# SpamAssassin rules file: phrase tests
#
# Please don't modify this file as your changes will be overwritten with
# the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead.
# See 'perldoc Mail::SpamAssassin::Conf' for details.
#
# Note: body tests are run with long lines, so be sure to limit the
# size of searches; use /.{0,30}/ instead of /.*/ to avoid huge
# search times.
#
# <@LICENSE>
# Copyright 2004 Apache Software Foundation
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# </@LICENSE>
#
###########################################################################
require_version @@VERSION@@
###########################################################################
body MULTI_REMOVAL_1WORD /remov\S{0,64}remov/i
describe MULTI_REMOVAL_1WORD List removal information
# bug 1022: MGM_POSTCARD #2 original
body REMOVE_POSTAL /(?:Send(?:ing)? a (?:postal mail|postcard) to (?:Unsubscribe|Customer ?Service|remove)|unsubscribe by (?:postal mail|postcard))/i
describe REMOVE_POSTAL Send real mail to be unsubscribed
###########################################################################
# CLICK rules
# note HTML_LINK_CLICK* rules in HTML parser section
body CLICK_BELOW_CAPS /CLICK\s.{0,30}(?:HERE|BELOW)/s
describe CLICK_BELOW_CAPS Asks you to click below (in capital letters)
body CLICK_TO_REMOVE_1 /click here to be (?:permanently )?(?:removed|deleted)/i
describe CLICK_TO_REMOVE_1 Click to be removed
body SENT_IN_COMPLIANCE /(?:e.?mail|message) .{0,10}sen[dt] (?:to you )?in (?:\w{1,10} )?compliance (?:of|with)/i
describe SENT_IN_COMPLIANCE Claims compliance with spam regulations
body BILL_1618 /\bs\W{0,4}1618\b/i
describe BILL_1618 Possible mention of bill 1618 (anti-spam bill)
body NO_QS_ASKED /\bNO QUESTIONS ASKED\b/i
describe NO_QS_ASKED Doesn't ask any questions
body FULL_REFUND /full refund|refunds? your money in full/i
describe FULL_REFUND Offers a full refund
body COMPLETELY_FREE /\b(?:100%|completely|totally|absolutely) (?-i:F)ree/i
describe COMPLETELY_FREE No such thing as a free lunch (2)
body NO_COST /\bno (?:cost|charge)\b/i
describe NO_COST No such thing as a free lunch (3)
body GUARANTEED_100_PERCENT /100% GUARANTEED/i
describe GUARANTEED_100_PERCENT One hundred percent guaranteed
body DEAR_FRIEND /^\s*Dear Friend\b/i
describe DEAR_FRIEND Dear Friend? That's not very dear!
body DEAR_SOMETHING /\bDear (?:IT\W|Internet|candidate|sirs?|madam|investor|travell?er|car shopper|web)\b/i
describe DEAR_SOMETHING Contains 'Dear (something)'
body BILLION_DOLLARS /[BM]ILLION DOLLAR/
describe BILLION_DOLLARS Talks about lots of money
body OPTING_OUT /\bopt-out\b/
describe OPTING_OUT Talks about opting out (lowercase version)
body OPTING_OUT_CAPS /(?-i:O)pt.?(?-i:O)ut/i
describe OPTING_OUT_CAPS Talks about opting out (capitalized version)
body MILLION_EMAIL /million (?:\w+ )?(?:e-?mail )?addresses/i
describe MILLION_EMAIL Get a million email addresses
body EXCUSE_1 /\b(?:You (?:were sent|have received|are receiving)|You're receiving).{0,15}(?:message|e-?mail)s? because/i
describe EXCUSE_1 Gives a lame excuse about why spam was sent
body EXCUSE_3 /to (?:be removed|be deleted|no longer receive th(?:is|ese) messages?) (?:from|send|reply|[e-]*mail)/i
