home *** CD-ROM | disk | FTP | other *** search
- #
- # Basic Content Control rule file for Pegasus Mail and Mercury
- # Copyright (c) 2003, David Harris; portions copyright (c) 2002 David Kocmoud.
- # For information on the syntax and format of this file, please consult
- # the "Content control" section of the Pegasus Mail or Mercury/32 Help file.
- #
- # This set of rules is intended to catch a wide range of unwanted mail
- # messages where the content is commercial or sexual in nature. It works
- # quite well (at the time of writing anyway) but you will almost certainly
- # want or need to adjust it over time to deal with the specific types of
- # content you want to filter. This rule set is designed to be used with a
- # definition where the trigger weight is set to 51.
- #
- # Note that many of the rules in this file have negative weights: this is
- # a useful way of "promoting" a message that might otherwise be detected
- # as having unacceptable content.
- #
-
- # Check for an unreasonable number of spaces in the subject
- if Subject matches "* +*" weight 51
-
- # Adjust for filtering of listserv messages
- if Subject matches "Rejected posting to*" weight -9999
-
- # The following group of rules is intended to allow "joke mail", which
- # often has somewhat smutty content, to pass through unhindered. If you
- # are happy to allow "joke mail" at your site, uncomment the set of rules
- # by removing the '#' symbol at the start of each line.
- #
- # if Subject contains "humor" weight -9999
- # if Subject contains "joke" weight -9999
- # if Subject contains "laugh" weight -9999
- # if Subject contains "comedy" weight -9999
- # if Sender contains "humor" weight -9999
- # if Sender contains "joke" weight -9999
- # if Sender contains "laugh" weight -9999
- # if Sender contains "comedy" weight -9999
-
- # Check for subject lines starting with "ADV: "
- if Subject matches "ADV:*" weight 51
-
- # Check for subject lines ending with a date/time stamp. e.g. "3/10/02 8:14:07 PM"
- if Subject matches "*[0-9]+/[0-9]+/[0-9]+ +[0-9]+:[0-9]+:[0-9]+ +[AP]M"
- weight 51 tag "Subject ends with timestamp"
-
- # Check for a "Comments: Authenticated sender..." header with no
- # matching X-Mailer header (a common, although older spam signature).
- if header "comments" contains "authenticated sender"
- andnot exists "X-Mailer" weight 30
-
- # Check for special headers that reek of spam
- if exists "X-PMG-Recipient" weight 51
-
- # Check for messages with no "Date" field - this is illegal under
- # RFC2822 anyway, and is usually a pretty good indicator of spam
- ifnot exists "Date" weight 51
-
- # Check for header content suggesting unwanted "commercial services"
- if Subject matches "*Access*IRA funds taxfree*penalty[- ]free*" weight 51
- if Subject matches "*Access*IRA*no*tax*penalty*" weight 51
- if Subject contains "get out of debt" weight 51
- if Subject contains "debt reduction" weight 51
- if Subject contains "credit card debt" weight 51
- if Subject contains "accept credit cards" weight 51
- if Subject contains "accept credit carts" weight 51
- if Subject contains "no credit card required" weight 40
- if Subject contains "get paid for " weight 51
- if Subject contains "get paid while " weight 51
- if Subject hasall "guaranteed, return, investment" weight 51
- if Subject contains "low interest loan" weight 51
- if Subject contains "lowest mortgage rates" weight 51
- if Subject contains "bad credit" weight 51
- if Subject hasall "online, casino" weight 51
- if Subject contains "multilevel market" weight 30
- if Subject contains "increase your net worth" weight 30
- if Subject contains " pay you " weight 30
- if Subject matches "*paycheck*paycheck*" weight 30
- if Subject contains "take surveys" weight 30
- if Subject contains "fire your boss" weight 51
- if Subject contains " work from home" weight 40
- if Subject hasall " work, home" weight 40
- if Subject hasall " working, home" weight 40
- if Subject matches "*mak* money*home*" weight 51
- if Subject contains "make money on" weight 51
- if Subject contains "make more money" weight 51
- if Subject contains "want more money" weight 51
