# Ruleset: cloudsploit.cf # License: GPL # Version: 215159152 # Author: Jared Hall # Contact: jared@jaredsec.com # Generated By: jbuild ################### CLOUDSPLOIT SECTION ################### # URIs that should not appear with certain Body/Subjects ## EXEMPTIONS ## header __JR_EXPLOIT_FROM_EXEMPT1 EnvelopeFrom =~ /\@(.*\.)?(waveapps\.com|citi\.com|hulumail\.com|govhub\.com|rcgdocumentation\.com|celebritycruises\.com)\>?$/i header __JR_EXPLOIT_FROM_EXEMPT2 ALL:raw =~ /Received:\sfrom\s(.*\.)?(docusign\.net)\s/m header __JR_EXPLOIT_FROM_EXEMPT3 From:addr =~ /\@(.*\.)?(waveapps\.com|citi\.com|hulumail\.com|govhub\.com)$/i meta __JR_EXPLOIT_FROM_EXEMPT (__JR_EXPLOIT_FROM_EXEMPT1 || __JR_EXPLOIT_FROM_EXEMPT2 || __JR_EXPLOIT_FROM_EXEMPT3) ## CREATING BODY RULES: JR_EXPLOIT.cf ## body T_JR_CLOUDSPLOIT_BODY1 /(^|\b|\s)(Accept\sthe\sdocuments\sfor\sreview\.|You\shave\sdocuments\sawaiting\syour\sreview\.|Last\smonth\sattached\sRef\sSlips\saccording\sto\syour\srequest\sDocumet|Please\sfind\sattached\sorder\,\sand\sthe\spackaging\sdesign\swith\sthe\srequested\schanges|Get\syour\sfiles|Follow\sthe\sURL\sbelow\sto\supgrade\syour\squota\sto|Your\sfiles\sis\sready\sfor\sdownload|Click\sHere\sTo\sView\sAnd\sDownload\sYour\sFile\.|Your\sdocument\shas\sbeen\scompleted|Email\sencryption\spowered\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\.|Click\sDownload\sDocument\sTo\sView\sYour\sFax\sDocuments\sOnline|Docs\:\sCreate\sand\sedit\sdocuments\sonline\.|If\syou\sdo\snot\supdate\syour\swallet\,\s?your\swallet\swill\sbe\srestricted|You\smight\sexperience\sdelays\sor\scan\sno\slonger\ssend\sand\sreceive\smessages|To\supdate\suse\sthe\slink\sbelow\sto\sget\sthe\slatest\supdate|I\swant\sto\sknow\sif\syou\scan\ssupply\sus\swith\sthese\sitems\.|You\swill\sreceive\spending\semails\safter\ssuccessful\slogin\svia\sportal\sas\swe\sapologize\sfor\sthe\sinconvenience|messages\sstill\spending\sto\sbe\sdelivered\sto\syour\sinbox\ssince|Kindly\sStudy\sfor\sPresentation|You\shave\sreceived\sthis\semail\sbecause\ssomeone\sshared\sa\sdocument\swith\syou\sfrom|This\semail\sgrants\saccess\sto\sthis\sitem|Folder\sError\sNotification|Re\-activate\sAccount)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY1 nosubject body T_JR_CLOUDSPLOIT_BODY2 /(^|\b|\s)(Your\spassword\sis\sexpiring\.\sThe\ssystem\swill\sgenerate\sa\snew\spassword\sfor\syou\sautomatcally|To\sretain\syour\sold\spassword\sand\savoid\schange\,\ssimply\suse\sthe\sbutton\sbelow|Our\ssystem\shas\sshown\sthat\syour\sMetaMask\swallet\shas\snot\syet\sbeen\sverified|(\xD0\xBC\xD0\xBE\xD0\xBB\xD1\x8F\s\xD0\xBD\xD0\xB0\xD1\x82\xD0\xB8\xD1\x81\xD0\xBD\xD0\xB5\xD1\x82\xD0\xB5\s\xD1\x81\xD0\xBB\xD0\xB5\xD0\xB4\xD0\xBD\xD0\xB8\xD1\x8F\xD1\x82\s\xD0\xBB\xD0\xB8\xD0\xBD\xD0\xBA)|has\sbeen\ssuspended\stemporarily\sdue\sto\ssome\sPolicy\sViolations|cPanel\s\x40\s2022|\xE2\x9A\xA0\sYour\sEmail\sHas\sBeen\sRestricted|Read\smore\sabout\sthe\sinvestment\srules\son\sthe\sregistration\spage\sbefore\syou\sproceed\sto\sregister\sand\sdeposit\syour\sCrypto|Register\sand\sinvest\syour\sBitcoin\sor\sEthereum\sin\sCoinbase\slatest\ssmart\scontract|Therefore\swe\shave\splaced\sa\ssecurity\shold\son\syour\sonline\saccess\sto\sprovide\sbetter\ssecurity\sfor\syour\sprotection|Your\semail\spassword\swill\sexpire\s[0-9]{2}\shours\sfrom|mail\sVerification\sFor\s\s?Mailbox|Kindly\srelease\smessages\sback\sto\syour\sinbox|Add\sto\sstorage\sspace\shere\.|Review\sdue\sinvoice\sand\sapprove\sfor\spaymnet|all\sAmerican\sExpress\xC2\xAE\sCard\smember\sare\srequired\sto\sverify\stheir\spersonal\sinformation)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY2 nosubject body T_JR_CLOUDSPLOIT_BODY3 /(^|\b|\s)(Synchronize\sMail\sError|Thank\syou\sfor\sbeing\sa\sValid\sCardmember\.\sWe\slook\sforward\sto\sserving\syou\sbest|Failure\sto\sfollow\sabove\swill\slead\sto\smailbox\sin\-accessabilty|The\spassword\sto\syour\semail\saccount\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sis\sscheduled\sto\sexpire\stoday|This\smessage\sis\sgenerated\sautomatically\sby\sthe\sserver\swhen\syou\sexceed\sthe\sassigned\scapacity\sof\syour\smailbox|We\shave\ssome\shelpful\sinformation\son\sthe\sintranet\sregarding\semail\ssettings|If\syou\sdon\'t\sverify\syour\swallet,\syour\swallet\swill\sbe\srestricted|Your\sAccount\swas\sjust\ssigned\sin\sto\sa\snew\sdevice|Your\saccount\srequires\sverifying\ssome\sinformation|Update\sVersion\s2023|Important\sService\sNotification|Please\sFollow\sthis\ssteps\sto\sconfirm\sit|CLICK\sHERE\sTO\sUNBLOCK|Keep\sSame\sPassword|Confirm\sYour\sEmail\sHere|Unable\sto\ssynchronize\s\[0-9]\]\sincomming\smails\sto\syour\saccount|My\sGreetings\sto\syou|suspended\sfrom\sthe\sonline\smaintenance\sservice\sdatabase|Here\x5C\x27s\sthe\sdocument\sthat\s[a-z0-9.\-]+\.[a-z0-9.\-]+\sshared\swith\syou\.|A\scaller\sin\syour\sdirectory\sjust\sleft\syou\sa\smessage\.|has\sfailed\sto\sdeliver\s\[0-9]\]\snew\semails\sfrom\ssome\sof\syour\scontacts|All\semail\smessages\sin\syour\spersonal\sQuarantine)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY3 nosubject body T_JR_CLOUDSPLOIT_BODY4 /(^|\b|\s)(Please\scheck\sand\sarrange\sthe\sProforma\sinvoice\sfor\sremittance|confirm\sthat\syou\scan\smake\slarge\ssupply\sof\sthe\sexcel\sorder|Kindly\srefer\spayment\sdetails\sas\sper\sattached\sand\splease\sproceed\sour\sorder\sasap|Follow\sbelow\sto\skeep\syour\scurrent\spassword\sand\savoid\sdata\sloss|Please\sstudy\sDocument\sproperly\sfor\scontract\smeeting\spresentation|documents\shas\sbeen\sshared\swith\syou\son\s[a-z0-9._\-]+\@[a-z0-9.\-]+\sSharepoint\sStorage|[a-zA-Z0-9.\-]+\.[a-z0-9.\-]+\sE\-mail\sSync\sFailure\.|The\smailbox\scan\sno\slonger\ssend\sor\sreceive\smessages\.|[a-z0-9._\-]+\@[a-z0-9.\-]+\smail\sbox\sis\sfull\.|We\sdiscovered\sunusual\sactivities\son\syour\saccount\.|One\sTime\sPassword\sAuthentication\sRequired|[a-zA-Z0-9.\-]+\.[a-z0-9.\-]+\s\sManagement\swould\slike\sto\sshare\san\supdate|Listen\sto\syour\sbusiness\sVoicemail\sMessage|We\shave\sput\sa\stemporary\shold\son\syour\saccount\sactivities\still\syou\sverify\sand\svalidate\syour\saccount|American\sExpress\sCustomer\sService\sTeam|Stop\sSnoring\sAnd\sSleep\sApnea\sProgram|Kindly\suse\sbelow\sto\srelease\spending\smessages|Email\sVerification|VERIFY\sYOUR\sEMAIL\sACCOUNT|Click\sTo\sVerify|your\swallet\shas\snot\syet\sbeen\sverified|unable\sto\svalidate\syour\sbilling\sinformation|Review\s\&\sResolve\sthis|Outlook\sVoice\sAccess)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY4 nosubject body T_JR_CLOUDSPLOIT_BODY5 /(^|\b|\s)(we\'ll\ssuspend\syour\smembership\sif\swe\sdo\snot\sreceive\sa\sresponse\sfrom\syou|Your\saccount\shas\sbeen\sput\son\shold\.|Kindly\slogon\sbelow\sto\sverify\syour\sidentity|Your\sdomain\sserver\s\(DNS\)\sdefault\smust\sbe\sRestored|Unlock\sMessage|you\smay\snot\sreceive\snew\smessages\sif\sno\saction\sis\staken|View\sall\sdocuments\sbelow|You\shave\sunread\sdocuments\sin\syour\sDropbox|Security\srisk\sfor\syour\semail|(AUTO\-EXPAND|UPDATE)\sSTORAGE|Email\sDeactivation\sNotification|cancel\sthe\srequest\simmediately\susing\sthe\sCancel\sDeactivation\sbutton\sbelow|Continue\sWith\sSame\sPassword|use\sthe\sbelow\sbutton\sto\scontinue\susing\sthe\ssame\spassword|[0-9]\spending\ssent\smessages\scouldn\'t\sbe\sdelivered|Click\shere\sto\sview\sundelivered\ssent\smessages|Your\sbest\sMail\sService|Email\sCredentials\sMust\sbe\sValid\sto\sensure\syou\sare\sthe\sright\sRecepient|This\smails\shas\sbeen\sscaned|Some\sinformation\son\syour\saccount\sappears\sto\sbe\soutdated\sor\sincorrect|Your\saccount\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\shas\sexperienced\san\sabnormal\slogin\srecently|Login\sproduct|Log\sin\stime|Cpanel\sWarning\sService|COMPLETE\sVERIFICATION|Private\sEmail\ssoftware\supgrade|Please\sconfirm\syour\semail\saddress\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8})(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY5 nosubject body T_JR_CLOUDSPLOIT_BODY6 /(^|\b|\s)(Server\sAdministrator\s\|\sIT\sSupport|within\syour\s\s?mailbox\sportal|Confirm\sYour\sEmail\sHere|Mail\sService\sTeam|DOWNLOAD\sYOUR\sEMAILS|ACCOUNT\sNOTIFICATION|NEW\sDOMAIN\sUPDATE|Do\snot\sreply\,take\saction\!|READ\sBLOCKED\sMESSAGES|You\sCan\sRead\sthese\sMail\sMessage\(s\)\sfrom\syour|NOTE\:\sYou\sHave\s\sBlocked\sIncoming\sMessages|A\snew\spassword\swill\sbe\sgenerated\sby\sthe\ssystem|Your\sVoice\sEncrypted\sMessage|Listen\sVoice\sMail|Control\sPanel\sStorage\sAlert|Mail\sSystem\sAdministrator|Kindly\sclick\son\sUpdate\sAccount|continue\swith\syour\sonline\sservicing\srequest|your\saccount\swas\saccessed\sby\san\sunauthorized\sthird\sparty|Thank\syou\sfor\syour\sCard\sMembership|It\xE2\x80\x99s\stime\sto\supgrade\syour\saccount|View\sDelayed\sIncoming\sMails|RE\-ENA\xC2\xADBLE\sPAS\xC2\xADSWORD\sNOW|Pas\xC2\xADsw\xC2\xADord\swi\xC2\xADll|e\xC2\xADxp\xC2\xADire\sin\s(2\xC2\xAD4)Ho\xC2\xADurs|Email\sAdministrator|Your\ssubscription\ssuspended|UPDATE\sPAYMENT\sINFORMATION|Releases\sthe\scurrent\squarantined\semail\son\shold\sto\syour\sinbox|email\ssecurity\sservice|Quarantine\sReport|ask\sthe\ssystem\sadministrator\sto\supgrade\syour\saccount\sto\sa\slarger\squota|RETRIEVE\sACCOUNT\sNOW|Action\srequired\sFix\sthis\sbelow|Prevented\smessages\s\([0-9]{2}\)|Take\sAction\sNow|use\sthe\sbutton\sbelow\sto\sfix\sthis\serror)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY6 nosubject body T_JR_CLOUDSPLOIT_BODY7 /(^|\b|\s)(You\scan\scontinue\susing\syour\scurrent\spassword\.|System\swill\slog\syou\sout\sand\sgenerate\sa\snew\spassword\sexactly\sat|Message\:\sPlease\sreview\scontract\sdocuments\sfor\syour\ssigning|Upgrade\sto\sthe\slatest\sversion|Please\scheck\sif\syou\shave\sany\simportant\semails\sin\squarantine\.|CLICK\sHERE\:\sUPDATE\sSTORAGE|Update\syour\sstorage\sbelow|DELIVER\sALL\sMAILS|\x22\sinfo\s\x22\sWe\sreceived\sa\srequest\sto\sclose\syour\semail\saccount|To\sview\syour\ssecure\smessage\:|this\scan\sstop\sincoming\semails\sfrom\sarriving|Use\sthe\slink\sbelow\sto\sget\smore\sfree\sspace|you\scan\sresolve\sthe\sstorage\sissue\sbelow|Expiry\sNotice|Immediate\sAttention\sNeeded\!|Your\smailbox\sis\salmost\sfull\.|Due\sto\sso\smany\sfailures\,\sthis\sis\sa\sfinal\snotice|going\sto\sclose\sall\saccounts\sthat\shave\sbeen\sinactive|LinkedIn\sCorporation|You\shave\sreceived\sa\snew\sfile|AUTHENTICATE\sACCOUNT\sHERE|Please\sindicate\sif\syou\sare\sstill\susing\sthis\smailbox|I\'m\sstill\susing\smy\semail|please\sstop\smy\semail|your\saccount\swill\sbe\sdisconnected\sif\syou\sdo\snot\sconfirm\syour\semail\snow|Reply\sBusiness\sInvite|pending\smessages\son\sIMAP\s?\/\s?POP\semail\sSettings|Please\sFix\sIt\sBelow|Review\sMessages|WeTransfer\sFile\sSharing\sService|EMISI\xC3\x93N\sDE\sCOMPROBANTES)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY7 nosubject body T_JR_CLOUDSPLOIT_BODY8 /(^|\b|\s)(You\swill\sbe\sbriefly\ssuspended\sfrom\ssending\sand\sreceiving\smessages|Track\sMy\sShipment\sNow|Webmail\sFile\sServer|file\sshared\sin\sWebmail\sFile\sServer|Go\sto\sstorage\sSettings|continue\swith\sthe\scurrent\spassword|You\shave\s[0-9]{1,2}\sdelayed\smessages\sto\syour\smail|kindly\s\s\s\sResolve|System\smailbox\,\splease\sdo\snot\sreply|the\slink\sbelow\sto\sdownload\sthe\se\-invoice\sfor\smore\sdetails|Just\sreply\sthrough\sfiverr\sand|Review\/Respond\sto\sinqury|verify\stheir\swallets\sin\sorder\sto\scomply\swith\sKYC\sregulation|You\sare\smissing\sout\son\stons\sof\straffic|Kindly\suse\sthe\sreview\stab\sabove\sto\sfix\sissue\sand\srepair\smailbox\simmediately|help\syou\sdevelop\sa\sdigital\smarketing\sstrategy|Sign\sin\sto\sa\sCRA\saccount|contact\sthe\sTax\sRefund\sHelpline|message\sme\son\sfiverr\slets\sdiscuss|View\sYour\seMessage|Release\sPending\sMessages|Kindly\sclick\sbelow\sbutton\sto\srelease\smessages|Identify\sif\syou\sare\sstill\san\sactive\suser\sto\savoid\sdisconnection|NOTE\:\sIF\sYOU\sUSE\sWRONG\sPASSWORD|show\syou\show\swe\scan\sgenerate\smore\scalls\sand\sleads\sfor\syour\sbusiness|this\sacc\xC2\xADount|Unlock\sthe\sSecrets\sto\sSkyrocketing\sYour\sOnline\sSales|NOTE\:\sTo\sview\syour\sorder\,\splease\sdownload\syour\sinvoice\sfrom\sthe\sattachment)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY8 nosubject body T_JR_CLOUDSPLOIT_BODY9 /(^|\b|\s)(eV\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFoi\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFce\sPo\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFrt\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFal|kindly\suse\sthe\sportal\sbelow\sto\sauthenticate|Re\-authenticate\syour\ssession|You\shave\sreceived\sa\sFile\son\sOneDrive\sfor\syour\sreview|Here\sis\sthe\sseller\'s\sdisclosure\sbelow|LinkedIn\sNew\sMessage\sNotification|Reply\sImmediately|To\sView\sIncoming\sSuspended\sMessages|You\shave\s\([0-9]\)\sSuspended\sincoming\smessages|kindly\suse\sthe\sbutton\sbelow\sto\skeep\susing\syour\scurrent\spassword|UPDATE\sAND\sCONTINUE\sUSING\sYOUR\sACCOUNT|failure\sto\supdate\scan\scause\spermanent\sDe-activation\sif\syou\sdo\snot\sverify|Mail\sMaintance\sTeam|must\sbe\sput\sup\-to\sdate\sand\sverified\sotherwise\syour\semail\saccount\swill\sbe\spermanently\sclosed|RESGATAR\sAGORA|Quanto\smais\spontos\smelhor|Your\smailbox\sstorage\shas\sexceeded\sits\slimit|You\shave\s[0-9]{2}\sReceived|messages\sin\syour\sVoiceMail\sbox|look\sfor\san\supdated\semail\sor\sVerify\syour\semail|InqtGMncDvoice\sworking\sonly\son\sPC\/Desktop|DownsDgOxdyload\syour\sinvooneAnVwice|view\syour\sorpAusvKder|Save\sand\sopen\sview\syour\smessage\s\(document\)|Turn\son\spush\snotifications|RESOLVE\sERROR\sNOW|Play\sAudio)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY9 nosubject body T_JR_CLOUDSPLOIT_BODY10 /(^|\b|\s)(Get\syour\sfile\shere|Upgrade\sMailBox\sApp|KLICKEN\sSIE\sHIER|We\snotice\stoo\smany\swrong\slogin\sattempt\son\syour\swhich\sput\sa\slock|Quarantine\sInbox|Send\sunlimited\semails\sand\screate\semail\scampaigns|payment\sapproval\slist\sby\sthe\sBoard\sOf\sDirectors|Open\sContract\sHere|VIEW\sYOUR\sDOCUMENT\sBELOW|Update\s&\sVerify\sNow|To\savoid\saccount\sshutdown\skindly\sverify\syour\smailbox|to\snotify\syou\sof\simportant\schanges\sto\syour\semail\saccount\sand\sservices|keep\sthe\ssame\spassword|Check\sactivity\s\/\ssecure\syour\saccount|Your\semail\sservice\smay\sbe\sinterrupted\suntil\syou\sverify\syour\saccount|Your\saccount\spassword\sexpires\son\sour\ssystem\sToday|Pls\sfind\sattached\sour\sPurchase\sOrder|You\scan\slog\sin\susing\sthe\slink\sprovided\sbelow|UPDATE\sYOUR\sACCOUNT\sNOW|Use\sthe\sbutton\sbelow\sto\skeep\scurrent\spassword|Keep\sCu\xD0\xB3\xD0\xB3ent\sPassw\xD0\xBE\xD0\xB3d|Retrieve\sEmails|E\-mail\sSecurity\sTeam\.|shared\swith\syou\son\sSharepoint|Notification\sof\sQueued\sMessage|Keep\sor\schange\sthe\scurrent\spassword\shere|Assistance\sfor\sYour\sWebmail|Review\syour\ssession\sbelow\sto\sretrieve\sthe\sblocked\semails\simmediately|Secured\sDocument\sAttached|shared\([0-9]\)\sdocument|Keep\s\-\sPassword|View\sinvoice|Update\sSecurity\sToken|STAY\sPREMIUM)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY10 nosubject body T_JR_CLOUDSPLOIT_BODY11 /(^|\b|\s)(To\savoid\sinterruption\sof\suse\sof\syour\semail\sbox|You\sha\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFve|a\sn\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFew|v\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFoicenote|mes\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFsa\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFge|Lis\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFten\sn\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFow|OneDrive\srecycle\sbin|ChatGPT\-powered\sApp\sSuite|Mail\sInc\s\xC2\xA92023|Failure\sto\scarry\sout\sany\sof\sthe\sabove\soperations\swould\scause\syour\semail\sto\smalfunction|Incoming\sFailed\sMessages|For\ssecurity\spurposes\,\syou\smust\senter\sthe\scode\sbelow\sto\sverify\syour\saccount\sto\saccess|WebmailJTeam|receiving\sand\ssaving\sof\smessages\swill\sbe\sdisallowed|one\stime\spassword\sconfirmation\sis\srequired|This\sfeature\sis\sonly\savailable\son\sdesktop\/laptop\scomputers|PaymMhhYpsVzents\sSupnkqFwzTport\sTeMqEvkdZam|You\'ve\sreceived\san\sencrypted\smessage\sfrom|Follow\smy\spackage|Your\spackage\sis\swaiting\sfor\sdelivery|current\sterms\sand\sconditions\swill\sbe\supdated\sto\scomply\swith\sthe\slatest\sregulations|You\shave\sreceived\s[0-9]{1,2}\sincoming\sfax\sdocuments?|Voicemail\sNotice|Voice\sMessenger|SEE\sDOCUMENT|Keep\sMy\sPassword)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY11 nosubject body T_JR_CLOUDSPLOIT_BODY12 /(^|\b|\s)(Some\sof\syour\sincoming\smails\shave\sbeen\sput\son\shold\sin\sthe\semail\sserver|To\sreceive\syour\spending\smail\son\sthis\saccount\sproceed\sbelow|Approve\sHere\sAnd\sFree\sStorage\sSpace|To\scontinue\susing\sthis\semail\saddress\swe\surge\syou\sto\sre\-confirm|you\shave\sbeen\sdisconnected\sfrom\ssending\sand\sreceiving\semails|Outlook\sBusiness\sVoice|Please\sclick\shere\sto\sconfirm\syour\sSign\-in|Info\sis\sCorrect|View\sEligibility|press\sAccept\sto\scontinue\swith\scurrent\spassword|ACCEPT\s\-\sCONTINUE|RESOLVE\sERROR\sNOW|Click\sbelow\sto\scontinue\swith\sthe\ssame\spassword|update\syour\ssecurity\stoken\susing\sthe\sbutton\sbelow|Confirm\sIdentity|Online\sBanking\sTeam|Bradesco\sFidelidade|Secure\sMy\sAccount|New\sOnline\sAlert|DOWNLOAD\sAND\sACKNOWLEDGE\sNOW|We\skindly\srequest\syour\sattention\sto\sdownload|View\sFile\sNow|KEEP\sMY\sSAME\sPASSWORD|QuickBooks\sOnline\sPayroll\sPremium|Resubscribe|Please\scomplete\sthe\sverification\sprocess|Complete\sVerification|CONFIRM\sAUTHENTICATION|access\sto\syour\smailbox\swill\sbe\srestricted|avoid\smailbox\slogin\srestriction|confirming\syour\semail\saddress|Confirm\sEmail\sAddress|going\sto\sbe\sa\sshutdown\son\severy\semail\saccount\squota|New\sDATABASE\sADMIN|Validate\sAccount\sInformation|Password\sExpiration\sNotice|locked_out)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY12 nosubject body T_JR_CLOUDSPLOIT_BODY13 /(^|\b|\s)(received\s\([0-9]\)\snew\svoicemails?\sfrom\syour\scontact|2023\sEmail\sserver|Main\xE2\x80\x8Ctain\syour|We\srecently\sdetected\san\sunusual\sactivity|suspend\syour\sonline\sbanking|complete\syour\sonline\senrollment|Con\sway\sfirm\sIdentity|con\sbusiness\sfirm\syour\sac\sstation\scount\sinformation|act\selection\sivity\sin\syour\sac\sinstead\scount\sthat\sseems\sunu\sfuture\ssual|On\sstructure\sline\sBa\schallenge\snking\sTeam|Voicemail\sMessage\sReceived|someone\sin\syour\sphonebook\scontact|PLAY\sMESSAGE|UNLOCK\sEMAIL\sACCOUNT|kindly\sfind\sattached\sthe\slist\sof\sthe\sproducts\sand\squote|Email\sAccount\sSettings|Restart\syour\smembership|GET\sINSTANT\sACCESS|enclosed\sdetailed\sinquiry|information\scontained\sin\sthis\scommunication\sfrom\sthe\ssender\sis\sconfidential|Please\sreview\sand\ssign\san\sinvoice|Current\sCash\sOffer|CLICK\sTO\sDOWNLOAD|ATTACHED\sQUOTE\s\&\sINVOICE|If\syou\shaven\'t\sset\sup\semail\sforwarding\,\scancel\sbelow|Cancel\sForwarding|INCOMING\sDOCUMENTS\ssent|Your\sZelle\xC2\xAE\smoney\sis\spending|Dear\smember|Verify\snow|detected\ssomething\sunuusual|files\svia\swetransfer|your\s\s?mail\sservice\shas\sbeen\swithheld\sand\sLimited|You\shave\sa\sNew\sSecure\sFile\sMessage\sReport|ACCESS\sFILES|2023\sDHL|Verify\syour\saccount\snow|Rectify\sNow|your_account)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY13 nosubject body T_JR_CLOUDSPLOIT_BODY14 /(^|\b|\s)(send\sme\syour\scurrent\sprice\slist\svia\slinkedin\snetwork|received\sa\snew\sscanned\sdocument|PaymentCopy_scan\d{4,5}\.pdf|staff\smemo\sreferring\sto\sthe\sabove\ssubject|Annual\sVacation\sPlan|Annual\sLeave\sPlan|sharepoint\sportal|important\sfinancial\sdocument\shas\sbeen\scompleted|Enjoy\sBenefits\sSuch\sAs|Thank\syou\sfor\susing\sThis\sService|Please\sstudy\sdocuments\sproperly\sfor\syour\sconfirmation|documents\shas\sbeen\sshared|No\sFurther\saction\sis\srequired\sof\syou|New\sPayment\sfor\spending\sinvoice|Show\sme\spayment\sdetails|appears\syou\sare\syet\sto\scomplete\syour\saccount|You\sreceived\sa\snew\stransfer|Please\slog\sback\sin\shere\sto\sretrieve\syour\smessages|cPanel\sMailbox\sHousekeeper|You\shave\s\d\snew\sitem\(s\)\sfor\syour\sattention|Open\sDocument|Confirm\sShipping\sAddress|RESOLVE\sMESSAGES\s\([0-9]\)|Click\son\sResolve\sMessages\s\([0-9]\)|Your\sshipment\shas\sarrived|your\sincoming\smessages\sare\squeued\sup\sand\spending\sdelivery|reference\son\sthe\slist\sof\srequired\sitems|REQUEST\sFOR\sQUOTATION|Your\sCredit\sHas\sBeen\sApplied|Protect\smy\saccount|suspend\syour\sAccount\'s\sOnline\sAccess|verify\sand\supdate\syour\sdetails|An\serror\soccurred\,\sbut\sit\shas\sbeen\sfixed|Payoff\sLetter\s\&\swire\sinstructions\.pdf|WebAdmin\ssupport|action_is_ignored)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY14 nosubject body T_JR_CLOUDSPLOIT_BODY15 /(^|\b|\s)(SharePoint\sshared\swith\syou|Failure\sto\sconfirm\smight\slead\sto\sclosing\syour\smailbox|continue\susing\sthe\ssame\spassword|Verify\syour\semail\saddress|confirm\sownership\sof\sthe\semail\saddress|ANALYZE\sDOCUMENTS|sent\syou\sa\sdocument\sfor\sanalysis\sand\ssignature|Adobe\sDoc\sSecurity\sShared\sFile|You\shave\sreceived\sa\ssecure\sPurchase\sOrder|\(Action\sRequired\!\)|Authenticate\sYour\sAccount|Review\sYour\sProposal\sby|have\s\([0-9]\)\simportant\sincoming\semails|Release\spending\semails|Banco\sBradesco\sS\/A|You\sHave\sa\sNew\sMessage|VIEW\s\/\sDOWNLOAD\sDOCUMENT|SERVER\sNOTIFICATION|For\smore\sdetails\,\splease\slog\sin\syour\swebsite|please\slogin\sand\sconfirm\sownership|new\sEncypted\sEmail\sMessage\sin\syour\smail\sbox|VIEW\/READ\sEncrypted\sMessage|Account\sRisk\sAlert|Appeal\sRight\sNow|Your\sswift\sattention\sis\scrucial|Account\sCancellation\sRequest|Start\srefusjon|We\shave\sreceived\sa\stermination\srequest\sat|Account\sCancellation\sRequest|removal\sfrom\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\srequested\son|GET\sYOUR\sSUBSCRIPTION|our\sservices\swill\sbe\stemporarily\srestricted|QuickBooks\sTeam|please\ssend\sa\smessage\son\sWhatsApp\sor\semail|Kindly\s\s?Review\s\s?Document|Your\sWallet\sis\sabout\sto\sbe\ssuspended|Apply\sfor\sKYC\sVerification|78w1r4|Fix\sThis\sError\sNow)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY15 nosubject body T_JR_CLOUDSPLOIT_BODY16 /(^|\b|\s)(VERIFY\sYOUR\sWALLET|complete\sKYC\sverification|please\sconfirm\syour\sidentity\sand\sseek\sa\sreview|ACTION\sREQUIRED|your\saccount\shas\sbeen\slocked|your\sservices\sare\ssuspended|Renew\syour\sBilling|verify\sthat\sthis\sis\syour\semail\saddress\sbefore|Bekrefte\sprofil\sinformasjonen\sdin\.|KYC\sverification\sprocess|Account\sSuspension\sNotice|Proceed\sto\sVerification|2023\sPayment\sAudit|You\sHave\sMissing\sFiles|Review\sYour\sProposal\sNow|Confirmar\semail|Please\ssee\sand\sreview\syour\sdocument|View\sPDF\sDocument|Your\siCloud\sStorage\sIs\sFull|Notificacao\sde\sAudiencia|Excel\sfiles\shave\sbeen\sshared\swith\syou|have\sblocked\ssome\sof\syour\semails\sfrom\sreaching\syour\sinbox|your\smailbox\sis\stemporarily\ssuspended|your\soutgoing\semails\swill\snot\sdeliver\sto\sthe\sreceiver|please\sclick\shere\sto\sunblock\syour\saccount|Important\s2023\sTax\sDocument|aktivere\skontoen|oppdaterer\sinformasjonen\shvert|click\sthe\slink\sbelow\sto\supgrade\syour\siCloud\sstorage\splan|iCloud\sSupport\sTeam|Kundeservice\sVipps|Update\sPayment\sInformation|To\supdate\sthe\sdefault\spayment\smethod\sor\schoose\sa\snew\sone|Your\sAmazon\sPrime\sMembership|Click\shere\sto\sview\sStatement|Oppdater\sbetalingsm\xC3\xA5ten|Download\sFile\(s\)|Justicia\sdel\sTrabajo|shared\sthe\sfolder\s\"INVOICE\"\swith\syou)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY16 nosubject body T_JR_CLOUDSPLOIT_BODY17 /(^|\b|\s)(require\sall\sclients\sto\sre\-login\sand\sreactivate|Foresporsel\som\stilbakebetaling|Hello\.\sAnd\sBye\.|have\s\([0-9]\)\sincoming\spending\smessages\sfrom|messages\swere\sheld\sdue\sto\slow\semail\sstorage|Please\sclick\sto\sretrieve\sMessages|tap\sthe\sbutton\sbelow\sto\saccess\syour\saccount|you\ssuccessfully\sregistered\san\saccount\sin\sour\ssystem|Important\sSecure\sMessage\sRegarding\sYour\sAccount|been\sshared\svia\sSecureMessage|This\sis\san\sautomated\.|Mail\-Server\sBlocked\s[0-9]\sincoming\smessages|Fix\serrors\sor\syour\saccount\swill\sbe\ssuspended\.|required\sto\supdate\stheir\sinformation\sto\sthe\snew\ssecurity\ssystem|verify\sthat\syour\spayment\saccount\shas\ssufficient\sfunds\sfor\syour\srenewal|read\syour\sSecure\sMessage\sbecause\sit\scontains\sspecific\sinformation\sabout\syour\saccount|You\shave\sreceived\sa\snew\ssecure\smessage\sin\syour\sprivate\sinbox|You\shave\sreceived\s1\smessage\(\-s\)|Once\sthe\sfee\sis\spaid\,\swe\swill\sbe\sable\sto\sdeliver\sthe\sparcel|Follow\-my\-parcel|Ministerio\sde\sla\sJusticia|Reactivate\sMailbox|Your\smailbox\sis\sno\slonger\sactive\son\syour|[0-9]{1,2}\spending\smessages\sfor\sdelivery\sto\syour\smailbox|INCOMING\sE\-MAILS|[0-9]\sIncoming\sE\-mails\sBlocked|recent\srequest\sto\sdeactivate\syour\semail\saccount)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY17 nosubject body T_JR_CLOUDSPLOIT_BODY18 /(^|\b|\s)(Skjema\sfor\srefusjon\sher|Kindly\sfind\sthe\sattached\sAnnual\sAppraisal\sPerformance\sin|Director\sof\sHuman\sResources|Notice\son\sfailure\sto\supdate\syour\sclient\sdetails\syou\shave\snow\sbeen|Vous\savez\s5\se\-mails\smis\sen\squarantaine|Lire\sles\smessages|2024\sroundcube\sMail|To\sview\sthe\sencrypted\smessage\sfrom\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|your\sincoming\smails\shave\sbeen\ssuspended|Proceed\sbelow\sto\sreceive\syour\spending\smail\son|RECEIVE\sMAILS|Email\sAccount\sExpiry\sNotification|Your\semail\saccount\sis\sabout\sto\sexpire|Your\saccount\shas\sbeen\slocked|Click\sHere\sTo\sUnlock\syour\saccount|You\shave\s[0-9]\snew\smessages\sin\syour\semail\squarantine|View\squarantine\smessage|Deliver\sall\smessages|(welcome\syou|click\sthe\sbutton\sbelow)\sto\s(sign|log)\sin\sto\syour\saccount|Your\sscore\shas\sbeen\sreleased\sfor|please\spress\sthe\sbutton\sbelow|message\sregarding\sthe\swithdrawal|You\'ve\sreceived\san\sencrypted\smessage|Be\som\srefusjon\sav\sfakturabelopet\sved\sa\sklikke\spa\slenken\:|Foresporsel\som\srefusjon|your\saccount\srequires\sa\sfull\sprofile\supdate|Cancel\sRequest\s\-\sFriendly\sReminder|Update\sof\syour\saccounts|Schedule\sdelivery\snow|Please\saddress\sthe\sinstructions\spromptly|Oppdaterer\sdata|password_is\sset|Hi\,\sI\swanted\sto\sconfirm\swhen\stransfer\s\s?payment|to\sconfirm\syour\sidentity\,\santicipate\sreceiving\sa\sone\-time\scode|Continue\sHere)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY18 nosubject body T_JR_CLOUDSPLOIT_BODY19 /(^|\b|\s)(email\saddress\srequires\sconfirmation|confirm\syour\semail\saddress\simmediately|Thank\syou\sfor\ssending\sus\sthis\sproposal|Immediate\sVerification\sRequired|Kindly\svisit\sattach\sto\sconfirm\sDocuments\sreceipt|Extend(ed)?\sfor\sFree|You\scan\saccess\stax\sinvoice\swith\sbelow\slink|Kindly\ssign\sand\sstamp\syour\sattached\scompany\sCustom\sTax\sDocs|K\xD0\xB5\xEF\xBB\xBF\xEF\xBB\xBF\xD0\xB5\xEF\xBB\xBF\xEF\xBB\xBFp\sM\xEF\xBB\xBFy\s\xD0\xA0\xEF\xBB\xBF\xEF\xBB\xBF\xD0\xB0\xEF\xBB\xBF\xEF\xBB\xBFss\xEF\xBB\xBFw\xEF\xBB\xBF\xEF\xBB\xBFor\xEF\xBB\xBFd|Be\som\sdin\srefusjon|new\sdocument\sto\sreview\sfrom\sadmin\sportal|VIEW\sCOMPLETED\sDOCUMENT|Please\sExamine\sThe\sProposal\sAt\sHand|You\shave\s[0-9]\sUnreceived|invoice\shas\sbeen\sgenerated\sfor\sUSD\s[0-9]{3}\.[0-9]{2}\sunder\syour\saccount|Read\sUndelivered\sEmails\sbutton|Employee\sBonus\sPayout\sform|FILL\sOUT\sFORM|Incoming\sMessages\sBlocked|VIEW\sYOUR\sINCOMING\sMESSAGES|[0-9]\sIncoming\sMessages\sBlocked|DELIVER\sALL\sMESSAGES|You\shave\s[0-9]\snew\spending\smessages|The\sdelivery\sof\smessages\swas\sstopped|To\sView\sIncoming\sSuspended\sMessages|request\syou\sto\sre\-validate\syour\sidentity|KEEP\sMY\sPASSWORD|encourage\syou\sto\stake\sthe\stime\snow\sto\smaintain\syour\spassword\sactivity|server\shave\srestricted\ssome\sincoming\smessages|so\sheld\semails\scan\sbe\sreleased\sto\syour\sinbox|account\shas\sbeen\slocked\sand\sunder\sreview\sfor\ssecurity\scheck|upgrade\shere\>\>)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY19 nosubject body T_JR_CLOUDSPLOIT_BODY20 /(^|\b|\s)(Authorize\sdelivery\sof\spending\smails|Report\serror\sto\san\sIT\sHelp\sDesk|Revolutionary\sbreakthrough|Find\sattached\sdocuments\sfor\sshipment\.\sEUR1\sand\sComm\.\sInvoice|CHAT\sNOW|Read\sMail\sNow|GO\sTO\sPRIVATE\sCHAT|update\syour\saccount\sinformation\susing\sthe\ssecure\sbutton\sprovided\sbelow|Activate\s2FA\sNow|Outgoing\sMail\sError|Release\sEmails|Use\sthe\slink\sbelow\sto\skeep\saccount\spasswords|Action\sis\srequired\sbefore\send\sof\stoday|Microsoft\sOutlook\sInc|keep\sor\supdate\scurrent\scredentials|Keep\sor\sUpdate|immediate\ssteps\sto\smaintain\sand\savoid\srestricting|Please\sfind\sthe\sattached\s\s?PURCHASE\sORDER\sFROM|KEEP\sSAME\sPASSWORD|Keep\sCurrent\sPassword|email\spassword\shas\sreached\sits\sexpiration|Account\sSecurity\sCheck|Click\shere\sto\skeep\syour\spassword|To\sretain\syour\sexisting\spassword\,\sclick\son\sthis\sbox|Keep\sCurrent\sCredentials|Password\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\sauto\sexpires\stoday|Read\sMessages|review\syour\ssecurity\sactivity|validate\syou\sare\sthe\sowner\sof\sthe\saccount|Show\smy\smessages|Kindly\sReview\sbelow|VIEW\sDOCUMENT|email\saccount\sis\snearly\sfull|Please\sclick\sbelow\sto\sfill\sout\sthe\snecessary\sdocuments\sand\skeep\srecords|Please\sreview\sthe\sdocument\sin\sOneDrive)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY20 nosubject body T_JR_CLOUDSPLOIT_BODY21 /(^|\b|\s)(Secure\sEmail\sAddress|password\sexpires\stoday|\xD0\xB0v\xD0\xBEid\sem\xD0\xB0il\sacc\xD0\xBEunt\sdi\xD1\x95\xD0\xB0bility|m\xD0\xB0ilbox\sacc\xD0\xB5\xD1\x95\xD1\x95\sr\xD0\xB5\xD1\x95triction|quarantined\smessages\sin\syour\squarantine\sportal|below\slink\sto\slogin\sto\syour\semail\sportal|I\shope\sthis\semail\sreaches\syou\swell|Your\saccount\spassword\sexpires|to\scontinue\swith\sthe\ssame\spassword|link\sbelow\sto\srelease\sit\sall\sto\syour\sinbox|cPanel\s(Security|Gateway)|REVIEW\sDOCUMENT|Attached\svia\swith\sLink\sbelow\,\syou\swill\sfind\san\sExcel\sdocument|review\s\s?our\sRevised\sP\.O|Please\sRectify\sthe\sProblem\sBelow|Listen\sto\sMessage|Voicemail\sAccess\sNumber|individuals\swhose\semployments\/contracts\shave\sbeen\sterminated|exclude\sall\sthe\saffected\semployees\sfrom\sall\semail\scorrespondences|documents\shave\sbeen\suploaded\sto\syour\sOneDrive\sStorage|account\sownership\swill\sbe\sfully\srestored\safter\sverification|[0-9]\sInbound\sQuarantine\sEmails|VIEW\sMESSAGES\sLOG|log\sin\sto\sthe\sKYC\sportal\susing\syour\scredentials|Click\sto\sReview\sTimesheet|confirm\syour\saccount\sdetails\sfor\spayment\.