* !--.*forwarded message --* !^forwarded message:* !^-----BEGIN PGP SIGNED MESSAGE-----* -1000^0* -1000^0   ^Subject: Re:*  -200^1   ^[:;#>]*   500^1   composed using NICErsPRO Total Solution Email*   500^1   http://www\.nicers\.com{ :0 f | ${FORMAIL} -A"X-SBRule: Spam Mailer/NicersPro" :0 { SPAMTAG=yes }}# Product Link bulk emailer:0 BH* !--.*forwarded message --* !^forwarded message:* !^-----BEGIN PGP SIGNED MESSAGE-----* -1000^0* -1000^0   ^Subject: Re:*  -200^1   ^[:;#>]*   500^0   ^From:.*product link*   500^1   we are product link*   200^1   805[-\. )]*654[-\. ]*4042{ :0 f | ${FORMAIL} -A"X-SBRule: Spam Mailer/Product Link" :0 { SPAMTAG=yes }}# QuickSMTP:0* ^X-Mailer:.*QuickSMTP{ :0 f | ${FORMAIL} -A"X-SBRule: QuickSMTP" :0 { SPAMTAG=yes }}# Rapid Fire Mail Server (RFMS):0 BH* !--.*forwarded message --* !^forwarded message:* !^-----BEGIN PGP SIGNED MESSAGE-----* -1000^0* -1000^0   ^Subject: Re:*  -200^1   ^[:;#>]*  1000^0   !^From:*  1000^0   ^From:[ ]?$*   500^0   !^To:*   500^0   ^To:[ ]?$*   800^1   Rapid Fire Mail Server*   600^1   RFMS{ :0 f | ${FORMAIL} -A"X-SBRule: Spam Mailer/RFMS" :0 { SPAMTAG=yes }}# Safeguard:0 BH* !--.*forwarded message --* !^forwarded message:* !^-----BEGIN PGP SIGNED MESSAGE-----* -1000^0* -1000^0   ^Subject: Re:*  -200^1   ^[:;#>]*   500^0   ^From:[ ]safeguard[0-9]*@*   500^0   ^X-MDRemoteIP:*   500^0   ^X-MDaemon-Deliver-To:*   800^1   Source Code 2002 Safeguard{ :0 f | ${FORMAIL} -A"X-SBRule: Spam Mailer/Safeguard" :0 { SPAMTAG=yes }}# Stealth Mailer Classic :(:0*  ^Received:.*(SMTP id GAA.*-0600 \(EST\)([^a-z0-9\.]|$)|\               \(8\.8\.5\/8\.6\.5\)){ :0 f | ${FORMAIL} -A"X-SBRule: Spam Mailer/Stealth Classic" :0 { SPAMTAG=yes }}# Stealth mailer -- New & "Improved" :( :<:0*  ^Received:.*-0700 \(EDT\)([^a-z0-9\.]|$){ :0 f | ${FORMAIL} -A"X-SBRule: Spam Mailer/Stealth New" :0 { SPAMTAG=yes }}# TDS Mailer (TO/DATE/SUBJECT):0 D* ^(TO:)* ^(DATE:)* ^(SUBJECT:){ :0 f | ${FORMAIL} -A"X-SBRule: Spam Mailer/TDS" :0 { SPAMTAG=yes }}# DS Mailer (DATE/SUBJECT):0 D* !^(T[Oo]:)* ^(DATE:)* ^(SUBJECT:){ :0 f | ${FORMAIL} -A"X-SBRule: Spam Mailer/DS" :0 { SPAMTAG=yes }}# X-EM Mailer:0* ^X-EM-Version:* ^X-EM-Registration:{ XEM=yes }:0* LEANTAG ?? no* !XEM ?? yes{ :0 BH * !--.*forwarded message -- * !^forwarded message: * !^-----BEGIN PGP SIGNED MESSAGE----- * -1000^0 * -1000^0   ^Subject: Re: *  -200^1   ^[:;#>] *   500^0   ^\<\!\-\- Please Read! If you are reading this then that means *   500^0   an HTML capable e-mail client *   500^0   you are not viewing this message as(.*$)+it should be *   500^0   Please send an email to services@maxir(\.|=2E)com with Remove(.*$)+as the subject *   500^0   ^\<base href=.?.?\"http://.*\"\>(.*$)+(.*$)+^\<\!\-\- Start Top Banner \-\-\>$ { XEM=yes }}:0* XEM ?? yes{ :0 f | ${FORMAIL} -A"X-SBRule: Spam Mailer/XEM" :0 { SPAMTAG=yes }}# Zenith Bulk Emailer (RFMS):0 BH* !--.*forwarded message --* !^forwarded message:* !^-----BEGIN PGP SIGNED MESSAGE-----* -1000^0* -1000^0   ^Subject: Re:*  -200^1   ^[:;#>]*  1000^0   ^X-Info:.*Zenith Bulk Emailer*   500^1   Zen Bulk Emailer*   500^1   212[-\. )]*208[-\. ]*2904*   500^1   +44[-\. (]*01[-\. )]*772[-\. ]*492507*   300^1   FireFox Freeware*   200^1   RFMS{ :0 f | ${FORMAIL} -A"X-SBRule: Spam Mailer/Zenith" :0 { SPAMTAG=yes }}# Mailer with Random X-Mailer Header string:0* ^X-Mailer: [a-z0-9][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.]{ :0 f | ${FORMAIL} -A"X-SBRule: Spam Mailer/Random X-Mailer" :0 { SPAMTAG=yes }}# Mailer with "This is an HTML message" text section...:0 B* !--.*forwarded message --* !^forwarded message:* !^-----BEGIN PGP SIGNED MESSAGE-----* -1000^0* -1000^0   ^Subject: Re:*  -200^1   ^[:;#>]*  1100^0   ^..... This is an HTML Message \! .....$*  1100^0   ^這是一個(gè)HTML格式的郵件/This is a html format mail$*  1100^0   $^$^Please use MIME-capable reader\.$*   800^0   ^If you are reading this message, your email browser does not support$*   800^0   ^HTML formatting\.  