From 46cfc9e266cd06a7c9986a2c8e4a027e077e0ac0 Mon Sep 17 00:00:00 2001 From: Stoiko Ivanov Date: Tue, 13 Jul 2021 13:00:51 +0200 Subject: [PATCH] update SpamAssassin signatures Signed-off-by: Stoiko Ivanov --- sa-updates/20_aux_tlds.cf | 1 + sa-updates/20_dnsbl_tests.cf | 30 +- sa-updates/20_freemail_domains.cf | 2 +- sa-updates/20_head_tests.cf | 25 +- sa-updates/20_ratware.cf | 3 +- sa-updates/25_uribl.cf | 40 +- sa-updates/50_scores.cf | 11 +- sa-updates/60_bayes_stopwords.cf | 66 +-- sa-updates/72_active.cf | 661 ++++++++++++++++--------- sa-updates/72_scores.cf | 535 ++++++++++---------- sa-updates/73_sandbox_manual_scores.cf | 5 + sa-updates/languages | Bin 101479 -> 107916 bytes 12 files changed, 777 insertions(+), 602 deletions(-) diff --git a/sa-updates/20_aux_tlds.cf b/sa-updates/20_aux_tlds.cf index 1ab7557..551bb61 100644 --- a/sa-updates/20_aux_tlds.cf +++ b/sa-updates/20_aux_tlds.cf @@ -740,6 +740,7 @@ util_rb_3tld blogspot.com.es util_rb_3tld no-ip.co.uk # util_rb_3tld mobile.web.tr +util_rb_3tld ct.sendgrid.net endif diff --git a/sa-updates/20_dnsbl_tests.cf b/sa-updates/20_dnsbl_tests.cf index 69a2912..d905124 100644 --- a/sa-updates/20_dnsbl_tests.cf +++ b/sa-updates/20_dnsbl_tests.cf @@ -207,45 +207,27 @@ reuse RCVD_IN_IADB_VOUCHED # https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6247 # Certified: # https://www.validity.com/resource-center/fact-sheet-certification/ -# (replaces RCVD_IN_BSP_TRUSTED, RCVD_IN_BSP_OTHER, RCVD_IN_SSC_TRUSTED_COI) +# (replaces RCVD_IN_BSP_TRUSTED, RCVD_IN_BSP_OTHER, RCVD_IN_SSC_TRUSTED_COI, RCVD_IN_RP_CERTIFIED) header RCVD_IN_VALIDITY_CERTIFIED eval:check_rbl_txt('ssc-firsttrusted', 'sa-trusted.bondedsender.org.') describe RCVD_IN_VALIDITY_CERTIFIED Sender in Validity Certification - Contact certification@validity.com tflags RCVD_IN_VALIDITY_CERTIFIED net nice publish -reuse RCVD_IN_VALIDITY_CERTIFIED +reuse RCVD_IN_VALIDITY_CERTIFIED RCVD_IN_RP_CERTIFIED # Safe: # https://www.validity.com/resource-center/fact-sheet-certification/ -# (replaces HABEAS_ACCREDITED_COI, HABEAS_ACCREDITED_SOI, HABEAS_CHECKED) +# (replaces HABEAS_ACCREDITED_COI, HABEAS_ACCREDITED_SOI, HABEAS_CHECKED, RCVD_IN_RP_SAFE) header RCVD_IN_VALIDITY_SAFE eval:check_rbl_txt('ssc-firsttrusted','sa-accredit.habeas.com.') describe RCVD_IN_VALIDITY_SAFE Sender in Validity Safe - Contact certification@validity.com tflags RCVD_IN_VALIDITY_SAFE net nice publish -reuse RCVD_IN_VALIDITY_SAFE +reuse RCVD_IN_VALIDITY_SAFE RCVD_IN_RP_SAFE # Validity RPBL (née Return Path Reputation Network Blacklist - RNBL): # https://www.senderscore.org/blocklistlookup/ +# (replaces RCVD_IN_RP_RNBL) header RCVD_IN_VALIDITY_RPBL eval:check_rbl('rnbl-lastexternal','bl.score.senderscore.com.') describe RCVD_IN_VALIDITY_RPBL Relay in Validity RPBL, https://senderscore.org/blocklistlookup/ tflags RCVD_IN_VALIDITY_RPBL net publish -reuse RCVD_IN_VALIDITY_RPBL - -# temporary -meta RCVD_IN_RP_CERTIFIED RCVD_IN_VALIDITY_CERTIFIED -describe RCVD_IN_RP_CERTIFIED RCVD_IN_RP_CERTIFIED renamed to RCVD_IN_VALIDITY_CERTIFIED, please update local rules -score RCVD_IN_RP_CERTIFIED -0.001 -tflags RCVD_IN_RP_CERTIFIED net nice publish -reuse RCVD_IN_RP_CERTIFIED - -meta RCVD_IN_RP_SAFE RCVD_IN_VALIDITY_SAFE -describe RCVD_IN_RP_SAFE RCVD_IN_RP_SAFE renamed to RCVD_IN_VALIDITY_SAFE, please update local rules -score RCVD_IN_RP_SAFE -0.001 -tflags RCVD_IN_RP_SAFE net nice publish -reuse RCVD_IN_RP_SAFE - -meta RCVD_IN_RP_RNBL RCVD_IN_VALIDITY_RPBL -describe RCVD_IN_RP_RNBL RCVD_IN_RP_RNBL renamed to RCVD_IN_VALIDITY_RPBL, please update local rules -score RCVD_IN_RP_RNBL 0.001 -tflags RCVD_IN_RP_RNBL net publish -reuse RCVD_IN_RP_RNBL +reuse RCVD_IN_VALIDITY_RPBL RCVD_IN_RP_RNBL endif diff --git a/sa-updates/20_freemail_domains.cf b/sa-updates/20_freemail_domains.cf index d4b4087..2b15b1c 100644 --- a/sa-updates/20_freemail_domains.cf +++ b/sa-updates/20_freemail_domains.cf @@ -354,7 +354,7 @@ freemail_domains trevas.net tripod-mail.com triton.net trmailbox.com tsamail.co. freemail_domains turbonett.com turkey.com tvnet.lv twc.com typemail.com u2club.com uae.ac freemail_domains ubbi.com ubbi.com.br uboot.com ugeek.com uk2.net uk2net.com ukr.net freemail_domains ukrpost.net ukrpost.ua uku.co.uk ulimit.com ummah.org unbounded.com -freemail_domains unican.es unicum.de unimail.mn unitedemailsystems.com universal.pt +freemail_domains unicum.de unimail.mn unitedemailsystems.com universal.pt freemail_domains universia.cl universia.edu.ve universia.es universia.net.co universia.net.mx freemail_domains universia.pr universia.pt universiabrasil.net unofree.it uol.com.ar freemail_domains uol.com.br uole.com uolmail.com uomail.com uraniomail.com urbi.com.br diff --git a/sa-updates/20_head_tests.cf b/sa-updates/20_head_tests.cf index 64df56d..5d9f71b 100644 --- a/sa-updates/20_head_tests.cf +++ b/sa-updates/20_head_tests.cf @@ -418,7 +418,7 @@ describe BAD_ENC_HEADER Message has bad MIME encoding in the header header __ML1 Precedence =~ m{\b(list|bulk)\b}i -header __ML2 exists:List-Id +meta __ML2 __HAS_LIST_ID header __ML3 exists:List-Post header __ML4 exists:Mailing-List header __ML5 Return-Path:addr =~ m{^([^\@]+-(request|bounces|admin|owner)|owner-[^\@]+)(\@|\z)}i @@ -454,15 +454,24 @@ tflags CHARSET_FARAWAY_HEADER userconf # might want to exempt users using languages that don't use Latin # alphabets, but do it in the eval -header __SUBJ_ILLEGAL_CHARS eval:check_illegal_chars('Subject','0.00','2') -meta SUBJ_ILLEGAL_CHARS (__SUBJ_ILLEGAL_CHARS && !__FROM_YAHOO_COM) +# Will FP without 4.0 and UTF-8 support +if (version >= 4.000000) + header __SUBJ_ILLEGAL_CHARS eval:check_illegal_chars('Subject','0.00','2') + meta SUBJ_ILLEGAL_CHARS (__SUBJ_ILLEGAL_CHARS && !__FROM_YAHOO_COM) + header FROM_ILLEGAL_CHARS eval:check_illegal_chars('From','0.20','2') + header __HEAD_ILLEGAL_CHARS eval:check_illegal_chars('ALL','0.010','2') + meta HEAD_ILLEGAL_CHARS __HEAD_ILLEGAL_CHARS && !__SUBJ_ILLEGAL_CHARS && !FROM_ILLEGAL_CHARS +endif +if (version < 4.000000) + meta __SUBJ_ILLEGAL_CHARS 0 + meta SUBJ_ILLEGAL_CHARS 0 + meta FROM_ILLEGAL_CHARS 0 + meta __HEAD_ILLEGAL_CHARS 0 + meta HEAD_ILLEGAL_CHARS 0 +endif + describe SUBJ_ILLEGAL_CHARS Subject: has too many raw illegal characters - -header FROM_ILLEGAL_CHARS eval:check_illegal_chars('From','0.20','2') describe FROM_ILLEGAL_CHARS From: has too many raw illegal characters - -header __HEAD_ILLEGAL_CHARS eval:check_illegal_chars('ALL','0.010','2') -meta HEAD_ILLEGAL_CHARS __HEAD_ILLEGAL_CHARS && !__SUBJ_ILLEGAL_CHARS && !FROM_ILLEGAL_CHARS describe HEAD_ILLEGAL_CHARS Headers have too many raw illegal characters ################################################################### diff --git a/sa-updates/20_ratware.cf b/sa-updates/20_ratware.cf index 009bd50..b25cd70 100644 --- a/sa-updates/20_ratware.cf +++ b/sa-updates/20_ratware.cf @@ -114,8 +114,7 @@ header __HAS_X_LOOP exists:X-Loop header __HAS_X_MAILING_LIST exists:X-Mailing-List header __HAS_X_MAILMAN_VERSION exists:X-Mailman-Version describe MAILING_LIST_MULTI Multiple indicators imply a widely-seen list manager -# __ML2 and __HAS_LIST_ID are exactly equivalent, don't double-count -meta MAILING_LIST_MULTI __HAS_X_LOOP + __HAS_X_MAILING_LIST + __HAS_X_MAILMAN_VERSION + __HAS_LIST_ID + __HAS_X_BEEN_THERE +__DOS_HAS_LIST_UNSUB + __ML1 + __ML3 + __ML4 + __ML5 > 2 +meta MAILING_LIST_MULTI __HAS_X_LOOP + __HAS_X_MAILING_LIST + __HAS_X_MAILMAN_VERSION + __HAS_X_BEEN_THERE +__DOS_HAS_LIST_UNSUB + __ML1 + __ML2 + __ML3 + __ML4 + __ML5 > 2 tflags MAILING_LIST_MULTI nice # QUALCOMM Eudora diff --git a/sa-updates/25_uribl.cf b/sa-updates/25_uribl.cf index f911df9..c61abe8 100644 --- a/sa-updates/25_uribl.cf +++ b/sa-updates/25_uribl.cf @@ -88,55 +88,55 @@ if can(Mail::SpamAssassin::Plugin::URIDNSBL::has_tflags_domains_only) urirhssub URIBL_DBL_SPAM dbl.spamhaus.org. A 127.0.1.2 body URIBL_DBL_SPAM eval:check_uridnsbl('URIBL_DBL_SPAM') describe URIBL_DBL_SPAM Contains a spam URL listed in the Spamhaus DBL blocklist -tflags URIBL_DBL_SPAM net domains_only +tflags URIBL_DBL_SPAM net domains_only notrim reuse URIBL_DBL_SPAM urirhssub URIBL_DBL_PHISH dbl.spamhaus.org. A 127.0.1.4 body URIBL_DBL_PHISH eval:check_uridnsbl('URIBL_DBL_PHISH') describe URIBL_DBL_PHISH Contains a Phishing URL listed in the Spamhaus DBL blocklist -tflags URIBL_DBL_PHISH net domains_only +tflags URIBL_DBL_PHISH net domains_only notrim reuse URIBL_DBL_PHISH urirhssub URIBL_DBL_MALWARE dbl.spamhaus.org. A 127.0.1.5 body URIBL_DBL_MALWARE eval:check_uridnsbl('URIBL_DBL_MALWARE') describe URIBL_DBL_MALWARE Contains a malware URL listed in the Spamhaus DBL blocklist -tflags URIBL_DBL_MALWARE net domains_only +tflags URIBL_DBL_MALWARE net domains_only notrim reuse URIBL_DBL_MALWARE urirhssub URIBL_DBL_BOTNETCC dbl.spamhaus.org. A 127.0.1.6 body URIBL_DBL_BOTNETCC eval:check_uridnsbl('URIBL_DBL_BOTNETCC') describe URIBL_DBL_BOTNETCC Contains a botned C&C URL listed in the Spamhaus DBL blocklist -tflags URIBL_DBL_BOTNETCC net domains_only +tflags URIBL_DBL_BOTNETCC net domains_only notrim reuse URIBL_DBL_BOTNETCC urirhssub URIBL_DBL_ABUSE_SPAM dbl.spamhaus.org. A 127.0.1.102 body URIBL_DBL_ABUSE_SPAM eval:check_uridnsbl('URIBL_DBL_ABUSE_SPAM') describe URIBL_DBL_ABUSE_SPAM Contains an abused spamvertized URL listed in the Spamhaus DBL blocklist -tflags URIBL_DBL_ABUSE_SPAM net domains_only +tflags URIBL_DBL_ABUSE_SPAM net domains_only notrim reuse URIBL_DBL_ABUSE_SPAM urirhssub URIBL_DBL_ABUSE_REDIR dbl.spamhaus.org. A 127.0.1.103 body URIBL_DBL_ABUSE_REDIR eval:check_uridnsbl('URIBL_DBL_ABUSE_REDIR') describe URIBL_DBL_ABUSE_REDIR Contains an abused redirector URL listed in the Spamhaus DBL blocklist -tflags URIBL_DBL_ABUSE_REDIR net domains_only +tflags URIBL_DBL_ABUSE_REDIR net domains_only notrim reuse URIBL_DBL_ABUSE_REDIR urirhssub URIBL_DBL_ABUSE_PHISH dbl.spamhaus.org. A 127.0.1.104 body URIBL_DBL_ABUSE_PHISH eval:check_uridnsbl('URIBL_DBL_ABUSE_PHISH') describe URIBL_DBL_ABUSE_PHISH Contains an abused phishing URL listed in the Spamhaus DBL blocklist -tflags URIBL_DBL_ABUSE_PHISH net domains_only +tflags URIBL_DBL_ABUSE_PHISH net domains_only notrim reuse URIBL_DBL_ABUSE_PHISH urirhssub URIBL_DBL_ABUSE_MALW dbl.spamhaus.org. A 127.0.1.105 body URIBL_DBL_ABUSE_MALW eval:check_uridnsbl('URIBL_DBL_ABUSE_MALW') describe URIBL_DBL_ABUSE_MALW Contains an abused malware URL listed in the Spamhaus DBL blocklist -tflags URIBL_DBL_ABUSE_MALW net domains_only +tflags URIBL_DBL_ABUSE_MALW net domains_only notrim reuse URIBL_DBL_ABUSE_MALW urirhssub URIBL_DBL_ABUSE_BOTCC dbl.spamhaus.org. A 127.0.1.106 body URIBL_DBL_ABUSE_BOTCC eval:check_uridnsbl('URIBL_DBL_ABUSE_BOTCC') describe URIBL_DBL_ABUSE_BOTCC Contains an abused botnet C&C URL listed in the Spamhaus DBL blocklist -tflags URIBL_DBL_ABUSE_BOTCC net domains_only +tflags URIBL_DBL_ABUSE_BOTCC net domains_only notrim reuse URIBL_DBL_ABUSE_BOTCC @@ -145,21 +145,21 @@ reuse URIBL_DBL_ABUSE_BOTCC urirhssub URIBL_DBL_ERROR dbl.spamhaus.org. A 127.0.1.255 body URIBL_DBL_ERROR eval:check_uridnsbl('URIBL_DBL_ERROR') describe URIBL_DBL_ERROR Error: queried the Spamhaus DBL blocklist for an IP -tflags URIBL_DBL_ERROR net domains_only +tflags URIBL_DBL_ERROR net domains_only notrim reuse URIBL_DBL_ERROR # New blocked checks 10/2019 urirhssub URIBL_DBL_BLOCKED_OPENDNS dbl.spamhaus.org. A 127.255.255.254 body URIBL_DBL_BLOCKED_OPENDNS eval:check_uridnsbl('URIBL_DBL_BLOCKED_OPENDNS') describe URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/ -tflags URIBL_DBL_BLOCKED_OPENDNS net domains_only +tflags URIBL_DBL_BLOCKED_OPENDNS net domains_only notrim reuse URIBL_DBL_BLOCKED_OPENDNS # New blocked checks 10/2019 urirhssub URIBL_DBL_BLOCKED dbl.spamhaus.org. A 127.255.255.255 body URIBL_DBL_BLOCKED eval:check_uridnsbl('URIBL_DBL_BLOCKED') describe URIBL_DBL_BLOCKED ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/ -tflags URIBL_DBL_BLOCKED net domains_only +tflags URIBL_DBL_BLOCKED net domains_only notrim reuse URIBL_DBL_BLOCKED endif @@ -171,52 +171,52 @@ endif #urirhssub URIBL_SC_SURBL multi.surbl.org. A 2 #body URIBL_SC_SURBL eval:check_uridnsbl('URIBL_SC_SURBL') #describe URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist -#tflags URIBL_SC_SURBL net +#tflags URIBL_SC_SURBL net notrim #reuse URIBL_SC_SURBL urirhssub URIBL_WS_SURBL multi.surbl.org. A 4 body URIBL_WS_SURBL eval:check_uridnsbl('URIBL_WS_SURBL') describe URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist -tflags URIBL_WS_SURBL net +tflags URIBL_WS_SURBL net notrim reuse URIBL_WS_SURBL urirhssub URIBL_PH_SURBL multi.surbl.org. A 8 body URIBL_PH_SURBL eval:check_uridnsbl('URIBL_PH_SURBL') describe URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist -tflags URIBL_PH_SURBL net +tflags URIBL_PH_SURBL net notrim reuse URIBL_PH_SURBL urirhssub URIBL_MW_SURBL multi.surbl.org. A 16 body URIBL_MW_SURBL eval:check_uridnsbl('URIBL_MW_SURBL') describe URIBL_MW_SURBL Contains a URL listed in the MW SURBL blocklist -tflags URIBL_MW_SURBL net +tflags URIBL_MW_SURBL net notrim reuse URIBL_MW_SURBL urirhssub URIBL_CR_SURBL multi.surbl.org. A 128 body URIBL_CR_SURBL eval:check_uridnsbl('URIBL_CR_SURBL') describe URIBL_CR_SURBL Contains an URL listed in the CR SURBL blocklist -tflags URIBL_CR_SURBL net +tflags URIBL_CR_SURBL net notrim reuse URIBL_CR_SURBL #MERGED INTO BIT 64 per bug 7279 #urirhssub URIBL_AB_SURBL multi.surbl.org. A 32 #body URIBL_AB_SURBL eval:check_uridnsbl('URIBL_AB_SURBL') #describe URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist -#tflags URIBL_AB_SURBL net +#tflags URIBL_AB_SURBL net notrim #reuse URIBL_AB_SURBL #JP MOVED INTO ABUSE AS WELL AND BIT REUSED per bug 7279 urirhssub URIBL_ABUSE_SURBL multi.surbl.org. A 64 body URIBL_ABUSE_SURBL eval:check_uridnsbl('URIBL_ABUSE_SURBL') describe URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist -tflags URIBL_ABUSE_SURBL net +tflags URIBL_ABUSE_SURBL net notrim reuse URIBL_ABUSE_SURBL #SURBL BLOCK RULES - Bit 1 means your DNS has been blocked and this rule should be triggered to notify you. urirhssub SURBL_BLOCKED multi.surbl.org. A 1 body SURBL_BLOCKED eval:check_uridnsbl('SURBL_BLOCKED') describe SURBL_BLOCKED ADMINISTRATOR NOTICE: The query to SURBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists\#dnsbl-block for more information. -tflags SURBL_BLOCKED net noautolearn +tflags SURBL_BLOCKED net noautolearn notrim reuse SURBL_BLOCKED if can(Mail::SpamAssassin::Conf::feature_dns_block_rule) diff --git a/sa-updates/50_scores.cf b/sa-updates/50_scores.cf index 3b06941..d51fa42 100644 --- a/sa-updates/50_scores.cf +++ b/sa-updates/50_scores.cf @@ -46,7 +46,6 @@ score BANKING_LAWS 2.399 2.004 2.157 1.099 # n=2 score BILLION_DOLLARS 0.001 1.451 1.229 1.638 score BODY_ENHANCEMENT 0.927 1.611 0.974 0.001 score BODY_ENHANCEMENT2 0.1 -score BUG6152_INVALID_DATE_TZ_ABSURD 0.1 score CONFIRMED_FORGED 0 # n=0 n=1 n=2 n=3 score CORRUPT_FROM_LINE_IN_HDRS 0 # n=0 n=1 n=2 n=3 score CTYPE_001C_A 0 # n=0 n=1 n=2 n=3 @@ -178,7 +177,7 @@ score HIDE_WIN_STATUS 0.001 score HIGH_CODEPAGE_URI 0 # n=0 n=1 n=2 # score HK_LOTTO 3.599 2.755 2.993 3.599 # Allow GA manage score score HK_NAME_DRUGS 4.299 0.001 3.077 0.552 -score HK_RANDOM_ENVFROM 2.638 0.626 1.798 0.001 +# score HK_RANDOM_ENVFROM 2.638 0.626 1.798 0.001 # Allow GA manage score score HTML_MIME_NO_HTML_TAG 0.001 0.635 0.001 0.377 score HTML_MISSING_CTYPE 0 # n=0 n=1 n=2 n=3 score HTML_SHORT_CENTER 3.799 3.421 2.611 0.743 @@ -266,9 +265,13 @@ score RATWARE_EGROUPS 1.898 1.258 1.406 1.621 score RATWARE_HASH_DASH 0 # n=0 n=1 n=2 n=3 score RATWARE_MOZ_MALFORMED 0 # n=0 n=1 n=2 n=3 score RATWARE_MPOP_WEBMAIL 1.153 1.338 1.229 1.999 # n=0 -score RATWARE_MS_HASH 2.036 3.692 0.454 2.148 +# jhardin 05/2021 +# masscheck corpora thin or nonexistent, real world FPs reported - exposing to ruleqa for eval +#score RATWARE_MS_HASH 2.036 3.692 0.454 2.148 score RATWARE_OE_MALFORMED 0 # n=0 n=1 n=2 n=3 -score RATWARE_OUTLOOK_NONAME 2.964 0.033 2.685 2.950 +# jhardin 05/2021 +# masscheck corpora thin or nonexistent, real world FPs reported - exposing to ruleqa for eval +#score RATWARE_OUTLOOK_NONAME 2.964 0.033 2.685 2.950 score RATWARE_RCVD_AT 0 # n=0 n=1 n=2 n=3 score RATWARE_RCVD_PF 0 # n=0 n=1 n=2 n=3 score RATWARE_ZERO_TZ 2.392 2.535 0.265 1.781 # n=0 diff --git a/sa-updates/60_bayes_stopwords.cf b/sa-updates/60_bayes_stopwords.cf index 443dcc3..3b5546f 100644 --- a/sa-updates/60_bayes_stopwords.cf +++ b/sa-updates/60_bayes_stopwords.cf @@ -16,52 +16,54 @@ # if (version >= 4.000000) - if can(Mail::SpamAssassin::Conf::feature_bayes_stopwords) - # Danish - bayes_stopword_dk (?