|Click\shere\sto\sview\syour\sinvoice|click\sOpen\sMessage|New\sSecure\sMessage|account\sstorage\scapacity\shas\sbeen\sexceeded|Save\sto\sOneDrive)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY21 nosubject body T_JR_CLOUDSPLOIT_BODY22 /(^|\b|\s)(please\sclick\sthe\sbutton\sbelow|manually\supdate\syour\smailbox\spreference\ssettings|encourage\syou\sto\ssign\sin\sto\sreview\sthese\schanges\scarefully|we\ssuggest\syou\simmediately\ssecure\syour\saccount|A\snew\ssign\-in\son\syour\sEMail|see\sattached\sand\sconfirm\sthe\sclosing\ssettlement\sis\sapproved|Use\sCurrent\sCredentials|update\syour\scurrent\scredentials\sbelow|Approved\sInvoice\sDocuments|Payment\sready\sto\sbe\sdeposited|RESGATAR\sPONTOS|Tin\snh\xE1\xBA\xAFn\s\xC4\x91\xE1\xBA\xBFn\sb\xE1\xBB\x8B\sch\xE1\xBA\xB7n|Email\sSecurity\sPowered\sby\sVoltage|Excel\sfile\sFor\syour\sAttention|Continue\sUsing\sSame\sPassword|continue\susing\ssame\ssecure\stoken|Kindly\sverify\syour\semail\saddress|IMAP\/POP3\sand\sSMTP\srequires\sverification|Stay\sConnected\sWith\sMy\sPassword|ensure\syour\saccount\sis\snot\sfurther\scompromised|validate\syou\sare\sthe\sowner\sof\sthe\saccount|Pending\sDocument\svia\sSharePoint\sServer|RE\-ACTIVE\sSAME\sPASSWORD|has\sreceived\sa\sprotected\smessage|Microsoft\sPurview\sMessage\sEncryption|Email\sServer\sUpdate|all\sincoming\semails\swill\snow\sbe\srejected|STAY\sWITH\sTHE\sCURRENT\sPASSWORD|new\sinquiry\sawaiting\syour\sresponse|Open\sin\sExcel|Download\sDocument|New\sDocument\sInvitation|Re\-Active\sSame\sPassword|EFT\sDelivery\sReport)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY22 nosubject body T_JR_CLOUDSPLOIT_BODY23 /(^|\b|\s)(access\sa\snew\sdocument\sshared\swith\syou\svia\sOffice365|You\sreceived\sa\spayment\sfrom|CLICK\sHERE\sTO\sORDER\sNOW|Here\'s\sthe\sdocument\sthat\sHR\sDepartment\sshared\swith\syou\.|Sen\xC2\xAD\xC2\xADd\sand\srecei\xC2\xADve\sfiles\sfrom\sanywhere\susing\syour\scomputer\,\stablet\sor\ssmartphone|Your\sQuickBooks\saccount\shas\sbeen\srestricted|The\sonline\sverification\smust\sbe\scompleted\sbefore\sit\sexpires|Verify\sOwnership\sNow|Follow\sbelow\sportal\sto\sverify\sownership|Please\sreview\sthe\sattached\sdocument|We\sreceived\sa\srequest\sto\sofficially\ssuspend\syour\saccount|will\sstop\ssending\sand\sreceiving\semails\sif\snot\sverified\swithin\s[0-9]{2}hrs|Go\sthrough\sthe\slist\sabove\sand\sconfirm\syour\snew\ssalary\sinformation|Payroll\sAdministrator\sManager|endless\spossibilities\swith\sSuper\sForce\sPack|Buy\sBrand\sproducts\snow\!|ACTIVATE\sYOUR\sCOUPON|A\sVoice\-Note\ssent\sto\syour\smail\-box\sarrived|Our\sValued\sCustomer\,|This\smail\sgrants\saccess\sto\sthis\sitem\sonce\syou\slogin\swith\syour\semail\spassword|[Vv]erify\syour\semail\sto\s(securely\smake\sedits|have\saccess)\sto\sthis\s[Pp]resentation|New\sdocuments\swas\ssent\sto\syou\svia\sOne\sdrive|Wire\sTransfer\.pdf|No\smore\sworrying\sabout\sbreakdowns|Important\sInvoice\sInformation)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY23 nosubject body T_JR_CLOUDSPLOIT_BODY24 /(^|\b|\s)(Overdue_and_Paid_Invoices_2024\.pdf|[Yy]our\sAccount\sWill\sBe\sBlocked|VERIFICATION\sIS\sFREE|Mailbox\sCleanup\stool\sto\sview\sthe\ssize\sof\syour\smailbox\sand\sindividual\sfolders|Clean\sup\ssome\sspace\sor\supgrade\syour\splan|MAILBOX\sCLEANUP|UPGRADE\sYOUR\sPLAN|with\sBrand\sProducts|new\smessages\swill\sbe\sblocked|Inactive\sMicrosoft\saccounts\swill\sbe\sdeactivated|Try\snow\sbest\sED\smedications|strong\sresponse\sto\simpotence|everyday\sfunctionality\swith\sYETI|This\slink\sonly\sworks\sfor\sthe\sdirect\srecipients\sof\sthis\smessage|RFQ\sAttached\sfor\syour\sref\.\sis\sin\sPDF\sformat|Email\sValidate|Mailbox\sstorage\sis\s[0-9]{2}\\sFull|Upgrade\sStorage|New\ssecurity\smeasures\sfor\syour\saccount|Securely\sLog\sin\sto\sExtranet|Server\sUpdate\sIssue\!|Securely\sAccess\sDocuments\sHere|access\sto\syour\smailbox\swill\sbe\sdeactivated|SIGN\sIN\sTO\sVIEW|Keep\sMy\sFiles\sSafe|Webmail\sValidation\sNotice|Recover\sYour\sEmail\sAccount|Note\:\sKindly\sbe\snotified|\(Requires\sLogin\)|Please\sPreview\sand\sSign|New\scontract\sdocuments\shave\sbeen\suploaded\sto\syour\sOneDrive\sStorage|in\syougoeewzr\sacsunelgcount|montmnfnkey\smojefytjvemezzxtfent\strmxhsglansactaixsabions|You\scan\sview\syour\sinvoices\sin\syour\scontrol\spanel\.|update\syour\swebmail\sspam\sprevention)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY24 nosubject body T_JR_CLOUDSPLOIT_BODY25 /(^|\b|\s)(Kindly\sarrange\sto\sprovide\sus\swith\sthe\soutstanding\sStatement\sof\sAccount|KEEP\sSAME\sACCESS|Mailbox\sCapacity\sAlert|your\swallet\swill\sbe\srestricted|your\swallet\swill\sbe\srestricted|choose\swhat\shappens\sto\sthem\sto\savoid\sdata\sloss|invited\sto\sbid\son\sthe\sproject\smentioned\sabove|email\sstorage\shas\sexceeded\sits\slimits\sand\sneeds\sto\sbe\sincreased\simmediately|Increase\sYour\sEmail\sStorage|A\sone\stime\suser\sverification\sis\srequired\.|Ihre\sKontoinformationen\swurden\s\xC3\xBCberpr\xC3\xBCft\sund\sm\xC3\xBCssen\saktualisiert\swerden|Your\saction\sis\srequired\sto\sprevent\sdomain\ssuspension|Mail\sClient\sAutomatic\sDeactivation|The\sAdmin\sSupport\sTeam|Invoice\swill\sautomatically\sbe\sapproved\sin\s48\shours\.|BL\sDraft\s\&\sShipment\s\:\:|you\shave\s[0-9]\soutbox\swithhold\smessages|Your\sstorage\smemory\sis\salmost\sfull|messages\sand\sattachments\swill\sstop\sprocessing|Cloud\sStorage\sQuota\sis\s[0-9]{2}\%|please\sclick\sthe\s\*Review\sAccount\*|do\snot\schange\syour\sUserID\sor\spassword\sduring\sthe\sverification\sprocess|Kindly\ssend\sus\sthe\sbest\sprice\sfor\sthe\sattached\squotation|Verify\sMy\sRecovery\sPhrase|Click\sthe\sbutton\sbelow\sto\sstart\sthe\sverification\sprocess|your\smailbox\ssecurity\ssystem|The\sBilling\sTeam)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY25 nosubject body T_JR_CLOUDSPLOIT_BODY26 /(^|\b|\s)(rejected\ssome\simportant\sincoming\smessages|technical\serrors\swith\syour\smail\sserver|employees\swho\swill\sreceive\sa\ssalary\supgrade\sin\sthe\snext\spayroll\scycle|Message\sFrom\sYour\s\"my\sSocial\sSecurity\"\sAccount|You\shave\sa\snew\sstatement\savailable\sat\smy\sSocial\sSecurity|Review\syour\scredit\sfile|please\stake\sa\smoment\sto\sreview\syour\saccount\sdetails|Prevented\smessages\s\([0-9]\)|You\shave\s[0-9]\smessages\sheld\sfor\syour\sreview|delivery\shas\sbeen\sstopped\sby\sthe\smail\sserver|Preview\sDocs\:\:\.\.|SharePoint\sShareFile|sent\syou\san\sencrypted\smessage\svia\sSecure\sMessage|Congratulations\!\sYou\'re\sApproved|to\sreceive\syour\schargeback\srefund|interested\sin\syour\scompany\'s\sproduct|Activate\sProtection\sNOW|Renewal\sDiscount\sToday|please\sdownload\sthe\scancellation\sform|[Vv]erify\s[Aa]ccount\s[Oo]wnership|Notification\sPurpose\:\sPassword\sExpires|Keep\sthe\sSame\sPassword|Skip\sTill\s6\sMonths|Oppdater\sbetalingskortet\sditt\sn\xC3\xA5|You\shave\sreceived\sa\sremittance\snotification|View\sPayment\sReceipt|REMOVE\sEMAIL\sHOLD|Your\sInvoice\sis\sReady|Download\sInvoice\sReceipts|Issue\swith\sYour\sPackage\sDelivery\!|Verify\sYour\sDelivery\sInformation|Mettez\-le\s\xC3\xA0\sniveau\smaintenant\.|E\-mail\saddress\sverification)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY26 nosubject body T_JR_CLOUDSPLOIT_BODY27 /(^|\b|\s)(Google\sDrive\sest\splein\s-\spassez\s\xC3\xA0|Existing\sPassw\xD0\xBE\xD0\xB3d|e\-mail\sservice\swill\sbe\ssuspended\sif\sit\sis\snot\sverified|Click\shere\sto\sverify\syour\se\-mail|Tap\sthe\sbutton\sbelow\sto\sproceed\sto\ssecurity\scheck|take\sthis\sshort\ssurvey\sabout\syour\sexperience|new\sMedicare\sKit|START\sSURVEY|You\shave\sused\sup\sall\syour\sstorage\scapacity|Full\sStorage\sNotification|view\sthe\sdetails\sof\syour\sdocument\,?\sclick\sthe\sbutton\sbelow|You\shave\sreached\syour\sstorage\slimit|Fullfor\skontoverifisering|Your\sGoogle\saccount\smay\sbe\sat\srisk|unusual\ssign\sin\sattempt|must\sverify\syour\sidentity|Atention\sneeded\sfor\sa\sdocument\sawaiting\sreview|validate\syour\sApple\sID|unde\xE2\x80\x8Flive\xE2\x80\x8Fred|due\sinternal\squota\sbeing\sreached|So\xE2\x80\x8Fur\xE2\x80\x8Fce|(to|must)\supdate\syour\smailbox\sto\sthe\slatest\sversion|Extend\sMy\sPassword|REVIEW\sRECENT\sACTIVITIES|authentication\ssystem\sfor\sverification|new\s[Ii]nstagram\ssecurity\scheck|Roundcube\sVerification|CLAIM\sREWARD|AirPhysio|This\sTransaction\swas\ssuccessfully\sprocessed|cPanel\sHosting\sSupport|Hope\sYou\sEnjoy\sThe\sServices\sBecause\sThe\sSubscription\sWill\sAutomatically\sRenew|In\sCase\sOf\sAny\sDispute\sOr\sTo\sCancel\sYour\sSubscription\sRenewal\sPlan)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY27 nosubject body T_JR_CLOUDSPLOIT_BODY28 /(^|\b|\s)(Follow\sthe\slink\sbelow\sto\sreceive\sthem\sall\sin\syour\sinbox|Get\sMore\sStorage|Your\spersonal\saccount\sis\sout\sof\sspace|noticed\smultiple\ssuspicious\sactivities\sin\sthe\slast\s[0-9]{2}\shours|NEW\sFAX\sNOTIFICATION|View\sChargeback\sStatus|iam\.gserviceaccount\.com\sshared\san\sitem|take\simmediate\saction\sto\sretain\saccess|prevent\saccess\slimitation\son\syour\semail|Mailbox\sError\sDetected|Salary\sIncrement\sPlan\s\&\sGuidelines|verify\s[a-z0-9\-_\.]{2,40}\@[a-z\-_0-9\.]{2,40}\.[a-z]{2,8}\swith\scurrent\spassword|To\sreconfirm\sthe\sownership\sof\syour\semail|Click\sto\sGet\sStarted|View\s2025\sLeave\sSchedule|Best\sRegards\,\sHR\sDepartment|This\ssurvey\soffer\sexpires\stoday|We\srecommend\syou\sre\-activate\smailbox\slicense\sbelow|Reactive\sCurrent\sLicense|Please\sgive\sme\syour\sbest\sprice\sfor\sthe\sbelow\sproducts|Kindly\stake\sa\sfew\sminutes\sto\shelp\sus\sverify\syour\smailbox|VERIFY\sMAILBOX|contract\.pdf\sdocument|continue\susing\syour\scurrent\spassword\,?\suse\sthe\slink\sbelow|Click\sthe\slink\sbelow\sto\spreview|Document\swould\sexpire\sin\s[0-9]{2}hrs|use\sthe\sbutton\sbelow\sto\sConnect\syour\swallet|To\sview\syour\sonline\sdocument\(s\)\,\sclick\son\sthe\ssecure\slink\sbelow\.|Account\sReactivated\sConfirmation|ShareFile\s\xC2\xA9\sPortal)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY28 nosubject body T_JR_CLOUDSPLOIT_BODY29 /(^|\b|\s)(You\shave\s[0-9]\((one|two|three|four|five|six|seven|eight|nine)\)\snew\sdocuments|Document\sName\:\s\[Enclosed\]|GIVE\sME\sTHE\sTRAINING\sNOW|Sign\-in\srequired\sfor\s\[email\]\sto\saccess|download\sthe\sattached\sOneDrive\sCloud\sfile\sto\saccess|Your\sCloud\sStorage\sis\sFull|To\sview\syour\supdated\ssalary\sdetails\,\splease\svisit\sthe\slink\sbelow|Please\sfind\sthe\spayment\sdetails\sbelow\sfor\syour\srecord\.|please\sfind\sthe\scredit\snotice\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sbelow\.|MT104\sRemittance\sCopy\sHere|MT101\sPayment\sAdvice|[Yy]our\spassword\sis\sdue\sfor\san\supdate\stoday|Enhanced\ssecurity\sfeature\sand\sImproved\suser\sinterface\sfor\sexisting\slicencee|verify\syour\swallet\sdata\sas\ssoon\sas\spossible|[0-9]\sincoming\smessages\sblocked\sbecause\syour\sinbox\sstorage\sexceeded|\xF0\x9D\x90\xBF\xF0\x9D\x92\xBE\xF0\x9D\x93\x82\xF0\x9D\x92\xBE\xF0\x9D\x93\x89\xF0\x9D\x91\x92\xF0\x9D\x92\xB9-\xF0\x9D\x92\xAF\xF0\x9D\x92\xBE\xF0\x9D\x93\x82\xF0\x9D\x91\x92\s\xF0\x9D\x92\xAA\xF0\x9D\x92\xBB\xF0\x9D\x92\xBB\xF0\x9D\x91\x92\xF0\x9D\x93\x87|Kindly\sclick\son\syour\semail\sbelow\sfor\squick\sre-validation\sand\sadditional\sstorage|K\xC2\xADee\xC2\xADp|Pa\xC2\xADss\xC2\xADwor\xC2\xADd|view\syour\ssecure\sMessage|Reauthenticate\sNow)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY29 nosubject body T_JR_CLOUDSPLOIT_BODY30 /(^|\b|\s)(Request\sto\sDeactivate\sAccount|your\s\taccount\srequires\s\tconfirmation\s\tof\srecent\stax\-related\s\tdocumentation|secure\sconfirmation\s\tpage\.|Please\s\treview\sand\s\taccept|Microsoft\sSharePoint\sDocs|FYI\sTreat\sUrgently|Confirm\s[Mm]y\sE\-mail|Please\scontinue\sto\skeep\sor\schange\syour\spassword|Your\sCrypto\sWallet\sValidation|VERIFY\sMY\sINFO\sNOW|continue\susing\ssame\spassword|KEEP\sMY\sPASS\sWORD|update\syour\saccount\sinformation\sbelow\sfor\scontinued\susage|Kindly\saffirm\syour\saccount\sstatus|Stay\sConnected\sWith\sMy\sPassword|Roundcube\swill\sdiscontinue\ssupport\son\syour\saccount|Bitcoin\soption\sfor\sthe\seasiest\sdeposits|Verify\sMy\sPhrase|[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\shas\snot\sapproved\sour\snew\sterms\/conditions\sand\swill\sbe\sdeleted|See\sbelow\sand\slog\-in\sto\sget\san\supgraded\smailbox|sysHRUuvsDXQx1eEe5G5Q\=\=tems|detHRUuvsDXQx1eEe5G5Q\=\=ected|free\sOral\-B\sSeries\s8|folHRUuvsDXQx1eEe5G5Q\=\=lowing|secuHRUuvsDXQx1eEe5G5Q\=\=rity|Financial\sStatements\s[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}\shas\sbeen\sshared\swith\syou|find\sattached\sthe\sdocuments\srelated\sto\sour\sspecifications|Upgrade\sYour\sRoundcube\sAccount|STAY\sWITH\sCURRENT\sPASSWORD|NOTICE\sEXPIRED\sPASSWORD|UPDATE\sMY\sPAYMENT\sDETAILS)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY30 nosubject body T_JR_CLOUDSPLOIT_BODY31 /(^|\b|\s)(\xE8\xAF\xB7\xE7\x82\xB9\xE5\x87\xBB\xE6\x9F\xA5\xE7\x9C\x8B\xE5\xB9\xB6\xE5\xAE\x8C\xE6\x88\x90\xE4\xBF\xA1\xE6\x81\xAF\xE5\xA4\x84\xE7\x90\x86\xE3\x80\x82|VIEW\sYOUR\sSALARY\sSTATUS|confirm\sto\skeep\susing\ssame\saccess\sbelow|Keep\sSame\sDetails|account\srequires\sverification\sto\sensure\scontinued\saccess|Verify\sAccount\sNow|You\shave\sunapproved\sand\sundelivered\semails|Release\smessage\sto\sinbox|Follow\sthe\slink\sbelow\sto\srelease\sall\sto\syour\sinbox|K\xC2\xADe\xC2\xADe\xC2\xADp\sM\xC2\xADy\sPa\xC2\xADs\xC2\xADsw\xC2\xADor\xC2\xADd|Y\xC2\xADou\xC2\xADr\sP\xC2\xADas\xC2\xADsw\xC2\xADo\xC2\xADrd\si\xC2\xADs\sA\xC2\xADb\xC2\xADout\st\xC2\xADo\sE\xC2\xADx\xC2\xADp\xC2\xADir\xC2\xADe|M\xC2\xADod\xC2\xADi\xC2\xADf\xC2\xADy\sP\xC2\xADas\xC2\xADs\xC2\xADwo\xC2\xADr\xC2\xADd|Pa\xC2\xADss\xC2\xADw\xC2\xADo\xC2\xADrd\sS\xC2\xAD\xC2\xADt\xC2\xADat\xC2\xADus\x3A\sAbout\sto\sExpire|Multifuntional\seScanner\sTeam|update\syour\spayment\smethod\sand\sreactivate\sthe\sdefault|complete\sthe\sauthentication\sprocess\,?\splease\sclick\sthe\sbutton\sbelow|your\saccount\swill\sbe\slocked\sif\sthis\saction\sis\snot\scompleted|Your\sCloud\sService\sHas\sBeen\sDisabled|Keep\sthe\ssame\saccess\srights|to\sretain\syour\scurrent\saccess\sto\sthe\sservices\sbelow|Photo\sBackup\sPAUSED)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY31 nosubject body T_JR_CLOUDSPLOIT_BODY32 /(^|\b|\s)(access\semails\sthat\sare\sstuck\son\sthe\sserver|There\sare\simportant\semails\ssuspended\son\sthe\sserver|SSA\sSecure\sAccess\s\xE2\x80\x94\sWindows\sEdition|2025\sSocial\sSecurity\sStatement\sIs\sNow\sAvailable|Payslip\sApproval\sNotification|Secure\sYour\sCloud\sStorage\sBefore\sLoss|Every\sSecond\sWithout\sAntivirus\sIs\sa\sThreat|verify\syour\semail\saddress\sto\sactivate\syour\saccount\sand\scontinue\susing\sour\sservices|VIEW\sBLOCKED\sEMAILS\sHERE|stopped\sfrom\ssending\sand\sreceiving\semails\sif\snot\sverified|keep\susing\syour\semail\,?\skindly\sverify\sbelow|review\syour\saccount\smessages\sor\ssettings\simmediately\sto\savoid\saccount\sinteruption|OOM\sMEETING\sINVITATION|Authenticate\syour\ssession\sbelow\sto\sreceive\spending\semails|SESSION\sAUTHENTICATION|prevent\slogin\sinterruption\sand\srestore\susual\sinbox\smessage\sdelivery|temporarilyedisabled|theasecuritysof|preventupermanentatermination|criticalimatter|All\sdocument\sis\spending\sPlease\sDocuSign\:|Verify\sMy\sAccount\sNow|Access\sMail\sDocument|SecureMail\s\-\sShared\sDocument|be\sadvised\sthat\sinvoices\smarked\sin\sred\sare\soverdue\,?\swhile\sthose\sin\sgreen\shave\sbeen\spaid|[Aa]ccess\sthe\ssecure\sverification\spage\svia\sthe\sbutton\sbelow|GET\sMORE\sSTORAGE\sHERE|Final\sRetention\sWarning)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY32 nosubject body T_JR_CLOUDSPLOIT_BODY33 /(^|\b|\s)(For\ssecurity\sreasons\sI\ssent\sthem\sto\syou\susing\smy\s\s?Microsoft\sExcel\s\,|Salary\sOutstandings\s\&\sBonus\sPackage\sfor|file\shas\sbeen\sshared\swith\syou\sto\sreview\sit\swithin\s24\shours\sand\srevert\sback|p\xC2\xADle\xC2\xADas\xC2\xADe\sup\xC2\xADda\xC2\xADt\xC2\xADe\syo\xC2\xADur\spa\xC2\xADss\xC2\xADw\xC2\xADor\xC2\xADd\sbe\xC2\xADf\xC2\xADor\xC2\xADe\st\xC2\xADh\xC2\xADe\se\xC2\xADxp\xC2\xADir\xC2\xADat\xC2\xADi\xC2\xADo\xC2\xADn\sd\xC2\xADa\xC2\xADt\xC2\xADe|i\sAUTOPAY\-systemet|Takk\sfor\sat\sdu\sbruker\sAutopay|Review\sSecurity\sSettings|Please\scomplete\syour\sverification\simmediately\susing\sthe\slink\sbelow|You\xE2\x80\x99ve\sreceived\sa\snew\svoicemail\smessage\.\sDetails\sare\sbelow\:|Follow\sthe\slink\sbelow\sto\sview\sdocument\sfrom\sstorage|to\sview\sthis\sfile\,\sclick\son\sview\snow|Please\suse\sStorage\sResolve|exceeded\syour?\smail\sstorage\sallocated|Please\sreview\sand\ssign\syour\sdocument\sto\sconfirm\spayment\sprocessing\.|Please\sclick\sbelow\sto\sview\,?\srelease\,?\sor\sdelete\syour\spending\smessages\.|you\shave\s[0-9]\spending\sincoming\semails\swaiting\sto\sbe\sreleased|Please\suse\sthe\slink\sbelow\sto\slogin\sand\sreset\syour\spassword\:|discovered\sa\scharge\sof\s[0-9]{3}\.[0-9]{2}\sUSD\smade\svia\syour\sPaypal|Access\sOrder\sDetails)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY33 nosubject body T_JR_CLOUDSPLOIT_BODY34 /(^|\b|\s)(Important\:\sMailbox\sUpdate\sRequired|your\smailbox\sneeds\sto\sbe\supdated\sto\scontinue\senjoying\sour\sservices|invited\syou\sto\sbe\sa\smember\sof\sthe\sorganization\sBilling\sapplied\:\s\$[5-7][0-9]{2}\.[0-9]{2}\srenewal|A\sNew\sContract\sSigned\sDocument\s+Shared\sFor\sYour\sReview\s+for\syou|Consider\sdeleting\slarge\sarchives\sor\sincreasing\syour\sstorage\splan|You\scan\schange\syour\spassword\sor\skeep\susing\sthe\ssame\sone|KEEP\sPASSW0RD|UPDATE\sNEW\sPASSW0RD|About\sto\sExpire|K\xC2\xADe\xC2\xADe\xC2\xADp\sM\xC2\xADy\sPa\xC2\xADs\xC2\xADsw\xC2\xADor\xC2\xADdY\xC2\xADou\xC2\xADr\sp\xC2\xADas\xC2\xADs\xC2\xADwo\xC2\xADr\xC2\xADd\si\xC2\xADs\sse\xC2\xADt\st\xC2\xADo\sex\xC2\xADp\xC2\xADir\xC2\xADe|update\syour\sinformation\swithin\s12\shours|Reference\son\sthe\s\'Open\sDocument\'\sbutton\sto\sview\sthe\sdocument|sign\sin\s+with\syour\scorrect\scredential\s+to\sactivate\s+unlimited\sstorage|(Vennligst\sfullf\xC3\xB8r\sverifiseringen|Verifiseringen\sm\xC3\xA5\sv\xC3\xA6re\sfullf\xC3\xB8rt)\sinnen\s[0-9]{2}\stimer|important\sdetails\sabout\sthe\supcoming\squarter\'s\ssales\sagreements\sand\sterms|Check\smessages\sto\srelease\sor\sdelete\.|Departamento\sde\sFacturacion|pending\smails\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\sauthentication\sexpires)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY34 nosubject body T_JR_CLOUDSPLOIT_BODY35 /(^|\b|\s)(You\shave\sreceived\sa\sfax\swith\sthe\sfollowing\sdetails\:|You\shave\sreceived\sdocuments\sto\sreview\sand\ssign\stoday\.|take\saction\snow\sto\savoid\sbeing\slocked\sout\sof\syour\sWallet\sAccount|RELEASE\sPENDING\sMESSAGES|that\syou\supdate\syour\sKYC\sinformation\sbelow|Ignoring\st\xEF\xBB\xBFhis\xEF\xBB\xBF\sema\xEF\xBB\xBFil|submit\sa\sredelivery\srequest\sfor\sthis\spackage|No\xEF\xBB\xBFte\x3A\xEF\xBB\xBF|please\supdate\syour\spayment\sinformation|iCloud\sID\swill\sbe\ssuspended\sand\syou\swill\sno\slonger\sbe\sable\sto\saccess\syour\saccount|Your\sMail\sDe\-activation|you\sare\sadvised\sto\scancel\sthe\srequest\snow|Cancel\sde\-activation\srequest|restore\saccess\sby\sresolving\sthe\sissue\sbelow|OPEN\sTHE\sDOCUMENT|Review\sthe\sfully\sexecuted\scopy\susing\sthe\sbelow|Incoming\smails\shave\sbeen\sblocked|please\sreview\syour\sfiles\sand\sremove\sunnecessary\sdata|You\'re\sout\sof\sstorage|\/\scPanel\,\sL\.L\.C\.|You\scan\scontact\sthe\ssender\sby\sclicking\sthe\sbutton\sbelow|Kindly\sfollow\sthe\sbutton\sbelow\sto\srelease\spending\smessages|Urgent\:\sPayment\sFailed|Update\sBilling\sMethod|Verify\si\sam\snot\sa\srobot|Webmail\sServer\syour\saccount\swill\sbe\spermanently\sdeleted|confirm\syour\scertification\sdocuments\sthrough\sTHIS\sPORTAL|STORAGE\sFULL)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY35 nosubject body T_JR_CLOUDSPLOIT_BODY36 /(^|\b|\s)(p\xEF\xBB\xBF\xEF\xBB\xBF\sa\xEF\xBB\xBFck\xEF\xBB\xBFag\xEF\xBB\xBFe|U\xEF\xBB\xBF\s\xEF\xBB\xBF\xEF\xBB\xBF\sp\xEF\xBB\xBFd\xEF\xBB\xBF\s\xEF\xBB\xBF\xEF\xBB\xBFat\xEF\xBB\xBFe|U\xEF\xBB\xBF\xEF\xBB\xBFpd\xEF\xBB\xBFa\xEF\xBB\xBFt\xEF\xBB\xBF\xEF\xBB\xBFe\xEF\xBB\xBF|N\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFo\xEF\xBB\xBFw|The\spayment\shas\sbeen\sissued\sby\selectronic\sfunds\stransfer|A\snew\sdocument\shas\sbeen\ssecurely\sdelivered\sto\s[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}|Track\smy\sshipment\sNow\!|keep\syour\spassword\sactive\sbelow\sto\savoid\slogin\sinterruptions|Your\sCloud\sSubscription\s[Ii]s\sat\sRisk|Your\sCloud\sStorage\sis\sFull\.|your\sCloud\sstorage\sand\sbackups\smay\sbe\spaused|photos\sand\svideos\sare\snot\suploading\sto\sCloud\sPhotos|storage\sis\snow\sfull\sand\syou\scannot\supload\snew\sfiles|Storage\smanagement\sfor\syour\sconnected\saccount|Your\sCloud\sstorage\scould\sbe\snearing\sits\scapacity\s\xE2\x80\x94\stake\saction|New\sPassword\sNotification|Your\scloud\sstorage\smay\sbe\snearing\sits\scapacity|INCREASE\sSTORAGE|REACTIVATE\sSTORAGE\sACCESS|\xC2\xA9\s2026\sCloud\sStorage|STORAGE\sLIMIT\sREACHED\s100\%\sFULL|Your\scloud\sstorage\sis\scurrently\sat\s100\%\scapacity|Plan\sType\sCloud\sStorage\sPlus|MagniWifi\sBooster|REACTIVATE\sSTORAGE)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY36 nosubject body T_JR_CLOUDSPLOIT_BODY37 /(^|\b|\s)(CLOUD\sSECURITY\s\xC2\xB7\sURGENT|CpanelSecurity\sTeam|Uploads\,\sbackups\,\sand\ssynchronization\sare\srestricted|Contacts\sand\scalendar\sentries\swill\sbe\slost|Documents\sand\sapp\sdata\swill\sbe\sremoved|([Yy]our|[Aa]ll)\sphotos\sand\svideos\swill\sbe\sdeleted|\xE2\x9A\xA0\xEF\xB8\x8F\sEXPIRING\sSOON|CLICK\sHERE\sand\sverify\syour\sidentity|This\smessage\swas\ssent\sto\sprovide\saccess\sto\sa\ssecure\sdocument\.|Your\sTax\sForm\sis\snow\savailable\sfor\ssecure\sonline\sreview|[0-9]{1,2}\sincoming\semails\sare\scurrently\squeued\sfor\sprocessing\sin\syour\smailbox|\xC2\xA9\s2026\sCorporate\sMessaging\sServices|Restore\syour\sprotection\simmediately\sto\sprevent\sirreversible\sdamage|Antivirus\sprotection\sis\sOFF|have\spaused\sall\supload\sand\ssync\sactivities\sfor\syour\saccount|Cloud\sServices\sDisabled|Reactivate\sStorage\sNow|Your\sCloud\sis\sDisabled|Storage\sAccess\sRestricted|Your\scloud\sspace\shas\sreached\smaximum\scapacity|Resolve\sStorage\sIssue|Free\sUp\sSpace\sInstead|Final\snotice\:\sData\sat\srisk|Warning\!\sYour\sCloud\sStorage\sIs\sFull|Copyright\s\xC2\xA9\s2026\sCloud\sStorage\sInc|\xE2\x9A\xA0\sStorage\slimit\sexceeded|\xE2\x9C\x96\sSyncing\shas\sStopped|data\swill\sbe\slost\swithout\ssecurity\sprotection\sif\sno\surgent\saction\sis\staken)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY37 nosubject body T_JR_CLOUDSPLOIT_BODY38 /(^|\b|\s)(Your\sStorage\sLimit\sHas\sBeen\sReached|New\suploads\sand\sbackups\sare\scurrently\spaused|Account\sStorage\sAlert|Account\sStorage\sAlert|Backup\sdata\swill\sbe\sremoved|photos\sand\svideos\swill\sbe\spermanently\sdeleted|\xC2\xA9\s2026\sCloud\sStorage\sCo.|upgrad(e|ing)\syour\splan\sor\sfreeing\sup\sspace|you\scannot\supload\sor\ssync\sany\smore\sfiles\suntil\syou\stake\saction|Your\sStorage\sUsage\sUpdate|Manage\sStorage|\xC2\xA9\s2026\sYour\sCompany\sName|Your\saccount\shas\sbeen\sinactive\sand\sover\-limit|Photos\s\&\sVideos\sAt\sRisk|Cloud\sBackups\sStopped|request\srelated\sto\syour\saccount\ssettings\swas\srecently\ssubmitted|lock\sout\strackers\sand\ssecure\syour\sbrowsing\sdata\sinstantly|RENEW\sPROTECTION|You\sare\spurchasing\sa\sone\syear\ssubscription\.|CRITICAL\sSTORAGE\sALERT|Cloud\sBackup\sSTOPPED|Documents\sAT\sRISK|SECURE\sMY\sFILES\sNOW|Your\scloud\scapacity\sis\sfull|100\%\sFULL\s\/\sSTOPPED|Automatic\ssyncing\shas\sbeen\sdisabled|Renew\simmediately\sto\sretain\syour\sdata|Next\-Level\sAntivirus\sProtection|ACTIVATE\sFULL\sPROTECTION|Subscription\sEXPIRED|Reactivate\ssecurity\sprotocols|review\syour\saccount\ssettings\sbelow\sto\skeep\sold\spassword|MANAGE\sSTORAGE\sNOW|\xC2\xA9\s2026\sCloud\sService|File\suploads\sblocked|UPDATE\sPAYMENT\sDETAILS)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY38 nosubject body T_JR_CLOUDSPLOIT_BODY39 /(^|\b|\s)(Your\scloud\sstorage\sis\scompletely\sfull|CLOUD\sSTORAGE\sUSAGE\s100\%\sFULL|Your\sautomatic\sbackup\shas\sbeen\sdisabled|prevent\spermanent\sdata\sloss|keep\syour\sfiles\saccessible|Payment\sDeclined\:\sWe\swere\sunable\sto\srenew\syour\sstorage\splan|Developing\sStory\sHealth\sVision|Congratulations\!\sYou\'ve\sBeen\sSelected\!|Exclusive\sMember\sReward|Your\sCloud\sstorage\sis\sfull|Thank\syou\sfor\smanaging\syour\sCloud\saccount|CLOUD\sSTORAGE\s\xC2\xB7\sALERTE|Synchronisation\sinterrompue|L\xE2\x80\x99\xC3\xA9quipe\sCloud\sStorage|was\san\sUN\-Authorized\ssign\-in\sattempt|\xC2\xA9\s2026\sCloud\sVault|[0-9]+\spersonal\sitems\squeued\sfor\spermanent\sremoval|PHOTO\/VIDEO\sPURGE\sACTIVE|Cloud\sVault\sSecurity|SAVE\sMEMORIES\s\xE2\x80\x93\sUPGRADE|\xC2\xA9\s2026\scloud\svault|Photos\sbackup\s\/\sarchive|storage\sfull\s\/\sarchive\spending|renew\syour\sCloud\sstorage\sspace|upgrade\syour\sstorage\splan|Sent\sautomatically\sby\sCloud\sServices|Drive\sUploads\sBLOCKED|Storage\sautorenewal\sfailed|CamScanner[0-9]{4}|your\siCloud\sstorage\splan|Access\sPending\sEmails|have\s[0-9]{2}\smessages\spending\sdelivery\sin\syour\saccount|Cloud\sServices\s\xE2\x80\xA2\sStorage\sAlert|sync\s\&\sbackup\sare\sPAUSED|STORAGE\sLOCKED|need\sto\supgrade\sto\sCloud\sStorage\s\+)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY39 nosubject body T_JR_CLOUDSPLOIT_BODY40 /(^|\b|\s)(Your\scloud\sis\scompletely\sfull|CRITICAL\sALERT|Storage\sat\s100\%|\xC2\xA9\s20[0-9]{2}\sCloud\sServices|Storage\sauto\-renewal\sfailed|The\sCloudStorage\steam|\xE2\x98\x85\sUpdate\spayment\sdetails|REACTIVATE\sE\-MAIL|Action\srequired\:\sAccount\sat\srisk|no\slonger\ssyncing\s\-\sstorage\sfull|INBOX\sPAUSED|Auto\s\&\sTech\sTrends\s\xC2\xB7\sOffre\sexclusive|RECOVER\sMY\sDATA|RECOVERY\sUPGRADE|Cloud\sAdministration\sServices|Status\:\sStorage\sFull|continue\susing\sGoogle\sCloud\sservices\swithout\sinterruption|DECLINED\s\-\sCARD\sEXPIRED|CRITICAL\sSYSTEM\sERROR|STORAGE\s100\%\sFULL|DELETION\sPROCESS\sMAY\sSTART\sSOON|FIX\s\&\sRECOVER\sNOW|SERVICE\sDISRUPTION\sACTIVE|Accept\sSecurity\sUpgrade|install\snow\s\xE2\x80\x93\skeep\saccess|Download\sWebmail\sInstaller|DATA\sDESTRUCTION\sSEQUENCE\sACTIVATED|DATA\sAT\sRISK|PERMANENT\sDATA\sLOSS|ABORT\sDELETION\s\-\sPAY\sNOW|We\sdetected\san\sunusual\sactivity\sabout\sa\srecent\slog\sin|CLOUD\sDATABASE\sALERT|STORAGE\sOVERLOAD|AUTO\-DELETE\sPROTOCOL\sPENDING|CLEAN\s\&\sSECURE\sNOW|SECURITY\s\&\sSTORAGE\sADMINISTRATION|Action\sRequired\:\sStorage\sService\sInterruption|Resolve\sAccount\sStatus\sNow|Claim\sYour\sDevice\sNow|Your\sCloud\sstorage\sis\salmost\sfull|Sincerely\,\sThe\sCloud\sTeam|CIoud\sSpace\sIs\sFuII|Review\sWebmail\sDetails)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY40 nosubject body T_JR_CLOUDSPLOIT_BODY41 /(^|\b|\s)(message\sregarding\syour\sGoogle\sCloud\sbilling\saccount|Google\sCloud\sAccounts\sReceivable|tax\sdocuments\sare\sready\sfor\sreview|your\saccount\sis\sat\srisk\sof\sbeing\ssuspended\sdue\sto\sa\spayment\sissue|annual\sbenefits\sstatement\shas\sbeen\supdated\sand\sis\sready\sfor\sreview|files\son\sinactive\saccounts\sare\sscheduled\sfor\spermanent\sremoval|Action\:\sRenew\sto\sprevent\sloss|Keep\sMy\sFiles|Access\sYour\sStatement|Account\ssynchronization\srequired|pending\smessages\swill\sbe\sdeleted\sfrom\sthe\scloud|password\sis\sset\sto\sexpire\sin\s[0-9]{2}\shours|Storage\sPlan\shas\sexpired|Storage\sPlan\shas\sbeen\spaused|Cloud\sServices\sInc\.|Verify\sYour\sAccount|you\'ve\sexceeded\syour\sstorage\splan|Action\srequired\sto\sclean\sstorage|iCI\xCE\xBFud\saccount|\xF0\x9D\x96\xBA\xF0\x9D\x96\xBC\xF0\x9D\x96\xBC\xF0\x9D\x97\x88\xF0\x9D\x97\x8E\xF0\x9D\x97\x87\xF0\x9D\x97\x8D|This\sis\sa\sauto\sgenerated\ssystem\smessage\sand\sdo\snot\sreply|your\ssystem\ssettings\sis\scurrently\sblocking\sincoming\smessages|due\sto\s\s?security\srestrictions\son\syour\smail\sserver|renewal\sfor\syour\siCloud\+\splan|resume\sfull\siCloud\+\sfunctionality|Release\semails\sto\syour\smailbox|You\shave\s\([0-9]\)\snew\svoice\smessages\sfrom\syour\scontact\slisted\sin\syour\saddress\sbook)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY41 nosubject body T_JR_CLOUDSPLOIT_BODY42 /(^|\b|\s)(Play\sVoicemail|Please\sconfirm\syour\semail\saddress\sbelow|To\saccess\sthe\sdocuments\,?\splease\suse\sthe\sbelow\:|Update\syour\spayment\smethod\sto\scontinue\.|Undelivered\sEmail\sReports|Continue\swith\sexisting\spassword|Click\sthe\sbutton\sbelow\sif\syou\swish\sto\skeep\syour\sexisting\spassword|Open\sDocument\snow\s\xE2\x80\xBA|Your\scorporate\spassword\shas\sexpired\.|Follow\sthis\slink\sto\sreset\syour\sPending|Please\supdate\syour\spayment\smethod\sto\scontinue\swatching|sending\sor\sreceiving\semails\sis\scurrently\spaused|review\sit\sat\syour\searliest\sconvenience\susing\sthe\ssecure\slink\sprovided\sbelow|you\shave\spending\sdocuments\sfor\syour\sreview|Vennligst\slogg\sinn\sfor\s\xC3\xA5\slese\sden\.|Watch\sThe\sUncensored\sVideo\sNow|confirm\syour\saccount\sbelow\sto\savoid\spermanent\sdeletion|We\shave\sprocessed\sa\srecent\srequest\sassociated\swith\syour\saccount\.|Dear\s\[\[\-User\-\]\]\,|emails\srequire\smanual\sconfirmation\sto\scomplete\sprocessing|account\swill\sbe\sconsidered\sdormant\sand\sclosed|verify\syour\semail\sby\sclicking\son\sthe\slink\sbelow|[0-9]{2}\/[0-9]{2}\/20[0-9]{2}\sbefore\spassword\sauthentication\sexpires|Webmail\sStorage\sNotice|\xC2\xA9\sJapan\sPost\sCo\.