describe EXCUSE_3 Claims you can be removed from the list
body EXCUSE_4 /To Be Removed,? Please/i
describe EXCUSE_4 Claims you can be removed from the list
# strange pattern because otherwise it matches the std. majordomo line
# pls note the comment above. DO NOT just put "to" in the first group!
body EXCUSE_6 /\b(?:wish to|click to) remove yourself/i
describe EXCUSE_6 Claims you can be removed from the list
body EXCUSE_7 /you (?:wish|want|would like|desire) to be removed/i
describe EXCUSE_7 Claims you can be removed from the list
body EXCUSE_10 /if you (?:(?:want|wish|care|prefer) not to |do ?n[o']t (?:want|wish|care) to )(?:be contacted again|receive (?:any ?)?(?:more|future|further)\b.{1,10}\b(?:e?-?mail|message|offer|solicitation)s?|be included)/i
describe EXCUSE_10 "if you do not wish to receive any more"
body EXCUSE_12 /this (?:e?-?mail|message) (?:(?:has )?reached|was sent to) you in error/i
describe EXCUSE_12 Nobody's perfect
body EXCUSE_19 /because (?:you're|you (?:are )?)(?:registered|.{0,20}\bopt.{0,3}in)/i
describe EXCUSE_19 Claims you opted-in or registered
body EXCUSE_23 /you have provided permission/i
describe EXCUSE_23 Claims you have provided permission
body EXCUSE_24 /you(?:'ve|'re| have| are)? receiv(?:e|ed|ing) this (?:advertisement|offer|special|recurring|paid).{0,16}\b(?:by either|because)/i
describe EXCUSE_24 Claims you wanted this ad
body EXCUSE_REMOVE /to be removed from.{0,20}(?:mailings|offers)/i
describe EXCUSE_REMOVE Talks about how to be removed from mailings
body TARGETED /\btargeted (?:traffic|e-?mail|internet|leads?)\b/i
describe TARGETED Targeted Traffic / Email Addresses
body STRONG_BUY /strong buy/i
describe STRONG_BUY Tells you about a strong buy
body WE_HONOR_ALL /\b(?:honou?r|respect)(?: all)? remov(?:e|al) requests?\b/i
describe WE_HONOR_ALL Claims to honor removal requests
body STOCK_PICK /STOCK PICK/i
describe STOCK_PICK Offers a picked stock
body STOCK_ALERT /stock alert/i
describe STOCK_ALERT Offers a alert about a stock
body MICRO_CAP_WARNING /Investing in micro-cap securities is highly speculative/i
describe MICRO_CAP_WARNING SEC-mandated penny-stock warning
body NOT_ADVISOR /not a registered investment advisor/i
describe NOT_ADVISOR Not registered investment advisor
body SOME_BREAKTHROUGH /\b(?:science|medical|major|scientific|fundamental|technology|revolutionary)\s+breakthrough/i
describe SOME_BREAKTHROUGH Describes some sort of breakthrough
body SELECTED_YOU /\b(?:you (?:have been|were) selected|\bwe (?:have )?selected you)/i
describe SELECTED_YOU They have selected you for something
# (contrib: skod)
body MAIL_IN_ORDER_FORM /\b(?:Mail-in|secure|ez|credit.card|fax this) Order Form\b/i
describe MAIL_IN_ORDER_FORM Contains mail-in order form
# (contrib: skod)
body UNIVERSITY_DIPLOMAS /\b(?:college|university)\s+diplomas/i
describe UNIVERSITY_DIPLOMAS University Diplomas
body PREST_NON_ACCREDITED /prestigi?ous\b.{0,20}\bnon-accredited\b.{0,20}\buniversities/i
describe PREST_NON_ACCREDITED 'Prestigious Non-Accredited Universities'
body CANNOT_BE_SPAM /cannot be considered spam/i
describe CANNOT_BE_SPAM Claims "cannot be considered spam"
