On 05/30/2017 06:17 PM, Kevin A. McGrail wrote:
Bringing this back to sysadmins list:
On 5/30/2017 5:04 PM, Dave Jones wrote:
Is there a way I can force sa-update to download a certain version
ignoring the TXT record so I can verify that a recent tar.gz file is
good?
No, but since you have access to the files, you could put the 3 files
for a rule update in a dir and run off the local copy of the files. For
example:
sa-update -D -v --install=/tmp/1/1786853.tar.gz
I did this on my automasscheck server that is a full mail server
receiving spam and it's working fine/normal with the latest ruleqa build.
I have a slight concern after doing a diff on the two directories that
are the before (old) and after finding some differences in files:
Only in old/: 72_scores.cf
Only in old/: languages
Only in old/: MIRRORED.BY
Only in old/: sa-update-pubkey.txt
Only in old/: STATISTICS-set0-72_scores.cf.txt
Only in old/: STATISTICS-set1-72_scores.cf.txt
Only in old/: STATISTICS-set2-72_scores.cf.txt
Only in old/: STATISTICS-set3-72_scores.cf.txt
Only in old/: user_prefs.template
See attached full diff output.
Dave
Currently I have DNS updates disabled by creating a
/usr/local/bin/updateDNS.disabled file as a way to hold back and DNS
changes. Once I get the thumbs up, we just need to delete that file
and DNS changes will start happening again for the auto masscheck
processing nightly that should be ready to go.
I compared 1796841.tar.gz (a recent one) to 1786855.tar.gz (the last
before the server went down) and overall it looks gtg.
What are your thoughts on posting on dev@ and ask for some community input.
I am all for asking for help. I didn't know that I could ask the dev@
list for stuff like this so that's good to know.
I combined the run_part2 into the first run_nightly since there aren't
two parts actually so the steps will run all together.
Excellent. These scripts need streamlining and it's awesome you are
doing that.
Someone did remove the passphrase on the GPG key so it was completely
automated for a while.
"A while" = "years" like 7 or more...
Best,
KAM
[[email protected] 3.004001]# diff old/ updates_spamassassin_org
diff old/20_dnsbl_tests.cf updates_spamassassin_org/20_dnsbl_tests.cf
47,48c47
< # There is no charge for removal from the proxy, vulnerability, relay,
zombie, spam or DUHL databases.
< # (as per http://www.sorbs.net/overview.shtml 08-2016)
---
> # delist: $50 fee for RCVD_IN_SORBS_SPAM, others have free retest on request
75,78c74,78
< header RCVD_IN_SORBS_SPAM eval:check_rbl_sub('sorbs', '127.0.0.6')
< describe RCVD_IN_SORBS_SPAM SORBS: sender is a spam source
< tflags RCVD_IN_SORBS_SPAM net
< reuse RCVD_IN_SORBS_SPAM RCVD_IN_SORBS_SPAM
---
> # delist: $50 fee
> #header RCVD_IN_SORBS_SPAM eval:check_rbl_sub('sorbs', '127.0.0.6')
> #describe RCVD_IN_SORBS_SPAM SORBS: sender is a spam source
> #tflags RCVD_IN_SORBS_SPAM net
> #reuse RCVD_IN_SORBS_SPAM RCVD_IN_SORBS_SPAM
diff old/20_freemail_domains.cf updates_spamassassin_org/20_freemail_domains.cf
274c274
< freemail_domains opentransfer.com operamail.com oplusnet.com orange.*
orangehome.co.uk
---
> freemail_domains opentransfer.com operamail.com oplusnet.com orange.fr
> orangehome.co.uk orange.es orange.jo orange.pl
diff old/20_meta_tests.cf updates_spamassassin_org/20_meta_tests.cf
49,50c49,52
< header __MOZILLA_MUA X-Mailer =~ /\bMozilla\b/
< header __MOZILLA_MSGID MESSAGEID =~
/^<[A-F\d]{8}\.[A-F1-9][A-F\d]{0,7}\@\S+>$/m
---
> #See Bug 7411
> #header __MOZILLA_MUA X-Mailer =~ /\bMozilla\b/
> header __MOZILLA_MUA User-Agent =~ /^mozilla\b/i
