#LAST UPDATED 12/02/2014 #SKIPIFWEIGHT 25 MINWEIGHTTOFAIL 6 #--------------------------------------------------------------------# # EXCEPTIONS # #--------------------------------------------------------------------# TESTSFAILED END PCRE (IADB|BONDEDSENDER) TESTSFAILED END PCRE (BASE64|CB-ATTACH) #--------------------------------------------------------------------# # BUMP # #--------------------------------------------------------------------# TESTSFAILED 3 PCRE (FILTER-MEDICAL|SNIFFER-SNAKEOIL) REVDNS 3 PCRE (?i:\.(hotmail|AOL|yahoo)\.com$) #--------------------------------------------------------------------# # MAILFFROM # #--------------------------------------------------------------------# MAILFROM 5 PCRE (?i:viagra|cialis|levitra) #--------------------------------------------------------------------# # DRUG CONTENT INDICATORS # #--------------------------------------------------------------------# BODY 1 PCRE (?i:Cialis) BODY 1 PCRE (?i:Codine) BODY 1 PCRE (?i:Ephedra) BODY 1 PCRE (?i:Levitra) BODY 1 PCRE (?i:Valium) BODY 1 PCRE (?i:Viagra) BODY 1 PCRE (?i:Vicodin) BODY 1 PCRE (?i:Xanax) BODY 1 PCRE (?i:Phentermine) BODY 1 PCRE (?i:Supplement) SUBJECT 3 PCRE (?i:Cialis) SUBJECT 3 PCRE (?i:Cod[io]ne) SUBJECT 3 PCRE (?i:Ephedra) SUBJECT 3 PCRE (?i:Levitra) SUBJECT 3 PCRE (?i:Valium) SUBJECT 6 PCRE (?i:Viagra) SUBJECT 3 PCRE (?i:Vicodin) SUBJECT 3 PCRE (?i:Phentermine) SUBJECT 3 PCRE (?i:pharmacy) SUBJECT 3 PCRE (?i:Supplement) ANYWHERE 4 PCRE (?i:(?!Cialis)\bC[iali]{4}s) ANYWHERE 4 PCRE (?i:(?!Ephedra)\bE[phedr]{5}a) ANYWHERE 4 PCRE (?i:(?!Levitra)\bL[evitr]{5}a) ANYWHERE 4 PCRE (?i:(?!Valium)\bV[aliu]{4}m) ANYWHERE 4 PCRE (?i:(?!Viagra)\bV[iagr]{4}a) ANYWHERE 4 PCRE (?i:(?!Vicodin)\bV[icodi]{5}n) ANYWHERE 4 PCRE (?i:(?!Phentermine)\bP[hentermin]{9}e) ANYWHERE 4 PCRE (?i:(?!Supplement)\bS[upplemen]{8}t) ANYWHERE 20 PCRE (?i:WonderCum) ANYWHERE 20 PCRE (?i:Colonex) ANYWHERE 20 PCRE (?i:Venacura) ANYWHERE 20 PCRE (?i:FungiDerm) BODY 10 PCRE (?i:\b0rder\b) BODY 5 PCRE (?i:(Instant|discreet|confidential).(shipping|purchase)) BODY 2 PCRE (?i:RISK.?FREE) BODY 1 PCRE (?i:generic) BODY 10 PCRE (?i:(Authentic|genuine|generic)(\s{1,2})Viagra) BODY 12 PCRE (?i:((viagra|cialis\b).{0,}){5}) BODY 3 PCRE (?i:trial bottle) #--------------------------------------------------------------------# # AMBIEN # #--------------------------------------------------------------------# ANYWHERE 3 PCRE (?i:\bam{0,2}b[|i1í!]{0,2}.e{0,2}.n\b) ANYWHERE 1 PCRE (?i:\b|\s)[_\W]{0,3}[a4\xE0-\xE6@][_\W]{0,3}m[_\W]{0,3}b[_\W]{0,3}[i1!|l\xEC-\xEF][_\W]{0,3}[e3\xE8-\xEB][_\W]{0,3}n[_\W]{0,3}(?:\b|\s) #--------------------------------------------------------------------# # CIALIS # #--------------------------------------------------------------------# ANYWHERE 3 PCRE (?i:(?!(classified|cleanlines|clear lines|capitalist|claim is))\b[c\[].{0,2}[|li1í!].{0,2}[a@].{0,2}[|li1í!].{0,2}[|i1í!].{0,2}s\b) BODY 10 PCRE (?i:(?!cialis)(c{1,}i{1,}a{1,}l{1,}i{1,}s{1,})) #--------------------------------------------------------------------# # HGH # #--------------------------------------------------------------------# ANYWHERE 5 PCRE (?i:\b(?:human growth hormone|(?