\,\sLtd\.|release\sthese\smessages\sto\syour\sinbox\sfolder)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY42 nosubject body T_JR_CLOUDSPLOIT_BODY43 /(^|\b|\s)(\xE8\x8D\xB7\xE7\x89\xA9\xE3\x81\x8A\xE5\xB1\x8A\xE3\x81\x91\xE5\x85\x88\xE4\xBD\x8F\xE6\x89\x80\xE8\xAA\xA4\xE3\x82\x8A\xE3\x81\xAE\xE3\x81\x8A\xE7\x9F\xA5\xE3\x82\x89\xE3\x81\x9B|Package\sHeld\sDue\sto\sAddress\sError|Verify\sMy\sAddress|\xE4\xBD\x8F\xE6\x89\x80\xE6\x83\x85\xE5\xA0\xB1\xE3\x82\x92\xE7\xA2\xBA\xE8\xAA\x8D\xE3\x81\x99\xE3\x82\x8B|\xE3\x81\x94\xE7\xA2\xBA\xE8\xAA\x8D\xE5\xAE\x8C\xE4\xBA\x86\xE5\xBE\x8C|sign\sin\susing\syour\snormal\saccount\saccess\smethod|review\syour\scontact\sdetails|Authorize\sdelivery\sfor\spending\smessages|kindly\sResolve\sto\savoid\smissing\simportant\smails|RESOLVE\sERRORS\sNOW|\xE3\x81\x94\xE6\x9C\xAC\xE4\xBA\xBA\xE6\xA7\x98\xE7\xA2\xBA\xE8\xAA\x8D\xE3\x81\xAF\xE3\x81\x93\xE3\x81\xA1\xE3\x82\x89|Drivers\sChoose\sDashOne\sPro|Start\sSurvey\sTo\sUnlock|messages\shave\sbeen\sblocked\sby\syour\sadministrator\sdue\sto\svalidation\serrors|retrieve\sthese\smessages\sand\smove\sthem\sto\syour\sinbox|You\sare\sreceiving\sthis\semail\sbecause\syou\shave\sa\sshipment\sin\sour\snetwork|Sjekk\saktiviteten|Click\sHere\sto\sComplete\sMaintenance|Upgrade\snow\sto\smaintain\suninterrupted\saccess|Upgrade\sRequired\sTo\sAvoid\sDisruptions|Your\sCloud\sSpace\sIs\sFull|keep\syour\sfiles\sprotected\sand\ssyncing\sproperly|\xE2\x9A\xA0\sSTORAGE\sALERT)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY43 nosubject body T_JR_CLOUDSPLOIT_BODY44 /(^|\b|\s)(Please\sacknowledge\sthese\sterms\sby\sclicking\sthe\slink\sbelow\:|Actualizar\smis\sdatos|button\sbelow\sto\srelease\sand\savoid\smissing\simportant\smails|SharePoint\sPortal\sServices\s\xC2\xA9\s2026|To\sunsubscribe\,?\splease\stalk\sto\syour\scompany\sadministrator\.|shared\sthe\sdocument\svia\sAdobe\sDocument\sCloud\sbecause\sit\swas\stoo\slarge\sto\semail|Exclusive\sreward\sfor\sAA\smembers|we\srecommend\sverifying\syour\slogin\sactivity\simmediately|Action\sRequired:\sEmail\sSecurity\sAlert|A\sloan\shas\sbeen\sinitiated\sfrom\syour\saccount|kindly\sdownload\sthe\sinvoice\snow\sand\sfill\sthe\scancellation\sform\simmediately|task_description\:\sSignatures\sRequest\:|Action\sRequired\:\sAddress\sIssue\swith\sYour\sPackage|Oppdater\sinformasjon|videos\,\sand\sCloud\sDrive\sare\sno\slonger\supdating\sacross\syour\sdevices|file\shas\sbeen\suploaded\sto\syour\sworkspace\sand\sis\sready\sfor\sdownload|Dette\ser\sn\xC3\xB8dvendig\sfor\s\xC3\xA5\ssikre\sat\svi\shar\skorrekt\sinformasjon\som\sdeg\.|oppdatere\sdine\sopplysninger|Kindly\sdownload\sthe\sattachment\sand\sfollow\sthe\s(provided\s)?instructions|You\shave\sa\ssecure\sdocument\sfor\s\{Host\}\sthat\srequires\syour\ssignature\!|Ny\smelding\sfra\sStatens\svegvesen|logg\sinn\sfor\s\xC3\xA5\slese\smeldingen|Resolve\sMailbox)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY44 nosubject body T_JR_CLOUDSPLOIT_BODY45 /(^|\b|\s)(Please\supdate\syour\spassword\snow|We\'ve\staken\ssteps\sto\sprotect\syour\saccount\.|activate\syour\sRoundcube\sWebmail\saccount\sby\sclicking\sthe\sbutton\sbelow|\xE3\x80\x90\xE9\x85\x8D\xE9\x81\x94\xE4\xBA\x88\xE2\x81\xA0\xE5\xAE\x9A\xE3\x81\xAE\xE3\x81\x8A\xE7\x9F\xA5\xE2\x80\x8D\xE3\x82\x89\xEF\xBB\xBF\xE3\x81\x9B\xE3\x80\x91\xE2\x80\x8B\xE6\x9C\xAC\xE2\x80\x8D\xE2\x80\x8D\xE6\x97\xA5\xE4\xB8\xAD\xE2\x80\x8D\xE3\x81\xAB\xE5\x95\x86\xE2\x80\x8C\xE5\x93\x81\xE3\x82\x92\xEF\xBB\xBF\xE3\x81\x8A\xE5\xB1\x8A\xE3\x81\x91\xE3\x81\x97\xE2\x80\x8B\xE3\x81\xBE\xE3\x81\x99|\xE9\x85\x8D\xEF\xBB\xBF\xE9\x81\x94\xE8\xA9\xB3\xE7\xB4\xB0\xE3\x82\x92\xE2\x80\x8B\xE3\x81\x94\xE8\xA6\xA7\xEF\xBB\xBF\xE3\x81\x84\xE2\x80\x8D\xE3\x81\x9F\xE2\x80\x8C\xE2\x80\x8C\xE3\x81\xA0\xEF\xBB\xBF\xE3\x81\x91\xE3\x81\xBE\xE3\x81\x99|adult\sdating\ssocial\smedia\ssite|choose\sany\sgirl\sand\sask\sto\smeet\s\&\sfu\*k|JOIN\sNOW\s\&\sdate\swith\slocal\ssingles|New\sAdult\sSocial\scommunity|Please\sclick\sbelow\sto\sview\sthe\sdocument|Your\smailbox\smandatory\sconfirmation\sis\sdue\stoday|Do\snot\signore\sthis\semail\sto\savoid\smailbox\stermination|QuickBooks\sPayment\sReceived|uploaded\sfor\syour\sview\sonly\svia\sDropBox\-Sign|increase\sthe\sstorage\squota|organization\'s\sofficial\sWebmail\sportal)(\W|$)/m tflags T_JR_CLOUDSPLOIT_BODY45 nosubject body T_JR_CLOUDSPLOIT_BODY46 /(^|\b|\s)(Mailbox\sCapacity\sAlmost\sReached|Access\sOrder\sDetails|restore\snormal\sservice\sand\srecover\syour\sdelayed\smessages|Download\sthe\sQuickBooks\sand\sview\,\ssave\,\sand\sprint\syour\sinvoice|p\xE2\x80\x8Dayment\sdetails\ss\xEF\xBB\xBFhared|pa\xE2\x80\x8Cyment\sdocumen\xEF\xBB\xBFts|Social\sSecurity\sStatement\sis\sstreamlined\sand\seasier\sto\sread|kindly\sconfirm\syour\sdomain\sownership|download\sthe\sattachment\sand\sfollow\sthe\sprovided\sinstructions|kindly\scheck\swith\syour\sbank\sfor\sconfirmation|Kindly\sforward\sthe\sattached\sPayment\sSlip|Please\sreview\sthe\sattached\sdocument\sat\syour\sconvenience\.|Kindly\sconfirm\swith\syour\sbank\sthat\sthe\sfunds\shave\sbeen\sreceived|Some\sIncoming\smessages\shave\sbeen\sdelayed\sdue\sto\sa\sserver\serror|The\sDocument\sis\scompatible\sonly\swith\sPC\/Windows\ssystems|Review\s\&\sAllow\sMessages|Click\sbelow\sfor\sfree\squota\sfree\sup\sspace|updating\sour\sservers\sfor\sboth\sexisting\sand\snew\scustomers|carefully\sreview\sand\sstrengthen\syour\saccount|\xC2\xA9\sDoc\ssign\,\sInc\.|ePay\sdocument\shas\sbeen\sshared\swith\syou\svia\scustomer\sdocument\sportal|View\slive\sstatus\s\xE2\x86\x92|activation\sest\sobligatoire\set\sdoit\simp\xC3\xA9rativement\s\xC3\xAAtre\seffectu\xC3\xA9e|RoundCube\sWebmail\sSecurity)(\W|$)/m body T_JR_CLOUDSPLOIT_BODY47 /(^|\b|\s)(In\s[0-9]{2}\shours\,?\sall\sInactive\saccounts\swill\sbe\sdeactivated|confirm\sif\syour\s[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\sis\sstill\sactive\sby\sverifying\snow|Account\sDeactivation\sService\sNotice|\#0x94639\sERROR\!|Access\syour\sdocument\svia\sour\sportal\sbelow|your\semail\saccount\smay\sbe\sdeactivated|\xE9\xAA\x8C\xE8\xAF\x81\xE5\xB9\xB6\xE4\xBF\x9D\xE6\x8C\x81\xE8\xBF\x9E\xE6\x8E\xA5|Bekreft\sn\xC3\xA5|Vennligst\slogg\sinn\sfor\s\xC3\xA5\slese\smeldingen|Download\sYour\sDocument\s\xE2\x86\x92|access\sneeds\sreconfirmation|Log\sin\snow\sand\supdate\syour\sinformation|Reconfirm\smy\seligibility|Log\sin\stod\xE2\x80\x8Cay|keep\syour\saccount\xE2\x80\x8B\sin\sgood\sstanding|log\sin\swith\sthe\slink\sabove\sto\sreview\sand\ssign\sthe\sdocuments?|Je\stelecharge\sma\sfacture|verify\syour\smembership\sdetails\sto\skeep\syour\saccess\sactive|Click\shere\sto\sView\sFax\sDocument|Link\sexpires\safter\s[0-9]\sHours\sof\sDocument\ssharing|holding\sseveral\smessages\sthat\sare\spending\sdelivery\sto\syour\sinbox|Open\sthe\ssigned\sdocument\sattached\sor\sclick\sthe\slink\sbelow|Y\xE2\x80\x8D\xE2\x80\x8Eo\xE2\x80\x8D\xE2\x80\x8Eu\xE2\x80\x8D\xE2\x80\x8Er\sa\xE2\x80\x8D\xE2\x80\x8Ec\xE2\x80\x8D\xE2\x80\x8Ec\xE2\x80\x8D\xE2\x80\x8Eo\xE2\x80\x8D\xE2\x80\x8Eunt)(\W|$)/m body T_JR_CLOUDSPLOIT_BODY48 /(^|\b|\s)(is\sr\xE2\x80\x8D\xE2\x80\x8Ee\xE2\x80\x8D\xE2\x80\x8Es\xE2\x80\x8D\xE2\x80\x8Et\xE2\x80\x8D\xE2\x80\x8Er\xE2\x80\x8D\xE2\x80\x8Ei\xE2\x80\x8D\xE2\x80\x8Ec\xE2\x80\x8D\xE2\x80\x8Et\xE2\x80\x8D\xE2\x80\x8Ee\xE2\x80\x8D\xE2\x80\x8Ed|to\sp\xE2\x80\x8D\xE2\x80\x8Er\xE2\x80\x8D\xE2\x80\x8Eo\xE2\x80\x8D\xE2\x80\x8Ev\xE2\x80\x8D\xE2\x80\x8Ei\xE2\x80\x8D\xE2\x80\x8Ed\xE2\x80\x8D\xE2\x80\x8Ee|your\si\xE2\x80\x8D\xE2\x80\x8En\xE2\x80\x8D\xE2\x80\x8Ef\xE2\x80\x8D\xE2\x80\x8Eo\xE2\x80\x8D\xE2\x80\x8Er\xE2\x80\x8D\xE2\x80\x8Em\xE2\x80\x8D\xE2\x80\x8Ea\xE2\x80\x8D\xE2\x80\x8Et\xE2\x80\x8D\xE2\x80\x8Ei\xE2\x80\x8D\xE2\x80\x8Eo\xE2\x80\x8D\xE2\x80\x8En|restore\snormal\sservice\sand\srecover\syour\sdelayed\smessages|continue\susing\syour\scurrent\spassword\swithout\sinterruption|Kindly\sreview\sthe\sdocument\sand\slet\sme\sknow\sif\swe\sshould\sproceed|Les\smer\sher\:\svegvesen\.no|document\shas\sbeen\sadded\sto\syour\sworkspace\sand\sis\sready\sfor\sviewing|You\shave\sa\svoice\-email\sfrom\sa\sspecific\scaller|access\syour\smailbox\sthrough\syour\semail\sprovider\'s\sofficial\swebsite|we\sask\sthat\syou\supdate\syour\spayment\smethod|Kindly\suse\sthe\sbutton\sbelow\sto\skeep|\xC2\xADlogin\s\xC2\xAD\xCF\xB2\xC2\xADr\xC2\xADe\xC2\xAD\xD4\x81\xD0\xB5n\xC2\xADt\xC2\xADi\xC2\xADa\xC2\xADl\xC2\xADs)(\W|$)/m body T_JR_CLOUDSPLOIT_BODY49 /(^|\b|\s)(expires\stoday\sand\sneeds\sto\sValidate\syour\spassword|Effectuer\sla\ssynchronisation\sde\smes\sacc\xC3\xA8s|Mise\s\xC3\xA0\sjour\sdes\sacc\xC3\xA8s\srequise\spour\sle\smaintien\sde\svos\sservices|review\sthe\sattached\sform\,?\sconfirm\syour\swillingness\sto\sserve|You\sreceived\sthis\snotification\sfrom\s\{udomain\}\sSharePoint\.|Server\sPOP3\sError\sNotification|Update\sPayment\sMethod\sBelow|Validate\syour\scurrent\spassword|Password\sRe\-validation|Action\sRequired\:\sYour\smailbox\shas\sa\stemporary\srestriction|confirm\syour\sidentity\sand\srestore\sfull\saccess|Password\sExpiration\sNotification|Your\sIRS\s2025\sTax\sDocument\sReview|mailbox\smandatory\sconfirmation\sis\sdue\stoday|Access\syour\sdocument\svia\sour\sportal\sbelow|review\sthe\sdetails\sand\sconfirm\sreceipt\sof\sthis\snotice\sby\sclicking\sthe\sbutton|Please\scheck\sthe\supdated\sfiles\savailable\sin\syour\sportal|incoming\semail\(s\)\sthat\sare\scurrently\sblocked|Please\sreview\sand\ssign\syour\sdocument\.\s\[\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s\]|verify\syour\semail\saddress\sto\sactivate\syour\saccount|Please\stake\sa\smoment\sto\sopen\sthe\sfile\sand\scomplete\sthe\srequested\saction|IMAP\/POP3\sMail\sDelivery\sFail)(\W|$)/m body T_JR_CLOUDSPLOIT_BODY50 /(^|\b|\s)(Copyright\s\xC2\xA9\sRoundcube\,\sInc\.\sAll\sRights\sReserved|download\sand\sclick\sthe\sbutton\sbelow\sto\saccess\syour\sofficial\sdocuments|Scanned\sby\:\sXerox\sTrusted\sAI\sScanner)(\W|$)/m meta __JR_CLOUDSPLOIT_BODY ((T_JR_CLOUDSPLOIT_BODY1 || T_JR_CLOUDSPLOIT_BODY2 || T_JR_CLOUDSPLOIT_BODY3 || T_JR_CLOUDSPLOIT_BODY4 || T_JR_CLOUDSPLOIT_BODY5 || T_JR_CLOUDSPLOIT_BODY6 || T_JR_CLOUDSPLOIT_BODY7 || T_JR_CLOUDSPLOIT_BODY8 || T_JR_CLOUDSPLOIT_BODY9 || T_JR_CLOUDSPLOIT_BODY10 || T_JR_CLOUDSPLOIT_BODY11 || T_JR_CLOUDSPLOIT_BODY12 || T_JR_CLOUDSPLOIT_BODY13 || T_JR_CLOUDSPLOIT_BODY14 || T_JR_CLOUDSPLOIT_BODY15 || T_JR_CLOUDSPLOIT_BODY16 || T_JR_CLOUDSPLOIT_BODY17 || T_JR_CLOUDSPLOIT_BODY18 || T_JR_CLOUDSPLOIT_BODY19 || T_JR_CLOUDSPLOIT_BODY20 || T_JR_CLOUDSPLOIT_BODY21 || T_JR_CLOUDSPLOIT_BODY22 || T_JR_CLOUDSPLOIT_BODY23 || T_JR_CLOUDSPLOIT_BODY24 || T_JR_CLOUDSPLOIT_BODY25 || T_JR_CLOUDSPLOIT_BODY26 || T_JR_CLOUDSPLOIT_BODY27 || T_JR_CLOUDSPLOIT_BODY28 || T_JR_CLOUDSPLOIT_BODY29 || T_JR_CLOUDSPLOIT_BODY30 || T_JR_CLOUDSPLOIT_BODY31 || T_JR_CLOUDSPLOIT_BODY32 || T_JR_CLOUDSPLOIT_BODY33 || T_JR_CLOUDSPLOIT_BODY34 || T_JR_CLOUDSPLOIT_BODY35 || T_JR_CLOUDSPLOIT_BODY36 || T_JR_CLOUDSPLOIT_BODY37 || T_JR_CLOUDSPLOIT_BODY38 || T_JR_CLOUDSPLOIT_BODY39 || T_JR_CLOUDSPLOIT_BODY40 || T_JR_CLOUDSPLOIT_BODY41 || T_JR_CLOUDSPLOIT_BODY42 || T_JR_CLOUDSPLOIT_BODY43 || T_JR_CLOUDSPLOIT_BODY44 || T_JR_CLOUDSPLOIT_BODY45 || T_JR_CLOUDSPLOIT_BODY46 || T_JR_CLOUDSPLOIT_BODY47 || T_JR_CLOUDSPLOIT_BODY48 || T_JR_CLOUDSPLOIT_BODY49 || T_JR_CLOUDSPLOIT_BODY50) && !(__JR_EXPLOIT_FROM_EXEMPT)) ## CREATING SUBJECT RULES: JR_EXPLOIT.cf ## header T_JR_CLOUDSPLOIT_SUBJ1 Subject =~ /You\shave\swaiting\sdocuments\sfor\sreview|[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sa\snew\sfile\swas\ssend\sto\syou\svia\sWeTransfer|[A-z]{3,20}\syour\sfile\sis\sready\sfor\sdownload|Password\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sexpires\stoday|Validate\sAccount\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Adobesign|Mailbox\sVersion\sOutdated\s\-\sTo\sFix\sErrors\s\-\sCritical\sError|Incoming\sFax\sMessage\s\-\sOnHold|ATTN\sDocument|shared\sPayment\sfiles|Plan\sShared\sVia\sFax|Meeting\sReminder\sNotice|Your\sPassword\sis\sExpiring\s\-\sUrgent|Your\sMetaMask\swallet\swill\sbe\ssuspended|Ditt\sonline\sfakturanummer\s[0-9]{13}NO\.|(\xD0\xB5\s\xD0\xB7\xD0\xB0\xD1\x81\xD1\x8F\xD0\xBA\xD0\xBB\xD0\xB0\s\xD0\xBF\xD1\x80\xD0\xBE\xD0\xB1\xD0\xBB\xD0\xB5\xD0\xBC\xD0\xB8\s\xD0\xB2\xD1\x8A\xD0\xB2\s\xD0\x92\xD0\xB0\xD1\x88\xD0\xB0\xD1\x82\xD0\xB0\s\xD0\xB5\xD0\xBB\xD0\xB5\xD0\xBA\xD1\x82\xD1\x80\xD0\xBE\xD0\xBD\xD0\xBD\xD0\xB0\s\xD0\xBF\xD0\xBE\xD1\x89\xD0\xB5\xD0\xBD\xD1\x81\xD0\xBA\xD0\xB0\s\xD0\xBA\xD1\x83\xD1\x82\xD0\xB8\xD1\x8F)|quota\sthreshold\sattained\sfor|Invest\syour\sCrypto\sand\searn\s100\%\sprofit|You\sreceived\sa\snew\sletter|Email\sVerification\s\(\s?[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s?\)|mail\sVerification\sFor\s\s?Mailbox|New\svoicemail\smessage\sfrom/m header T_JR_CLOUDSPLOIT_SUBJ2 Subject =~ /Email\sPassword\sExpired\.|You\sHave\s[0-9]{1,2}\spending\sIncoming\sMessages|Warning:\smailbox\sclose\sto\squota|Review\sdue\sinvoice\sand\sapprove\sfor\spayment|lerta\sde\sseguranca:\shouve\sum\sacesso\sde\sum\snovo\sdispositivo\sna\ssua\sconta\.\sProtocolo:|Adicionou\sum\snovo\scolaborador\s\-\sID|Important\sInformation\sAbout\sYour\sAccount|Needs\sAttention:\sIncoming\sPayment\sOn\sHold|Verify\syour\swallet|Security\sAlert\son\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|New\sSecurity\sMessage|Secure\sMessage\s[0-9]{4}\s\-\sPending\sAccount\sVerification|Your\sQuickBooks\sAccount\sIs\sOn\sHold|P\xE2\x80\x8Dass\xE2\x80\x8Dword\sExpir\xE2\x80\x8Dation\sNot\xE2\x80\x8Dice|Confirm\sYour\sDelivery\sStatus|ykwkosnqmx|Upgrade\sMailbox|ACCOUNT\sSHUTDOWN|DE\-ACTIVATION\sREQUEST|Security\/Upgrade\sMaintainance\sready|Activate\sOne\-Time\sVerification\sOn\sYour\sEmail\sAccount|You\shave\s\{0-9]\}\smessages\sundelivered|^Dropbox\sMessage\ssent\sfrom|\[Cyberdoc\]|Profile\sUpdate\srequired\sImmediately|Request\sProduction$|Verify\sYour\sAccount\sOwnership|New\sSecure\sMessage|You\shave\s\[?{0-9]{1,3}\]?\s(new\spending|undelivered)\smails\son|^Account\sTermination\sRequest|IT\sWarning\sfor\s[a-z0-9._\-]+\@[a-z0-9.\-]+\sMailBox\sAccount|^Incoming\sPending\sMessage$|Action\sRequired:\sYou\shave\s[0-9]\sblocked\smessages/m header T_JR_CLOUDSPLOIT_SUBJ3 Subject =~ /Password_Expiry_Notification|[a-z0-9.\-]+\.[a-z0-9.\-]+\sShared\sNew\sProject\sContract\sDocument|\([0-9]\)\sQuarantine\sMessages|Verify\syour\sIdentity|Noticy\sOf\sPolicy|Documents\sfrom\s[a-z0-9.\-]+\.[a-z0-9.\-]+\sService|Claim\syour\sReward\stoday|^Hello\sdear|Business\sVoicemail\sMessage|You\sHave\sNew\sSecurity\sMessage|[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s\-\sPending\sEmails\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|DHL\sExpress\sDelivery|LinkedIn\sbusiness\sRequest\sfrom|Incoming\sMails\sFailed\sTo\sDeliver\sTo\sYour\sMailbox|Laste\sNote\s\!|We\sare\ssad\sto\ssee\syou\sgo|Security\sVerification\sIs\sRequired|Account\ssuspension|EMail_DomainPart\]\-|Pending\sEmails\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Warning:\smailbox\sis\sfull|Your\semail\saddress\swill\sbe\ssuspended|Mailbox\sQuota\sExceeded|Deativation\sNotice|Password\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sexpires\ssoon|Mail\sdelivery\sfailed:\sreturning\smessage\sto\ssender|Urgent:\sImportant\sAction\sRequired|E\-mail\spassword\sset\sto\sexpire\:\swarning|Account\sVerification\sMessage|Mailbox\saccount\sabnormal\slogin\sreminder|Roundcube\sAlert\sWarning|Scheduled\sPrivate\sEmail\sSoftware\sUpgrade|Someone\smay\shave\saccess\sto\syour\saccount|Account\s\s?Notification|y4w24x/m header T_JR_CLOUDSPLOIT_SUBJ4 Subject =~ /Shipping\sDelivery|You\shave\s[0-9]{1,2}\spending\semails\,\sdownload\sthem\snow|NEW\sDOMAIN\sUPDATE|You\shave\sreceived\sa\snew\selectronic\sPurchase\sOrder|Please\sfind\sattached\sdocuments|Incoming\sEmails\sBlocked\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|MSG\-PSWD\snotice|Authentication\s?\/\s?Expire\sRequest|Folder\sError\sNotice|Voice\sMessage\sReceived\sFrom|Control\spanel\sstorage\sAlert|Security\sValidation\sMessage|Password\sExpiration\son|Your\sPending\sPayment\sHas\sDeclined|Upgrade\sYour\sAccount|Verify\syour\sMail\sAccount|Delayed\sIncoming\sMails|Downtime\sNow\sOver|Validate\sNow\s\-\s(Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday)|Your\ssubscription\shas\sbeen\ssuspended|Please\ssend\sus\sinvoice\sto\senable\sus\sreview\sand\sget\sback\sto\syou|Your\sAction\sIs\sRequired|email\saccount\sis\snearly\sfull|Quota\sIs\sDue\sFor\sUpdate|Password\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sexpires|Incoming\sMesaages\sHeld|Use\sbelow\sbutton\sto\skeep\sor\supdate\scurrent\scredentials|[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s\-\sPassword\sExpired|received\sa\sshare\sdocument\svia\sOnedrive|Mailbox\sTermination\sWarning|Mailbox\sDeactivation\sNotice|Delivery\sfailed:\sreturning\smessage\,|ACTION\sREQUEST\sFOR\sSTORAGE\sUpgrade|have\s[0-9]\sPending\sincoming\smessages/m header T_JR_CLOUDSPLOIT_SUBJ5 Subject =~ /Email\sAccount\sClosure\sRequest|Service\sFund:\sEFT\sPayment\sDelayed|Ser?ver\sRequest\sNotification|Mailbox\sis\sFull|Storage\sQuota\sNotice|package\swill\sbe\ssuspended\sin|Severe\sinternal\sinformational\srequest|Your\smailbox\sis\salmost\sfull|Final\sDeactivation\sNotice|You\sreceived\sa\ssigned\scontract\sdocument\svia\sOnedrive|You\shave\sreceived\sa\snew\sfile|Email\s\xE2\x9C\x89\sTermination\sis\sin\sprogress|incoming\smessages\spending\son\sE\-mail|unread\sbusiness\smessage\svia\sLinkedIn|You\shave\s\([0-9]{1,2}\)\sPending\sMessages|Delivery\sNotice\s?\-\s?[0-9]{1,2}\sinbox\smessages\sSuspended|SHIPMENT\sDOCUMENTS|New\sFile\sReceived|Confirmation\sUpdate\sPassword|Incoming\smails\sblocked!|Mail\sservice\shalted\sover\sstorage\scapacity|wallet\swill\sbe\ssuspended\sand\syour\sassets\swill\sbe\sfrozen|ELECTRONIC\sINVOICE|Media\sContact\sfrom\sWebsite|You\shave\s[0-9]\snew\sbusiness\smessage|Urgent\s\!{1,4}|ACH\/EFT\s:\sImportant\sDeposit\sDocument|New\sDocument\sFrom\sSSA\.GOV|Warning:\sYour\smailbox\sstorage\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Important:\sMessage\sAbout\sYour\sAccount\sFrom|Action\sRequired:\sAuthenticate\sYour\sEmail\sAddress|Users\sinbox\sis\sfull|mailbox\sis\sunable\sto\ssend\semail|Password\sExpiry\sFor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}/m header T_JR_CLOUDSPLOIT_SUBJ6 Subject =~ /Final\swarning\s:\sYour\smailbox\sis\salmost\sfull|AktuaIisiere\sdeine\slnformationen\s\.|kindly\srectify\syour\saccount\sbelow|Action\sID\!\!\!|Messages\sPending\sDelivery\sOn\sYour\se\-Mail\sPortal|DocSign\ssent\syou\sa\sfile\sfor\ssign\sand\sapproval|Quarantine\sSummary:\s\[\s?[0-9]\smessage(s)\squarantined\s?\]|Kindly\sConfirm\sYour\sSecured\sDocument|20[0-9]{2}\sAudit\sPreview|EMAIL\sDE\-ACTIVATION\sNOTICE\s\(DO\sNOT\sIGNORE\)|Messages\sfrom\s[0-9]{4}\sfor\s[A-z0-9\-_\.]{2,40}|Your\s\[Email\]\swill\sbe\sblocked|Mailbox\sLogin\sNotification|PASSWORD\sRESET\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Completed:\sPlease\sReview\sand\sSign|Received\sAWB\sDocuments\svia\sWeTransfer|Unauthorized\sAccount\sClosure|Account\sClosure\sRequest|[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sServer\s\-\sPassword\sExpired|[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s:Email\sNo\sLonger\sIn\sUse|Mails\sPending\sAction\!{2,3}|Action\sRequired:\sYour\sPassword\sHas\sExpired|Meeting\sReminder\sVia\sSharepoint|Action\srequired:\sPlease\sverify\syour\semail\saddress|Urgent\sRoutine\sMaintenance|The\sDocument\sis\sShared\sto\sYou|Mailbox\sError|Service\sSuspension\sNotice|Undelivered\sEmails|New\sFax\sDocument[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}|File\son\sOneDrive\sfor\syour\sreview\s\!|CD\s\&\sOther\sClosing\sDocs\sAttached|5000K\sNEW\sORDER/m header T_JR_CLOUDSPLOIT_SUBJ7 Subject =~ /Your\sIncoming\sFailed\sMessages|Password\sHas\sExpired|Update\sand\scontinue\susing\syour\smail\sservice|Many\sfiles\swere\srecently\sdeleted\sfrom\syour\sOneDrive|E\-mail\sstorage\slimit\sexceeded|Incoming\sFailed\sMessage|Share\sPoint\sAccount\sVerification\sCode|Important\sMessage|Your\sorder\s[0-9]{3}\-[0-9]{7}\-[0-9]{6}\shas\sbeen\sshipped|ACH\sCompleted|New\schanges\!|File\sShared\sto\syou|Delivery\sreport\-\s[0-9]\sinbox\smessages\son\shold|Failed\!\s\sNotification|Certificado\sDigital\sAFIP|Incoming\s\&\sOutgoing\smail\sfailed|Re\-confirm\saccount|[0-9]\sUnread\sMessages?\sFrom\.\.\.|It\'s\sa\sMatch\!|You\shave\spending\smessages\son\sour\sremote\sserver|Scanned\sDocument\sShared\sVia\sOneDrive|Login\sUpdate|Important\sSecurity\sUpdate\sfor|Action\sRequired|Attention\sRequired\s\#[0-9]{7}|MIL\spontos\svao\sexpirar\sem\sbreve|New\sEmployee\sHandbook|Service\sexpiration\snotice\s\-\sREF:|All\stransactions\son\shold\!|Please\smoderate:|a\stemporary\shold\son\syour\saccount|Password\ssuspension\sfor|Order\sConfirmation\sfor|EMAIL\sUPDATE|New\sNotice:\s[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}\s[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}\s[ap]\.m\.|[0-9]{8}\sis\syour\sMicrosoft\sSharePoint\sverification\scode\.|Webmail\smaintenance\ssupport|Your\sattention\srequired|Attention\srequired|Viktig\s?:\s?Oppdater/m header T_JR_CLOUDSPLOIT_SUBJ8 Subject =~ /Your\sattention\sis\srequired|New\sMessage\son|Some\sinformation\sseems\sto\sbe\sinaccurate|Additional\sinformation\srequired\sfor\sthis\sshipment|information\sneeded\sto\scomplete\syour\ssubmission|Email\sPassword\sUpdated|Review\syour\saccount|Restart\syour\smembership\sID|Your\sOffer\s\(\$[0-9]{2,3}\sValue\)|[0-9]\sPending\sIncoming\sMessages|Inquiry\s\#\s2023|Statement\sof\sAccount\sand\sInvoices\sFor\sYour\sReview|DocSign\ssend\syou\sfile|^Final\sAttempt\!$|Please\sinvoice\sfrom\sDocuSign|Invoice\sPayment\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|LARGE\sFILE\sVIA\sweTranfer|You\shave\sreceived\smoney\swith\sZelle|Your\smoney\sis\spending\!|Please\svisit\ssecurity\scenter|sent\svia\sWeTransfer|Your\sPo\/Item\slist|Service\shas\sbeen\sStopped|\|\s[0-9]{10}\s\||(^|\s)DHL($|\b)|Annual\sLeave\sCompliance|New\sScanned\sdocument\sfrom|Annual\sLeave\sCompliance|have\sreceived\sa\snew\sdocument|Your\ssent\smail\swas\sundelivered|Payment\sAdvice\sDocuments|Email\saccount\sverification\supdate|Payment\srun\sfor\spending|Pending\sTransaction|payroll\sfor\spreliminary\sreview|ACTION\sREQUIRED:\sIncoming\sPending\sMessages|\[SEC\=OFFICIAL\]|incoming\smessages\spending\sdelivery|Verification\sproccess|Important\sSecurity\sNotification|[0-9]\sMail\sdelivery\sfailed\sfor|Current\sAccount\sStatement/m header T_JR_CLOUDSPLOIT_SUBJ9 Subject =~ /Payoff\sLetter\s\&\swire\sinstructions|Re\-authenticate\sSign\-in|Email\saddress\sverification|SharePoint|e\-payment\sPortal|Supplier\sDocument\sRequest|have\sreceived\sa\ssecure\sPO|Email\sAuthenticate\sRequest|Server\sWarning\!\!\!|Document\sRecieve\sVia\sOneDrive|Account\sto\sshut\sdown|New\sEncrypted\sMessage\sNotification|Important\sAccount\sNotification:|Violation\sof\sCommunity\sStandards|Bekreftelse\sav\srefusjon|removal\sfrom\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\srequested\son|subject\sto\sa\stemporary\ssuspension|New\sprojects\.|Your\sresponse\sis\sneeded\snow|We\swill\sbe\sdisabled\syour\sadvertising|Email\sverification\sprocess|MAILBOX\sALERT\sFOR|IT\-Desk\sFrom|Mail\-box\svalidation\srequired|You\'ve\scanceled\syour|Apply\sKYC\sVerification|Verification\sServices\s:\sSecure\sYour\sFunds|2023\sPayment\sAudit|password\sis\sabout\sto\sexpire\!|SystemDesk|Important\sCrediential\sNotification|(Password|Login)\sExpir(y|ation)\s(Notice|Alert)|mail\sest\xC3\xA3o\spara\sser\ssuspensos|Automatic\sreply:|cPanel\sNotification\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Important\sNotice:\sBlocked\sEmails|Email\sOutgoing\sBlocked|Kontoen\sdin\ser\sblokkert|Ny\smelding\!|iCloud\sStorage\sLimit\sReached|Upgrade\sNow\sfor\sUninterrupted\sService|Oppdater\sinformasjonen\sdin|Nye\sbruksbetingelser/m header T_JR_CLOUDSPLOIT_SUBJ10 Subject =~ /Reactivate\sYour\sAccount\sfor\sEnhanced\sProtection|Dessverre\smislyktes\sbetalingen|Incoming\smails\snot\sdelivered|Complete\sviaSign:|Ignoring\sthis\smessage\swill\simpact\syour\saccount|shared\svia\sSecureMessage|Incoming\smails\sblocked\!|Membership\sis\srenewal\sscheduled|WebMail\sAccount\swill\sbe\sSuspended|Urgently\supdate\syour|Server\s\xE2\x80\x93\sPassword\sexpired|Re\-Authentication\sRequest|ProSeries\spayment\snotification|this\smessage\smay\sresult\sin\saccount\ssuspension|KYC\sVerification|Your\sParcel\sis\spending|Deals\sand\sPO\sSheet\sreceived\sas|Aviso\sextrajudicial\sde\sla\sJusticia|Deactivation\sRequest\sIn\sProgress\sFor|OnePark\s\&\sAutoPay|Annual\sPerformance\sAppraisal|Your\sEmail\sHas\sbeen\sBanned|lire\sles\smessages|Admin\sShared\sa\sRemittance\sReceipt|sent\sYou\san\sEncrypted\sMessage|Incoming\smails\spending\sdelivery|Email\saccount\sexpiry\snotice|Account\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sis\sLocked|messages\sin\syour\semail\squarantine|Score\sreleased\:|ACH\sRemittance\se\-Payment\:|Email\sStorage\sWarning|You\shave\san\sImportant\sDocument|Important\sDocument\sVia\ssharepoint|Account\sUpdate\s:\sSecurity|Important\sdelivery\snote:|Confirm\sYour\sEmail\sfor\sSecure|update\syour\se\-mail\sservices|Delivery\snotice\sto\sREF\sNo:AWB[0-9]{7}/m header T_JR_CLOUDSPLOIT_SUBJ11 Subject =~ /your\spassword\sis\sabout\sto\sexpire|Action\sis\srequired\simmediately|Important\sserver\smessage|refusjon\sav\sfaktura|Corresponding\sDoc\sto\sView|Pending\sMessages\sAlert|1st\sNOTICE|Employee\sBenefit\sBonus|Pending\sUndelivered\sMails|Incoming\sMessages\sBlocked|Existing\sUsers\sto\sRe\-Confirm|Critical\sEmail\sNotification|messages\spending\son\syour\semail|Staff\sEmployment\sTermination\slists|Avoid\sPassword\sexpiration|password\sis\sset\sto\sexpire\stoday|Action\sneeded\sfor\s[A-z0-9]{3,20}\stransaction\.|Urgent\sTwo\-Factor\sAuthentication\sActivation|Delivery\sError|password\sis\sExpiring\sToday|Reminder\!\!\!|Password\sReset\sNotice|Authorization\sSystem\sAccess|Save\spassword\sNow|Shipment\sfor\sPurchase\sOrder\-[0-9]+|\spassword\sexpires?\stoday|[Yy]our\saccount\spassword|password\sexpire\stoday|[0-9]{2}hrs\s\sAccount\swill\sbe\ssuspend|Verify\sOwnership\sE\-mail|Account\sSecurity\sCheck|Mail\sAccount\supdate|I\-T\s\s?Update|Update\s\s?Alert\!|Your\spackage\scould\snot\sbe\sdelivered|unbelievable\sremedy|Login\sAuthentication\sExpires|currently\shave\s(one|two|three|four|five|six|seven)\sunread\smessages|suspension\son\syour\smailbox|A\snew\sfile\snamed\s.*\.pdf\shas\sbeen\sshared|account\spassword\sexpires\stoday|Additional\sSecurity\sVerification|Unusual\sSign\-in\sActivity/m header T_JR_CLOUDSPLOIT_SUBJ12 Subject =~ /waiting\sfor\sownership\svalidation|Email\sQuarantine\sReport|You\sHave\s\([0-9]\)\sFailed\sMessages|\[Action\sis\sRequired\]|Review\sEmail\sAccess\sPreference|Employment\sTermination\sAnnouncement|Product\sInquiry|Relay:\sVoicemail\sMessage|Employment\sTermination|shared\sdocument\sfrom\sOneDrive|Inbound\sQuarantine\sEmails|Fraudulent\sPayment\sDetected|Outstanding\sInvoice\sStatus|Update\sKYC\sDetails|Timesheets\-Remider\-|Secured\sMessage\sfor\s[a-z0-9\-_\.]{2,40}\@[A-z\-_0-9.]{2,40}\.[A-z]{2,8}|Update\syour\smailbox\sPreference|via\sRazorpay|New\sPolicy\sAmendments|your\sbank\sdetails|Closing\sSettlement|A-z]{2,20}\sNotification\sAccess|Oppdater\skontoen\sdin|Update\syour\saccount|Retain\sExisting\sPassword|Account\sExpiration\sWarning|Mailbox\sQuota\supgrade|IMAP\/POP3\sand\sSMTP\sServer\sAuthentication|PRODUCT\sOF\sTHE\sDAY|Settlement\sFunds\/Closing|Authenticate\sYour\sAccount|You\shave\sa\snew\sbuyers\sinquiry|Contract\sDocument\sfor|You\sReceived\sa\sVoice\sMessage|Payment\sSchedule|Please\sacknowledge\sthe\sreceipt|Your\saccount\shas\sbeen\srestricted|account\swill\sbe\sblocked\sfrom\ssending\sand\sreceiving|MESSAGE\sFAILURE|Increase\sin\ssalary|MEGA\sDEALS|Discount\spack|Voice\-Note\ssent\sto\syour\smail\-box|Security\sAlert:\sData\sBreach|Important\s\-\sUpdate\syour\sinformation/m header T_JR_CLOUDSPLOIT_SUBJ13 Subject =~ /shared\sa\spresentation|Wire\sTransfer\s\(Success\)|C0nfirmati0n|compliance\sissues\sdetected|SOA\sand\sOverdue\sinvoices|Account\sWill\sBe\sBlocked|Your\semail\sdata\sstorage\sis\salmost\sfull|USA\sPHARMACY|YETI\sCrossroads\sBackpack|invoices\sfor\spayment\ssettlement|Your\sMailbox\sis\sstorage|changes\sto\sextranet\saccess|You\shave\sa\snew\ssecure\smessage|Westech\sEngineering\sLLC|You\shave\sreceived\sa\snew\sDocument|You\shave\sPending\sMessages\son\sYour\sEmail\sServer|Your\sNew\sEmail\sNotifications:|Binance\sTrading\sAccount|Verify\sYour\sEmail|Document\s\xC2\xA0?Awaits\sYour\sReview\s\&\sSignature|Completed:\s:\sComplete\swith\sDocusign|Your\sNew\sEmail\sNotifications|You\'ve\sreceived\sa\sNew\sSecured\sDocument|EFT\/ACH\sCompleted|Shipment\sDocumentation\sfor\sReview|Transaction\sConfirmation\sNotification|Review\sDocument\s\:\sKindly\sSign|\"?WARNING[\":\-]\sReview\spending\smessages|Please\sClick\sto\sConfirm|MaiIbox\sStorage|Quota\sLimit\s\s?Exceeded|account\spassword\swill\sbe\sexpires|Aktualisieren\sSie\sIhre\sKontoinformationen|Verify\syour\semail\saddress\sto\ssecure\syour\sdomain\sname|^Review\sPayment\sInvoice\.|Shipment\sREF\#[0-9]{5}|Mail\-in\-a\-Box\sUsage\sReport|Urgent\sAccount\sAttention\sRequired|RFQ\sChemicals|Yeti\sRambler|Mail\sroutine\smaintenance\s\!\!/m header T_JR_CLOUDSPLOIT_SUBJ14 Subject =~ /Email\sDelivery\sProblems\son\s[A-z0-9\-_\.]{2,40}\@[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}|Take\surgent\saction\sto\ssecure\syour\smailbox|Yearly\sEmployee\sPerformance\sReport|Review\sYour\sInformation\sfor\sContinued\sService|Account\sUpdate\sFor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}|Your\scredit\slimit\shas\sbeen\sexceeded|You\shave\s[0-9]\smessages\sheld\sfor\syour\sreview|Urgent:\sVerify\sYour\sContact\sDetails|your\sCompany\sName\sreward|your\schargeback\shas\sbeen\scompleted|Oppdater\sbetalingsinformasjonen\sdin|\([2-9]\)\s\sPending\sMail($|\b)|Antivirus\sAlert|EFT\-Remittance\sAdvice|E\-mail\sNotifiations|current\semail\saddress\s[A-z0-9\-_\.]