header_checks

# uuencoded and mime attachments 
/(^begin [0-9]{1,4} |name\s*=\s*"?).*\.(lnk|bat|c[ho]m|cmd|com|exe|dll|vxd|pif|scr|hta|jse?|sh[mbs]|vb[esx]|ws[fh]|pcf|LNK|BAT|C[HO]M|CMD|COM|EXE|DLL|VXD|PIF|SCR|HTA|JSE?|SH[MBS]|VB[ESX]|WS[FH]|PCF)"?\s*$/	REJECT HEADER: executable attachment blocked

# bad From info
/^From.*admin@nieusma.com/	REJECT HEADER: possible virus blocked

# known bad ZIP files
/\b(your_details|data|document|jefftest)\.zip/i		REJECT HEADER: possible virus blocked

body_checks

# don't bother checking each line of attachments 
'^[0-9A-Za-z.+/=]{60,}\s*$'		OK



# Content-Type: APPLICATION/octet-stream; name="jefftest.zip"
# reject all windows executable attachments
/^(Content-Disposition: attachment;.*|Content-Type:.*|\s+)(file)?name="?.*\.(lnk|hta|com|pif|vbs|vbe|js|jse|exe|bat|cmd|vxd|scr|shm|dll|reg|LNK|HTA|COM|PIF|VBS|VBE|JS|JSE|EXE|BAT|CMD|VXD|SCR|SHM|DLL|REG)"?\s*$/	REJECT BODY Your e-mail was blocked because it contains a windows executable file


# known bad ZIP files
/^(Content-Disposition: attachment;.*|Content-Type:.*|\s+)(file)?name="?(your_details|data|document|jefftest)\.zip"?\s*$/		REJECT HEADER: possible virus blocked


# all numeric URLs, with or without a login/password (does not block
# dotted-quad IP addresses)
# e.g. http://37373737382921/   or  http://user%pass@3783838932109/
# or URLs with UNICODE
'http://([0-9%@]+|[^/]*@[0-9]+)[\s/]|http://([0-9%@]+|[^/]*@[0-9]+)|http://[^/\s]*%[0-9a-f]+'	REJECT BODY blocked due to questionable URL


# URLs commonly mentioned in spam
'http://www[0-9]*\.(cshharvester|desirecasino|quasistupid|unsubscribelist|betonusa|pyramidcasino|investment4u|myfreelawfirm|new-opps4u|genacom|detectitnow|beaverpalace|namesforeveryone|kellyslittlesecret|img-marketing|bonairesoft|software4udepo|affordable-domains|ashampoo|mortgageforu2)\.com|http://(www\.)?(removeyou\.com|clickcash\.webpower\.com|quasistupid\.org)|www\.(chinaniconline\.com/mortgage|requestedinfo\.net|traffic101\.info)|web[0-9]?\.customoffers\.com/click\.asp\?lnk|66\.231\.133\.63|software4udepo\.com|\S*@?www\.onestarnow\.com|81\.9\.8|blacksnowcloud\.com'	REJECT BODY: Blocked e-mail due to common SPAM URL


# common porn spam phrases
/gang ?bang|s\s*e\s*x\s*drive|big tit lovers|\bcum.?(shoo?ts?|slurp)|\bcum all over|ass.?fucking|(tight|wet|shaved|young|teen)\s+puss|tight.*pussy|fuck.?fest|pussy.?juice|compulsive masturbators agree|explicit hardcore|hardcore (porn|pron|pr0n|p o r n)|nasty.*sluts|you received this mail because our records show that you have asked to receive|(teens?|anal)\s*(fuck|xxx)|delete this mail( now)? if (you|u) do not want porn|dear adult webmaster|hardcore\s+bondage|bizarre\s+fetish|must be at least 18|great sex in a bottle|(hot|wet|nasty|lesbian|crazy).*(sex|orgy)|\bcocks?\b|horny teen|incredible adult site|love dolls|great adult video|http:\/\/www.xxx-host.net|sex with animals|mature audience only|barnyard fun|s e x u a l l y|nature[']*s secret weapon/	REJECT BODY porn


/888-248-4571|HUMAN GROWTH HORMONE/i		REJECT BODY spam
/1-888-288-9043|1-888-977-1577|1-888-248-4930|human growth hormone (precursor|therapy)|nature's secret weapon|pheromones!|androstenone pheromones|great news for usa homeowners|get a copy of your FBI file/	REJECT BODY spam


# money scams
/(evaluating multi-level sales plans|sources for the best mailing lists|major corporations and multi-level sales|how to make \$250,000 through multi-level sales|the insider's guide to (advertising for free|sending bulk e-mail) on the (net|internet)|secrets? to multi.?level marketing on the (net|internet)|how to become a millionaire utilizing|how to send out 0ne million e-mails for free|order all \d+ reports shown on the list below|^order report \#[\s\d]+ from:$)|take control of your finance|now is the time to refinance|is on track to beat ALL earnings estimates|debt collection service|easy 30-50\% return|Lenders Compete for Your Lowest Rate|Tap into the high-income opportunity|discover the highly coveted secret|FULLPROMOTE/	REJECT BODY scam spam


# mortgage email combat
/help you get the mortgage loan you want|refinance your home|refinance your current home|mortgage rates|30 Yr Fixed Rate Mortgage|your\s*("free"|free)\s*quote|free online quote|Protect your financial (well-being|well being|future)|secure financial future can be yours|become a part of this.*industry|fill out our simple form|hundreds of loan programs|follow me to financial freedom|home-based income opportunity|attention homeowner|LoanSafe4AllNow1/	REJECT BODY mortgage spam