<?xml version="1.0" encoding="utf-8" ?>
<configuration>
	<filters>
		<filter name="all">
			<log>
				<option type="match true" />
				<option type="rules with match" />
				<option type="execution" />
			</log>
			<results default="accept">
				<result key="accept">
					<return>0</return>
					<copy enabled="yes" createdir="yes">c:\regexflt\accepted\{yyyy}-{mm}\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt</copy>
					<copy enabled="yes" operation="append" mail="no" append="&quot;{smtp:client_ip}&quot;,&quot;{smtp:helo}&quot;,&quot;{smtp:mail_from}&quot;,&quot;{smtp:rcpt_to}&quot;,&quot;{mm}/{dd}/{yyyy} {HH}:{MM}:{SS}&quot;,&quot;{smtp:mail_from_mailbox}&quot;,&quot;{smtp:mail_from_domain}&quot;,&quot;{smtp:rcpt_to_mailbox}&quot;,&quot;{smtp:rcpt_to_domain}&quot;,&quot;accept&quot;,&quot;scam&quot;,&quot;c:\\regexflt\\accepted\\{yyyy}-{mm}\\{smtp:rcpt_to_domain}\\{smtp:rcpt_to_mailbox}\\{source:filename}{smtp:recipient_id}.txt&quot;\r\n">c:\regexflt\accepted\{yyyy}-{mm}\log.txt</copy>
					<imap enabled="no" createdir="yes">c:\Program Files\Merak\mail\2150.com\rejectedmail\RegEx Accepted\{source:filename}{smtp:recipient_id}.imap</imap>
					<http enabled="no">http://localhost/2150/regexflt_test.asp</http>
				</result>
				<result key="reject">
					<return>1</return>
					<smtpstatuscode>554</smtpstatuscode>
					<smtpextendedstatuscode>5.7.1</smtpextendedstatuscode>
					<message>Content filter scam rejection</message>
					<copy enabled="yes" createdir="yes">c:\regexflt\rejected\{yyyy}-{mm}\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\Scam\{source:filename}{smtp:recipient_id}.txt</copy>
					<copy enabled="yes" operation="append" mail="no" append="&quot;{smtp:client_ip}&quot;,&quot;{smtp:helo}&quot;,&quot;{smtp:mail_from}&quot;,&quot;{smtp:rcpt_to}&quot;,&quot;{mm}/{dd}/{yyyy} {HH}:{MM}:{SS}&quot;,&quot;{smtp:mail_from_mailbox}&quot;,&quot;{smtp:mail_from_domain}&quot;,&quot;{smtp:rcpt_to_mailbox}&quot;,&quot;{smtp:rcpt_to_domain}&quot;,&quot;reject&quot;,&quot;scam&quot;,&quot;c:\\regexflt\\rejected\\{yyyy}-{mm}\\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\\Scam\\{source:filename}{smtp:recipient_id}.txt&quot;\r\n">c:\regexflt\rejected\{yyyy}-{mm}\log.txt</copy>
					<imap enabled="no" createdir="yes">c:\Program Files\Merak\mail\2150.com\rejectedmail\RegEx Rejected\{source:filename}{smtp:recipient_id}.imap</imap>
					<http enabled="no">http://localhost/2150/regexflt_test.asp</http>
					<delay milliseconds="5000" />
				</result>
				<result key="mark">
					<return>0</return>
					<copy enabled="yes" createdir="yes">c:\regexflt\modified\{yyyy}-{mm}\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt</copy>
					<copy enabled="yes" operation="append" mail="no" append="&quot;{smtp:client_ip}&quot;,&quot;{smtp:helo}&quot;,&quot;{smtp:mail_from}&quot;,&quot;{smtp:rcpt_to}&quot;,&quot;{mm}/{dd}/{yyyy} {HH}:{MM}:{SS}&quot;,&quot;{smtp:mail_from_mailbox}&quot;,&quot;{smtp:mail_from_domain}&quot;,&quot;{smtp:rcpt_to_mailbox}&quot;,&quot;{smtp:rcpt_to_domain}&quot;,&quot;mark&quot;,&quot;scam&quot;,&quot;c:\\regexflt\\modified\\{yyyy}-{mm}\\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\\{source:filename}{smtp:recipient_id}.txt&quot;\r\n">c:\regexflt\modified\{yyyy}-{mm}\log.txt</copy>
					<imap enabled="no" createdir="yes">c:\Program Files\Merak\mail\2150.com\rejectedmail\RegEx Modified\{source:filename}{smtp:recipient_id}.imap</imap>
					<http enabled="no">http://localhost/2150/regexflt_test.asp</http>
					<modifysource enabled="yes">
					  <header enabled="yes" action="replace" item="subject" value="SPAM-NIGERIA: {value}" />
					  <header enabled="yes" action="add" item="X-RegEx-Filter" value="regex_nigeria_scam.xml" />
					  <header enabled="yes" action="replaceoradd" item="Importance" value="Low" />
					  <header enabled="yes" action="replaceoradd" item="X-Priority" value="5 (Lowest)" />
					  <header enabled="no" action="add" item="X-RegEx-Filter-Title" value="{result:rule:title}" comment="Not yet implemented" />
					  <header enabled="no" action="add" item="X-RegEx-Filter-UID" value="{result:rule:uid}" comment="Not yet implemented" />
					</modifysource>
					<delay milliseconds="5000" comment="Delay the spammer even though we're delivering the message" />
				</result>
			</results>
			<parser>
				<maxlines>1000</maxlines>
				<maxbuffer>50000</maxbuffer>
				<quickresult>yes</quickresult>
			</parser>
			<rules>
				<rule result="reject">
					<title>Nigeria scam (single)</title>
					<comment>Inidicative of the infamous Nigerian bank scam emails</comment>
					<scope>
						<body>all</body>
					</scope>
					<expressions oninit="score=0" logic="return (score &gt;= 1)">
						<expression collection="text_packed" casesensitive="no" type="regex" onmatch="score += 1" uid="">theintendedpersonbeforewecandiscuss</expression>
						<expression collection="text_packed" casesensitive="no" type="regex" onmatch="score += 1" uid="">portharcourtnigeria</expression>
					</expressions>
				</rule>
				<rule result="reject">
					<title>Nigeria scam</title>
					<comment>Inidicative of the infamous Nigerian bank scam emails</comment>