{2,40}\@[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}\shas\sbeen\smarked\sas\sspam|Docu\sReview\sComplete|^iCloud\sUser|Google\sSecurity\sAlert|your\sApple\sID\saccount|Awaits\sYour\sReview\s\&\sSignature|^Mailbox\squota$|Expire\sLogin|Advisory\sNotice:\ssettlement\sreceipt|Pending\sEmail\sMessages|Important\smessages\spending|Email\sPolicy\s\&\sPrivacy\sViolation|Profile\sOn\sHold|Pending\sDocu\sReview|A\snew\sfile\swas\ssend\sto|2025\sLeave\/Vacation\sSchedule|Reminder\-Server|Expiry\-Request|give\sme\syour\sbest\sprice\sfor\sthe\sbelow\sproducts|Salary\sConfirmation\sEmail|Human\sVerification\sRequired|Reply:\sRE:\sRe:\sDeposit\s\-\sP\/I/m header T_JR_CLOUDSPLOIT_SUBJ15 Subject =~ /contract\.pdf\sdocument|Confirm\sYour\sDomain\sOwnership|You\shave\sshared\sfiles\son\sOneDrive|You\shave\s[0-9]\((one|two|three|four|five|six|seven|eight|nine)\)\snew\sdocuments|Statement\sfor\saccount\s[0-9]{7}\s[a-z]{2,15}\.pdf|You\shave\s[0-9]\((one|two|three|four|five|six|seven|eight|nine)\)\snew\sdocuments|Cloud\sStorage\sHas\sReached\sIts\sLimit|Password\sIs\sExpiring\!\x5C\xE2\x80\x93\x5CsConfirm\sNow|ERA\/EFT\sClaims\xE2\x80\x93\sAttention\sRequired|Commission\/Salary\sadjustment\.|Payment\sConfirmation\sfor\sInvoice|DBT\sPayment\sAdvice|Please\sCheck\sand\sConfirm|Introducing\sour\snew\slicense\ssoftware|document\sfor\ssignature\sneeded_for_[A-z0-9\-_\.]{2,40}\@[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}|Hardware\sWallet\sData|\!Security\sNotice|Try\sthis\sinstead$|your\sQuickbook\sOnline\sAccount|Password\sRegeneration\sRequired\sFor|ACCOUNT\sMAINTENANCE|\*DO\sNOT\sIGN0RE\*|Cliams\s\#[0-9]{7}\s\xE2\x80\x93\sAttention\sRequired|Deactivate\sAccount\sRequest|Email\sAddress\sVerification\sRequired|Deadline\sApproaching:\sAccount\sConfirmation|Account\sStatus\sChanged\s\xE2\x80\x93\sConfirm\sChanges|Please\sReview\sRecent\sActivity|Payment\sReminder\s\xE2\x80\x93\sOverdue\sInvoices|Please\sconfirm\syour\sE\-mail\saddress|Email\sAuthentication\sRequired\!|Verify\sYour\sAccount\sto\sRegain\sAccess/m header T_JR_CLOUDSPLOIT_SUBJ16 Subject =~ /Validate\sYour\sCrypto\sWallet|Can\sWe\sDiscuss\sThis\?|Account\sAccess\sNeeds\sReconfirmation|Security\sNotice\sfrom\sLedger|Attention\sNeeded:\sSecurity\sIssues|^Status\supdated\ssuccessfully$|Action\sRequired:\sYour\sEmail\sAccount\sUpgrade|Executive\sOnboarding\sProtocol\sApproval|Your\sSignature\sRequested:\sNew\sExecutive\sOnboarding|Prepared\sfor\sExecutive\sReview|[A-z]{2,20}\sNew\sDocument\sAlert\:|Discontinuation\sNotice\!\!|\*\*Missed\sCaller\*\*|Action\sNeeded\:\sVerify\syour\saccount|have\s\([0-9]\)\sMails\sPending\s\!|A\sg\sr\se\se\sm\se\sn\st|\xE3\x80\x90Charles\sSchwab\xE3\x80\x91|Completed:\sPlease\sreview:|Completed:\s[A-z0-9]{2,15}\sAmended\sand\sRestated\sAgreement|Clear\sYour\sCache\sImmediately|Your\spassword\swill\sexpire\stoday\!|Your\siCloud\sID\shas\sbeen\slocked|Install\sSSA\sAccess\sto\sView\sYour\s2025\sBenefit|Your\sCloud\sStorage\sExpired|WARNING\s\!\!\sSystem\shave\sdetected|Purchase\sContract\sDocument\sShared\swith:\s[A-z0-9\-_\.]{2,40}\@[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}|You\shave\s\([0-9]\)\sdelayed\sE\-mails|Your\sEmail:\s[A-z0-9\-_\.]{2,40}\@[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}\swill\sbe\sblocked|Access_Granted_to_Finalized_File_Please_Review|Authentication\serror\sin\s[A-z0-9\-_\.]{2,40}\@[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}|ONE\sTime\sVerification|Mail\sUnHold/m header T_JR_CLOUDSPLOIT_SUBJ17 Subject =~ /Notification\sof\sa\sNew\sSecure\sMessage\sDocument\sfor\sYour\sAttention|Complete\swith\sDocu\-Sign:\sSigning\scompleted\s\-|documents\sfrom\sR\sHudson\s\&\sCo|Important\sEmail\spending\sto\syour\sinbox|your\sattention\sis\sneeded\sfor\sa\sdocument\sawaiting\sreview|Notification:\sShared\sDocument|Invoice\sStatus:\sOverdue\s\&\sPaid|Security\sNotification\s\xE2\x80\x93\sAction\sRecommended|Your\sCloud\sStorage\sIs\sAlmost\sFull|Secure\sYour\sFiles\sNow|Payroll\/Disbursement\sManagement|Y\sou\sr|P\sas\ssw\so\srd|document\shas\sbeen\sshared\sto\syou\svia\sDocusign|Document\sDelivery\svia\sMicrosoft\sOneDrive|parkering\si\sAUTOPAY\-systemet|Complete\sVerification\sto\sAvoid\sAccount\sIssues|Completed:\sSales\sAnd\sPurchase|Account\sValidation\sService|New\s+VoiceMail\s+Notification\s+From\s+[0-9]{9}XX|invited\sto\sthe\sorganization\sBilling\sapplied|Document\sof\snew\sorders|Email\s[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}\sPassword\sDue\sFor\sChange|Cancellation\sof\syour\ssubscription\.|Review\sand\sSign\sto\sFinalize\sPending\sPayments|Incoming\sPhone\sCall\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}|Unlimited\sStorage\sSpace\sActivation\sWith\sNew\sSecurity|Sales\sOrder\sConfirmation|ATTENTION:\s[0-9]\sPending\sE\-mails|Handling\skreves\sfor\skontosikkerheten\sdin/m header T_JR_CLOUDSPLOIT_SUBJ18 Subject =~ /Mensuel\sverifisering:\sBekreft\sinformasjonen\sdin\sfor\s\xC3\xA5\sfortsette\s\xC3\xA5\sbruke|Please\sconfirm\sthree\s\([0-9]\)\sPending\sMessages|Important\sNotice:\sPrevent\sAccount\sLockout|Incoming\smessages\sblocked\!|Prevent\sAccount\sLockout|Parcel\sissue\,\splease\sreschedule\sdelivery|Address\serror\splease\scorrect\spromptly\sTracking\sNumber|Address\serror\sdelivery\sobstructed\sID|Important\sAlert:\siCloud\sBilling|Xerox\sMultifunction\sScanner|ePrint\sDocument\sDistribution|EFT\/ACH\sReceipt\sNotice|no\slonger\ssend\sand\sreceive\semails\son\s[A-z0-9\-_\.]{2,40}\@[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}|Your\saccount\sstorage\sstatus|Update\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}|Your\sMailbox\sStorage\sNeeds\sAttention|Undelivered\sPending\sMessages\!|Update\sNotice\!\!|Incoming\sEmails\son\sHold|Undelivered\sItems\son\sMailServer\*\*|Payment\sFailed\sfor\sYour\s[0-9]{3}GB\sCloud\sStorage\.|Your\sstore\sis\sfull\s?\,\sclick\sto\scheck|Cloud\sStorage\s[0-9]{1,3}[GT]B:\sPayment\soverdue|Immediate\sAction\sRequired.\sPayment\sDeclined|Your\sCloud\sAccount\shas\sbeen\slocked|Your\s[Pp]hotos\sand\s[Vv]ideos\swill\sbe\s(deleted|[Re]emoved)|We\sHave\sTo\sSuspend\sYour\sAccount\sToday|Alerts:\-\sPlease\sReview\sYour\s2025\sTax\sDocuments\.|Secure_Disbursement\sfor/m header T_JR_CLOUDSPLOIT_SUBJ19 Subject =~ /Storage\slimit\sreached\son\syour\saccount|Account\sActivity\s:\sUrgent\sAction\sRequired|You\sreceived\sa\ssecured\sfile\svia\sSharepoint|Extend\syour\scloud\sstorage|ALERT:\sHackers\sCan\sAccess\sYour\sDevice|Your\saccount\sis\sscheduled\sfor\sclosure|Your\sfiles\sare\sabout\sto\sbe\slost|Subscription\sCancelled:\sPayment\sfailed|Data\sProtection\sAlert:\sStorage\sFull|Your\sphotos\swill\sbe\sdeleted\stonight|We\scould\snot\sprocess\syour\spayment|renew\sto\skeep\syour\sstorage\sactive|Storage\sLimit\sReached|Your\sstorage\sis\salmost\sfull|Status\sChange:\sINACTIVE|^Recent\sAccount\sRequest|Your\sFiles\sWill\sBe\sPermanently\sDeleted|Review\syour\sstorage|Final\sNotice:\sAntivirus\sprotection\sexpired|DEVICE\sIS\sNO\sLONGER\sSAFE|Manage\syour\sstorage\ssettings|Account\sActivity\sNotification\/Update|^Your\splan\shas\sexpired|FINAL\sNOTICE:\sFile\sdeletion\sscheduled|Access\sDenied:\sAccount\sLocked|Last\sChance\sto\sProtect\sYour\sDATA|Your_CIoud|account_will_be_suspended|\|\|[A-z0-9\-_\.]{2,40}\@[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}\|\||Un\-Authorized\sSign\-in|Uploads[\s_]Paused:\sStorage\sFull|Payment\sFailed:\sSubscription\sTerminated|Failed\sto\ssave:\sNot\senough\sspace|Failed\sto\ssave:\sNot\senough\sspace|Error:\sUnable\sto\supload\sfile|Action\srequired:\sYour\spayment\sfailed/m header T_JR_CLOUDSPLOIT_SUBJ20 Subject =~ /Please\sreview:\sPurchase\sOrder\s[0-9]{6}|deaktiviert\s\xE2\x80\x93\sFotos\s\x26\sVideos|Reminder:\sContact\sIT\sSupport|Action\srecommended\sfor\syour\saccount|Your\sAccount\sis\son\sHold|Don\xE2\x80\x99t\sLose\sYour\sFiles|Secure\sMore\sCloud\sStorage|We\scant\sprocess\sthe\spayment|Uploads\sPaused:\sStorage\sFull|Security\sConsent\sRequest|Syncing\sdisabled:\sCapacity\sexceeded|Error:\sUnable\sto\supload\sfile|YOUR\sCARD\sWAS\sDESTROYED|Webmail:\sNew\sSign\-in\sAlert|Critical\sStorage\sAlert|Operation\sFailed:\sNo\sSpace\sLeft|FINAL\sALERT:\sFiles\swill\sbe\sdeleted|Critical\sFailure|Data\sremoval\simminent|Action\srecommended\sfor\syour\sfiles|CRITICAL\sSECURITY\sALERT|Account\sLocked\sDue\sto\sUnauthorized\sActivity|\xF0\x9D\x96\xAF\xF0\x9D\x97\x85\xF0\x9D\x96\xBE\xF0\x9D\x96\xBA\xF0\x9D\x97\x8C\xF0\x9D\x96\xBE|Please\supdate\spayment\smethod:|Data\sprotection\sdisabled|Account\ssynchronization\srequired|^Document\sis\sready|Action\srequired:\sCloud\sfull|Your\sPassword\swill\sexpire|Storage\sfull\?|Your\saccount\swill\sbe\srestricted|Storage\sused\s100\%|\xF0\x9D\x96\xA2\xF0\x9D\x97\x81\xF0\x9D\x96\xBE\xF0\x9D\x96\xBC\xF0\x9D\x97\x84|PO\sContract\sAgreement\sApril|keep\syour\scurrent\sstorage\splan|Failure\sDelivery\sExcess\sSpam|Voicemail\sAlert:\sYou\shave\s[0-9]\snew\svoicemails/m header T_JR_CLOUDSPLOIT_SUBJ21 Subject =~ /Shared\sDocument:\sHR\sManager\sPayment\sSchedule|^Pending:\s[A-Z]\-[0-9]{6}\sQuotes\/Summary|Email\sDeliverability\sAlert|Some\smessages\snot\sdelivered|Password_expiry_notice_Update|Important\sAccount\sSecurity\sUpdate|Reset\syour\spassword\sfor|Partnership\sProposal\sRequest|restore\syour\scloud\sbackups|Password_expiry_notice|Account\sdocuments\sfor\syour\selectronic\ssignature|New\sHR\sDocument\s\xE2\x80\x94\sReview\sNeeded|Incoming\sDelivery\sProcessing\sFailed|Urgent\sdeactivation\snotice|Purchase\sOrder\sINV\#[0-9]{5}|Webmail\sAccess\sExpiry|Account\sStorage\sExceeded|UPS\sPlease\sVerify|Keep\sYour\sAccount\sInformation\sUp\sto\sDate|Revalidate\sYour\sEmail\sAccount|Complete\swith\sDocu\sSign:|Attention\sRequired:\sPassword\sExpiring|Message\sReview\sRequired|Kortet\sditt\ser\ssperret\sp\xC3\xA5\sgrunn|Security\s\&\sSystem\sMaintenance\sNotice|Important\sAccount\sAlert|Cloud\sStorage\sFull|Upgrade\sFull\sPlan\sToday|Please\sReview\sYour\sAccount|ATTN\sRequired:\sEmployees\sSOA|Important\sSecurity\sNotice|Resolve\sMailbox\sAccount|Regarding\sYour\sDigital\sTrading\sAccount|Mailbox\sAccount\sError|New\sshared\sdocuments\sfor\syour\sreview\s\-\s[0-9]{2}\/[0-9]{2}\/202[0-9]\s\-\s[A-z0-9\-_\.]{2,40}\@[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}|Email\sOwnership\sVerification|Banque\spopulaire/m header T_JR_CLOUDSPLOIT_SUBJ22 Subject =~ /New\sDocument\sReceived\s-\s+\([A-z0-9\-_\.]{2,40}\@[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}\)|Upgrade\sto\s[0-9]{3}\s?GB\sstorage\splan|Submission\sof\sAccount\sDocuments|Account\sDocuments\sfor\sReview|Get\smore\sspace\sfor\syour\sphotos\sand\sfiles|Cloud\sDrive\sis\sfull|Photos\sare\sno\slonger\sbacking\sup|Action\sRequired\sto\sRegain\sAccess\sto\sYour\sAccount|important\semails\sawaiting\sdelivery\sto\syour\sinbox|Loan\sRequest\sConfirmation|Verifisering\skreves\sfor\suavbrutt\stjeneste|Delivery\sexpired\,\splease\sreschedule\sTracking\sNumber|storage\saccess\sis\stemporarily\sfrozen|Reactivate\syour\ssuspended\sstorage\splan|New\sPurchase\sRequisition\savailable|Signed\sDocument\sProcessed\s\-\sPlease\sCheck|New\sshared\supgrade\sfor\syour\sreview|U\sheeft\seen\sbelangrijke\supdate|Critical\ssecurity\salert|Account\sNotice\s\xE2\x80\x94\sPlease\sReview\sYour\sInformation|\xE9\x87\x8D\xE6\x96\xB0\xE6\xBF\x80\xE6\xB4\xBB\xE5\xB8\x90\xE6\x88\xB7|Federal\sTax\sDocument\sSecure\sMessage|\[\d\]\sDocuments\sfor\sYour\sReview\s\/\sSign\sNow|EMAIL\sSIZE\sALERT:|Upgrade\sYour\sMailbox|Mailbox\sCapacity\sAlmost\sReached|View\sYour\sEncrypted\sMessage|Your\sorder\shas\sbeen\sConfirmed|Docu\-Sign:\sSignature\sRequired\s\-\sPending\sYour\sReview|Action\sRequired:\sPending\sMessages|been\slisted\sas\sa\sreference/m header T_JR_CLOUDSPLOIT_SUBJ23 Subject =~ /Payment\sReceipt\sAttached\sfor\sConfirmation|Action\sRequired:\sPlease\sReview\sThis\sDocument|Notice:\sYou\sno\slonger\sSend\sor\sreceive|Review\sRequested:\sDocument\sReceived|Account\sStatus\sConfirmation\sRequired|Transaction\sReceipt:\sDeposit\sConfirmation|ACH\sPayment\sConfirmation|Your\semail\saccount\swill\sbe\sdeactivated\ssoon|Nye\sbetingelser\sfor\sdin\skonto|Keep\syour\saccount\sconnected|Oppdaterte\svilk\xC3\xA5r\sfor\sAvida-kontoen\sdin|Tax\sDocument\sCompleted|to\srestore\sfull\saccess|Update\syour\stax\sinformation|les\sfactures\smentionnees\sci\-dessous\srestent\simpayees|Don\xE2\x80\x99t\sWait\sUntil\sYour\sStorage\sIs\sFull|Mailbox\sis\sfull\s\xE2\x80\x93\saction\srequired|Payment\sconfirmation\spending\sfor\syour\ssubscription|Webmail\sUpdate:\sAction\sRequired|Account\sExpiry\sNotification|eSign\snow\sbefore\sthe\scountdown|D0cuSlgn\sfiles|QuickBooks\sAdmin\sElectronic\stransfer\sservice|RSign\seSign\sComplete:|Remittance\sAttached|Scheduled\sServer\sUpgrade|Yo\su\sr\sA\sc\sc\so\su\sn\st|I\ss\sOn\sH\sold|ACCOUNT\sTEMPORARILY\sBLOCKED|Action\sNeeded:\s[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}\sMailbox\sQuota\sExceeded|Attempted\spassword\sReset\sRequest|Account\sDeletion\sRequest|Pending\sMessage\sDelivery|Important\sNotice:\sUpdated|Mailbox\spassword\snotice/m header T_JR_CLOUDSPLOIT_SUBJ24 Subject =~ /Re\-validation\sNotice\sRef|Bank\sRemittance\sSwift\scopy|Webmail\sAccount\sPassword|Amended\sSalary\sPaycheck\sfor|Pending\sSignature\sRequest\s\-\s[0-9]{1,2}\/[0-9]{1,2}\/202[0-9]|Nye\skrav\stil\sdokumentasjon|Online\sWire\sTransfer\sCompleted|\[Notifcation\]|Missed\scaller\svoice\-mail|Incoming\sMails\sOn\sHold|confirmation\sof\spassword|Final\sWarning:\sVerify\syour\s[A-z0-9\-_\.]{2,40}\@[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}|Reminder:\sInvoice\sattachment|Action\sRequested:\sID:\s[0-9]{5}|IMAP\sPOP3\sDelivery\sFail|You\sHave\s[0-9]{1,2}\sImportant\sEmails\son\sHold|EFT\sPayment\sTRX:\sID\#/m meta __JR_CLOUDSPLOIT_SUBJ ((T_JR_CLOUDSPLOIT_SUBJ1 || T_JR_CLOUDSPLOIT_SUBJ2 || T_JR_CLOUDSPLOIT_SUBJ3 || T_JR_CLOUDSPLOIT_SUBJ4 || T_JR_CLOUDSPLOIT_SUBJ5 || T_JR_CLOUDSPLOIT_SUBJ6 || T_JR_CLOUDSPLOIT_SUBJ7 || T_JR_CLOUDSPLOIT_SUBJ8 || T_JR_CLOUDSPLOIT_SUBJ9 || T_JR_CLOUDSPLOIT_SUBJ10 || T_JR_CLOUDSPLOIT_SUBJ11 || T_JR_CLOUDSPLOIT_SUBJ12 || T_JR_CLOUDSPLOIT_SUBJ13 || T_JR_CLOUDSPLOIT_SUBJ14 || T_JR_CLOUDSPLOIT_SUBJ15 || T_JR_CLOUDSPLOIT_SUBJ16 || T_JR_CLOUDSPLOIT_SUBJ17 || T_JR_CLOUDSPLOIT_SUBJ18 || T_JR_CLOUDSPLOIT_SUBJ19 || T_JR_CLOUDSPLOIT_SUBJ20 || T_JR_CLOUDSPLOIT_SUBJ21 || T_JR_CLOUDSPLOIT_SUBJ22 || T_JR_CLOUDSPLOIT_SUBJ23 || T_JR_CLOUDSPLOIT_SUBJ24) && !(__JR_EXPLOIT_FROM_EXEMPT)) ## CREATING URI RULES: JR_EXPLOIT.cf ## ifplugin Mail::SpamAssassin::Plugin::MIMEHeader uri __JR_CSPLOIT_URL_BUZZ_URL m;https?://[-\.a-zA-Z0-9]{4,65}\.buzz(\s|$|\/);i uri __JR_CSPLOIT_URL_CLUB_URL m;https?://[-\.a-zA-Z0-9]{4,65}\.club(\s|$|\/);i uri __JR_CSPLOIT_URL_SPACE_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.space(\s|$|\/);i uri __JR_CSPLOIT_URL_XYZ_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.xyz(\s|$|\/);i uri __JR_CSPLOIT_URL_ASIA_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.asia(\s|$|\/);i uri __JR_CSPLOIT_URL_BEST_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.best(\s|$|\/);i uri __JR_CSPLOIT_URL_CLICK_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.click(\s|$|\/);i uri __JR_CSPLOIT_URL_SITE_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.site(\s|$|\/);i uri __JR_CSPLOIT_URL_STORE_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.store(\s|$|\/);i uri __JR_CSPLOIT_URL_PRO_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.pro(\s|$|\/);i uri __JR_CSPLOIT_URL_INFO_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.info(\s|$|\/);i uri __JR_CSPLOIT_URL_SHOP_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.shop(\s|$|\/);i uri __JR_CSPLOIT_URL_TUBE_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.tube(\s|$|\/);i uri __JR_CSPLOIT_URL_ONLINE_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.online(\s|$|\/);i uri __JR_CSPLOIT_URL_TATTOO_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.tattoo(\s|$|\/);i uri __JR_CSPLOIT_URL_IO_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.io(\s|$|\/);i uri __JR_CSPLOIT_URL_BIO_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.bio(\s|$|\/);i uri __JR_CSPLOIT_URL_CC_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.cc(\s|$|\/);i uri __JR_CSPLOIT_URL_CLOUD_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.cloud(\s|$|\/);i uri __JR_CSPLOIT_URL_STORAGE_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.storage(\s|$|\/);i uri __JR_CSPLOIT_URL_FITNESS_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.fitness(\s|$|\/);i uri __JR_CSPLOIT_URL_TOURS_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.tours(\s|$|\/);i uri __JR_CSPLOIT_URL_DESIGN_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.design(\s|$|\/);i uri __JR_CSPLOIT_URL_FUTBOL_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.futbol(\s|$|\/);i uri __JR_CSPLOIT_URL_TOP_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.top(\s|$|\/);i uri __JR_CSPLOIT_URL_DOG_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.dog(\s|$|\/);i uri __JR_CSPLOIT_URL_ICU_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.icu(\s|$|\/);i uri __JR_CSPLOIT_URL_SBS_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.sbs(\s|$|\/);i uri __JR_CSPLOIT_URL_TRAVEL_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.travel(\s|$|\/);i uri __JR_CSPLOIT_URL_TODAY_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.today(\s|$|\/);i uri __JR_CSPLOIT_URL_IM_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.im(\s|$|\/);i uri __JR_CSPLOIT_URL_CFD_FILES m;https?://[-\.a-zA-Z0-9]{3,65}\.cfd(\s|$|\/);i uri __JR_CSPLOIT_URL_DIGITAL_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.digital(\s|$|\/);i uri __JR_CSPLOIT_URL_CAM_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.cam(\s|$|\/);i uri __JR_CSPLOIT_URL_ICU m;https?://[-\.a-zA-Z0-9]{3,65}\.icu(\s|$|\/);i uri __JR_CSPLOIT_URL_LAT m;https?://[-\.a-zA-Z0-9]{3,65}\.lat(\s|$|\/);i uri __JR_CSPLOIT_URL_UNO m;https?://[-\.a-zA-Z0-9]{3,65}\.uno(\s|$|\/);i uri __JR_CSPLOIT_URL_VKSV m;https?://([-\.a-zA-Z0-9]{0,65}\.)?vk\.sv(\s|$|\/);i uri __JR_CSPLOIT_URL_MJAM m;https?://([-\.a-zA-Z0-9]{0,65}\.)?mj\.am(\s|$|\/);i uri __JR_CSPLOIT_URL_FLEEK_URL m;https?://[-\.a-zA-Z0-9]{6,65}\.fleek\.co(\s|$|\/); uri __JR_CSPLOIT_URL_FLEEK2_URL m;https?://ipfs\-fleek\-co\.translate\.goog(\s|$|\/); uri __JR_CSPLOIT_URL_FLEEK3_URL m;https?://[-\.a-zA-Z0-9]{6,70}\.fleek\.cool(\s|$|\/); uri __JR_CSPLOIT_URL_GLITCH_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.glitch\.me(\s|$|\/); uri __JR_CSPLOIT_URL_IT_COM_URL m;https?://[-\.a-zA-Z0-9]{3,65}\.it\.com(\s|$|\/); uri __JR_CSPLOIT_URL_BR_IMAGES m;https?://uploaddeimagens\.com\.br(\s|$|\/); uri __JR_CSPLOIT_URL_DIKSI m;https?://([-\.a-zA-Z0-9]{3,65}\.)?dik\.si(\s|$|\/);i uri __JR_CSPLOIT_URL_JIGSY m;https?://[-\.a-zA-Z0-9]{3,65}\.jigsy\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_IPFS_IO m;https?://([-\.a-zA-Z0-9]{0,65}\.)?ipfs\.io(\s|$|\/);i uri __JR_CSPLOIT_URL_GOOGLE1 m;https?://([-\.a-zA-Z0-9]{3,65}\.)?storage\.cloud\.google\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_GOOGLE2 m;https?://([-\.a-zA-Z0-9]{3,65}\.)?(firebase)?storage\.googleapis\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_GOOGLE3 m;https?://([-\.a-zA-Z0-9]{3,65}\.)?translate\.goog(\s|$|\/);i uri __JR_CSPLOIT_URL_GOOGLE4 m;https?://sites\.google\.com/;i uri __JR_CSPLOIT_URL_GOOGLE5 m;https?://docs\.google\.com/forms/;i uri __JR_CSPLOIT_URL_GOOGLE6 m;https?://([-\.a-zA-Z0-9]{3,65}\.)?googleweblight\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_GOOGLE7 m;https?://apis\.google\.com/;i uri __JR_CSPLOIT_URL_GOOGLE8 m;https?://adservice\.google\.com/;i uri __JR_CSPLOIT_URL_GOOGLE9 m;https?://([-\.a-zA-Z0-9]{3,65}\.)?googleadservices\.com/;i uri __JR_CSPLOIT_URL_GOOGLE10 m;https?://([-\.a-zA-Z0-9]{3,65}\.)?translate\.google\.com/;i uri __JR_CSPLOIT_URL_GOOGLE11 m;https?://([-\.a-zA-Z0-9]{3,65}\.)?google\.(ae|lt|is|it)(\s|$|\/);i uri __JR_CSPLOIT_URL_GOOGLE12 m;https?://([-\.a-zA-Z0-9]{3,65}\.)?share\.google(\s|$|\/);i uri __JR_CSPLOIT_URL_GOOGLE13 m;https://www\.google\.com/url\?q\=http;i uri __JR_CSPLOIT_URL_BING_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?bing\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_SGRID_FILES m;https?://([-\.a-zA-Z0-9]{3,65}\.)?sendgrid\.net(\s|$|\/);i uri __JR_CSPLOIT_URL_IONOSCLOUD m;https?://([-\.a-zA-Z0-9]{3,65}\.)?ionoscloud\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_PSTMARK_IT m;https?://([-\.a-zA-Z0-9]{3,65}\.)?pstmrk\.it(\s|$|\/);i uri __JR_CSPLOIT_URL_DWEB_LNK m;https?://([-\.a-zA-Z0-9]{3,75}\.)?dweb\.link(\s|$|\/);i uri __JR_CSPLOIT_URL_HUBSLY m;https?://([-\.a-zA-Z0-9]{3,75}\.)?hubs\.ly(\s|$|\/);i uri __JR_CSPLOIT_URL_EASYCO m;https?://([-\.a-zA-Z0-9]{3,40}\.)?easy\.co(\s|$|\/);i uri __JR_CSPLOIT_URL_JOTFORM m;https?://([-\.a-zA-Z0-9]{3,40}\.)?jotform\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_EMLINK m;https?://([-\.a-zA-Z0-9]{3,65}\.)?emlnk\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_SIASKY m;https?://([-\.a-zA-Z0-9]{3,65}\.)?siasky\.net(\s|$|\/);i uri __JR_CSPLOIT_URL_TBMS m;https?://([-\.a-zA-Z0-9]{3,65}\.)?tbms\.in(\s|$|\/);i uri __JR_CSPLOIT_URL_BACKBLAZE m;https?://([-\.A-z0-9]{3,65}\.)?backblazeb[0-9]?\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_FUNCTIONS m;https?://([-\.A-z0-9]{3,65}\.)?cloudfunctions\.net(\s|$|\/);i uri __JR_CSPLOIT_URL_BLOBCORE m;https?://([-\.A-z0-9]{3,65}\.)?blob\.core\.windows\.net(\s|$|\/);i uri __JR_CSPLOIT_URL_ACE1 m;https?://([-\.A-z0-9]{3,65}\.)?acemlnc\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_WIX1 m;https?://([-\.A-z0-9]{3,65}\.)?wixstatic\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_WIX2 m;https?://([-\.A-z0-9]{3,65}\.)?wix\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_RULINKS m;https?://([-\.A-z0-9]{3,65}\.)?rulinks\.info(\s|$|\/);i uri __JR_CSPLOIT_URL_MYHUAWEI m;https?://([-\.A-z0-9]{3,65}\.)?myhuaweicloud\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_AMAZONAWS m;https?://([-\.A-z0-9]{3,65}\.)?amazonaws\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_AMAZONAPPS m;https?://([-\.A-z0-9]{3,65}\.)?awsapprunner\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_AMAZONTRK m;https?://([-\.A-z0-9]{3,65}\.)?awstrack.me(\s|$|\/);i uri __JR_CSPLOIT_URL_BOOKSDEPO m;https?://([-\.A-z0-9]{3,65}\.)?books\-depo\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_BUBBLEAPPS m;https?://([-\.A-z0-9]{3,65}\.)?bubbleapps\.io(\s|$|\/);i uri __JR_CSPLOIT_URL_VIGLINK m;https?://([-\.A-z0-9]{3,65}\.)?viglink\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_ADNX m;https?://([-\.A-z0-9]{3,65}\.)?adnxs\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_DIGOCEAN m;https?://([-\.A-z0-9]{3,65}\.)?digitaloceanspaces\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_TRANSGOOG m;https?://([\-\.A-z0-9]{3,65})?link\.translate\.goog(\s|$|\/);i uri __JR_CSPLOIT_URL_W3S m;https?://([-\.A-z0-9]{3,65}\.)?w3s\.link(\s|$|\/);i uri __JR_CSPLOIT_URL_CRUSTY m;https?://([-\.A-z0-9]{3,65}\.)?crustapps\.net(\s|$|\/);i uri __JR_CSPLOIT_URL_AMPLIFY m;https?://([-\.A-z0-9]{3,65}\.)?amplifyapp\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_BOOKZ m;https?://([-\.A-z0-9]{2,20}\.)?bookbuddyz\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_AD_AI m;https?://([-\.A-z0-9]{2,20}\.)?adcreative\.ai(\s|$|\/);i uri __JR_CSPLOIT_URL_APP_LINK m;https?://([-\.A-z0-9]{2,20}\.)?app\.link(\s|$|\/);i uri __JR_CSPLOIT_URL_FORMS_GLE m;https?://([-\.A-z0-9]{2,20}\.)?forms\.gle(\s|$|\/);i uri __JR_CSPLOIT_URL_REPL_CO m;https?://([-\.A-z0-9]{2,20}\.)?repl\.co(\s|$|\/);i uri __JR_CSPLOIT_URL_STATIC m;https?://([-\.A-z0-9]{3,65}\.)?static\.app(\s|$|\/);i uri __JR_CSPLOIT_URL_EMLNK m;https?://([-\.A-z0-9]{3,65}\.)?emlnk\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_CF_IPFS m;https?://([-\.A-z0-9]{2,68}\.)?(cf|cloudflare)\-ipfs\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_LINOBJ m;https?://([-\.A-z0-9]{3,65}\.)?linodeobjects\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_WIXSITE m;https?://([-\.A-z0-9]{3,65}\.)?wixsite\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_R2DEV m;https?://([-\.a-zA-Z0-9]{3,65}\.)?r2\.dev(\s|$|\/);i uri __JR_CSPLOIT_URL_RUNAPP m;https?://([-\.a-zA-Z0-9]{3,65}\.)?run\.app(\s|$|\/);i uri __JR_CSPLOIT_URL_PIXELIO m;https?://([-\.a-zA-Z0-9]{3,65}\.)?pixelbin\.io(\s|$|\/);i uri __JR_CSPLOIT_URL_WEBHOSTAPP m;https?://([-\.a-zA-Z0-9]{3,65}\.)?[0-9]{3}webhostapp\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_QRFY m;https?://([-\.A-z0-9]{2,20}\.)?qrfy\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_TK_URL m;https?://[-\.A-z0-9]{3,65}\.(tk|TK)(\s|$|\/); uri __JR_CSPLOIT_URL_GMGB4 m;https?://([-\.A-z0-9]{3,65}\.)?gmgb4\.net(\s|$|\/);i uri __JR_CSPLOIT_URL_DEVELOPR m;https?://([-\.A-z0-9]{3,65}\.)?talktodevelopers\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_DISCORD m;https?://([-\.A-z0-9]{2,20}\.)?discordapp\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_SUB_FORM m;https?://([-\.A-z0-9]{2,20}\.)?submit\-form\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_DOC_DL m;https?://([-\.A-z0-9]{3,65}\.)?documentsdownloads\.company(\s|$|\/);i uri __JR_CSPLOIT_URL_ACCOUMT m;https?://([-\.A-z0-9]{3,65}\.)?accoumt\.shop(\s|$|\/);i uri __JR_CSPLOIT_URL_DBLCLK m;https?://([-\.A-z0-9]{3,65}\.)?doubleclick\.net(\s|$|\/);i uri __JR_CSPLOIT_URL_ELASTIC m;https?://([-\.A-z0-9]{3,65}\.)?elasticemail\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_STREAK m;https?://([-\.A-z0-9]{3,65}\.)?(streaklinks|streak)\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_WEBWAVE m;https?://([-\.A-z0-9]{3,65}\.)?webwave\.dev(\s|$|\/);i uri __JR_CSPLOIT_URL_WEBFLOW m;https?://([-\.A-z0-9]{3,65}\.)?webflow\.io(\s|$|\/);i uri __JR_CSPLOIT_URL_DYNDNS m;https?://([-\.A-z0-9]{3,65}\.)?dynamic\-dns\.net(\s|$|\/);i uri __JR_CSPLOIT_URL_NVF m;https?://([-\.A-z0-9]{2,20}\.)?nvfdcn\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_SALESFORCE m;https?://([-\.A-z0-9]{3,65}\.)?salesforce\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_QRPRO m;https?://([-\.A-z0-9]{3,30}\.)?qrcodes\.pro(\s|$|\/);i uri __JR_CSPLOIT_URL_FIREBASE m;https?://([-\.A-z0-9]{3,65}\.)?firebaseapp\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_WORKDEV m;https?://([-\.A-z0-9]{3,65}\.)?workers\.dev(\s|$|\/);i uri __JR_CSPLOIT_URL_PAGEDEV m;https?://([-\.A-z0-9]{3,65}\.)?pages\.dev(\s|$|\/);i uri __JR_CSPLOIT_URL_NADSRV m;https?://([-\.A-z0-9]{3,65}\.)?nadserv\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_JEMI m;https?://([-\.A-z0-9]{3,65}\.)?jemi\.so(\s|$|\/);i uri __JR_CSPLOIT_URL_CTC_RS6 m;https?://([-\.A-z0-9]{2,20}\.)?rs6\.net(\s|$|\/);i uri __JR_CSPLOIT_URL_REPLIT m;https?://([-\.A-z0-9]{2,65}\.)?replit\.dev(\s|$|\/);i uri __JR_CSPLOIT_URL_REPLIT1 m;https?://([-\.a-zA-Z0-9]{3,65}\.)?replit\.app(\s|$|\/);i uri __JR_CSPLOIT_URL_OODO m;https?://([-\.A-z0-9]{2,65}\.)?odoo\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_BEEHIIV m;https?://([-\.A-z0-9]{2,65}\.)?beehiiv\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_PRIVMAIL m;https?://([-\.A-z0-9]{2,65}\.)?privateemail\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_ZOHO_INSIGHT m;https?://([-\.A-z0-9]{2,65}\.)?zohoinsights\-crm\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_YANDEX1 m;https?://forms\.yandex\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_PIXJRE m;https?://([-\.A-z0-9]{2,20}\.)?pixjre\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_LU_MS m;https?://([-\.A-z0-9]{2,65}\.)?1u\.ms(\s|$|\/);i uri __JR_CSPLOIT_URL_CLOUD_IPFS m;https?://([-\.A-z0-9]{2,30}\.)?cloudflare\-ipfs\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_UTRAKER m;https?://([-\.A-z0-9]{2,30}\.)?utraker\.com(\s|$|\/); uri __JR_CSPLOIT_URL_RU_COM_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?ru\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_SA_COM_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?sa\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_ZA_COM_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?za\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_AZURE_APP_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?azurestaticapps\.net(\s|$|\/);i uri __JR_CSPLOIT_URL_SHORTGY_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?short\.gy(\s|$|\/);i uri __JR_CSPLOIT_URL_CF_IPFS_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?cf\-ipfs\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_TRIMMER_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?trimmer\.to(\s|$|\/);i uri __JR_CSPLOIT_URL_CLUBOS_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?club\-os\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_STRAPP_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?strapiapp\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_CHAIN_IO_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?chainsafe\.io(\s|$|\/);i uri __JR_CSPLOIT_URL_MEDIAFIRE_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?mediafire\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_SENDSPACE_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?sendspace\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_DRV_TW_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?on\.drv\.tw(\s|$|\/);i uri __JR_CSPLOIT_URL_REM_AX_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?rem\.ax(\s|$|\/);i uri __JR_CSPLOIT_URL_QBOOKSEC m;https?://([-\.a-zA-Z0-9]{3,65}\.)?quickbooksec\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_VERCEL_APP m;https?://([-\.a-zA-Z0-9]{3,65}\.)?vercel\.app(\s|$|\/);i uri __JR_CSPLOIT_URL_VERCEL_APP2 m;/.*[\.?=/]vercel\.app/;i uri __JR_CSPLOIT_URL_ACCOUNTUS m;https?://([-\.a-zA-Z0-9]{3,65}\.)?accountus\.help(\s|$|\/);i uri __JR_CSPLOIT_URL_MOTIONHOST m;https?://([-\.a-zA-Z0-9]{3,65}\.)?motionhosting\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_KTX_URI m;https?://([-\.a-zA-Z0-9]{3,65}\.)?kt[0-9]{1,2}\.co(\s|$|\/);i uri __JR_CSPLOIT_URL_VOZER_URI m;https?://([-\.a-zA-Z0-9]{3,65}\.)?vozer\.net(\s|$|\/);i uri __JR_CSPLOIT_URL_WEEBLY_URI m;https?://([-\.a-zA-Z0-9]{3,65}\.)