> header __MOZILLA_MSGID MESSAGEID =~
> /^<(?:[a-f\d]{8}-(?:[a-f\d]{4}-){3}[a-f\d]{12}|[A-F\d]{8}\.[A-F1-9][A-F\d]{0,7})\@\S+>$/m
diff old/72_active.cf updates_spamassassin_org/72_active.cf
27a28,33
> ##{ ACH_CANCELLED
>
> meta ACH_CANCELLED __ACH_CANCELLED
> describe ACH_CANCELLED "ACH cancelled" fraud / phish
> ##} ACH_CANCELLED
>
130a137,142
> ##{ ADMITS_SPAM
>
> meta ADMITS_SPAM __ADMITS_SPAM && !__TO___LOWER &&
> !__MSOE_MID_WRONG_CASE && !__RP_MATCHES_RCVD
> describe ADMITS_SPAM Admits this is an ad
> ##} ADMITS_SPAM
>
138a151,157
> ##{ ADVANCE_FEE_2_NEW_FRM_MNY
>
> meta ADVANCE_FEE_2_NEW_FRM_MNY (__ADVANCE_FEE_2_NEW_FRM_MNY &&
> !__ADVANCE_FEE_3_NEW_FRM_MNY && !__ADVANCE_FEE_4_NEW_FRM_MNY &&
> !__ADVANCE_FEE_5_NEW_FRM_MNY) && !__HTML_LINK_IMAGE && !__HDRS_LCASE &&
> !__DOS_HAS_LIST_UNSUB && !__THREADED && !__HAS_SENDER && !__HAS_X_LOOP
> describe ADVANCE_FEE_2_NEW_FRM_MNY Advance Fee fraud form and lots of
> money
> #score ADVANCE_FEE_2_NEW_FRM_MNY 2.500
> ##} ADVANCE_FEE_2_NEW_FRM_MNY
>
161a181,186
> ##{ ADVANCE_FEE_3_NEW_FRM_MNY
>
> meta ADVANCE_FEE_3_NEW_FRM_MNY (__ADVANCE_FEE_3_NEW_FRM_MNY &&
> !__ADVANCE_FEE_4_NEW_FRM_MNY && !__ADVANCE_FEE_5_NEW_FRM_MNY) &&
> !__HTML_LINK_IMAGE && !__THREADED && !__HAS_SENDER && !__HAS_X_LOOP
> describe ADVANCE_FEE_3_NEW_FRM_MNY Advance Fee fraud form and lots of
> money
> ##} ADVANCE_FEE_3_NEW_FRM_MNY
>
175a201,212
> ##{ ADVANCE_FEE_4_NEW_FRM_MNY
>
> meta ADVANCE_FEE_4_NEW_FRM_MNY (__ADVANCE_FEE_4_NEW_FRM_MNY &&
> !__ADVANCE_FEE_5_NEW_FRM_MNY)
> describe ADVANCE_FEE_4_NEW_FRM_MNY Advance Fee fraud form and lots of
> money
> ##} ADVANCE_FEE_4_NEW_FRM_MNY
>
> ##{ ADVANCE_FEE_4_NEW_MONEY
>
> meta ADVANCE_FEE_4_NEW_MONEY (__ADVANCE_FEE_4_NEW_MONEY &&
> !__ADVANCE_FEE_5_NEW_MONEY) && !__HTML_LINK_IMAGE && !__TAG_EXISTS_CENTER &&
> !__HAS_SENDER && !__HAS_X_LOOP
> describe ADVANCE_FEE_4_NEW_MONEY Advance Fee fraud and lots of money
> ##} ADVANCE_FEE_4_NEW_MONEY
>
181a219,230
> ##{ ADVANCE_FEE_5_NEW_FRM_MNY
>
> meta ADVANCE_FEE_5_NEW_FRM_MNY __ADVANCE_FEE_5_NEW_FRM_MNY
> describe ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of
> money
> ##} ADVANCE_FEE_5_NEW_FRM_MNY
>
> ##{ ADVANCE_FEE_5_NEW_MONEY
>
> meta ADVANCE_FEE_5_NEW_MONEY __ADVANCE_FEE_5_NEW_MONEY &&
> !__BOUNCE_CTYPE
> describe ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money
> ##} ADVANCE_FEE_5_NEW_MONEY
>
211a261,266
> ##{ AXB_X_FF_SEZ_S
>
> header AXB_X_FF_SEZ_S X-Forefront-Antispam-Report =~
> /\bSFV\:SPM\b/
> describe AXB_X_FF_SEZ_S Forefront sez this is spam
> ##} AXB_X_FF_SEZ_S
>
233a289,295
> ##{ BIGNUM_EMAILS
>
> meta BIGNUM_EMAILS __BIGNUM_EMAILS && !__SPOOFED_URL
> && !__BUGGED_IMG
> describe BIGNUM_EMAILS Lots of email addresses/leads
> #score BIGNUM_EMAILS 3.00 # limit
> ##} BIGNUM_EMAILS
>
240a303,309
> ##{ BODY_SINGLE_URI
>
> meta BODY_SINGLE_URI (__BODY_SINGLE_WORD && __HAS_ANY_URI) &&
> !ALL_TRUSTED && !__HDRS_LCASE_KNOWN && !__FROM_ALL_NUMS && !__RCD_RDNS_SMTP
> describe BODY_SINGLE_URI Message body is only a URI
> #score BODY_SINGLE_URI 2.500 # limit
> ##} BODY_SINGLE_URI
>
298a368,387
> ##{ COMPENSATION
>
> describe COMPENSATION "Compensation"
> #score COMPENSATION 1.50 # limit
> ##} COMPENSATION
>
> ##{ COMPENSATION if !plugin(Mail::SpamAssassin::Plugin::DKIM)
>
> if !plugin(Mail::SpamAssassin::Plugin::DKIM)
> meta COMPENSATION __COMPENSATION && !__DOS_HAS_LIST_UNSUB &&
> !__HAS_X_LOOP && !__HAS_ERRORS_TO && !__UNSUB_LINK && !__OPERA_MID_NON_OP &&
> !__FB_S_STOCK && !__COMMENT_EXISTS && !__NOT_SPOOFED && !__LOCAL_PP_NONPPURL