^:(?:a(?:lle|nden)|bl(?:ev|iver?)|d(?:e(?:nne|res|tte)|isse)|e(?:fter|ller)|h(?:a(?:ns|v(?:de|e))|endes?|v(?:ad|is|or))|ikke|kunne|m(?:ange|eget|ine)|nog(?:et|le)|o(?:gs\xc3\xa5|ver)|s(?:elv|ine|k(?:al|ulle)|\xc3\xa5dan)|under|v(?:ille|\xc3\xa6ret?))) + ifplugin Mail::SpamAssassin::Plugin::Bayes + if can(Mail::SpamAssassin::Conf::feature_bayes_stopwords) + # Danish + bayes_stopword_dk (?^:(?:a(?:lle|nden)|bl(?:ev|iver?)|d(?:e(?:nne|res|tte)|isse)|e(?:fter|ller)|h(?:a(?:ns|v(?:de|e))|endes?|v(?:ad|is|or))|ikke|kunne|m(?:ange|eget|ine)|nog(?:et|le)|o(?:gs\xc3\xa5|ver)|s(?:elv|ine|k(?:al|ulle)|\xc3\xa5dan)|under|v(?:ille|\xc3\xa6ret?))) - # Dutch - bayes_stopword_nl (?^:(?:a(?:l(?:les|tijd)|ndere)|d(?:aar|eze|o(?:ch|en|or))|eens|ge(?:en|weest)|h(?:aar|e(?:bben|eft)|ier)|ie(?:mand|ts)|kunnen|m(?:aar|eer|ijn|oet)|n(?:aar|iets?)|o(?:mdat|nder|ver)|reeds|t(?:egen|o(?:ch|en))|v(?:eel|oor)|w(?:a(?:nt|ren)|e(?:rd|zen)|ord(?:en|t))|z(?:elf|i(?:ch|jn)|onder))) + # Dutch + bayes_stopword_nl (?^:(?:a(?:l(?:les|tijd)|ndere)|d(?:aar|eze|o(?:ch|en|or))|eens|ge(?:en|weest)|h(?:aar|e(?:bben|eft)|ier)|ie(?:mand|ts)|kunnen|m(?:aar|eer|ijn|oet)|n(?:aar|iets?)|o(?:mdat|nder|ver)|reeds|t(?:egen|o(?:ch|en))|v(?:eel|oor)|w(?:a(?:nt|ren)|e(?:rd|zen)|ord(?:en|t))|z(?:elf|i(?:ch|jn)|onder))) - # German - bayes_stopword_de (?:a(?:ber|l(?:le[mnrs]?|so)|nder(?:(?:e[mnrs]?|[mnrs]))?|uch)|bist|d(?:a(?:mit|nn|ss(?:elbe)?|zu)|e(?:in(?:e[mnrs]?)?|mselben|n(?:selben|n)|r(?:er|selben?)|sse(?:lben|n))|i(?:ch|es(?:e(?:(?:lben?|[mnrs]))?)?)|o(?:ch|rt)|urch)|e(?:in(?:e[mnrs]?|ig(?:e[mnrs]?)?|mal)|twas|u(?:ch|er|re[mnrs]?))|ge(?:gen|wesen)|h(?:a(?:ben?|tten?)|i(?:er|nter))|i(?:h(?:nen|re[mnrs]?)|ndem)|je(?:de[mnrs]?|ne[mnrs]?|tzt)|k(?:ann|ein(?:e[mnrs]?)?|\xc3\xb6nn(?:en|te))|m(?:a(?:chen|nche[mnrs]?)|ein(?:e[mnrs]?)?|ich|uss(?:te)?)|n(?:ach|ichts?|och)|o(?:der|hne)|s(?:e(?:hr|in(?:e[mnrs]?)?|lbst)|i(?:ch|nd)|o(?:l(?:che[mnrs]?|l(?:te)?)|n(?:dern|st)))|un(?:ser(?:e[mns]?)?|ter)|viel|w(?:ar(?:en|st)|e(?:i(?:ter|l)|lche[mnrs]?|nn|rden?)|i(?:eder|ll|r(?:st|d))|oll(?:en|te)|\xc3(?:\xa4hrend|\xbcrden?))|zw(?:ar|ischen)|\xc3\xbcber) + # German + bayes_stopword_de (?:a(?:ber|l(?:le[mnrs]?|so)|nder(?:(?:e[mnrs]?|[mnrs]))?|uch)|bist|d(?:a(?:mit|nn|ss(?:elbe)?|zu)|e(?:in(?:e[mnrs]?)?|mselben|n(?:selben|n)|r(?:er|selben?)|sse(?:lben|n))|i(?:ch|es(?:e(?:(?:lben?|[mnrs]))?)?)|o(?:ch|rt)|urch)|e(?:in(?:e[mnrs]?|ig(?:e[mnrs]?)?|mal)|twas|u(?:ch|er|re[mnrs]?))|ge(?:gen|wesen)|h(?:a(?:ben?|tten?)|i(?:er|nter))|i(?:h(?:nen|re[mnrs]?)|ndem)|je(?:de[mnrs]?|ne[mnrs]?|tzt)|k(?:ann|ein(?:e[mnrs]?)?|\xc3\xb6nn(?:en|te))|m(?:a(?:chen|nche[mnrs]?)|ein(?:e[mnrs]?)?|ich|uss(?:te)?)|n(?:ach|ichts?|och)|o(?:der|hne)|s(?:e(?:hr|in(?:e[mnrs]?)?|lbst)|i(?:ch|nd)|o(?:l(?:che[mnrs]?|l(?:te)?)|n(?:dern|st)))|un(?:ser(?:e[mns]?)?|ter)|viel|w(?:ar(?:en|st)|e(?:i(?:ter|l)|lche[mnrs]?|nn|rden?)|i(?:eder|ll|r(?:st|d))|oll(?:en|te)|\xc3(?:\xa4hrend|\xbcrden?))|zw(?:ar|ischen)|\xc3\xbcber) - # English - bayes_stopword_en (?:a(?:ble|l(?:ready|l)|n[dy]|re)|b(?:ecause|oth)|c(?:an|ome)|e(?:ach|mail|ven)|f(?:ew|irst|or|rom)|give|h(?:a(?:ve|s)|ttp)|i(?:n(?:formation|to)|t\'s)|just|know|l(?:ike|o(?:ng|ok))|m(?:a(?:de|il(?:(?:ing|to))?|ke|ny)|o(?:re|st)|uch)|n(?:eed|o[tw]|umber)|o(?:ff|n(?:ly|e)|ut|wn)|p(?:eople|lace)|right|s(?:ame|ee|uch)|t(?:h(?:at|is|rough|e)|ime)|using|w(?:eb|h(?:ere|y)|ith(?:out)?|or(?:ld|k))|y(?:ears?|ou(?:(?:\'re|r))?))$ - # bayes_stopword_en (?:a(?:bo(?:ut|ve)|fter|gain(?:st)?|ren(?:\'t)?)|b(?:e(?:cause|en|fore|ing|low|tween)|oth)|couldn(?:\'t)?|d(?:idn(?:\'t)?|o(?:es(?:n(?:\'t)?)?|ing|n\'t|wn)|uring)|each|f(?:rom|urther)|h(?:a(?:dn(?:\'t)?|sn(?:\'t)?|v(?:e(?:n(?:\'t)?)?|ing))|er(?:s(?:elf)?|e)|imself)|i(?:nto|sn\'t|t(?:\'s|self))|just|m(?:ightn(?:\'t)?|o(?:re|st)|ustn(?:\'t)?|yself)|needn(?:\'t)?|o(?:n(?:ce|ly)|ther|urs(?:elves)?|ver)|s(?:ame|h(?:an(?:\'t)?|e\'s|ould(?:(?:\'ve|n(?:\'t)?))?)|ome|uch)|th(?:a(?:t(?:\'ll)?|n)|e(?:irs?|m(?:selves)?|re|se|[ny])|is|ose|rough)|un(?:der|til)|very|w(?:asn(?:\'t)?|ere(?:n(?:\'t)?)?|h(?:at|e(?:re|n)|i(?:ch|le)|om)|i(?:ll|th)|o(?:n\'t|uldn(?:\'t)?))|you(?:\'(?:ll|re|ve|d)|r(?:s(?:el(?:ves|f))?)?)) + # English + bayes_stopword_en (?:a(?:ble|l(?:ready|l)|n[dy]|re)|b(?:ecause|oth)|c(?:an|ome)|e(?:ach|mail|ven)|f(?:ew|irst|or|rom)|give|h(?:a(?:ve|s)|ttp)|i(?:n(?:formation|to)|t\'s)|just|know|l(?:ike|o(?:ng|ok))|m(?:a(?:de|il(?:(?:ing|to))?|ke|ny)|o(?:re|st)|uch)|n(?:eed|o[tw]|umber)|o(?:ff|n(?:ly|e)|ut|wn)|p(?:eople|lace)|right|s(?:ame|ee|uch)|t(?:h(?:at|is|rough|e)|ime)|using|w(?:eb|h(?:ere|y)|ith(?:out)?|or(?:ld|k))|y(?:ears?|ou(?:(?:\'re|r))?))$ + # bayes_stopword_en (?:a(?:bo(?:ut|ve)|fter|gain(?:st)?|ren(?:\'t)?)|b(?:e(?:cause|en|fore|ing|low|tween)|oth)|couldn(?:\'t)?|d(?:idn(?:\'t)?|o(?:es(?:n(?:\'t)?)?|ing|n\'t|wn)|uring)|each|f(?:rom|urther)|h(?:a(?:dn(?:\'t)?|sn(?:\'t)?|v(?:e(?:n(?:\'t)?)?|ing))|er(?:s(?:elf)?|e)|imself)|i(?:nto|sn\'t|t(?:\'s|self))|just|m(?:ightn(?:\'t)?|o(?:re|st)|ustn(?:\'t)?|yself)|needn(?:\'t)?|o(?:n(?:ce|ly)|ther|urs(?:elves)?|ver)|s(?:ame|h(?:an(?:\'t)?|e\'s|ould(?:(?:\'ve|n(?:\'t)?))?)|ome|uch)|th(?:a(?:t(?:\'ll)?|n)|e(?:irs?|m(?:selves)?|re|se|[ny])|is|ose|rough)|un(?:der|til)|very|w(?:asn(?:\'t)?|ere(?:n(?:\'t)?)?|h(?:at|e(?:re|n)|i(?:ch|le)|om)|i(?:ll|th)|o(?:n\'t|uldn(?:\'t)?))|you(?:\'(?:ll|re|ve|d)|r(?:s(?:el(?:ves|f))?)?)) - # Spanish - bayes_stopword_es (?:a(?:lg(?:un(?:as|os)|o)|ntes?)|c(?:o(?:mo|ntra)|ua(?:ndo|l))|d(?:esde|onde|urante)|e(?:ll(?:as?|os)|ntre|r(?:a(?:is|[ns])|es)|s(?:as|os|t(?:a(?:(?:ba(?:(?:is|[ns]))?|d(?:(?:as?|os?))?|mos|ndo|r(?:(?:emos|\xc3(?:\xa1[ns]?|\xa9(?:is)?|\xada(?:(?:is|mos|[ns]))?)))?|s))?|e(?:mos)?|o[sy]?|uv(?:i(?:e(?:r(?:a(?:(?:is|[ns]))?|on)|se(?:(?:is|[ns]))?)|mos|ste(?:is)?|\xc3\xa9(?:ramos|semos))|[eo])|\xc3(?:\xa1(?:(?:bamos|is|[ns]))?|\xa9(?:(?:is|[ns]))?))))|fu(?:e(?:r(?:a(?:(?:is|[ns]))?|on)|se(?:(?:is|[ns]))?)|i(?:mos|ste(?:is)?)|\xc3\xa9(?:ramos|semos))|h(?:a(?:b(?:i(?:d(?:as?|os?)|endo)|r(?:emos|\xc3(?:\xa1[ns]?|\xa9(?:is)?|\xada(?:(?:is|mos|[ns]))?))|\xc3(?:\xa9is|\xada(?:(?:is|mos|[ns]))?))|sta|y(?:a(?:(?:mos|[ns]))?|\xc3\xa1is))|emos|ub(?:i(?:e(?:r(?:a(?:(?:is|[ns]))?|on)|se(?:(?:is|[ns]))?)|mos|ste(?:is)?|\xc3\xa9(?:ramos|semos))|[eo]))|m(?:uchos?|\xc3\xad(?:as|os))|n(?:ada|osotr(?:as|os)|uestr(?:as?|os?))|otr(?:as?|os?)|p(?:ara|ero|o(?:co|rque))|quien(?:es)?|s(?:e(?:a(?:mos|[ns])|ntid(?:(?:as?|os?))?|r(?:emos|\xc3(?:\xa1[ns]?|\xa9(?:is)?|\xada(?:(?:is|mos|[ns]))?))|\xc3\xa1is)|i(?:ente|ntiendo)|o(?:bre|is|mos)|uy(?:as?|os?))|t(?:a(?:mbi\xc3\xa9n|nto)|en(?:dr(?:emos|\xc3(?:\xa1[ns]?|\xa9(?:is)?|\xada(?:(?:is|mos|[ns]))?))|e(?:mos|d)|g(?:a(?:(?:mos|[ns]))?|\xc3\xa1is|o)|i(?:d(?:as?|os?)|endo)|\xc3(?:\xa9is|\xada(?:(?:is|mos|[ns]))?))|iene[ns]?|odos?|u(?:v(?:i(?:e(?:r(?:a(?:(?:is|[ns]))?|on)|se(?:(?:is|[ns]))?)|mos|ste(?:is)?|\xc3\xa9(?:ramos|semos))|[eo])|y(?:as?|os?)))|unos|v(?:osotr(?:as|os)|uestr(?:as?|os?))|\xc3\xa9ramos) + # Spanish + bayes_stopword_es (?:a(?:lg(?:un(?:as|os)|o)|ntes?)|c(?:o(?:mo|ntra)|ua(?:ndo|l))|d(?:esde|onde|urante)|e(?:ll(?:as?|os)|ntre|r(?:a(?:is|[ns])|es)|s(?:as|os|t(?:a(?:(?:ba(?:(?:is|[ns]))?|d(?:(?:as?|os?))?|mos|ndo|r(?:(?:emos|\xc3(?:\xa1[ns]?|\xa9(?:is)?|\xada(?:(?:is|mos|[ns]))?)))?|s))?|e(?:mos)?|o[sy]?|uv(?:i(?:e(?:r(?:a(?:(?:is|[ns]))?|on)|se(?:(?:is|[ns]))?)|mos|ste(?:is)?|\xc3\xa9(?:ramos|semos))|[eo])|\xc3(?:\xa1(?:(?:bamos|is|[ns]))?|\xa9(?:(?:is|[ns]))?))))|fu(?:e(?:r(?:a(?:(?:is|[ns]))?|on)|se(?:(?:is|[ns]))?)|i(?:mos|ste(?:is)?)|\xc3\xa9(?:ramos|semos))|h(?:a(?:b(?:i(?:d(?:as?|os?)|endo)|r(?:emos|\xc3(?:\xa1[ns]?|\xa9(?:is)?|\xada(?:(?:is|mos|[ns]))?))|\xc3(?:\xa9is|\xada(?:(?:is|mos|[ns]))?))|sta|y(?:a(?:(?:mos|[ns]))?|\xc3\xa1is))|emos|ub(?:i(?:e(?:r(?:a(?:(?:is|[ns]))?|on)|se(?:(?:is|[ns]))?)|mos|ste(?:is)?|\xc3\xa9(?:ramos|semos))|[eo]))|m(?:uchos?|\xc3\xad(?:as|os))|n(?:ada|osotr(?:as|os)|uestr(?:as?|os?))|otr(?:as?|os?)|p(?:ara|ero|o(?:co|rque))|quien(?:es)?|s(?:e(?:a(?:mos|[ns])|ntid(?:(?:as?|os?))?|r(?:emos|\xc3(?:\xa1[ns]?|\xa9(?:is)?|\xada(?:(?:is|mos|[ns]))?))|\xc3\xa1is)|i(?:ente|ntiendo)|o(?:bre|is|mos)|uy(?:as?|os?))|t(?:a(?:mbi\xc3\xa9n|nto)|en(?:dr(?:emos|\xc3(?:\xa1[ns]?|\xa9(?:is)?|\xada(?:(?:is|mos|[ns]))?))|e(?:mos|d)|g(?:a(?:(?:mos|[ns]))?|\xc3\xa1is|o)|i(?:d(?:as?|os?)|endo)|\xc3(?:\xa9is|\xada(?:(?:is|mos|[ns]))?))|iene[ns]?|odos?|u(?:v(?:i(?:e(?:r(?:a(?:(?:is|[ns]))?|on)|se(?:(?:is|[ns]))?)|mos|ste(?:is)?|\xc3\xa9(?:ramos|semos))|[eo])|y(?:as?|os?)))|unos|v(?:osotr(?:as|os)|uestr(?:as?|os?))|\xc3\xa9ramos) - # Finnish - bayes_stopword_fi (?^:(?:e(?:iv\xc3\xa4t|mme|tt(?:\xc3\xa4|e))|h(?:ei(?:d\xc3\xa4[nt]|hin|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|s(?:s\xc3\xa4|t\xc3\xa4)|t\xc3\xa4)|\xc3\xa4n(?:e(?:en|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|s(?:s\xc3\xa4|t\xc3\xa4)|[nt])|t\xc3\xa4))|itse|jo(?:hon|i(?:den|hin|ksi|l(?:l[ae]|ta)|na|s(?:sa|ta)|ta)|k(?:si|a)|l(?:l[ae]|ta)|n(?:ka|a)|s(?:sa|ta)|t(?:ka|a))|k(?:anssa|e(?:i(?:den|hin|ksi|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|n\xc3\xa4|s(?:s\xc3\xa4|t\xc3\xa4)|t\xc3\xa4)|ne(?:en|ksi|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|n(?:\xc3\xa4)?|s(?:s\xc3\xa4|t\xc3\xa4)|t)|t(?:k\xc3\xa4|\xc3\xa4))|oska|u(?:in|ka))|m(?:ei(?:d\xc3\xa4[nt]|hin|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|s(?:s\xc3\xa4|t\xc3\xa4)|t\xc3\xa4)|i(?:hin|k(?:si|\xc3\xa4)|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|n(?:k\xc3\xa4|u(?:l(?:l[ae]|ta)|s(?:sa|ta)|un|[ant])|\xc3\xa4)|s(?:s\xc3\xa4|t\xc3\xa4)|t(?:k\xc3\xa4|\xc3\xa4))|u(?:kaan|tta))|n(?:ii(?:den|hin|ksi|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|n(?:\xc3\xa4)?|s(?:s\xc3\xa4|t\xc3\xa4)|t\xc3\xa4)|oi(?:den|hin|ksi|l(?:l[ae]|ta)|na?|s(?:sa|ta)|ta)|\xc3\xa4(?:i(?:den|hin|ksi|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|n\xc3\xa4|s(?:s\xc3\xa4|t\xc3\xa4)|t\xc3\xa4)|m\xc3\xa4))|o(?:l(?:e(?:mme|t(?:te)?|n)|i(?:mme|si(?:(?:mme|t(?:te)?|vat|n))?|t(?:te)?|vat|n)|l(?:eet|ut|a))|vat)|poikki|s(?:ek\xc3\xa4|i(?:i(?:hen|n\xc3\xa4|t\xc3\xa4)|ksi|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|n(?:u(?:l(?:l[ae]|ta)|s(?:sa|ta)|un|[ant])|\xc3\xa4)|t\xc3\xa4))|t(?:all\xc3\xa4|ei(?:d\xc3\xa4[nt]|hin|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|s(?:s\xc3\xa4|t\xc3\xa4)|t\xc3\xa4)|uo(?:hon|ksi|l(?:l[ae]|ta)|na?|s(?:sa|ta)|t\xc3\xa4)|\xc3\xa4(?:h\xc3\xa4n|ksi|l(?:le|t\xc3\xa4)|m\xc3\xa4n?|n\xc3\xa4|s(?:s\xc3\xa4|t\xc3\xa4)|t\xc3\xa4))|va(?:an|ikka))) + # Finnish + bayes_stopword_fi (?^:(?:e(?:iv\xc3\xa4t|mme|tt(?:\xc3\xa4|e))|h(?:ei(?:d\xc3\xa4[nt]|hin|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|s(?:s\xc3\xa4|t\xc3\xa4)|t\xc3\xa4)|\xc3\xa4n(?:e(?:en|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|s(?:s\xc3\xa4|t\xc3\xa4)|[nt])|t\xc3\xa4))|itse|jo(?:hon|i(?:den|hin|ksi|l(?:l[ae]|ta)|na|s(?:sa|ta)|ta)|k(?:si|a)|l(?:l[ae]|ta)|n(?:ka|a)|s(?:sa|ta)|t(?:ka|a))|k(?:anssa|e(?:i(?:den|hin|ksi|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|n\xc3\xa4|s(?:s\xc3\xa4|t\xc3\xa4)|t\xc3\xa4)|ne(?:en|ksi|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|n(?:\xc3\xa4)?|s(?:s\xc3\xa4|t\xc3\xa4)|t)|t(?:k\xc3\xa4|\xc3\xa4))|oska|u(?:in|ka))|m(?:ei(?:d\xc3\xa4[nt]|hin|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|s(?:s\xc3\xa4|t\xc3\xa4)|t\xc3\xa4)|i(?:hin|k(?:si|\xc3\xa4)|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|n(?:k\xc3\xa4|u(?:l(?:l[ae]|ta)|s(?:sa|ta)|un|[ant])|\xc3\xa4)|s(?:s\xc3\xa4|t\xc3\xa4)|t(?:k\xc3\xa4|\xc3\xa4))|u(?:kaan|tta))|n(?:ii(?:den|hin|ksi|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|n(?:\xc3\xa4)?|s(?:s\xc3\xa4|t\xc3\xa4)|t\xc3\xa4)|oi(?:den|hin|ksi|l(?:l[ae]|ta)|na?|s(?:sa|ta)|ta)|\xc3\xa4(?:i(?:den|hin|ksi|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|n\xc3\xa4|s(?:s\xc3\xa4|t\xc3\xa4)|t\xc3\xa4)|m\xc3\xa4))|o(?:l(?:e(?:mme|t(?:te)?|n)|i(?:mme|si(?:(?:mme|t(?:te)?|vat|n))?|t(?:te)?|vat|n)|l(?:eet|ut|a))|vat)|poikki|s(?:ek\xc3\xa4|i(?:i(?:hen|n\xc3\xa4|t\xc3\xa4)|ksi|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|n(?:u(?:l(?:l[ae]|ta)|s(?:sa|ta)|un|[ant])|\xc3\xa4)|t\xc3\xa4))|t(?:all\xc3\xa4|ei(?:d\xc3\xa4[nt]|hin|l(?:l(?:\xc3\xa4|e)|t\xc3\xa4)|s(?:s\xc3\xa4|t\xc3\xa4)|t\xc3\xa4)|uo(?:hon|ksi|l(?:l[ae]|ta)|na?|s(?:sa|ta)|t\xc3\xa4)|\xc3\xa4(?:h\xc3\xa4n|ksi|l(?:le|t\xc3\xa4)|m\xc3\xa4n?|n\xc3\xa4|s(?:s\xc3\xa4|t\xc3\xa4)|t\xc3\xa4))|va(?:an|ikka))) - # French - bayes_stopword_fr (?:a(?:ie(?:nt|s)|ur(?:a(?:(?:i(?:(?:ent|[st]))?|s))?|ez|i(?:ez|ons)|on[st])|v(?:ai(?:ent|[st])|e[cz]|i(?:ez|ons)|ons)|y(?:ant(?:(?:es?|s))?|ez|ons))|dans|e(?:lle|u(?:es|rent|ss(?:e(?:(?:nt|s))?|i(?:ez|ons)))|\xc3\xbb(?:mes|tes))|f(?:u(?:rent|ss(?:e(?:(?:nt|s))?|i(?:ez|ons)))|\xc3\xbb(?:mes|tes))|leur|m(?:ais|\xc3\xaame)|no(?:tre|us)|pour|s(?:er(?:a(?:(?:i(?:(?:ent|[st]))?|s))?|ez|i(?:ez|ons)|on[st])|o(?:i(?:ent|[st])|mmes|nt|y(?:ez|ons))|uis)|vo(?:tre|us)|\xc3(?:\xa9t(?:a(?:i(?:ent|[st])|nt(?:(?:es?|s))?)|i(?:ez|ons)|\xc3\xa9(?:es?|s))|\xaates)) + # French + bayes_stopword_fr (?:a(?:ie(?:nt|s)|ur(?:a(?:(?:i(?:(?:ent|[st]))?|s))?|ez|i(?:ez|ons)|on[st])|v(?:ai(?:ent|[st])|e[cz]|i(?:ez|ons)|ons)|y(?:ant(?:(?:es?|s))?|ez|ons))|dans|e(?:lle|u(?:es|rent|ss(?:e(?:(?:nt|s))?|i(?:ez|ons)))|\xc3\xbb(?:mes|tes))|f(?:u(?:rent|ss(?:e(?:(?:nt|s))?|i(?:ez|ons)))|\xc3\xbb(?:mes|tes))|leur|m(?:ais|\xc3\xaame)|no(?:tre|us)|pour|s(?:er(?:a(?:(?:i(?:(?:ent|[st]))?|s))?|ez|i(?:ez|ons)|on[st])|o(?:i(?:ent|[st])|mmes|nt|y(?:ez|ons))|uis)|vo(?:tre|us)|\xc3(?:\xa9t(?:a(?:i(?:ent|[st])|nt(?:(?:es?|s))?)|i(?:ez|ons)|\xc3\xa9(?:es?|s))|\xaates)) - # Greek - bayes_stopword_gr (?^:(?:\xce(?:\xb1(?:\xce(?:\xbb\xce\xbb\xce\xb1|\xbd\xcf\x84\xce\xb9)|\xcf\x85\xcf\x84(?:\xce(?:\xb5\xcf\x83|\xbf(?:(?:\xce\xb9|\xcf(?:\x85\xcf\x83|\x83)))?|[\xb1\xb7])|\xcf\x89\xce\xbd)|\xe1\xbd\x90\xcf\x84(?:\xcf\x8c\xcf\x83|\xe1\xbd\xb8\xcf\x82))|\xb3\xce\xbf\xe1\xbf\xa6\xce\xbd|\xb4\xce\xb1(?:\xce\xaf\xcf\x83|\xe1\xbd\xb6\xcf\x82)|\xb5(?:\xce(?:\xb9(?:\xce(?:\xbc\xce\xb1(?:\xce\xb9|\xcf\x83\xcf\x84\xce\xb5)|\xbd\xce\xb1\xce\xb9)|\xcf\x83(?:\xce\xb1\xce\xb9|\xcf\x84\xce\xb5))|\xba\xce\xb5\xce\xb9\xce\xbd(?:\xce(?:\xb5\xcf\x83|\xbf(?:(?:\xce\xb9|\xcf(?:\x85\xcf\x83|\x83)))?|[\xb1\xb7])|\xcf\x89\xce\xbd))|\xe1\xbc(?:\xb0\xce\xbc(?:\xce\xaf|\xe1\xbd\xb6)|\xb4(?:\xce\xbc\xce\xb9|\xcf\x84\xce\xb5)))|\xb9\xcf\x83\xcf\x89\xcf\x83|\xba\xce\xb1(?:\xce\xaf\xcf\x84\xce\xbf\xce\xb9|\xcf\x84(?:\xce[\xac\xb1]|\xe1\xbd\xb0))|\xbc\xce(?:\xae\xcf\x84\xce\xb5|\xb5\xcf\x84(?:\xce[\xac\xb1]|\xe1\xbd\xb0))|\xbf(?:\xce\xbc\xcf\x89\xcf\x83|\xcf\x80\xcf\x89\xcf\x83|\xe1\xbd(?:\x90(?:\xce\xb4(?:\xce(?:\xb5(?:\xce\xaf\xcf\x83|\xe1\xbd\xb6\xcf\x82)|\xad)|\xe1\xbd\xb2(?:\xce\xbd)?)|\xcf\x87\xe1\xbd\xb6)|\x94\xcf\x84\xce\xb5|\x95\xcf\x84\xcf\x89(?:\xcf[\x82\x83])?|\x97\xcf\x84\xce\xbf\xcf[\x82\x83])))|\xcf(?:\x80(?:\xce(?:\xb1\xcf\x81(?:\xce[\xac\xb1]|\xe1\xbd\xb0)|\xb5\xcf\x81(?:\xce\xaf|\xe1\xbd\xb6)|\xbf(?:\xce\xb9(?:\xce(?:\xb5\xcf\x83|\xbf(?:(?:\xce\xb9|\xcf(?:\x85\xcf\x83|\x83)))?