?weebly\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_LINODE_OBJ m;https?://([-\.a-zA-Z0-9]{3,65}\.)?linodeobjects\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_TOP_GG m;https?://([-\.a-zA-Z0-9]{3,65}\.)?top\.gg(\s|$|\/);i uri __JR_CSPLOIT_URL_IPFS_XYZ m;https?://([-\.a-zA-Z0-9]{3,65}\.)?[a-z]{1,8}\-ipfs\.xyz(\s|$|\/);i uri __JR_CSPLOIT_URL_MJT_LU m;https?://([-\.a-zA-Z0-9]{3,65}\.)?mjt\.lu(\s|$|\/);i uri __JR_CSPLOIT_URL_XTRFR_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?xtrfr\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_KUDOSI_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?kudosi\.ai(\s|$|\/);i uri __JR_CSPLOIT_URL_GUMROAD m;https?://([-\.a-zA-Z0-9]{3,65}\.)?gumroad\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_NETLIFY m;https?://([-\.a-zA-Z0-9]{3,65}\.)?netlify\.app(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_4EVER_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?4everland\.app(\s|$|\/);i uri __JR_CSPLOIT_URL_GHZ_IO m;https?://([-\.a-zA-Z0-9]{3,65}\.)?qhz\.io(\s|$|\/);i uri __JR_CSPLOIT_URL_ONRENDER m;https?://([-\.a-zA-Z0-9]{3,65}\.)?onrender\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_OSTORAGE m;https?://([-\.a-zA-Z0-9]{3,65}\.)?oortstorage\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_MYPI_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?mypi\.co(\s|$|\/);i uri __JR_CSPLOIT_URL_REDIR_URL1 m;https?://([-\.a-zA-Z0-9]{3,65}\.)?redirectingat\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_EVIL_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?evil\.com(\s|\&|$|\/); uri __JR_CSPLOIT_URL_FASTLY_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?fastly\.net(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_WDCDN_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?wdcdn\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_GIT_IO_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?github\.io(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_DOCSEND m;https?://([-\.a-zA-Z0-9]{3,65}\.)?docsend\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_EX_4_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?e\-x4\.com(\s|\&|$|\/); uri __JR_CSPLOIT_URL_STREAMS_URL1 m;https?://([-\.a-zA-Z0-9]{3,65}\.)?allstreamslive24\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_MATHTAG m;https?://([-\.a-zA-Z0-9]{3,65}\.)?mathtag\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_AWIN1_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?awin1\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_COOKST_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?cookstowns\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_STAT1_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?status1\.site(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_AYM_SHOP_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?aymshopping\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_ACK_DIG_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?acknowledge1\.digital(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_MEAT_SE_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?meatings\.se(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_CODE_PAGE_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?codeberg\.page(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_XLATE_ONE_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?translators\.one(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_SHOOT_CAN_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?shootcanada\.ca(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_KAIDO_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?kaido\.run(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_TRK_AGENCY m;https?://([-\.a-zA-Z0-9]{3,65}\.)?donttrackme\.agency(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_ONLY_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?onlydategrils\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_MCMOD_CN_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?mcmod\.cn(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_VTRAXIS_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?veltraxis\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_SAMIKSHA_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?samiksha\.com\.sg(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_PARABOX_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?parabox\.uk(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_IVORAX_URL m;https?://([-\.a-zA-Z0-9]{3,65}\.)?ivorax\.com\.de(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_SANDUIK_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?sanduik\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_SHOPIHY_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?shopihy\.info(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_SUPRSND_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?suprsend\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_NVERCO_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?inversionesrv\.com\.co(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_STOPASIS_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?stopsoriasis\.co\.il(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_APOLLO_HS_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?apollohouses\.it(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_TR_EAST_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?transitioneast\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_HSTUDIO1_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?haarstudiokerzmann\.de(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_APOBONK_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?apobonk\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_CRAZYDOM_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?crazydomains\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_ORTODOX_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?ortodoxinfo\.ro(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_STORDEV_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?storage\.dev(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_SUCCESSEU_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?successfactors\.eu(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_UNIFIIT_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?unifiit\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_OORTSTOR_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?oortstorages\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_BCDN_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?b\-cdn\.net(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_CASAL_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?casalpotenciadeviver\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_COMADORA_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?comercializadoralaavenida\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_MEDCALITY_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?medicalitystore\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_INRECPT_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?inreception\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_AUTOPLT_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?serviceautopilot\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_SURGE1_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?surge\.sh(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_AVIDAF_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?avidaf\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_COPAAIR_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?copaalr\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_ALAMENT_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?alamenterprise\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_TRUEQR_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?trueqrcode\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_DCLICK_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?doubleclick\.net(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_SFRAME_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?supplyframe\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_HOURIHA_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?hou\-riha\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_LUVTRUMP_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?welovetrump\.de(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_LMARK_SU_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?landmarksfeed\.su(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_ARWEAVE_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?arweave\.net(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_AZAD_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?azad\-corp\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_PYTHONANY_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?pythonanywhere\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_TOPSEO_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?topseooptimization\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_LVPURP_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?loveandpurposeglobaloutreach\.org(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_FTLUXY_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?fitluxy\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_VMSTEEL_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?vmsteeltech\.in(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_ASCENTY_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?ascenicty\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_CPANEL_SEC_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?cpanelsecure\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_MAXTECH_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?maximum\-tech\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_WTINY_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?www\-tinyurl\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_YAM_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?yam\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_BEACONS m;https?://([-\.a-zA-Z0-9]{0,65}\.)?beacons\.ai(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_RWALLET m;https?://([-\.a-zA-Z0-9]{0,65}\.)?recoverwallet\.live(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_DEALBADA m;https?://([-\.a-zA-Z0-9]{0,65}\.)?dealbada\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_MOVEIS_BR_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?tlprimeimoveis\.com\.br(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_DRAMKAR_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?drambedkarbedcollege\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_TREAT_VU_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?treatment\.vu(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_LONGLINK_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?reallylong\.link(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_DBGD_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?designedbygd\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_CW_DEV_URL m;https?://([-\.a-zA-Z0-9]{0,70}\.)?cloudworkstations\.dev(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_APPWRITE_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?appwrite\.network(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_DIAMONDT_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?diamondologist\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_CAN_MEDI_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?icanmedispharm\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_VIROVU_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?myviro\.vu(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_SPESH_TZ_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?spesh\.co\.tz(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_DESAP_VU_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?desaplicadas\.vu(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_XTOUR_DE_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?xtourspace\.de(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_OPTI_APP_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?optivanta\.app(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_JU_MP_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?ju\.mp(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_VVERSE_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?vendorverse\.space(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_GAHEEZ_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?gaheezonline\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_OSSHZ_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?osshz\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_HAIXING_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?zh\-l\-haixing\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_WEUOMAIT_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?weuomait\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_SEARCHBRF_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?searchbriefing\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_EDGEONE_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?edgeone\.dev(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_BUYINO_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?buyino\.dev(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_PETRAMIS_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?petramis\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_BRK_BLK_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?breakablock\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_NICHOL_GA_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?nicholglassandaluminium\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_TZNT_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?sdtznt\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_RICORICO_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?ricoricotaqueria\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_CLOUDFRONT_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?cloudfront\.net(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_NEXAONE_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?nexaone\.one(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_CASA_DEL_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?casadelmarbg\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_PGYDT_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?pgydt\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_WOLFDSI_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?wolfdsi\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_KALKYL_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?kreditkalkyl\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_SCALETRN_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?scaletrainer\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_YEMLEE_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?yemlee\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_SHARPBOX_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?sharpsbox\.us(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_ACCUMENT_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?accumentum\.net(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_LIFEINTEL_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?lifeskill\-intelligence\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_GREENGOV_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?greengov2012\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_ALTORIX_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?altorix\.world(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_MILLERM_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?millermliling\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_FEILCESDA_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?feilcesda\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_KELID_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?kelidtest\.ir(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_MONDAY_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?monday\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_HIDRIVE_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?hidrive\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_XPERTY_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?expertyclinic\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_CONCEPTVU_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?concepts\.vu(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_HUIDA_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?wap\-huida\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_COUPONSC_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?thecouponscode\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_XANO_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?xano\.io(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_KRYNEXO_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?krynexo\.vu(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_ENELA_ZA_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?enela\.co\.za(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_CONF_VU_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?confirmation\.vu(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_MEONG_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?meong138\.net(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_CELIAC_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?celiacosaraucania\.cl(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_ACCION_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?accionelectric\.org(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_BIONICJOB_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?bionicjob\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_CRECI_BR_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?creci\-am\.gov\.br(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_IR_ES_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?78643ir\.es(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_ZDXH_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?zdxhgj\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_DFVBG_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?dfvbg\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_BULAX_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?bulaxiong\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_CONTABO1_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?contabostorage\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_RAILWAY_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?railway\.app(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_CHORUS_FR_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?chorus\-pro\.gouv\.fr(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_VESTIAIRE_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?vestiaire\.ca(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_TALENTGUM_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?talentgum\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_MAIS_BR_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?officemaisoficial\.com\.br(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_CRAFTIVE_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?craftivesolution\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_ELCHIRI_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?elchiriguanotarija\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_VOGUE_DEV_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?voguedevelopers\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_WJSCO_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?wjsco\.ir(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_URBANROW_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?urbansrow\.us(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_AIRRESCUE1_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?airrescue\.de(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_PURPOSE_VU_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?purpose\.vu(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_FOREXSIG_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?forexsignalshub\.info(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_CREDTRUS_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?credtrus\.health(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_SHADOWFUN_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?shadowclub\.fun(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_SNGLINK_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?sng\.link(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_ONYXHEALTH_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?onyxhealthplus\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_OCCASIN_VU_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?occasion\.vu(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_SIMBIOXIA_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?simbioxia\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_KLEPROMIL_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?klepromil\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_HALAMANG_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?halamang\-gamot\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_QZZ_IO_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?qzz\.io(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_GRANSLIV_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?gransliving\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_GDQJGS_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?gdqjgs\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_ATTY_RES_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?attorneyresume\.com(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_HC_DEPT_URL m;https?://([-\.a-zA-Z0-9]{0,65}\.)?healthcaredept\.org(\s|\&|$|\/);i uri __JR_CSPLOIT_URL_BIT_LY_URL m;https?://bit\.ly(\s|$|\/);i uri __JR_CSPLOIT_URL_BITDO_URL m;https?://bit\.do(\s|$|\/);i uri __JR_CSPLOIT_URL_BRAND_URL m;https?://rebrand\.ly(\s|$|\/);i uri __JR_CSPLOIT_URL_NEON_URL m;https?://neon\.ly(\s|$|\/);i uri __JR_CSPLOIT_URL_JUMP_URL m;https?://j\.mp(\s|$|\/);i uri __JR_CSPLOIT_URL_CUTT_URL m;https?://cutt\.ly(\s|$|\/);i uri __JR_CSPLOIT_URL_BUFF_URL m;https?://buff\.ly(\s|$|\/);i uri __JR_CSPLOIT_URL_KUTT_URL m;https?://kutt\.it(\s|$|\/);i uri __JR_CSPLOIT_URL_BITWS_URL m;https?://bitly\.ws(\s|$|\/);i uri __JR_CSPLOIT_URL_BITCX_URL m;https?://bitly\.cx(\s|$|\/);i uri __JR_CSPLOIT_URL_TINY_URL m;https?://tinyurl\.com(\s|$|\/);i uri __JR_CSPLOIT_URL_TWITS m;https?://t\.co(\s|$|\/);i uri __JR_CSPLOIT_URL_GEN_S_ID m;https?://s\.id/;i uri __JR_CSPLOIT_URL_U_TO m;https?://u\.to/;i uri __JR_CSPLOIT_URL_ZPR_URL m;https?://zpr\.io/;i uri __JR_CSPLOIT_URL_TINY1_URL m;https?://tiny\.one/;i uri __JR_CSPLOIT_URL_RB_GY m;https?://rb\.gy/;i uri __JR_CSPLOIT_URL_T_LY_URL m;https?://t\.ly(\s|$|\/);i uri __JR_CSPLOIT_URL_SHORT_AT_URL m;https?://shorturl\.at(\s|$|\/);i uri __JR_CSPLOIT_URL_WA_LINK_URL m;https?://wa\.link(\s|$|\/);i uri __JR_CSPLOIT_URL_CLCK_RU_URL m;https?://clck\.ru(\s|$|\/);i uri __JR_CSPLOIT_URL_IS_GD m;https?://is\.gd/;i uri __JR_CSPLOIT_URL_FR_URLZ m;https?://urlz\.fr/;i uri __JR_CSPLOIT_URL_RS_P1 m;https?://p1\.rs/;i uri __JR_CSPLOIT_URL_PSEE_IO m;https?://psee\.io/;i uri __JR_CSPLOIT_URL_TAWK_TO m;https?://tawk\.to/;i uri __JR_CSPLOIT_URL_0HO_LA_URL m;https?://0ho\.la/;i uri __JR_CSPLOIT_URL_I_BITLY_URL m;https?://ibit\.ly(\s|$|\/);i uri __JR_CSPLOIT_URL_WE_TL_URL m;https?://we\.tl/;i uri __JR_CSPLOIT_URL_KO_GL_URL m;https?://ko\.gl/;i uri __JR_CSPLOIT_URL_B_LINK_URL m;https?://b\.link/;i uri __JR_CSPLOIT_URL_GRCO_URL m;https?://qrco\.de/;i uri __JR_CSPLOIT_URL_TO_PW m;https?://to2\.pw/;i uri __JR_CSPLOIT_URL_SHORT_ASIA m;https?://shorturl\.asia/;i uri __JR_CSPLOIT_URL_CLEVER m;https?://clvr\.ch/;i uri __JR_CSPLOIT_URL_L1NQ m;https?://l1nq\.com/;i uri __JR_CSPLOIT_URL_SHORTER_ME m;https?://shorter\.me/;i uri __JR_CSPLOIT_URL_SHORT_ME m;https?://urlshort\.dev/;i uri __JR_CSPLOIT_URL_ULR_ME m;https?://urlr\.me/;i uri __JR_CSPLOIT_URL_UR0_LINK m;https?://ur0\.link/;i uri __JR_CSPLOIT_URL_TLY_LINK m;https?://t\.ly/;i uri __JR_CSPLOIT_URL_SIKER m;https?://siker\.im/;i uri __JR_CSPLOIT_URL_TREE m;https?://tr\.ee/;i uri __JR_CSPLOIT_URL_SHORT_DO m;https?://short\.do/;i uri __JR_CSPLOIT_URL_TINYL_IO m;https?://tinyl\.io/;i uri __JR_CSPLOIT_URL_NWAX_URL m;https?://nw\.ax/;i uri __JR_CSPLOIT_URL_NEV_IT m;https?://nev\.lt/;i uri __JR_CSPLOIT_URL_JX_AX m;https?://jx\.ax/;i uri __JR_CSPLOIT_URL_LI_HI m;https?://lihi2\.me/;i uri __JR_CSPLOIT_URL_LI_HI1 m;https?://lihi1.me/;i uri __JR_CSPLOIT_URL_DUB_SH m;https?://dub\.sh/;i uri __JR_CSPLOIT_URL_SMALL_NL m;https?://smallurl\.nl/;i uri __JR_CSPLOIT_URL_URAND_CO m;https?://urand\.co/;i uri __JR_CSPLOIT_URL_CMS_URL1 m;/(wp\-content|wp\-admin|wp\-includes|wp\-css?|wp\-cache|user\-miscwp|administrator|uploads|components|bin|files|includes|Plugin|core|assets|logs|js|cp\-manager)/;i uri __JR_CSPLOIT_URL_CMS_URL2 m;/(wp\-content|wp\-admin|wp\-includes|wp\-css?|wp\-cache|administrator|includes|Plugin|You\-have\-obtained\-a\-new\-file\.paper|wp\.php)\?;i uri __JR_CSPLOIT_URL_CMS_URL3A m;\bredirect_uri\=;i uri __JR_CSPLOIT_URL_CMS_URL3B m;\bapps.googleusercontent.com;i uri __JR_CSPLOIT_URL_CMS_MISC m;[/\#](appforest_uf|ckfinder|fixed[0-9]|sign\-in|Tour[0-9l]|uyuyyu|ipfs|sev|ms\-onedrive|sharepoint|gatekeeper|home|csc|bitrix|loginpage|MailUpdateFresh|redirect|qbo\-account|usr\-[0-9]{3,4}|tortugas|track|eda|proxy|index\.php\/campaigns|detail|shop\/products|shop\/files|mailfiles\.online|12345[a-z]?