- if Subject contains "pile of cash" weight 51
- if Subject contains "save $" weight 51
- if Subject contains "save money" weight 51
- if Subject contains "stock pick" weight 40
- if Subject contains "stock play" weight 40
- if Subject contains "stockwatch" weight 40
- if Subject contains "OTCBB:" weight 40
- if Subject contains "watch this stock" weight 40
- if Subject contains "win cash" weight 51
- if Subject contains "win money" weight 51
- if Subject contains "win $" weight 51
- if Subject hasall "venture, capital" weight 51
- if Sender contains "investor insights" weight 51
- if subject matches "*create*paycheck*home*" weight 51
- if subject hasall "online, pharmacy" weight 51
-
- # Check for header content suggesting unwanted sexual "services"
- if Subject contains "adult entertainment" weight 51
- if Subject contains "adult web" weight 51
- if Subject contains "adult site" weight 51
- if Subject contains "adult video" weight 51
- if Subject contains "barely legal" weight 51
- if Subject contains "bondage" weight 40
- if Subject contains "erotica" weight 40
- if Subject contains "fetish" weight 40
- if Subject contains "fisting" weight 40
- if Subject contains "fuck" weight 40 tag "Naughty word"
- if Subject contains "hardcore" weight 10
- if Subject contains "horny" weight 20
- if Subject contains "naughty" weight 10
- if Subject contains "naked" weight 20
- if Subject contains "porn " weight 40
- if Subject contains "pussy" weight 25
- if subject contains "pussies" weight 25
- if Subject contains "nude celeb" weight 51
- if Subject contains "sex" weight 10
- if Subject contains "slut" weight 40
- if Subject contains "sleaze" weight 20
- if Subject contains "viagra" weight 51
- if Subject contains "whore" weight 51
- if Subject matches "*/cXXX*" weight 30
- if Subject contains "Pen1s" weight 51
- if subject has "f12ee" or subject has "fl2ee" weight 51
- if subject has "seks" or subject has "secks" weight 51
- if subject has "toon, toons" weight 30
-
- # Diet/health stuff
- if Subject contains "fat blocker" weight 30
- if Subject contains "Liposuction" weight 30
- if Subject contains "Obesity" weight 30
- if Subject contains "Weight Loss" weight 51
- if Subject contains "enlargement"
- and Subject has "Penis, Penile" weight 51 tag "Penis enlargement ad"
- if Subject hasall "coral, calcium" weight 51
-
- # Bulk e-mail Spam stuff
- if Subject hasall "million, addresses" weight 51
- if Subject matches "*bulk*mail*" weight 51
-
- # Other sales stuff
- if Subject contains "below wholesale price" weight 30
- if Subject contains "buy wholesale" weight 30
- if Subject matches "*cell*phone*" weight 30
- if Subject contains "descrambler" weight 30
- if Subject contains "dream vacation" weight 30
- if Subject matches "*earn*bonus*points*" weight 60
- if Subject contains "free gift" weight 30
- if Subject contains "get more hits" weight 51
- if Subject contains "increase sales" weight 30
- if Subject contains "INCREDIBLE SOFTWARE BARGAIN" weight 30
- if Subject contains "Internet Detective" weight 51
- if Subject contains "Internet Spy" weight 51
- if Subject contains "Life Insurance Quotes" weight 30
- if Subject contains "limited time offer" weight 51
- if Subject contains "mortgage rates" weight 30
- if Subject contains "need Life Insurance" weight 51
- if Subject contains "psychic reading" weight 51
- if Subject contains "site need more traffic" weight 51
- if Subject contains "stop smoking" weight 51
- if Subject matches "*web*promotion service*" weight 51
- if Subject matches "*save* on *" weight 30
- if Subject contains "No Fee!" weight 40
- if Subject contains "Paying Too Much" weight 40
- if Subject contains "Or Your Money Back" weight 40
- if Subject matches "*/cFREE[E!*, ]*" weight 51
- if sender contains "vividnews" weight 51
- if sender contains "vividinsid" weight 51
- if sender contains "Bulkmail" weight 45
-
- # Chinese Spam: note that users in China will almost certainly
- # have to disable these tests - they are intended solely for
- # Westerners who are inundated with rubbish originating from
- # within Mainland China and Taiwan.