|\xb1)|\xcf\x89\xce\xbd)|\xcf\x84\xce\xb5))|\xcf\x81(?:\xce\xbf\xcf\x83|\xcf\x8c\xcf\x83|\xe1\xbd\xb8\xcf\x82))|\x83\xcf\x84\xce(?:\xb7\xce\xbd|\xbf\xce\xbd)|\x84(?:\xce(?:\xb1\xe1\xbf\x96\xcf\x82|\xb9\xce\xbd\xce\xb1|\xbf(?:\xce\xb9\xce\xbf\xe1\xbf\xa6\xcf\x84\xce\xbf\xcf[\x82\x83]|\xcf(?:\x84\xce\xb5|\x8d\xcf\x83)|\xe1(?:\xbd\xba\xcf\x82|\xbf\x96\xcf\x82)))|\xcf\x8c\xcf\x84\xce\xb5))|\xe1(?:\xbc(?:\x80\xce\xbb\xce\xbb(?:\xce\xac|\xe1\xbd\xb0|\xe2\x80\x99|\')|\x84\xce\xbb\xce\xbb\xce\xbf\xcf[\x82\x83]|\x90(?:\xce\xbc(?:\xcf\x8c\xcf\x83|\xe1\xbd\xb8\xcf\x82)|\xcf(?:\x80\xce\xb5\xe1\xbd\xb6|\x83\xcf\x84\xce\xb9))|\x91\xce\xb1\xcf\x85\xcf\x84\xce\xbf\xe1\xbf\xa6)|\xbd(?:\x85(?:\xce\xb8\xce\xb5\xce\xbd|\xcf(?:\x80\xce\xb5\xcf\x81|\x83\xcf\x84\xce\xb9\xcf[\x82\x83]))|\x91(?:\xce\xbc\xcf\x8c\xcf\x83|\xcf\x80(?:\xce\xad\xcf\x81|\xe1\xbd\xb2\xcf\x81))|\xa5\xcf\x83\xcf\x84\xce\xb5)))) + # Greek + bayes_stopword_gr (?^:(?:\xce(?:\xb1(?:\xce(?:\xbb\xce\xbb\xce\xb1|\xbd\xcf\x84\xce\xb9)|\xcf\x85\xcf\x84(?:\xce(?:\xb5\xcf\x83|\xbf(?:(?:\xce\xb9|\xcf(?:\x85\xcf\x83|\x83)))?|[\xb1\xb7])|\xcf\x89\xce\xbd)|\xe1\xbd\x90\xcf\x84(?:\xcf\x8c\xcf\x83|\xe1\xbd\xb8\xcf\x82))|\xb3\xce\xbf\xe1\xbf\xa6\xce\xbd|\xb4\xce\xb1(?:\xce\xaf\xcf\x83|\xe1\xbd\xb6\xcf\x82)|\xb5(?:\xce(?:\xb9(?:\xce(?:\xbc\xce\xb1(?:\xce\xb9|\xcf\x83\xcf\x84\xce\xb5)|\xbd\xce\xb1\xce\xb9)|\xcf\x83(?:\xce\xb1\xce\xb9|\xcf\x84\xce\xb5))|\xba\xce\xb5\xce\xb9\xce\xbd(?:\xce(?:\xb5\xcf\x83|\xbf(?:(?:\xce\xb9|\xcf(?:\x85\xcf\x83|\x83)))?|[\xb1\xb7])|\xcf\x89\xce\xbd))|\xe1\xbc(?:\xb0\xce\xbc(?:\xce\xaf|\xe1\xbd\xb6)|\xb4(?:\xce\xbc\xce\xb9|\xcf\x84\xce\xb5)))|\xb9\xcf\x83\xcf\x89\xcf\x83|\xba\xce\xb1(?:\xce\xaf\xcf\x84\xce\xbf\xce\xb9|\xcf\x84(?:\xce[\xac\xb1]|\xe1\xbd\xb0))|\xbc\xce(?:\xae\xcf\x84\xce\xb5|\xb5\xcf\x84(?:\xce[\xac\xb1]|\xe1\xbd\xb0))|\xbf(?:\xce\xbc\xcf\x89\xcf\x83|\xcf\x80\xcf\x89\xcf\x83|\xe1\xbd(?:\x90(?:\xce\xb4(?:\xce(?:\xb5(?:\xce\xaf\xcf\x83|\xe1\xbd\xb6\xcf\x82)|\xad)|\xe1\xbd\xb2(?:\xce\xbd)?)|\xcf\x87\xe1\xbd\xb6)|\x94\xcf\x84\xce\xb5|\x95\xcf\x84\xcf\x89(?:\xcf[\x82\x83])?|\x97\xcf\x84\xce\xbf\xcf[\x82\x83])))|\xcf(?:\x80(?:\xce(?:\xb1\xcf\x81(?:\xce[\xac\xb1]|\xe1\xbd\xb0)|\xb5\xcf\x81(?:\xce\xaf|\xe1\xbd\xb6)|\xbf(?:\xce\xb9(?:\xce(?:\xb5\xcf\x83|\xbf(?:(?:\xce\xb9|\xcf(?:\x85\xcf\x83|\x83)))?|\xb1)|\xcf\x89\xce\xbd)|\xcf\x84\xce\xb5))|\xcf\x81(?:\xce\xbf\xcf\x83|\xcf\x8c\xcf\x83|\xe1\xbd\xb8\xcf\x82))|\x83\xcf\x84\xce(?:\xb7\xce\xbd|\xbf\xce\xbd)|\x84(?:\xce(?:\xb1\xe1\xbf\x96\xcf\x82|\xb9\xce\xbd\xce\xb1|\xbf(?:\xce\xb9\xce\xbf\xe1\xbf\xa6\xcf\x84\xce\xbf\xcf[\x82\x83]|\xcf(?:\x84\xce\xb5|\x8d\xcf\x83)|\xe1(?:\xbd\xba\xcf\x82|\xbf\x96\xcf\x82)))|\xcf\x8c\xcf\x84\xce\xb5))|\xe1(?:\xbc(?:\x80\xce\xbb\xce\xbb(?:\xce\xac|\xe1\xbd\xb0|\xe2\x80\x99|\')|\x84\xce\xbb\xce\xbb\xce\xbf\xcf[\x82\x83]|\x90(?:\xce\xbc(?:\xcf\x8c\xcf\x83|\xe1\xbd\xb8\xcf\x82)|\xcf(?:\x80\xce\xb5\xe1\xbd\xb6|\x83\xcf\x84\xce\xb9))|\x91\xce\xb1\xcf\x85\xcf\x84\xce\xbf\xe1\xbf\xa6)|\xbd(?:\x85(?:\xce\xb8\xce\xb5\xce\xbd|\xcf(?:\x80\xce\xb5\xcf\x81|\x83\xcf\x84\xce\xb9\xcf[\x82\x83]))|\x91(?:\xce\xbc\xcf\x8c\xcf\x83|\xcf\x80(?:\xce\xad\xcf\x81|\xe1\xbd\xb2\xcf\x81))|\xa5\xcf\x83\xcf\x84\xce\xb5)))) - # Hungarian - bayes_stopword_hu (?^:(?:a(?:bban|h(?:hoz|o(?:gy|l))|k(?:ik|kor)|latt|m(?:ely(?:(?:e(?:k(?:(?:ben|et))?|t)|nek))?|i(?:kor|t)|olyan|\xc3\xadg)|nnak|rr(?:\xc3\xb3l|a)|z(?:o(?:n(?:ban)?|k)|t\xc3\xa1n|ut\xc3\xa1n|zal|\xc3\xa9rt))|be(?:l\xc3\xbcl|nne)|c(?:ikk(?:ek(?:et)?)?|sak)|e(?:bben|ddig|g(?:y(?:e(?:tlen|s)|ik|re|\xc3\xa9b)|\xc3\xa9sz)|hhez|kkor|l(?:len|s\xc3\xb5|\xc3(?:\xa9g|\xb5(?:sz\xc3\xb6r|tt)))|milyen|nnek|rre|z(?:e[kn]|zel|\xc3\xa9rt))|fel\xc3\xa9|h(?:anem|iszen|ogy(?:an)?)|i(?:gen|l(?:l(?:etve|\.)|yen(?:kor)?)|s(?:m\xc3\xa9t|on))|jobban|k(?:e(?:ll(?:ett)?|res(?:s\xc3\xbcnk|zt\xc3\xbcl))|\xc3(?:\xadv\xc3\xbcl|\xb6z\xc3(?:\xb6tt|\xbcl)))|le(?:g(?:al\xc3\xa1bb|yen)|het(?:ett)?|nn[ei]|sz|tt)|m(?:a(?:g(?:\xc3\xa1t|a)|jd)|e(?:l(?:lett|y(?:ek)?)|rt)|i(?:kor|lyen|n(?:d(?:en(?:(?:ki|t))?|ig)|t(?:ha)?)|vel|\xc3\xa9rt)|ost|\xc3\xa1sik)|n(?:agy(?:o(?:bb|n))?|ek(?:em|i)|incs|\xc3\xa9(?:h(?:\xc3\xa1ny|a)|lk\xc3\xbcl))|olyan|pe(?:dig|rsze)|s(?:aj\xc3\xa1t|emmi|ok(?:at|kal)|z(?:e(?:mben|rint)|inte|\xc3\xa1m\xc3\xa1ra))|t(?:al\xc3\xa1n|e(?:h\xc3\xa1t|ljes)|ov\xc3\xa1bb(?:\xc3\xa1)?|\xc3\xb6bb)|u(?:gyanis|t(?:ols\xc3\xb3|\xc3\xa1na?))|v(?:a(?:gy(?:(?:is|ok))?|l(?:a(?:ki|mi(?:nt)?)|\xc3\xb3)|nnak)|ele|is(?:sza|zont)|ol(?:na|t(?:(?:a[km]|unk))?))|\xc3(?:\xa1ltal(?:\xc3\xa1ban)?|\xa9ppen|\xb5ket|\xb6ssze|\xbaj(?:abb|ra)))) + # Hungarian + bayes_stopword_hu (?^:(?:a(?:bban|h(?:hoz|o(?:gy|l))|k(?:ik|kor)|latt|m(?:ely(?:(?:e(?:k(?:(?:ben|et))?|t)|nek))?|i(?:kor|t)|olyan|\xc3\xadg)|nnak|rr(?:\xc3\xb3l|a)|z(?:o(?:n(?:ban)?|k)|t\xc3\xa1n|ut\xc3\xa1n|zal|\xc3\xa9rt))|be(?:l\xc3\xbcl|nne)|c(?:ikk(?:ek(?:et)?)?|sak)|e(?:bben|ddig|g(?:y(?:e(?:tlen|s)|ik|re|\xc3\xa9b)|\xc3\xa9sz)|hhez|kkor|l(?:len|s\xc3\xb5|\xc3(?:\xa9g|\xb5(?:sz\xc3\xb6r|tt)))|milyen|nnek|rre|z(?:e[kn]|zel|\xc3\xa9rt))|fel\xc3\xa9|h(?:anem|iszen|ogy(?:an)?)|i(?:gen|l(?:l(?:etve|\.)|yen(?:kor)?)|s(?:m\xc3\xa9t|on))|jobban|k(?:e(?:ll(?:ett)?|res(?:s\xc3\xbcnk|zt\xc3\xbcl))|\xc3(?:\xadv\xc3\xbcl|\xb6z\xc3(?:\xb6tt|\xbcl)))|le(?:g(?:al\xc3\xa1bb|yen)|het(?:ett)?|nn[ei]|sz|tt)|m(?:a(?:g(?:\xc3\xa1t|a)|jd)|e(?:l(?:lett|y(?:ek)?)|rt)|i(?:kor|lyen|n(?:d(?:en(?:(?:ki|t))?|ig)|t(?:ha)?)|vel|\xc3\xa9rt)|ost|\xc3\xa1sik)|n(?:agy(?:o(?:bb|n))?|ek(?:em|i)|incs|\xc3\xa9(?:h(?:\xc3\xa1ny|a)|lk\xc3\xbcl))|olyan|pe(?:dig|rsze)|s(?:aj\xc3\xa1t|emmi|ok(?:at|kal)|z(?:e(?:mben|rint)|inte|\xc3\xa1m\xc3\xa1ra))|t(?:al\xc3\xa1n|e(?:h\xc3\xa1t|ljes)|ov\xc3\xa1bb(?:\xc3\xa1)?|\xc3\xb6bb)|u(?:gyanis|t(?:ols\xc3\xb3|\xc3\xa1na?))|v(?:a(?:gy(?:(?:is|ok))?|l(?:a(?:ki|mi(?:nt)?)|\xc3\xb3)|nnak)|ele|is(?:sza|zont)|ol(?:na|t(?:(?:a[km]|unk))?))|\xc3(?:\xa1ltal(?:\xc3\xa1ban)?|\xa9ppen|\xb5ket|\xb6ssze|\xbaj(?:abb|ra)))) - # Italian - bayes_stopword_it (?:a(?:bbia(?:(?:mo|no|te))?|gli|ll[aeo]|nche|v(?:e(?:mmo|ndo|s(?:s(?:e(?:ro)?|i(?:mo)?)|t[ei])|te|v(?:a(?:(?:mo|no|te))?|[io]))|r(?:a(?:nno|i)|e(?:bbe(?:ro)?|m(?:mo|o)|st[ei]|te|i)|\xc3[\xa0\xb2])|ut[aeio]))|co(?:me|ntro)|d(?:a(?:gli?|ll[aeo]?)|e(?:gli?|ll[aeo]?)|ove)|e(?:bb(?:e(?:ro)?|i)|ra(?:no|va(?:mo|te))|ssendo)|f(?:a(?:c(?:ci(?:a(?:(?:mo|no|te))?|o)|e(?:mmo|ndo|s(?:s(?:e(?:ro)?|i(?:mo)?)|t[ei])|v(?:a(?:(?:mo|no|te))?|[io])))|nno|r(?:a(?:nno|i)|e(?:bbe(?:ro)?|m(?:mo|o)|st[ei]|te|i)|\xc3[\xa0\xb2]))|ec(?:e(?:ro)?|i)|os(?:s(?:e(?:ro)?|i(?:mo)?)|t[ei])|u(?:mmo|rono))|hanno|loro|miei|n(?:e(?:gli?|ll[aeo]?)|ostr[aeio])|perch\xc3\xa9|qu(?:a(?:le|nt[aeio])|e(?:ll[aeio]|st[aeio]))|s(?:ar(?:a(?:nno|i)|e(?:bbe(?:ro)?|m(?:mo|o)|st[ei]|te|i)|\xc3[\xa0\xb2])|i(?:a(?:mo|no|te)|ete)|ono|t(?:a(?:n(?:do|no)|r(?:a(?:nno|i)|e(?:bbe(?:ro)?|m(?:mo|o)|st[ei]|te|i)|\xc3[\xa0\xb2])|v(?:a(?:(?:mo|no|te))?|[io])|i)|e(?:mmo|s(?:s(?:e(?:ro)?|i(?:mo)?)|t[ei])|tt(?:e(?:ro)?|i))|ia(?:(?:mo|no|te))?)|u(?:gli?|ll[aeo]?|oi))|tu(?:oi|tt[io])|vostr[aeio]) + # Italian + bayes_stopword_it (?:a(?:bbia(?:(?:mo|no|te))?|gli|ll[aeo]|nche|v(?:e(?:mmo|ndo|s(?:s(?:e(?:ro)?|i(?:mo)?)|t[ei])|te|v(?:a(?:(?:mo|no|te))?|[io]))|r(?:a(?:nno|i)|e(?:bbe(?:ro)?|m(?:mo|o)|st[ei]|te|i)|\xc3[\xa0\xb2])|ut[aeio]))|co(?:me|ntro)|d(?:a(?:gli?|ll[aeo]?)|e(?:gli?|ll[aeo]?)|ove)|e(?:bb(?:e(?:ro)?|i)|ra(?:no|va(?:mo|te))|ssendo)|f(?:a(?:c(?:ci(?:a(?:(?:mo|no|te))?|o)|e(?:mmo|ndo|s(?:s(?:e(?:ro)?|i(?:mo)?)|t[ei])|v(?:a(?:(?:mo|no|te))?|[io])))|nno|r(?:a(?:nno|i)|e(?:bbe(?:ro)?|m(?:mo|o)|st[ei]|te|i)|\xc3[\xa0\xb2]))|ec(?:e(?:ro)?|i)|os(?:s(?:e(?:ro)?|i(?:mo)?)|t[ei])|u(?:mmo|rono))|hanno|loro|miei|n(?:e(?:gli?|ll[aeo]?)|ostr[aeio])|perch\xc3\xa9|qu(?:a(?:le|nt[aeio])|e(?:ll[aeio]|st[aeio]))|s(?:ar(?:a(?:nno|i)|e(?:bbe(?:ro)?|m(?:mo|o)|st[ei]|te|i)|\xc3[\xa0\xb2])|i(?:a(?:mo|no|te)|ete)|ono|t(?:a(?:n(?:do|no)|r(?:a(?:nno|i)|e(?:bbe(?:ro)?|m(?:mo|o)|st[ei]|te|i)|\xc3[\xa0\xb2])|v(?:a(?:(?:mo|no|te))?|[io])|i)|e(?:mmo|s(?:s(?:e(?:ro)?|i(?:mo)?)|t[ei])|tt(?:e(?:ro)?|i))|ia(?:(?:mo|no|te))?)|u(?:gli?|ll[aeo]?|oi))|tu(?:oi|tt[io])|vostr[aeio]) - # Norwegian - bayes_stopword_no (?^:(?:alle|b(?:are|egge|l(?:ei|i(?:tt|r))|\xc3\xa5de)|d(?:e(?:i(?:r(?:es|a)|m)|nne|res?|tte)|i(?:sse|tt)|ykk(?:ar)?)|e(?:itt|lle[rs]|tter)|fordi|h(?:a(?:dde|ns)|enn(?:ar|es?)|o(?:nom|ss(?:en)?)|v(?:e[mr]|i(?:lken?|s)|or(?:(?:dan|for))?))|i(?:kk(?:je|e)|n(?:g(?:en|i)|kje|ni))|k(?:or(?:leis|so)|unne|v(?:ar(?:helst)?|en|ifor))|m(?:ange|e(?:dan|get|llom)|i(?:ne|tt)|ykje)|no(?:en|k(?:o[nr]?|re|a))|o(?:gs\xc3\xa5|ver)|s(?:amme|elv|i(?:d(?:an|en)|ne|tt)|j\xc3\xb8l|k(?:al|ulle)|lik|om(?:me|t)|\xc3\xa5nn)|uten|v(?:arte?|er(?:te|e)|ille|or[est]|\xc3\xa6r[et]))) + # Norwegian + bayes_stopword_no (?^:(?:alle|b(?:are|egge|l(?:ei|i(?:tt|r))|\xc3\xa5de)|d(?:e(?:i(?:r(?:es|a)|m)|nne|res?|tte)|i(?:sse|tt)|ykk(?:ar)?)|e(?:itt|lle[rs]|tter)|fordi|h(?:a(?:dde|ns)|enn(?:ar|es?)|o(?:nom|ss(?:en)?)|v(?:e[mr]|i(?:lken?|s)|or(?:(?:dan|for))?))|i(?:kk(?:je|e)|n(?:g(?:en|i)|kje|ni))|k(?:or(?:leis|so)|unne|v(?:ar(?:helst)?|en|ifor))|m(?:ange|e(?:dan|get|llom)|i(?:ne|tt)|ykje)|no(?:en|k(?:o[nr]?|re|a))|o(?:gs\xc3\xa5|ver)|s(?:amme|elv|i(?:d(?:an|en)|ne|tt)|j\xc3\xb8l|k(?:al|ulle)|lik|om(?:me|t)|\xc3\xa5nn)|uten|v(?:arte?|er(?:te|e)|ille|or[est]|\xc3\xa6r[et]))) - # Portuguese - bayes_stopword_pt (?^:(?:aqu(?:el(?:as?|es?)|ilo)|como|de(?:l(?:as?|es?)|pois)|e(?:l(?:as|es)|ntre|ram|s(?:s(?:as?|es?)|t(?:a(?:(?:mos|vam?|s))?|e(?:(?:ja(?:m(?:os)?)?|ve|s))?|iv(?:e(?:(?:mos|r(?:(?:am?|em|mos))?|ssem?))?|\xc3\xa9(?:ramos|ssemos))|ou|\xc3(?:\xa1(?:vamos)?|\xa3o))))|f(?:o(?:mos|r(?:am?|em|mos)|ssem?)|\xc3\xb4(?:ramos|ssemos))|h(?:a(?:ja(?:m(?:os)?)?|vemos)|ouv(?:e(?:(?:mos|r(?:(?:am?|e(?:m(?:os)?|i)|iam?|mos|\xc3(?:\xa3o|\xadamos|\xa1)))?|ssem?))?|\xc3\xa9(?:ramos|ssemos)))|is(?:so|to)|lhes|m(?:ais|e(?:smo|us)|inhas?|uito)|n(?:oss(?:as?|os?)|uma)|p(?:ara|el(?:as?|os?))|qu(?:a(?:ndo|l)|em)|s(?:e(?:ja(?:m(?:os)?)?|r(?:e(?:mos|i)|iam?|\xc3(?:\xa3o|\xadamos|\xa1))|us)|omos|uas)|t(?:amb\xc3\xa9m|e(?:mos|nh(?:a(?:m(?:os)?)?|o)|r(?:e(?:mos|i)|iam?|\xc3(?:\xa3o|\xadamos|\xa1))|us|ve)|i(?:nham?|v(?:e(?:(?:mos|r(?:(?:am?|em|mos))?|ssem?))?|\xc3\xa9(?:ramos|ssemos)))|uas|\xc3\xadnhamos)|voc\xc3\xaas?|\xc3\xa9ramos)) + # Portuguese + bayes_stopword_pt (?^:(?:aqu(?:el(?:as?|es?)|ilo)|como|de(?:l(?:as?|es?)|pois)|e(?:l(?:as|es)|ntre|ram|s(?:s(?:as?|es?)|t(?:a(?:(?:mos|vam?|s))?|e(?:(?:ja(?:m(?:os)?)?|ve|s))?|iv(?:e(?:(?:mos|r(?:(?:am?|em|mos))?|ssem?))?|\xc3\xa9(?:ramos|ssemos))|ou|\xc3(?:\xa1(?:vamos)?|\xa3o))))|f(?:o(?:mos|r(?:am?|em|mos)|ssem?)|\xc3\xb4(?:ramos|ssemos))|h(?:a(?:ja(?:m(?:os)?)?|vemos)|ouv(?:e(?:(?:mos|r(?:(?:am?|e(?:m(?:os)?|i)|iam?|mos|\xc3(?:\xa3o|\xadamos|\xa1)))?|ssem?))?|\xc3\xa9(?:ramos|ssemos)))|is(?:so|to)|lhes|m(?:ais|e(?:smo|us)|inhas?|uito)|n(?:oss(?:as?|os?)|uma)|p(?:ara|el(?:as?|os?))|qu(?:a(?:ndo|l)|em)|s(?:e(?:ja(?:m(?:os)?)?|r(?:e(?:mos|i)|iam?|\xc3(?:\xa3o|\xadamos|\xa1))|us)|omos|uas)|t(?:amb\xc3\xa9m|e(?:mos|nh(?:a(?:m(?:os)?)?|o)|r(?:e(?:mos|i)|iam?|\xc3(?:\xa3o|\xadamos|\xa1))|us|ve)|i(?:nham?|v(?:e(?:(?:mos|r(?:(?:am?|em|mos))?|ssem?))?|\xc3\xa9(?:ramos|ssemos)))|uas|\xc3\xadnhamos)|voc\xc3\xaas?|\xc3\xa9ramos)) - # Russian - bayes_stopword_ru (?^:(?:\xd0(?:\xb1(?:\xd0\xbe\xd0\xbb(?:\xd0\xb5\xd0\xb5|\xd1\x8c\xd1\x88\xd0\xb5)|\xd1(?:\x83\xd0\xb4(?:\xd0\xb5\xd1\x82|\xd1\x82\xd0\xbe)|\x8b(?:\xd0\xbb\xd0[\xb0\xb8\xbe]|\xd1\x82\xd1\x8c)))|\xb2(?:\xd0(?:\xb4\xd1\x80\xd1\x83\xd0\xb3|\xb5\xd0\xb4\xd1\x8c|\xbf\xd1\x80\xd0\xbe\xd1\x87\xd0\xb5\xd0\xbc)|\xd1\x81\xd0\xb5(?:\xd0\xb3\xd0(?:\xb4\xd0\xb0|\xbe)|\xd1\x85))|\xb4(?:\xd0\xb0\xd0\xb6\xd0\xb5|\xd1\x80\xd1\x83\xd0\xb3\xd0\xbe\xd0\xb9)|\xb5\xd1\x81(?:\xd0\xbb\xd0\xb8|\xd1\x82\xd1\x8c)|\xb7\xd0(?:\xb0\xd1\x87\xd0\xb5\xd0\xbc|\xb4\xd0\xb5\xd1\x81\xd1\x8c)|\xb8\xd0\xbd\xd0\xbe\xd0\xb3\xd0\xb4\xd0\xb0|\xba(?:\xd0(?:\xb0\xd0\xba\xd0(?:\xb0\xd1\x8f|\xbe\xd0\xb9)|\xbe\xd0(?:\xb3\xd0\xb4\xd0\xb0|\xbd\xd0\xb5\xd1\x87\xd0\xbd\xd0\xbe))|\xd1\x83\xd0\xb4\xd0\xb0)|\xbb\xd1\x83\xd1\x87\xd1\x88\xd0\xb5|\xbc\xd0(?:\xb5\xd0(?:\xb6\xd0\xb4\xd1\x83|\xbd\xd1\x8f)|\xbd\xd0\xbe\xd0\xb3\xd0\xbe|\xbe\xd0\xb6\xd0(?:\xb5\xd1\x82|\xbd\xd0\xbe))|\xbd\xd0(?:\xb0\xd0(?:\xb4\xd0\xbe|\xba\xd0\xbe\xd0\xbd\xd0\xb5\xd1\x86)|\xb5\xd0(?:\xb3\xd0\xbe|\xbb\xd1\x8c\xd0\xb7\xd1\x8f)|\xb8(?:\xd0(?:\xb1\xd1\x83\xd0\xb4\xd1\x8c|\xba\xd0\xbe\xd0\xb3\xd0\xb4\xd0\xb0)|\xd1\x87\xd0\xb5\xd0\xb3\xd0\xbe))|\xbe\xd0(?:\xb4\xd0\xb8\xd0\xbd|\xbf\xd1\x8f\xd1\x82\xd1\x8c)|\xbf\xd0(?:\xb5\xd1\x80\xd0\xb5\xd0\xb4|\xbe\xd1(?:\x81\xd0\xbb\xd0\xb5|\x82\xd0\xbe\xd0\xbc(?:\xd1\x83)?|\x87\xd1\x82\xd0\xb8)))|\xd1(?:\x80\xd0\xb0\xd0\xb7\xd0\xb2\xd0\xb5|\x81\xd0(?:\xb2\xd0\xbe\xd1\x8e|\xb5\xd0(?:\xb1(?:\xd0\xb5|\xd1\x8f)|\xb9\xd1\x87\xd0\xb0\xd1\x81)|\xbe\xd0\xb2\xd1\x81\xd0\xb5\xd0\xbc)|\x82\xd0(?:\xb0\xd0\xba\xd0\xbe\xd0\xb9|\xb5\xd0(?:\xb1\xd1\x8f|\xbf\xd0\xb5\xd1\x80\xd1\x8c)|\xbe\xd0(?:\xb3\xd0(?:\xb4\xd0\xb0|\xbe)|\xb6\xd0\xb5|\xbb\xd1\x8c\xd0\xba\xd0\xbe))|\x85\xd0\xbe\xd1(?:\x80\xd0\xbe\xd1\x88\xd0\xbe|\x82\xd1\x8c)|\x87(?:\xd0\xb5(?:\xd0\xb3\xd0\xbe|\xd1\x80\xd0\xb5\xd0\xb7)|\xd1(?:\x82\xd0\xbe\xd0\xb1(?:\xd1\x8b)?|\x83\xd1\x82\xd1\x8c))|\x8d\xd1\x82\xd0\xbe(?:\xd0(?:\xb3\xd0\xbe|[\xb9\xbc])|\xd1\x82)))) + # Russian + bayes_stopword_ru (?^:(?:\xd0(?:\xb1(?:\xd0\xbe\xd0\xbb(?:\xd0\xb5\xd0\xb5|\xd1\x8c\xd1\x88\xd0\xb5)|\xd1(?:\x83\xd0\xb4(?:\xd0\xb5\xd1\x82|\xd1\x82\xd0\xbe)|\x8b(?:\xd0\xbb\xd0[\xb0\xb8\xbe]|\xd1\x82\xd1\x8c)))|\xb2(?:\xd0(?:\xb4\xd1\x80\xd1\x83\xd0\xb3|\xb5\xd0\xb4\xd1\x8c|\xbf\xd1\x80\xd0\xbe\xd1\x87\xd0\xb5\xd0\xbc)|\xd1\x81\xd0\xb5(?:\xd0\xb3\xd0(?:\xb4\xd0\xb0|\xbe)|\xd1\x85))|\xb4(?:\xd0\xb0\xd0\xb6\xd0\xb5|\xd1\x80\xd1\x83\xd0\xb3\xd0\xbe\xd0\xb9)|\xb5\xd1\x81(?:\xd0\xbb\xd0\xb8|\xd1\x82\xd1\x8c)|\xb7\xd0(?:\xb0\xd1\x87\xd0\xb5\xd0\xbc|\xb4\xd0\xb5\xd1\x81\xd1\x8c)|\xb8\xd0\xbd\xd0\xbe\xd0\xb3\xd0\xb4\xd0\xb0|\xba(?:\xd0(?:\xb0\xd0\xba\xd0(?:\xb0\xd1\x8f|\xbe\xd0\xb9)|\xbe\xd0(?:\xb3\xd0\xb4\xd0\xb0|\xbd\xd0\xb5\xd1\x87\xd0\xbd\xd0\xbe))|\xd1\x83\xd0\xb4\xd0\xb0)|\xbb\xd1\x83\xd1\x87\xd1\x88\xd0\xb5|\xbc\xd0(?:\xb5\xd0(?:\xb6\xd0\xb4\xd1\x83|\xbd\xd1\x8f)|\xbd\xd0\xbe\xd0\xb3\xd0\xbe|\xbe\xd0\xb6\xd0(?:\xb5\xd1\x82|\xbd\xd0\xbe))|\xbd\xd0(?:\xb0\xd0(?:\xb4\xd0\xbe|\xba\xd0\xbe\xd0\xbd\xd0\xb5\xd1\x86)|\xb5\xd0(?:\xb3\xd0\xbe|\xbb\xd1\x8c\xd0\xb7\xd1\x8f)|\xb8(?:\xd0(?:\xb1\xd1\x83\xd0\xb4\xd1\x8c|\xba\xd0\xbe\xd0\xb3\xd0\xb4\xd0\xb0)|\xd1\x87\xd0\xb5\xd0\xb3\xd0\xbe))|\xbe\xd0(?:\xb4\xd0\xb8\xd0\xbd|\xbf\xd1\x8f\xd1\x82\xd1\x8c)|\xbf\xd0(?:\xb5\xd1\x80\xd0\xb5\xd0\xb4|\xbe\xd1(?:\x81\xd0\xbb\xd0\xb5|\x82\xd0\xbe\xd0\xbc(?:\xd1\x83)?|\x87\xd1\x82\xd0\xb8)))|\xd1(?:\x80\xd0\xb0\xd0\xb7\xd0\xb2\xd0\xb5|\x81\xd0(?:\xb2\xd0\xbe\xd1\x8e|\xb5\xd0(?:\xb1(?:\xd0\xb5|\xd1\x8f)|\xb9\xd1\x87\xd0\xb0\xd1\x81)|\xbe\xd0\xb2\xd1\x81\xd0\xb5\xd0\xbc)|\x82\xd0(?:\xb0\xd0\xba\xd0\xbe\xd0\xb9|\xb5\xd0(?:\xb1\xd1\x8f|\xbf\xd0\xb5\xd1\x80\xd1\x8c)|\xbe\xd0(?:\xb3\xd0(?:\xb4\xd0\xb0|\xbe)|\xb6\xd0\xb5|\xbb\xd1\x8c\xd0\xba\xd0\xbe))|\x85\xd0\xbe\xd1(?:\x80\xd0\xbe\xd1\x88\xd0\xbe|\x82\xd1\x8c)|\x87(?:\xd0\xb5(?:\xd0\xb3\xd0\xbe|\xd1\x80\xd0\xb5\xd0\xb7)|\xd1(?:\x82\xd0\xbe\xd0\xb1(?:\xd1\x8b)?|\x83\xd1\x82\xd1\x8c))|\x8d\xd1\x82\xd0\xbe(?:\xd0(?:\xb3\xd0\xbe|[\xb9\xbc])|\xd1\x82)))) - # Swedish - bayes_stopword_se (?^:(?:all[at]|bl(?:ev|i(?:vit|r))|d(?:e(?:nna|ras|ssa?|tta)|i(?:na|tt))|e(?:fter|ller)|fr\xc3\xa5n|h(?:a(?:de|ns)|ennes?|onom)|i(?:cke|n(?:gen|om|te))|kunde|m(?:ellan|i(?:na|tt)|ycket)|n\xc3\xa5g(?:o[nt]|ra)|s(?:amma|edan|i(?:na|tta)|j\xc3\xa4lv|kulle|\xc3\xa5dan[at]?)|till|u(?:nder|tan)|v(?:ar(?:f\xc3\xb6r|it|je|[ast])|ilk(?:as?|e[nt])|\xc3\xa5r[at])|\xc3\xb6ver)) + # Swedish + bayes_stopword_se (?^:(?:all[at]|bl(?:ev|i(?:vit|r))|d(?:e(?:nna|ras|ssa?|tta)|i(?:na|tt))|e(?:fter|ller)|fr\xc3\xa5n|h(?:a(?:de|ns)|ennes?|onom)|i(?:cke|n(?:gen|om|te))|kunde|m(?:ellan|i(?:na|tt)|ycket)|n\xc3\xa5g(?:o[nt]|ra)|s(?:amma|edan|i(?:na|tta)|j\xc3\xa4lv|kulle|\xc3\xa5dan[at]?)