-i:HGH)|H.G.H)\b) #--------------------------------------------------------------------# # HOODIA # #--------------------------------------------------------------------# ANYWHERE 10 PCRE (?i:Hoodia\b) #--------------------------------------------------------------------# # LEVITRA # #--------------------------------------------------------------------# ANYWHERE 5 PCRE (?i:(?!levitra)\bl.{0,2}e.{0,2}v.{0,2}[|li1í!].{0,2}t.{0,2}r.{0,2}[a@]\b) #--------------------------------------------------------------------# # LIPITOR # #--------------------------------------------------------------------# ANYWHERE 2 PCRE (?i:(?!lipitor)\bl.{0,2}[|li1í!].{0,2}p.{0,2}[|li1í!].{0,2}t.[o0\xF2-\xF6].{0,2}r\b) #--------------------------------------------------------------------# # PHENTERMINE # #--------------------------------------------------------------------# ANYWHERE 5 PCRE (?i:(?!phentermine)\bp.{0,2}h.{0,2}[e3].{0,2}n.{0,2}t.{0,2}[e3].{0,2}r.{0,2}m.{0,2}[|li1í!].{0,2}n.{0,2}e.{0,2}\b) #--------------------------------------------------------------------# # VALIUM # #--------------------------------------------------------------------# ANYWHERE 2 PCRE (?i:(?!valium)\bv.{0,2}[a@].{0,2}l.{0,2}.[\|lh1í\!]{0,2}.u{0,2}m\b) #--------------------------------------------------------------------# # VIAGRA # #--------------------------------------------------------------------# ANYWHERE 5 PCRE (?i:(?!viagra)\bv.{0,2}[|li1í!].{0,2}[a@/\\].{0,2}[gq].{0,2}r.{0,2}[a@/\\]) BODY 10 PCRE (?i:(?!viagra)(v{1,}i{1,}a{1,}g{1,}r{1,}a{1,})) #--------------------------------------------------------------------# # VICODIN # #--------------------------------------------------------------------# ANYWHERE 2 PCRE (?i:(?!vicodin)\bv.{0,2}[\|lh1í\!].{0,2}c.{0,2}o.{0,2}d.{0,2}[\|lh1í\!].{0,2}n\b) #--------------------------------------------------------------------# # XANAX # #--------------------------------------------------------------------# ANYWHERE 5 PCRE (?i:(?!xanax)\bx.{0,2}[a@].{0,2}n.{0,2}[a@].{0,2}x) #--------------------------------------------------------------------# # SELLING MEDS # #--------------------------------------------------------------------# BODY 20 PCRE (?im:v.{0,2}[|li1í!].{0,2}[a@].{0,2}g.{0,2}r.{0,2}[a@]+.{0,30}?(\$\d{1,4}(\.|,)\d{1,4})) BODY 2 PCRE (?im:v.{0,2}[|li1í!].{0,2}[a@].{0,2}g.{0,2}r.{0,2}[a@]+.{0,30}?((\$\d{1,4}(\.|,)\d{1,4})|\bmg\b)) BODY 20 PCRE (?im:l.{0,2}e.{0,2}v.{0,2}[|li1í!].{0,2}t.{0,2}r.{0,2}[a@]+.{0,30}?(\$\d{1,4}(\.|,)\d{1,4})) #--------------------------------------------------------------------# # MEDS # #--------------------------------------------------------------------# ANYWHERE 3 PCRE (?i:(?!more days)\bm.{0,2}[e3].{0,2}d(.{0,2}(s|z))\b) BODY 5 PCRE (?i:(?!meds)\b(m(\W?|_)e(\W?|_)d(\W?|_)s\b)) ANYWHERE 3 PCRE (?i:Soft.?Tabs) #--------------------------------------------------------------------# # PILLS # #--------------------------------------------------------------------# BODY 5 PCRE (?i:(?!pills)\b(p(\W?|_)i(\W?|_)[l1\|](\W?|_)[l1\|](\W?|_)[sz]\b)) BODY 5 PCRE (?i:\$\d\d.{0,8}mg\s.{0,8}pill) #--------------------------------------------------------------------# # URL # #--------------------------------------------------------------------# BODY 30 PCRE (?i:showweek.hk) BODY 5 PCRE ((?<=http://|www).{0,30}(?i:Ephedra|viagra|levitra|cialis)) #--------------------------------------------------------------------# # OBSFUCATION # #--------------------------------------------------------------------# BODY 10 PCRE (\s{4}[a-z]{4}\s{4,5}[a-z]{4}\s{4})