0 c:\regexflt\accepted\{yyyy}-{mm}\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt http://localhost/2150/regexflt_test.asp 1 c:\regexflt\rejected\{yyyy}-{mm}\{smtp:mail_from_domain}\{smtp:mail_from_mailbox}\spamtrap\{source:filename}{smtp:recipient_id}.txt http://localhost/2150/regexflt_test.asp 0 c:\regexflt\accepted\{yyyy}-{mm}\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt c:\regexflt\accepted\{yyyy}-{mm}\log.txt 1 554 5.7.1 Blacklisted by www.surbl.org c:\regexflt\rejected\{yyyy}-{mm}\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\surbl\{source:filename}{smtp:recipient_id}.txt c:\regexflt\rejected\{yyyy}-{mm}\log.txt unlimited unlimited yes

all

all multi.surbl.org 0 c:\regexflt\accepted\{yyyy}-{mm}\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt c:\regexflt\accepted\{yyyy}-{mm}\log.txt 1 554 5.7.1 Blacklisted by sbl-xbl.spamhaus.org c:\regexflt\rejected\{yyyy}-{mm}\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\spamhaus\{source:filename}{smtp:recipient_id}.txt c:\regexflt\rejected\{yyyy}-{mm}\log.txt unlimited unlimited yes

all

all sbl-xbl.spamhaus.org 0 c:\regexflt\accepted\{yyyy}-{mm}\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt c:\regexflt\accepted\{yyyy}-{mm}\log.txt c:\Program Files\Merak\mail\2150.com\rejectedmail\RegEx Accepted\{source:filename}{smtp:recipient_id}.imap http://localhost/2150/regexflt_test.asp 1 554 5.7.1 Content filter rejection c:\regexflt\rejected\{yyyy}-{mm}\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt c:\regexflt\rejected\{yyyy}-{mm}\log.txt 1 554 5.7.1 Auto-executing JavaScript not permitted in email c:\regexflt\rejected\{yyyy}-{mm}\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\AutoJavaScript\{source:filename}{smtp:recipient_id}.txt c:\regexflt\rejected\{yyyy}-{mm}\log.txt 1 554 5.7.1 Bare LF characters found in message (RFC 2822 violation) c:\regexflt\rejected\{yyyy}-{mm}\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\LF\{source:filename}{smtp:recipient_id}.txt c:\regexflt\rejected\{yyyy}-{mm}\log.txt 1 554 5.7.1 E-Mail body is empty c:\regexflt\rejected\{yyyy}-{mm}\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\Empty\{source:filename}{smtp:recipient_id}.txt c:\regexflt\rejected\{yyyy}-{mm}\log.txt 1 554 5.7.1 Attachment type is not permitted c:\regexflt\rejected\{yyyy}-{mm}\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\Attachment\{source:filename}{smtp:recipient_id}.txt c:\regexflt\rejected\{yyyy}-{mm}\log.txt 0 c:\regexflt\modified\{yyyy}-{mm}\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt c:\regexflt\modified\{yyyy}-{mm}\log.txt c:\Program Files\Merak\mail\2150.com\rejectedmail\RegEx Modified\{source:filename}{smtp:recipient_id}.imap http://localhost/2150/regexflt_test.asp

1000 80000 yes Look for any all-numeric URLs (specifically not dotted format but entirely numeric).

all

all http://[[:digit:]]{4,}[^.] http://[[:graph:]]*@[[:digit:]]{4,}[^.] Look for a short 1-8 character tag at the end of the subject line, separated by 10 or more spaces or periods.

all

^subject:[[:blank:]]+.+[[:blank:] ._]{10,}[[:graph:]]{1,8}$ ^subject:[[:blank:]]+.+[[:blank:] ._]{18,}[[:graph:]]+ ^subject:[[:blank:]]+.+[ ]{3,}[[:graph:]]+ Look for a 4-digit or longer tag at the end of the subject line, separated by at least two spaces.