|till|u(?:nder|tan)|v(?:ar(?:f\xc3\xb6r|it|je|[ast])|ilk(?:as?|e[nt])|\xc3\xa5r[at])|\xc3\xb6ver)) - # Turkish - bayes_stopword_tr (?^:(?:a(?:caba|sl\xc4\xb1nda)|b(?:az\xc4\xb1|elki|ir(?:ka\xc3\xa7|\xc5\x9fey|i))|d(?:aha|efa|iye)|e\xc4\x9fer|gibi|hepsi|i\xc3\xa7in|n(?:as\xc4\xb1l|e(?:den|r(?:de|e(?:de|ye)))|i(?:ye|\xc3\xa7in))|sanki|veya|yani|\xc3\xa7\xc3\xbcnk\xc3\xbc)) + # Turkish + bayes_stopword_tr (?^:(?:a(?:caba|sl\xc4\xb1nda)|b(?:az\xc4\xb1|elki|ir(?:ka\xc3\xa7|\xc5\x9fey|i))|d(?:aha|efa|iye)|e\xc4\x9fer|gibi|hepsi|i\xc3\xa7in|n(?:as\xc4\xb1l|e(?:den|r(?:de|e(?:de|ye)))|i(?:ye|\xc3\xa7in))|sanki|veya|yani|\xc3\xa7\xc3\xbcnk\xc3\xbc)) + endif endif endif diff --git a/sa-updates/72_active.cf b/sa-updates/72_active.cf index a09b034..3f5990d 100644 --- a/sa-updates/72_active.cf +++ b/sa-updates/72_active.cf @@ -158,6 +158,13 @@ describe ADMITS_SPAM Admits this is an ad tflags ADMITS_SPAM publish ##} ADMITS_SPAM +##{ ADULT_DATING_COMPANY + +meta ADULT_DATING_COMPANY __ADULTDATINGCOMPANY_BODY || __ADULTDATINGCOMPANY_FROM || __ADULTDATINGCOMPANY_REPTO +#score ADULT_DATING_COMPANY 10.000 # limit +tflags ADULT_DATING_COMPANY publish +##} ADULT_DATING_COMPANY + ##{ ADVANCE_FEE_2_NEW_FORM meta ADVANCE_FEE_2_NEW_FORM (__ADVANCE_FEE_2_NEW_FORM && !__ADVANCE_FEE_3_NEW_FORM && !__ADVANCE_FEE_4_NEW_FORM && !__ADVANCE_FEE_5_NEW_FORM) && !__FROM_LOWER && !__HAS_X_LOOP @@ -285,7 +292,7 @@ tflags ALIBABA_IMG_NOT_RCVD_ALI publish ##{ AMAZON_IMG_NOT_RCVD_AMZN -meta AMAZON_IMG_NOT_RCVD_AMZN __AMAZON_IMG_NOT_RCVD_AMZN && !__HDR_RCVD_KEEPA && !__URI_DBL_DOM && !__RCD_RDNS_SMTP && !__RCD_RDNS_MTA && !__DATE_LOWER && !__MSGID_LIST +meta AMAZON_IMG_NOT_RCVD_AMZN __AMAZON_IMG_NOT_RCVD_AMZN && !__HDR_RCVD_KEEPA && !__URI_DBL_DOM && !__RCD_RDNS_SMTP && !__RCD_RDNS_MTA && !__DATE_LOWER && !__MSGID_LIST && !__URI_PRODUCT_AMAZON && !__HAS_ERRORS_TO #score AMAZON_IMG_NOT_RCVD_AMZN 2.500 # limit describe AMAZON_IMG_NOT_RCVD_AMZN Amazon hosted image but message not from Amazon tflags AMAZON_IMG_NOT_RCVD_AMZN publish @@ -582,13 +589,6 @@ describe BODY_SINGLE_URI Message body is only a URI #score BODY_SINGLE_URI 2.500 # limit ##} BODY_SINGLE_URI -##{ BODY_SINGLE_WORD - -meta BODY_SINGLE_WORD __BODY_SINGLE_WORD && !ALL_TRUSTED && !__HDRS_LCASE_KNOWN && !__FROM_ALL_NUMS && !__RCD_RDNS_SMTP -describe BODY_SINGLE_WORD Message body is only one word (no spaces) -#score BODY_SINGLE_WORD 2.500 # limit -##} BODY_SINGLE_WORD - ##{ BODY_URI_ONLY meta BODY_URI_ONLY __BODY_URI_ONLY && !__NOT_SPOOFED && !__TO_EQ_FROM_DOM && !__X_CRON_ENV && !__DKIM_EXISTS && !__VIA_ML && !__HAS_X_REF && !__RCD_RDNS_MX_MESSY && !__RCD_RDNS_MAIL_MESSY && !__RCD_RDNS_SMTP_MESSY && !__MSGID_JAVAMAIL && !__RP_MATCHES_RCVD && !__URI_GOOGLE_DRV @@ -649,11 +649,6 @@ ifplugin Mail::SpamAssassin::Plugin::DKIM endif ##} BTC_ORG ifplugin Mail::SpamAssassin::Plugin::DKIM -##{ BUG6152_INVALID_DATE_TZ_ABSURD - -header BUG6152_INVALID_DATE_TZ_ABSURD Date =~ /[-+](?!(?:0\d|1[0-4])(?:[03]0|[14]5))\d{4}/ -##} BUG6152_INVALID_DATE_TZ_ABSURD - ##{ BULK_RE_SUSP_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004002) @@ -674,6 +669,13 @@ describe CANT_SEE_AD You really want to see our spam. tflags CANT_SEE_AD publish ##} CANT_SEE_AD +##{ CK_HELO_GENERIC + +header CK_HELO_GENERIC X-Spam-Relays-Untrusted =~ /^[^\]]+helo=(?=\S*(?:pool|dyna|lease|dial|dip|static))\S*\d+[^\d\s]+\d+[^\]]+ auth= /i +describe CK_HELO_GENERIC Relay used name indicative of a Dynamic Pool or Generic rPTR +#score CK_HELO_GENERIC 0.25 +##} CK_HELO_GENERIC + ##{ CN_B2B_SPAMMER body CN_B2B_SPAMMER /\bWe are (?:(?:a )?(?:China|Taiwan)[-\s]based|(?:one of (?:the )?best|(?:a )?leading) (?:international|[^\.]{10,90} (?:in|from) (?:\w+, )?(?:China|Taiwan)))\b/i @@ -794,6 +796,12 @@ body DEAR_WINNER /\bdear.{1,20}winner/i describe DEAR_WINNER Spam with generic salutation of "dear winner" ##} DEAR_WINNER +##{ DETAILS_OF_PRODUCT + +body DETAILS_OF_PRODUCT /(?:Please|kindly) (?:see|refer to|check(?: out)?) the (?:details of the product|(?:detailed |complete |specific )?product (?:details|information)) (below|following|that follow|in detail)|the following (?:(?:is the )?(?:detailed )?product information|is a brief introduction to (?:\w+\s){0,5}this product)|\bhere (is|are) some basic information about this|you can (?:\w+ )?understand our product/i +#score DETAILS_OF_PRODUCT 1.250 # limit +##} DETAILS_OF_PRODUCT + ##{ DKIMWL_BL ifplugin Mail::SpamAssassin::Plugin::AskDNS ifplugin Mail::SpamAssassin::Plugin::AskDNS @@ -935,13 +943,6 @@ header DRUGS_HDIA Subject =~ /\bhoodia\b/i describe DRUGS_HDIA Subject mentions "hoodia" ##} DRUGS_HDIA -##{ DSN_NO_MIMEVERSION - -meta DSN_NO_MIMEVERSION (__BOUNCE_RPATH_NULL && !__MIME_VERSION) -describe DSN_NO_MIMEVERSION Return-Path <> and no MIME-Version: header -#score DSN_NO_MIMEVERSION 2 -##} DSN_NO_MIMEVERSION - ##{ DX_TEXT_02 body DX_TEXT_02 /\b(?:change|modif(?:y|ications?)) (?:of|to|(?:yo)?ur) (?:message|sub|comm) stat/i @@ -1396,6 +1397,13 @@ meta FROM_MISSP_MSFT __FROM_RUNON && (__ANY_OUTLOOK_MUA || __MIM describe FROM_MISSP_MSFT From misspaced + supposed Microsoft tool ##} FROM_MISSP_MSFT +##{ FROM_MISSP_PHISH + +meta FROM_MISSP_PHISH __FROM_MISSP_PHISH && !__DOS_HAS_LIST_UNSUB +describe FROM_MISSP_PHISH Malformed, claims to be from financial organization - possible phish +#score FROM_MISSP_PHISH 3.500 # limit +##} FROM_MISSP_PHISH + ##{ FROM_MISSP_REPLYTO meta FROM_MISSP_REPLYTO __FROM_MISSP_REPLYTO && !__NOT_SPOOFED && !__RCD_RDNS_MTA_MESSY && !__TO___LOWER && !__COMMENT_EXISTS && !__UNSUB_LINK && !__MIME_QP && !__CTYPE_MULTIPART_ALT && !__JM_REACTOR_DATE && !__PLING_QUERY && !__DOS_HAS_LIST_UNSUB @@ -1432,6 +1440,13 @@ if can(Mail::SpamAssassin::Conf::perl_min_version_5010000) endif ##} FROM_MULTI_NORDNS if can(Mail::SpamAssassin::Conf::perl_min_version_5010000) +##{ FROM_NAME_EQ_TO_G_DRIVE + +meta FROM_NAME_EQ_TO_G_DRIVE !__SHORT_BODY_G_DRIVE_DYN && __SHORT_BODY_G_DRIVE && (__PDS_TO_EQ_FROM_NAME_1 || __PDS_TO_EQ_FROM_NAME_2) +describe FROM_NAME_EQ_TO_G_DRIVE From:name equals To:addr and GDRIVE link +#score FROM_NAME_EQ_TO_G_DRIVE 1.5 # limit +##} FROM_NAME_EQ_TO_G_DRIVE + ##{ FROM_NEWDOM_BTC if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS if (version >= 3.004001) @@ -1558,6 +1573,11 @@ meta FSL_HELO_BARE_IP_1 __FSL_HELO_BARE_IP_1 && !ALL_TRUSTED header FSL_HELO_DEVICE X-Spam-Relays-External =~ /\bhelo=(?:(?:dsl)?device|speedtouch)\.lan\b/i ##} FSL_HELO_DEVICE +##{ FSL_HELO_FAKE + +header FSL_HELO_FAKE X-Spam-Relays-External =~ /\bhelo=(?:yandex.ru|(?:hotmail|gmail|google|yahoo|msn|microsoft)\.com)\b/i +##} FSL_HELO_FAKE + ##{ FSL_HELO_NON_FQDN_1 header FSL_HELO_NON_FQDN_1 X-Spam-Relays-External =~ /^[^\]]+ helo=[a-zA-Z0-9-_]+ /i @@ -1908,6 +1928,14 @@ describe GOOG_REDIR_SHORT Google redirect to obscure spamvertised tflags GOOG_REDIR_SHORT publish ##} GOOG_REDIR_SHORT +##{ GOOG_STO_EMAIL_PHISH + +meta GOOG_STO_EMAIL_PHISH __URI_GOOG_STO_EMAIL && (__PDS_FROM_NAME_TO_DOMAIN || __TO_IN_SUBJ || __FROM_ADMIN || __VERIFY_ACCOUNT) +describe GOOG_STO_EMAIL_PHISH Possible phishing with google hosted content URI having email address +#score GOOG_STO_EMAIL_PHISH 3.00 # limit +tflags GOOG_STO_EMAIL_PHISH publish +##} GOOG_STO_EMAIL_PHISH + ##{ GOOG_STO_HTML_PHISH meta GOOG_STO_HTML_PHISH __GOOG_STO_HTML_PHISH @@ -1958,9 +1986,9 @@ tflags HAS_X_NO_RELAY publish ##{ HAS_X_OUTGOING_SPAM_STAT -meta HAS_X_OUTGOING_SPAM_STAT __HAS_X_OUTGOING_SPAM_STAT && !MAILING_LIST_MULTI && !__HAS_X_MAILMAN_VERSION && !__AUTOREPLY_ASU && !__THREAD_INDEX_GOOD +meta HAS_X_OUTGOING_SPAM_STAT __HAS_X_OUTGOING_SPAM_STAT && !MAILING_LIST_MULTI && !__HAS_X_MAILMAN_VERSION && !__AUTOREPLY_ASU && !__THREAD_INDEX_GOOD && !__HAS_X_LOOP && !__DOC_ATTACH && !__PDF_ATTACH && !__FROM_EQ_ORG_1 && !__HAS_IN_REPLY_TO describe HAS_X_OUTGOING_SPAM_STAT Has header claiming outbound spam scan - why trust the results? -#score HAS_X_OUTGOING_SPAM_STAT 3.000 # limit +#score HAS_X_OUTGOING_SPAM_STAT 2.000 # limit tflags HAS_X_OUTGOING_SPAM_STAT publish ##} HAS_X_OUTGOING_SPAM_STAT @@ -2054,11 +2082,6 @@ endif header HELO_FRIEND X-Spam-Relays-External =~ /^[^\]]+ helo=friend /i ##} HELO_FRIEND -##{ HELO_LH_HOME - -header HELO_LH_HOME X-Spam-Relays-External =~ /^[^\]]+ helo=\S+\.(?:home|lan) /i -##} HELO_LH_HOME - ##{ HELO_LH_LD header HELO_LH_LD X-Spam-Relays-External =~ /^[^\]]+ helo=localhost\.localdomain /i @@ -2133,7 +2156,7 @@ endif ##{ HK_RANDOM_ENVFROM -header HK_RANDOM_ENVFROM EnvelopeFrom =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#-]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr)|[^@]{26}|.*?@.{0,20}\b(?:cmp-info|cmpgnr|cnn|tori|jysk|amadeus)\.[a-z]{2,3}$)[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi +header HK_RANDOM_ENVFROM EnvelopeFrom =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#-]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr)|[^@]{26}|.*?\@.{0,20}\b(?:cmp-info|cmpgnr|cnn|tori|jysk|amadeus|amazon)\.[a-z]{2,3}$)[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi describe HK_RANDOM_ENVFROM Envelope sender username looks random #score HK_RANDOM_ENVFROM 1 tflags HK_RANDOM_ENVFROM publish @@ -2141,7 +2164,7 @@ tflags HK_RANDOM_ENVFROM publish ##{ HK_RANDOM_FROM -header HK_RANDOM_FROM From:addr =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#-]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr)|[^@]{26}|.*?@.{0,20}\b(?:cmp-info|cmpgnr|cnn|tori|jysk|amadeus)\.[a-z]{2,3}$)[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi +header HK_RANDOM_FROM From:addr =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#-]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr)|[^@]{26}|.*?\@.{0,20}\b(?:cmp-info|cmpgnr|cnn|tori|jysk|amadeus|amazon)\.[a-z]{2,3}$)[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi describe HK_RANDOM_FROM From username looks random #score HK_RANDOM_FROM 1 tflags HK_RANDOM_FROM publish @@ -2149,7 +2172,7 @@ tflags HK_RANDOM_FROM publish ##{ HK_RANDOM_REPLYTO -header HK_RANDOM_REPLYTO Reply-To:addr =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#-]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr)|[^@]{26}|.*?@.{0,20}\b(?:cmp-info|cmpgnr|cnn|tori|jysk|amadeus)\.[a-z]{2,3}$)[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi +header HK_RANDOM_REPLYTO Reply-To:addr =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#-]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr)|[^@]{26}|.*?\@.{0,20}\b(?:cmp-info|cmpgnr|cnn|tori|jysk|amadeus|amazon)\.[a-z]{2,3}$)[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi describe HK_RANDOM_REPLYTO Reply-To username looks random #score HK_RANDOM_REPLYTO 1 tflags HK_RANDOM_REPLYTO publish @@ -2179,7 +2202,7 @@ meta HK_WIN ((__hk_win_2 + __hk_win_3 + __hk_win_4 + __hk_win_5 + __hk_win_7 meta HOSTED_IMG_DIRECT_MX __HOSTED_IMG_DIRECT_MX && !__DKIM_EXISTS #score HOSTED_IMG_DIRECT_MX 3.500 # limit -describe HOSTED_IMG_DIRECT_MX Image hosted at large ecomm site, message direct-to-mx +describe HOSTED_IMG_DIRECT_MX Image hosted at large ecomm, CDN or hosting site, message direct-to-mx tflags HOSTED_IMG_DIRECT_MX publish ##} HOSTED_IMG_DIRECT_MX @@ -2195,7 +2218,7 @@ tflags HOSTED_IMG_DQ_UNSUB publish meta HOSTED_IMG_FREEM __HOSTED_IMG_FREEM && !__THREADED #score HOSTED_IMG_FREEM 3.500 # limit -describe HOSTED_IMG_FREEM Image hosted at large ecomm site or redirected, freemail from or reply-to +describe HOSTED_IMG_FREEM Image hosted at large ecomm, CDN or hosting site or redirected, freemail from or reply-to tflags HOSTED_IMG_FREEM publish ##} HOSTED_IMG_FREEM @@ -2203,7 +2226,7 @@ tflags HOSTED_IMG_FREEM publish meta HOSTED_IMG_MULTI __HOSTED_IMG_MULTI && !__DKIM_EXISTS #score HOSTED_IMG_MULTI 3.000 # limit -describe HOSTED_IMG_MULTI Multiple images hosted at different large ecomm sites, free image sites, or redirected +describe HOSTED_IMG_MULTI Multiple images hosted at different large ecomm, CDN or hosting sites, free image sites, or redirected tflags HOSTED_IMG_MULTI publish ##} HOSTED_IMG_MULTI @@ -2231,6 +2254,13 @@ describe HTML_ENTITY_ASCII_TINY Obfuscated ASCII + tiny fonts tflags HTML_ENTITY_ASCII_TINY publish ##} HTML_ENTITY_ASCII_TINY +##{ HTML_FONT_TINY_NORDNS + +meta HTML_FONT_TINY_NORDNS __HTML_FONT_TINY_01 && __RDNS_NONE +describe HTML_FONT_TINY_NORDNS Font too small to read, no rDNS +#score HTML_FONT_TINY_NORDNS 1.500 # limit +##} HTML_FONT_TINY_NORDNS + ##{ HTML_OFF_PAGE meta HTML_OFF_PAGE __HTML_OFF_PAGE && !__RP_MATCHES_RCVD && !__LONGLINE && !__DKIM_EXISTS @@ -2257,6 +2287,14 @@ describe HTML_SINGLET_MANY Many single-letter HTML format blocks tflags HTML_SINGLET_MANY publish ##} HTML_SINGLET_MANY +##{ HTML_TAG_BALANCE_CENTER ifplugin Mail::SpamAssassin::Plugin::HTMLEval + +ifplugin Mail::SpamAssassin::Plugin::HTMLEval + meta HTML_TAG_BALANCE_CENTER __HTML_TAG_BALANCE_CENTER && !__RCD_RDNS_MAIL_MESSY && !__RCD_RDNS_SMTP_MESSY + describe HTML_TAG_BALANCE_CENTER Malformatted HTML +endif +##} HTML_TAG_BALANCE_CENTER ifplugin Mail::SpamAssassin::Plugin::HTMLEval + ##{ HTML_TEXT_INVISIBLE_FONT if can(Mail::SpamAssassin::Conf::feature_bug6558_free) if can(Mail::SpamAssassin::Conf::feature_bug6558_free) @@ -2386,6 +2424,14 @@ describe KHOP_HELO_FCRDNS Relay HELO differs from its IP's reverse DNS #score KHOP_HELO_FCRDNS 0.4 # 20090603 ##} KHOP_HELO_FCRDNS +##{ LINKEDIN_IMG_NOT_RCVD_LNKN + +meta LINKEDIN_IMG_NOT_RCVD_LNKN __LINKED_IMG_NOT_RCVD_LINK && !__LUNSUB_BEFORE_SUBJDT +#score LINKEDIN_IMG_NOT_RCVD_LNKN 2.500 # limit +describe LINKEDIN_IMG_NOT_RCVD_LNKN Linkedin hosted image but message not from Linkedin +tflags LINKEDIN_IMG_NOT_RCVD_LNKN publish +##} LINKEDIN_IMG_NOT_RCVD_LNKN + ##{ LIST_PRTL_PUMPDUMP meta LIST_PRTL_PUMPDUMP __LIST_PRTL_PUMPDUMP && !__DKIM_EXISTS @@ -2489,13 +2535,6 @@ describe LOTTO_AGENT Claims Agent #score LOTTO_AGENT 1.50 # limit ##} LOTTO_AGENT -##{ LOTTO_DEPT - -meta LOTTO_DEPT __LOTTO_DEPT && !__COMMENT_EXISTS && !__HAS_IN_REPLY_TO && !__THREADED && !__VIA_ML && !__TO_YOUR_ORG && !__TRAVEL_ITINERARY && !__AUTO_ACCIDENT -describe LOTTO_DEPT Claims Department -#score LOTTO_DEPT 2.00 # limit -##} LOTTO_DEPT - ##{ LUCRATIVE meta LUCRATIVE ( __LUCRATIVE && __HELO_NO_DOMAIN ) && !ALL_TRUSTED @@ -2509,12 +2548,6 @@ tflags LUCRATIVE publish header L_SPAM_TOOL_13 Date =~ /\s[+-]\d(?![2358]45)\d[124-9]\d$/ ##} L_SPAM_TOOL_13 -##{ MALFORMED_FREEMAIL - -meta MALFORMED_FREEMAIL (MISSING_HEADERS||__HDRS_LCASE) && FREEMAIL_FROM -describe MALFORMED_FREEMAIL Bad headers on message from free email service -##} MALFORMED_FREEMAIL - ##{ MALF_HTML_B64 meta MALF_HTML_B64 MIME_BASE64_TEXT && HTML_MIME_NO_HTML_TAG @@ -2647,11 +2680,6 @@ describe MIXED_CENTER_CASE Has center tag in mixed case tflags MIXED_CENTER_CASE publish ##} MIXED_CENTER_CASE -##{ MIXED_CTYPE_CASE - -header MIXED_CTYPE_CASE Content-Type =~ m;^(?i:text/)(?!html|HTML)[Hh][Tt][Mm][Ll]; -##} MIXED_CTYPE_CASE - ##{ MIXED_ES if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ifplugin Mail::SpamAssassin::Plugin::ReplaceTags if can(Mail::SpamAssassin::Conf::feature_bug6558_free) @@ -2818,11 +2846,11 @@ describe MSGID_MULTIPLE_AT Message-ID contains multiple '@' characters #score MSGID_MULTIPLE_AT 0.001 ##} MSGID_MULTIPLE_AT -##{ MSGID_NOFQDN1 +##{ MSGID_WSP_TRAIL -meta MSGID_NOFQDN1 __MSGID_NOFQDN1 -describe MSGID_NOFQDN1 Message-ID with no domain name -##} MSGID_NOFQDN1 +header MSGID_WSP_TRAIL Message-ID:raw =~ /< [^>]* \s > [^<>]* \z/xm +describe MSGID_WSP_TRAIL Trailing whitespace before '>' in Message-ID header +##} MSGID_WSP_TRAIL ##{ MSMAIL_PRI_ABNORMAL @@ -2872,13 +2900,6 @@ describe NICE_REPLY_A Looks like a legit reply (A) tflags NICE_REPLY_A nice ##} NICE_REPLY_A -##{ NORDNS_LOW_CONTRAST - -meta NORDNS_LOW_CONTRAST (__HTML_FONT_LOW_CONTRAST_MINFP && __RDNS_NONE) && !ALL_TRUSTED && !