					<scope>
						<body>all</body>
					</scope>
					<expressions oninit="where=0;amount=0;percent=0;misc=0" logic="return (where &gt;= 1) &amp;&amp; (amount &gt;= 1) &amp;&amp; (percent &gt;= 1) &amp;&amp; (misc &gt;= 1)">
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">abidjan</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">abuja</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">africa</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">algeria</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">angola</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">benin</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">congo</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">cotonou</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">democratic +republic</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">dubai</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">gambia</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">ghana</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">hong +kong</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">iraq</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">ireland</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">kuwait</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">liberia</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">macau</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">mauritius</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">philippines</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">nigeria</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">[^r]oman</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">r\.o\.c\.</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">sierra +leone</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">swaziland</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">u\.a\.e\.</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">west +africa</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">zaire</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">zimbabwe</expression>
						<expression casesensitive="no" type="regex" onmatch="amount += 1" uid="">(\$\|USD)\({0,1}[[:blank:]]*[0123456789]{1,3}[[:blank:]]*[,\.]{0,1}[[:blank:]]*[0123456789]{3,3}[[:blank:]]*[,\.]{0,1}[[:blank:]]*[0123456789]{3,3}</expression>
						<expression casesensitive="no" type="regex" onmatch="amount += 1" uid="">[0123456789]{1,3}[[:blank:]]*[,]{0,1}[[:blank:]]*[0123456789]{3,3}[[:blank:]]*[,\.]{0,1}[[:blank:]]*[0123456789]{3,3}[[:blank:]]*[,\.]{0,1}[[:blank:]]*(\$\|USD)</expression>
						<expression casesensitive="no" type="regex" onmatch="amount += 1" uid="">(\$\|USD)[0123456789]+[[:blank:]]*[,\.]{0,1}[[:blank:]]*[0123456789]*[[:blank:]]*M</expression>
						<expression casesensitive="yes" type="regex" onfirstmatch="amount += 1" uid="">huge +sum +of +money</expression>
						<expression casesensitive="yes" type="regex" onfirstmatch="amount += 1" uid="">fixed +deposit +account</expression>
						<expression casesensitive="yes" type="regex" onfirstmatch="amount += 0.4" uid="">USD</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">million</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">dollar</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">united +states +dollar</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">[0123456789]{1,3}[[:blank:]]*[,\.][[:blank:]]*[0123456789]{3,3}[[:blank:]]*[,\.][[:blank:]]*[0123456789]{3,3}</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">banking +law</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">royalties</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">receive +on +behalf</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">pending +transaction</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">islamic +law</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">the +sum +of</expression>
						<expression collection="text_packed" casesensitive="no" type="regex" onfirstmatch="amount += 1.0" uid="">tracedmanyofthesefund</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">government +has +frozen</expression>
						<expression casesensitive="no" type="regex" onmatch="percent += 1" uid="">[0123456789]+[0123456789,\.]*[[:blank:]]*%</expression>
						<expression casesensitive="no" type="regex" onmatch="percent += 1" uid="">compensat</expression>
						<expression casesensitive="no" type="regex" onmatch="percent += 1" uid="">disbursement</expression>
						<expression collection="text_packed" casesensitive="no" type="regex" onmatch="percent += 1" uid="">glorifygod</expression>
						<expression collection="text_packed" casesensitive="no" type="regex" onmatch="percent += 1" uid="">letterofauthority</expression>
						<expression collection="text_packed" casesensitive="no" type="regex" onmatch="percent += 1" uid="">originalbeneficiary</expression>
						<expression collection="text_packed" casesensitive="no" type="regex" onmatch="percent += 1" uid="">sharethefunds</expression>
						<expression casesensitive="no" type="regex" onmatch="percent += 1" uid="">percent</expression>