|L0|mison|des|via|1drv|components|com_|eky|ecv|search|contents|serverdata|cdn\/shop|index\.php|wa\.me|track\-url|mail_track|ertbfvsxasd|ffvdssdfgbfvcs|dfgbfvcsd|fgbvdsd|fgbfvcsdfgnbfvcs|dfgnbfvcs|dfgbfvcsxsdfg|fvcsdfgnbfvcs|humancheck\.su|i\sn\st\se\sr\sc\so\sp\se\sr\sa\st\si\sv\se\ss|tinyemail\-stripo|action\-tracking|test|[a-z\-]{2,20}\.host|immofiplus\.com|wp\-dir|oempro|scoff|jhjff|Out|techtomanagerbulk|forms\/message|lkjhcxcvbnjoihuyujn|zxcvbnjmkbvfgdxcfhkjvbn|ertyuiokbbvgfcgvhvbnm|mailster|solicitorexpects\.us|freecachoffers|scorp\-roundcube\-rd|buythisdomain\.net|webersolar\.com\.br|customwebbosidemails\.uwu\.ai|code\-effect\.apkworld\.app|\~\-|drooll|redirect[a-z]|yoktogel168reg\.com|newnextcubers|cybermailrecoonected|roundcube[a-z]|3rdparty|castleopoint\.com|webmail2026|153\.122\.129\.67|share\.google|storage\.googleapis\.com|[a-z0-9]{2,20}\.multiscreensite\.com|thesilverbroker\.com)[/]; meta __JR_CSPLOIT_CMS_URL3 (__JR_CSPLOIT_CMS_URL3A && __JR_CSPLOIT_CMS_URL3B) meta __JR_CSPLOIT_CMS_URL (__JR_CSPLOIT_CMS_URL1 || __JR_CSPLOIT_CMS_URL2 || __JR_CSPLOIT_CMS_URL3) meta T_JR_CSPLOIT_BAD_URL (__JR_CSPLOIT_BUZZ_URL || __JR_CSPLOIT_CLUB_URL || __JR_CSPLOIT_SPACE_URL || __JR_CSPLOIT_XYZ_URL || __JR_CSPLOIT_ASIA_URL || __JR_CSPLOIT_BEST_URL || __JR_CSPLOIT_CLICK_URL || __JR_CSPLOIT_SITE_URL || __JR_CSPLOIT_STORE_URL || __JR_CSPLOIT_PRO_URL || __JR_CSPLOIT_INFO_URL || __JR_CSPLOIT_SHOP_URL || __JR_CSPLOIT_TUBE_URL || __JR_CSPLOIT_ONLINE_URL || __JR_CSPLOIT_TATTOO_URL || __JR_CSPLOIT_IO_URL || __JR_CSPLOIT_BIO_URL || __JR_CSPLOIT_CC_URL || __JR_CSPLOIT_CLOUD_URL || __JR_CSPLOIT_STORAGE_URL || __JR_CSPLOIT_FITNESS_URL || __JR_CSPLOIT_TOURS_URL || __JR_CSPLOIT_DESIGN_URL || __JR_CSPLOIT_FUTBOL_URL || __JR_CSPLOIT_TOP_URL || __JR_CSPLOIT_DOG_URL || __JR_CSPLOIT_ICU_URL || __JR_CSPLOIT_SBS_URL || __JR_CSPLOIT_TRAVEL_URL || __JR_CSPLOIT_TODAY_URL || __JR_CSPLOIT_IM_URL || __JR_CSPLOIT_CFD_FILES || __JR_CSPLOIT_DIGITAL_URL || __JR_CSPLOIT_CAM_URL || __JR_CSPLOIT_VKSV || __JR_CSPLOIT_MJAM || __JR_CSPLOIT_FLEEK_URL || __JR_CSPLOIT_FLEEK2_URL || __JR_CSPLOIT_FLEEK3_URL || __JR_CSPLOIT_GLITCH_URL || __JR_CSPLOIT_IT_COM_URL || __JR_CSPLOIT_BR_IMAGES || __JR_CSPLOIT_DIKSI || __JR_CSPLOIT_JIGSY || __JR_CSPLOIT_IPFS_IO || __JR_CSPLOIT_GOOGLE1 || __JR_CSPLOIT_GOOGLE2 || __JR_CSPLOIT_GOOGLE3 || __JR_CSPLOIT_GOOGLE4 || __JR_CSPLOIT_GOOGLE5 || __JR_CSPLOIT_GOOGLE6 || __JR_CSPLOIT_GOOGLE7 || __JR_CSPLOIT_GOOGLE8 || __JR_CSPLOIT_GOOGLE9 || __JR_CSPLOIT_GOOGLE10 || __JR_CSPLOIT_GOOGLE11 || __JR_CSPLOIT_GOOGLE12 || __JR_CSPLOIT_GOOGLE13 || __JR_CSPLOIT_BING_URL || __JR_CSPLOIT_SGRID_FILES || __JR_CSPLOIT_IONOSCLOUD || __JR_CSPLOIT_PSTMARK_IT || __JR_CSPLOIT_DWEB_LNK || __JR_CSPLOIT_HUBSLY || __JR_CSPLOIT_EASYCO || __JR_CSPLOIT_JOTFORM || __JR_CSPLOIT_EMLINK || __JR_CSPLOIT_SIASKY || __JR_CSPLOIT_TBMS || __JR_CSPLOIT_BACKBLAZE || __JR_CSPLOIT_FUNCTIONS || __JR_CSPLOIT_BLOBCORE || __JR_CSPLOIT_ACE1 || __JR_CSPLOIT_WIX1 || __JR_CSPLOIT_WIX1 || __JR_CSPLOIT_RULINKS || __JR_CSPLOIT_MYHUAWEI || __JR_CSPLOIT_AMAZONAWS || __JR_CSPLOIT_AMAZONAPPS || __JR_CSPLOIT_AMAZONTRK || __JR_CSPLOIT_BOOKSDEPO || __JR_CSPLOIT_BUBBLEAPPS || __JR_CSPLOIT_VIGLINK || __JR_CSPLOIT_ADNX || __JR_CSPLOIT_DIGOCEAN || __JR_CSPLOIT_TRANSGOOG || __JR_CSPLOIT_W3S || __JR_CSPLOIT_CRUSTY || __JR_CSPLOIT_AMPLIFY || __JR_CSPLOIT_BOOKZ || __JR_CSPLOIT_AD_AI || __JR_CSPLOIT_APP_LINK || __JR_CSPLOIT_FORMS_GLE || __JR_CSPLOIT_REPL_CO || __JR_CSPLOIT_STATIC || __JR_CSPLOIT_EMLNK || __JR_CSPLOIT_CF_IPFS || __JR_CSPLOIT_LINOBJ || __JR_CSPLOIT_WIXSITE || __JR_CSPLOIT_R2DEV || __JR_CSPLOIT_RUNAPP || __JR_CSPLOIT_PIXELIO || __JR_CSPLOIT_WEBHOSTAPP || __JR_CSPLOIT_QRFY || __JR_CSPLOIT_TK_URL || __JR_CSPLOIT_GMGB4 || __JR_CSPLOIT_DEVELOPR || __JR_CSPLOIT_DISCORD || __JR_CSPLOIT_SUB_FORM || __JR_CSPLOIT_DOC_DL || __JR_CSPLOIT_ACCOUMT || __JR_CSPLOIT_DBLCLK || __JR_CSPLOIT_ELASTIC || __JR_CSPLOIT_STREAK || __JR_CSPLOIT_WEBWAVE || __JR_CSPLOIT_WEBFLOW || __JR_CSPLOIT_DYNDNS || __JR_CSPLOIT_NVF || __JR_CSPLOIT_ICU || __JR_CSPLOIT_LAT || __JR_CSPLOIT_UNO || __JR_CSPLOIT_SALESFORCE || __JR_CSPLOIT_QRPRO || __JR_CSPLOIT_FIREBASE || __JR_CSPLOIT_WORKDEV || __JR_CSPLOIT_PAGEDEV || __JR_CSPLOIT_NADSRV || __JR_CSPLOIT_JEMI || __JR_CSPLOIT_CTC_RS6 || __JR_CSPLOIT_REPLIT || __JR_CSPLOIT_REPLIT1 || __JR_CSPLOIT_OODO || __JR_CSPLOIT_BEEHIIV || __JR_CSPLOIT_PRIVMAIL || __JR_CSPLOIT_ZOHO_INSIGHT || __JR_CSPLOIT_YANDEX1 || __JR_CSPLOIT_PIXJRE || __JR_CSPLOIT_LU_MS || __JR_CSPLOIT_CLOUD_IPFS || __JR_CSPLOIT_UTRAKER || __JR_CSPLOIT_RU_COM_URL || __JR_CSPLOIT_SA_COM_URL || __JR_CSPLOIT_ZA_COM_URL || __JR_CSPLOIT_AZURE_APP_URL || __JR_CSPLOIT_SHORTGY_URL || __JR_CSPLOIT_CF_IPFS_URL || __JR_CSPLOIT_TRIMMER_URL || __JR_CSPLOIT_CLUBOS_URL || __JR_CSPLOIT_STRAPP_URL || __JR_CSPLOIT_CHAIN_IO_URL || __JR_CSPLOIT_MEDIAFIRE_URL || __JR_CSPLOIT_SENDSPACE_URL || __JR_CSPLOIT_DRV_TW_URL || __JR_CSPLOIT_REM_AX_URL || __JR_CSPLOIT_QBOOKSEC || __JR_CSPLOIT_VERCEL_APP || __JR_CSPLOIT_VERCEL_APP2 || __JR_CSPLOIT_ACCOUNTUS || __JR_CSPLOIT_MOTIONHOST || __JR_CSPLOIT_KTX_URI || __JR_CSPLOIT_VOZER_URI || __JR_CSPLOIT_WEEBLY_URI || __JR_CSPLOIT_LINODE_OBJ || __JR_CSPLOIT_TOP_GG || __JR_CSPLOIT_IPFS_XYZ || __JR_CSPLOIT_MJT_LU || __JR_CSPLOIT_XTRFR_URL || __JR_CSPLOIT_KUDOSI_URL || __JR_CSPLOIT_GUMROAD || __JR_CSPLOIT_NETLIFY || __JR_CSPLOIT_4EVER_URL || __JR_CSPLOIT_GHZ_IO || __JR_CSPLOIT_ONRENDER || __JR_CSPLOIT_OSTORAGE || __JR_CSPLOIT_MYPI_URL || __JR_CSPLOIT_REDIR_URL1 || __JR_CSPLOIT_EVIL_URL || __JR_CSPLOIT_FASTLY_URL || __JR_CSPLOIT_WDCDN_URL || __JR_CSPLOIT_GIT_IO_URL || __JR_CSPLOIT_DOCSEND || __JR_CSPLOIT_EX_4_URL || __JR_CSPLOIT_STREAMS_URL1 || __JR_CSPLOIT_MATHTAG || __JR_CSPLOIT_AWIN1_URL || __JR_CSPLOIT_COOKST_URL || __JR_CSPLOIT_STAT1_URL || __JR_CSPLOIT_AYM_SHOP_URL || __JR_CSPLOIT_ACK_DIG_URL || __JR_CSPLOIT_MEAT_SE_URL || __JR_CSPLOIT_CODE_PAGE_URL || __JR_CSPLOIT_XLATE_ONE_URL || __JR_CSPLOIT_SHOOT_CAN_URL || __JR_CSPLOIT_KAIDO_URL || __JR_CSPLOIT_TRK_AGENCY || __JR_CSPLOIT_ONLY_URL || __JR_CSPLOIT_MCMOD_CN_URL || __JR_CSPLOIT_VTRAXIS_URL || __JR_CSPLOIT_SAMIKSHA_URL || __JR_CSPLOIT_PARABOX_URL || __JR_CSPLOIT_IVORAX_URL || __JR_CSPLOIT_SANDUIK_URL || __JR_CSPLOIT_SHOPIHY_URL || __JR_CSPLOIT_SUPRSND_URL || __JR_CSPLOIT_NVERCO_URL || __JR_CSPLOIT_STOPASIS_URL || __JR_CSPLOIT_APOLLO_HS_URL || __JR_CSPLOIT_TR_EAST_URL || __JR_CSPLOIT_HSTUDIO1_URL || __JR_CSPLOIT_APOBONK_URL || __JR_CSPLOIT_CRAZYDOM_URL || __JR_CSPLOIT_ORTODOX_URL || __JR_CSPLOIT_STORDEV_URL || __JR_CSPLOIT_SUCCESSEU_URL || __JR_CSPLOIT_UNIFIIT_URL || __JR_CSPLOIT_OORTSTOR_URL || __JR_CSPLOIT_BCDN_URL || __JR_CSPLOIT_CASAL_URL || __JR_CSPLOIT_COMADORA_URL || __JR_CSPLOIT_MEDCALITY_URL || __JR_CSPLOIT_INRECPT_URL || __JR_CSPLOIT_AUTOPLT_URL || __JR_CSPLOIT_SURGE1_URL || __JR_CSPLOIT_AVIDAF_URL || __JR_CSPLOIT_COPAAIR_URL || __JR_CSPLOIT_ALAMENT_URL || __JR_CSPLOIT_TRUEQR_URL || __JR_CSPLOIT_DCLICK_URL || __JR_CSPLOIT_SFRAME_URL || __JR_CSPLOIT_HOURIHA_URL || __JR_CSPLOIT_LUVTRUMP_URL || __JR_CSPLOIT_LMARK_SU_URL || __JR_CSPLOIT_ARWEAVE_URL || __JR_CSPLOIT_AZAD_URL || __JR_CSPLOIT_PYTHONANY_URL || __JR_CSPLOIT_TOPSEO_URL || __JR_CSPLOIT_LVPURP_URL || __JR_CSPLOIT_FTLUXY_URL || __JR_CSPLOIT_VMSTEEL_URL || __JR_CSPLOIT_ASCENTY_URL || __JR_CSPLOIT_CPANEL_SEC_URL || __JR_CSPLOIT_MAXTECH_URL || __JR_CSPLOIT_WTINY_URL || __JR_CSPLOIT_YAM_URL || __JR_CSPLOIT_BEACONS || __JR_CSPLOIT_RWALLET || __JR_CSPLOIT_DEALBADA || __JR_CSPLOIT_MOVEIS_BR_URL || __JR_CSPLOIT_DRAMKAR_URL || __JR_CSPLOIT_TREAT_VU_URL || __JR_CSPLOIT_LONGLINK_URL || __JR_CSPLOIT_DBGD_URL || __JR_CSPLOIT_CW_DEV_URL || __JR_CSPLOIT_APPWRITE_URL || __JR_CSPLOIT_DIAMONDT_URL || __JR_CSPLOIT_CAN_MEDI_URL || __JR_CSPLOIT_VIROVU_URL || __JR_CSPLOIT_SPESH_TZ_URL || __JR_CSPLOIT_DESAP_VU_URL || __JR_CSPLOIT_XTOUR_DE_URL || __JR_CSPLOIT_OPTI_APP_URL || __JR_CSPLOIT_JU_MP_URL || __JR_CSPLOIT_VVERSE_URL || __JR_CSPLOIT_GAHEEZ_URL || __JR_CSPLOIT_OSSHZ_URL || __JR_CSPLOIT_HAIXING_URL || __JR_CSPLOIT_WEUOMAIT_URL || __JR_CSPLOIT_SEARCHBRF_URL || __JR_CSPLOIT_EDGEONE_URL || __JR_CSPLOIT_BUYINO_URL || __JR_CSPLOIT_PETRAMIS_URL || __JR_CSPLOIT_BRK_BLK_URL || __JR_CSPLOIT_NICHOL_GA_URL || __JR_CSPLOIT_TZNT_URL || __JR_CSPLOIT_RICORICO_URL || __JR_CSPLOIT_CLOUDFRONT_URL || __JR_CSPLOIT_NEXAONE_URL || __JR_CSPLOIT_CASA_DEL_URL || __JR_CSPLOIT_PGYDT_URL || __JR_CSPLOIT_WOLFDSI_URL || __JR_CSPLOIT_KALKYL_URL || __JR_CSPLOIT_SCALETRN_URL || __JR_CSPLOIT_YEMLEE_URL || __JR_CSPLOIT_SHARPBOX_URL || __JR_CSPLOIT_ACCUMENT_URL || __JR_CSPLOIT_LIFEINTEL_URL || __JR_CSPLOIT_GREENGOV_URL || __JR_CSPLOIT_ALTORIX_URL || __JR_CSPLOIT_MILLERM_URL || __JR_CSPLOIT_FEILCESDA_URL || __JR_CSPLOIT_KELID_URL || __JR_CSPLOIT_MONDAY_URL || __JR_CSPLOIT_HIDRIVE_URL || __JR_CSPLOIT_XPERTY_URL || __JR_CSPLOIT_CONCEPTVU_URL || __JR_CSPLOIT_HUIDA_URL || __JR_CSPLOIT_COUPONSC_URL || __JR_CSPLOIT_XANO_URL || __JR_CSPLOIT_KRYNEXO_URL || __JR_CSPLOIT_ENELA_ZA_URL || __JR_CSPLOIT_CONF_VU_URL || __JR_CSPLOIT_MEONG_URL || __JR_CSPLOIT_CELIAC_URL || __JR_CSPLOIT_ACCION_URL || __JR_CSPLOIT_BIONICJOB_URL || __JR_CSPLOIT_CRECI_BR_URL || __JR_CSPLOIT_IR_ES_URL || __JR_CSPLOIT_ZDXH_URL || __JR_CSPLOIT_DFVBG_URL || __JR_CSPLOIT_BULAX_URL || __JR_CSPLOIT_CONTABO1_URL || __JR_CSPLOIT_RAILWAY_URL || __JR_CSPLOIT_CHORUS_FR_URL || __JR_CSPLOIT_VESTIAIRE_URL || __JR_CSPLOIT_TALENTGUM_URL || __JR_CSPLOIT_MAIS_BR_URL || __JR_CSPLOIT_CRAFTIVE_URL || __JR_CSPLOIT_ELCHIRI_URL || __JR_CSPLOIT_VOGUE_DEV_URL || __JR_CSPLOIT_WJSCO_URL || __JR_CSPLOIT_URBANROW_URL || __JR_CSPLOIT_AIRRESCUE1_URL || __JR_CSPLOIT_PURPOSE_VU_URL || __JR_CSPLOIT_FOREXSIG_URL || __JR_CSPLOIT_CREDTRUS_URL || __JR_CSPLOIT_SHADOWFUN_URL || __JR_CSPLOIT_SNGLINK_URL || __JR_CSPLOIT_ONYXHEALTH_URL || __JR_CSPLOIT_OCCASIN_VU_URL || __JR_CSPLOIT_SIMBIOXIA_URL || __JR_CSPLOIT_KLEPROMIL_URL || __JR_CSPLOIT_HALAMANG_URL || __JR_CSPLOIT_QZZ_IO_URL || __JR_CSPLOIT_GRANSLIV_URL || __JR_CSPLOIT_GDQJGS_URL || __JR_CSPLOIT_ATTY_RES_URL || __JR_CSPLOIT_HC_DEPT_URL || __JR_CSPLOIT_BIT_LY_URL || __JR_CSPLOIT_BITDO_URL || __JR_CSPLOIT_BRAND_URL || __JR_CSPLOIT_NEON_URL || __JR_CSPLOIT_JUMP_URL || __JR_CSPLOIT_CUTT_URL || __JR_CSPLOIT_BUFF_URL || __JR_CSPLOIT_KUTT_URL || __JR_CSPLOIT_BITWS_URL || __JR_CSPLOIT_BITCX_URL || __JR_CSPLOIT_TINY_URL || __JR_CSPLOIT_TWITS || __JR_CSPLOIT_GEN_S_ID || __JR_CSPLOIT_U_TO || __JR_CSPLOIT_ZPR_URL || __JR_CSPLOIT_TINY1_URL || __JR_CSPLOIT_RB_GY || __JR_CSPLOIT_T_LY_URL || __JR_CSPLOIT_SHORT_AT_URL || __JR_CSPLOIT_WA_LINK_URL || __JR_CSPLOIT_CLCK_RU_URL || __JR_CSPLOIT_IS_GD || __JR_CSPLOIT_FR_URLZ || __JR_CSPLOIT_RS_P1 || __JR_CSPLOIT_PSEE_IO || __JR_CSPLOIT_TAWK_TO || __JR_CSPLOIT_0HO_LA_URL || __JR_CSPLOIT_I_BITLY_URL || __JR_CSPLOIT_WE_TL_URL || __JR_CSPLOIT_KO_GL_URL || __JR_CSPLOIT_B_LINK_URL || __JR_CSPLOIT_GRCO_URL || __JR_CSPLOIT_TO_PW || __JR_CSPLOIT_SHORT_ASIA || __JR_CSPLOIT_CLEVER || __JR_CSPLOIT_L1NQ || __JR_CSPLOIT_SHORTER_ME || __JR_CSPLOIT_SHORT_ME || __JR_CSPLOIT_ULR_ME || __JR_CSPLOIT_UR0_LINK || __JR_CSPLOIT_TLY_LINK || __JR_CSPLOIT_SIKER || __JR_CSPLOIT_TREE || __JR_CSPLOIT_SHORT_DO || __JR_CSPLOIT_TINYL_IO || __JR_CSPLOIT_NWAX_URL || __JR_CSPLOIT_NEV_IT || __JR_CSPLOIT_JX_AX || __JR_CSPLOIT_LI_HI || __JR_CSPLOIT_LI_HI1 || __JR_CSPLOIT_DUB_SH || __JR_CSPLOIT_SMALL_NL || __JR_CSPLOIT_URAND_CO || __JR_CSPLOIT_CMS_URL || __JR_CSPLOIT_CMS_MISC) meta JR_CLOUDSPLOIT ((__JR_CLOUDSPLOIT_BODY || __JR_CLOUDSPLOIT_SUBJ) && T_JR_CSPLOIT_BAD_URL) describe JR_CLOUDSPLOIT Bad URL signatures in association with body/subject contect score JR_CLOUDSPLOIT 10 endif ###################### MIME SECTION ###################### ## CREATING MIME RULES: JR_EXPLOIT.cf JR_HDR_GEN.cf ## ## Malformed/Disguised HTML filenames ## ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader T_JR_CSPLOIT_MIME1 Content-Disposition =~ /filename\=\"?(.*\.(xlsx?\.HTML|[Xx][Ll][Ss]\.html|xls\.htML|xls\.HtMl|xls\.htM|xsl_x\.h_T_M_L|_xsl_x\.hTML|wavv\s\.HTmL))([";']?|$)/ mimeheader T_JR_CSPLOIT_MIME1A Content-Disposition =~ /filename.*\=\"?(.*\.[Ss]?(HTMl|HTmL|HTml|HtML|HtMl|HtmL|Html|htmL|htMl|htML|hTml|hTmL|hTML|hTMl))([";']?|$)/ mimeheader T_JR_CSPLOIT_MIME1B Content-Disposition =~ /filename.*\=\"?(.*\.[Ss]?(HTm|HtM|Htm|htM|hTm|hTM))([";']?|$)/ describe JR_CSPLOIT_MIME_HTML Wrong MIME Type for HTML files score JR_CSPLOIT_MIME_HTML 5 ## Wrong HTML MIME Types ## mimeheader T_JR_CSPLOIT_MIME_HTML1 Content-Type =~ /application\/octet\-stream\;(\scharset\=[A-z0-9\-]{3,15}\;)?\sname\=\".{1,70}\.s?html?\"/i mimeheader T_JR_CSPLOIT_MIME_HTML2 Content-Type =~ /application\/html\;(\scharset\=[A-z0-9\-]{3,15}\;)?\sname\=\".{1,70}\.s?html?\"/i mimeheader T_JR_CSPLOIT_MIME_HTML3 Content-Type =~ /application\/x\-html\;(\scharset\=[A-z0-9\-]{3,15}\;)?\sname\=\".{1,70}\.s?html?\"/i mimeheader T_JR_CSPLOIT_MIME_HTML4 Content-Type =~ /application\/x\-gtar\;\sname\=\".{1,70}\.s?html?\"/i mimeheader T_JR_CSPLOIT_MIME_HTML5 Content-Type =~ /image\/jpeg\;\sname\=\".{1,70}\.s?html?\"/i meta JR_CSPLOIT_MIME_HTML (T_JR_CSPLOIT_MIME_HTML1 || T_JR_CSPLOIT_MIME_HTML2 || T_JR_CSPLOIT_MIME_HTML3 || T_JR_CSPLOIT_MIME_HTML4 || T_JR_CSPLOIT_MIME_HTML5) describe JR_CSPLOIT_MIME_HTML Wrong MIME Type for HTML files score JR_CSPLOIT_MIME_HTML 5 ## Wrong DOC MIME Types ## mimeheader T_JR_CSPLOIT_MIME_DOC1 Content-Type =~ /application\/octet\-stream\;\sname\=\".{1,70}\.docx?\"/i mimeheader T_JR_CSPLOIT_MIME_DOC2 Content-Type =~ /application\/xml\;\sname\=\".{1,70}\.docx?\"/i meta JR_CSPLOIT_MIME_DOC (T_JR_CSPLOIT_MIME_DOC1 || T_JR_CSPLOIT_MIME_DOC2) describe JR_CSPLOIT_MIME_DOC Wrong MIME Type for DOC(X) files score JR_CSPLOIT_MIME_DOC 5 ## Wrong TEXT MIME Types ## header T_JR_CSPLOIT_MIME_TEXT1 ALL:raw =~ /Content\-Type\:\stext\/plain\;?(?!\scharset=\"utf-8\")(\scharset\=\"[A-z0-9\-]{3,15}\")?\sContent\-Transfer\-Encoding\:\sbase64/m mimeheader T_JR_CSPLOIT_MIME_TEXT2 Content-Type =~ /application\/(plain|html)/i mimeheader T_JR_CSPLOIT_MIME_TEXT3 Content-Type =~ /image\/(plain|html)/i meta JR_CSPLOIT_MIME_TEXT (T_JR_CSPLOIT_MIME_TEXT1 || T_JR_CSPLOIT_MIME_TEXT2 || T_JR_CSPLOIT_MIME_TEXT3) describe JR_CSPLOIT_MIME_TEXT Wrong MIME Type for Text files score JR_CSPLOIT_MIME_TEXT 5 ## Wrong PDF MIME Types ## mimeheader T_JR_CSPLOIT_MIME_PDF1 Content-Type =~ /application\/text\;(\scharset\=[A-z0-9\-]{3,15}\;)?\sname\=\".{1,70}\.pdf?\"/i describe T_JR_CSPLOIT_MIME_PDF1 Text declaration for a PDF MIME type is incorrect mimeheader T_JR_CSPLOIT_MIME_PDF3 Content-Type =~ /image\/jpeg\;\sname\=\".{1,70}\.pdf?\"/i describe T_JR_CSPLOIT_MIME_PDF3 JPEG declaration for a PDF MIME type is incorrect meta JR_CSPLOIT_MIME_PDF (T_JR_CSPLOIT_MIME_PDF1 || T_JR_CSPLOIT_MIME_PDF3) describe JR_CSPLOIT_MIME_PDF Wrong MIME Type for PDF files score JR_CSPLOIT_MIME_PDF 5 ## Wrong TAR/GZ MIME Types ## mimeheader T_JR_CSPLOIT_MIME_ARC1 Content-Type =~ /application\/x\-rar\;\s(file)?name\=\"?.{2,40}\.gz(\"|\;)?/i mimeheader T_JR_CSPLOIT_MIME_ARC2 Content-Type =~ /application\/x\-rar\;\s(file)?name\=\"?.{2,40}\.tar(\"|\;)?/i meta JR_CSPLOIT_MIME_ARC (T_JR_CSPLOIT_MIME_ARC1 || T_JR_CSPLOIT_MIME_ARC2) describe JR_CSPLOIT_MIME_ARC Wrong MIME Type for TAR or GZ files score JR_CSPLOIT_MIME_ARC 5 ## Other MIME Oddities ## mimeheader JR_UTF8B_FILENAME Content-Type:raw =~ /name\=\"?(\=\?[Uu][Tt][Ff]\-8\?B\?)/ describe JR_UTF8B_FILENAME Attachment has a UTF8 Binary filename score JR_UTF8B_FILENAME 1.2 mimeheader JR_3UNDER_ATTACH Content-Disposition =~ /filename\=\"?(.{2,50}___.{3,50}(\.[A-z]{1,4}))(\"|\;)?/ describe JR_3UNDER_ATTACH Attachment has 3 underscores in base filename score JR_3UNDER_ATTACH 3 mimeheader JR_3DOTS_ATTACH Content-Disposition =~ /filename\=\"?(.{2,50}\.\.\..{2,50}(\.[A-z0-9]{1,4}))(\"|\;)?/ describe JR_3DOTS_ATTACH Attachment has 3 dots/periods in base filename score JR_3DOTS_ATTACH 3 mimeheader JR_TXT_JS_ATTACH Content-Disposition =~ /filename\=\"?(.{1,30}\.(TXT|txt)\.js)(\"|\;)?/ describe JR_TXT_JS_ATTACH Javascript attachment disguised as TEXT score JR_TXT_JS_ATTACH 5 mimeheader JR_ASTERISK_ATTACH Content-Disposition =~ /filename.*\=\"?(.*\.\*)([";']?|$)/ describe JR_TXT_JS_ATTACH Wildcard asterisk in filename score JR_TXT_JS_ATTACH 5 mimeheader JR_DOUBLEDOTS_ATTACH Content-Disposition =~ /filename\=\"?([A-z][A-z0-9]{8,10}\.\.(pdf|doc|xls|html))(\"|\;)?/ describe JR_DOUBLEDOTS_ATTACH Attachment extension has two dots.. score JR_DOUBLEDOTS_ATTACH 5 mimeheader JR_STREAM_NOFILE Content-Type =~ /application\/octet\-stream\;\sname\=\"?(?!.*\.)(\"|\;)?/ describe JR_STREAM_NOFILE Octet-Stream header without a valid filename score JR_STREAM_NOFILE 10 endif ################### ATTACHMENT SECTION ################### ## CREATING ATTACHMENT RULES: JR_EXPLOIT.cf ## ## BAD AND/OR EXPLOITED FILENAMES ## ## Content-Disposition ## ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader T_JR_BAD_DISPOSITION1 Content-Disposition =~ /filename\*?\=[\s"]?(PO\#\s[0-9]{7,9}\.rtf|EL\-3887\sMedical\sreport\sp1\.doc|form\.(rtf|docx?)|Reverse\sAdvice\.html|Bill_of_Lading_[0-9]{8,9}\.html|2020\sCOCACOLA\s+WINNING\sDRAW\.pdf|Shippment\sDocument\#[0-9]{4,6}\.htm|.*ExxonMb\.docx.*|BOL\.xlsx|PO\#[0-9]{5,6}\.xlsx|Order\.pdf\.z|From\sMrs\sVonda\.\sFamily\.\.docx?|Order\.rar|Form\s\-\s[a-zA-z]{3}\s[0-9]{2}\,\s[0-9]{4}\.(rtf|docx?)|[A-Z]{2}[0-9]{9,10}[A-Z]{2}\.(rtf|docx?)|Electronic\sform\.(rtf|docx?)|PRICE\sLIST\.rar|PO\sEcotec\.xlam|Proforma\sInvoice\.arj|ivd\s[0-9]{4,5}\.rar|[A-Z]{2}[0-9]{3}\sTRANSFER\sCOPY\.gz|PROOF\sOF\sPAYMENT\.img|[0-9]{13}\.jpg|Quotation\sRequest\.ace|invoice\-05062019\supdate.iso|Plaza\-Building\-\-Combo\-Exit\-\-Emer\s\(4\)\.rtf|email_verification_processor\.html|AUW\-020120\sZZT\-020520\.(rtf|docx?)|RFQ\-[0-9]{6,7}\.html|W\-9\sform\.(rtf|docx?)|W\-9\.(rft|docx?)|QUOTATION\sREVISED\s[A-Z]{3}\,[0-9]{1,2}\.html|ANTIS\sLLC\-SOFT\sCORPORATE\sOFFER\.pdf|MV\sIvy\sOcean\.xlsm?|Vessel\sparticulars\.xlsm?|2020\sPAYROLL\.html|Tokyo\s2020\.pdf|invoicerequest\.doc|8651\s8\-14\-18\.xls|EMR\sLetter\.xls|f[0-9]{10,12}\.doc|BILLING\-REPORT\-UPDATE\.pdf|CA858\sNSO1420\sRIB\sLB\sSAS\.img|SWIFT\s[0-9]{12,16}\.IMG|NEW\sORDER\.html|BARRISTER\sTIMOTHY\sLEKALAKALA\.doc|Amazon\-Update\.dot|BILLING\-REPORT\-CASEID\#45896\.pdf|.*\.pdf\.html)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION2 Content-Disposition =~ /filename\*?\=[\s"]?(harris\ssteakhouse\sinvoice\.pdf|Scan_Document57309PDF\.iso|RFQ\sfor\sAluminium\sSheet\s\-\s377591\.uue|DOCS\.xlsx|Order\slist\s\&\sPrices\sConfirmation\.doc|Coca\-Cola\sPromotion\.pdf|Receipt\s\-\sML435LQ027\.pdf|urgent\srequest\sfor\squotation\.img|Company\-Terms\.doc|DOT_JD_GM\.doc|signed_[0-9]{6}\.gz|PO\#[0-9]{4}[A-Z]{4}\.(HTML|html)|You\sKnow\.docx|Invoice[0-9]{4,5}\(1\)\.img|i[0-9]{7,9}\.doc|LOVE_YOU_[0-9]{6}_2020\.zip|Invoice_pdf\.gz|SANLAM_FINANCE_SPECIAL\.pdf|urgent\spricelist\sfor\sangola\sproject\.img|Coca\-Cola\sFIFA\sWORLD\-CUP\.pdf|Buy\s3\sget\s1\sFree\.pdf|[A-Z]{3}\-[A-Z]{3}\sOUTSTANDING\sPAYMENT\sDETAILS\.r00|att1\-5812880355\.pdf\.html|OI\.img|IP\.img|PO\.img|Official\sLetter\.pdf|Statement\sof\sAccount\s\(FEB\s2020\)\.r00|357\.doc|From\s+FRED\s+GAMBO\.pdf|Quotation\.xlsx|AccountTerminationRequest\.htm|Apple\-Update\.dot|FORMAT\.pdf|Shipping\sDocuments\sPL\&BL\sDraft\.img|Image0002\.gz|DHL\sAWB\/\sORGL\sSHIPPING\sDOCS\.html|Invoice\s0022000003649\.doc|Porposal\sFrom\sMrs\sBrown\.pdf|Payment\sCopy_pdf\.img|3\.5\%\sApply\sFor\sA\sRCS\sCash\sLoan\sPromo\!\s1\.pdf|RCS\sLoan\sApplication\sForm\.pdf|P0[\@\#]{1,2}[0-9]{9,12}\.zip|mail28188\.pdf|Charles\.Schwab\.Security\.Service\.2020\.pdf|Dear\srespected\scustomer.*\.pdf|Update\sInfromation\.dot)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION3 Content-Disposition =~ /filename\*?\=[\s"]?(invoice\-[0-9]{3,5}_remittance\.html|QUOTATION|BLACKBERRY\s{1,5}{0-9]{1,2}TH\s{1,5}ANNIVERSARY\s{1,5}PROMOTION\s{1,5}FOR\s{1,5}2020\s{1,5}AWARD\s{1,5}NOTIFICATIONS\.docx|SUSAN\sSHABANGU\.docx|APPLY\sINSTANT\sLOANS\sHERE\.txt|875643664\.gz|Update[\s\-_]Amazon[\s\-_]Informations[\s\-_]Membership\.pdf|6554010\.xls|APPROVED\sPAYMENT\.\.pdf|invoice\.pdf\.z|hesaphareket\.doc|Invitation\sto\sBid\.pdf|Product\sSpecification\.pdf|we\scan\sagree\.docx?|SUSAN\sSHABANGU\.pdf|United\sNations\sCovid\-19\sFund\sRelieve\sAward\s2020\.pdf|Proforma\sInvoice\.html|NUMBERS\.\.docx|PO\.gz|NEW\sORDER\.gz|Order\sSummary\.pdf|BCKBCAVNATIONALLOTTOUKEmailDraw\sF2020\sFJJ\-SA\.pdf|doc01762120200806170236\.html|[a-z]{3,15}_shipment\.html|Bill\.\.\.pdf|Order\sconfirmation\.pdf|CombinedHud\.pdf|ORDER\.html|A\s+N\s+N\s+E\s+X\s+E\-\s+2020\.pdf|BusinessProposal[0-9]{1,8}\%\sForYou\.docx|Emsf_Billing_invoice\.html|Quotation\sSheet\.html|Account\sListing\sReport\s+\-\s+[0-9][0-9]\/[0-9][0-9]\/2020\.pdf|Confirmation[\s\-_]EuroJackpot\.pdf|good_day_565130_+popular_?\s?jennifer_aniston\.pdf\.pdf|Confirmation\-49438\.pdf|JUST\sTHINKING\sby\sMartha\sOwens\sSeptember\s2020\.wpd|Pending\sInvoice\.html|my\snew\.docx|Urgent\sInvitation\sfor\sthe\ssupply\sof\sFace\sMask\.pdf|lotto\.xps)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION4 Content-Disposition =~ /filename\*?\=[\s"]?(RELIEF[\s\-_]FUND[\s\-_]CONSOLIDATION\.pdf|Fax\s[0-9]{5,7}\.htm|00559988333\.z|notice\s[0-9]{4}\.xls|YAHOO[\s\-_]LOTTERY\.pdf|PDF\-AMZ\s\-RENEW\.pdf|Welcome\sTo\sBrightWay\sFinance\.\.pdf|Transaction\-Declined\-21\-10\-2020\.security\.pdf|Amazon[\s\-_]Prime[\s\-_]Update\.pdf|PO\-[a-zA-Z][0-9]{7,9}\.zip|payment\sissue\.docx|Customer\sOrder\,\sImages\,\sSpec\.zip|New\s+Order\s*\.(xls|zip|gz|html?|docx?|img|pdf)|\senc_info\.zip|Payment_Receipt_[0-9]{7,9}_[0-9]{3,5}\.xlsx|[a-zA-Z]+\sNew\sOrder\.img|Receipt_HKNEVB90IOC\.pdf|CV\.IMG|Pop2_E\s\(8\)\.html|PO_\#[0-9]{8}\.xlsx?|HUD\-1\s\([0-9]\)\.pdf|SwiftPaymentRef[0-9]{6,7}PDF\.html|TP\-[0-9A-Z]{11,13}\-Receipt\.pdf|APPLY\@CONFIDECASHLOAN\.COM\!+\.pdf|WeTransfer\sFile\sfor\s[a-z0-9._\-]+\@[a-z0-9.\-]+\s\.html|Ordine\s+dacquisto_[0-9]{8}_[0-9]{8}_[0-9]{6}\.pdf|Proof_Of_Payment\.pdf\.htm|SS19T90591\.gz|Update[\s\-_]Payment[\s\-_]Informations?\.pdf|[0-9]{14}\.doc|Amazon\sMembership\sUpdate\s\!\.pdf|SWIFT\sMID.*\.html|DUE\sINVOICE\.html|Deposit\sPayment\.html|PO\-391SXF\.xlxs\.html|WESTERN[\s\-_]UNION[\s\-_]PROMO\.doc|OneDrive\.pdf|PI00TH00932\.htm|invoice_AH953162696A\.pdf|proforma_invoice\.html|OneDrive[\s\-_]Secured[\s\-_]Message\.pdf|ES\-MA\-18\-9\s\([0-9]{4}\)\.doc|Account[\s\-_]Information[\s\-_]Prime[\s\-_]Disable\.pdf)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION5 Content-Disposition =~ /filename\*?\=[\s"]?(03022021\.IMG|The\sgreat\scontroversy\s\s\-\sE\.\sG\.\sW\.\s\(whole\sbook\)\.pdf|New\sOrder_xls\s\(2\)\.html|Wire\-Transfer\.html|Project\sproposal\.docx|New\sPurchase\sorder\.pdf\s\([0-9]\)\.zipx|ChineseSpys62\.pdf|ORDER_2020_54\.docx|Order\sMR\-B\.\s04\s03\s21\.cat|SBA_APPROVAL_FORM\.pdf|RV\.URGENT\sPAYMENT\.zip|Swift_Copy_5100378\.htm|WNRTYRVAQ\.html|payment_certificate\.xlsx|E\-INVOICE\.Htm|FedEx\sMPS\sShipment\s[0-9]{11,13}\.yz|cotizacion1?\.pdf\.gz|E_Chase\-Support393030\.html|CVE9362\.gz|INVOICE_COPY\s\-\sENC\s\([0-9]\)\.htm|SANLAM\s\-\sFINANCE\.PDF|Receipt\-Statement\-90124769\.pdf|Payment\scopy\-pdf\.html|PO34500567\.xlsx|BillOfLading\.cab|INV\#R19839\(134PKGs\)\.xlsx|\$[0-9]{3,3}\,[0-9]{3,3}\.[0-9]{2,2}\.shtml|Order\s100920\-0086\.ppt|Order\s100920\-0087\.pps|P\.O\.List\.html|Indeed_Update_File\.html|URGENT_QUOTATION_PR\s\#\s[0-9]{5,7}270473\.\s[0-9]{2,2}\-[0-9]{2,2}\-[0-9]{4,4}xlxs\.Gz|.*COMMERCIAL\sINVOICE\sSHIPMENT\s[0-9]{11,13}\.pdf\.r[0-9]{2}|Order\s[0-9]{5,7}\#\.doc|Quote\sRequest\s\#[0-9]{6,8}\.doc|PI_[0-9]{4,6}MV_REVISED\.xlsx|Order\sNo\.41018\.htm|Purchase\sOrder\sFor\sInvoice\s\([0-9]\)\.htm|SUSAN\.doc|GREY\s2021\sIN\.xlsx|PrimeUpdate_Payment[0-9]{4,6}\.pdf|Payment\sReport\s.*\.hTMl|payment\scopy\.html|MICROSOFT\sAWARD\sPROGRAMM\.pdf)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION6 Content-Disposition =~ /filename\*?\=[\s"]?(SC202102\-00013\.z|US\sFederal\sReserve\sBank\sCorporate\sOffice\.(xps|pdf)|.*\@.*\..*Dhl\sShipping\sDoc\.html|RFQ\s\-\s00[0-9]\.xlsx|FROM\.?MRS\.?ROSE\.?MILLER\.doc|POBKMIN20210000000231PDF\.r15|RE\-DEUTSCHLAND\.\.pdf|hk\-MongoliaKTYBeb\.pdf|From\s+Mark\s+Stevenson[\s_]+[0-9]{4,}(\s\([0-9]\))?\.(pdf|docx|jpg)Swift\-EUR\s[0-9]{4,5}\.IMG|BK\sPNG\sFOB\sSCO\.pdf|report\spayment\.xlsx|.*URGENT\sBUSINESS\sRESPOND.*|PO1024808\.Html|Purchase\sOrder\([0-9]\)\.zip|DOC\#[0-9]{3,4}\-[0-9]{4,5}\-[0-9]{4,5}\.pdf|PO26738\.html|INV560a\.html|Purchase\sOrder_[0-9]{5,7}\.xlsx|doc64654475795\.gz|Document\.Html|Filter\sOrder\.Html|Siwft_Afex_USD[0-9]{4,6}\.img|INSTRUCTION\sTO\sCREDIT\sYOUR\sACCOUNT\sWITH\sTHE\sSUM.*\.doc|MicrosoftsBingIWcI3e\.pdf|request\.zip|PO\#[0-9]{6,8}\-INQUIRY\.HTM|file\.gz|New_Order\-RFQ_HL51L05\.HTML|invoice\sfor\s[a-z0-9._\-]+\@[a-z0-9.\-]+\.html|RQF\sINV\.Html|Document01\.html|Tax\sInvoice\sIN[0-9]{5,7}\.PDF\.z|SecurityUpdates\.(zip|exe|gz|doc)|Authorization\sLetter\.\.doc|Documents\.html|Ein\sKopieren\s[0-9]{5,7}\s\([0-9]\)\.pdf|SKM_[A-Z][0-9]{19,22}[A-z][0-9][A-Z]{1,3}\.zip|PI\#[0-9]{4,6}[A-Z]{3,4}_Pdf\.html?|ADDRESS_FORM\.html?|PURCHASE\sORDER\sNO_[0-9]{4,}\.xlsx?|Estate\.pdf|Loan\sScheme\.pdf|Commercial\sInvoice\.2212\.htm|wire\stransfer\.html?|Sales\sContract\.htm)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION7 Content-Disposition =~ /filename\*?\=[\s"]?(InvPixcareer\.\-[0-9]{4,6}_[0-9]{7,9}\.xlsb|CMR\-[0-9]{5,7}_PDF\.IMG|PO[0-9]{6,8}\.\xE2\x80\xAEfdp\.html|attachments\.zip|2021[0-9]{10,11}\-[0-9]{4}\.zip|Invoice\-[0-9]{8,9}_2021[0-9]{4,5}\.xlsb|__MFS\.pdf|3856579\.tif|Review1\.ppt|Review\.ppt|Payment\.shtml|PR\sNo\.\s[0-9]{5,6}\.zip|Plan\-[0-9]{8}_[0-9]{8}\.xlsb|tabella\sepi\s\.docx|Video0014\.mp4|P112DEA\sprogram\s\.docx|loan\sdetails\s+[.]{2,5}pdf|Order\sEQE090\.xlsx|Premier\sLotteries\.pdf|scanned\sPayment\sInvoice\.pdf\.\s+\.html|IMPORTANTE\.pdf|credit\snotification\s+pdf\.z|Bank\sDetails\s+pdf\.z|\[RFQ\]\s[A-Z]{2,2}\s[A-Z]{3,3}\#[0-9]{9,10}\s[A-z]{2,40}\.[A-z]{2,8}\sPdfXls\.html|Banka\sSwift\.[0-9]{7,9}\.zip|New\sOrder\.shtml|Invoice\#due_Thursday\,\sOctober\s28\,\s2021\.html|Bank\sCopy\.PDF\)\.ppam|NEW\sORDER\sLIST\sPDF\.gz|Rebecca\sSchieble\.\.docx|PAYMENT\-PROCESSED\.html|DOCUMENT_docx\s+\.htm[lL]|PO_190569\.doc|PO\#SC[0-9]{5}\.docx|etc\.pdf|PO\sAMO\s[0-9]{9,11}\.xlsx|[A-Z]{2}[0-9]{3}\sSWIFT\-INV[0-9]{5}\.s?html|Swift\sCopy\sUSD\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sPdf_Xls\.s?html|CTM\sARRANGEMENT_PDF\.cab|Document\.html|ATTACHED\.zip|[0-9]{16,23}\.xlsb|RecoversfromaLungInfection[A-z0-9]{5,7}\.pdf|payment\scopy\.xll|Shipping\sSchedule\.xlsx|Shipping\sSchedule\.xlsx|Agreement\sDocuments\.html|[0-9]{11}\.xlsb)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION8 Content-Disposition =~ /filename\*?\=[\s"]?(Crude\sOil\sLifting\sContract\sOffer\.{1,6}pdf|Invoice32463\.html|MT103\-_[0-9]{9}\.htm|MRS\.\sGRACE\sMUGABE\.docx?|Scan_5638782\.zip|PO\sfor\sContract\s211_c\.pdf|MICROSOFT\sAWARD\sLOTTERY\s2021\.pdf|Fb\.pdf|PO[0-9]{8}\.Html|CUBLINK\sPAUL\sDAVIS\.docx|TrustWallet\s\sVerification\sWallet\-NTF\'s\.pdf|About\syou\.pdf|payment\-claim\.\.pdf|Trnst\.MSY\.00614\.pdf|PO\#5689\.xlsx|CHARITY_DONATIONS\.pdf|E\-Contact\sForm\.htm|Bank\.docx|Contact\s\s\#9021257246\.html|PO_[0-9]{8}USD\s[a-z]{2,15}\.[a-z]{2,15}\sPdfXls\.html|DHL\sAWB\s\-\s[0-9]{12}_Shipping\sDocuments\s2022\.gz|Hsbc\sswift\.htm|Proforma\sFatura\sektedir\.zip|Shipping\sDoc\.shtml|Security\sMail\sMessage\.pdf|Documents\.html|PROJECT\sFUNDING\sINVESTMENT\.pdf|Lease\sAgreement\.Html|Trust_Wallet_Verification_Wallet\-NFS\.pdf|[a-z]{2,25}\s6424\.64\.pdf\.HtML|cvds\.{1,4}World\sHealth\sOrg\.{1,4}odt|Proposal_xls\.htm|FreeLotto\.pdf|ATTORNEY\sCALEB\sBORIS\.docx|27099788_20220118152009\.docx|Order\s[0-9]{5}\s\(SF[0-9]{5}\)\.XLSX|Laurent\.docx|Vanida\.docx|\(MT\-103\-USD\)\*\*\*717\.htm|COMPENSATION\sFUND\sPAYMENT\sAPPROVED\sNOTIFICATION\s2022\.pdf|Health\.Benefit\.2022\-21\.pdf|NEW\sVETERANS\sAFFAIRS\sPAYMENT\.pdf|VETERANS\sAFFAIRS\sPAYMENT\.pdf|Payment\sComfirmation\.HTML|CCPsOrganHarvesting7i6LCd\.pdf|TrumpCovid\-19CCPWAC7gs\.pdf)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION9 Content-Disposition =~ /filename\*?\=[\s"]?(Order\slist\.PDF\.zip|\(Good\sInformation\)1\.pdf|BILL521vr4078\.pdf|Attached\sDoc\.png|INV84T0D20554\.pdf|Contract\&AgreementCopy_[0-9]{3}\.htm|Disable\sMember\sList\s_Eng_\.pdf|Inoice\snote\.png|Payment\-Confirmation\.html|Document_[a-z]{2,24}\@[a-z]{2,45}\.[a-z]{2,8}\.html|No\.\sSTB42020\.pdf|MT103_Payment_slip_for\soutstanding\s[0-9]{6}\.html|c94e77i1ba0\.\.pdf|Statement\sof\sAccount\sas\sof\s[0-9]{8}\.xls|r64t66h9om9\.\.pdf|j99p59e8hr6\.\.pdf|m73n99q8to0\.\.pdf|i59d93r9eu2\.\.pdf|i97e87j8uo1\.\.pdf|w69p48s1gn3\.\.pdf|a24h27p0ew0\.\.pdf|y06r30s5ne6\.\.pdf|DHL\-Waybill\.img|FIFA\sWORLD\sCUP\sQATAR\s2022\.pdf|SP_04132022\.docx|Falling\.is\.never\.an\.option\.\._K2kJXKu6yXFDHQmX\.pdf|The\.Perfect\.Welcome\.Offer\.from\.our\.Palace_yEsvG7VcaRRxP2lx5\.pdf|GOOGLE\sINC\s\s2021\-\.pdf|Remittance\sAdvice_[0-9]{7}\.html|Settlememt\s\sPayment\son\sHold\.pdf|Shipment\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}_eSecure\.HTML|FAX_[0-9]{13,15}[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\.htm|Fwd\sSwift\sCopy\.r[0-9]{1,2}|picture_7Zd8M3cr\.pdf|eFax[0-9]{6}\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\.html?|picture_RLTwazAJEGGiRU\.pdf|EFCISLUGKJ_1\.png|Document\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\.html?|[0-9]{13}\.xll|OFERTAS\sABRIL\s\-[0-9]\.xlsx?|Doc\.html)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION10 Content-Disposition =~ /filename\*?\=[\s"]?(Original_Document\.htm|Proforma\sDetails\.html|\#900128\.xlsx|FROM\sMRS\.\sRITA\s\sK\.\sMADINE\.jpg|Customer\sStatement\.html|PO\-SAREN0LLC0\-PO[0-9]{6}_scancopy\.xlsx?|MSDS\.xlsx|[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sWIRE[0-9]{8}PDF\s\.htm|New_Order\.xlsx\.htm|New\sorder\.xlsx|SWIFT\sTransfer\s\(103\)\s[0-9]{16}\.docx|Brightok\-Trading\-PO[0-9]{5}_copy\.doc|Stainless\sSteel\sPlates\sSheets\sand\sCoil\sproduct\sinquiry\.zip|Purchase\sorder\.htm|RFQ\s11054\.eml\.lz|PO\-[0-9]{5}_New\sOrder\.xlsx\.html?|COmin\.jpg|DOC20220513PRELIMINARYALUMINUMPROFILEQUANTITIESGMH\.7z|Outlook\-y3eiruqu\.png|28\.06\.22\.ppa|WeTransfer\sfiles_[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}\.html|INV\-Due_paymentDetails\.htm|[0-9]{13,14}\s\-\sMembership\sNumber\.pdf|CHINA\-DOC_CHINA\sNHV\s4\.80\scbmQMUM00006537ARMXJUN5220\.pdf\.gz|Bill\sof\sLading\.htm|FBII\.HTML|New_Order_[a-z]{3,45}\.[a-z]{2,8}\.htm|Order\s[0-9]{7}\-0\.pdf|SOLICITATION\#_AHR941085Q33\.pdf|Outbound\sShipment\sOrder\s[0-9]{5}_pdf\.gz|FedEx\s\-\sAWB\.html|e\-Pay\.html|contract\ssigned\.shtm|Inv_[0-9]{8}\.html|Order\s[0-9]{8}\.xlsx|Purchase\sorder\s\#[0-9]{5}\.docx|eSecure_[A-z0-9.\<\>\@_\-]{10,70}\@linkedin\.com\>\.html|Paul\'s\sCV\.img|scanned\scopy\.img|YAHOO\=MSN\.pdf|message_zdm\.pdf)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION11 Content-Disposition =~ /filename\*?\=[\s"]?(Shipping\sDocuments\s\s\&\s\sPO\#\s\-RDPL\.img|ID\-[0-9]{7}\.htm|Apex_G\.C\([0-9]\)\.PDF|Izjava\su\sprilogu\.zip|Potvrda\snarudzbe\.\sRS[0-9]{10}\.DOC\.zip|Payment_Notification_xls\.html|Doc_[0-9]{10}_AUGUST2022\.img|RFGBN[0-9]{1,3}\.zip|UN\.\.JPG|ScanDocT\#[0-9]{5}\.CAB|POP3\sNew\.html|factura\.html|Shipping\sDocuments\.gz|Join__us__today__and__TRIPLE__your__deposits_IuLCW6T8MckrbMA\.pdf|CONV\-LT\-lt\.pdf|AWB002\.html|Great\.gaming\.opportunities_[0-9A-z]{3,20}\.pdf|DHL\-AWB\#[0-9]{9}\.htm|dcv19md\.htm|INVOICE\sORDER\sID\s\-\s\([0-9]{4}\-GWHS\-3[0-9]{4}\)\.jpg|CONTRACT\-[A-Z]{3,20}\s_\s31ST_AUGUST_2022\s_\.png|CLARIFICATION\sLETTER\.pdf|NEW\sAIR\sCOURIER\.html|United\.doc|ANNEXE\.\.\.\.jpg|Receipt\-Payment\-Now\.pdf|doc[0-9]{21}\-[0-9]{11}\.exe\.bz2|ESKOM\sHOLDINGS\sLIMITED\.pdf|QATAR\sFIFA\sWORLD\sCUP\s2022\sMICROSOFT\sONLINE\sWINNING\sNOTIFICATION(\-[0-9])?\.pdf|PO\.IMG|Your\sOrder\sConfirmation\sof\sGeek\sSquad\.jpg|payment\.shtml|Microsoft\sAward\.doc|Shipping\sDocuments\s[0-9]{13}_XLS\.html|E\-Contact_Form\.pdf\.NLSPrintForm\.html|Invoice\s\sGenerated\sBILL\s\s\#[0-9]{5}[A-Z]{10}\.jpg|purchase\sorder\sNo\.\s[0-9]{10}\.xlsx|Exso\-PO\-[0-9]{5}\.xlsx|WELCOME\sTO\sMONEY\sHELP\sSOUTH\sAFRICA\sPROMOTIONS\sLOAN\sSCHEME\.pdf|MONEY\sHELP\sSA\sAPPLICATION\sFORM\.pdf|32310\-INV\.xlsx)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION12 Content-Disposition =~ /filename\*?\=[\s"]?(vm\s(Sun|Mon|Tues|Wednes|Thurs|Fri|Sat|Sun)day\s[A-z]{3}\s[0-9]{1,2}\,\s[0-9]{4}\s[0-9]{4}\s(AM|PM)\.html|Sales\sbill\s\#[0-9]{65,70}\.jpg|RCS\sLOAN\sAPPLICATION\sFORM\.pdf|Djiepy\.z|0234122562756152526\.zip|RELIEF\sFUND\sPROGRAMME\.pdf|pdfFiles\/INV_[0-9]{18}\.pdf|ENBD_Advice\.PDF\.shtml|Account\sUpgrade\.html|TRNSF_RECEIPT\s[0-9]{1,2}\.[0-9]{1,2}\.[0-9]{2}\.html|PLUS\sMEMBERSHIP\#[0-9]{7}\-[A-Z][0-9]{2}[A-Z]{3}\.jpg|Inv_[0-9]{5}_[a-z]{2,20}\.zip|PO\.HTML|CONTRACT\-INVOICE\.shtml|Excel\sOnline\s\-\sNL\sRevised\sOrder\.htm|Mary\s\_\.pdf|Electronic_Document\.tar|F00015722EXpo\.xls|F6RY39455577\.pdf|[0-9]{12}\.rar|DHL\sReceipt_[0-9]{10}\.rar|Order\sconfirmation\sPO\s[0-9]{8}\.doc|OUL70\.pdf|B1LL[0-9]{8}\.pdf|RFQ\#[0-9]{5}\-AQUA\sCHEMICALS\.IMG|Order\sInfo\s\#[0-9]{55,56}\.jpg|AP\sREMITTANCE\sTRANSCRIPTION\.htm|SAGAR\sBrochure\.pdf|MT103_Payment_Receipt_pdf\.htm|ABC\sLOTTO\.docx|Fixed\sRate_[0-9]{10}\.pdf|Invoice\-SP[0-9]{4}\.shtml|Paystub_[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}\.html|[0-9]{9}[A-Z]{7}[0-9]{6}\.html|APPROVED\sREFUND\sDETAILS\s\#\s[0-9]{9}\.jpg|Payment\sreceipt\.\.jpg|Transaction\sProcessed\s\#9348\.jpg|GLPU70\.pdf|ACCOUNT\sSECURITY\sMESSAGE\.pdf|INTERNATIONAL\sDEPARTMENT\sOF\sMOLOTTERY\.docx|Invoice_12737128\.pdf|SC\-new\-order\.Xsl\.htm)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION13 Content-Disposition =~ /filename\*?\=[\s"]?(AAB\.\sClaim\.docx|AmazonCaseID[0-9][A-Z0-9]{10,13}\#\.pdf|Update[\s\-]Information[\s\-_]Account\sAmazon[\s\-_]Premium[\s\-_]Membership\!\.pdf|PO\s[0-9]{4,6}\,[0-9]{4,6}\.html|COCA\s+COLA\s+ONLINE\s+PROMOTION\s+AWARD\.docx|Payment_receipt\.html?|Payroll\sServices\.html?|GAGNANT\sD_compressed\.pdf|Uk\sLottery\.pdf|PO\s92202474\.doc|NedBank\sElectronic\sDocument\.html|SO\-sales\sorder\sTematsi\.xlsx|PO\-OrderConfirmation[0-9]{4}\.xlsx|[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}\.shtml|receipt[0-9]{7}\.html|PendingVoice\-message\.html|ACCOUNT\sSECURITY\sMESSAGE\.pdf|PP0026525\.pdf|voice[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}\s[0-9:]{7,8}\s[apm.]