Please disregard the HTML code below this message\.${ :0 f | ${FORMAIL} -A"X-SBRule: Spam Mailer/Body Text" :0 { SPAMTAG=yes }}# Other Spam Software X-Mailer: headers:0* ^X-(Mailer|Server): (.*\{\%xmailer\%\}|\              .*[0-9]+KingInfo_Mailer|\              .*6.0 sub|\              .*Accucast|\              .*ArGoSoft MX Mailer|\              .*Aristotle|\              .*BallSacMailer|\              .*BulkMailer|\              .*cgiemail|\              .*CSM[ ]|\              .*dd <[0-9][0-9]>|\              .*Direct Email|\              .*eBizmailer|\              .*E-Mail Connection|\              .*eMerge|\              .*Envex|\              .*FletMail|\              .*GoldMine|\              .*Jackpot|\              .*JBH Msender|\              .*jfmailer|\              .*Kaufman Mail Warrior|\              .*KingInfo_Mailer|\              .*Mach5|\              .*Mail Bomber|\              .*Mailchute|\              .*Mailer Signature|\              .*MailKing|\              .*MailWorkZ|\              .*MailXSender|\              .*MassE-Mail|\              .*massmail\.pl|\              .*Mega-Mailer|\              .*Millennium Mailer|\              .*Mindcast|\              .*MMailer|\              .*Mozzila|\              .*Multimailer|\              .*Odulo BulkMail Master|\              .*QuickSender|\              .*RIME|\              .*Robot-Mail|\              .*RoryMAILER|\              .*Sir Mail-A-Lot|\              .*StormPost|\              .*Telesale|\              .*The HARVESTER|\              .*V3,1,6,1|\              .*WC Mail __ty__|\              .*WinNT\'s Blat|\              .*X-Mailer|\              .*YDH_optin_v[0-9].[0-9]|\              .*yougotit){ :0 f | ${FORMAIL} -A"X-SBRule: Spam X-Mailer" :0 { SPAMTAG=yes }}# Spam Software -- other header stigmata:0* (^Content-Type: Commercial E-Mail|\   ^Content-type: .*boundary=.?\#MYBOUNDARY\#|\   ^Message-ID: <private\.company\.and\.not\.an\.ISP>|\   ^Received:.*ALLINTERNETUSERS|\   ^Received:.*CLOAKED|\   ^Received: from bulkserver|\   ^Received:.*spam\.master|\   ^Received:.*(^|[^-_0-9a-z])stealth([ ]|$)|\   ^Received:.*--- unknown host ---|\   ^Received:.*Wakeup|\   ^Received:.*young-crook-|\   ^Status: MC|\   ^To: friends?@public\.com([^a-z0-9\.]|$)|\   ^To.*(^|[^-_0-9a-z])user@|\   ^To.*(^|[^-_0-9a-z])your?@|\   ^To.*yourdomain\.com([^a-z0-9\.]|$)|\   ^To.*WebSiteOwner@|\   ^To: XXXXXX|\   ^X-Advertisement:|\   ^X-Distribution: Mass|\   ^X-#:|\   ^X-Info: Antro Promotions|\   ^X-Info: mailto:.* in case of spamming!|\   ^X-visit: http://www\.WebPromote\.com/|\   ^X-IdiRosNa: |\   ^X-UtuBasAga: |\   ^X-HrAga: |\   ^X-BasUtuNaTeg: )* !^Received.*stealth\.net([^a-z0-9\.]|$){ :0 f | ${FORMAIL} -A"X-SBRule: Spam Software Header Stigmata" :0 { SPAMTAG=yes }}# Spam Software -- body stigmata#:0 BH* LEANTAG ?? no* !^Subject: .*\(fwd\)* !--.*forwarded message --* !^forwarded message:* !^-----BEGIN PGP SIGNED MESSAGE-----* -1000^0*  -500^0   ^Subject: Re:*  -200^1   ^[:;#>]*  -600^1    ^Subject:.*spam*   800^0    (^|[^-_0-9a-z])This message has been sent using a trial-run version([^a-z0-9\.]|$)*   800^0    (^|[^-_0-9a-z])TSmtpRelayServer([^a-z0-9\.]|$)*   800^0    (^|[^-_0-9a-z])TSmtpRelayServer([^a-z0-9\.]|$)*   800^0    ()<!-- iServe\.com\.hk \.\.\. This page is encripted*   800^0    ()<!-- Written by Chris Chan*   800^0    ()<!-- All Rights Reserved by iServe Worldwide Ltd\. -->*   800^0    ()\(This safeguard is not inserted when using the registered version\)*   500^0    (^|[^-_0-9a-z])This message contains an HTML formatted message but your email([^a-z0-9\.]|$)*   500^0    (^|[^-_0-9a-z])client does not support the display of HTML\. Please view this message in a([^a-z0-9\.]|$)*   500^0    (^|[^-_0-9a-z])different mail client or forward this email to a web-based mail system([^a-z0-9\.]|$){ :0 f | ${FORMAIL} -A"X-SBRule: Spam Software Body Stigmata" :0 { SPAMTAG=yes }}