# Jul 3 2002 jm: modified PENIS_ENLARGE patterns: removed "add", replaced with
# "inches", because that seems to be another typical word in the pattern.
# Feb 11 2003 jm: removed "PP" from pattern, since "pp. 234-237" is std usage
# in academic circles. I don't think the hit-rate will be affected. ;)
# Feb 18 2004 rap: Changed rule name PENIS_ENLARGE to BODY_ENHANCEMENT. Some found the
# old rule name offensive.
body BODY_ENHANCEMENT /\b(?:enlarge|increase|grow|lengthen|larger\b|bigger\b|longer\b|thicker\b|\binches\b).{0,50}\b(?:penis|male organ|pee[ -]?pee|dick|sc?hlong|wh?anger|breast)/i
describe BODY_ENHANCEMENT Information on growing body parts
body BODY_ENHANCEMENT2 /\b(?:penis|male organ|pee[ -]?pee|dick|sc?hlong|wh?anger|breast).{0,50}\b(?:enlarge|increase|grow|lengthen|larger\b|bigger\b|longer\b|thicker\b|\binches\b)/i
describe BODY_ENHANCEMENT2 Information on getting larger body parts
body IMPOTENCE /\b(?:impotence (?:problem|cure|solution)|Premature Ejaculation|erectile dysfunction)/i
describe IMPOTENCE Impotence cure
body WORK_AT_HOME /\b(?:WORK|(?:MAKE|EARN).{1,10}(?:MONEY|\$+|BUCKS|CASH)).{1,10}(?:AT|FROM) (?:YOUR )?HOME/i
describe WORK_AT_HOME Information on how to work at home (1)
body MORTGAGE_BEST /\b(?:low(?:est|er)?|free|second|rate|best|refinanc(?:e|ing)|online|instant) mortgage/i
describe MORTGAGE_BEST Information on mortgages
body MORTGAGE_PITCH /mortgage (?:rates?|quotes?|approv(?:al|ed)|payment|interest|loans?|app(?:\b|lication))/i
describe MORTGAGE_PITCH Looks like mortgage pitch
body MORTGAGE_RATES /Mortgage rates/i
describe MORTGAGE_RATES Information on mortgage rates
body ORDER_REPORT /order report .\s?\d from/i
describe ORDER_REPORT Order a report from someone
# this works best as rawbody
# do not add "subscribe", "unsubscribe", or "help"
rawbody MAILTO_SUBJ_REMOVE /mailto:.{0,64}\@.{0,64}\?subject=(?:\"|3D)*(?:remove?|delete|please.?(?:delete|remove|unsubscribe)|abuse|off\b|stop|take.?me.?off)/i
describe MAILTO_SUBJ_REMOVE mailto URI includes removal text
body AOL_USERS_LINK /AOL\s+Users\s+Click/is
describe AOL_USERS_LINK Includes a link for AOL users to click
body NA_DOLLARS /\b(?:\d{1,3})?Million\b.{0,40}\b(?:Canadian Dollar?s?|US\$|U\.? ?S\.? Dollar)/i
describe NA_DOLLARS Talks about a million North American dollars
body US_DOLLARS_3 /(?:\$|usd).?\d{1,3}[,.]\d{3}[,.]\d{3}(?:[,.]\d\d)?/i
describe US_DOLLARS_3 Mentions millions of $ ($NN,NNN,NNN.NN)
body MILLION_USD /Million\b.{0,40}\b(?:United States? Dollars?|USD)/i
describe MILLION_USD Talks about millions of dollars
rawbody FRONTPAGE /FrontPage.Editor/
describe FRONTPAGE Frontpage used to create the message
body JODY /\b(?:My wife|Mi esposa), Jody/
describe JODY Contains "My wife, Jody" testimonial
body YOUR_INCOME /\byour income\b/i
describe YOUR_INCOME Doing something with my income
body RESISTANCE_IS_FUTILE /Replying to this email will not unsubscribe you./i
describe RESISTANCE_IS_FUTILE Resistance to this spam is futile
body SUBJ_2_CREDIT /subject to credit approval/i
describe SUBJ_2_CREDIT Contains 'subject to credit approval'
body URG_BIZ /urgent.{0,16}(?:assistance|business|buy|confidential|notice|proposal|reply|request|response)/i
describe URG_BIZ Contains urgent matter
body EARN_PER_WEEK /\b(?:earn|make).{1,20}\d\d\d+.{1,30}(?:per week|per month|weekly|monthly)/i
describe EARN_PER_WEEK Contains 'earn $something per week'
body ALL_NATURAL /\b(?:100%|completely|totally|all) natural/i
describe ALL_NATURAL Spam is 100% natural?!
body MONEY_BACK /money back guarantee/i
describe MONEY_BACK Money back guarantee
body NO_CATCH /there is no catch/i
describe NO_CATCH There is no catch
body NO_OBLIGATION /no obligation/i
describe NO_OBLIGATION There is no obligation
body NO_DISAPPOINTMENT /You won'?t be diss?app?ointed/i
describe NO_DISAPPOINTMENT You won't be "disappointed"
body SERIOUS_ONLY /Serious [IE]nquiries Only/i
describe SERIOUS_ONLY Serious Enquiries Only
body RISK_FREE /\b(?:risk[ -]free|no[ -]risk)/i
describe RISK_FREE Risk free. Suuurreeee....
# "seen on TV", "seen on ABC/NBC/etc", "seen on XYZ TV", or "seen on:"
body AS_SEEN_ON /seen on\b\s*(?:T\.?V\.?|ABC|NBC|CBS|CNN|Oprah|USA Today|48 Hours|New York Times|\w+\s+T\.?V\.?|:)/i
describe AS_SEEN_ON As seen on national TV!