> && !__NOT_A_PERSON && !__SUBSCRIPTION_INFO && !__DKIM_EXISTS && !__HAS_SENDER
> && !__RP_MATCHES_RCVD
> endif
> ##} COMPENSATION if !plugin(Mail::SpamAssassin::Plugin::DKIM)
>
> ##{ COMPENSATION ifplugin Mail::SpamAssassin::Plugin::DKIM
>
> ifplugin Mail::SpamAssassin::Plugin::DKIM
> meta COMPENSATION __COMPENSATION && !__DOS_HAS_LIST_UNSUB &&
> !__HAS_X_LOOP && !__HAS_ERRORS_TO && !__UNSUB_LINK && !__OPERA_MID_NON_OP &&
> !__FB_S_STOCK && !__COMMENT_EXISTS && !__NOT_SPOOFED && !__LOCAL_PP_NONPPURL
> && !__NOT_A_PERSON && !__SUBSCRIPTION_INFO && !__DKIM_EXISTS && !__HAS_SENDER
> && !__RP_MATCHES_RCVD && !__DKIM_DEPENDABLE
> endif
> ##} COMPENSATION ifplugin Mail::SpamAssassin::Plugin::DKIM
>
337a427,432
> ##{ DEAR_BENEFICIARY
>
> body DEAR_BENEFICIARY
> /\b(?:De[ae]r\s|At+(?:ention|n):?\s?)(?:\S+\s)?Ben[ei]ficiary\b/i
> describe DEAR_BENEFICIARY Dear Beneficiary:
> ##} DEAR_BENEFICIARY
>
473a569,573
> ##{ FAKE_REPLY_A1
>
> meta FAKE_REPLY_A1 (__SUBJ_RE && __MISSING_REPLY &&
> __MISSING_REF && __BOTH_INR_AND_REF)
> ##} FAKE_REPLY_A1
>
503a604,629
> ##{ FILL_THIS_FORM_FRAUD_PHISH ifplugin
> Mail::SpamAssassin::Plugin::ReplaceTags
>
> ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
> meta FILL_THIS_FORM_FRAUD_PHISH __FILL_THIS_FORM_FRAUD_PHISH &&
> !__UNSUB_LINK && !__SPOOFED_URL && !__DOS_LINK && !__CAN_HELP && !__VIA_ML &&
> !__COMMENT_EXISTS && !__HAS_IN_REPLY_TO && !__THREADED
> describe FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
> endif
> ##} FILL_THIS_FORM_FRAUD_PHISH ifplugin
> Mail::SpamAssassin::Plugin::ReplaceTags
>
> ##{ FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
>
> ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
> meta FILL_THIS_FORM_LOAN __FILL_THIS_FORM_LOAN &&
> !__COMMENT_EXISTS && !__HTML_LINK_IMAGE
> describe FILL_THIS_FORM_LOAN Answer loan question(s)
> # score FILL_THIS_FORM_LOAN 2.0
> endif
> ##} FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
>
> ##{ FILL_THIS_FORM_LONG ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
>
> ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
> meta FILL_THIS_FORM_LONG __FILL_THIS_FORM_LONG && !__VIA_ML
> && !__DOS_HAS_LIST_UNSUB && !__THREADED && !__TRAVEL_MANY
> describe FILL_THIS_FORM_LONG Fill in a form with personal
> information
> # score FILL_THIS_FORM_LONG 2.00 # limit
> endif
> ##} FILL_THIS_FORM_LONG ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
>
577a704,709
> ##{ FROM_MISSP_DYNIP
>
> meta FROM_MISSP_DYNIP __FROM_RUNON && RDNS_DYNAMIC
> describe FROM_MISSP_DYNIP From misspaced + dynamic rDNS
> ##} FROM_MISSP_DYNIP
>
928a1061,1070
> ##{ HK_NAME_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail if (version
> >= 3.004000)
>
> ifplugin Mail::SpamAssassin::Plugin::FreeMail
> if (version >= 3.004000)
> meta HK_NAME_MR_MRS __HK_NAME_MR_MRS && !FREEMAIL_FROM
> # score HK_NAME_MR_MRS 1.0
> endif
> endif
> ##} HK_NAME_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail if (version
> >= 3.004000)
>
952a1095,1099
> ##{ HK_SCAM_N3
>
> body HK_SCAM_N3 /\bdirect telephone numbers?\b/i
> ##} HK_SCAM_N3
>
968,972d1114
< ##{ IMG_DIRECT_TO_MX
<
< meta IMG_DIRECT_TO_MX __DOS_DIRECT_TO_MX && __JPEG_ATTACH &&
__ONE_IMG && __IMG_LE_300K
< ##} IMG_DIRECT_TO_MX
<
1029a1172,1178
> ##{ LIST_PARTIAL_SHORT_MSG
>
> meta LIST_PARTIAL_SHORT_MSG __LIST_PARTIAL_SHORT_MSG &&
> !__DKIM_EXISTS
> describe LIST_PARTIAL_SHORT_MSG Incomplete mailing list headers +
> short message
> #score LIST_PARTIAL_SHORT_MSG 2.500 # limit
> ##} LIST_PARTIAL_SHORT_MSG
>
1136a1286,1297
> ##{ MILLION_USD
>
> body MILLION_USD /Million\b.{0,40}\b(?:United States?