- if header "Content-Type" contains "Big5" weight 45
- if header "Content-Type" contains "GB2312" weight 45
-
- # Check for URL using dotted-IP-address
- if body matches "*tp:??[0-9]+.[0-9]+.[0-9]+.*" weight 20
-
- # Match spam that claims not to be spam because it "adheres" to the
- # ridiculous 105C 1618 section 301 legislation.
- if body matches "*1618*section 301*" weight 51
- if body matches "*section 301*1618*" weight 51
-
- # Viral stuff - not intended to replace competent virus scanning,
- # but easy to do for a few of the most common cases
- if subject matches "*Snow*Seven*Dwar*REAL*story*" weight 51
-
- # Body matches - all the rules below this point test the message
- # body. This has more of an impact on the time it takes to process
- # the rule set than header processing does.
-
- # Check for body content suggesting unwanted "commercial services"
- if body contains "credit/Wcard debt" weight 51
- if body hasall "credit/Wcard, bills" weight 40
- if body contains "credit rating" weight 20
- if body contains "fix your credit" weight 40
- if body contains "Accept Credit Car" weight 51
- if body contains "Accept Major Credit Car" weight 51
- if body contains "bad credit" weight 30
- if body contains "damaged credit" weight 30
- if body contains "your credit rating" weight 51
- if body contains "consolidate your debt" weight 51
- if body contains "entrepreneurial" weight 30
- if body contains "earn good money" weight 30
- if body contains "IRA Liberation Process" weight 70
- if body contains "financial freedom" weight 51
- if body contains "financial security" weight 40
- if body contains "stockwatch" weight 40
- if body contains "OTCBB:" weight 40
- if body contains "(Stock Symbol: " weight 40
- if body contains "refinance your home" weight 40
- if body matches "*take control*your*financial future*" weight 40
- if body contains "venture capital" weight 40
- if body contains "investor insights" weight 51
- if body contains "forward looking statements" weight 51
- if body matches "*section 27a*securities act of 1933*" weight 51
- if body matches "*section 21b*securities exchange act of 1934*" weight 51
- if body contains "investment advice" weight 51
- if body contains "future marketing messages" weight 51
- if body contains "get out of debt" weight 51
- if body contains "outstanding debt" weight 40
- if body contains "low interest loan" weight 10
- if body contains "high interest rates" weight 10
- if body matches "*income*from home*" weight 10
- if body matches "*need*additional income*" weight 10
- if body contains "multilevel market" weight 10
- if body contains "online casino" weight 51
- if body contains " lottery " weight 20
- if body contains " lotto " weight 20
- if body contains " jackpot " weight 20
- if body contains "pay you" weight 10
- if body contains "reduce your debt" weight 51
- if body contains "stop throwing your money away" weight 51
- if body contains "fire your boss" weight 51
- if body contains "work from home" weight 40
- if body contains "work at home" weight 20
- if body contains "working from home" weight 40
- if body contains "you have nothing to lose" weight 30
- if body contains "you have nothing to loose" weight 30
- if body hasall "construed, offer, solicitation, security" weight 51
- if body hasall "not, solicitation, recommendation, buy" weight 51
- if body contains "not an offer to buy or sell securities" weight 88
- if body matches "*highly speculative* risk*" weight 88
- if body hasall "Stephan, Ducharme" weight 51
- if body hasall "earning money, eBay" weight 51
- if body hasall "earn, extra, income" weight 51
- if body hasall "limited, time, only" weight 40
- if body contains "independent marketing" weight 25
- if body hasall "need, more, money, apply, grant"
- weight 51 tag "Spurious Federal Grants guide"
- if body contains "to learn more about" weight 30
- if body matches "*must be*years*to*" weight 30
- if body contains "click here" weight 20
- if body matches "/c*GUARANTEED*" weight 20
- if body hasall "offer, lowest, rates" weight 20
- if body hasall "copy, dvd, movie" weight 40
- if body contains "is banned from" or body contains "is banned in" weight 15
- if body hasall "mortgage, dollars, loan" weight 25
- if body contains "private chat room" weight 25
- if body contains "video poker" weight 25
- if body contains "chance to win" weight 15
-
- # Check for body content suggesting unwanted sexual "services"
- if body hasall "adult, entertainment" weight 20
- if body contains "adult web" weight 20
- if body contains "adult site" weight 20