# This phrase appears in many pyramid scheme mails in which
# "My Wife Jody" testimonials are absent
body COPY_ACCURATELY /copy.{1,10}name.{1,10}address.{1,10}ACCURATELY\b/i
describe COPY_ACCURATELY Common pyramid scheme phrase (1)
## Contrib: Marc Perkel
body OFFSHORE_SCAM /\boffshore\b.{0,20}(?:credit card|companies|account|financ|websites?)/i
describe OFFSHORE_SCAM Off Shore Scams
body WHY_PAY_MORE /\bwhy pay more\b/i
describe WHY_PAY_MORE Why Pay More?
body CONGRATULATIONS /\bcongratulations! you/i
describe CONGRATULATIONS Congratulations - you've been scammed?
# do not add "new" since there's non-spam about "new cell phone numbers"
# separated into two rules since one seems to have a lot of
# sourceforge list advertisement false positives
body CELL_PHONE_FREE /\b(?-i:F)ree\b.{0,24}(?:cell(?:ular)?|mobile).{0,4}phones?/i
describe CELL_PHONE_FREE Talks about free mobile phones
body CELL_PHONE_IMPROVE /\b(?:(?:boost|antenna|reception).{0,16}(?:cell|mobile|phone|cord.?less)|(?:cell|mobile|phone|cord.?less).{0,16}(?:boost|antenna|reception))/i
describe CELL_PHONE_IMPROVE Talks about cell-phone signal improvement
# similar to OFFER, but fewer FPs
body RECEIVE_OFFER /receive special offer/i
describe RECEIVE_OFFER Receive a special offer
body FREE_QUOTE_INSTANT /free.{0,12}(?:(?:instant|express|online|no.?obligation).{0,4})+.{0,32}\bquote/i
describe FREE_QUOTE_INSTANT Free express or no-obligation quote
body FREE_MEMBERSHIP /\bfree membership/i
describe FREE_MEMBERSHIP Free Membership
body CREDIT_CARD /\bcredit card.{1,10}(?:offer|debt|decision)/i
describe CREDIT_CARD Credit Card Offers
body NO_CREDIT_CHECK /\bno credit check\b/i
describe NO_CREDIT_CHECK Without a credit check
body BANKRUPTCY /\b(?:avoid|past) bankruptcy\b/i
describe BANKRUPTCY Avoiding bankruptcy
body ACCEPT_CREDIT_CARDS /\b(?:accept\b|are accepting).{1,15}credit cards?\b/i
describe ACCEPT_CREDIT_CARDS Accepting credit cards
body BAD_CREDIT /\b(?:bad|poor|no\b|eliminate|repair|(?:re)?establish|damag).{0,10} (?:credit|debt)\b/i
describe BAD_CREDIT Eliminate Bad Credit
body NONSECURED_CREDIT /\bunsecured.{0,10}(?:master ?card|visa|credit|loans|debt)\b/i
describe NONSECURED_CREDIT Non-secured Credit/Debt
body CONSOLIDATE_DEBT /(?:consolidate .{0,9} (?:debt|credit|bills)|debt[ -]?(?:consolidation|elimination))/i
describe CONSOLIDATE_DEBT Consolidate debt, credit, or bills
body REFINANCE_YOUR_HOME /\brefinance your(?: current)? (?:home|house)\b/i
describe REFINANCE_YOUR_HOME Home refinancing
body REFINANCE_NOW /time to refinance|refinanc\w{1,3}\b.{0,16}\bnow\b/i
describe REFINANCE_NOW Home refinancing
body NO_PURCHASE /\bno purchase\b/i
describe NO_PURCHASE No Purchase Necessary
body NO_MEDICAL /\bno medical exam/i
describe NO_MEDICAL No Medical Exams
body NO_FORMS /\bno .{0,9}forms\b/i
describe NO_FORMS No Claim Forms
body INITIAL_INVEST /\binitial investment\b/i
describe INITIAL_INVEST Requires Initial Investment
body BUY_DIRECT /\bbuy direct\b/i
describe BUY_DIRECT Buy Direct
body DO_IT_TODAY /\b(?:join|register|order|apply) .{0,10}(?-i:T)oday\b/i
describe DO_IT_TODAY Do it Today
body WHY_WAIT /\b(?:why wait|what are you waiting for)\b/i
describe WHY_WAIT What are you waiting for
body YOU_CAN_SEARCH /you can search for anyone/i
describe YOU_CAN_SEARCH You can search for anyone
body SEDUCTION /\b(?:seduc|attract).{0,8} (?:ebook|opposite sex|women)\b/i
describe SEDUCTION Score with babes!