__HAS_CID -describe NORDNS_LOW_CONTRAST No rDNS + hidden text -#score NORDNS_LOW_CONTRAST 2.500 # limit -##} NORDNS_LOW_CONTRAST - ##{ NOT_SPAM body NOT_SPAM /\b(?:(?:this (?:e?-?mail|message)|we) (?:is not|are not|cannot be considered) Spam|ESTE CORREO NO PUEDE SER CONSIDERADO (?:INTRUSIVO|spam)|Diese Nachricht ist KEIN SPAM)/i @@ -2971,6 +2992,11 @@ endif endif ##} OFFER_ONLY_AMERICA if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval +##{ ONLINE_MKTG_CNSLT + +body ONLINE_MKTG_CNSLT /\bonline marketing consultant\b/i +##} ONLINE_MKTG_CNSLT + ##{ ORDER_TODAY meta ORDER_TODAY __ORDER_TODAY && (__HTML_IMG_ONLY || __ALIBABA_IMG_NOT_RCVD_ALI || __TO_NO_BRKTS_NORDNS_HTML) @@ -2994,13 +3020,6 @@ describe PART_CID_STOCK_LESS Has a spammy image attachment (by Content-ID, more endif ##} PART_CID_STOCK_LESS ifplugin Mail::SpamAssassin::Plugin::MIMEHeader -##{ PDS_BAD_THREAD_QP_64 - -meta PDS_BAD_THREAD_QP_64 __PDS_QP_64 && __HAS_THREAD_INDEX && !__THREAD_INDEX_GOOD -describe PDS_BAD_THREAD_QP_64 Bad thread header - short QP -#score PDS_BAD_THREAD_QP_64 1.0 -##} PDS_BAD_THREAD_QP_64 - ##{ PDS_BTC_ID meta PDS_BTC_ID __PDS_BTC_ID @@ -3015,6 +3034,17 @@ describe PDS_BTC_MSGID Bitcoin ID with T_MSGID_NOFQDN2 #score PDS_BTC_MSGID 1.0 ##} PDS_BTC_MSGID +##{ PDS_BTC_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval + +if (version >= 3.004002) +ifplugin Mail::SpamAssassin::Plugin::WLBLEval +meta PDS_BTC_NTLD ( __BITCOIN_ID && __FROM_ADDRLIST_SUSPNTLD ) +describe PDS_BTC_NTLD Bitcoin suspect NTLD +#score PDS_BTC_NTLD 2.0 # limit +endif +endif +##} PDS_BTC_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval + ##{ PDS_DBL_URL_TNB_RUNON meta PDS_DBL_URL_TNB_RUNON __TO_NO_BRKTS_FROM_RUNON && __PDS_DOUBLE_URL @@ -3022,17 +3052,6 @@ describe PDS_DBL_URL_TNB_RUNON Double-url and To no arrows, from runon #score PDS_DBL_URL_TNB_RUNON 2.0 ##} PDS_DBL_URL_TNB_RUNON -##{ PDS_EMPTYSUBJ_URISHRT ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000) - -ifplugin Mail::SpamAssassin::Plugin::WLBLEval -if (version >= 3.004000) -meta PDS_EMPTYSUBJ_URISHRT (__PDS_URISHORTENER || __URL_SHORTENER) && __SUBJECT_EMPTY && __PDS_MSG_1024 -describe PDS_EMPTYSUBJ_URISHRT Empty subject with little more than URI shortener -#score PDS_EMPTYSUBJ_URISHRT 1.5 # limit -endif -endif -##} PDS_EMPTYSUBJ_URISHRT ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000) - ##{ PDS_FRNOM_TODOM_DBL_URL meta PDS_FRNOM_TODOM_DBL_URL PDS_FROM_NAME_TO_DOMAIN && __PDS_DOUBLE_URL @@ -3047,15 +3066,6 @@ describe PDS_FRNOM_TODOM_NAKED_TO Naked to From name equals to Domain #score PDS_FRNOM_TODOM_NAKED_TO 1.5 ##} PDS_FRNOM_TODOM_NAKED_TO -##{ PDS_FROM_2_EMAILS if can(Mail::SpamAssassin::Conf::perl_min_version_5010000) - -if can(Mail::SpamAssassin::Conf::perl_min_version_5010000) - meta PDS_FROM_2_EMAILS __PDS_FROM_2_EMAILS && !__VIA_ML && !__VIA_RESIGNER && !__MSGID_JAVAMAIL && !__RCD_RDNS_MAIL_MESSY && !__RCD_RDNS_SMTP_MESSY && !__DKIM_EXISTS - describe PDS_FROM_2_EMAILS From header has multiple different addresses -# score PDS_FROM_2_EMAILS 3.500 # limit -endif -##} PDS_FROM_2_EMAILS if can(Mail::SpamAssassin::Conf::perl_min_version_5010000) - ##{ PDS_FROM_2_EMAILS_SHRTNER ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000) ifplugin Mail::SpamAssassin::Plugin::WLBLEval @@ -3082,23 +3092,12 @@ describe PDS_HELO_SPF_FAIL High profile HELO that fails SPF tflags PDS_HELO_SPF_FAIL net ##} PDS_HELO_SPF_FAIL -##{ PDS_NAKED_TO_NUMERO +##{ PDS_HP_HELO_NORDNS -meta PDS_NAKED_TO_NUMERO __NAKED_TO && __NUMBERONLY_TLD -describe PDS_NAKED_TO_NUMERO Naked-to, numberonly domain -#score PDS_NAKED_TO_NUMERO 2.0 -##} PDS_NAKED_TO_NUMERO - -##{ PDS_NO_FULL_NAME_SPOOFED_URL ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000) - -ifplugin Mail::SpamAssassin::Plugin::WLBLEval -if (version >= 3.004000) -meta PDS_NO_FULL_NAME_SPOOFED_URL __PDS_MSG_1024 && __KHOP_NO_FULL_NAME && __SPOOFED_URL && !(__VIA_ML || __SENDER_BOT || __YAHOO_BULK || __UNSUB_LINK || __THREADED || __URL_SHORTENER) -describe PDS_NO_FULL_NAME_SPOOFED_URL HTML message short, T_SPOOFED_URL and T_KHOP_NO_FULL_NAME -#score PDS_NO_FULL_NAME_SPOOFED_URL 0.75 # limit -endif -endif -##} PDS_NO_FULL_NAME_SPOOFED_URL ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000) +meta PDS_HP_HELO_NORDNS RDNS_NONE && __HELO_HIGHPROFILE +describe PDS_HP_HELO_NORDNS High profile HELO with no sender rDNS +#score PDS_HP_HELO_NORDNS 1.0 +##} PDS_HP_HELO_NORDNS ##{ PDS_OTHER_BAD_TLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval @@ -3111,6 +3110,27 @@ endif endif ##} PDS_OTHER_BAD_TLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval +##{ PDS_PHPEXP_BOT + +meta PDS_PHPEXP_BOT __SENDER_BOT && (__PDS_TONAME_EQ_TOLOCAL + __NAKED_TO >= 1) && (__PDS_PHP_EVAL2 + __PDS_PHP_EVAL1 + T_PDS_X_PHP_WP_EXP + __PDS_X_PHP_WELLKNOWN >= 1) +describe PDS_PHPEXP_BOT PHP exploit bot sender +#score PDS_PHPEXP_BOT 1.5 +##} PDS_PHPEXP_BOT + +##{ PDS_PHP_EVAL + +meta PDS_PHP_EVAL __PDS_PHP_EVAL1 +describe PDS_PHP_EVAL PHP header shows eval'd code +#score PDS_PHP_EVAL 1.5 +##} PDS_PHP_EVAL + +##{ PDS_RDNS_DYNAMIC_FP + +meta PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC && !__PDS_RDNS_MTA +#score PDS_RDNS_DYNAMIC_FP 0.01 +describe PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC with FP steps +##} PDS_RDNS_DYNAMIC_FP + ##{ PDS_SHORTFWD_URISHRT_FP ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000) ifplugin Mail::SpamAssassin::Plugin::WLBLEval @@ -3122,16 +3142,16 @@ endif endif ##} PDS_SHORTFWD_URISHRT_FP ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000) -##{ PDS_SHORT_SPOOFED_URL ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000) +##{ PDS_SHORTFWD_URISHRT_QP ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000) ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000) -meta PDS_SHORT_SPOOFED_URL __PDS_MSG_1024 && __SPOOFED_URL && !(__VIA_ML || __SENDER_BOT || __YAHOO_BULK || __UNSUB_LINK || __THREADED || __URL_SHORTENER) -describe PDS_SHORT_SPOOFED_URL HTML message short and T_SPOOFED_URL (S_U_FP) -#score PDS_SHORT_SPOOFED_URL 2.0 +meta PDS_SHORTFWD_URISHRT_QP (__PDS_URISHORTENER || __URL_SHORTENER) && __HS_SUBJ_RE_FW && __T_PDS_MSG_512 && !PDS_SHORTFWD_URISHRT_FP +describe PDS_SHORTFWD_URISHRT_QP Apparently a short fwd/re with URI shortener +#score PDS_SHORTFWD_URISHRT_QP 1.5 # limit endif endif -##} PDS_SHORT_SPOOFED_URL ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000) +##} PDS_SHORTFWD_URISHRT_QP ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000) ##{ PDS_TINYSUBJ_URISHRT ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000) @@ -3158,20 +3178,6 @@ describe PDS_TONAME_EQ_TOLOCAL_HDRS_LCASE To: name matches everything in local e #score PDS_TONAME_EQ_TOLOCAL_HDRS_LCASE 2.0 # limit ##} PDS_TONAME_EQ_TOLOCAL_HDRS_LCASE -##{ PDS_TONAME_EQ_TOLOCAL_SHORT - -meta PDS_TONAME_EQ_TOLOCAL_SHORT __PDS_TONAME_EQ_TOLOCAL && __KAM_BODY_LENGTH_LT_512 -describe PDS_TONAME_EQ_TOLOCAL_SHORT Short body with To: name matches everything in local email -#score PDS_TONAME_EQ_TOLOCAL_SHORT 2.0 # limit -##} PDS_TONAME_EQ_TOLOCAL_SHORT - -##{ PDS_TONAME_EQ_TOLOCAL_VSHORT - -meta PDS_TONAME_EQ_TOLOCAL_VSHORT __KAM_BODY_LENGTH_LT_128 && __PDS_TONAME_EQ_TOLOCAL -describe PDS_TONAME_EQ_TOLOCAL_VSHORT Very short body and From looks like 2 different emails -#score PDS_TONAME_EQ_TOLOCAL_VSHORT 1.0 # limit -##} PDS_TONAME_EQ_TOLOCAL_VSHORT - ##{ PDS_TO_EQ_FROM_NAME if can(Mail::SpamAssassin::Conf::perl_min_version_5010000) if can(Mail::SpamAssassin::Conf::perl_min_version_5010000) @@ -3252,6 +3258,13 @@ describe PHP_ORIG_SCRIPT Sent by bot & other signs tflags PHP_ORIG_SCRIPT publish ##} PHP_ORIG_SCRIPT +##{ PHP_ORIG_SCRIPT_EVAL + +meta PHP_ORIG_SCRIPT_EVAL __PHP_ORIG_SCRIPT_EVAL +describe PHP_ORIG_SCRIPT_EVAL From suspicious PHP source +#score PHP_ORIG_SCRIPT_EVAL 3.000 # limit +##} PHP_ORIG_SCRIPT_EVAL + ##{ PHP_SCRIPT meta PHP_SCRIPT __HAS_PHP_SCRIPT && !ALL_TRUSTED && !__PHP_NOVER_MUA && !__TO___LOWER && !__MIME_BASE64 && !__HAS_ANY_EMAIL && !__L_CTE_7BIT @@ -3268,6 +3281,34 @@ describe PHP_SCRIPT_MUA Sent by PHP script, no version number tflags PHP_SCRIPT_MUA publish ##} PHP_SCRIPT_MUA +##{ POSSIBLE_APPLE_PHISH_02 + +meta POSSIBLE_APPLE_PHISH_02 (__FROM_NAME_APPLECOM && !__HDR_RCVD_APPLE) +describe POSSIBLE_APPLE_PHISH_02 Claims to be from apple but not processed by any apple MTA +tflags POSSIBLE_APPLE_PHISH_02 publish +##} POSSIBLE_APPLE_PHISH_02 + +##{ POSSIBLE_EBAY_PHISH_02 + +meta POSSIBLE_EBAY_PHISH_02 (__FROM_NAME_EBAYCOM && !__HDR_RCVD_EBAY) +describe POSSIBLE_EBAY_PHISH_02 Claims to be from ebay but not processed by any ebay MTA +tflags POSSIBLE_EBAY_PHISH_02 publish +##} POSSIBLE_EBAY_PHISH_02 + +##{ POSSIBLE_PAYPAL_PHISH_01 + +meta POSSIBLE_PAYPAL_PHISH_01 (__FROM_NAME_PAYPALCOM && __NAME_EMAIL_DIFF) +describe POSSIBLE_PAYPAL_PHISH_01 Claims to be from paypal but has non-paypal from email address +tflags POSSIBLE_PAYPAL_PHISH_01 publish +##} POSSIBLE_PAYPAL_PHISH_01 + +##{ POSSIBLE_PAYPAL_PHISH_02 + +meta POSSIBLE_PAYPAL_PHISH_02 (__FROM_NAME_PAYPALCOM && !__HDR_RCVD_PAYPAL) +describe POSSIBLE_PAYPAL_PHISH_02 Claims to be from paypal but not processed by any paypal MTA +tflags POSSIBLE_PAYPAL_PHISH_02 publish +##} POSSIBLE_PAYPAL_PHISH_02 + ##{ PP_MIME_FAKE_ASCII_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEEval if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_for_ascii_text_illegal) ifplugin Mail::SpamAssassin::Plugin::MIMEEval @@ -3373,9 +3414,9 @@ tflags RCVD_DBL_DQ publish ##{ RCVD_DOTEDU_SHORT -meta RCVD_DOTEDU_SHORT __RCVD_DOTEDU_SHORT && !__FS_SUBJ_RE && !__HAS_LIST_ID +meta RCVD_DOTEDU_SHORT __RCVD_DOTEDU_SHORT && !ALL_TRUSTED && !__FS_SUBJ_RE && !__HAS_LIST_ID describe RCVD_DOTEDU_SHORT Via .edu MTA + short message -#score RCVD_DOTEDU_SHORT 2.500 # limit +#score RCVD_DOTEDU_SHORT 1.500 # limit tflags RCVD_DOTEDU_SHORT publish ##} RCVD_DOTEDU_SHORT @@ -3680,10 +3721,16 @@ tflags RDNS_NUM_TLD_XM publish ##{ READY_TO_SHIP -body READY_TO_SHIP /(?:(?:in our (?:stock|warehouse|store)(?: today)?[.,:] |our (?:\w+,? ){2,8}(?:is |now )+)Ready (?:to (?:be )?|for )+ship|ready (?:for shipping|to (?:ship|send)) (?:(?:in|from|by) our (?:warehouse|stock)|(?:to|for)(?: global(?:ly)?| worldwide| customers){2})|(?:(?:our|this|a|great|fine|wonderful|cool|popular) new product|we have(?: \w+){1,6} available) in (?:our )?(?:warehouse|stock|store)|just arrived in our warehouse)/i +body READY_TO_SHIP /(?:(?:in our (?:stock|warehouse|store)(?: today| now| right away)?[.,:]\s|our (?:\w+,? ){2,8}(?:is |now )+)Ready (?:to (?:be )?|for )+(?:ship|send|deliver)|ready (?:for shipping|to (?:ship|send)) (?:(?:in|from|by) our (?:warehouse|stock)|(?:to|for)(?: global(?:ly)?| worldwide| customers){2})|(?:(?:our|this|a|great|fine|wonderful|cool|popular) new product|we have(?: \w+){1,6} available|ready) in (?:our )?(?:warehouse|stock|store)|just arrived in our warehouse|we will (?:contact the (?:warehouse|logistics) to )?arrange (?:the )?(?:shipment|delivery)|a new (?:\w+ ){1,3}in our warehouse)/i #score READY_TO_SHIP 1.250 # limit ##} READY_TO_SHIP +##{ REPLYTO_EMPTY + +header REPLYTO_EMPTY Reply-To =~ /<>/ +describe REPLYTO_EMPTY Reply-To undeliverable +##} REPLYTO_EMPTY + ##{ REPLYTO_WITHOUT_TO_CC meta REPLYTO_WITHOUT_TO_CC (__HAS_REPLY_TO && !__TOCC_EXISTS) @@ -3691,7 +3738,7 @@ meta REPLYTO_WITHOUT_TO_CC (__HAS_REPLY_TO && !__TOCC_EXISTS) ##{ REPTO_419_FRAUD -header REPTO_419_FRAUD Reply-To:addr =~ /^(?![^\s<>@]+\@(?:(?:gmail|yahoo|outlook|hotmail|aol|yandex|protonmail|qq|consultant)\.com|yahoo\.co\.jp)(?:$|[>,\s]))(?:(?:speakers)\@012\.net\.il|(?:mail)\@101private\.com|(?:(?:alfredcheuk002|fbi_1234|longchii|mavis_wanczyk|qfdonation))\@126\.com|(?:(?:a(?:aronmichaels005|lfredcheuk_yuchow)|ehagler|google_promoaward0?|istarsolar|joeblp|microsoft(?:_office16|award01)|panyawein|wong(?:_shiu(?:09|2016)|shiu_ki)))\@163\.com|(?:(?:navas1|ray\-thomas7h))\@1email\.eu|(?:mathew\.yon2)\@abbsinvestment\.com|(?:wang)\@abconline\.hk|(?:(?:mr\.tonyelumelu|r(?:emittancedept001|ussia2018worldcuplotto5)))\@accountant\.com|(?:midwestern)\@adexec\.com|(?:joxford)\@adm-irs\.com|(?:office)\@admntline\.ml|(?:info)\@aidakj\.com|(?:(?:a\.aktr|c(?:arlos\.adan|entralbank_malaysia2)|infovsa|maria\.louge|sarahjiwooali|w(?:bfefft|n\.buffett)))\@aim\.com|(?:(?:adainis|jessikasingh|travisalex))\@aliyun\.com|(?:(?:director|info))\@anletco-jp\.com|(?:(?:deanie_ron|m(?:softgbcmanager|undo\.europe)|richwetton))\@aol\.co\.uk|(?:mrssabah_ibrahim7)\@aol\.fr|(?:institutionaldepartment)\@aol\.nl|(?:deajohn)\@arubacloub\.com|(?:djohns)\@arubacloud\.com|(?:jeromecgb12)\@asia\.com|(?:bllphillips)\@att\.net|(?:garry\.quinlan)\@australiamail\.com|(?:(?:traoreahmed|zetiaziz))\@barid\.com|(?:atendimento\-multiplus\-banco\-brasil)\@bb\.com|(?:(?:admin|info))\@bhleu\.com|(?:noreply\.fujvfes)\@bibliothequegaillard\.com|(?:costruire)\@bigmat\.it|(?:alerts\-noreply)\@bis\.org|(?:susan\.lampard)\@bk\.ru|(?:(?:office\.uk|renataapsilva))\@bol\.com\.br|(?:executivedirector)\@box\.az|(?:ochiaisatoruasistbank)\@brew-master\.com|(?:nicola)\@brighenti\.net|(?:drbenardsani\.nnpc)\@bsgcpk\.com|(?:mrshelen)\@btarneauds\.com|(?:inter01)\@c2\.hu|(?:rim43505)\@cantv\.net|(?:duncanttodd)\@centrum\.cz|(?:(?:contact\.roycockrumgrantoffice|fbipayment(?:50|600)|harunajim667|ralphwjohnson))\@citromail\.hu|(?:info)\@classicmail\.co\.za|(?:martin)\@claudiatrincado\.com|(?:irdi33)\@cock\.li|(?:federal_ministrayoffinance)\@comtube\.com|(?:(?:jones\-co|kellyzwo))\@cox\.net|(?:(?:dmalpasswb|re(?:covered\-tax|em(?:2018|alhashimi|hashimi2020))))\@daum\.net|(?:rex)\@departmentofsecretary\.com|(?:blythemasters)\@digitalassetholding\.org|(?:(?:diplomaticagent11|jentwistle90))\@diplomats\.com|(?:(?:abd\.aljassem|claimreview))\@dr\.com|(?:atmpaymentcentttt)\@e-mail\.ua|(?:(?:herrick01|rogersteare02))\@e1\.ru|(?:olga\.ingrif)\@ecb-securities\.com|(?:jesusgacia)\@eclipso\.email|(?:davison\.warwick)\@eclipso\.eu|(?:no\-reply)\@economizar-na-web\.com\.br|(?:(?:denbrink|kathy_gerald1965|megaclaimcenter))\@email\.com|(?:johnkadiri)\@englandmail\.com|(?:info)\@euro-pinnacle\.com|(?:(?:advancedsegurosespana|claimdpts|monitorunitbelgium))\@europe\.com|(?:us\.secretaryofstate)\@ex\.ua|(?:susanibrahim)\@exclusivemail\.co\.za|(?:jabufa)\@executivemail\.co\.za|(?:adam_moroney\.esq)\@fedco-usa\.com|(?:steven)\@federalreservebanks\.us|(?:(?:jeferrey|yakuyaya77))\@financier\.com|(?:harry\.jones)\@firstbondcapital\.com|(?:admindepart)\@firstinlandbnkplc\.com|(?:notice)\@fnb\.co\.za|(?:info)\@fnconsultant\.biz|(?:(?:atmofficeauthoriza|captain\.lucasadam|e(?:golan2|u_payment)|gella1|k(?:aith\-angel|ossihpilip202)|pchwinningoffice1953|qatardonations16|smadartsadik|tepnherve00|worldauthorization))\@foxmail\.com|(?:zen)\@fpg\.com\.co|(?:mmpaulsmith145)\@frontier\.com|(?:mrchau1)\@gala\.net|(?:info)\@gcbonline\.co\.ua|(?:(?:bn|jb))\@getmaworldwide\.org|(?:info)\@gezimarkt\.com|(?:o(?:ctaviancm|rlando\.bloom))\@gmx\.co\.uk|(?:(?:a(?:hmet\.broker|lliance\.consultant)|f(?:aridaomar|er3nrod1512)|johnson\.douglas|kevin\-office|p\.hamedmoff|rosicboteruff|walter_anderson))\@gmx\.com|(?:(?:fernrodyup12|harrish|miraiminaki))\@gmx\.fr|(?:joxford)\@gmx\.us|(?:ben\.malbon)\@googlefps\.co\.uk|(?:m\.johnson10012)\@googlemail\.com|(?:larrypage)\@gpa-team\.com|(?:ceo)\@gpromo-team\.com|(?:sundarpichai)\@gpromoteam\.com|(?:sundarpichai)\@gpromoteamuk\.com|(?:garreth\.webb)\@grossfitconsultancy\.biz|(?:irenegeorgiadou)\@hellenicbankcy\.com|(?:raymondchanjp)\@hkmaltd\.org|(?:marketing)\@homebg\.in|(?:williamsdavid_3r)\@hotmail\.co\.uk|(?:christgoldwilliams)\@hotmail\.fr|(?:douglasflint)\@hsbcbank\.group|(?:gtakeshi)\@htisteel\.com|(?:alexgoodwill129)\@ibibo\.com|(?:victorwang67)\@imail\.com|(?:01)\@imf-org\.org|(?:chrisdodgshun)\@inbound\.plus|(?:imffunds)\@inbox\.lv|(?:info\.fidelity\.finance)\@inbox\.ru|(?:(?:janetyellenoffice|off(?:er2021|iceme)))\@indamail\.hu|(?:lizawong)\@infohsbc\.net|(?:sgt\.dave)\@inmano\.com|(?:baankston)\@instruction\.com|(?:sheikhwahab)\@islamicfb\.com|(?:mrsfatimahhassan[12])\@itbox\.ro|(?:info)\@johnhenryorg\.com|(?:john)\@johnpedroconsults\.com|(?:wbuk0[13])\@katamail\.com|(?:(?:ditmereduart|europsenderscouriers|lewiscarl))\@keemail\.me|(?:mikiwilliams)\@knol-power\.nl|(?:a015)\@laposte\.net|(?:johndavid)\@lawdistributionlimited\.com|(?:info)\@lbafltd\.com|(?:philiphampton)\@lec20\.com|(?:ecowascourt)\@legislator\.com|(?:olivia_simon)\@lihat\.dds-akaun\.com|(?:pb\-2pb012)\@live\.co\.uk|(?:(?:financiero172|helen_galloway|markjohnson650))\@live\.com|(?:mr\.williamrigule)\@live\.fr|(?:deqishanmedical1)\@localnet\.com|(?:miraminaki)\@lycos\.com|(?:drdanielmminele)\@magicmail\.co\.za|(?:andrewh1)\@mail2banker\.com|(?:lanxianjun)\@mail2hongkong\.com|(?:hwc2)\@mail2world\.com|(?:shillay)\@mail\.bg|(?:fanliangjen)\@mail\.china\.com|(?:(?:a(?:isha\-gaddafi0|yishagddafio|zimhashim2018)|eddy_haryono|ghazal\-a|info\.federalreserve\.org|kateclough1|mriamchombo1968|nancyvee80|ren\.deqi212))\@mail\.com|(?:williamsdawson)\@mail\.com\.tr|(?:(?:ayishagddafio|david\.onyeoma\.74|hmtreasyru\.ng|sambo_dasuki))\@mail\.ru|(?:(?:publishers_clearinghouse|rev\.williamschurch))\@mail\.uk|(?:mrcheongg2012)\@mailbox\.hu|(?:brantwbishop)\@mailbox\.org|(?:epowerball)\@mailbox\.sk|(?:johannreimann)\@memeware\.net|(?:miguel)\@miguel-sanchez\.com|(?:rbi\-e)\@mit\.tc|(?:info)\@morbicera\.com|(?:anjer\.keith)\@ms-fsp-europe\.com|(?:paul\.chang)\@msn\.com|(?:enquiry)\@multiplysearch\.com|(?:cadpayout01)\@my\.com|(?:(?:contactmee|ministersoffinance))\@mynet\.com|(?:me)\@myprivatemail\.website|(?:stephanfalzer)\@myself\.com|(?:(?:reem9999|wujames))\@naver\.com|(?:jessicahunt1960)\@net-c\.com|(?:zenith)\@nmk\.ugu\.pl|(?:maxedwards)\@octopusinvestment\.co\.uk|(?:lindsaytrembley)\@oimail\.com|(?:googleclaims111)\@one\.lt|(?:accountingdrg)\@onet\.eu|(?:(?:allanwoodmarko1|eco\.depo\.services|fred\.grenville))\@onet\.pl|(?:(?:castorock|infobiz2|jarramos|mrsalice09))\@ono\.com|(?:pablomancilla1)\@orange\.es|(?:servicio\.correo)\@orange\.fr|(?:turkish\-air)\@outlook\.com\.tr|(?:(?:ahmed3khan|dpt_transferunionwestern|mr\.onyeadams|rohitjain0))\@outlook\.fr|(?:m\.khan1)\@outlook\.sa|(?:info\-casino888\.com)\@ozu\.es|(?:info)\@peagent\.net|(?:andrew\.penning)\@penninglegalassociate\.com|(?:info)\@phillipsmorgan\.co\.za|(?:wood)\@poczta\.onet\.eu|(?:m(?:aryjosen|boyaeth))\@post\.com|(?:united\.globeawardoffice)\@post\.cz|(?:ffundsremitunits)\@premiumtbnk\.com|(?:santiagomachado)\@presidency\.com|(?:ecowaspayoffice)\@protonmail\.ch|(?:uni1)\@rayana\.ir|(?:(?:mrsrose\.hill|robert\.cota|unionbatmpaymentsection))\@rediffmail\.com|(?:nidiabustamante)\@registerednurses\.com|(?:info)\@rehapmed\.com|(?:info)\@repsol\.org\.uk|(?:jamesmr\.monday)\@rocketmail\.com|(?:(?:g(?:loriacmackenzie001|mackenzie001)|monicatorres001|wanczykmavis101))\@rogers\.com|(?:elena\.santos)\@rollageoup\.com|(?:info)\@roycockrum\.org|(?:mrs\.rachel2013)\@safe-mail\.net|(?:vera)\@safrica\.com|(?:enqraward)\@sbcglobal\.net|(?:fbotha2009)\@secsuremail\.com|(?:peterddeng)\@secsuremailer\.com|(?:francisbotha65)\@securesvsmail\.online|(?:smtpfox\-ys2n8)\@semillasdeamor\.com\.co|(?:wils)\@send\.com|(?:ibralsmma)\@seznam\.cz|(?:(?:jimyang77|kentpace))\@sina\.com|(?:swat)\@sltdchambers\.com|(?:(?:dycheseaan|sean(?:dyyches|sdychh)))\@sol\.dk|(?:info(?:04|1))\@sony\.com|(?:info\.jschneider)\@spainmail\.com|(?:barrister_hans)\@stationlibraryjhelum\.com|(?:contact\.hmrc\.gov\.uk)\@sudhisalooja\.com|(?:fbidirector(?:11|wadc))\@superposta\.com|(?:anders\.karlsson)\@swedbankabgroup\.com|(?:insurance_contl)\@swissmail\.com|(?:nnbank)\@szm\.sk|(?:xiankailu)\@taiyaubank-hk\.com|(?:mhua)\@tbochk\.com|(?:veronicabright)\@terra\.com\.pe|(?:billard\.thompson)\@thompsonlawassociates\.com|(?:fabio2016)\@tim\.it|(?:zimcargoservicehelpdesks)\@tlen\.pl|(?:drew)\@ton\.net\.ru|(?:itpark01)\@tpg\.com\.au|(?:bobby\.william)\@tradent\.net|(?:info)\@treasury-departmentdc\.twomini\.com|(?:info)\@treasury-usa\.3eeweb\.com|(?:info)\@un-grant\.info|(?:(?:b(?:lueskyanimatedfilm|rown\.monica_l)|info\.(?:clev\.frb|imfamerica)|policyaddmin\.file))\@usa\.com|(?:bmuczdh)\@virgilio\.it|(?:itgiix)\@visa\.com|(?:vankoning)\@volny\.cz|(?:holt1231)\@w\.cn|(?:infos)\@walmart\.com|(?:daydreamin)\@wanadoo\.fr|(?:(?:foreignoperationmanager|mr\.(?:ikokuoya|olicadams)))\@web\.cg|(?:weboffice05)\@web\.de|(?:b(?:\-calebfirm2007|oriscaleb121))\@webmail\.co\.za|(?:(?:frboffice|jw\.ny\.frb))\@webmail\.hu|(?:verificationsector)\@webname\.com|(?:grahamjoneschambers)\@wildblue\.net|(?:e\.shaw)\@wilmagroup\.com|(?:tbryant6)\@woh\.rr\.com|(?:henleywatkinss)\@y7mail\.com|(?:stephaniehans\.euromillionlottery)\@yahoo\.be|(?:johnkwanghooi101)\@yahoo\.c|(?:chapelliermadeleine)\@yahoo\.ca|(?:arroblutt\.paymentoffice)\@yahoo\.cn|(?:bencook5511)\@yahoo\.co\.nz|(?:gloriamoses02)\@yahoo\.co\.th|(?:(?:abigailbanga1975|bobwatson92|fundyawa2014|j(?:effwilliam207|oe_modisen)|lloydsbanksb|owengreen70|rebeccajoe98|samue95))\@yahoo\.co\.uk|(?:(?:changgordon(?:61|946)|lordsmartin|revlarrutycoker2015|thomaspeter227|zhu\.shumin))\@yahoo\.com\.hk|(?:imf_office_agent)\@yahoo\.com\.my|(?:(?:dr\.pauljames110|jessicp1))\@yahoo\.com\.sg|(?:boa2cb)\@yahoo\.com\.vn|(?:(?:contactus88\-00|jflangvm5nshyazyo7si6jfuqah6jsldw2kw6c2t|lmj82717|m(?:r\.angelabenjamin|srangelabne32)))\@yahoo\.es|(?:(?:charlinebebe22|fortinsandrine|rita_will001))\@yahoo\.fr|(?:maktoum\.shasher)\@yahoo\.pt|(?:ukdebtmanagement5)\@yahool\.com|(?:dr\.amelia\.george1)\@yandex\.ru|(?:jayanderson)\@yccaifuu\.com|(?:(?:alfred_cheuk_chow|friedrich_mayrh1|maviswanczyk01))\@yeah\.net|(?:(?:avaethan21|feliciamagi|westernunion817))\@ymail\.com|(?:goldfish20123)\@zing\.vn|(?:(?:asiafoundationorg\.hr|jefflindsay))\@zoho\.com|(?:laprimitivaes)\@zohomail\.eu)$/i +header REPTO_419_FRAUD Reply-To:addr =~ /^(?![^\s<>@]+\@(?:(?:gmail|yahoo|outlook|hotmail|aol|yandex|protonmail|qq|consultant)\.com|yahoo\.co\.jp)(?:$|[>,\s]))(?:(?:speakers)\@012\.net\.il|(?:mail)\@101private\.com|(?:(?:alfredcheuk002|fbi_1234|longchii|mavis_wanczyk|qfdonation))\@126\.com|(?:(?:a(?:aronmichaels005|lfredcheuk_yuchow)|ehagler|google_promoaward0?|istarsolar|joeblp|microsoft(?:_office16|award01)|panyawein|wong(?:_shiu(?:09|2016)|shiu_ki)))\@163\.com|(?:(?:navas1|ray\-thomas7h))\@1email\.eu|(?:mathew\.yon2)\@abbsinvestment\.com|(?:wang)\@abconline\.hk|(?:(?:mr\.tonyelumelu|r(?:emittancedept001|ussia2018worldcuplotto5)))\@accountant\.com|(?:midwestern)\@adexec\.com|(?:joxford)\@adm-irs\.com|(?:office)\@admntline\.ml|(?:info)\@aidakj\.com|(?:(?:a\.aktr|c(?:arlos\.adan|entralbank_malaysia2)|infovsa|maria\.louge|sarahjiwooali|w(?:bfefft|n\.buffett)))\@aim\.com|(?:(?:adainis|jessikasingh|travisalex))\@aliyun\.com|(?:(?:director|info))\@anletco-jp\.com|(?:(?:deanie_ron|m(?:softgbcmanager|undo\.europe)|richwetton))\@aol\.co\.uk|(?:mrssabah_ibrahim7)\@aol\.fr|(?:institutionaldepartment)\@aol\.nl|(?:deajohn)\@arubacloub\.com|(?:djohns)\@arubacloud\.com|(?:jeromecgb12)\@asia\.com|(?:bllphillips)\@att\.net|(?:garry\.quinlan)\@australiamail\.com|(?:(?:traoreahmed|zetiaziz))\@barid\.com|(?:atendimento\-multiplus\-banco\-brasil)\@bb\.com|(?:(?:admin|info))\@bhleu\.com|(?:noreply\.fujvfes)\@bibliothequegaillard\.com|(?:costruire)\@bigmat\.it|(?:alerts\-noreply)\@bis\.org|(?:susan\.lampard)\@bk\.ru|(?:(?:office\.uk|renataapsilva))\@bol\.com\.br|(?:executivedirector)\@box\.az|(?:ochiaisatoruasistbank)\@brew-master\.com|(?:nicola)\@brighenti\.net|(?:drbenardsani\.nnpc)\@bsgcpk\.com|(?:mrshelen)\@btarneauds\.com|(?:inter01)\@c2\.hu|(?:rim43505)\@cantv\.net|(?:duncanttodd)\@centrum\.cz|(?:(?:andrelwotti|contact\.roycockrumgrantoffice|fbipayment(?:50|600)|harunajim667|ralphwjohnson))\@citromail\.hu|(?:info)\@classicmail\.co\.za|(?:martin)\@claudiatrincado\.com|(?:irdi33)\@cock\.li|(?:federal_ministrayoffinance)\@comtube\.com|(?:cc(?:hendik|jjdesk))\@consultancydesk\.co\.ua|(?:(?:jones\-co|kellyzwo))\@cox\.net|(?:(?:dmalpasswb|re(?:covered\-tax|em(?:2018|alhashimi|hashimi2020))))\@daum\.net|(?:rex)\@departmentofsecretary\.com|(?:blythemasters)\@digitalassetholding\.org|(?:(?:diplomaticagent11|jentwistle90))\@diplomats\.com|(?:(?:abd\.aljassem|claimreview))\@dr\.com|(?:atmpaymentcentttt)\@e-mail\.ua|(?:(?:herrick01|rogersteare02))\@e1\.ru|(?:olga\.ingrif)\@ecb-securities\.com|(?:jesusgacia)\@eclipso\.email|(?:davison\.warwick)\@eclipso\.eu|(?:no\-reply)\@economizar-na-web\.com\.br|(?:(?:denbrink|kathy_gerald1965|megaclaimcenter))\@email\.com|(?:johnkadiri)\@englandmail\.com|(?:info)\@euro-pinnacle\.com|(?:(?:advancedsegurosespana|claimdpts|monitorunitbelgium))\@europe\.com|(?:us\.secretaryofstate)\@ex\.ua|(?:susanibrahim)\@exclusivemail\.co\.za|(?:jabufa)\@executivemail\.co\.za|(?:adam_moroney\.esq)\@fedco-usa\.com|(?:steven)\@federalreservebanks\.us|(?:(?:jeferrey|yakuyaya77))\@financier\.com|(?:harry\.jones)\@firstbondcapital\.com|(?:admindepart)\@firstinlandbnkplc\.com|(?:notice)\@fnb\.co\.za|(?:info)\@fnconsultant\.biz|(?:(?:atmofficeauthoriza|captain\.lucasadam|e(?:golan2|u_payment)|gella1|k(?:aith\-angel|ossihpilip202)|pchwinningoffice1953|qatardonations16|smadartsadik|tepnherve00|worldauthorization))\@foxmail\.com|(?:zen)\@fpg\.com\.co|(?:mmpaulsmith145)\@frontier\.com|(?:mrchau1)\@gala\.net|(?:info)\@gcbonline\.co\.ua|(?:(?:bn|jb))\@getmaworldwide\.org|(?:info)\@gezimarkt\.com|(?:o(?:ctaviancm|rlando\.bloom))\@gmx\.co\.uk|(?:(?:a(?:hmet\.broker|lliance\.consultant)|f(?:aridaomar|er3nrod1512)|johnson\.douglas|kevin\-office|p\.hamedmoff|rosicboteruff|walter_anderson))\@gmx\.com|(?:(?:fernrodyup12|harrish|miraiminaki))\@gmx\.fr|(?:joxford)\@gmx\.us|(?:ben\.malbon)\@googlefps\.co\.uk|(?:m\.johnson10012)\@googlemail\.com|(?:larrypage)\@gpa-team\.com|(?:ceo)\@gpromo-team\.com|(?:sundarpichai)\@gpromoteam\.com|(?:sundarpichai)\@gpromoteamuk\.com|(?:garreth\.webb)\@grossfitconsultancy\.biz|(?:irenegeorgiadou)\@hellenicbankcy\.com|(?:raymondchanjp)\@hkmaltd\.org|(?:marketing)\@homebg\.in|(?:williamsdavid_3r)\@hotmail\.co\.uk|(?:christgoldwilliams)\@hotmail\.fr|(?:douglasflint)\@hsbcbank\.group|(?:gtakeshi)\@htisteel\.com|(?:alexgoodwill129)\@ibibo\.com|(?:victorwang67)\@imail\.com|(?:01)\@imf-org\.org|(?:chrisdodgshun)\@inbound\.plus|(?:imffunds)\@inbox\.lv|(?:info\.fidelity\.finance)\@inbox\.ru|(?:(?:janetyellenoffice|off(?:er2021|iceme)))\@indamail\.hu|(?:lizawong)\@infohsbc\.net|(?:sgt\.dave)\@inmano\.com|(?:baankston)\@instruction\.com|(?:sheikhwahab)\@islamicfb\.com|(?:mrsfatimahhassan[12])\@itbox\.ro|(?:info)\@johnhenryorg\.com|(?:john)\@johnpedroconsults\.com|(?:wbuk0[13])\@katamail\.com|(?:(?:ditmereduart|europsenderscouriers|lewiscarl))\@keemail\.me|(?:mikiwilliams)\@knol-power\.nl|(?:a015)\@laposte\.net|(?:johndavid)\@lawdistributionlimited\.com|(?:info)\@lbafltd\.com|(?:philiphampton)\@lec20\.com|(?:ecowascourt)\@legislator\.com|(?:fatih)\@leventsimsek\.com\.tr|(?:olivia_simon)\@lihat\.dds-akaun\.com|(?:pb\-2pb012)\@live\.co\.uk|(?:(?:financiero172|helen_galloway|markjohnson650))\@live\.com|(?:mr\.williamrigule)\@live\.fr|(?:deqishanmedical1)\@localnet\.com|(?:miraminaki)\@lycos\.com|(?:drdanielmminele)\@magicmail\.co\.za|(?:andrewh1)\@mail2banker\.com|(?:lanxianjun)\@mail2hongkong\.com|(?:hwc2)\@mail2world\.com|(?:shillay)\@mail\.bg|(?:fanliangjen)\@mail\.china\.com|(?:(?:a(?:isha\-gaddafi0|yishagddafio|zimhashim2018)|eddy_haryono|ghazal\-a|info\.federalreserve\.org|kateclough1|mriamchombo1968|nancyvee80|ren\.deqi212))\@mail\.com|(?:williamsdawson)\@mail\.com\.tr|(?:(?:ayishagddafio|david\.onyeoma\.74|hmtreasyru\.ng|sambo_dasuki))\@mail\.ru|(?:(?:publishers_clearinghouse|rev\.williamschurch))\@mail\.uk|(?:mrcheongg2012)\@mailbox\.hu|(?:brantwbishop)\@mailbox\.org|(?:epowerball)\@mailbox\.sk|(?:johannreimann)\@memeware\.net|(?:sarb_bnk086)\@meta\.ua|(?:miguel)\@miguel-sanchez\.com|(?:rbi\-e)\@mit\.tc|(?:info)\@morbicera\.com|(?:anjer\.keith)\@ms-fsp-europe\.com|(?:paul\.chang)\@msn\.com|(?:enquiry)\@multiplysearch\.com|(?:cadpayout01)\@my\.com|(?:(?:contactmee|ministersoffinance))\@mynet\.com|(?:me)\@myprivatemail\.website|(?:stephanfalzer)\@myself\.com|(?:(?:reem9999|wujames))\@naver\.com|(?:abel)\@nbdeil\.com|(?:jessicahunt1960)\@net-c\.com|(?:zenith)\@nmk\.ugu\.pl|(?:maxedwards)\@octopusinvestment\.co\.uk|(?:lindsaytrembley)\@oimail\.com|(?:googleclaims111)\@one\.lt|(?:accountingdrg)\@onet\.eu|(?:(?:allanwoodmarko1|eco\.depo\.services|fred\.grenville))\@onet\.pl|(?:(?:castorock|infobiz2|jarramos|mrsalice09))\@ono\.com|(?:pablomancilla1)\@orange\.es|(?:servicio\.correo)\@orange\.fr|(?:turkish\-air)\@outlook\.com\.tr|(?:(?:ahmed3khan|dpt_transferunionwestern|mr\.onyeadams|rohitjain0))\@outlook\.fr|(?:m\.khan1)\@outlook\.sa|(?:info\-casino888\.com)\@ozu\.es|(?:info)\@peagent\.net|(?:andrew\.penning)\@penninglegalassociate\.com|(?:info)\@phillipsmorgan\.co\.za|(?:wood)\@poczta\.onet\.eu|(?:m(?:aryjosen|boyaeth))\@post\.com|(?:united\.globeawardoffice)\@post\.cz|(?:ffundsremitunits)\@premiumtbnk\.com|(?:santiagomachado)\@presidency\.com|(?:ecowaspayoffice)\@protonmail\.ch|(?:uni1)\@rayana\.ir|(?:(?:mrsrose\.hill|robert\.cota|unionbatmpaymentsection))\@rediffmail\.com|(?:nidiabustamante)\@registerednurses\.com|(?:info)\@rehapmed\.com|(?:info)\@repsol\.org\.uk|(?:jamesmr\.monday)\@rocketmail\.com|(?:(?:g(?:loriacmackenzie001|mackenzie001)|monicatorres001|wanczykmavis101))\@rogers\.com|(?:elena\.santos)\@rollageoup\.com|(?:info)\@roycockrum\.org|(?:mrs\.rachel2013)\@safe-mail\.net|(?:vera)\@safrica\.com|(?:enqraward)\@sbcglobal\.net|(?:fbotha2009)\@secsuremail\.com|(?:peterddeng)\@secsuremailer\.com|(?:francisbotha65)\@securesvsmail\.online|(?:smtpfox\-ys2n8)\@semillasdeamor\.com\.co|(?:wils)\@send\.com|(?:ibralsmma)\@seznam\.cz|(?:(?:jimyang77|kentpace))\@sina\.com|(?:swat)\@sltdchambers\.com|(?:(?:dycheseaan|sean(?:dyyches|sdychh)))\@sol\.dk|(?:info(?:04|1))\@sony\.com|(?:info\.jschneider)\@spainmail\.com|(?:barrister_hans)\@stationlibraryjhelum\.com|(?:contact\.hmrc\.gov\.uk)\@sudhisalooja\.com|(?:fbidirector(?:11|wadc))\@superposta\.com|(?:anders\.karlsson)\@swedbankabgroup\.com|(?:insurance_contl)\@swissmail\.com|(?:nnbank)\@szm\.sk|(?:xiankailu)\@taiyaubank-hk\.com|(?:mhua)\@tbochk\.com|(?:veronicabright)\@terra\.com\.pe|(?:billard\.thompson)\@thompsonlawassociates\.com|(?:fabio2016)\@tim\.it|(?:zimcargoservicehelpdesks)\@tlen\.pl|(?:drew)\@ton\.net\.ru|(?:itpark01)\@tpg\.com\.au|(?:bobby\.william)\@tradent\.net|(?:info)\@treasury-departmentdc\.twomini\.com|(?:info)\@treasury-usa\.3eeweb\.com|(?:info)\@un-grant\.info|(?:(?:b(?:lueskyanimatedfilm|rown\.monica_l)|info\.(?:clev\.frb|imfamerica)|policyaddmin\.file))\@usa\.com|(?:bmuczdh)\@virgilio\.it|(?:itgiix)\@visa\.com|(?:vankoning)\@volny\.cz|(?:holt1231)\@w\.cn|(?:infos)\@walmart\.com|(?:daydreamin)\@wanadoo\.fr|(?:(?:foreignoperationmanager|mr\.(?:ikokuoya|olicadams)))\@web\.cg|(?:weboffice05)\@web\.de|(?:b(?:\-calebfirm2007|oriscaleb121))\@webmail\.co\.za|(?:(?:frboffice|jw\.ny\.frb))\@webmail\.hu|(?:verificationsector)\@webname\.com|(?:grahamjoneschambers)\@wildblue\.net|(?:e\.shaw)\@wilmagroup\.com|(?:tbryant6)\@woh\.rr\.com|(?:henleywatkinss)\@y7mail\.com|(?:stephaniehans\.euromillionlottery)\@yahoo\.be|(?:johnkwanghooi101)\@yahoo\.c|(?:chapelliermadeleine)\@yahoo\.ca|(?:arroblutt\.paymentoffice)\@yahoo\.cn|(?:bencook5511)\@yahoo\.co\.nz|(?:gloriamoses02)\@yahoo\.co\.th|(?:(?:abigailbanga1975|bobwatson92|fundyawa2014|j(?:effwilliam207|oe_modisen)|lloydsbanksb|owengreen70|rebeccajoe98|samue95))\@yahoo\.co\.uk|(?:(?:changgordon(?:61|946)|lordsmartin|revlarrutycoker2015|thomaspeter227|zhu\.shumin))\@yahoo\.com\.hk|(?:imf_office_agent)\@yahoo\.com\.my|(?:(?:dr\.pauljames110|jessicp1))\@yahoo\.com\.sg|(?:boa2cb)\@yahoo\.com\.vn|(?:(?:contactus88\-00|jflangvm5nshyazyo7si6jfuqah6jsldw2kw6c2t|lmj82717|m(?:r\.angelabenjamin|srangelabne32)))\@yahoo\.es|(?:(?:charlinebebe22|fortinsandrine|rita_will001))\@yahoo\.fr|(?:maktoum\.shasher)\@yahoo\.pt|(?:ukdebtmanagement5)\@yahool\.com|(?:dr\.amelia\.george1)\@yandex\.ru|(?:jayanderson)\@yccaifuu\.com|(?:(?:alfred_cheuk_chow|friedrich_mayrh1|maviswanczyk01))\@yeah\.net|(?:(?:avaethan21|feliciamagi|westernunion817))\@ymail\.com|(?:goldfish20123)\@zing\.vn|(?:(?:asiafoundationorg\.hr|jefflindsay))\@zoho\.com|(?:laprimitivaes)\@zohomail\.eu)$/i describe REPTO_419_FRAUD Reply-To is known advance fee fraud collector mailbox #score REPTO_419_FRAUD 3.000 tflags REPTO_419_FRAUD publish @@ -3699,7 +3746,7 @@ tflags REPTO_419_FRAUD publish ##{ REPTO_419_FRAUD_AOL -header REPTO_419_FRAUD_AOL Reply-To:addr =~ /^(?