- if body contains "barely legal*teens" weight 51
- if body contains " hardcore " weight 20
- if body contains "prefer girls" weight 40
- if body contains " naked " weight 10
- if body contains " unclothed " weight 10
- if body contains " nude " weight 20
- if body contains " ass " weight 10
- if body contains "improve sex" weight 30
- if body contains "sexual experience" weight 40
- if body contains " erections" weight 10
- if body contains " sexlover" weight 51
- if body contains "sexual preferences" weight 20
- if body contains "* sexx+ *" weight 51
- if body contains " sexshows" weight 51
- if body contains " sex shows" weight 40
- if body contains " sleaze" weight 20
- if body contains "gangbang" or body contains "gang-bang" weight 40
- if body contains "titties" weight 20
- if body has "viagra, viapro" weight 40
- if body contains "adult video" weight 30
- if body hasall "adult, action, female" weight 40
- if body has "anal" weight 20
- if body has "bondage" weight 20
- if body contains " horny" weight 20
- if body contains " fetish" weight 20
- if body has "fuck, fucked, fucking" weight 40 tag "The F word"
- if body has "cunt, cunts" weight 40 tag "The C word"
- if body contains "fisting" weight 40
- if body has "penis" weight 20
- if body has "cock " weight 20
- if body contains " cumm" weight 20
- if body contains " cummshot" weight 51
- if body contains " cumshot" weight 51
- if body has "rape" weight 20
- if body contains "hot puss" weight 25
- if body contains "pussies" weight 25
- if body has "slut" or body has "sluts" weight 40
- if body has "whore" or body has "whores" weight 40
- if body matches "*must be*18*old*" weight 40
- if body contains "no minors allowed" weight 40
- if body matches "*Hardcore?Porno*" weight 51
- if body contains " Porno " weight 40
- if body contains " sex software" weight 111
- if body contains " sexsoftware" weight 51
- if body contains "$$$$$$$$$$$$$" weight 51
- if body hasall "probably don't remember me, website" weight 51
- if body hasall "teen, cock, suck" weight 51
- if body hasall "free, day, trial" weight 30
- if body hasall "young, teen, video" weight 30
- if body hasall "young, teenage, video" weight 30
- if body hasall "porn, chick, pictures" weight 51
- if body has "toon, toons" weight 30
- if body hasall "XXX, free" weight 40
- if body contains "adult movie" weight 40
-
- # Check for deliberate misspellings of common "trigger" words - the
- # misspelling is a dead giveaway that the message is spam.
- if body contains "p0rn" or subject contains "p0rn" weight 51
- if body has "p@rn" or subject has "p@rn" weight 51
- if body contains "pen1s" or subject contains "pen1s" weight 51
- if body contains "penφs" or subject contains "penφs" weight 51
- if body contains "tenage" or subject contains "tenage" weight 30
-
- # Check for body content suggesting spurious diet/health stuff
- if body contains "Liposuction" weight 20
- if body contains " Obesity" weight 10
- if body contains "stop smoking" weight 20
- if body has "Weight/WLoss" weight 30
- if body contains "lose weight" weight 30
- if body contains "loose weight" weight 30
- if body contains "burning fat" weight 30
- if body contains "no hunger pains" weight 30
- if body contains "lose weight while you sleep" weight 30
- if body hasall "penis, enlargement" weight 51 tag "Penis enlargement ad"
- if body contains "penis size" weight 40
- if body hasall "penis size, larger penis" weight 51
- if body hasall "penis, gain, inches" weight 51
- if body contains "health insurance" weight 25
- if body contains "medical premium" weight 25
- if body hasall "increase, size, penis" weight 51 tag "Penis enlargement ad"
- if body has "penile, ejaculation, sildenafil" weight 30
- if body hasall "prescription, online" weight 30
- if body contains "no doctor visit" or body contains "no doctor's visit" weight 30
- if body matches "/c*HGH*" weight 40
- if body hasall "sexual, enhancer" weight 40
- if body hasall "dietary, supplement" weight 15
- if body contains "online" and body has "prescription, pharmacies, pharmacy" weight 40
- if subject matches "/c*HGH*"
- and body hasall "human, growth, hormone" weight 51
- if body hasall "human, growth, hormone" weight 40
- if body hasall "coral, calcium" weight 51
- if body has "H?G?H" weight 51
- if body contains "H G H" weight 51
- if body contains "fat loss" weight 25
- if body contains "wrinkle reduction" weight 25
- if body contains "reverses aging" weight 25
-
- # Check the body for evidence of scams - in particular the ludicrous
- # "Nigerian funds transfer" (or "419") scam.