> Dollars?|USD)/i
> describe MILLION_USD Talks about millions of dollars
> #score MILLION_USD 2
> lang de describe MILLION_USD Erw�hnt Millonen von Dollar
> lang fr describe MILLION_USD Phrase cl� d'escroquerie nig�rienne
> (millions of dollars)
> lang nl describe MILLION_USD Heeft het over miljoenen
> dollars
> lang pl describe MILLION_USD O milionach dolar�w
> lang pt_BR describe MILLION_USD Fala sobre milh�es de d�lares
> ##} MILLION_USD
>
1166a1328,1346
> ##{ MONEY_ATM_CARD
>
> meta MONEY_ATM_CARD __MONEY_ATM_CARD && !__COMMENT_EXISTS &&
> !__TAG_EXISTS_STYLE
> describe MONEY_ATM_CARD Lots of money on an ATM card
> ##} MONEY_ATM_CARD
>
> ##{ MONEY_BARRISTER
>
> meta MONEY_BARRISTER __BARRISTER && LOTS_OF_MONEY
> describe MONEY_BARRISTER Lots of money from a UK lawyer
> #score MONEY_BARRISTER 1.000 # limit
> ##} MONEY_BARRISTER
>
> ##{ MONEY_FORM
>
> meta MONEY_FORM __MONEY_FORM && !__FB_TOUR && !__FM_MY_PRICE &&
> !__FR_SPACING_8 && !__COMMENT_EXISTS && !__CAN_HELP
> describe MONEY_FORM Lots of money if you fill out a form
> ##} MONEY_FORM
>
1188c1368
< ##{ MONEY_LOTTERY
---
> ##{ MONEY_FROM_41
1190,1192c1370,1380
< meta MONEY_LOTTERY __MONEY_LOTTERY && !__CAN_HELP &&
!__HTML_LINK_IMAGE && !__DOS_HAS_LIST_UNSUB && !__MSGID_APPLEMAIL && __THREADED
< describe MONEY_LOTTERY Lots of money from a lottery
< ##} MONEY_LOTTERY
---
> meta MONEY_FROM_41 __MONEY_FROM_41
> describe MONEY_FROM_41 Lots of money from Africa
> #score MONEY_FROM_41 2.00 # limit
> ##} MONEY_FROM_41
>
> ##{ MONEY_FROM_MISSP
>
> meta MONEY_FROM_MISSP LOTS_OF_MONEY && __FROM_MISSPACED && !__MIME_QP
> describe MONEY_FROM_MISSP Lots of money and misspaced From
> #score MONEY_FROM_MISSP 2.000 # limit
> ##} MONEY_FROM_MISSP
1237a1426,1441
> ##{ OBFU_DOC_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
>
> ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
> mimeheader OBFU_DOC_ATTACH Content-Type =~
> m,\bapplication/octet-stream\b.+\.(?:doc|rtf)\b,i
> describe OBFU_DOC_ATTACH MS Document attachment with generic MIME
> type
> endif
> ##} OBFU_DOC_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
>
> ##{ OBFU_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
>
> ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
> mimeheader OBFU_HTML_ATTACH Content-Type =~
> m,\bapplication/octet-stream\b.+\.html?\b,i
> describe OBFU_HTML_ATTACH HTML attachment with non-text MIME type
> endif
> ##} OBFU_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
>
1253a1458,1462
> ##{ ONLINE_MKTG_CNSLT
>
> body ONLINE_MKTG_CNSLT /\bonline marketing consultant\b/i
> ##} ONLINE_MKTG_CNSLT
>
1269a1479,1486
> ##{ PDS_TO_EQ_FROM_NAME if
> can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
>
> if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
> meta PDS_TO_EQ_FROM_NAME (__PDS_TO_EQ_FROM_NAME_1 ||
> __PDS_TO_EQ_FROM_NAME_2)
> describe PDS_TO_EQ_FROM_NAME From: name same as To: address
> endif
> ##} PDS_TO_EQ_FROM_NAME if
> can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
>
1719a1937,1942
> ##{ RISK_FREE
>
> meta RISK_FREE __FRAUD_IOV && !__UNSUB_LINK && !__VIA_ML &&
> !__HTML_LINK_IMAGE && !__SUBSCRIPTION_INFO && !__HS_SUBJ_RE_FW &&
> !__LCL__ENV_AND_HDR_FROM_MATCH
> describe RISK_FREE No risk!
> ##} RISK_FREE
>
1735a1959,1964
> ##{ SERGIO_SUBJECT_VIAGRA01
>
> header SERGIO_SUBJECT_VIAGRA01 Subject =~
> /v[^a-zA-Z0-9]{0,3}[i1l][^a-zA-Z0-9]{0,3}a[^a-zA-Z0-9
> ]{0,3}g[^a-zA-Z0-9]{0,3}r[^a-zA-Z0-9]{0,3}a/i
> describe SERGIO_SUBJECT_VIAGRA01 Viagra garbled subject
> ##} SERGIO_SUBJECT_VIAGRA01
>
1839a2069,2073
> ##{ STOX_BOUND_090909_B
>
> header STOX_BOUND_090909_B Content-Type:raw =~ /;\n
> boundary=\"------------0[0-9]0[0-9]0[0-9]0[0-9]0[0-9]0[0-9]0[0-9]0[0-9]0[0-9]0[0-9]0[0-9]0[0-9]\"$/s
> ##} STOX_BOUND_090909_B
>
1863a2098,2103
> ##{ SUBJ_BROKEN_WORD
>
> meta SUBJ_BROKEN_WORD __SUBJ_BROKEN_WORD && !ALL_TRUSTED &&
> !__RP_MATCHES_RCVD && !__COMMENT_EXISTS && !__MIME_QP &&
> !__DOS_HAS_LIST_UNSUB && !__HAS_IN_REPLY_TO && !__THREADED &&
> !__MSGID_JAVAMAIL && !__DKIM_EXISTS && !__RCD_RDNS_MAIL_MESSY &&
> !__MSGID_OK_DIGITS && !__NOT_A_PERSON && !__LCL__ENV_AND_HDR_FROM_MATCH
> describe SUBJ_BROKEN_WORD Subject contains odd word break
> ##} SUBJ_BROKEN_WORD
>
1898a2139,2145
> ##{ TEQF_USR_POLITE
>
> meta TEQF_USR_POLITE __TO_EQ_FROM_USR_NN && __FRAUD_IRT
> describe TEQF_USR_POLITE To and from user nearly same + polite
> greeting
> #score TEQF_USR_POLITE 2.000 # limit
> ##} TEQF_USR_POLITE
>
1943a2191,2196
> ##{ TO_NO_BRKTS_DYNIP
>
> meta TO_NO_BRKTS_DYNIP __TO_NO_BRKTS_DYNIP && !__NAME_IS_EMAIL &&
> !__MSGID_OK_HEX && !__UNSUB_LINK && !__THREADED && !__RCD_RDNS_MX_MESSY &&
> !__COMMENT_EXISTS && !__MUA_TBIRD && !__CD && !__ML1 && !__RP_MATCHES_RCVD &&
> !__SUBSCRIPTION_INFO && !__HAS_THREAD_INDEX && !__IS_EXCH
> describe TO_NO_BRKTS_DYNIP To: lacks brackets and dynamic rDNS
> ##} TO_NO_BRKTS_DYNIP
>
2019a2273,2277
> ##{ TVD_BODY_END_STAR
>
> body TVD_BODY_END_STAR /(?:[A-Z0-9]+\*[,\s]+){2}/
> ##} TVD_BODY_END_STAR
>
2310,2329d2567
< ##{ T_COMPENSATION
<
< describe T_COMPENSATION "Compensation"
< #score T_COMPENSATION 1.50 # limit
< ##} T_COMPENSATION
<
< ##{ T_COMPENSATION if !plugin(Mail::SpamAssassin::Plugin::DKIM)
<
< if !plugin(Mail::SpamAssassin::Plugin::DKIM)
< meta T_COMPENSATION __COMPENSATION && !__DOS_HAS_LIST_UNSUB &&
!__HAS_X_LOOP && !__HAS_ERRORS_TO && !__UNSUB_LINK && !__OPERA_MID_NON_OP &&
!__FB_S_STOCK && !__COMMENT_EXISTS && !__NOT_SPOOFED && !__LOCAL_PP_NONPPURL &&
!__NOT_A_PERSON && !__SUBSCRIPTION_INFO && !__DKIM_EXISTS && !__HAS_SENDER &&
!__RP_MATCHES_RCVD
< endif
< ##} T_COMPENSATION if !plugin(Mail::SpamAssassin::Plugin::DKIM)
<
< ##{ T_COMPENSATION ifplugin Mail::SpamAssassin::Plugin::DKIM
<
< ifplugin Mail::SpamAssassin::Plugin::DKIM
< meta T_COMPENSATION __COMPENSATION && !__DOS_HAS_LIST_UNSUB &&
!__HAS_X_LOOP && !__HAS_ERRORS_TO && !__UNSUB_LINK && !__OPERA_MID_NON_OP &&
!__FB_S_STOCK && !__COMMENT_EXISTS && !__NOT_SPOOFED && !__LOCAL_PP_NONPPURL &&
!__NOT_A_PERSON && !__SUBSCRIPTION_INFO && !__DKIM_EXISTS && !__HAS_SENDER &&
!__RP_MATCHES_RCVD && !__DKIM_DEPENDABLE
< endif
< ##} T_COMPENSATION ifplugin Mail::SpamAssassin::Plugin::DKIM
<
2346,2351d2583
< ##{ T_DEAR_BENEFICIARY
<
< body T_DEAR_BENEFICIARY
/\b(?:De[ae]r\s|At+(?:ention|n):?\s?)(?:\S+\s)?Ben[ei]ficiary\b/i
< describe T_DEAR_BENEFICIARY Dear Beneficiary:
< ##} T_DEAR_BENEFICIARY
<
2409,2434d2640
< ##{ T_FILL_THIS_FORM_FRAUD_PHISH ifplugin
Mail::SpamAssassin::Plugin::ReplaceTags
<
< ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
< meta T_FILL_THIS_FORM_FRAUD_PHISH __FILL_THIS_FORM_FRAUD_PHISH &&
!__UNSUB_LINK && !__SPOOFED_URL && !__DOS_LINK && !__CAN_HELP && !__VIA_ML &&
!__COMMENT_EXISTS && !__HAS_IN_REPLY_TO && !__THREADED
< describe T_FILL_THIS_FORM_FRAUD_PHISH Answer suspicious question(s)
< endif
< ##} T_FILL_THIS_FORM_FRAUD_PHISH ifplugin
Mail::SpamAssassin::Plugin::ReplaceTags
<
< ##{ T_FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
<
< ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
< meta T_FILL_THIS_FORM_LOAN __FILL_THIS_FORM_LOAN &&
!__COMMENT_EXISTS && !__HTML_LINK_IMAGE
< describe T_FILL_THIS_FORM_LOAN Answer loan question(s)
< # score T_FILL_THIS_FORM_LOAN 2.0
< endif
< ##} T_FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
<
< ##{ T_FILL_THIS_FORM_LONG ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
<
< ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
< meta T_FILL_THIS_FORM_LONG __FILL_THIS_FORM_LONG &&
!__VIA_ML && !__DOS_HAS_LIST_UNSUB && !__THREADED && !__TRAVEL_MANY
< describe T_FILL_THIS_FORM_LONG Fill in a form with personal
information
< # score T_FILL_THIS_FORM_LONG 2.00 # limit
< endif
< ##} T_FILL_THIS_FORM_LONG ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
<
2525,2534d2730