{4}\.wav\.html|EFT_CLAIM_8981_APPROVED\.pdf|\#Inv[0-9]{8}_Payment_Advice\.htm|Export\sDocuments\sand\stracking\.html|Your\-WellsFargo\-Notice\.pdf|\-ENG1\.jpg|a36d6587_40to925\.jpg|Update\.html|Doc[0-9]{6}_\-[0-9]{14}\.[0-9A-Z]{16}\@linkedin\.com\-\.html|FedEx\sPaperworks_\<[0-9]{14}\.[0-9A-Z]{16}\@fedex\.com\>\.HTM|FCB\sLetter\.\.doc|M\.\.Untitled\.\.M\.tif|[A-z]{2,20}\sSf_Invoice\.Html|docInvite\-white\.png|icon\-DownloadApp\-18x18\@2x\.png|26b7bf3601ea8f1ee66b0ee1bcd333c4\.png|picture_ywq0RR0sPK1Efg\.pdf|INVOICE\s\#[0-9]{3}\.HTML|Yugra\sLLC\.pdf|AWB\-SHIPMENT\.html?|Sales_Straightforward\s\(1\)\.mp3|SWIFT\s2000\sEURO\.html)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION14 Content-Disposition =~ /filename\*?\=[\s"]?([0-9]{8}_Exclusivo_PE15\s2022\s08_ESP\.zip|WESTERN\sUNION\sPROMOTION\!\!\!\.pdf|INVOICE\s1103\.Html|EFT\-SECURE\-TRANSFER\.\.\.pdf|JOINT\sVENTURE\sPARTNERSHIP\.pdf|INV244456890\.htm|AETNA\sPAYMENT\sCLAIM\.pdf|DONATION\.\.pdf|Payment_Remittance_2022[0-9]{4,5}\.htm|red\scross\s\(charity\sdonation\)\s1\.pdf|george\sachi\schi\.pdf|TT\sswift\scopy\.[Hh]tml|Purchase\sOrder\.Html|C\!\.docm?|PaymentRequest_Invoice[0-9]{6}\.docx|Purchase\sOrder\sMRQ\-[0-9]{4}\.img|AWARD\sSECTION\sMSA\.pdf|PO\-\#[0-9]{5}\.html|Signed\sContract\.Html|Nov\sSOA\.xlsx?|IMG_20211206\.png|PO5457\.html|Invoice_27611\sUSD\stbi\.net\sPdfXls\.html|Anna\sCooper\.pdf|Order\-2021\-PO\s\#\s[0-9]{4}\.xlsx|Swift\sCopy\.doc|Project\.docx|New\sProject\.xlsx|\#Drive_file_[0-9]{7,9}\#\.pdf|Data\sSheet\sreview\s\.ppt|Amendment\.\-[0-9]{9,11}_[0-9]{7,9}\.xlsb|IMAGE[0-9]{8}\.zip|VOICE\.docx|INV(\s|_)[0-9]{9,10}\.xlsm|Techincial\sDrawing\s\&\sPicture\sSpecification\.PDF\.img|cargo\swaybill\.gz|Microsoft[-\s_]Award[.,]{2,}doc|PO\sKOENG\sCO\.\,\sLTD\.\sNO_[0-9]{4,5}\.htm|Hsbc\sdocc\.html|.*_1009922_PAYMENT_COPY|Your\sPackage\.xlsx|DOC\#[0-9]{3,}\-[0-9]{4,}\-[0-9]{4,}\.pdf|inv222343322\.xlsx|05032021\seman\-\stbi\-srZW1hbg\=+dZW1hbg\=+GZ\.htm|Scan[0-9]{5,7}\.7z|Pk_\$[0-9]{5,7}\.xlsx|PAID\-[0-9]{5}\.html)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION15 Content-Disposition =~ /filename\*?\=[\s"]?(Swift\sCopy\.xlsx|WORLD\sCUP\s2022\.pdf|S\.AFIFA\sQATAR\-CANADA\sPROMO\sNOTIFICATION\.doc|ETD\:12\/26\sSHA\sTO\sLYT\.html|indeed_account_validation\.html|Letter\.docx|[A-Z0-9]SWFT.xlsx|Coperion\sGmbH\s.*\sOrder\sConfirmations\.xlsx|CMS\sUSD\sSlip\sPayment_pdf\.zip|remittance\-cable\-from\-the\-bank\.docx|The\sfinal\sdecison\.pdf|Health\,\sdiet\sand\smind\.docx|Norton\sService\sInvoice\sPDF\.pdf|Signed\sCopy\sof\sOrder\sQY1909\-4\-063\.htm|PO\-[0-9]{4,6}\.html|info\s2560\.xls|New\sShipment\snvoice\sNo\.\.zip|quote_XMNA[0-9]{1,8}\.docx|OUTSTANDING\sINVOICE_JUNE2020\.zip|RFQ\s\#\sI180535\.PDF\.HTML|PO\#\s[0-9]{4,5}\.html|Receipt_HKNEVB90IOC\.pdf|WINNING\s+2020\.(docx|pdf)|INSTRUCTION\sTO\sCREDIT\sYOUR\sACCOUNT\sWITH\sTHE\sSUM\sOF\s\(16\sMILLION\sUS\sDOLLARS\)\s\(1\)\.pdf|W\-8BEN\sRevised\.pdf|Invoice\sfor\spayment\scopy\.xlsx|PURCHASE\sORDER\.html|Remittance\sCopy\sof\sUS\$\s55\,000\.00\.img|PARLIAMENT\sORDER\.pdf|FILE\s\([0-9]\)\s\([0-9]\)\.pdf|Inquiry\.pdf\.z|RELIEF\sPAYMENT\sFROM\sW\.H\.O\.docx|ST_[0-9]{4,6}\.xls|Update[\s\-_]Informations\.pdf|inv\s\#[0-9]{4,6}\.html|You\sHave\sA\sNew\sMessage\.ics|Urgent\sAccount\sUpdate\.pdf|Proof\sof\spayment\.html|Pending\sDelivery\s+.*\@.*\.html|A\sWINNER\.+pdf|remittance_confirmation\.html|SECURITY\sUPDATE\sDOC\.pdf)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION16 Content-Disposition =~ /filename\*?\=[\s"]?((Invoice\sbill|RENEWAL\sUPDATE)\s\#\s[0-9]{11,12}\.jpg|Our\sProject\sRequirement\sof\sAU\-600\s\(300\,000PCS\)\sdrawings\.7z|AudioThesisAttackGFalconecausedCIAPentagon\.amr|1997filmescapeinspires\s9\-11TwinTowers\s\-\.jpg|IRS\sSecured\sDocument\(TAX\)\.htm|VOICEMESSAGE\.htm|\#8754210754210485210\.jpg|[0-9]{1,2}\.[0-9]\ssecs\sAUDIO\-Attchment\.html|PAYMENT\sSLIP\.zip|Somoil\sCRUDE\sOIL\.pdf|ORDER\sBILL\sATTACHMENT\s\#\#\#\s[A-Z]{2}[0-9]{8}\-[A-Z]{3}[0-9]{12}\.jpg|Scan_Wire\sInstruction\.PDF\.shtml|Quote\#\#\-PDF\.gz|sales\scontract\-[0-9]{3}\s\&\sNew\-Order\.tar|PO\sRFQ\s\#[0-9]{4}\.shtml|shipping\sdocuments\.zip|purchase\sorder\s\.shml|BL\/PL\/INV\.shtml|eSecure_Paperwork_Shipments\.htm|RetirementFundsNotice\(Principal\)\.pdf|Subscription\sPlan\.pdf|Made\-in\-China\.png|Fax[0-9]{5}\-echo\-SwiftMT103\.htm|RCS_Loan_Application_Form\s\.pdf|RFQ\-LSU55612\sFMCO\sProject\.doc|NEW\sPO\sMARCH\.PNG|Anthem\sACH\sPayment\sCompleted_Awaiting\sApproval\.pdf|Purchase\sOrder\sPB2ED146HB2M\-047\.html|Monthly\sPlans\sDocuments\.jpg|INFO\-SERVICE\sID\s[A-Z0-9]{28}\.\.jpg|New\sSubscription\sInvoice\.[0-9]\.jpg|Orden\sde\scompra\.xlsx|Immo\sLoyer\s\([0-9]\)\.docx|SocialSecurityAdministrationDocument\([0-9\-]{10}\)\.htm|Repudiandae\.html|Dicta\.html|Voluptates\.html)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION17 Content-Disposition =~ /filename\*?\=[\s"]?(Order\s\(March\)\s[0-9]{7}\.xls|Scan_remittance[0-9]{17}\-[0-9]{7}\s\s?png\s\s?\s?\.htm|Et\.html|Placeat\.html|Assumenda\.html|Eum\.html|Est\.html|Document\sfor\sclearance\.xls|Ceridust\s3715\sPO\sno\,\s[0-9]{6}\.xls|Felicitaciones\sEstimado\sganador\sdel\spremio\sMo\.docx|SOA\s\(1\)\.7z|Inv_[0-9]{8}_from_[a-z]{6,12}_[0-9]{4}_[0-9]{4}\.pdf|Inv_[A-Z]{3}[0-9]{5}_from_[a-z]{6,12}_[0-9]{3}_[0-9]{4}\.pdf|Inv_[A-Z]{2}[0-9]{6}_from_NrtnLfelock_[0-9]{4}_[0-9]{4}\.pdf|USD\s[0-9]{2}\,[0-9]{3}\.\.htm|REQUEST\s[A-Z]{2}[0-9][A-Z][0-9]{2}\-[0-9]{3}\.pdf|Bill[0-9]{11}\.pdf|Payment\sInformation\s\#[0-9]{11}\-[A-Z]{7}\-[A-Z]{6}\-[A-Z]{9}\-[A-Z]{6}\.jpg|Refund\sstatus\s\#[0-9]{57}\.jpg|EFTInvoice\#[0-9]{4}\-Cigna[A-z]{2}\.pdf|DHL_BQB\-[0-9]{6}\.html|PAlD\-DOC\s[a-z]{2,20}\sOutgoing\.Ref\-[0-9]{6}\.html|Debit_Order_Notice\.html|Statement_ID\-[0-9]{9}\.PDF\.htm|ATTACHED\.pdf|Department\sof\sMineral\sResources\sand\sEnergy\.pdf|CBFI\sCV[0-9]{4}\sContract_Copy_2Original\-[0-9]{8}\.doc|PO\sno\.\s[0-9]{10}\.doc|USA\sCEO\,\sOWNER\sFOUNDER\s1000\s\([0-9]\)\.xlsx|Afri\sLoan\.pdf|EINLADUNG\.pdf|\#Doc\.Signed\.html|download\smessage\sreports\.htm|QUOT\._[0-9]{1,2}_[0-9]{1,2}_[0-9]{4}\.zip|Quot\.\s[0-9]{1,2}\s[0-9]{1,2}\s\s?[0-9]{4}\.HTML|[0-9]{13}\.zip)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION18 Content-Disposition =~ /filename\*?\=[\s"]?(mini\scompetition\sJitegemee\sholding\.doc\.html|Invoice\#[0-9]{3}\.shtml|Part\sPayment\sQuotation\.doc|SWIFT[0-9]{8}\.html|[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}\.html|PAYMENT\sSWIFT_HSBC\.html|RENEWAL\sPLAMN\s\@\@\.jpg|DHI_INVOICE_[0-9]{8}_[0-9]{8}PDF\.lzh|Signed\sAgreement\.html|Payment\sReceipt\.html|U\sprilogu\sje\spredracun\.zip|ACH\scopy\s\.doc|Purchase_order\s[0-9]{6}\.pdf\.7z|PO\#[A-Z]{2}\-UK\-[0-9]{4}\.shtml|Scan\sFile\.htm|[A-Z]{2,20}\-STM00037\.html|LUXURY\.pdf|INVOICE\s[0-9]{8}\s\-1y\s\,\s\#PREV\sINVOICE\s[0-9]{5}\.img|jerry\sPay\sstatements\.htm|0rder\sSpecifications\.html|AGR\-ROTULOS_2023\-79627\.doc|Tender\sFor\sWork_xls\.shtml|SOA[0-9]{9}\.xls|INV\-[0-9]{5}PYL\.pdf|Purchase\sOrder\sList\sRequirements\s[0-9]{14}\sPDF\.zip|INV[0-9]XX[0-9]\-BV847XX[0-9]\.pdf|Pepsico\sLLC\sRFQ\sInformation\.img|FileDoc\s\.shtml|Quote\-Details\.htm|HSBC\sPayment\sInformation\.img|payment\sfilies\.htm|Order\sconfirmation\sAeon\svietnam\s[0-9]{8}\sPO\s[0-9]{3}\.[0-9]{3}|EFT\sPDF\.html|[0-9]{13,14}[A-Z]{4}\.pdf|INVOICE\sORDER\sBILL\s\#[0-9]{10}\.jpg|PO_22948\.pdf|Swift\sCopy[0-9]{7}\.htm|PI\+INV\+BL\+Pdf\.html|2023\sTax\sRefund\sReceipt\s[0-9]{7}\.html|SWIFT\sCOPY\.zip|REFWON[0-9]{2,4}UK[0-9]\.pdf|Hydro\-Quebec\.txt|[0-9]{4}TaxRP_2xPdf\.pdf)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION19 Content-Disposition =~ /filename\*?\=[\s"]?(Tax\sRefund\sReceipt\s\[SENSITIVE\=CONFIDENTIAL\]\.html?|PO\#[0-9]{7}\.shtml|ATO\s\-\sSuperannuation\sPayment\sdetails\s\-\sAugust\s2023\.html|doc[0-9]{12,14}\.html|NEW\sIMPORT\sDUTY\-TARIFFS\s2023\#\.html|New\sOrder\sNo\.\s[0-9]{8}\.exe\.7z|Request\sfor\sQuotation\s\-\sPfizer\.pdf|COMPENSATION\sFUND\sPAYMENT\sAPPROVED\sNOTIFICATION\s2023\.docx|SO\-[a-z]\-[0-9]\.lzh|Vorladung\.pdf|HP\-Quote\(Request\)\.html|1_para_[0-9]{13,15}\.pdf|Gmbh\sPayment\sConfirmation\.html|GmbH\sInovice\sno\.\(Ref\sINV\-[0-9]{4}\-[0-9]{7}\)\.html|inv\#[0-9]{3}\.pdf\.z|PAYMENT\sMT103\-[0-9]{6}[A-Z]{4}\.xla|n\-[0-9]{8}\-[0-9]{11}\.html|New\sBank\sDetails\.pdf\s+\.htm|\(Congrattullattionss[0-9]{1,3}\)\.pdf|Wire\sTransfer\s\-\sPayment\s[0-9]{1,2}\.[0-9]{1,2}\.[0-9]{4}\.pdf|nota\-[0-9]{8}\-[0-9]{11}\.html|Church\s\-\sRenovation\sProject\sEstimate\s[0-9]{4}\-[0-9]\srequire\syour\sreview\.htm|Inv_[A-Z0-9]{8}_from_GeekSquadInc_[0-9]{3}_[0-9]{4}\.pdf|Sehr\sGeehrter\sBegunstigter\.pdf|attachment\-1\.\*|40a77a49\-6a7a\-41cb\-9fc0\-71c190b98079\.pdf|nota\-gerada\-[0-9]{7}\-[0-9]{11}\.html|351\-4562\-6724546\.pdf|statement_BillingTeam\.pdf|Proposal\sfor\sour\snew\sproject\srequires\syour\sreview\.htm|nfs\-[0-9]{8}\-[0-9]{11}\.html|BANCO\sSWIFT\spdf\.zip|CPSC\-B\-PC\-010\-2024\.pdf)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION20 Content-Disposition =~ /filename\*?\=[\s"]?(Email\sUnblocked\.html|Waybill\.img|PO[0-9]{2}\-[0-9]{2}\-[0-9]{4}\-[0-9]\.xls|invoice_539018872\.pdf|Docs\.html|ADsHfddbwATTACHEDAPPROVED\xC3\x82PAYMENTfg\.pdf|AFEGCEdghdiATTACHEDAPPROVED\xC3\x82PAYMENTkjul1D3E\.tif|[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}Payment\.html|P\.O\s\#[0-9]{4,6}\.img|NOIOBAN[0-9]{10,12}\.shtml|Paid\sUser\-[0-9]{6}\.pdf|.*[0-9]{4}\s\-\sSoA\.shtml|.*\-_Quotation\.shtml|Paid\sPayment\.html|Quote\.html|PO\#[0-9]{2}[A-Z][0-9]{4}\.html?|NEW\sSHIPMENT\.IMG|1650928783888\.pdf|PO\s[0-9]{6}_[0-9]{6}_Revised\.PDF\.HTML|Invoice_BXJ_[0-9]{13}\.pdf|Bill_PSK_[0-9]{15,17}\.pdf|Paid\sUser\-[0-9]{6}\.pdf|Bill_[A-z]{3}_[0-9]{13,14}\.pdf|Requirements\.html?|E\&W_Construction_Bid_details\.pdf|E\-bill_[A-Z]{3}_[0-9]{13,14}\.pdf|Geek_Statement_[A-Z]{3}_[0-9]{5}\.pdf|Pago\-Comp\-[0-9]{10}\.pdf|100kb\svideo\([0-9]\)\.mp4|PO\sconfirmation[0-9]{7}\.PDF\.Z|Wire[0-9]{10}\.html|\#498396511\.pdf|\#[0-9]{8}_Edlen\.xls|Swft\.html|PAYMENT\sCOPY\.zip|Dokumen\.zip|KR_OrderContract_[A-Z]{8}\.pdf|SharedFile\.html|invoice\sNo\s[0-9]{6}\.PNG|Remmittance\-Swift\-Invoice\-PDF\.htm|PO72100020\.doc|OFFICIAL\sREQUEST\sFOR\sQUOTATION\.pdf|.{2,30}\#PO\#[0-9]{8}\.XLS\.htm|ref_[0-9]{12,15}\.tar|LLC\sAZRO\sOIL\sSOFT\sCOPORATE\sOFFER\.\.pdf|kjhgfd\.html)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION21 Content-Disposition =~ /filename\*?\=[\s"]?([0-9]\.\spresentation\sWinterdienst\sAlpha\s\([0-9]\)\.pdf|RFQ\-3279793278\s\-Supply\s\&\sInstallation\sWorks\-For\sAl\sDelta\sProjec\-docs\.7z|DHL\-CARGO\-[0-9]{4}_DOCUMENT\.zip|61119083\.png|UTF\-8\'\'cotizaci\xC3\xB2n\.xlam|PO\#[0-9]{9}\-PDF\.html|ref_[0-9]{14}\.tar|Prepayment\-receipt\.html|UTF\-8\'\'SOLICITO\%20COTIZACI\%C3\%93N\%20URGENTE\%20\.\.pdf\.zip|84303839140\.zip|1Z82039483273829\.html|confirmation\sof\scontinuation\=_[0-9]{10}_[0-9]{10}\.pdf|Scanned\.html|transactionrsoribcmby_\=billing\sharmony\.pdf|Order\sRequirements\.xls\.htm|HBL\#\s[A-Z0-9]{7}\sDOCUMENTS\.7z|8ID0109FLT24PO92CD\-R\.pdf|[a-z]{2,20}jerry\-swift\-inv002133\.html|\(FASTLINK\sQUARRY\sPUMPS\)\.pdf|RFQ\sNO\.\sTEF[0-9]{4}\.pdf|NEDBANK\sFunds\smoved\sto\sOPTIMUMPLUS\.html|INVOICE\s\s[A-Z]{4}\-01031D84\.pdf|vmail_4352\.html|UPS_RECEIPT\-[0-9]{1,2}\-[0-9]{1,2}\-[0-9]{4}\.html|Employee\-SSN\.html|Administrative\sfile\.html|FUND\sDONATION\sPROPOSAL\sLETTER\.pdf|Order_Spec[0-9{2}\-[0-9{2}\-20[0-9{2}\.dot|Executed\s\+\-\s2025\sLease\sAgreement\.pdf\.htm|REQUIRED\-ORDER\-PROFILE\-DETAILS\.GZ|Cert\sof\sIns\s\&\sW\-9\s\-[A-z]{2,20}\.htm|Request_Order_N0_[A-Z0-9]{4}_[0-9]{10}\.GZ|PO\.html|PO_[A-Z]{2}[0-9]{8}\.html|TRANSACTION\sDATA\.TBZ|Mr\sFOLASHODUN\.txt|BF73NF9EORG85BRG829IWY\-P\.pdf)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION22 Content-Disposition =~ /filename\*?\=[\s"]?(Order\sDocument\s\s\s\.html|Contract_ESTIMATE\.htm|RFQ_PO\-GEL_[0-9]{4}_xlsx\.zip|Piskareva\(472\)\-DV7600\-Items\-HN093GR\-Spec\-Order\-pdf\.zip|PO\#SGODOB4204538\.zip|URGENT\sINVESTMENT\sARRANGEMENT\.doc|[0-9]{9}AE\.7z|sick\swoman\sletter\.pdf|JX6KQUKY8R07ICEN5XG13HPY3G3HX\.bmp|Signed\scontract\.htm|new\sorder\.jpg|NARESCO\sCONTRACTING\s-\sSN[0-9]{10,12}\.docx|Jul\.2025\.(EQX|ZHL)\.heif|07232025\-67426576237901\.pdf|UN\sPAYMENT\sRELIEF\sFUND\.pdf|MT103_(\xE2\x82\xAC|Euro_)[0-9]{3}\,[0-9]{3}\.[0-9]{2}\s_\s[A-Z][a-z]{2,8}\s\-\s[A-Z][a-z]{2,8}\s2025\.zip|NEW\sORDER\sFOR\sAUGUST\s\.docx|JOU22013125\.zip|25_08\-16OX2\-210030494\.pdf|Payment\sConfirmation\sPrint\sOut\sCopy\sMT103\.zip|Materials_Requirements_and_Specifications\.pdf\.zip|[A-Z][a-z]{2,25}_[0-9]{7}\.HTM|DHL\-_Order_Confirmation_pdf\.html|Project\sDrawings\.htm|Comprobante\.de\.Transferencia\.[0-9]{2}\.[0-9]{2}\.[0-9]{4}\.gz|Bestellung\-AN2025\-2909_Mikropor_DOCX\.gz|Sep\-29\-2025\seNotification\sBoFA_eMsg\s\(1\)\.pdf|eDocusign_Review\.pdf|Purchase\sorder\sItems\-\sExcel\sOnline\sQuotation\srequest\s\.html|Proforma\sInvoice\-pdf\.html|e\-Notice_ID\-[A-Z][0-9]{4}[A-Z0-9]{5}\.pdf|Justificante_transferencia_2025\-11\-05\-14\.24\.38\.684000\.tar|New\sorder\#2_W43550970351\.zip)([";']|$)/ mimeheader T_JR_BAD_DISPOSITION23 Content-Disposition =~ /filename\*?\=[\s"]?(Z19ORSFYLFX967BNCQ0FN\.pdf|SAFSIM\.Payroll\.html|Hello\:\sPayment\sconfirmation\sfor\sTransaction\sreceived_[0-9]{10}\.pdf|AmAzON\.Co\.jP\.grursk)([";']|$)/ ## Content-Type ## mimeheader T_JR_BAD_CTYPE1 Content-Type =~ /[nN]ame\=\"?(FNB\sPOP\sLETTER1\.png|NEW\sCOCA\sCOLA\sAWARD\.jpg|GIABA\s+COMPENSATION\sPAYMENT\.jpg|ArabENG\.png|Ms\.\sSusan\.png|BCKBCAVNATIONALLOTTOUKEmailDraw\sF2020\sFJJ\-SA\.png|FNB\sPOP\sLETTER1\.png|Outlook\-i2junytc\.png|Electronic\sform\.rtf|jj\s11\.jpg|ducument\.jpg|READ\sTHE\sLETTER\.jpg|[a-z0-9]{100,}|HSBC_Payment_slip_for\sOutstanding\sInv\s[0-9]{5,7}\.shtm|Swift\sDocument\.html|PO[0-9]{8}\sPACKING\sLIST\s\&\sINVOICEs\.xlsx?|Inq\s080221\.xlsx?|DOC[0-9]{3}\-[0-9]{4}\-[0-9]{3}\.pdf|New\sOrderfor\s30\%25\sDeposit\sPayment\.html?|\xE2\x99\xAC\sVM_590218\.html?|OHCHR\!\s100\%\.(pdf|jpg)|Onedrive\.html|EMS\sElectronic\sInvoice\.HMTL|Docs\.Reciept\.[0-9]{7}\.html|Docx\.Html|Polyone\sPolymers_044\,pdf\-\-\.html|Payment\scopy\.html|account\sshutdown\sletter\.html|Swift_103_[0-9]{7,9}\s?fdp\.html|New\spurchase\.html|Remittance210802\.html|CI\-7499883985\.hTM|PO\#[0-9]{7,9}\-CA\.HTM|DHL_Tracking_Document\.PDF\.shtml|Remittance\scopy[0-9]{5}[a-z]{3,20}\.html|Payment\.Reciept\.[0-9]{7,8}\.html|Docx_ersfccv093\.Xsl\.html|Urgent\sRQF\s\&\sPO\.html|EUR\s[0-9]{3}\,[0-9]{3}\.htm|NEW\sAIR\sCOURIER\.html|PAYMENT_RECEIPT\.html|PURCHASE_ORDER\.HTM|wireconfirmation\.png|[A-z]{2,33}\.[A-z]{2,33}\sclosure\sletter\.htm|pJpn2wvlvFe7aY\.soq|PO_[0-9]{7,9}USD\s[A-z]{2,40}\.[A-z]{2,8}\sPdfXls\.html)(\"|\;)?/ mimeheader T_JR_BAD_CTYPE2 Content-Type =~ /[nN]ame\=\"?(2NU6pvPcjI\.yradc|inv\-po\.html|\(GOOD\sDAY\sINFORMATION\)\.jpg|mbamfejficffklol\.png|e98bbea0089ee6f5d50d9ef7bdf00d45\.png|fy22expresseng2crevrgb\.png|DDFR\-[0-9]{9}\.png|DepositRemittance\.html|N0RT0N\sINVOICE\s[0-9]\.jpg|remittance_copy_[0-9]{5}\.htm|Updated\sinvoice\.\.jpg|share\spoint\s01\.jpeg|share\spoint\sblank\sdown\.jpeg|BHiqE8O9F9Ma5tYn\.jpg|NedBank\sElectronic\sStatement\.html\.htm|Invoice\s\#35\.png|plern\.JPG|Voicemail\sAudio\sTranscription\.html|\[MR\.\sVICTOR\sBALOYI\]0000\.jpg|Remittance\sconfirmation\.html|XDSR154\.png|E426QQN6K\.pdf|Payment\sAdvice\scopy\.html|thumbnail_thumbnail_msg[0-9]{10}\-[0-9]{4}\.jpg|eReceipt\-[A-z0-9]{18}\-[A-z]{4}\-[A-z0-9]{15}_[A-z0-9]{20}\s+\.html|eReceipt\-[A-z0-9]{47}_[A-z0-9]{12}\s+\.html|eReceipt\-[A-z0-9]{34}\-A-z0-9]{25}\s+\.html|eReceipt\-[A-z0-9]{2}_[A-z0-9]{13}\-[A-z0-9]{24}\-[A-z0-9]{18}\s+\.html|ach\-remittanceconfirmation[0-9]{8}\.html|_0001\-00000001\.pdf|Bills35663\.html|CSTMR_ID\-59894XAA\.png|PMT[0-9]{8}\.html|Zelle_Attached_[A-z]{3,9}_202[0-9]\.htm|KTP1109\.html|Outlook\-hb4tcxkw\.jpg|image005\(12\-18\-10\-41\-51\)\.jpg|DOCUREH\.PNG|linkin\simage\.png|Payment_Adv\.htm|Outlook\-yuz2yveb\.jpg|PO\-[0-9]{7}\.shtml|Remittance_Summary_INV[0-9]{4}BACS_\.htm|Outlook\-pnkqs110\.png|Outlook\-hjtoajo4\.jpg)(\"|\;)?/ mimeheader T_JR_BAD_CTYPE3 Content-Type =~ /[nN]ame\=\"?(Outlook\-axe3s2ps\.jpg|Outlook\-lpxfr4vg\.jpg|Outlook\-lrq1qaxz\.jpg|2WUHAF6ONAUAKBJ1PY73KZ\.jpg|T5U\-XV7\-2QKO\.png|invoce\s[0-9]{7}\.htm|CONGRATULATION\sYOU\sHAVE\sWON\.txt|Payment\sAdvice\.html|PO\sSUMMARY\.html|ATT\-INV\#[0-9]{4}\.html|IHUB8762236GHFT\.gif|VM0002111020025\.html|[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}_queryreport_TxnID\.html|hyfsdsd9sd97797s7desdsdsd\.png)(\"|\;)?/ ## UTF8 Content-Disposition ## mimeheader T_JR_BAD_DISPOSITION_UTF1 Content-Disposition =~ /filename\=\"?(\xe4\xbc\xa0\xe6\x92\xad\xe7\x9a\x84\xe6\xb8\xa0\xe9\x81\x93\xef\xbc\x9b\x2e\x20\xe4\xbc\xa0\xe6\x92\xad\xe7\x9a\x84\xe5\x86\x85\xe5\xae\xb9\xe8\xae\xbe\xe8\xae\xa1\x2e\x78\x6c\x73\x78|\xD8\xA7\xD9\x84\xD9\x85\xD9\x82\xD8\xB1\s\xD8\xA7\xD9\x84\xD8\xB1\xD8\xA6\xD9\x8A\xD8\xB3\xD9\x8A\.docx?|\xD0\xA1\xD0\xBA\xD0\xB0\xD0\xBD\s27\s\xD0\xB8\xD1\x8E\xD0\xBD\xD1\x8F\s2022\s\xD0\xB3\.\,\s14.22\s?[0-9]?\.pdf|\xD9\x88\xD8\xB2\xD8\xA7\xD8\xB1\xD8\xA9\s\xD8\xA7\xD9\x84\xD8\xAE\xD8\xA7\xD8\xB1\xD8\xAC\xD9\x8A\xD8\xA9\s\xD8\xA7\xD9\x84\xD8\xA3\xD9\x85\xD8\xB1\xD9\x8A\xD9\x83\xD9\x8A\xD8\xA9\.\.docx)([";']?|$)/ mimeheader T_JR_BAD_DISPOSITION_UTF2 Content-Disposition =~ /(%C2%AEPayroll_stubs\.Htm|%CE%A3%CE%A5%CE%93%CE%9A%CE%9B%CE%97%CE%A3%CE%97\.pdf|Swift\%20Copy\%C2\%B7IMG\.z)([";']?|$)/ meta JR_BAD_ATTACHMENT (T_JR_BAD_DISPOSITION1 || T_JR_BAD_DISPOSITION2 || T_JR_BAD_DISPOSITION3 || T_JR_BAD_DISPOSITION4 || T_JR_BAD_DISPOSITION5 || T_JR_BAD_DISPOSITION6 || T_JR_BAD_DISPOSITION7 || T_JR_BAD_DISPOSITION8 || T_JR_BAD_DISPOSITION9 || T_JR_BAD_DISPOSITION10 || T_JR_BAD_DISPOSITION11 || T_JR_BAD_DISPOSITION12 || T_JR_BAD_DISPOSITION13 || T_JR_BAD_DISPOSITION14 || T_JR_BAD_DISPOSITION15 || T_JR_BAD_DISPOSITION16 || T_JR_BAD_DISPOSITION17 || T_JR_BAD_DISPOSITION18 || T_JR_BAD_DISPOSITION19 || T_JR_BAD_DISPOSITION20 || T_JR_BAD_DISPOSITION21 || T_JR_BAD_DISPOSITION22 || T_JR_BAD_DISPOSITION23 || T_JR_BAD_CTYPE1 || T_JR_BAD_CTYPE2 || T_JR_BAD_CTYPE3 || T_JR_BAD_DISPOSITION_UTF1 || T_JR_BAD_DISPOSITION_UTF2) describe JR_BAD_ATTACHMENT Filename observed in SCAMs/EXPLOITs score JR_BAD_ATTACHMENT 5 endif ## Detect Excessive MAILTO links ## ## Extracting From: TBI_MX_MISC.cf ## # uri __JR_MULTI_MAILTO /^mailto:/i # tflags __JR_MULTI_MAILTO multiple maxhits=16 # meta JR_MULTI_MAILTO_MANY __JR_MULTI_MAILTO > 15 # describe JR_MULTI_MAILTO_MANY Message body has many mailto links # score JR_MULTI_MAILTO_MANY 4.0 uri __JR_MULTI_MAILTO /^mailto:/i tflags __JR_MULTI_MAILTO multiple maxhits=20 meta __CS_MAILTO __JR_MULTI_MAILTO >= 15 ################### HEADER ODDITIES ################### ## CREATING HEADER RULES: JR_EXPLOIT.cf JR_META.cf JR_PHISH.cf ## ## Setting some non-visible rules for attachment categories: ## ## __JR_HAS_REPLYTO __JR_ATTACHED_VIDEO __JR_ATTACHED_AUDIO ## __JR_ATTACHED_IMAGE __JR_ATTACHED_HTML __JR_ATTACHED_PROGRAM ## __JR_ATTACHED_DISKIMAGE __JR_ATTACHED_ARCHIVE __JR_ATTACHED_PRINT_FILE ## __JR_ATTACHED_OFFICE_DOC ## Setting __JR_FREEMAIL_BODY for Freemail addresses anywhere ## ifplugin Mail::SpamAssassin::Plugin::FreeMail header __JR_FREEMAIL_BODY eval:check_freemail_body() header __JR_FREEMAIL_FROM eval:check_freemail_from() header __JR_FREEMAIL_REPLYTO eval:check_freemail_replyto() meta T_JR_FREEMAIL_ANYWHERE (__JR_FREEMAIL_BODY || __JR_FREEMAIL_FROM || __JR_FREEMAIL_REPLYTO) endif # ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta JR_EXPLOIT_OPEN_ARCHIVE (__JR_ATTACHED_ARCHIVE && (T_JR_EXPLOIT_OPEN_ARCHIVE1 || T_JR_EXPLOIT_OPEN_ARCHIVE2)) mimeheader __JR_ATTACHED_VIDEO Content-Disposition =~ /filename\=[\s"]?.*\.(wmv|mp4|avi|mov|flv|mkv|webm|m4v|asf)([";']?|$)/i mimeheader __JR_ATTACHED_AUDIO Content-Disposition =~ /filename\=[\s"]?.*\.(mp3|wav|oga|flac|aif[fc]?|m4[abprv]|aac|caf|3gp|au|snd|mka|opus)([";']?|$)/i mimeheader __JR_ATTACHED_IMAGE1 Content-Disposition =~ /filename\=[\s"]?.*\.(jpeg?|jpg|bmp|gif|svg|tif|tiff|wmf|emf|png|heic)([";']?|$)/i mimeheader __JR_ATTACHED_IMAGE2 Content-Type =~ /image\/(jpeg|png|gif|bmp|svg\+xml|tiff|heic|heif)/i meta __JR_ATTACHED_IMAGE (__JR_ATTACHED_IMAGE1 || __JR_ATTACHED_IMAGE2) mimeheader __JR_ATTACHED_HTML Content-Disposition =~ /filename\=[\s"]?.*\.(html?|shtml?|xml)([";']?|$)/i mimeheader __JR_ATTACHED_PROGRAM Content-Disposition =~ /filename\=[\s"]?.*\.(exe|hqx|cmd|bin|hta|hlp|pif|class|dll|msi|bat|scr|pl|php|py|js)([";']?|$)/i mimeheader __JR_ATTACHED_DISKIMAGE Content-Disposition =~ /filename\=[\s"]?.*\.(iso|img|daa|dwg)([";']?|$)/i mimeheader __JR_ATTACHED_ARCHIVE Content-Disposition =~ /filename\=[\s"]?.*\.(tgz|zipx?|7z|xz|z|[jr]ar|r0[0-9]|arc|gz|bz2?|tar|b?cpio|sit|lzh|lha|cab)([";']?|$)/i mimeheader __JR_ATTACHED_PRINT_FILE Content-Disposition =~ /filename\=[\s"]?.*\.(rtf|xps|pdf)([";']?|$)/i mimeheader __JR_ATTACHED_OFFICE_DOC Content-Disposition =~ /filename\=[\s"]?.*\.(od[tmgpsfcbi]|ot[thgps]|oxt|doc[xm]?|dot[xm]?|xl[stawc]x?|xls[mb]|xl[ta]m|ppt[xm]?|pps[xm]?|ppam?|pot[xm]?|mdb|mpp|w(cm|db|ks|ps))([";']?|$)/i endif ## Bad ONMICROSOFT/365 Hostnames ## header T_JR_BAD_MICROSOFT1 EnvelopeFrom =~ /^\?$/m header T_JR_BAD_MICROSOFT2A ALL =~ /\@(.*\.)?(cnoleuv|8v7mk87|x27eco0|itopiarytelligence|xn5919t|codecraftnest|x1r862t|soufkefdf3jf|ln801n5|x6rtpm0|xsyt8ub|xh4h50y|xx4qgplz|bu3tey0|vtmbhlra|n8uob4m|x7r3459|vwscxaub|6sr1v6x|braitwaitbratwaitwaitbrer|clanofchronos|carpentryby|sheldonisdnoc|mycouchetard|cd16a|sd28a|tifelate1s|hadrahreew|vb24x7s|zppl2e2|x3635f5|uacozmxd|hadmubeo|pkd993ak|x66arz7|awlu|idrivesoch|es02ms|soufuzdqs2is|x4a8q31|mecatnet|x577z0f|nvduw2axyqgs|xs8lete|x577z0f|xi8hea3|t1ms|x87tvoc|kauehtsz|h0jknot4956x|yrhtxegrzf|OR07MS|aguireschol|malcis|0ad172jikv36|xlaboslate|x88eu43|sr8jr|gk2xs|kd55w|xq99a6j|ssn17|lz7q4d3|x7o599w|gh52m8|sd45wa|Abner515|x7k3xkq|sduhvfbauwd|xstijbarik|xlightcloud|samlsnet|cdklu|yewdream|dsflu|iwebways|xvqqp1y|xs85pm3|dnuke|43a4s5k|hgjld1|cnoleuv|xmk87z2|ztmck|hbmv|xk1ru1r|xps8n15|pol01ms|xulmsyporg|xv568tb|xb6bv2c|x7x95uo|x1156b4|dvsexuko|kasgarlimahmutortaokulu|x7ds4qc|x09b0df|Thorofare395|kmzm3899|xj33g3q|apsdighi|x24m2v2|xs87097|WYN365|ln801n5|asewl|x4t3uy8|us01ms|hfacv|worldlimited|bltwksxz|x44rm9i|xmp0f3o|x0h782h|smkkartinibtm|nuhe|vitagisnet|win64net|igrizzlimited|gh52v3|pelchatllc|greenstein491|pola02ms|x59f6oy|satafalotos|sdachvln|xtechaerstate|xco6102|freakcloud|allaccesstixxnet|xf6468e|x06l37q|mwovb|xn672jo|joannabmolla|x1wem89|dbkjd3|t7aaym5|iuqt9478|xwn4i0a|x98pf14|x2pfy20|xr727il|x9u174x|lqhi5649|sa9rwqst|hlddk1|escolalabourecat|xm8ns0m|clfschools|ujup8002|xcu143s|mcn6ldul|xyv186x|xs1j4j8|adegk2|xw016bv|xlaa14w|i2m2kig|fkml23|xl22461|x8a2ub2|x6mddt3|x8sr7h2|xv90n58|x061qqf|x55r0s3|xxmdxafh|xXMDxafh|mnj7y8za|x0y6k49|xt9zed9|xh290u1|eookkglglguyjujhihihjk61|x55r0s3|xm3r53b)\.onmicrosoft\.com\>?\)?$/im header T_JR_BAD_MICROSOFT2B ALL =~ /\@(.*\.)?(kdkindy|infodfca7|infoebix5|infodlor1|dunnlewisfoundationorgau|blackandwhitestoriescom|childrensfoundationau|infoasrqm|oldermenunlimitedherveybay|infoeilb1|varunaorg|abcfriends1|pacojetagch|ucacueedu|LyndenAgedCareAssociationau|infodjrt3|infoegor7|infoeilb2|infodrdt7|LiverpoolNeighbourhoodorg|ogrbayburtedu|unipamplonaedu|NorthWestMultipleBirthClub|DarwinCommunity|infodycy7|THEYOUTHIMPACTorg|ecntAu|CentralCoastKidsInNeed|beyondthebadgeorg|questioningchristianityorg|FaunaRescueWhitsundaysorg|Butlerraudhaemp|gimfoundationorg|PakanaServicesLtd|c3kalgoorliecomaus|infoekjg1584|s4eorg|fightcancerorg|swimming365|strongislandfoundationcomau|fawwaorg|stkildamumsorg|infoemhw1|KYDSYouthDevelopmentService|goodshepherdlutheranorg|stlukeshealingfoundationorg|oriqlcom|buddhistcouncilorg|SouthernCrossVineyard|theascendfoundationorg|connextionsauorg|darwinaviationmuseumcom|infoeevj2|nehret|cobranewes[0-9]|freshwatercommunitychurch|theexchangechurchcomau|mybestlifeaustraliaorg|santaclaaus2293|murrayanglicanorg|changefutures|glenroyneighbourhood|farmroadpreschoolcom|stpaulsburwoodorg|miriamrosefoundationorg|damronfg3|hobsonsbayvicgovaus|pzsyh|hamiltonshowgroundaus|sensesofcinemacom|infoelxa5|infodkko7|hungerzeroorg|nimoworg|gawura|nhheduvn|assyrianchurchorg|ballaratagriculturalorg|friendslrbgcomau|BallaratAgriculturalorg|mackaypioneerkindergarten|thebigumbrellaorg|apotofcouragecomau|preciousangelsinhome|moulameinpreschoolorg|monashlss|RaptorRefugeInc|hamerkazshelanuau|monashlss|jamescookuniversityau|thetrusteeforqueenorg|mandurahslscsurf|pivots|maddisonoconner|railraymonde44|Kendall069|infoasrqb|infomaro5|morarhand|radx365|rhandstoke|nela50|vincentdd71|garlanddny|infobftb5|sntortorasnjw|mmckenzie4655|ycollier|thjtfstqo|vandervortvalentina|lapdeskquechua5)\.onmicrosoft\.com\>?\)?$/im header T_JR_BAD_MICROSOFT2C ALL =~ /\@(.*\.)?(itculiacanedu|ZimmermanandSons964|learningcreativeskillsin|cvoedukempen|esbmk|jcccmacid6|shyipin|DiazMillsandBray|Euroland|amaralassociados1|eibelezaservicos|iesfranciscoayala|hahnkeelingandbauch|hoithanhtinlanhban|centreincau|wwwdcbtcouk|debbiekaur|centralaidorgukk|silvertonparochialtrust|nyahwestunitingchurch|willefondens|marypiston25|x0i507h|x1qt9ih|x04285c|ckzl2632|mpgvsmbp|x7y55ea|2470020|eggubbs|pypz250gn|fghhdydc05|suj90lo|uhfschools|vtij3877|ysf6sdg|meNsy3|xpftj39|xy95b29|solerainc|xld51o9|dbuh|365connect|rR88AVPPSB|dsbzmvn|ecntAu|nevadarotaryfoundation|infoejmf2|infoewft3|alstonvillewardellcatholic|willyouaus|vgrau|infodtks2|infoelhj3|infobbzf|warddekenorg|infobdchs|projectorgau|mankindprojectorgau|walkoflifetraininginc|onjcriorg|twintownskindycomau|birraleekindyorg|lhimuseumcom|kemenkeu|doovie|semillasdejesus|vanketinstitute|elipslife|dailydials19|entrpriseforyou|madara003|kqed1|ourdailybread3|jewishcommunity1|ahvnccpdenyfksntjwizvb|atriummedicalcenter64662|mercycorps49080|abde10|harvardmedical87486|miamivalleyhospital21683|phelpsmedical94600|indianaonline81925|americanfriendsof54137|uppervalleymedical39340|capitalhealthsystem13775|eastmissouriaction76196|hsyejsyddd9|nosjkewqew4|isana73901|pmhccinc37298|educationforchange7182|Jett812|WisokyCN|Dai20356215|Kar19569723|ar19569723|cry19033743|samenkooreducation)\.onmicrosoft\.com\>?\)?$/im header T_JR_BAD_MICROSOFT3 ALL =~ /\@((([xz]|vb|vr|db|gh)[^aeiouy]|vw|vt|nv|wt|hg|gk|pk|dv|km|kz|iuq|lqh|suj|mensy|xy).*|[A-z]{2}[0-9].*|[0-9]+|[sb][dup][0-9].*|[^aeiouy]{5,20}|.*[a-z][0-9]{2,4}[a-z].*)\.onmicrosoft\.com\>?$/im header T_JR_BAD_MICROSOFT4 ALL =~ /\@((.*(sataf|sdach|lkz|sduh|clfs|ujup|hf|blt|smk|mcn|fkm|jhts|MNj|vtij|hjk|wxb|ckz|gvs|mbp|eggub|ypz|hdy|fgh|ydc|pyp|vgb|rdfw|cvjr|vpps|zmvn|dsbz|dbuh|cntAu|foundationau|youaus|eybay|vgrau|bbzf|elhj|dtks|rddek|bdchs|rgau|njcr|ycomau|dyorg|kdk|dfca|bkjd|srqm|tagch|aemp|kjg|tfstq|eevj|bftb|hnkee|anhba|\#FOXnews|dcbtc|ekaur|gukk|lhim|menkeu|jcccma|cvoeduk|nosjk|jsyddd).*)|.*[a-z][0-9][a-z][0-9]\.*|.*flinsure)\.onmicrosoft\.com\>?$/im header T_JR_BAD_MICROSOFT5 ALL =~ /\@.*(wft|jmf|dlor|bix|bix|degk|ddk|kjd|eilb|abcfriends|jrt|egor|drdt|dycy)[0-9]\.onmicrosoft\.com\>?$/im # header T_JR_BAD_MICROSOFT6 ALL =~ /\@(?=(.*?[A-Z][a-z]){3}).{6,30}(\.onmicrosoft\.com)/m meta JR_BAD_ONMICROSOFT (T_JR_BAD_MICROSOFT1 || T_JR_BAD_MICROSOFT2A || T_JR_BAD_MICROSOFT2B || T_JR_BAD_MICROSOFT2C || T_JR_BAD_MICROSOFT3 || T_JR_BAD_MICROSOFT4 || T_JR_BAD_MICROSOFT5 || T_JR_FROM_BAD_MS_CLIENTS || T_JR_FROM_MSG_ID1) # meta JR_BAD_ONMICROSOFT (T_JR_BAD_MICROSOFT1 || T_JR_BAD_MICROSOFT2A || T_JR_BAD_MICROSOFT2B || T_JR_BAD_MICROSOFT2C || T_JR_BAD_MICROSOFT3 || T_JR_BAD_MICROSOFT4 || T_JR_BAD_MICROSOFT5 || T_JR_BAD_MICROSOFT6) describe JR_BAD_ONMICROSOFT Bad M365/ONMICROSOFT host name score JR_BAD_ONMICROSOFT 7 ## Bad iCloud Exploits ## header __JR_BAD_APPLES1A EnvelopeFrom =~ /^(.{2,30}_at_).*\@icloud\.com$/ header __JR_BAD_APPLES1B From:addr =~ /^(.{2,30}_at_).*\@icloud\.com$/ score JR_BAD_APPLES1 7 describe JR_BAD_APPLES1 Bad message envelope detected from Apple/iCloud host ## Bad Firebase Projects ## header JR_BAD_FIREBASE From:addr =~ /.*\@(.*\.)?(?:017[25][79]\-eva\-[0-9]{2}\-1089159020573|zlltjd|user08279\-tp\-06\-785164885003|user08261\-tp\-10\-785164885003|user08406\-tp\-10\-785164885003|user00151\-pro\-01\-785164885003|user01180\-pro\-01\-785164885003|user08425\-tp\-09\-785164885003|user08473\-tp\-08\-785164885003|user02361\-pro\-01\-785164885003|user02661\-pro\-01\-785164885003|user01587\-pro\-01\-785164885003|user01077\-pro\-01\-785164885003|user00201\-pro\-01\-785164885003|u01625\-eva\-05\-1089159020573|gidz\-6acd1|oxzs\-b7cc3|cneo\-4e70c|llhb\-6e8d8|jtsd\-3e7a4|zjax\-1d596|yykr\-c9eed|lrlw\-58302|rjhv\-aeb09|agwj\-dfd67|szeg\-d4b7b|qiqm\-f5254|kdsr\-a42fb|vivabase-6f90d|rfyv\-60a0a|support\-service\-7f0fc|three\-dbae9|warolli\-87e78|other02\-dce8c|tadot02\-feac9|kolola01\-b96f8|farah01\-4c01e|other03\-4281e|abdelll|ultimate\-triode\-488711\-m2|aytozin00|fisesend|sadikfgdf|faruuuuuuuuha|hassan01\-42a1e|abdess\-d42bc|ha04\-f2e37|alxer3|nadikanadi|n\-11\-89e43|alexer\-99c56|subwaysurf\-be516|fir\-001\-15f9f|chocola\-203a1|l3iddd02|otoowe01|guudz\-353f4|loma\-9b50e|nn11\-16fdc|cloud07\-df133|lm9dame18|cyber\-tutorials|erenyegger23\-5e1bc|ahmed\-15\-24490|lacoste45\-c524f|ohlala\-e5a64|newkaseel800|promax10|notification\-hardware2|tiki02|flay\-7a7d1|t3awidaa|project\-001\-b5645|bxbhfrh\-e26d1|project\-003\-57dc0|namir\-87be3|erfsdhbefsdhb|ben01\-b0611|project\-hamzaelalamix\-00\-80d9c|gtd01\-7c030|gtd02\-badce|benigill|obahmo54|ra\-c137b|army\-34c36|net\-e181a|yalmaz\-b4957|promax14\-7cb83|nirvana\-4aa43|zamko14\-500fc|alami\-3|alamix\-2|taniprji|medvi\-health\-01|turkie2|eqwgqgw|bunny3\-480de|bajio\-59311|sert\-c2ac9|delta01\-4365b|delta03\-de193|delta02\-8b936|tunisie2|vsl6\-b45b9|i3tachn|qodos\-4c4db|tabachir\-d3d1f|adilsahbi\-ccf42|cede\-a5dcb|alamix\-1\-f4078|hiba\-1\-c4ca4|freecachy\-06idx47j)\.(firebaseapp\.com)$/i describe JR_BAD_FIREBASE Bad Firebase Project score JR_BAD_FIREBASE 5.0 ## Bad Numbered Domains ## header __JR_FROM_BAD_NUM4A From:addr =~ /.{2,40}\@\d\d\d\d\.[A-z]{2,8}/i header __JR_FROM_BAD_NUM4B EnvelopeFrom =~ /.{2,40}\@(.*\.)?\d\d\d\d\.[A-z]{2,8}\>?