all

^subject:[[:blank:]]+.+[[:blank:]]{2,}[[:digit:]]{4,}[[:blank:]]*$ Specific subjects that are cause alone for rejection.

all

^subject:[[:blank:]]+.+the[[:blank:]]+truth[[:blank:]]+about.+!$ ^subject: +moderator +notification: +new +(post\|topic) +in Same character-only email-addresses.

all

^from:[[:print:]]+(.)\1{4,}@ ^from:[[:print:]]+@(.)\1{6,}.[a-zA-Z]{2,3} Mail-addresses consisting only of 1 or 2 letters and 5 or more numbers often are fake email addresses.

nomessageid,noreceived,noinreplyto

[<\| \|'\|"]+[a-z]{1,2}[[:digit:]]{5,}\@ Look for any of the patterns.

all

^from:[[:blank:]]+.*@listmanpro\.com ^from:[[:blank:]]+.*uswives\.com ^from:[[:blank:]]+.*haretoday\.com ^from:[[:blank:]]+.*colonize\.com

all

insaneearl fartbutt expnmail\.go\.com Typical spam words and phrases.

all

all \${13,} 100.{0,20} +guarantee 7 +days +a +week absolutely +free absolutely +no +laws +prohibiting accept.{1,30}(credit\|payment) achieve.{0,20}goals act +now addleanmuscle adult +special adult +site affiliate.{1,15}program affordable.{1,15}insurance all +for +only all.{0,2}natural amateur.{0,20}site an +affiliate +relationship anal\b angelfire\.com any +further +mailings anyone.{1,15}apply application.{1,20}for apply +now approval +process are +invited aruba asadvertisedontelevision as +little +as as +seen +on +tv \bass\b attentionwebmaster attract.{1,25}sex autoemailremoval automatically.{1,15}removed babes background +checks bad +credit bankruptcy be +(a +millionaire\|your +own +boss) beautiful.{1,20}women because +you +(have +agreed\|signed +up\|or +someone) behind.{0,20}payment below +is +the +result +of +your +feedback +form best +deal best +opportunit better +sex between +the +ages +of \.biz[^.] biz +domain bizop body +fat +loss boost +sales boost +your +income boostsgasmileage boostyourimmunesystem breast.{0,20}enhancement browse +through bulk.{1,10}mail business +opportunity cable +descramble cable +filter call.{1,15}(24.{0,5}hours\|now\|toll.{0,2}free\|today) call.{1,20}free can +only +have +one +winner cash.{0,5}gram casino change.{1,10}life change +your +financial +future charles.{0,5}carboneau cheapest +price +on +the +net check +or +money +order check.{0,5}to.{0,5}check chooseyourmedication cialagen cialis classified +information clickhere clicklink clinically cloak +your +info coc(k\|ks)\b collection.{1,15}agenc comes +with +keychain competitive +rate complete +turnkey completely +affordable compliance.{1,40}1618 confidential +report confidentiality.{0,10}(assured\|guarantee) confirm +your +entry congratulationstoallmembers consolidatedebt contactus copy +any +dvd +movie coral +calcium credit.{0,8}card +bills credit.{0,8}challenged credit.{0,8}deserve credit.{0,8}limit credit.{0,8}need credit.{0,8}profile creditor cumshot cybersex dailyherbalsupplement day +money +back +guarantee day +trial debt.{1,10}analysis debt.{1,10}collection debt.{1,10}consolidat debt.{1,10}relief dietpatch dietpill dildo distributor.{0,20}join diplomas discount +medication discreet +packaging do +you +accept +credit +cards dont +miss +the +opportunit double.{0,20}invest drown.{1,20}debt due +to +the +popularity +of +this each +of +the +5 +reports earn.{1,20}\$ earn.{1,20}chance earn.{1,20}dollar earn.{1,20}money +with +us earn +more +with earn.{1,20}over eat.{1,20}free earning.{0,20}week eliminate.{1,20}debt eliminatestress email +advertisement email +your +ad empower +yourself endlessopportunities endorsed +by +doctors enhancingoil enjoy.{1,20}benefits enjoy.{1,20}twice +the +action enlargement +formula erection even +oprah every +order +includes everyone +can +be +a +winner excit.{0,20}plan exclude +yourself +here excluded +from +our +advertis extra +(cash\|money) extractor +pro fax.{1,15}order fdaapproved feelandlookyounger filed +bankruptcy fill.{1,20}form financial +expert financial +freedom financial +independence findalocalchurch find +out +anything +about +any find +out +more flat.{1,3}fee fly.{1,20}free follow +me +to follow +me +to for +your +free +download forweightloss free.{1,15}apply free +(cash\|exposure) free.{1,15}consult free +evaluation free.