=[^\s<>@]+\@aol\.com)(?:(?:a(?:\.dordevicii|aromartins|f\.2[06]|ljaber111|meliageorge|n(?:d(?:_bley|rew_hans)|ttilimarim)|rthur\.alan)|b(?:aanidleewy|claimdept|rownchurchill2)|c(?:\.european|allumfoundation|h(?:anprivacy03|eungdavidd|ngeric|ristyruwalt)|ristinabruno38|ustom_service58)|d(?:avid(?:\.kms|opatry)|hodgkins001|ianwaynie|onald_anderson44)|e(?:ng(?:joej|r\.abdulla)|ricalbertdpm|velynjoshua44)|f(?:d\.29|ernandezfernandez3|oundation\.charity)|g(?:arang\.rebeca|eorge_clifford4|roupfacility)|hernandezrosemary632|jmesaud|k\.doreen00|l(?:\.b162k|erynnewest99|i(?:sarobinson5\.0|zcarroll101)|orrainewirangee)|m(?:_l\.wanczyk62|aviswanczyk[do]|rs(?:isabelladzsesszika|safiagaddafi))|no(?:rmapatto|tification\.notification)|p(?:a(?:tricia(?:\.hans|hans)|ulpollard2)|eterwong345|otfolio\.management)|r(?:achel_wat2|oyalpalace2018)|s(?:afiiagadafi|gt\.gillianj200|ovchan|pwalker721|taatsloterijnederlands)|usembassy330|w(?:attson\.renwick|ebank244|issam\.haddad|u\.xiabk)|zeti\.aziz))\@aol\.com$/i +header REPTO_419_FRAUD_AOL Reply-To:addr =~ /^(?=[^\s<>@]+\@aol\.com)(?:(?:a(?:\.dordevicii|aromartins|f\.2[06]|ljaber111|meliageorge|n(?:d(?:_bley|rew_hans)|ttilimarim)|rthur\.alan)|b(?:aanidleewy|claimdept|rownchurchill2)|c(?:\.european|allumfoundation|h(?:anprivacy03|eungdavidd|ngeric|ristyruwalt)|ristinabruno38|ustom_service58)|d(?:avid(?:\.kms|opatry)|hodgkins001|ianwaynie|onald_anderson44)|e(?:ng(?:joej|r\.abdulla)|ricalbertdpm|velynjoshua44)|f(?:d\.29|ernandezfernandez3|oundation\.charity)|g(?:arang\.rebeca|eorge_clifford4|roupfacility)|hernandezrosemary632|jmesaud|k\.doreen00|l(?:\.b162k|erynnewest99|i(?:sarobinson5\.0|zcarroll101)|orrainewirangee)|m(?:_l\.wanczyk62|aviswanczyk[do]|rs(?:isabelladzsesszika|safiagaddafi))|no(?:rmapatto|tification\.notification)|p(?:a(?:tricia(?:\.hans|hans)|ulpollard2)|eterwong345|otfolio\.management)|r(?:achel_wat2|oyalpalace2018)|s(?:afiiagadafi|gt\.gillianj200|ovchan|pwalker721|t(?:aatsloterijnederlands|efano_pessina))|usembassy330|w(?:attson\.renwick|ebank244|issam\.haddad|u\.xiabk)|yurdaaytarkan5|zeti\.aziz))\@aol\.com$/i describe REPTO_419_FRAUD_AOL Reply-To is known advance fee fraud collector mailbox #score REPTO_419_FRAUD_AOL 3.000 tflags REPTO_419_FRAUD_AOL publish @@ -3723,7 +3770,7 @@ tflags REPTO_419_FRAUD_CNS publish ##{ REPTO_419_FRAUD_GM -header REPTO_419_FRAUD_GM Reply-To:addr =~ /^(?=[^\s<>@]+\@gmail\.com)(?:(?:01marviswanczyk|41speedlinkdelivery|7912richardtony|a(?:bu(?:lkareem461|shadi0004)|c(?:aalzz11|count\.optionsmr\.jonasarmstrong|e(?:alss11|cere001))|d(?:esilgon77|iallo\.boa)|erofilxeport|gent\.laryedwad|isha(?:1976algaddafi|gaddafiaam)|jaminamo|l(?:\.jo60691737|a(?:n\.austin(?:041|223)|scramac)|ber\.yang222|ex(?:ander(?:daisy911|peterson4499)|hoffman3319|smithznn)|ghafrij13|hajarb|lenholden121|nizmaria|ure\.wawrenka1472)|m(?:b\.w\.stuart\.symington|ericadeliverycomapny1(?:300|800)|ina(?:ltwaijiri02|tasomda))|n(?:d(?:rewumehunitedbankforafrica|yfox0022)|itaminarnguessan|n(?:a(?:choihkkic|llee091|sigurlaug458)|jenijohnsonn)|t(?:honyalvaradollc|o(?:meuenio|niopaco20consultant)))|r(?:adka01|chibaldhamble|thur11alan)|s(?:h(?:0611jnag|westwood7)|ianbae1010|sistance7agent)|t(?:m(?:mastercard41|office929)|tohlawoffice\.tg)|w1614860|yevayawovi190|zi(?:m(?:\.h(?:ashim\.premj|premji13)|hashim(?:2018|donation2019))|z(?:dake0|george50)))|b(?:a(?:lla250abc|nk(?:centralasiahalobca34|ingcentralng)|ochang7a|r(?:bersmadar75|r(?:\.(?:charles(?:1954|office)|martinrichard)|ister(?:\.fidelisokafor|lordruben94)|ubenjames)|teld\.huisman01))|bongo593|c0996013|e(?:linekra1|n(?:ezero392|jaminsarah195))|i(?:anigercash|ll(?:\.lawrence0747|fhome))|laisevodoun|mw(?:automobile242|officeline)|o(?:arddept0|cchenyi)|r(?:a(?:ndy\.heavenscenttt|volpaul55)|endalaporte112|ianmoynih00)|uff(?:ettwarrene21|ookj))|c(?:a(?:ixaseguros9810001|mluba2017|r(?:eisu98|l(?:os\.s\.helux|thomos)|twrighttownhomesllc))|bnatm847|claimsa|e(?:li(?:cerez|neroullier(?:200|nm))|ntraltrustlltd)|h(?:a(?:ngching885|r(?:itylisajohnrobinson41|l(?:esluenga01|tonnewmanus1)))|e(?:mchung1011|nchung1011)|i(?:enkraymond|mwiakim))|iticonsultantjohncg0|kruger00017|l(?:a(?:im(?:adviser11|officeadm)|xtonpaul00)|s79408)|o(?:l(?:\.(?:ahmedmarani|fakhrialsalabi(?:01)?|hmedismari)|abdullahassi|edavid77032|husseinharmuchc(?:cj|j)|inchrisweir50|mohmanairf|o(?:mbasjuan53|nelsaad00))|mpensationcommitteboard|n(?:sult(?:ancy64|matthias|sto\.u)|tact(?:\.kolason|ad00[04]))|operation612)|pt\.eugenebarash|r(?:a(?:bbechambers|wfordgillies1)|ist(?:bru(?:05|n05)|i1537bru))|ustomerservicelacaixa2)|d(?:29laws|a(?:n(?:008629|iel(?:35508109|zulu11)|nydan24532)|v(?:i(?:d(?:\.loanfirm18|ibe718|larbi11|pere337|r(?:amirez\.luis9012|ikhen))|scarolyn334|yax98)|ychan1970))|c(?:layconsult|ole77032)|e(?:btm123|n(?:iwalts|nis(?:clark659|quaid888))|partmentofstate(?:123|321)|tlefeckhardd)|hill27676|i(?:ane\.s\.wojcicki|gitalassetholding|p(?:francis1|lomat(?:\.john\.clerke|sshenry)))|o(?:minicahkye|na(?:ldwilliam1988|tionhelpercare5))|r(?:\.(?:meirh|wilsonpaul02)|abodid|davidrhama221|j(?:amesdee|oesimon77)|kennedyuzo|meier\.heidi?|o(?:vieogor1|wenfrederick))|u(?:a1155a|nsilva58|stinmoskovitz\.2facebook)|v\.metus)|e(?:benezero392|christina937|d(?:runity|winfreeman22)|fcc\.financial\.dept|l(?:i(?:bethgomez(?:175|499)|sabethmaria600|zabethedw0)|otocashoffice1?)|m(?:2keld|ailpostlink09|efiele(?:328|g757)|ilyrichmond391)|renakgeorge123|ssexlss1|vgpatmow)|f(?:\.mikhail025|a(?:ithdesrie511|tme\.mehmed001)|blott47|e(?:deralreservebankdallasdst|lix88995)|g0067333|irstbank(?:49(?:666|966)|k49666)|j569282|l(?:556249|aurentdz40|uhmann\.dn)|mb\.agent|o(?:ropunionbank|undations\.west)|r(?:a(?:100dub132|n(?:c(?:espatrickconnolly(?:5050|4)|isca(?:mendoza960|samendoza))|k(?:jwangg|laurarivera)))|bbankny\.gov|e(?:derick\.colemanesq|elottosweepstake51))|u(?:lanlan28|ngg1w))|g(?:00gleggewinner19|a(?:b(?:albertoassociates|rielkalia1102)|r(?:ethbull112016|yakinson121))|bill4880|e(?:n(?:\.ahmedmsksi|eral(?:abdulrazak|williamstony990))|orgekwame481|r(?:aldjhjh11|tjanvlieghe787))|g780904|i(?:idp955|lbert12oook)|kwasiiwusu1\.persona|l(?:enmoore0011|oriachow5052)|o(?:glegewinnerteam|o(?:dnessxtra|golteam2019|oglegwiinner219)|vgodwinemefiele111)|r(?:ace(?:jackmanwoods|obia001)|e(?:ant311|energeoffrey776))|veraallen)|h(?:a(?:r(?:old\.dia1100|ryebert101|twellbdaniel)|s(?:h(?:imyreem78|mireem801)|sanalshujairy))|e(?:a(?:dofficecentre0210|therbrooeke101)|cto(?:alon|r(?:castillos653|scastillo6))|lpdesk47321)|gold8080|heba\.hhassan207|i(?:ldad837|toshurui)|klee\.mike|o(?:lsemeyerole6|nmackjohn518|rnbeckmajordennis63[478]|seoky(?:34|9))|sbchgm|trryt34|uichmh)|i(?:1955smael|amannjejosonn|bed627|n(?:fo(?:\.(?:abogadosmfontana|g00gleclaim|questiondesk|ulmusau)|64240|98cbnoffice7|a(?:prl06|sminternationalpk)|fdrserve)|gridrolle2|t(?:ernationallppp1|linvestorsfirm))|terryoffice)|j(?:35809121|a(?:888179|cobmaseon5995|m(?:alpriv8un|es(?:husmansdesk2240|okoh82))|nusensecureprivate|sonyeungchiwai|vierlesme001)|b5406424|c2222222rrr|e(?:ff(?:deandk2|erydean1960)|nniannjhsonn|ssikasingh4)|imyang977|k3311131|mpowellfr|o(?:e(?:dward023|kendal540|lmodisen)|hn(?:\.wilde\.oneplusfinance|a9577|griffn818|paton\.alphafmc|r(?:awlings956|oxfordjr1)|son(?:deba|wilson(?:389|490))|tanko214|uba234|walterlove2010)|monkzza|n(?:esandassociates68|monkssa)|s(?:ephacevedo024|ianeangenor)|y(?:ce00011|mrskone5))|rawlings007|s4fernado|uliet\.le(?:222|e2222)|w6935997)|k(?:a(?:lstromjames3|malnizar000|rabo\.ramala39|t(?:ebaronbarr|hilittman7|jamess043|rinaziako56))|e(?:lsawamelia55|n(?:mck(?:ay1980|enziejr)|nedy\.sawadogo19))|halidbuhazza99|js09376|kasbu790|o(?:ntakt\.claim|tokairportcargo|watsusho\.co\.ltd\.jp)|rnkl1109|un(?:gwei7777|ioue28)|wasiowusug)|l(?:a(?:r(?:ateambo|rytoms200)|ursent892|wrencefoundation30)|blackshirepm|e(?:ndfair\.co\.uk1|rynne(?:0west99|west2289))|i(?:amfinchus(?:11|3)|ezlnatashavanessa|li(?:ane\.bettencourt1945|ianchrstph)|n(?:elink008|glung104)|xiung(?:l48|9))|john6132|o(?:g(?:anntomas|eengen)|ttyoffice1|u(?:ghreymargaret67|isdreyfusmargarita5))|p319765|u(?:ckywinners2018|sba\.moored2019)|w94059|y(?:\.cheapiseth909|n(?:\.arthur011|cmba440|nmkl3332)))|m(?:a(?:bel\.manaku|ck(?:enzbezos|oliver324)|incare655|jor(?:dennishornbeck53|townsend01)|k(?:altschmidt|toumsheikhhasher)|n(?:duesq58|uelfranco(?:727|foundation0))|r(?:cusdembialomr|i(?:a(?:111dembele|27idemba|3(?:31lucas|51lucas)|hhills00)|nacoleman84|opabl26)|k(?:roth456|uses200)|y(?:franson56|jify00aaz01))|s(?:onmanny05|pencer5151)|t(?:hewriaanza|twilly3)|u(?:noveutileina|rhinck11?)|viswanczyk(?:1(?:19|987)|4(?:89|5)|775|foundation45|k112|zz)|xaajn|ydetratt)|c(?:\.cheadychang76|kenthando)|dredban775|e(?:044386|engeoffrey|l(?:lagolan|vidabullock5)|nnss01)|gfrederick80|husameddine|i(?:c(?:he(?:alwuu002|lintagro)|paulla|w954)|k(?:edawson1960s|h(?:\.fridman|ai(?:\.fridman261|lfridm32)))|nfin\.gv|ss(?:\.melisa\.mehmett|boteogottai|yaelronen))|jminabii|k(?:ent7117|untjoro52)|lbriggs08860|m(?:1086771|argaritalouisdreyfus)|nmalarge|o(?:ham(?:edabdul1717|madraqab00)|rienkal30)|r(?:\.(?:justinmaxwell09|lusee|wlsonkabore)|7672900|cjames001|d517341|ericfranck|fabianchukwu|hanimuhammad627|jamesmc6|martine80|paulfrank01|r(?:echardthomas|ichardanthony1)|s(?:\.(?:biyufungchi16|janetolsen?|olsenjanett|patarkatsishvili|susanread12)|a(?:ishaalqadafi1976|ngela454)|g(?:ezeria|racewoods70)|h(?:amima60|ristinemadeleine)|j(?:ackman123|lleach)|maureens847|nicolefr1marios|r(?:obinsanders185|uthsmith9900)|s(?:arahbenjamin103|ophiac)|veraaellen)|tomcrist\.ca)|s(?:agent02|golaan4|smadar44)|twvvv|u(?:ali000111|stadris22)|y(?:burghhugohendrik|racbally))|n(?:aomiiwasaki181|ckniem|eilt(?:9108|rotter(?:2017|968))|obuyuki\.hirano128|tawdglobal)|o(?:\.peace004|3344nb|ffice(?:\.012123|rricherd876|windowterms)|hallkenneth1|liviemorgan4|marinyandeng|nufoundationclaims|pcwkdw|swald\.l(?:\.lewis|ewwis)|vieogor1)|p(?:\.compton101|a(?:storfrancesco1|trick(?:\.efcc|andfrancessconnolly)|ul(?:eed1969|n8018)|ymentofficer14)|brookk0|e(?:130304|t(?:er(?:\.waddell204|guggi0|kenin73?|stephen4040)|ronasofficepromo))|h(?:\.cbnl|illip\.richead218)|i(?:eterstevens511|lz37754)|o(?:lloke|wellmrwilliam)|r(?:esleybathini1|o(?:1nvstream|cessing2013general))|trsvermeulen|w178483)|q(?:iquanzhou7|nzeng1)|r(?:19772744|677gfd|a(?:johnfernn|kidy23|lhashimi78|ymond(?:aba200|damon15))|e(?:beccagarang11|em(?:has(?:himy(?:1978|mail)|m044)|n2214)|mittanceofficeasaba|neehii\.omb|plyback00|v(?:\.(?:jamesabel1|mikedadax)|ernestcebi|frankjackson91))|i(?:ch(?:ard(?:lustig4u|w(?:ahl511|illis815))|lawandds)|tawilliams4141)|josh200000|o(?:berthanandez6655|naldmorris786|s(?:a\.gomes0044|e(?:kipkalya934|tam00)))|svcdusan|t(?:\.rev\.ericmark05|honrichardshepherd)|u(?:ssiaworldcuppromo|thmporat1\"))|s(?:a(?:chingrams|l(?:ehhussienconsult1|imzaid7000)|nchoscozfifa|rfiafarfask7)|cottpeters7989|e(?:cretservicce[78]|rgeantrobertbrown1|ydouthiebaconsultant)|g\.offiice\.group|h(?:a(?:msiahmohamadyunusbnegara|nemissler2009)|e(?:ikhalmaktoum79|ry(?:\.gtl131|etr03))|inawatrathaksin93)|i(?:lverlakeconsultant|mlkheng5)|krause680|l5342743|o(?:fia\.adams201|u(?:rcingloggs|thwsltd))|peelman1972|rfredericodehernandez|sdt224|tephentam1(?:47|6)|u(?:iyang(?:\.boc|02)|leiman\.cbnn|n\.hor20|san(?:freeman112x|neklatten502)|zana111bah)|w(?:eeneyjohnson384|islottnl))|t(?:a(?:mmy21gill|y(?:ebsouami0|lorcathy362))|davalvse|erryparkins11|h(?:ailandbankoffice01|e(?:ara\.choy2|bigbiglottowinning77|odorosloannis9|resawilliams7661?|smithfm124))|imothymetheny01|lyerdonald613|mason9w4r|o(?:m(?:\.cristdonor|c(?:hrist1995|rist(?:52|donation12|foundation99|world)))|ny(?:\.chung760|zimpro11)|pchronodesk|shikazusendo101)|p2911220|ransfermoney21\.2|tkhan69s)|u(?:babankbjplc|dregwqr|kponguko|marukareem8|n(?:claimedfunds554|itednation(?:organization70|s(?:8182|councilrefunds)))|sdepartmentofjustice80)|v(?:a(?:mamakazlegalchambers|nderwesthuizen560)|e(?:enapatel883|neerchris20003|r(?:a(?:aellen7|hollinkvan0)|enichekaterinaekaterina4))|i(?:ctoriaabraham2310|dalpamela85|ngut170|pjeferrey)|owpovertyfoundation)|w(?:a(?:dp4726|hlr(?:5990|ichard18)|ldibeatesieberhagen|nczykm61)|b(?:271981|6159980)|d232633|i(?:ge122|ll(?:iamrobert3852|update123))|kfinancialservice|orldbankregionalmanageroffice|u(?:\.office212|mt722)|ww\.moneygram9054)|y(?:\.oguzhan011|anghoseok5|doo974)|z(?:enithbankplconline98|kiaslan1963|minhong65)))\@gmail\.com$/i +header REPTO_419_FRAUD_GM Reply-To:addr =~ /^(?=[^\s<>@]+\@gmail\.com)(?:(?:01marviswanczyk|41speedlinkdelivery|7912richardtony|a(?:b(?:d97412345|u(?:lkareem461|shadi0004))|c(?:aalzz11|count\.optionsmr\.jonasarmstrong|e(?:alss11|cere001))|d(?:esilgon77|iallo\.boa)|erofilxeport|gent\.laryedwad|isha(?:1976algaddafi|gaddafiaam)|jaminamo|l(?:\.jo60691737|a(?:n\.austin(?:041|223)|scramac)|ber\.yang222|ex(?:ander(?:daisy911|peterson4499)|hoffman3319|smithznn)|ghafrij13|hajarb|lenholden121|nizmaria|ure\.wawrenka1472)|m(?:b\.w\.stuart\.symington|ericadeliverycomapny1(?:300|800)|ina(?:ltwaijiri02|tasomda))|n(?:d(?:rewumehunitedbankforafrica|yfox0022)|itaminarnguessan|n(?:a(?:choihkkic|llee091|sigurlaug458)|jenijohnsonn)|t(?:honyalvaradollc|o(?:meuenio|niopaco20consultant)))|r(?:adka01|chibaldhamble|thur11alan)|s(?:h(?:0611jnag|westwood7)|ianbae1010|sistance7agent)|t(?:m(?:mastercard41|office929)|tohlawoffice\.tg)|w1614860|yevayawovi190|zi(?:m(?:\.h(?:ashim\.premj|premji13)|hashim(?:2018|donation2019))|z(?:dake0|george50)))|b(?:a(?:lla250abc|nk(?:centralasiahalobca34|ingcentralng)|ochang7a|r(?:bersmadar75|r(?:\.(?:charles(?:1954|office)|martinrichard)|ister(?:\.fidelisokafor|lordruben94)|ubenjames)|teld\.huisman01))|bongo593|c0996013|e(?:linekra1|n(?:ezero392|jaminsarah195))|i(?:anigercash|ll(?:\.lawrence0747|fhome))|laisevodoun|mw(?:automobile242|officeline)|o(?:arddept0|cchenyi)|r(?:a(?:ndy\.heavenscenttt|volpaul55)|endalaporte112|ianmoynih00)|uff(?:ettwarrene21|ookj))|c(?:a(?:ixaseguros9810001|mluba2017|r(?:eisu98|l(?:os\.s\.helux|thomos)|twrighttownhomesllc))|bnatm847|claimsa|e(?:li(?:cerez|neroullier(?:200|nm))|ntraltrustlltd)|h(?:a(?:ngching885|r(?:itylisajohnrobinson41|l(?:esluenga01|tonnewmanus1)))|e(?:mchung1011|nchung1011)|i(?:enk(?:raymond|wongp)|mwiakim))|iticonsultantjohncg0|kruger00017|l(?:a(?:im(?:adviser11|officeadm)|xtonpaul00)|s79408)|o(?:l(?:\.(?:ahmedmarani|fakhrialsalabi(?:01)?|hmedismari)|abdullahassi|edavid77032|husseinharmuchc(?:cj|j)|inchrisweir50|mohmanairf|o(?:mbasjuan53|nelsaad00))|mpensationcommitteboard|n(?:sult(?:ancy64|matthias|sto\.u)|tact(?:\.kolason|ad00[04]))|operation612)|pt\.eugenebarash|r(?:a(?:bbechambers|wfordgillies1)|ist(?:bru(?:05|n05)|i1537bru))|ustomerservicelacaixa2)|d(?:29laws|a(?:n(?:008629|iel(?:35508109|zulu11)|nydan24532)|v(?:i(?:d(?:\.loanfirm18|ibe718|larbi11|pere337|r(?:amirez\.luis9012|ikhen))|scarolyn334|yax98)|ychan1970))|c(?:layconsult|ole77032)|e(?:btm123|n(?:iwalts|nis(?:clark659|quaid888))|partmentofstate(?:123|321)|tlefeckhardd)|hill27676|i(?:ane\.s\.wojcicki|gitalassetholding|p(?:francis1|lomat(?:\.john\.clerke|sshenry)))|minique200|o(?:minicahkye|na(?:ldwilliam1988|tionhelpercare5))|r(?:\.(?:meirh|wilsonpaul02)|abodid|davidrhama221|j(?:amesdee|oesimon77)|kennedyuzo|meier\.heidi?