< ##{ T_HK_NAME_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail if
(version >= 3.004000)
<
< ifplugin Mail::SpamAssassin::Plugin::FreeMail
< if (version >= 3.004000)
< meta T_HK_NAME_MR_MRS __HK_NAME_MR_MRS && !FREEMAIL_FROM
< # score T_HK_NAME_MR_MRS 1.0
< endif
< endif
< ##} T_HK_NAME_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail if
(version >= 3.004000)
<
2648c2844
< meta T_OBFU_ATTACH_MISSP __FROM_RUNON && (T_OBFU_HTML_ATTACH ||
OBFU_TEXT_ATTACH || T_OBFU_DOC_ATTACH || T_OBFU_PDF_ATTACH || T_OBFU_JPG_ATTACH
|| T_OBFU_GIF_ATTACH)
---
> meta T_OBFU_ATTACH_MISSP __FROM_RUNON && (OBFU_HTML_ATTACH ||
> OBFU_TEXT_ATTACH || OBFU_DOC_ATTACH || T_OBFU_PDF_ATTACH || T_OBFU_JPG_ATTACH
> || T_OBFU_GIF_ATTACH)
2653,2660d2848
< ##{ T_OBFU_DOC_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
<
< ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
< mimeheader T_OBFU_DOC_ATTACH Content-Type =~
m,\bapplication/octet-stream\b.+\.(?:doc|rtf)\b,i
< describe T_OBFU_DOC_ATTACH MS Document attachment with generic MIME
type
< endif
< ##} T_OBFU_DOC_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
<
2669,2676d2856
< ##{ T_OBFU_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
<
< ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
< mimeheader T_OBFU_HTML_ATTACH Content-Type =~
m,\bapplication/octet-stream\b.+\.html?\b,i
< describe T_OBFU_HTML_ATTACH HTML attachment with non-text MIME type
< endif
< ##} T_OBFU_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
<
2708,2715d2887
< ##{ T_PDS_TO_EQ_FROM_NAME if
can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
<
< if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
< meta T_PDS_TO_EQ_FROM_NAME (__PDS_TO_EQ_FROM_NAME_1 ||
__PDS_TO_EQ_FROM_NAME_2)
< describe T_PDS_TO_EQ_FROM_NAME From: name same as To: address
< endif
< ##} T_PDS_TO_EQ_FROM_NAME if
can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
<
3386a3559,3560
> meta __ACH_CANCELLED (__ACH_CANCELLED_01 || __ACH_CANCELLED_02
> || __ACH_CANCELLED_03 || __ACH_CANCELLED_04) && (__HAS_ANY_URI ||
> LOTS_OF_MONEY)
>
3435c3609,3611
< meta __ADVANCE_FEE_2_NEW (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH
+ __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + T_DEAR_BENEFICIARY +
DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT +
__EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM +
__FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR +
__FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB +
__FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB +
__FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ +
__FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW +
__FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY +
__IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY +
__LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 +
__LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET +
__PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + UNCLAIMED_MONEY +
__WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT +
__YOUR_FUND + __YOUR_PERM + __YOU_WON > 1) && !__THREAD_INDEX_GOOD
---
> body __ADMITS_SPAM /\bth(?:e[- ]+above|is)(?:\?+s|[- ]+is)[-
> ]+(?:intended[- ]+as[- ]+)?an?[- ]+(?:email[- ]+)?[a@]dvert[i1l]sement\b/i
>
> meta __ADVANCE_FEE_2_NEW (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH
> + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY +
> DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT +
> __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM +
> __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR +
> __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB +
> __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB +
> __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ +
> __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW +
> __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY +
> __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY +
> __LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 +
> __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET +
> __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + UNCLAIMED_MONEY +
> __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT +
> __YOUR_FUND + __YOUR_PERM + __YOU_WON > 1) && !__THREAD_INDEX_GOOD
3438a3615,3616
> meta __ADVANCE_FEE_2_NEW_FRM_MNY __FILL_THIS_FORM && LOTS_OF_MONEY &&
> __ADVANCE_FEE_2_NEW
>
3441c3619
< meta __ADVANCE_FEE_3_NEW (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH
+ __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + T_DEAR_BENEFICIARY +
DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT +
__EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM +
__FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR +
__FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB +
__FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB +
__FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ +
__FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW +
__FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY +
__IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY +
__LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 +
__LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET +
__PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + UNCLAIMED_MONEY +
__WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT +
__YOUR_FUND + __YOUR_PERM + __YOU_WON > 2) && !__THREAD_INDEX_GOOD
---
> meta __ADVANCE_FEE_3_NEW (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH
> + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY +
> DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT +
> __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM +
> __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR +
> __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB +
> __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB +
> __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ +
> __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW +
> __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY +
> __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY +
> __LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 +
> __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET +
> __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + UNCLAIMED_MONEY +
> __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT +
> __YOUR_FUND + __YOUR_PERM + __YOU_WON > 2) && !__THREAD_INDEX_GOOD
3449c3627
< meta __ADVANCE_FEE_4_NEW (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH
+ __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + T_DEAR_BENEFICIARY +
DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT +
__EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM +
__FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR +
__FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB +
__FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB +
__FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ +
__FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW +
__FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY +
__IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY +
__LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 +
__LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET +
__PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + UNCLAIMED_MONEY +
__WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT +
__YOUR_FUND + __YOUR_PERM + __YOU_WON > 3) && !__THREAD_INDEX_GOOD
---
> meta __ADVANCE_FEE_4_NEW (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH
> + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY +
> DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT +
> __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM +
> __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR +
> __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB +
> __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB +
> __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ +
> __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW +
> __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY +
> __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY +
> __LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 +
> __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET +
> __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + UNCLAIMED_MONEY +
> __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT +
> __YOUR_FUND + __YOUR_PERM + __YOU_WON > 3) && !__THREAD_INDEX_GOOD
3452a3631,3632
> meta __ADVANCE_FEE_4_NEW_FRM_MNY __FILL_THIS_FORM && LOTS_OF_MONEY &&
> __ADVANCE_FEE_4_NEW
>
3455c3635
< meta __ADVANCE_FEE_5_NEW (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH
+ __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + T_DEAR_BENEFICIARY +
DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT +
__EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM +
__FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR +
__FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB +
__FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB +
__FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ +
__FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW +
__FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY +
__IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY +
__LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 +
__LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET +
__PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + UNCLAIMED_MONEY +
__WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT +
__YOUR_FUND + __YOUR_PERM + __YOU_WON > 4) && !__THREAD_INDEX_GOOD
---
> meta __ADVANCE_FEE_5_NEW (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH
> + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY +
> DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT +
> __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM +
> __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR +
> __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB +
> __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB +
> __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ +
> __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW +
> __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY +
> __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY +
> __LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 +
> __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET +
> __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT + UNCLAIMED_MONEY +
> __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT +
> __YOUR_FUND + __YOUR_PERM + __YOU_WON > 4) && !__THREAD_INDEX_GOOD
3532a3713,3716
> body __BIGNUM_EMAILS
> /\b(?:thousand|million|\d[,\d]{4,})\s(?:(?!and|or|your|place|baby)\w+\s)?(?:e-?mail\saddresses|leads|names)\b/i
>
> meta __BODY_SINGLE_WORD __BODY_TEXT_LINE < 3 && !__EMPTY_BODY &&
> !__SMIME_MESSAGE && ((__SINGLE_WORD_LINE && !__SINGLE_WORD_SUBJ) ||
> __SINGLE_WORD_LINE > 1)
>
3902c4086
< meta __FORM_FRAUD (__FILL_THIS_FORM || __FILL_THIS_FORM_SHORT) &&
(__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR +
__FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT +
__FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV +
__FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG +
__FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY +
__FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN +
__FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW +
__FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO +
__FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD +
__BACK_SCRATCH + __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY
+ __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + T_DEAR_BENEFICIARY +
DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC +
__DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES +
__FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT
+ __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL
+ __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT +
__LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 +
__LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE +
__NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM +
__SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED +
__TRUNK_BOX + __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY +
__YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM +
__YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY +
__PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 1)
---
> meta __FORM_FRAUD (__FILL_THIS_FORM || __FILL_THIS_FORM_SHORT) &&
> (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR +
> __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT +
> __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV +
> __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG +
> __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY +
> __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN +
> __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW +
> __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO +
> __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD +
> __BACK_SCRATCH + __BARRISTER + __BENEFICIARY + __COMPENSATION +
> __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL +
> DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN +
> __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER +
> __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH +
> __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY
> + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT +
> __LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI +
> __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS
> + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF +
> __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT +
> __TRTMT_DEFILED + __TRUNK_BOX + __UN + UNCLAIMED_MONEY + __WIDOW +
> __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK +
> __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM +
> T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK +
> __CHARITY > 1)
3904c4088
< meta __FORM_FRAUD_3 (__FILL_THIS_FORM || __FILL_THIS_FORM_SHORT) &&
(__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR +
__FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT +
__FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV +
__FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG +
__FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY +
__FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN +
__FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW +
__FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO +
__FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD +
__BACK_SCRATCH + __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY
+ __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + T_DEAR_BENEFICIARY +
DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC +
__DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES +
__FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT
+ __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL
+ __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT +
__LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 +
__LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE +
__NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM +
__SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED +
__TRUNK_BOX + __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY +
__YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM +
__YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY +
__PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 3)
---