{1,15}grant free.{1,15}offer free +password free +prescription free.{1,15}quot fuck full +training fuelsaverpro futuremailingoptions future.{1,20}millionaire gang +bang generat.{1,15}lead genericprozac get +any +more +sales get +hard get +hard +in +under get +laid get +more +info get +off +the +list get +our get +out.{0,15}debt get +rid +of +pain get +removed get +up +to +.{0,4}(%\|percent) gets +you +hard giv.{0,8} +away +money /go/[[:digit:]]{8,}/ gold +mine good +credit got +debt got +(you\|your) +attention government +grants great +opportunit ground.{1,4}floor groundbreaking +medicine growthhormone guarant.{0,20}cash guarant.{0,20}check guarant.{0,20}credit guarant.{0,20}income hair +loss hard.{0,4}core harness.{1,30}power have +been +specially +selected have +debt hav(e\|ing) +people +watc(h\|hing) +me healthierbones herbal herbal +patch herbal +supple HGH\b H.G.H high +demand high +quality +mini home.{0,7}business home.{0,7}typist host +my +webcam hot +(leads\|prospect) http://.{1,50}affiliate http://.{0,50}debt http://.{0,50}merchant http://.{1,25}order http://.{1,10}yahoo\.com.{1,10}remove http://.{1,25}remove http://[[:digit:]]{2,} humangrowthhormone humangrowthhormone if +you +wait +any +longer if +you +would +like +to +make +at +least imagine.{0,14}possibilit immediate.{1,20}access immediate.{1,20}remov improve.{0,10}cash in +compliance +with in +just.{0,20}days in +your.{1,20}pocket in +your +spare +time income.{1,20}machine income.{1,20}potential income +replacement incredibl.{1,10}rates increase.{1,20}income increase.{1,20}income increase.{1,10}libido increase.{1,20}revenue increase.{1,20}site increase.{1,20}stamina increaseyourconfidence increaseyourpleasure increase.{1,20}web incredible +weight +loss information +please instant.{0,30}approval instant.{0,30}quote instant.{0,30}win intense.{1,10}orgasm international +order internet +gold.{0,5}rush internet +millionaire internet +spy introductory +apr introductory +offer investor +alert is +not +spam it +could +be +you its +completely +free its +so +easy join.{0,15}free join.{0,15}here join.{0,15}program join.{0,15}team join +the +(million\|thousand) just +like +you keep.{0,15}money ladies +are +real larger +returns largermanhood lead.{1,15}generat learn.{0,20}more learn.{0,20}strateg learn +the +secret legitimate +business lenders +fight +for +your levitra life +insurance like +to +flirt limited +time limited +web +offer little +known +secret liv.{1,20}fixed income liv.{1,5}xxx live +longer +with lolitas lose.{0,20}inch lose.{0,20}pound lose.{0,20}weight low.{1,30}\brates low +start.up +cost lower +payment make.{1,5}money makeextramoney makemebig makethewoman male +performance +enhanc market.{0,20}(net\|tactics) marketing +partners may +not +be +suitable medical +breakthr meet.{0,20}single meet.{0,20}very +beautiful merchant +account merchant +status million.{0,15}e.{0,1}mail money.{0,15}making money.{0,15}need money.{0,15}pocket monthly +income monthlypmts mortgage +loan mortgage +quote mtg +rates mtg +rates +dropped much.{1,5}much +more must +be.{0,20}age my +manhood naked need.{0,25}leads needmoreenergy network.{1,10}market never +receive +another never.{1,18}repay next +hot +pick n[o0] +annual +fee n[o0] +consultation +fee n[o0] +cost.{1,15}you n[o0] +craving n[o0] +credit n[o0] +diet(ing\|s) n[o0] +doctor +appointment +need n[o0] +doctor +required n[o0] +emba(r\|rr)ass n[o0].{1,15}experience +require n[o0] +gimmicks n[o0] +hunger.{1,20}pain n[o0] +hype n[o0] +loans n[o0] +more +advertisements n[o0]moredoctors n[o0] +more +please n[o0]negativesideeffects n[o0].{1,15}obligation n[o0] +prior +prescrip n[o0].{1,15}require n[o0] +strenuous.{1,20}exerci nothing +to +lose notification +of +business +opportunity now +being +accepted offensive +words offered +no.{0,1}where +else offers +in +the +past on +your +mortgage onceinalifetime one.time +fee one.time +mail online.{0,20}approv onlinepharm opportunit +of +a +lifetime opt.{1,3}(in\|out) order +(now\|today) order +vicodin orgasm \borg(ies\|y) otc +news +alert otcbb our.{1,50}enable our.