|o(?:vieogor1|wenfrederick))|u(?:a1155a|nsilva58|stinmoskovitz\.2facebook)|v\.metus)|e(?:benezero392|christina937|d(?:runity|winfreeman22)|fcc\.financial\.dept|l(?:i(?:bethgomez(?:175|499)|sabethmaria600|zabethedw0)|otocashoffice1?)|m(?:2keld|ailpostlink09|efiele(?:328|g757)|ilyrichmond391)|r(?:enakgeorge123|ioncarter\.private)|ssexlss1|vgpatmow)|f(?:\.mikhail025|a(?:ithdesrie511|tme\.mehmed001)|blott47|e(?:deralreservebankdallasdst|lix88995)|g0067333|irstbank(?:49(?:666|966)|k49666)|j569282|l(?:556249|aurentdz40|uhmann\.dn)|mb\.agent|o(?:ropunionbank|undations\.west)|r(?:a(?:100dub132|n(?:c(?:espatrickconnolly(?:5050|4)|isca(?:mendoza960|samendoza))|k(?:j(?:ane984|wangg)|laurarivera)))|bbankny\.gov|e(?:derick\.colemanesq|elottosweepstake51))|u(?:lanlan28|ngg1w))|g(?:00gleggewinner19|a(?:b(?:albertoassociates|rielkalia1102)|r(?:ethbull112016|yakinson121))|bill4880|e(?:n(?:\.ahmedmsksi|eral(?:abdulrazak|williamstony990))|orgekwame481|r(?:aldjhjh11|tjanvlieghe787))|g780904|i(?:idp955|lbert12oook)|kwasiiwusu1\.persona|l(?:enmoore0011|oriachow5052)|o(?:glegewinnerteam|o(?:dnessxtra|golteam2019|oglegwiinner219)|vgodwinemefiele111)|r(?:ace(?:jackmanwoods|obia001)|e(?:ant311|energeoffrey776))|veraallen)|h(?:a(?:r(?:old\.dia1100|ryebert101|twellbdaniel)|s(?:h(?:imyreem78|mireem801)|sanalshujairy))|e(?:a(?:dofficecentre0210|therbrooeke101)|cto(?:alon|r(?:castillos653|scastillo6))|lpdesk47321)|gold8080|heba\.hhassan207|i(?:ldad837|toshurui)|klee\.mike|o(?:lsemeyerole6|nmackjohn518|rnbeckmajordennis63[478]|seoky(?:34|9))|sbchgm|trryt34|uichmh)|i(?:1955smael|amannjejosonn|bed627|n(?:fo(?:\.(?:abogadosmfontana|g00gleclaim|questiondesk|ulmusau)|64240|98cbnoffice7|a(?:prl06|sminternationalpk)|dessk\.dfwairportonline|fdrserve)|gridrolle2|t(?:ernationallppp1|linvestorsfirm))|smailtarkan533|terryoffice)|j(?:35809121|a(?:6002932|888179|cobmaseon5995|m(?:alpriv8un|es(?:husmansdesk2240|okoh82))|nusensecureprivate|sonyeungchiwai|vierlesme001)|b5406424|c2222222rrr|e(?:ff(?:deandk2|erydean1960)|nniannjhsonn|ssikasingh4)|imyang977|k3311131|mpowellfr|o(?:e(?:dward023|kendal540|lmodisen)|hn(?:\.wilde\.oneplusfinance|a9577|griffn818|paton\.alphafmc|r(?:awlings956|oxfordjr1)|son(?:deba|wilson(?:389|490))|tanko214|uba234|walterlove2010)|monkzza|n(?:esandassociates68|monkssa)|s(?:ephacevedo024|ianeangenor)|y(?:ce00011|mrskone5))|rawlings007|s4fernado|uliet\.le(?:222|e2222)|w6935997)|k(?:a(?:lstromjames3|malnizar000|rabo\.ramala39|t(?:ebaronbarr|hilittman7|jamess043|rinaziako56))|e(?:lsawamelia55|n(?:mck(?:ay1980|enziejr)|nedy\.sawadogo19))|halidbuhazza99|js09376|kasbu790|o(?:ntakt\.claim|tokairportcargo|watsusho\.co\.ltd\.jp)|rnkl1109|un(?:gwei7777|ioue28)|wasiowusug)|l(?:a(?:r(?:ateambo|rytoms200)|ursent892|wrencefoundation30)|blackshirepm|e(?:ndfair\.co\.uk1|rynne(?:0west99|west2289))|i(?:amfinchus(?:11|3)|ezlnatashavanessa|li(?:ane\.bettencourt1945|ianchrstph)|n(?:elink008|glung104)|xiung(?:l48|9))|john6132|o(?:g(?:anntomas|eengen)|rrainewirengee|ttyoffice1|u(?:ghreymargaret67|isdreyfusmargarita5))|p319765|u(?:ckywinners2018|sba\.moored2019)|w94059|y(?:\.cheapiseth909|n(?:\.arthur011|cmba440|nmkl3332)))|m(?:a(?:bel\.manaku|ck(?:enzbezos|oliver324)|incare655|jor(?:dennishornbeck53|townsend01)|k(?:altschmidt|toumsheikhhasher)|n(?:duesq58|fran630|uelfranco(?:727|foundation0))|r(?:cusdembialomr|i(?:a(?:111dembele|27idemba|3(?:31lucas|51lucas)|hhills00)|nacoleman84|opabl26)|k(?:roth456|uses200)|y(?:franson56|jify00aaz01))|s(?:onmanny05|pencer5151)|t(?:hewriaanza|twilly3)|u(?:noveutileina|rhinck11?)|viswanczyk(?:1(?:19|987)|4(?:89|5)|775|foundation45|k112|zz)|xaajn|ydetratt)|c(?:\.cheadychang76|kenthando)|dredban775|e(?:044386|engeoffrey|l(?:lagolan|vidabullock5)|nnss01)|gfrederick80|husameddine|i(?:c(?:he(?:alwuu002|lintagro)|paulla|w954)|k(?:edawson1960s|h(?:\.fridman|ai(?:\.fridman261|lfridm32)))|nfin\.gv|ss(?:\.melisa\.mehmett|boteogottai|yaelronen))|jminabii|k(?:ent7117|untjoro52)|lbriggs08860|m(?:1086771|argaritalouisdreyfus)|nmalarge|o(?:ham(?:edabdul1717|madraqab00)|rienkal30)|r(?:\.(?:justinmaxwell09|lusee|wlsonkabore)|7672900|cjames001|d517341|ericfranck|fabianchukwu|hanimuhammad627|jamesmc6|martine80|paulfrank01|r(?:echardthomas|ichardanthony1)|s(?:\.(?:biyufungchi16|janetolsen?|olsenjanett|patarkatsishvili|susanread12)|a(?:ishaalqadafi1976|ngela454)|g(?:ezeria|racewoods70)|h(?:amima60|ristinemadeleine)|j(?:ackman123|lleach)|maureens847|nicolefr1marios|r(?:obinsanders185|uthsmith9900)|s(?:arahbenjamin103|ophiac)|veraaellen)|tomcrist\.ca)|s(?:agent02|golaan4|smadar44)|twvvv|u(?:ali000111|stadris22)|y(?:burghhugohendrik|racbally))|n(?:aomiiwasaki181|ckniem|eilt(?:9108|rotter(?:2017|968))|obuyuki\.hirano128|tawdglobal)|o(?:\.peace004|3344nb|ffice(?:\.012123|rricherd876|windowterms)|hallkenneth1|liviemorgan4|marinyandeng|nufoundationclaims|pcwkdw|swald\.l(?:\.lewis|ewwis)|vieogor1)|p(?:\.compton101|a(?:storfrancesco1|trick(?:\.efcc|andfrancessconnolly)|ul(?:eed1969|n8018)|ymentofficer14)|brookk0|e(?:130304|t(?:er(?:\.waddell204|guggi0|kenin73?|stephen4040)|ronasofficepromo))|good60000|h(?:\.cbnl|illip\.richead218)|i(?:eterstevens511|lz37754)|o(?:lloke|wellmrwilliam)|r(?:esleybathini1|o(?:1nvstream|cessing2013general))|trsvermeulen|w178483)|q(?:iquanzhou7|nzeng1)|r(?:19772744|677gfd|a(?:johnfernn|kidy23|lhashimi78|ymond(?:aba200|damon15))|e(?:beccagarang11|em(?:has(?:himy(?:1978|mail)|m044)|n2214)|lpandemic|mittanceofficeasaba|neehii\.omb|plyback00|v(?:\.(?:jamesabel1|mikedadax)|ernestcebi|frankjackson91))|i(?:ch(?:ard(?:lustig4u|w(?:ahl511|illis815))|lawandds)|tawilliams4141)|josh200000|o(?:berthanandez6655|naldmorris786|s(?:a\.gomes0044|e(?:kipkalya934|tam00)))|svcdusan|t(?:\.rev\.ericmark05|honrichardshepherd)|u(?:ssiaworldcuppromo|thmporat1\"))|s(?:a(?:chingrams|l(?:ehhussienconsult1|imzaid7000)|nchoscozfifa|rfiafarfask7)|cottpeters7989|e(?:cretservicce[78]|rgeantrobertbrown1|ydouthiebaconsultant)|g\.offiice\.group|h(?:a(?:msiahmohamadyunusbnegara|nemissler2009)|e(?:ikhalmaktoum79|ry(?:\.gtl131|etr03))|inawatrathaksin93)|i(?:lverlakeconsultant|mlkheng5)|krause680|l5342743|o(?:fia\.adams201|u(?:rcingloggs|thwsltd))|peelman1972|rfredericodehernandez|sdt224|tephentam1(?:47|6)|u(?:iyang(?:\.boc|02)|leiman\.cbnn|n\.hor20|san(?:freeman112x|neklatten502)|zana111bah)|w(?:eeneyjohnson384|islottnl))|t(?:a(?:mmy21gill|y(?:ebsouami0|lorcathy362))|davalvse|erryparkins11|h(?:ailandbankoffice01|e(?:ara\.choy2|bigbiglottowinning77|odorosloannis9|resawilliams7661?|smithfm124))|imothymetheny01|lyerdonald613|mason9w4r|o(?:m(?:\.cristdonor|c(?:hrist1995|rist(?:52|donation12|foundation99|world)))|ny(?:\.chung760|zimpro11)|pchronodesk|shikazusendo101)|p2911220|ransfermoney21\.2|tkhan69s)|u(?:babankbjplc|dregwqr|kponguko|marukareem8|n(?:claimedfunds554|itednation(?:organization70|s(?:8182|councilrefunds)))|sdepartmentofjustice80)|v(?:a(?:mamakazlegalchambers|nderwesthuizen560)|e(?:enapatel883|neerchris20003|r(?:a(?:aellen7|hollinkvan0)|enichekaterinaekaterina4))|i(?:ctoriaabraham2310|dalpamela85|ngut170|pjeferrey)|owpovertyfoundation)|w(?:a(?:dp4726|hlr(?:5990|ichard18)|ldibeatesieberhagen|nczykm61|rrenebuffett2)|b(?:271981|6159980)|d232633|i(?:elandherzog\.sw\.herad16|ge122|ll(?:clark2618|iamrobert3852|update123))|kfinancialservice|orldbankregionalmanageroffice|u(?:\.office212|mt722)|ww\.moneygram9054)|y(?:\.oguzhan011|anghoseok5|doo974)|z(?:enithbankplconline98|kiaslan1963|minhong65)))\@gmail\.com$/i describe REPTO_419_FRAUD_GM Reply-To is known advance fee fraud collector mailbox #score REPTO_419_FRAUD_GM 3.000 tflags REPTO_419_FRAUD_GM publish @@ -3739,7 +3786,7 @@ tflags REPTO_419_FRAUD_GM_LOOSE publish ##{ REPTO_419_FRAUD_HM -header REPTO_419_FRAUD_HM Reply-To:addr =~ /^(?=[^\s<>@]+\@hotmail\.com)(?:(?:a(?:brahambeniam|nikal01|zezul\.idrisazezulidris)|benarnault0|c(?:ecilekaramoko123|hoi21)|d(?:l13139|r\.dukanalycoulibaly)|egorbunova22|fanliangjen2|gen\.dmathokdiigwol|katabettencourt2018|l(?:\.b120k|e(?:a_edem|wisarm44)|imfu201677|ulihongm)|m(?:cliffmomah998|r(?:abrahambeniamfc|pedrohilldonations|s(?:\.roselinejac|elizabetmk|helenbgeorge|micheleallison2003)))|n(?:inajohn226|waigwe2765)|ocbc\-ba\-nkonline|patrickmullinfinaceservs|s(?:ajda\.andleeb|gthansencs|tephenbettinger|ulaimaninfante)|t(?:ashacap|omashntr)|unb(?:2015|int)|yostinbellamohammad))\@hotmail\.com$/i +header REPTO_419_FRAUD_HM Reply-To:addr =~ /^(?=[^\s<>@]+\@hotmail\.com)(?:(?:a(?:brahambeniam|nikal01|zezul\.idrisazezulidris)|benarnault0|c(?:ecilekaramoko123|hoi21)|d(?:l13139|r\.dukanalycoulibaly)|egorbunova22|fanliangjen2|gen\.dmathokdiigwol|infos(?:43|8)|katabettencourt2018|l(?:\.b120k|e(?:a_edem|wisarm44)|imfu201677|ulihongm)|m(?:cliffmomah998|r(?:abrahambeniamfc|pedrohilldonations|s(?:\.roselinejac|elizabetmk|helenbgeorge|micheleallison2003)))|n(?:inajohn226|waigwe2765)|ocbc\-ba\-nkonline|p(?:atrickmullinfinaceservs|owen10001)|s(?:ajda\.andleeb|gthansencs|tephenbettinger|ulaimaninfante)|t(?:ashacap|omashntr)|unb(?:2015|int)|yostinbellamohammad))\@hotmail\.com$/i describe REPTO_419_FRAUD_HM Reply-To is known advance fee fraud collector mailbox #score REPTO_419_FRAUD_HM 3.000 tflags REPTO_419_FRAUD_HM publish @@ -3771,7 +3818,7 @@ tflags REPTO_419_FRAUD_QQ publish ##{ REPTO_419_FRAUD_YH -header REPTO_419_FRAUD_YH Reply-To:addr =~ /^(?=[^\s<>@]+\@yahoo\.com)(?:(?:a(?:driantongson13|gaaintl\-4g5ee\.w3|l(?:berts\.odia|esiakalina2006)|mbassador\.l|nn(?:awax48|hester\.usa4))|b(?:a(?:che\.delfine|nk\.phbng14|rr(?:\.thomasclark|ister\.(?:dennis11|marcus)|lawrencefubara39|william_davies))|en(?:jaminb34|nicholas22)|illlawrenceee|riceangela45)|c(?:\.(?:aroline90|coulibaly2)|a(?:binet_maitre_emmanuel_patris|mpbellwilliamms)|h(?:arlesscharf112|hoy\.t|im\.w|jackson65)|juan852|o(?:llins(?:mattew32|wayne84)|mpliment\.sseason|ntelamine)|ythiamiller\.un10)|d(?:hamilton9099|i(?:aanesoto190|plomaticagent180)|r(?:\.aminramli|victorobaji))|edwarddawson|f(?:aizaadama2016|bicompensation_funds|ederal\.r73|id00180)|g(?:ov\.ukmessageboard|raham\.eddie2016|uesfilet1336523)|harry1vans|i(?:\.project33411|befranfgnfmf|nfo(?:111mail|bank1|money)|project32411)|j(?:\.edwards228|a(?:ckson\.davis915|ne(?:_ooparah|temoon150))|essica\.p_family|inping\.tw|kimyong21|lawrencefrb|ulietjohnsonn)|k(?:elvinmark629|im(?:\.leang2018?|leang(?:575|90))|yle_grubbe)|l(?:e(?:a_edem13|ge331|hman(?:909|bila))|i(?:m_kaan|sarobinson_555|uhngbin)|y_cheapiseth(?:11|2019))|m(?:arie_avis12|d(?:\.ps|zsesszika672)|elissalewis(?:10001|4004)|iss\.zarryb|o(?:hammedaahil46|keye79)|r(?:kellyayi62|s(?:\.esthernicolas|isabella\.dzesszikan|themo))|s\.gracie_olakun|unny(?:\.sopheap207|_sopheap30))|n(?:adhowc|estordaniel2|orahuz1960)|o(?:fficial_franksylvester88|legkozyrev1|mranshaalan52)|p(?:a(?:ckerkelvin|yus123x)|eterlee1950|rincerasmane)|r(?:alphw(?:\.johnson78|johnson78)|i(?:chard\.w94|taadamsw10)|o(?:b(?:ertbailey2004|orts20)|se(?:mary\.3as|richard655)))|s(?:amthong4040|igurlauganna34|leo25|mith(?:\.dr|colin767)|opheap\.munny|pwalker101|sgt\.bethany|tevecox\.98)|t(?:\.murasawa|ep1chen|heara\.chhoy|ylerhess\.43)|u(?:butu16|kdebtmanagement5)|vanserge2001|will(?:clark0010|iamsimon(?:22|521))|xianglongdai60|zhaodonghk))\@yahoo\.com$/i +header REPTO_419_FRAUD_YH Reply-To:addr =~ /^(?=[^\s<>@]+\@yahoo\.com)(?:(?:a(?:driantongson13|gaaintl\-4g5ee\.w3|l(?:berts\.odia|esiakalina2006)|mbassador\.l|nn(?:awax48|hester\.usa4))|b(?:a(?:che\.delfine|nk\.phbng14|rr(?:\.thomasclark|ister\.(?:dennis11|marcus)|lawrencefubara39|william_davies))|en(?:jaminb34|nicholas22)|illlawrenceee|riceangela45)|c(?:\.(?:aroline90|coulibaly2)|a(?:binet_maitre_emmanuel_patris|mpbellwilliamms)|h(?:arlesscharf112|hoy\.t|im\.w|jackson65)|juan852|o(?:llins(?:mattew32|wayne84)|mpliment\.sseason|ntelamine)|ythiamiller\.un10)|d(?:hamilton9099|i(?:aanesoto190|plomaticagent180)|r(?:\.aminramli|_raymondfung|victorobaji))|e(?:dwarddawson|ricalbert24)|f(?:aizaadama2016|bicompensation_funds|ederal\.r73|id00180)|g(?:ov\.ukmessageboard|raham\.eddie2016|uesfilet1336523)|harry1vans|i(?:\.project33411|befranfgnfmf|nfo(?:111mail|bank1|money)|project32411)|j(?:\.edwards228|a(?:ckson\.davis915|ne(?:_ooparah|temoon150))|essica\.p_family|inping\.tw|kimyong21|lawrencefrb|ulietjohnsonn)|k(?:elvinmark629|im(?:\.leang2018?|leang(?:575|90))|yle_grubbe)|l(?:e(?:a_edem13|ge331|hman(?:909|bila))|i(?:m_kaan|sarobinson_555|uhngbin)|y_cheapiseth(?:11|2019))|m(?:arie_avis12|d(?:\.ps|zsesszika672)|elissalewis(?:10001|4004)|iss\.zarryb|o(?:hammedaahil46|keye79)|r(?:kellyayi62|s(?:\.esthernicolas|isabella\.dzesszikan|themo))|s\.gracie_olakun|unny(?:\.sopheap207|_sopheap30))|n(?:adhowc|estordaniel2|orahuz1960)|o(?:fficial_franksylvester88|legkozyrev1|mranshaalan52)|p(?:a(?:ckerkelvin|yus123x)|eterlee1950|rincerasmane)|r(?:alphw(?:\.johnson78|johnson78)|i(?:chard\.w94|taadamsw10)|o(?:b(?:ertbailey2004|orts20)|se(?:mary\.3as|richard655)))|s(?:amthong4040|igurlauganna34|leo25|mith(?:\.dr|colin767)|opheap\.munny|pwalker101|sgt\.bethany|tevecox\.98)|t(?:\.murasawa|ep1chen|heara\.chhoy|ylerhess\.43)|u(?:butu16|kdebtmanagement5)|vanserge2001|will(?:clark0010|iamsimon(?:22|521))|xianglongdai60|zhaodonghk))\@yahoo\.com$/i describe REPTO_419_FRAUD_YH Reply-To is known advance fee fraud collector mailbox #score REPTO_419_FRAUD_YH 3.000 tflags REPTO_419_FRAUD_YH publish @@ -3795,7 +3842,7 @@ tflags REPTO_419_FRAUD_YJ publish ##{ REPTO_419_FRAUD_YN -header REPTO_419_FRAUD_YN Reply-To:addr =~ /^(?=[^\s<>@]+\@yandex\.com)(?:(?:a(?:lsharibi|m(?:andarandle|g3333txx101)|na\.mariposa|wesome\.mariacarmen)|b(?:ayemahama|igghandgrant|radely\.j)|clemlau|diezanimadueke|f(?:3dex\.courier|ed\.r3v|reedommarketinvestments|uzhongjun\.director)|g(?:\.anniversary(?:101)?|add4fi\.aisha)|hhalesbbanddd?|irenaa\.georgiadou|j(?:efrey(?:\-dean|\.dean11)|o(?:hnnicholsonjr|seph\-scott2k5)|uliet\.lee2222)|kenhamberlet|l(?:es20sc|otointernational\.elgordo)|m(?:a(?:hama\.baye|rcarmenguty)|fdpm|ohamed\.bennani|r(?:\-(?:jos\.martins|robert\-patrick\.patrick)|\.kongkea|spercy))|nokiahouse1[03]|olivia\.mabor|p(?:aragonloansinc|hilipfen778|ri(?:ncedarren0244|vatemail24)|ullmanrb)|rich(?:ard\.wahl|lawands)|skyeloanand\.financelimited|t(?:\.baloyi|an\.sung|omss\.smith|resor\.mambo)|w(?:b\.foundation|ill(?:1amsmarg1|iamsimon1960))|za\.dc2016))\@yandex\.com$/i +header REPTO_419_FRAUD_YN Reply-To:addr =~ /^(?=[^\s<>@]+\@yandex\.com)(?:(?:a(?:lsharibi|m(?:andarandle|g3333txx101)|na\.mariposa|wesome\.mariacarmen)|b(?:ayemahama|igghandgrant|radely\.j)|clemlau|diezanimadueke|f(?:3dex\.courier|ed\.r3v|reedommarketinvestments|uzhongjun\.director)|g(?:\.anniversary(?:101)?|add4fi\.aisha)|hhalesbbanddd?|irenaa\.georgiadou|j(?:efrey(?:\-dean|\.dean11)|o(?:hnnicholsonjr|seph\-scott2k5)|uliet\.lee2222)|kenhamberlet|l(?:es20sc|otointernational\.elgordo)|m(?:a(?:hama\.baye|rcarmenguty)|fdpm|ohamed\.bennani|r(?:\-(?:jos\.martins|robert\-patrick\.patrick)|\.kongkea|akram\.elkerrami|spercy))|nokiahouse1[03]|olivia\.mabor|p(?:aragonloansinc|hilipfen778|ri(?:ncedarren0244|vatemail24)|ullmanrb)|rich(?:ard\.wahl|lawands)|skyeloanand\.financelimited|t(?:\.baloyi|an\.sung|omss\.smith|resor\.mambo)|w(?:b\.foundation|ill(?:1amsmarg1|iamsimon1960))|za\.dc2016))\@yandex\.com$/i describe REPTO_419_FRAUD_YN Reply-To is known advance fee fraud collector mailbox #score REPTO_419_FRAUD_YN 3.000 tflags REPTO_419_FRAUD_YN publish @@ -3812,6 +3859,18 @@ describe RISK_FREE No risk! meta SB_GIF_AND_NO_URIS (__GIF_ATTACH&&!__HAS_ANY_URI&&!__HAS_ANY_EMAIL) ##} SB_GIF_AND_NO_URIS +##{ SCC_NEWBIE_HASBEENS + +describe SCC_NEWBIE_HASBEENS Abused gTLDs seen in spam from Google Apps. +header SCC_NEWBIE_HASBEENS X-Beenthere =~ /\.(today|online|monster)/ +##} SCC_NEWBIE_HASBEENS + +##{ SCRIPT_GIBBERISH + +meta SCRIPT_GIBBERISH __SCRIPT_GIBBERISH && (__BODY_XHTML || !__SCRIPT_TAG_IN_BODY) && !__TAG_EXISTS_META +describe SCRIPT_GIBBERISH Nonsense in HTML