- if body hasall "Nigeria, million, dollars, transfer"
- weight 51 tag "Nigerian 419 Scam"
- if body hasall "Liberia, million, dollars, transfer"
- weight 51 tag "Liberian 419 Scam"
- if body hasall "Angola, million, dollars, transfer"
- weight 51 tag "Angolan 419 Scam"
- if body hasall "Africa, million, dollars, transfer"
- weight 51 tag "Generic 419 Scam"
- if body hasall "Sese, Seko, million"
- weight 51 tag "Sese Seko 419 Scam"
- if body hasall "Sese-Seko, million"
- weight 51 tag "Sese Seko 419 Scam"
- if body hasall "Abacha, million, transfer"
- weight 51 tag "Maryam Abacha 419 Scam"
- if body hasall "Sierra Leone, Coleman, million"
- weight 51 tag "Sierra Leone 419 Scam"
- if body matches "*surprise*receive*know*personally*"
- and body hasall "million, transfer"
- weight 51 tag "Generic 419 Scam"
-
- if body contains "Nigeria" weight 30
- if body contains "Federal Government of Nigeria" weight 51
- if body hasall "Nigeria, Petroleum, Corporation" weight 51
- if body hasall "Nigeria, Chamber of Commerce" weight 51
- if body contains "Bank of Nigeria" weight 40
- if body contains "Bank in Africa" weight 40
- if body contains "transfer to overseas" weight 40
- if body contains "time machine" and body contains "vortex generator" weight 51
- if body hasall "fear, multimillion, dollar, class action, suit" weight 51
- if body contains "Intel and AOL are now discussing a merger" weight 51
- if body contains "Microsoft will pay you" weight 51
- if body matches "*(*Million United States Dollars)*" weight 51
- if body hasall "South Africa, Foreign, Exchange" weight 51
-
- # Check the body for suggestions that the message might be peddling
- # spam creation or distribution tools.
- if body contains "bulk e-mail" weight 30
- if body contains "bulk email" weight 30
- if body contains " bulkmail" weight 30
- if body contains "mass mailing service" weight 51
- if body hasall "mass, mailing, service" weight 30
- if body contains "mass marketing" weight 30
- if body contains "mass messages" weight 30
- if body matches "*million*addresses*" weight 30
- if body contains "bulker" weight 51
- if body hasall "Email, marketing, inexpensive, promote, targeted" weight 40
-
- # Look in the body for a few addresses intimately associated with
- # spam or other unwanted marketing activities.
- if body contains "www.try-it-free.net" weight 51
- if body contains "www.lendlink.net" weight 51
- if body contains "www.safelockrecords.com" weight 51
- if body contains "www.overnightrx.com" weight 51
- if body contains "usavemore.k666.com" weight 51
- if body contains "chicago20s.com" weight 51
- if body contains "hudsonleickfan.com" weight 51
- if body contains "good-insurance-rates.com" weight 51
- if body contains "0mbra.com" weight 51
- if body contains "www.geheime-seite.da.ru" weight 90
- if body contains "dirtcheapdomain.com" weight 51
- if body contains "kiss.com" weight 51
- if body contains "edirectnetwork.net" weight 51
- if body contains "37510hits4u.com" weight 51
- if body contains "emailhello.com" weight 51
- if body contains "bestcheapstuff.com" weight 51
- if body contains "classmates.com" weight 51
- if body contains "elucky-casino.com" weight 51
- if body contains "israeliconnections.com" weight 51
- if body contains "asiawholesalers.com" weight 51
- if body contains "naturaldepot.com" weight 51
- if body contains "swapselltrade.com" weight 51
-
- # Other Sales stuff
- if body contains "money-back guarantee" weight 40
- if body contains "money back guarantee" weight 40
- if body contains "no credit check" weight 51
- if body matches "*make more money*web*" weight 40
- if body matches "*f +r +e +e*" weight 51
- if body contains "absolutely free" weight 20
- if body contains "descrambler" weight 30
- if body contains "free DVD trial" weight 51
- if body contains "eValueMarketing" weight 66
- if body contains "get more hits" weight 20
- if body contains "limited time offer" weight 30
- if body contains "increase sales" weight 10