{1,50}experts our +fee ourlastprofitablealerts our +partner +sites our +site +has +been +extremely outstanding +deal own +boss own +hours ownyourdreamhome paragraph.{1,80}1618 pay.{0,20}bills pay.{0,20}credit +cards pay.{0,20}tuition pay-per-view penileerection penis pennies +on +the +dollar penny +stock pher(emones\|mones) phone.{0,10}sex pissed pis(s\|sing) place.{1,20}order please +be +patient porno potential +customer power.{0,20}income praydaily prayercansave premium +vacation +package prescriptionfree prescriptionmedications prescriptionmeds press +here +to +enter presstolearnwhy productsworkbesttogether promo\.php promote.{1.15}site propecia protect +your +children protect +your +invest protect +yourself proven +effective proven +guaranteed proven +management proven +track provide.{1,5}access provide.{1,5}compete prozac pussy put +me +on +your +list quick +and +easy quit +your +job r +e +m +o +v +e rates.{1,30}low readingyourbible ready +for +action really +works receivenomoreoffers receive +our receive.{1,25}free receive.{1,25}trial receivedthismessageinerror reduce +body.{0,10}fat reduce +debt reducewrinkles referral +service refinance.{0,20}home refinance.{0,20}loan refinance.{0,20}mortgage reformactof1995 rejuvenateyourbody removal +instructions remove +cellulite removed +from +our +list request +free resellers +wanted reserve +space \breserve +your residual.{0,20}income restoresexdrive revers.{0,20}aging revitalize risk +free /rm\.gif sav.{1,10}big sav.{1,10}money save.{1,10}every +month save +on +your +monthly +bill schoolgirls search.{1,10}engine search.{1,10}for +anyone section {1,20}1618 section {1,20}301 secure.{1.15}now see.{1,15}yourself send.{1,20}no +money serious +income set +your +own +hours sex +li.e sexual +p(otency\|erformance) sexy +video shed +.{0,7}weight +fast shippeddiscreetly sick.{1,6}tired.{1,6}unwanted.{1,6}email sign.{0,20}distributor signup +today sinnedagainstyouy /sites/[[:digit:]]{6,}/images \bslut someone +is +searching +for +you spam +remedy speak {1,20}sales special +free +gift special +offer speculativetargetprice start +accepting +credit +cards start +earning startliving start +saving +today starter +system stay.{1,20}free stopmailfuture super +low +rate superior +arousal tak.{2,15}storm take.{1,20}action +now take.{1,20}advantage take.{1,8}off +list talk.{1,10}you thank +you.{1,20}for +your +time thebestpricesonthenet thehotteststock thereisnoobligationfromyou thicken.{0,8}lengthen this +ad +is this +e.{0,1}mail +advertis thisnewsletterwaspaid thousands +of +green +cards timetoact to +be +(deleted\|removed) to +be +excluded +permanently to.{1,20}get.{1,20}your too +good +to +be +true top.{1,15}flight topstockpick truly +incredible turn +\$.{0,20}into universal +cable +descrambler unlimited +income unlimited +long.{0,10}distance unlock +digital +cable unsecured +loans unsolicited.{0.5}mail upside +potential us +funds use +as +a +webcam vacation +getaway valium valuable +offer v[iI|1]ag(ra\|ara) viaegra vicodin view +photos +of +singles visit +here visit +this +address wantofferstostop want +to +be +part +of we.{0,15}apologize we.{0,15}can +help we.{0,15}charge we.{0,15}guarant we.{0,15}offer we.{0,15}specialize we.{0,15}show +you we.{0,15}stand +behind web.{1,15}more.{1,15}traffic webcam +when +connect website +may +load wecantbebested weight.{0,20}loss while +quantities +last will.{1,15}your +site willbeprofiledfromall win.{1,5}win.{1,5}win windows +reliability without.{0,10}diet.{0,10}exersize withoutfiling.{,5}bankruptcy work.{0,9}home world.{1,20}accept world.{1,20}opportunity world.{1,5}smallest +digital world.{1,5}smallest +ever ^x-mailer:.*the bat xanax xxx xxx +film xxx +movie you +can +(profit\|win) you +have +chosen +to +be +sent you +may +have +signed +up you +pay you +will +never +have you +will +not +be +contacted +again you +won.{1,5}find you.{1,15}debt you.{0,20}been +selected you +will +see +results your +address +has +been +registered +with +us your +identity your +marketing +campaign your +privacy +is +extremely your +product zyban Certain mailing list software begins repetitious warnings daily if rejected by a SPAM filter; this stops the warnings too.