> meta __FORM_FRAUD_3 (__FILL_THIS_FORM || __FILL_THIS_FORM_SHORT) &&
> (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR +
> __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT +
> __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV +
> __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG +
> __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY +
> __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN +
> __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW +
> __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO +
> __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD +
> __BACK_SCRATCH + __BARRISTER + __BENEFICIARY + __COMPENSATION +
> __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL +
> DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN +
> __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER +
> __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH +
> __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY
> + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT +
> __LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI +
> __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS
> + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF +
> __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT +
> __TRTMT_DEFILED + __TRUNK_BOX + __UN + UNCLAIMED_MONEY + __WIDOW +
> __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK +
> __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM +
> T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK +
> __CHARITY > 3)
3906c4090
< meta __FORM_FRAUD_5 (__FILL_THIS_FORM || __FILL_THIS_FORM_SHORT) &&
(__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR +
__FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT +
__FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV +
__FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG +
__FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY +
__FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN +
__FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW +
__FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO +
__FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD +
__BACK_SCRATCH + __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY
+ __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + T_DEAR_BENEFICIARY +
DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC +
__DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER + __FEES +
__FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT
+ __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL
+ __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT +
__LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 +
__LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE +
__NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM +
__SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED +
__TRUNK_BOX + __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY +
__YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM +
__YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY +
__PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 5)
---
> meta __FORM_FRAUD_5 (__FILL_THIS_FORM || __FILL_THIS_FORM_SHORT) &&
> (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR +
> __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT +
> __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV +
> __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG +
> __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY +
> __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN +
> __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW +
> __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO +
> __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD +
> __BACK_SCRATCH + __BARRISTER + __BENEFICIARY + __COMPENSATION +
> __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL +
> DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN +
> __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + T_EMRCP + __EX_CUSTOMER +
> __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH +
> __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY
> + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT +
> __LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI +
> __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS
> + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF +
> __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT +
> __TRTMT_DEFILED + __TRUNK_BOX + __UN + UNCLAIMED_MONEY + __WIDOW +
> __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK +
> __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM +
> T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK +
> __CHARITY > 5)
4061,4062d4244
< body __GET_TICKET /\b(?:buy|order) your (?:lott(?:o|ery)
)?tickets?\b/i
<
4326a4509,4510
> meta __LIST_PARTIAL_SHORT_MSG __HTML_LENGTH_0000_1024 &&
> __LIST_PARTIAL
>
4490c4674,4676
< meta __MONEY_FRAUD_3 LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV +
__FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP +
__FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY +
__FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK +
__FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY +
__FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC +
__FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF +
__FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ +
__FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE +
__AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER +
__BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER +
__DEAD_PARENT + __DEAL + T_DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED +
__DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE +
T_EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD +
__FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK +
__INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 +
__LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY
+ T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER +
__LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET +
__NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS +
__THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX + __UN + UNCLAIMED_MONEY +
__WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT +
__YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON +
T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS +
__RANDOM_PICK + __CHARITY > 3)
---
> meta __MONEY_ATM_CARD LOTS_OF_MONEY && __ATM_CARD
>
> meta __MONEY_FORM LOTS_OF_MONEY && __FILL_THIS_FORM
4492c4678
< meta __MONEY_FRAUD_5 LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV +
__FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP +
__FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY +
__FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK +
__FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY +
__FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC +
__FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF +
__FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ +
__FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE +
__AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER +
__BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER +
__DEAD_PARENT + __DEAL + T_DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED +
__DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE +
T_EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD +
__FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK +
__INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 +
__LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY
+ T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER +
__LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET +
__NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS +
__THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX + __UN + UNCLAIMED_MONEY +
__WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT +
__YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON +
T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS +
__RANDOM_PICK + __CHARITY > 5)
---
> meta __MONEY_FRAUD_3 LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV +
> __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP +
> __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY +
> __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK +
> __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY +
> __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC +
> __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF +
> __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ +
> __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE +
> __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER +
> __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER +
> __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED +
> __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE +
> T_EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD +
> __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK +
> __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2
> + __LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT + __LOTTO_RELATED +
> __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS +
> __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN +
> __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT +
> __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX
> + __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY +
> __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM +
> __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY +
> __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 3)
4494c4680
< meta __MONEY_FRAUD_8 LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV +
__FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP +
__FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY +
__FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK +
__FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY +
__FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC +
__FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF +
__FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ +
__FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE +
__AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER +
__BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER +
__DEAD_PARENT + __DEAL + T_DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED +
__DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE +
T_EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD +
__FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK +
__INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 +
__LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY
+ T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER +
__LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET +
__NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS +
__THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX + __UN + UNCLAIMED_MONEY +
__WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT +
__YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON +
T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS +
__RANDOM_PICK + __CHARITY > 8)
---
> meta __MONEY_FRAUD_5 LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV +
> __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP +
> __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY +
> __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK +
> __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY +
> __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC +
> __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF +
> __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ +
> __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE +
> __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER +
> __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER +
> __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED +
> __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE +
> T_EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD +
> __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK +
> __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2
> + __LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT + __LOTTO_RELATED +
> __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS +
> __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN +
> __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT +
> __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX
> + __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY +
> __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM +
> __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY +
> __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 5)
4496c4682,4684
< meta __MONEY_LOTTERY LOTS_OF_MONEY && (__LOTTO_WINNINGS + __LOTTO_WIN_01
+ __YOU_WON + __LOTTO_AGENT_01 + __LOTTO_AGENT_02 + __LOTTO_DEPT +
T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __LOTTO_ADMITS + __LOTTO_RELATED +
DEAR_WINNER + __LOTTO_VERIFY + __GET_TICKET > 1)
---
> meta __MONEY_FRAUD_8 LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV +
> __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP +
> __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY +
> __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK +
> __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY +
> __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC +
> __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF +
> __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ +
> __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE +
> __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER +
> __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER +
> __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED +
> __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE +
> T_EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD +
> __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK +
> __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2
> + __LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT + __LOTTO_RELATED +
> __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS +
> __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN +
> __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT +
> __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX
> + __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY +
> __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM +
> __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY +
> __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 8)
>
> meta __MONEY_FROM_41 __NSL_RCVD_FROM_41 && LOTS_OF_MONEY
4527a4716,4717
> header __NAME_IS_EMAIL From:raw =~
> /\w\@[\w.-]+\.\w\w+["'`]*\s*<\w+\@\w/
>
4815a5006,5008
> body __SINGLE_WORD_LINE /^\s?\S{1,60}\s?$/
> tflags __SINGLE_WORD_LINE multiple maxhits=2
>
4966a5160,5161
>
> meta __TO_NO_BRKTS_DYNIP __TO_NO_ARROWS_R && !__TO_UNDISCLOSED &&
> RDNS_DYNAMIC
Only in old/: 72_scores.cf
Only in old/: languages
Only in old/: MIRRORED.BY
Only in old/: sa-update-pubkey.txt
Only in old/: STATISTICS-set0-72_scores.cf.txt
Only in old/: STATISTICS-set1-72_scores.cf.txt
Only in old/: STATISTICS-set2-72_scores.cf.txt
Only in old/: STATISTICS-set3-72_scores.cf.txt
Only in old/: user_prefs.template