- if body contains "INCREDIBLE SOFTWARE BARGAIN" weight 20
- if body contains "Internet Detective" weight 51
- if body contains "Internet marketing" weight 51
- if body contains "Internet Spy" weight 51
- if body contains "No Credit Check" weight 30
- if body contains "no obligation" weight 30
- if body contains "no obligation quote" weight 30
- if body contains "free quote" weight 30
- if body contains "pay-per-view" weight 30
- if body contains "new home loan" weight 30
- if body matches "*refinance*home loan*" weight 30
- if body contains "save up to" weight 10
- if body contains "site need more traffic" weight 51
- if body contains "term life insurance" weight 40
- if body contains "free online quote" weight 40
- if body contains "buy term life insurance" weight 40
- if body matches "*web*promotion service*" weight 51
- if body contains "satisfaction guarantee" weight 10
- if body contains "your money back" weight 10
- if body hasall "click/Where, protect your computer" weight 40
- if body matches "*receive*mail*only*once*" weight 40
- if body contains "paying too much" or body contains "pay too much" weight 30
- if body contains "100% Free" weight 40
- if body contains "1oo% Free" weight 51
- if body hasall "casino, sportsbook" weight 51
- if body contains "100% legal" weight 51
- if body has "lender, lenders" and body hasall "compete, loan" weight 30
- if body hasall "mortgage, lender, compete, business" weight 51
- if body hasall "discovered, website, mortgage" weight 51
- if body matches "*/cJOIN/WFOR/WFREE*" weight 51
- if body contains "diploma"
- and body has "non-accredited, university" weight 51
- if body contains "make money on the web" weight 40
- if body contains "make money on" weight 20
- if body contains "want to make money" weight 20
- if body has "/cFREE" weight 20
-
- # Check for certain key words and phrases commonly found in promotional spam
- if body matches "*you*been chosen to receive*" weight 51
- if body matches "*you*receiv*offer*because*" weight 40
- if body matches "*you*receiv*this*mail*because*" weight 40
- if body matches "*mail*sent*you*because*" weight 40
- if body contains "the previous was an advertisement" weight 51
- if body matches "*not wish to receive*e-mail*promotion*" weight 51
- if body matches "*you*not wish*receiv*further*" weight 40
- if body contains "this is not a solicitation" weight 30
- if body contains "to be removed from" weight 41
- if body contains "to remove yourself from" weight 41
- if body has "opt-in" weight 21
- if body has "opt-out" weight 21
- if body contains "opt out" weight 21
- if body contains "optout" weight 21
- if body has "opted/Win" weight 40
- if body has "opted/Win" and body contains "affiliate" weight 51
- if body matches "*This*may*recurring mailing*" weight 51
- if body matches "*is a one*time*mail*" weight 51
- if body contains "No request for removal is necessary" weight 51
- if body hasall "cannot be considered spam, removal" weight 51
- if body matches "*1618*Title III*105th US Congress*" weight 51
- if body matches "*This*not*spam*sent*you*because*" weight 51
- if body matches "*This*not*spam*received*because*" weight 51
- if body matches "*was sent*because*not*wish*receive*" weight 40
- if body hasall "opportunity, change, life, forever, earn, free" weight 30
- if body hasall "click here, unsubscribe" weight 30
- if body matches "*no longer*receive*offer*mail*" weight 40
- if body has "partner/Wsite" or body has "partner/Wsites" weight 30
- if body matches "*your*privacy*important to us*" weight 40
- if body matches "*This is not*!*is a friendly*" weight 40
- if body has "click/Where/Wto/Wenter" weight 40
- if body contains "enter here" weight 30
-
- # Viral stuff - not intended to replace competent virus scanning,
- # but easy to do for a few of the most common cases
- if body matches "*You*I send this to you*advice*" weight 51
- if body matches "*This*mail*never sent unsolicited*" weight 51
- if body matches "*attached*product*part*official*campaign*popularity*" weight 51
-
-