# qb Quality Bytes MailXpress rules

body __QB_VIAGRA1 /Vi[a-z]*a[a-z]*g[a-z]*ra/i
meta QB_VIAGRA (__QB_VIAGRA1)
describe QB_VIAGRA Obfuscated version of Viagra
score QB_VIAGRA 8

body __QB_URI1 /http\:\/\/[0-9a-z\.\-\%]+[^0-9a-z\.\-\s\:\/\?]{1,5}[\%0-9a-z\.\-]+[\s\?\:\/]/i
meta QB_URI (__QB_URI1)
describe QB_URI Illegal URI
score QB_URI 0.5

body __QB_STOCK11 /c[o]+[m]+[p]+[a]+[n]+y/i
body __QB_STOCK12 /(s[y]+[m]+[b]+[o]+l|c[o]+[m]+[p]+[a]+[n]+y)[\s]*[:]+[\s]+[a-z]{4}/i
body __QB_STOCK13 /t[a]+[r]+[g]+[e]+t/i
body __QB_STOCK14 /c[u]+[r]+[e]+[n]+t[\s]+p[r]+[i]+[c]+e/i
body __QB_STOCK15 /e[x]+[p]+[e]+[c]+[t]+[e]+d[\s]+p[r]+[i]+[c]+e/i
body __QB_STOCK16 /\:[\s]+\$0\.0[0-9]{2}/
body __QB_STOCK18 /check\sout|watch\sfor|check the news/i
meta QB_STOCK1 (__QB_STOCK11 && __QB_STOCK12 && (__QB_STOCK13 || (__QB_STOCK14 && __QB_STOCK15)) )
describe QB_STOCK1 Stock tip
score QB_STOCK1 8
meta QB_STOCK2 ( __QB_STOCK16 && ( __QB_STOCK11 || __QB_STOCK18 ) )
score QB_STOCK2 3

full __QB_STOCK31 /((trade|stock|pink|watch|gain|target|invest|buy|company|price|growth|market).*){3}/si
body __QB_STOCK32 /([a-zA-Z])[\s]?([:]+|is)?[\s]+[A-Z]{4}/
body __QB_STOCK33 /(watch list|watch for|will go [a-z]+high|read more)/i
meta QB_STOCK31 ( __QB_STOCK31 && __QB_STOCK32 )
score QB_STOCK31 1
meta QB_STOCK32 ( __QB_STOCK31 && __QB_STOCK32 && __QB_STOCK33 )
score QB_STOCK32 2

body QB_BAD_CREDIT /bad[\s]{1,3}credit[\s]{1,3}ok/i
describe QB_BAD_CREDIT Mentioning that bad credit is OK
score QB_BAD_CREDIT 2

body __QB_IMGSPAM11 eval:pixel_coverage('gif',75000,250000)
body __QB_IMGSPAM12 eval:pixel_coverage('jpeg',75000,250000)
body __QB_IMGSPAM13 eval:pixel_coverage('png',75000,250000)
full __QB_IMGSPAM17 /(.{100,500}(\<BR\>|\<\/DIV\>|\<\/P\>)){4}/si
full __QB_IMGSPAM18 /\>.{1000,3500}?\</si
meta QB_IMGSPAM1 ( ( __QB_IMGSPAM11 || __QB_IMGSPAM12 || __QB_IMGSPAM13 ) && __QB_IMGSPAM17 )
describe QB_IMGSPAM1 Image with long paragraphs of text
meta QB_IMGSPAM2 ( ( __QB_IMGSPAM11 || __QB_IMGSPAM12 || __QB_IMGSPAM13 ) && __QB_IMGSPAM18 )
describe QB_IMGSPAM2 Image with a huge paragraph
score QB_IMGSPAM1 1
score QB_IMGSPAM2 1
describe __QB_IMGSPAM18 Very large paragraphs of text unlikely written by a person
score __QB_IMGSPAM18 2

header __QB_JOB_S1    Subject =~ /freelance/i
header __QB_JOB_S2    Subject =~ /job/i
body   __QB_JOB_B1    /j[o]+b/i
body   __QB_JOB_B2    /reply[\s]+to/i
body   __QB_JOB_B3    /more\sinformation/i
body   __QB_JOB_B4    /freelance/i
body   __QB_JOB_B5    /donation/i
body   __QB_EMAIL_ADDR /[\S]+\@[A-Za-z0-9\-\.]/
meta   QB_JOBOFFER_1 ( (__QB_JOB_S1 || __QB_JOB_S2) && ( __QB_JOB_B1 && __QB_JOB_B2 && __QB_JOB_B3 && __QB_JOB_B4 && __QB_JOB_B5 ) )
meta   QB_JOBOFFER_2 ( (__QB_JOB_S1 || __QB_JOB_S2) && ( __QB_JOB_B1 && __QB_JOB_B2 && __QB_JOB_B3 && __QB_JOB_B4 ) )
meta   QB_JOBOFFER_3 ( (__QB_JOB_S1 || __QB_JOB_S2) && ( __QB_JOB_B1 && __QB_JOB_B2 && __QB_JOB_B3 && __QB_JOB_B4 && __QB_EMAIL_ADDR ) )
score QB_JOBOFFER_2 3
score QB_JOBOFFER_1 1.5
score QB_JOBOFFER_3 1.5
describe QB_JOBOFFER_2 Job offer with freelance mentioned and reply to a different address than the sender
describe QB_JOBOFFER_1 Job offer with donation mentioned
describe QB_JOBOFFER_3 Job offer with a reply-to address specified in the body

body __QB_NEWSLTR_B1 /If you (can't|can[\s]?not) (see|read).+click here/i
body __QB_NEWSLTR_B2 /Registered Database/i
body __QB_NEWSLTR_B3 /מאגר נתונים/i
body __QB_NEWSLTR_B4 /All rights reserved/i
body __QB_NEWSLTR_B5 /כל הזכויות שמורות/i
meta QB_NEWSLTR_1 ( __QB_NEWSLTR_B1 && (__QB_NEWSLTR_B2 || __QB_NEWSLTR_B3) )
meta QB_NEWSLTR_2 ( QB_NEWSLTR_1 && (__QB_NEWSLTR_B4 || __QB_NEWSLTR_B5) )
describe QB_NEWSLTR_1 Newsletter
describe QB_NEWSLTR_2 Newsletter with "All rights reserved"
score QB_NEWSLTR_1 2.5
score QB_NEWSLTR_2 1