body INVALUABLE_MARKETING /invaluable marketing information/i
describe INVALUABLE_MARKETING Invaluable marketing information
body GUARANTEED_STUFF /\bguarantee.{0,15}(?:income|money|monthly)\b/i
describe GUARANTEED_STUFF Guaranteed Stuff
body EARNINGS /\b(?:potential (?:earnings|income)|income potential)\b/i
describe EARNINGS Potential Earnings
body THE_BEST_RATE /\bthe best rate/i
describe THE_BEST_RATE The best Rates
body AMAZING_STUFF /\bamazing (?:product|rates)/i
describe AMAZING_STUFF Amazing Stuff
# seems like we vastly reduce FPs on this one with a small change or two
body DIET_1 /\b(?:(?:without|no) (?:exercis(?:e|ing)|dieting)|weight.?loss|(?:extra|lose|lost|losing).{0,10}(?:pounds|weight|inches|lbs)|burn.{1,10}fat)\b/i
describe DIET_1 Lose Weight Spam
body DIET_2 /\blo+se.{1,10}\d+.{1,3}(?:lb|pound|kg|kilo)/i
describe DIET_2 Describes weight loss
body DIET_3 /(?:Body Fat Loss|Loss of body fat|lose.{1,10}body fat)/i
describe DIET_3 Describes body fat loss
body REVERSE_AGING /\breverses? aging\b/i
describe REVERSE_AGING Reverses Aging
body HAIR_LOSS /\b(?=[gnrt])(?:thinn?ing|restore|grow|new) hair|\bhair loss/i
describe HAIR_LOSS Cures Baldness
body WRINKLES /\bwrinkle reduction\b/i
describe WRINKLES Removes Wrinkles
body WHILE_YOU_SLEEP /\bwhile you sleep\b/i
describe WHILE_YOU_SLEEP While you Sleep
body RICH /\b(?:make you rich|get rich quick)\b/i
describe RICH If only it were that easy
body YOU_WON /\byou(?:\'ve| have)? won[^\'\w]/i
describe YOU_WON Who really wins?
body HIDDEN_CHARGES /\bhidden charges\b/i
describe HIDDEN_CHARGES Talks about Hidden Charges
body FIN_FREE /\bfinancial(?:ly)? free/i
describe FIN_FREE Freedom of a financial nature
body FORWARD_LOOKING /\bcontains forward-looking statements\b/i
describe FORWARD_LOOKING Stock Disclaimer Statement
body SATIS_GUAR /\bsatisfaction .{0,9}g(?:ua|au)ranteed\b/i
describe SATIS_GUAR Mail guarantees satisfaction
# Avoid an FP noted by NISHIJIMA Takanori: 'Japanese string sequence:
# "Su" "Ku" "Na" "I" "Ko" "Su" "To" "De" "Yo" "Ri" ...
# (This string means, "More ...(ex. "productive" or "effective")
# with less cost", and is a popular phrase but have no relations
# with human growth hormone, of course. :-)
# Encoded byte sequence: "$9" "$/" "$J" "$$" "%3" "%9" "%H" "$G" "$h" "$j"'
# note FP: ^^^^^^^^^^^^
body __HG_HORMONE /\b(?:human growth hormone|(?-i:HGH)|H.G.H)\b/i
meta HG_HORMONE (!__ISO_2022_JP_DELIM && __HG_HORMONE)
describe HG_HORMONE Talks about hormones for human growth
body EXTRA_CASH /\bextra cash\b/i
describe EXTRA_CASH Offers Extra Cash
body GET_PAID /\bget (?-i:P)aid\b/i
describe GET_PAID Get Paid
body BEEN_TURNED_DOWN /\bbeen turned down\b/i
describe BEEN_TURNED_DOWN Have you been turned down?
