#LAST UPDATED 06/14/2011
SKIPIFWEIGHT 50

# ================================================================================================ #
# EXCEPTIONS		                                                                           #
# ================================================================================================ #

TESTSFAILED	END	PCRE	(FILTER-(BACKSCATTER|FORGED|PHISH|STOCKS|SCAM|LOTTO|NOSENDER))
TESTSFAILED	END	PCRE	(SNIFFER)
TESTSFAILED	END	PCRE	(DYNA|DUL)
TESTSFAILED	END	PCRE	(SURBL)

#BODY		END	PCRE 	(?i:BASE64)

REVDNS		END	CONTAINS	[No Reverse DNS]

BODY		-3 	PCRE	(Declude)
BODY		-10 	PCRE	(START SCANALERT CODE)

MAILFROM	-10	PCRE	(?i:^(bounce-hreporting).*\@)
BODY		-5	PCRE	(autocontactor\.com)

SUBJECT		-10	PCRE	(?i:This week in the Jewish Tribune)

BODY		-2 	PCRE	(?i:p\.MsoNormal, li\.MsoNormal, div\.MsoNormal)
BODY		-5 	PCRE	(?i:incredimail)


#HEADERS
HEADERS		-3	PCRE	(?i:X-ICPINFO:)
HEADERS		-2	PCRE	(?i:X-Alligate-Grey: Passed)

#CANNOT VERIFY RESULT
HEADERS		0	PCRE	(?i:X-IronPort-Anti-Spam-Filtered: true)

#ABUSE
HEADERS		-1	PCRE	(?i:X-AntiAbuse:)

#DOMAIN KEYS
HEADERS		-1	PCRE	(?i:(DomainKey|DKIM)-Signature:)

# ================================================================================================ #
# MAILING-LISTS		                                                                           #
# ================================================================================================ #

MAILFROM	-3	PCRE	(?i:newsletter)

#LIST IDENTIFY
HEADERS		-5	PCRE	(?i:X-LinkedIn-Class:)

HEADERS		-3	PCRE	(?i:X-Unsubscribe-Web:)
HEADERS		-3	PCRE	(?i:List-Owner:)
HEADERS		-3	PCRE	(?i:Thread-Topic:)
HEADERS		-3	PCRE	(?i:List-Id:)
HEADERS		-3	PCRE	(?i:ListMember:)

HEADERS		-2	PCRE	(?i:List-Unsubscribe:)

BODY		-5	PCRE	(?i:Powered by  YourMailingListProvider)
BODY		-5	PCRE	(?i:You are on the Ziff Davis Media Email List.)
BODY		-5	PCRE	(?i:Email delivery powered by Google)

#THREAD
BODY		-5	PCRE	(?i:http://.{0,50}/(viewtopic|thread|showthread|forum))

#GOOGLE
#MAILFROM	-3	PCRE	(?i:^adwords-.*\@)
HEADERS		-3	PCRE	(?i:X-Google-Loop: groups-summary)

#LYRIS
HEADERS		-7	PCRE	(?i:Message-Id: \<LYRIS)
MAILFROM	-2	PCRE	(?i:\@lyris\.)
REVDNS		-5	PCRE	(?i:\.lyris\.net)

#CRAIGSLIST
BODY		-6	PCRE	(CRAIGSLIST ADVISORY)

#FOOTER
BODY		-3	PCRE	(?i:Update Profile)

# ================================================================================================ #
# DISCLAIMER		                                                                           #
# ================================================================================================ #

BODY		-5	PCRE	(?i:If you are not the intended recipient)
BODY		-5	PCRE	(?i:information contained herein may include trade secrets)
BODY		-5	PCRE	(?i:message contains confidential information and is intended)
BODY		-5	PCRE	(?i:This email may contain confidential information)
BODY		-5	PCRE	(?i:dissemination, distribution, or copying of this communication)
BODY		-5	PCRE	(?i:Any unauthorized review, use, disclosure, or distribution is prohibited)
BODY		-5	PCRE	(?i:This transmission, including all attachments)

#ECOMMERCE
BODY		-5	PCRE	(?i:Order (No|Number):)
BODY		-5	PCRE	(?i:Order Date:)
BODY		-5	PCRE	(?i:following items have shipped)