						<expression casesensitive="no" type="regex" onmatch="percent += 1" uid="">profitable</expression>
						<expression casesensitive="no" type="regex" onmatch="percent += 1" uid="">remunerat</expression>
						<expression casesensitive="no" type="regex" onmatch="percent += 1" uid="">retain</expression>
						<expression collection="text_packed" casesensitive="no" type="regex" onmatch="percent += 1" uid="">usethisfund</expression>
						<expression casesensitive="no" type="regex" onmatch="percent += 1" uid="">your +service</expression>
						<expression collection="text_packed" casesensitive="no" type="regex" onmatch="percent += 1" uid="">youwillbepaid</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">audit</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">bank +account</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">cancer</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">confiden</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">death</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">deceased</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">died</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">embezz</expression>
						<expression collection="packed" casesensitive="no" type="regex" onmatch="misc += 1" uid="">glorifygod</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">inherit</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">killed</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">secret</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">slain</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">surplus</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">transaction</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">transfer</expression>
					</expressions>
				</rule>
				<rule result="reject">
					<title>Lottery scam</title>
					<comment>Inidicative of the infamous lottery winning scam emails</comment>
					<scope>
						<body>all</body>
					</scope>
					<expressions collection="text" oninit="where=0;amount=0;misc=0" logic="return (where &gt;= 1) &amp;&amp; (amount &gt;= 1) &amp;&amp; (misc &gt;= 1)">
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">america</expression>
						<expression collection="text_packed" casesensitive="no" type="regex" onmatch="where += 1" uid="">allovertheworld</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">asia</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">australia</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">brunei</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">europe</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">great +britain</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">middle +east</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">new +zealand</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">third +world</expression>
						<expression casesensitive="no" type="regex" onmatch="where += 1" uid="">usa</expression>
						<expression casesensitive="no" type="regex" onmatch="amount += 1" uid="">(\$\|USD\|£\|€\|EUROS?)\({0,1}[[:blank:]]*[0123456789]{1,3}[[:blank:]]*[,\.]{0,1}[[:blank:]]*[0123456789]{3,3}[[:blank:]]*[,\.]{0,1}[[:blank:]]*[0123456789]{3,3}</expression>
						<expression casesensitive="no" type="regex" onmatch="amount += 1" uid="">[0123456789]{1,3}[[:blank:]]*[,]{0,1}[[:blank:]]*[0123456789]{3,3}[[:blank:]]*[,\.]{0,1}[[:blank:]]*[0123456789]{3,3}[[:blank:]]*[,\.]{0,1}[[:blank:]]*(\$\|USD\|£\|€\|EURO)</expression>
						<expression casesensitive="no" type="regex" onmatch="amount += 1" uid="">(\$\|USD\|£\|€\|EUROS?)[0123456789]+[[:blank:]]*[,\.]{0,1}[[:blank:]]*[0123456789]*[[:blank:]]*M</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 1" uid="">deposited +with +a +security</expression>
						<expression collection="text_packed" casesensitive="no" type="regex" onfirstmatch="amount += 1" uid="">lumpsumpayout</expression>
						<expression casesensitive="yes" type="regex" onfirstmatch="amount += 0.4" uid="">USD</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">million</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">dollar</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">euro</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">pounds</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">united +states +dollar</expression>
						<expression casesensitive="no" type="regex" onfirstmatch="amount += 0.4" uid="">[0123456789]{1,3}[[:blank:]]*[,\.][[:blank:]]*[0123456789]{3,3}[[:blank:]]*[,\.][[:blank:]]*[0123456789]{3,3}</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">award +notification</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">computer +ballot</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">international +winner</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">lottery +program</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">prize +claim +agent</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">top +secret</expression>
						<expression casesensitive="no" type="regex" onmatch="misc += 1" uid="">worldwide +premier +lotto</expression>
					</expressions>
				</rule>
			</rules>
		</filter>
	</filters>
</configuration>