all

all this +is +an +automated +message clear +the +bounce +counter announce\-subscribe list +messages +sent +to +your +address Auto-executing JavaScript in HTML body tag. Allows empty values for the attribute. all <body.*on(load\|unload).*> <body.*on(load\|unload) *= *(" *"\|' *').*> Unbalanced CR & LF characters Email has no body content The specified attachment types are not permitted in an email.

all

^content-(disposition\|type):.*name[[:blank:]]*=[[:blank:]]*"{0,1}[^/\:*?"<>| ]*\.(ade\|adp\|app\|bas\|bat\|chm\|cmd\|com\|cpl\|crt\|csh\|exe\|fxp\|hlp\|hta\|htm\|html\|inf\|ins\|isp\|js\|jse\|ksh\|lnk\|mda\|mdb\|mde\|mdt\|mdw\|mdz\|msc\|msi\|msp\|mst\|pcd\|pif\|prf\|prg\|reg\|scf\|scr\|sct\|shb\|shs\|url\|vb\|vbe\|vbs\|wsc\|wsf\|wsh\|xsl)\b Body text indicative of virus emails. all

all

themessagecontainsunicodecharactersandhasbeensentasabinaryattachment themessagecannotberepresentedin7bitasciiencodingandhasbeensentasabinaryattachment mailtransactionfailedpartialmessageisavailable thisisplaintextpart\b thismessagehasanattach\b ^content-(disposition\|type):.*name[[:blank:]]*=[[:blank:]]*"{0,1}[^/\:*?"<>| ]*\.(zip)\b ^somethingisgoingwrong$ ^takeiteasy$ [[:digit:]]{4,}isapasswordforarchive archivepassword[[:digit:]]{4,} inordertoreadtheattach readtheattachforfurtherdetails attachedfileprotectedwiththepasswordforsecurityreasons Blank line (single space) within header.

all

^[[:blank:]]+$ 1 250 2.6.0 Message accepted for processing c:\regexflt\accepted\{yyyy}-{mm}\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt http://www.2150.com/regexflt_intercept.asp