#RECIEPT
BODY		-5	PCRE	(?i:retain this receipt for your records)
BODY		-5	PCRE	(?i:Paid by (MasterCard|Visa|Amex))

#SIGNATURE
BODY		-10	PCRE	(?i:Sent (from|via).{0,10}(Verizon Wireless|BlackBerry|iPhone|Windows Mobile device.))
BODY		-10	PCRE	(?i:Connected by DROID on Verizon Wireless)

BODY		-5	PCRE	(?i:Follow me on Twitter)
BODY		-5	PCRE	(?i:Checked by (ESET NOD32 Antivirus|AVG|NOD32))
BODY		-5	PCRE	(?i:Free version of SPAMfighter)
BODY		-5	PCRE	(?i:Controllato da AVG)
BODY		-5	PCRE	(?i:IncrdiXMLRemarkStart)
BODY		-5	PCRE	(?i:To ensure delivery of .{12,50} e-mails please add .{12,50} to your address book or safe sender list.)
BODY		-5	PCRE	(?i:START SCANALERT CODE)
BODY		-5	PCRE	(?i:Please consider the environment before printing this e-mail)

BODY		-3	PCRE	(?i:to your e-?mail address book)


# ================================================================================================ #
# TRAVEL CONFIRMATIONS	                                                                           #
# ================================================================================================ #

BODY		-7	PCRE	(?i:Electronic Ticket)
BODY		-5	PCRE	(?i:checkmytrip)

BODY		-3	PCRE	(?i:NON-STOP)


BODY		-2	PCRE	(?i:Departure:)
BODY		-2	PCRE	(?i:Arrival:)
BODY		-2	PCRE	(?i:TICKET:)

BODY		-1	PCRE	(?i:DEPART)
BODY		-1	PCRE	(?i:ARRIVE)

BODY		-2	PCRE	(?i:cheapoair)



# ================================================================================================ #
# RECIEPTS		                                                                           #
# ================================================================================================ #

BODY		-2	PCRE	(?i:Thank you for your order)
BODY		-2	PCRE	(?i:Order confirmation)
BODY		-2	PCRE	(V\.A\.T)

MAILFROM	-10	PCRE	(?i:\@econfirmation.att-mail.com)


# ================================================================================================ #
# OUT OF OFFICE		                                                                           #
# ================================================================================================ #
BODY		-2	PCRE	(?i:I will be out of the office)
BODY		-2	PCRE	(?i:If you need immediate assistance)

#LEGITIMATE BULK
MAILFROM	-5	PCRE 	(?i:((not?[-_]?reply|bounce[ds]?)|no-?reply.bounce)@)

# ================================================================================================ #
# OTHER			                                                                           #
# ================================================================================================ #
#CONTACT
BODY		-5	PCRE	(?i:[0-9]{4}.{1,4}(mobile|home|work|office|cell|fax)\s)
BODY		-5	PCRE	(?i:(mobile|home|work|office|cell|fax|tel).{1,5}([0-9]{3}).?([0-9]{4}))

#SMILIES
BODY		-3	PCRE	(?i:\s[:;][-^o]?[][)(><{|\/DPp]\s)

BODY		-3	PCRE	(?i:---- (Forwarded|Original) message -----)

BODY		-3	PCRE	(?i:Forward To A Friend)

BODY		-2	PCRE	(?i:http://(www.)?facebook(\.|=2E)com/)
BODY		-2	PCRE	(?i:http://(www.)?twitter(\.|=2E)com/)
BODY		-2	PCRE	(?i:http://(www.)?myspace(\.|=2E)com/)

BODY		-3	PCRE	(?i:subtotal)
BODY		-3	PCRE	(?i:White Paper)

# ================================================================================================ #
# Auto-generated Codes	                                                                           #
# ================================================================================================ #

BODY 	-3	PCRE	(?i:(acct?(ount)?)|activation|confirmation|cust(omer)?|item|member(ship)?|\border|part|pass|product|purchase|reg(istration)?|serial|ticket|tracking|transaction|user).(#|n(o|um)\b|code|word|id\b|key|order)
BODY	-5	PCRE	(?i:\s(cd|asr|vin).{0,2}(#|num|key|set)\W?)
BODY	-5	PCRE	(?i:\ss(n:|\\n|\/n)[\W])