body ONE_TIME /\bone\W+time (?:charge|investment|offer|promotion)/i
describe ONE_TIME One Time Rip Off
body COMPETE /\bcompete for your business\b/i
describe COMPETE Compete for your business
body MEET_SINGLES /\bmeet .{0,12}singles|thousands of personal/i
describe MEET_SINGLES Meet Singles
body JOIN_MILLIONS /\bjoin (?:millions|thousands)\b/i
describe JOIN_MILLIONS Join Millions of Americans
body BE_BOSS /\byour own boss\b/i
describe BE_BOSS Be your own boss
body ML_MARKETING /\b(?:MLM|multi.level.marketing)\b/i
describe ML_MARKETING Multi Level Marketing mentioned
body ITS_LEGAL /\b(?:perfectly|absolutely|100%|totally) legal\b/i
describe ITS_LEGAL Claims to be Legal
body CONFIDENTIAL_ORDER /confidential.{0,9} order/i
describe CONFIDENTIAL_ORDER Confidentiality on all orders
body SAVE_THOUSANDS /\bsave (?:thousands|millions)\b/i
describe SAVE_THOUSANDS Save big money
body MARKETING_PARTNERS /\b(?:marketing|network) partner|\bpartner (?:web)?site/i
describe MARKETING_PARTNERS Claims you registered with a partner
body FREE_PREVIEW /\bfree preview\b/i
describe FREE_PREVIEW Free Preview
# http://www.hughes-family.org/bugzilla/show_bug.cgi?id=678
body DOMAIN_4U2 /[\@\.]\S{0,20}(?:[^0-9][42](?:yo)?u|for-*you)(?:[.-]\S{1,20})?\.(?:net|com|org|info)\b/
describe DOMAIN_4U2 Domain name containing a "4u" variant
body FREE_ACCESS /(?-i:F)ree access/i
describe FREE_ACCESS Contains 'free access' with capitals
body FREE_SAMPLE /(?-i:F)ree sample/i
describe FREE_SAMPLE Contains 'free sample' with capitals
body LOW_PRICE /\blow.{0,4} (?-i:P)rice/i
describe LOW_PRICE Lowest Price
body UNCLAIMED_MONEY /\bunclaimed (?:funds|money|prizes?|rewards?)\b/i
describe UNCLAIMED_MONEY People just leave money laying around
body OBSCURED_EMAIL /\w+\^\S+\(\w{2,4}\b/
describe OBSCURED_EMAIL Message seems to contain rot13ed address
body OUR_AFFILIATE_PARTNERS /our affiliate partners/i
describe OUR_AFFILIATE_PARTNERS Mentions their affiliate partners
body BANG_EXERCISE /\bexercis(?:e|er|es)!/i
describe BANG_EXERCISE Talks about exercise with an exclamation!
body BANG_MORE /\b(?-i:M)ore!/i
describe BANG_MORE Talks about more with an exclamation!
body BANG_OPRAH /\boprah!/i
describe BANG_OPRAH Talks about Oprah with an exclamation!
body BANG_QUOTE /\b(?-i:Q)uotes?\!/i
describe BANG_QUOTE Talks about quotes with an exclamation!
body ACT_NOW_CAPS /A(?i:ct) N(?i:ow)/
describe ACT_NOW_CAPS Talks about 'acting now' with capitals
body START_NOW_CAPS /S(?i:tart now)/
describe START_NOW_CAPS Talks about 'starting now' with capitals
body MORE_SEX /increased?.{0,9}(?:sex|stamina)/i
describe MORE_SEX Talks about a bigger drive for sex
body BANG_GUAR /\bguaranteed?\!/i
describe BANG_GUAR Something is emphatically guaranteed
# Feb 18 2003 jm: try another combo. I'm not sure __NIGERIAN_HONESTY is req'd.
body __NIGERIAN_CODE_CONDUCT /\bcode of conduct\b/i
body __NIGERIAN_CIV_SERVICE /\bcivil service\b/i
body __NIGERIAN_TOP_SECRET /\btop secret\b/i
body __NIGERIAN_STRICT_CONF /\b(?:strictest confidence|utmost secrecy)\b/i
body __NIGERIAN_HONESTY /\btransparent honesty\b/i
body __NIGERIAN_DISBURSE /\bdisburs/i
meta NIGERIAN_BODY_GOVT_3 ((__NIGERIAN_CODE_CONDUCT + __NIGERIAN_CIV_SERVICE + __NIGERIAN_HONESTY + __NIGERIAN_TOP_SECRET + __NIGERIAN_STRICT_CONF + __NIGERIAN_DISBURSE) >= 3)
describe NIGERIAN_BODY_GOVT_3 Message body has many indications of Nigerian scam
body SEE_FOR_YOURSELF /See (?:for|it|it for) yourself\b/i
describe SEE_FOR_YOURSELF See for yourself