$/ meta JR_FROM_BAD_NUM4 (__JR_FROM_BAD_NUM4A || __JR_FROM_BAD_NUM4B) describe JR_FROM_BAD_NUM4 Bad domain name: consists of four digits + TLD score JR_FROM_BAD_NUM4 10.0 header __JR_FROM_BAD_NUM4AA From:addr =~ /.{2,40}\@\d\d\d\d-?(online|creditcardapproval)\.[A-z]{2,8}/i header __JR_FROM_BAD_NUM4AB EnvelopeFrom =~ /.{2,40}\@(.*\.)?\d\d\d\d-?(online|creditcardapproval)\.[A-z]{2,8}\>?$/ meta JR_FROM_BAD_NUM4A (__JR_FROM_BAD_NUM4AA || __JR_FROM_BAD_NUM4AB) describe JR_FROM_BAD_NUM4A Bad domain name: starts with four digits, unique text, + TLD score JR_FROM_BAD_NUM4A 10.0 header __JR_FROM_BAD_NUM3A From:addr =~ /.{2,40}\@\d\d\d-?(meds|yes|fico\-credit|immediate\-credit|play\-dice|jackpot\-?game|card\-?game|game\-?gold|casino|dice\-?play|gold\-?game)\.[A-z]{2,8}/i header __JR_FROM_BAD_NUM3B EnvelopeFrom =~ /.{2,40}\@(.*\.)?\d\d\d-?(meds|yes|fico\-credit|immediate\-credit|play\-dice|jackpot\-?game|card\-?game|game\-?gold|casino|dice\-?play|gold\-?game)\.[A-z]{2,8}\>?$/ meta JR_FROM_BAD_NUM3 (__JR_FROM_BAD_NUM3A || __JR_FROM_BAD_NUM3B) describe JR_FROM_BAD_NUM3 Bad domain name: starts with three digits, unique text, + TLD score JR_FROM_BAD_NUM3 10.0 header __JR_FROM_BAD_NUMBER1 From:addr =~ /.{2,40}\@(126|163|21|189|139|10086|53)\.[A-z]{2,8}$/ header __JR_FROM_BAD_NUMBER2 From:addr =~ /.{2,40}\@(.*\.)?\d+\.[A-z]{2,8}$/ meta JR_FROM_BAD_NUMBER (__JR_FROM_BAD_NUMBER2 && !__JR_FROM_BAD_NUMBER1) describe JR_FROM_BAD_NUMBER Bad domain name: all digits + TLD score JR_FROM_BAD_NUMBER 3.0 ################################# ## Bad Gmails Ending in Digits ## header T_JR_FROM_BAD_GMAIL_NUM1 From:addr =~ /^(?:mrsannacooper|belljesy|ministerfinance|barristerjgiggs|file|officee|mradamacoulibaly|nelsonwilliamne|ofixweb|michealfinancecompany|eloh\.?progress|mrlennoxjjames|ctschida|benedict\.?bruce|herbertwigwe|hongduyen|edwinmark61ays|paymentrelease|catherinehoffmann|anneliseolsen5|mrshopeemma|mrsaishaay|thuyxnkr|natysexxxwebcam|healtheworld|mrs\.?lindarail|rainbowinthesky|myaffairsmorris|debtpayment|westenunion|weinsurefranchise|leadsglobals|unorganization|bancorpbank|lancelanceharryharry|revrosemary|sgtchristinadaranda|boardrepresentative|mrs\.?aslima\.?ahmed|h\.?orphanage|blessedmajor|mrsjeweltaylor|presidentt|infodesk|ukfinancialservices|katherinenelly|mrhassanusman|cntrlbnkngr|siginvestmentfzco|m\.?benleo|businessworld|tambakumba|helenejose|tatianadonaldson|amiradarrar|mrs\.?juan\.?henry|tamanciooramancioortega|mrmichaelsmith|goodluckjim|bracepat|hoangtrong|accessbank|komalodanel|fundingproject|officeduty|cintlpoliceforce|atmcarddpt|upspostalservice|philipcollininvestment)[0-9]{1,8}\@gmail\.com/i describe T_JR_FROM_BAD_GMAIL_NUM1 Bad Gmail From address that ends in digits score T_JR_FROM_BAD_GMAIL_NUM1 0.01 header T_JR_FROM_BAD_GMAIL_NUM2 From:addr =~ /^(?:getextracashnow|goodname|facebookaward|meirjessicau|jenniferdogolea|mrs\.?latifakoumbousi|bigbosscreation|dr\.?thomas\.?goodman|mr\.?christopher\.?wray|kalpanay|rev\.?fdmike|presleybryan|boonchaisuriya|worldremitpaymentcenter|agentdonaldparker|zarti\.?mustafa|brownkelvin|ruthowossu|barrdavidflknr|ade\.?abu|xxasma|info\.?dept\.?org|xuanquyet|equestrianproperty|michellerichard|nancylibya|mbotha|mubaraksuzanne|uzohedwine|emilia\.?blake|microffice|nguyenthihoang|johnclarkesq|george\.?kyle|seilermary|hrcareer|zenithbankplc|aminajohnson|info\.?lutz|piyabalopagniou|benbernank|zennithbankplc|claimdeptt|lawfirm|costaapplication|preciouse|offilcc|nguyenquangtuan|farmerhome|lethihuong|presidentmuhammadubuhari|infov|vodinhhai|nguyenminhhang|mrslindajerry|nguyenthanhthao|husamhasan|officeworkmail|successmail|nguyenvansuu|lindauwen|rosemarryjone|merciaakume|cintero|mrjimmyjohnson|ubabank\.?visaatmcard\.?department|managementfile|miss\.?fatimayusuf|mrs\.?lindakoffi|mrstinajerry)[0-9]{1,8}\@gmail\.com/i describe T_JR_FROM_BAD_GMAIL_NUM2 Bad Gmail From address that ends in digits score T_JR_FROM_BAD_GMAIL_NUM2 0.01 header T_JR_FROM_BAD_GMAIL_NUM3 From:addr =~ /^(?:cinterowork|barrgsmith|lawyerjeannoe|smrsmarie|paifdfngst|mrdon\.?jackson|companyinsurance|damondstefanloanfirm|geraword|favouramanze1|infouhs|favourjeff|autoreply|unclaimparcelzdzislawbak|promisegomise|officef|ubabankoffice|majesticwalsh|localbeef|nguyenthanhliem|drdavidcarter|nicodike|carefinancialservice|olufemiprime|atmcard|nguyenngocquang|binyaminfgala|mrsrebeccajohnson|interfinancegroup|tranthanhha|fbifbifbioffice|wunion|wunionoffice|unitednationrelieffund|joysnowrt|loveinthelord|usecash|genuineloan|bassiroudiop|traviscreditunionbank|seydimalang|mrssusanshone|williamsloanfirm|bettwinwilliams|dianahamade|grailsonmusta|felicitymmmm|orabankcomtg|rahmanamira|uzzsunday|info\.?ubaatmbankheadofficetogo|dr\.?albertnwaosu|infoinquiries|smithsmith|unlimitedtools|uunitedbankforafrica|luckboy|federalr|keystonebankplc|johnkofi|directordhl|lopezpacheco|julianpacheco|erlingpersson|loanfinancehome|mrrobertjr|mrsguidagarrison|atmofice|mrhopealive|worldremitservice|oaktreecapital)[0-9]{1,8}\@gmail\.com/i describe T_JR_FROM_BAD_GMAIL_NUM3 Bad Gmail From address that ends in digits score T_JR_FROM_BAD_GMAIL_NUM3 0.01 header T_JR_FROM_BAD_GMAIL_NUM4 From:addr =~ /^(?:tanakamasimba|chukwudiejiofor|bandolandreag|magajll|alexpopowcer|frankywladimir|oceanfinance|mrgodwin3emefieie|m\.?hayesjerry|fnpconnolly|financialintelligentunit|barr\.?jamesm|hamidumuhammadu|vicmatii1|privateemail|myprivateemail|logistiquetransport|personcontact|Charityloan|investm|mrs\.?ries|aishamuammargaddafi|kritigoyal|bitconinvestment|unnotarypaymentdepat|homelandsecuriti|agentfredrick|traceyrichard\.?imf|westernofice|anthonyblinken|mrmanuelfranco|braint\.?moynihan|alihassanemirates|cash\.level|offic|mrharryben|office|sale|laurraralph|bankofamerria|talia\.?okadigbo|housseyediao|officialmassage|michaelmichaell|blessedgrace|mrs\.?laurazack|barristerkomivitino|hdshgrs|victorvictoraku|mrjohncwilliams|gforf|aliceawab|prerna\.?raj|financeintegrated|mortgageloan|sexxybebix|brownmonicabrown|mr\.?allangriffith|officemanagement|dr\.?yongkimjim|stefanpersson|vacation\.?life\.?llc|unitedstateembassy|mr\.?mrschris|africandevelopmentbank|www\.?info|diplomaticagent|centralinfo)[0-9]{1,8}\@gmail\.com/i describe T_JR_FROM_BAD_GMAIL_NUM4 Bad Gmail From address that ends in digits score T_JR_FROM_BAD_GMAIL_NUM4 0.01 header T_JR_FROM_BAD_GMAIL_NUM5 From:addr =~ /^(?:mrsmariaelizabethscheffle|maccpistol|officemail|dr\.?richarddouglas|bluetrustloans|dailystar|mr\.?wongsoh|eeeeeg|stor|mysweetbelle|myjanes|infoconsul|benzantyni|calanthacamara|barristertedmaksriva|cajo|kllacuna\.?|afuabankole|drraymondchienkuofung|marline8558fu|barristermarkdavidson|trustb|unitedn|blankatmcard|illuminatiofficial|dianatranmalaysia|sgtnicoleharrison|officememo|infofirm|skylarhrs|nortoncustomer|equityloancompany|williamlinger|frb\.?info|halimkingsew|adrikaalimou|drmrsokonjoiwuala|duchai|capitalfinancemail|nikeshoes|mrslaurazack|financeminister|illuminati|sgtmonica|iceexpress88|magdalynaalnagash|pankovatatiana|officialdhlcourier|shopha|Transunioncoza|libertyloan|anateaminat|dikeikem|monicabrown|sgt\.?brownmonica|westernuniontransfer|mrs\.?viviandouglas|gerdfrohilch|mrsestherboateng|mrselizabethjohnson|michaelmichaell|illuminate|barristermorgan|dr\.?longllong|directcredit|mrjerrymeyer|officeonline|loanfinancehome|sistermarythomas|capitalbankfinancial)[0-9]{1,8}\@gmail\.com/i describe T_JR_FROM_BAD_GMAIL_NUM5 Bad Gmail From address that ends in digits score T_JR_FROM_BAD_GMAIL_NUM5 0.01 header T_JR_FROM_BAD_GMAIL_NUM6 From:addr =~ /^(?:ame\.?abbottmedicare|daviddirectemail|foussenaibrahim|hillaryphillip|edwardsgreene|welchmark|minfo|adomakohkofi1|joy\.?susan|mllchrist|michlihn|mrsbettywright|williamsbello|em|mrjamesamsterdam|chinyeregreg|efccbeninrepublic|mschristyjohnson|jamesloaninvestment|officefille|mrsirisstobbs|lawchambers|sow\.?genius|imfdirector\.?code|mrpeterfranklin|sabineashraflove|mralexbright|lottoaustralin|privateemail|goldenrunway|agentoffice|mrsarthurlinda|mr\.?douglasrichard|officialoffer|tntcuriercompany26|augustinedavid|mrrobertj|info|tac|lynnagent|monitoringunit|mahmoudmohammedxxx|dfgfddsgsdf|offi|officeaily|mrs\.?elizabeth|molina800|oofficial|frederickwilliamssmith|mradrieljames|mrseunicedafia|ubaceo|usagovernment|virginholes|missjoycarr|olugbemifemilola|postoffice|compdir|barristerhenry|christ0hawood|lakieshamozella|fundscommitte|good\.?done|srcccpt|yousufurdu|shenewatson|joanaabban|adamspatrice|ghazahmed|windowsoft|unionw|barristersmithmicheal|mrsmariaschaefer|usfederalreservebank)[0-9]{1,8}\@gmail\.com/i describe T_JR_FROM_BAD_GMAIL_NUM6 Bad Gmail From address that ends in digits score T_JR_FROM_BAD_GMAIL_NUM6 0.01 header T_JR_FROM_BAD_GMAIL_NUM7 From:addr =~ /^(?:henrycalvinfundings|officfile|financeconsult|mrsstephanie|coldstonecreamery|sisterdeborahdeon|richardharry|agnnigeria|worldtrad\.?|presidentjohnmahama|julienjulio|agentoffice|icpcoffice|officeoffbi|rev\.?tonyjohnson|moneygramoffice|williamejike08|agentdavidjacksonok|alikohaidar|oviajimdr|dghjgdjkdzs|ubabankforafrica|ivanivanoff|ddjj|mrselizabethallen|offdept1|deptmt3|mrkennedyhugo|mrpeteralexandra|mr\.?alinmusah|apexdept\.?ly|revrichardcoker|edouardaffovi|patienceessien09|revreginawandsmithx|mrdouglasrichardd|mrsaliyev|nguyenngochuyen|drmichealprosper|ubaceo|atmcarddeliveryoffice|federalreserve|infospende|revjbenson|ricksydneyvisanet|westernunion|ddirector|westernunion|unitedstatespostalservice122|ubab|mrssarahjehi|garymoorerepresentative011|drbenugo|upsservices|mrpeterwillson|officewesternunion|swiftcourierservices|officebusniess|officeuba|margaretphillip|dhlexpress|bnpperibasbank|upspostalservice|diplomaticconsulate|revfatherjohnson|unescos|moneygramoffice)[0-9]{1,8}\@gmail\.com/i describe T_JR_FROM_BAD_GMAIL_NUM7 Bad Gmail From address that ends in digits score T_JR_FROM_BAD_GMAIL_NUM7 0.01 header T_JR_FROM_BAD_GMAIL_NUM8 From:addr =~ /^(?:postofficeunitedstates|departmentofhomelandsecurit|bnpperibasbank|consultantagent|upgrad|officesdesk|lottotallan|mr\.?davidjoe|mrsannwillma|mrfrankkoko|uscustomservice118|moneygeamtransfer|ambassador\.?stuartsymington|unitednationoffice|iceoff|directioniwccanada|drjubrilubaro|dr\.?billwinston|attorneyboris|unitednationsrepresentative|bankc|gracedokie|annorboateng|officewu|henrywilliams00|officemail|brightangela|thecallumfoundation|infowatfordclaimsoffice|revmarkcbndesk|justice\.?dept|officeprofile|billgatesf|christophermaria|officeonline|fillings\.|amna|dsandersloans|jecobsmith|goodluckjohn|mrs.sistersarahjeh|bkmail\.?info|upsservices|mainvillebit|michaelsmithk|charlesduken|ibehlevi|nnpcexecutorintrust|frbonlinepayoffice|revfatherjames1|connollyfnp|mrsaishag|uniteddesk|tonlinebanking|mralexadams|presidentghana|rogerbryan|infopriv|infom|mrsyettybayarmaa|inffoocon|joanwilliams\.?mrs|mrsgrace|canadalott|barr\.?martinsegoka|citibankukinfounit|mrjohnjr|treasuredavid)[0-9]{1,8}\@gmail\.com/i describe T_JR_FROM_BAD_GMAIL_NUM8 Bad Gmail From address that ends in digits score T_JR_FROM_BAD_GMAIL_NUM8 0.01 header T_JR_FROM_BAD_GMAIL_NUM9 From:addr =~ /^(?:banka|fbireports?|file|mrsdaniellakyle|alfonsoblack|mrchristianjoseph|missksadia|chardonation|armyunitedstates|info\.?barristertino|qbank|infozenithbankorg|drmedwilliam|miracleoluchi493|moneyaffairs|dr\.?thomas\.?goodman|fedex|mrdavidtouch|partnerslegislators|uamerican|mrjohnforbeskerry|emmaludwigk|treasuredepartment|dhloffice|mmadukaokoro|jerryandsons|mbadvocate|mr\.?isa\.?ahmed\.?musa|diplomatmarkwilfred|bmwlttrdepartment|officebed|info\.?department\.?office|wwwfbiinvertigationunit|chasebankus|federalreservebanknewyork|speedtrust|inspectiionunit|fcourier|infocbngovoffice|fundfile|unitednationsfinance|firstbnkplc|diplomatic\.?fredugo803|dhswashingtondc|firstcitiexpressbankofnigeria|oficefils|frdept|vowlion2345|barristerjohnsonphillip|usarmy\.?quantock|officeinfosecretary|foffice|exxonmobilcorporation|unitedbank|fedexcompany|dhlcourier|globalfinancemon|infoff|fb\.?lotto\.?inc\.?promo\.?|attmachine|infoaramexshipping|moneygramofficeof|federalreserveb)[0-9]{1,8}\@gmail\.com/i describe T_JR_FROM_BAD_GMAIL_NUM9 Bad Gmail From address that ends in digits score T_JR_FROM_BAD_GMAIL_NUM9 0.01 header T_JR_FROM_BAD_GMAIL_NUM10 From:addr =~ /^(?:imfoffice|fundremittance|revfrpaulwilliams|crownprinceofdubia|microsoftc|mrfrankjohnson|officedf|mrkingsleyadebayo|westernunionof|expressups|drokwujosephnnanna|mrsruthmoreno|fgndeliv|recorderrecorder|frb\.?info|trustfinancecompany|unitedbankforafricar|worldvisioninternational|mredwardsellis|mrcharlesprettig|johngriffithjons|minhpguffeyd|bellamour|johngardnermd|servicecentre|economicfinancialcommission|dradamdougla|bbank|yokomaoffice|mrsrosebess|officefilego|mrpatricetalon|diplomaticagent|officesecretary|diplomatagent|lawaleduego|mrsjessiedan|casobi222|yoshikoazumi|angelakintonedhelp|O49Team|mrsdiezani\.?madueke|francineseuch|unitednationofficebenin|deskservice|bmwoffice|easyloanmicro|uzokak|susanwong972|admiunit|wesbanecreditunion|internalrevenues|financialconsultant|firstnationabank|stoporder|illuminatiofficial|atmcardservice|unprocessingunity|talktomanagement|mrsconniedutton|davisediv|dejiatbarclays|legitloan|internationalmonetaryfunds|officemail)[0-9]{1,8}\@gmail\.com/i describe T_JR_FROM_BAD_GMAIL_NUM10 Bad Gmail From address that ends in digits score T_JR_FROM_BAD_GMAIL_NUM10 0.01 header T_JR_FROM_BAD_GMAIL_NUM11 From:addr =~ /^(?:reportingconcerns|mrsgrace|bensonrumba|callunfoundation|benbruceoffice|officenotice|purchasing|skgbookkeeping|seojunkim|office|fbiheadoffice|drmohammedbello|drmarklopez|nigerianinvestigation|desjoe|infofii|webmail|imfchristinelagarde|advisery1000|officeofimf|ecowasofficebenin|tntexpress|mrs\.?rebeccaanashemagorokosho|diamondbankoffice|manamgroupltd|atmdepment|ffunds|facebookdepartment|officefe|cfochief|bankofamerica|officeprivate|unoffice|musowali96|sgtkalyin|jamesedward|mrgeorgewilliams|philipcollininvestment|westernunin|mgramoffice|usafile\.?org|cbnintlremittanceoffice|office\.?mail|jeffreylawchambers|skynetdiplomaticcourier|finacialservice|britishhighcommission|nortonconsumer|officepayment|illuminatiofficial|ubaceo|mr\.?tonycollins|imfinformationdept|dipmarkw|who\.?un\.?org|mrs\.?patriciacharles|financialclearinghouse|ecowasafrica|mrs\.?rebeccaanashemagorokosho|estatesloan|mrssherry|consultancyagency|ecobankb|westernuniuon|cfochief|danielsmithinvestment)[0-9]{1,8}\@gmail\.com/i describe T_JR_FROM_BAD_GMAIL_NUM11 Bad Gmail From address that ends in digits score T_JR_FROM_BAD_GMAIL_NUM11 0.01 header T_JR_FROM_BAD_GMAIL_NUM12 From:addr =~ /^(?:togolome|infomilitaryservice|orabankonlinebenin|barrjames\.?macbeth|mohabum1|westnnion|officeworldremit|executive8director|dr\.?moorelarry|bankamerica|blessingsunday|francopinault|mrsmrsmrs|deliverya|trustbank|unitdnationoffice|capitalscapitals|falmatamustaphayasulumi|servicec|federalreservebank|imfusgov|webinfo|usbnk|santanderconsumerbank|princekenechi|officef|letisahamzar|claimsoffice|goodnewsw|opayment|officefilego|worldwideloanserves|easyloanoffer|cbn\.?govt|FAX_DOCUMENT|australianloto|inf|ubaatmcard|diplomatdelivery|unofficeworldbank|babanfatee|salif\.?musa|officewesternnon|ecobankplc|www\.?orabank\.?com\.?tg|office|barclaycustomercare|lotoaustralia|takemore|lagardeimfoffice|INCGLOBAL|davidbeames46|cupqatar|mailinfo|deutschebank\.?nl\.?org|bgfibankgroupbenin|bilgate\.?de\.?foundation|officecontact|infocontact|officefile|woodforestnationalbank|unitednationswebinfo|facebookaward|jpmorganchasebnk|illuminatiinvite|mailerdaemon|internalrevenueservice|officetask)[0-9]{1,8}\@gmail\.com/i describe T_JR_FROM_BAD_GMAIL_NUM12 Bad Gmail From address that ends in digits score T_JR_FROM_BAD_GMAIL_NUM12 0.01 header T_JR_FROM_BAD_GMAIL_NUM13 From:addr =~ /^(?:mrmrsfrancespatrickconnolly|fbi|colinsamy|europeancoordinator|dhlpilot|dhldeliverycompanylometogo|website\.?devlopment|datesevices|uknationalclaims|faithmagomanyakundi|imfinformationdepartment|islamicdevelopmentbank|honorablejohngrobertsjr|combatant|safetydelivery|humanitarianproject|mrskristalinageorgieva|internationalfinanceattorney|officaa|logisticsmanagerrbc|ALPHA\.?COMPUTERHAL|MARKETINGPROPOSAL|ishikatrade|buffettdonation|robertwilliamzenithbplc|ueuropean|microffice|legalrightschamber|officefille|mailfunds|mariamreemamohammed|PresidentAkin|uptownceo|accdeptfedminagric|orabankheadofficetg|mrs\.?miriam\.?walker\.?|educationwebinar|sales|donationworldbank|jannyking|dir\.?chau|officalbarristerket|johndoe|accdeptfedminofagricnig|loke\.?india|paragonestimate|columbusmcmullen|instituteeducation|companycourier|moussa\.?loan|sndjddndh|edwardsargent|bizinter|maitainance|onlineclaims|fedexhomedelivery|atmcenter|websiteandseoservice|filefile)[0-9]{1,8}\@gmail\.com/i describe T_JR_FROM_BAD_GMAIL_NUM13 Bad Gmail From address that ends in digits score T_JR_FROM_BAD_GMAIL_NUM13 0.01 header T_JR_FROM_BAD_GMAIL_NUM14 From:addr =~ /^(?:aimestimating|peter\.?services|usafoffice|info\.?woodforest\.?bnk|speedexpressdeliverycompany|stateclaimoffice|officefills|projectfunding|info\.?ubaatmbankheadofficetogo|office\.?file0|transferoffice|bearuofffice|officetransfer)[0-9]{1,8}\@gmail\.com/i describe T_JR_FROM_BAD_GMAIL_NUM14 Bad Gmail From address that ends in digits score T_JR_FROM_BAD_GMAIL_NUM14 0.01 meta JR_FROM_BAD_GMAIL_NUM (T_JR_FROM_BAD_GMAIL_NUM1 || T_JR_FROM_BAD_GMAIL_NUM2 || T_JR_FROM_BAD_GMAIL_NUM3 || T_JR_FROM_BAD_GMAIL_NUM4 || T_JR_FROM_BAD_GMAIL_NUM5 || T_JR_FROM_BAD_GMAIL_NUM6 || T_JR_FROM_BAD_GMAIL_NUM7 || T_JR_FROM_BAD_GMAIL_NUM8 || T_JR_FROM_BAD_GMAIL_NUM9 || T_JR_FROM_BAD_GMAIL_NUM10 || T_JR_FROM_BAD_GMAIL_NUM11 || T_JR_FROM_BAD_GMAIL_NUM12 || T_JR_FROM_BAD_GMAIL_NUM13 || T_JR_FROM_BAD_GMAIL_NUM14) describe JR_FROM_BAD_GMAIL_NUM Jared Rulez| JR_FROM_BAD.cf score JR_FROM_BAD_GMAIL_NUM 3.5 ################################ ################## ### PIANO SPAM ### ################## body __JR_PIANO1A /(^|\b|\s)(?:giv(e|ing)\s(out|away)\smy\slate\shusband\'s|any\sinstrument\slover|receiving\sthis\sinstrument\sfor\sfree|passionate\sinstrument\slover|[Bb]aby\s[Gg]rand\s[Pp]iano|Yamaha\sPiano|Moved\sout\sand\shave\sa|Piano\sto\sgive\saway|any\smusic\senthusiast\sfor\sfree|you\sor\ssomeone\syou\sknow\smight\svalue\sthis\sinstrument|late\shusband\'s\sYamaha\sbaby\sgrand\spiano|the\shands\sof\sa\spassionate\sindividual|care\sfor\sthis\sexquisite\sinstrument|home\sfor\sthis\spiano|Baldwin\sBaby\sGrand\spiano|find\ssomeone\swho\swill\senjoy\sand\sappreciate\sit\sas\smuch\sas\sI\shave)(\W|$)/m tflags __JR_PIANO1A nosubject multiple maxhits=3 meta __JR_PIANO1 (__JR_PIANO1A >= 2) header __JR_PIANO2 Subject =~ /Do\sYou\sLove\sMusic|Do\syou\sRegret\sthat\syou\snever\slearned\spiano|must\ssell\spiano|PIANO\sGIFT\sWITH\sLOVE|Rehoming\sBaldwin/ meta JR_PIANO_SPAM (__JR_PIANO1 && (__JR_PST_FREE_ANYWHERE || __JR_PIANO2)) describe JR_PIANO_SPAM Persistent Piano Spam score JR_PIANO_SPAM 5.0 ################## ## Fun With From ## ## Extracting From: JR_PHISH.cf ## ## Multiple From Addresses ## header __JR_MULTI_FRM_ADDR1 From:raw =~ /.*\<.*\@.*\>"?\s\<.*\@.*\>/ header __JR_MULTI_FRM_ADDR2 From:raw =~ /.*\@.*[\,;:]\s{1,2}.*\@.*/ header __JR_MULTI_FRM_ADDR3 From:name =~ /[a-zA-Z0-9_\.\-]+\@[a-zA-Z0-9\.\-]{4,}[\,;:]$/ header __JR_MULTI_FRM_ADDR4A From:raw =~ /\@/ tflags __JR_MULTI_FRM_ADDR4A multiple maxhits=4 meta __JR_MULTI_FRM_ADDR4 (__JR_MULTI_FRM_ADDR4A >= 3) meta JR_MULTI_FRM_ADDR (__JR_MULTI_FRM_ADDR1 || __JR_MULTI_FRM_ADDR2 || __JR_MULTI_FRM_ADDR3 || __JR_MULTI_FRM_ADDR4) score JR_MULTI_FRM_ADDR 5.0 describe JR_MULTI_FRM_ADDR Message has multiple From Email addresses ## Leading/Trainling Spaces in Email address field ## header JR_FROM_ADDR_SPACE From:addr =~ /\s/ describe JR_FROM_ADDR_SPACE From has a space in it score JR_FROM_ADDR_SPACE 10.0 ## No whitespace separation betwen name and address fields ## header __JR_FROM_NO_SPACE1 X-Mailer =~ /MarshallSoft/ header __JR_FROM_NO_SPACE2 From:raw =~ /\w\<[A-z0-9_\-\.]+\@(.*\.)?[A-z\-_0-9]{2,40}\.[A-z]{2,8}\>?$/i meta JR_FROM_NO_SPACE __JR_FROM_NO_SPACE2 && !(__JR_FROM_NO_SPACE1) describe JR_FROM_NO_SPACE No space between From Name and
parts score JR_FROM_NO_SPACE 5.0 ## Extracting From: JR_HDR_FROM.cf ## ## From name ends in @ sign ## header JR_FROM_ENDS_WITH_AT From:name =~ /^.*\@$/ score JR_FROM_ENDS_WITH_AT 10.0 describe JR_FROM_ENDS_WITH_AT Jared Rulez| JR_HDR_FROM.cf ## From name has two @ signs ## header JR_FROM_DOUBLE_AT From:raw =~ /.*\@\@(.*\.)?[A-z\-_0-9]{2,40}\.[A-z]{2,8}\>?$/i describe JR_FROM_DOUBLE_AT From address has double <\@> signs score JR_FROM_DOUBLE_AT 10.0 ## Extracting From: JR_HDR_FROM.cf ## ## Sextortion/Scam RECORDED YOU messages ## header JR_FROM_IKNOW From =~ /^(RecordedYou|SaveYou|SaveYourself|IKnow|RECORDED_YOU|MASTER)\d{2,3}\@\d{4,5}\.com/ describe JR_FROM_IKNOW I RECORDED YOU spams score JR_FROM_IKNOW 7 ## Extracting From: JR_HDR_GEN.cf ## ## Long Subject Strings (>35 characters) ## header JR_SUBJ_LONG_STRING Subject =~ /[\S]{45,}\s/ describe JR_SUBJ_LONG_STRING Long contiguous string detected n Subject header score JR_HDR_GEN_LONG_STRING 0.8 ## Love Bug/Loveletter worm ## header JR_LOVEBUG Subject =~ /ILOVEYOU/ describe JR_LOVEBUG Love Bug/Loveletter virus infection score JR_LOVEBUG 20 ## Viral-replicated Messages ## header JR_REPLICATE1 Subject =~ /Snowhite\sand\sthe\sSeven\sDwarfs\s\-.*|BubbleBoy\sis\sback\!|Million\sEmail\sAddresses|Million\sFresh\sEmail\sAddresses|Make\sMoney\sIn\sYour\sSleep\!|ENLARGE\sYOUR\sPACKAGE|Hot\sCelebs/ describe JR_REPLICATE1 Subject indicates viral-replicated content score JR_REPLICATE1 20 ## Extracting From: JR_HDR_FROM.cf ## ## Spammy Envelope Headers ## header JR_ENVELOPE_FROM EnvelopeFrom =~ /^[<]?(RuGirls|coatfloor|iminur|renttoown|Bureau[\-\._]?center|subwayresturants|coatfloor|psychology|adtdealer|fixit|home\-pros|autoclearance|process|Top[\-\._]?Lenders|freescore|ecig|supporting|NoPhoneBills?|fordclearance|green|bedbugs|thinforlife|delllaptop|mothersdayspecials?|wizpath|mothersflower|autoextended|saledaily|maturedating|LocalDeals|claims[\-\._]?dept[0-9]{3,4}|moneytoday|proflight|Consolidate[\-\._]?Debt|Social[\-\._]?Security[\-\._]?Disability|TermLife[\-\._]?Insurance|X\-RayTechnician|autoreduce|insured|3d\-flight|data\.bbb|FamilyEdu|Lower[\-\._]?Your[\-\._]?Bills|Home[\-\._]?Living|Home[\-\._]?Shield|EnergyProfitToday|PowerOpp|Alcohol[\-\._]?Rehab|Mortgage[\-\.-_]?Quotes?|Anataflex|Fingerhut[\-\._]?Partner|FibromyalgiaInfo|InfoOnAlzheimers|RingJewelers|NationalAssociationofBusinessProfessionals|Gourmet[\-\._]?Gift[\-\._]?Baskets|Fingerhut\-Friends|LightAngel|Dental[\-\._]?Insurance|Security[\-\._]?Cameras?|Fingerhut\-Affiliate|GiftBaskets?|Harp\-Mortgage|UniversityOfPhoenix|Money\-for\-Seniors|HeartAttackFighter|SkiVacations|TVsFamilyBibleFilmsDVD|Ashley[\-\._]?Madison[\-\._]?Agent|Reverse[\-\._]?Mortgage|Penny[\-\._]?Stock[\-\._]?Alert|Fidelity[\-\._]?Life|Neuropathy|Pro[\-\._]?Flowers|Steaks[\-\._]?Online|CruiseAlaska|carshield_auto_protection|choose[\-\._]?your[\-\._]?mortgage\-|betterbutterspreader\.com\-|salebetterbutterspreader\.com\-|meetasianlady\.com\-|quickenloans[\-\._]?affiliate\-).*\@/i header JR_ENVELOPE_FROM_A EnvelopeFrom =~ /^[<]?(RuGirls|coatfloor|iminur|renttoown|Bureau[\-\._]?center|subwayresturants|dibzees|adtdealer|home\-pros|autoclearance|process|Top[\-\._]?Lenders|freescore|NoPhoneBills?|fordclearance|specialoffers?|bedbugs|thinforlife|delllaptop|mothersdayspecials?|wizpath|mothersflower|autoextended|saledaily|maturedating|LocalDeals|claims[\-\._]?dept[0-9]{3,4}|moneytoday|proflight|Consolidate[\-\._]?Debt|Social[\-\._]?Security[\-\._]?Disability|TermLife[\-\._]?Insurance|X\-RayTechnician|autoreduce|3d\-flight|data\.bbb|FamilyEdu|Lower[\-\._]?Your[\-\._]?Bills|Home[\-\._]?Living|Home[\-\._]?Shield|EnergyProfitToday|PowerOpp|Alcohol[\-\._]?Rehab|Mortgage[\-\.-_]?Quotes?|Anataflex|Fingerhut[\-\._]?Partner|FibromyalgiaInfo|InfoOnAlzheimers|RingJewelers|NationalAssociationofBusinessProfessionals|Gourmet[\-\._]?Gift[\-\._]?Baskets|Fingerhut\-Friends|LightAngel|Dental[\-\._]?Insurance|Security[\-\._]?Cameras?|Fingerhut\-Affiliate|GiftBaskets?|Harp\-Mortgage|UniversityOfPhoenix|Money\-for\-Seniors|HeartAttackFighter|SkiVacations|TVsFamilyBibleFilmsDVD|Ashley[\-\._]?Madison[\-\._]?Agent|Reverse[\-\._]?Mortgage|Penny[\-\._]?Stock[\-\._]?Alert|Fidelity[\-\._]?Life|Pro[\-\._]?Flowers|Steaks[\-\._]?Online|CruiseAlaska|carshield_auto_protection|choose[\-\._]?your[\-\._]?mortgage\-|betterbutterspreader\.com\-|salebetterbutterspreader\.com\-|meetasianlady\.com\-|quickenloans[\-\._]?affiliate\-|administartor).*\@/i header JR_ENVELOPE_FROM1 EnvelopeFrom =~ /^[<]?(touchfire|Horoscope|laissez|cable[\-\._]?service|roof[\-\._]?repair|seohelpdesk|Regenerate[\-\._]?Skin|FHARateLock|Your[\-\._]?Rate[\-\._]?Tips|Online[\-\._]?Doctorate|Mortgage[\-\._]?Rate[\-\._]?Lock|FlexSealFeatures|SuccessKit|home[\.\-_]solar|solar[\.\-_]saving|HealthNew|HealthCare|HolisticHealth|DailyHealth|HealthTips|Natural[\-\._]?Health|Healthy[\-\._]?Life|Healthy[\-\._]?Living|Health[\-\._]?Secret|peripheralneuro|diabeticneuro|nervepain|VARateLock|Brain[\-\._]?Essential|ExclusiveInvitation|Best[\-\._]?Performing|People[\-\._]?Search|Revitalize[\-\._]?Your|Spine[\-\._]?Doctor|Phone\-|Consolidate[\-\._]?Debt\-|Business[\-\._]?Funding|Corporate[\-\._]?Loans\-|Home[\-\._]?Security|AllInclusiveVacation\-|StartupBusiness\-|OnlineDoctorate\-|CertifiedNursingAssistantEducation|Detox\-|WalkinTub\-|Small[\-\._]?Business[\-\._]?Loan|MedicalBillingandCoding|Business[\-\._]?Phone[\-\._]?System\-|Free[\-\._]?Cell[\-\._]?Phone|publicrecords|Replacement[\-\._]?Window|Russia[\-\._]?Women|TrackR|esurface|WhosWho|Russian[\-\._]?Beauty[\-\._]?Online|endcancer\-|emcc\-|fide\-|thank[\-\._]?you[\-\._]?from[\-\._]?shopper[\-\._]?reward|ac[\-\._]?heating[\-\._]?specials|cvs[\-\._]?pharmacy[\-\._]?dollars[A-Za-z0-9\.\=\-_]{0,30}|open[\-\._]?coverage|petmerch|flight\.alert|seatravel|tire[\-\._]?coupon|new[\-\._]?tire|cruise(critic|finder)|(us|coverage|open)\.enrollment|open\.coverage|us\.care|daily[\-\._]?cruise|First[\-\._]?bank[\-\._]?of[\-\._]?nigeria|snxutxjap|sistemreminderwwasd|confrimation\-pymentbiling|terminix[\-\._]?pest[\-\._]?control[\-\._]?experts)/ header JR_ENVELOPE_FROM1A EnvelopeFrom =~ /^[<]?(touchfire|Horoscope|laissez|cable[\-\._]?service|roof[\-\._]?repair|seohelpdesk|Regenerate[\-\._]?Skin|FHARateLock|Your[\-\._]?Rate[\-\._]?Tips|Online[\-\._]?Doctorate|Mortgage[\-\._]?Rate[\-\._]?Lock|FlexSealFeatures|SuccessKit|home[\.\-_]solar|solar[\.\-_]saving|HealthNew|HealthCare|HolisticHealth|DailyHealth|HealthTips|Natural[\-\._]?Health|Healthy[\-\._]?Life|Healthy[\-\._]?Living|Health[\-\._]?Secret|peripheralneuro|diabeticneuro|nervepain|VARateLock|Brain[\-\._]?Essential|ExclusiveInvitation|Best[\-\._]?Performing|People[\-\._]?Search|Revitalize[\-\._]?Your|Spine[\-\._]?Doctor|Phone\-|Consolidate[\-\._]?Debt\-|Business[\-\._]?Funding|Corporate[\-\._]?Loans\-|Home[\-\._]?Security|AllInclusiveVacation\-|StartupBusiness\-|OnlineDoctorate\-|CertifiedNursingAssistantEducation|Detox\-|WalkinTub\-|Small[\-\._]?Business[\-\._]?Loan|MedicalBillingandCoding|Business[\-\._]?Phone[\-\._]?System\-|Free[\-\._]?Cell[\-\._]?Phone|publicrecords|Replacement[\-\._]?Window|Russia[\-\._]?Women|TrackR|esurface|WhosWho|Russian[\-\._]?Beauty[\-\._]?Online|endcancer\-|emcc\-|fide\-|thank[\-\._]?you[\-\._]?from[\-\._]?shopper[\-\._]?reward|ac[\-\._]?heating[\-\._]?specials|cvs[\-\._]?pharmacy[\-\._]?dollars[A-Za-z0-9\.\=\-_]{0,30}|new[\-\._]?tire|cruise(critic|finder)|(us|coverage|open)\.enrollment|open\.coverage|us\.care|daily[\-\._]?cruise).*\@/i score JR_ENVELOPE_FROM1A 5.5 header JR_ENVELOPE_FROM2 EnvelopeFrom =~ /^[<]?(RachaelMinus|Treat[\-\._]?Osteoporosis|Mortgage[\-\._]?Refinance|Russian[\-\._]?Women|myPCBackup|sgjrelation|medicare[\-\._]?insurance[\-\._]?coverage|Russian[\-\._]?GirlForU|oizgizala|\{\%FROMNAME\%\}[0-9]{2,3}|warby[\-\._]parker\[\-\._]promo|msg[0-9]{9,11}\@|IMFFUNDS\@|meetasianlady\.com|terminix\-affiliate|mutual\-of\-omaha\-mortgage|Mutual\sof\sOmaha\sMortgage|chooseyourmortgage[\-\._]affiliate|quicken\-loans\-mortgage\-partner|goldalliedtrustcom|livewire_insurance|lifequote[\-._]selectquote\.com|quicken[\-\._]loans[\-\._]affiliate|bright_lights_solar|affiliate_renewal_by_andersen|quickenloanscom\-ad\-partner|quickenloanscom_affiliate|solarbright[\-._]floodlights|quickenloanscom[\-\._]ad[\-\._]partner|renewalbyandersen|terminix_affiliate|bright[\-\._]?lights[\-\._]?solarbrightfloodlight[\-\._]?com|quickenloanscom[\-\._]?affiliate|quicken[\-\._]?loans[\-\._]?partner|empire[\-\._]?today[\-\._]?partner|americanhomewarranty\.com|noreplyn0repply|quicken_loans_info|terminix[\-\._]?affiliate|terminix[\-\._]?pest[\-\._]?control[\-\._]?expert|supportmailingsinformation\-|mailserviceauto\-group)/ header JR_ENVELOPE_FROM2A EnvelopeFrom =~ /^[<]?(RachaelMinus|Treat[\-\._]?Osteoporosis|Mortgage[\-\._]?Refinance|Russian[\-\._]?Women|myPCBackup|sgjrelation|medicare[\-\._]?insurance[\-\._]?coverage|Russian[\-\._]?GirlForU|oizgizala|\{\%FROMNAME\%\}[0-9]{2,3}|warby[\-\._]parker\[\-\._]promo|msg[0-9]{9,11}\@|IMFFUNDS\@|meetasianlady\.com|terminix\-affiliate|mutual\-of\-omaha\-mortgage|Mutual\sof\sOmaha\sMortgage|chooseyourmortgage[\-\._]affiliate|quicken\-loans\-mortgage\-partner|goldalliedtrustcom|livewire_insurance|lifequote[\-._]selectquote\.com|quicken[\-\._]loans[\-\._]affiliate|bright_lights_solar|affiliate_renewal_by_andersen|quickenloanscom\-ad\-partner|quickenloanscom_affiliate|solarbright[\-._]floodlights|quickenloanscom[\-\._]ad[\-\._]partner|renewalbyandersen|terminix_affiliate|bright[\-\._]?lights[\-\._]?solarbrightfloodlight[\-\._]?com|quickenloanscom[\-\._]?affiliate|quicken[\-\._]?loans[\-\._]?partner|empire[\-\._]?today[\-\._]?partner|open[\-\._]?coverage|petmerch|flight\.alert|seatravel|tire[\-\._]?coupon|americanhomewarranty\.com|solarbright[\-\._]?floodlights|zunmedyphionu|noreplyn0repply|quicken_loans_info|terminix[\-\._]?affiliate|terminix[\-\._]?pest[\-\._]?control[\-\._]?expert|admin\.securityservices|ultimate\.offers\.program|customer\.card\.invite|precise\.mini\.engraver|walmart\.support|needed\.trip|carshield[\-\._]?vehicle[\-\._]?coverage|MakeHerpesVanish).*\@/i header JR_ENVELOPE_FROM3A EnvelopeFrom =~ /^[<]?(info\-mailsecurity\.no\-reply|amerisave[\-\._]?mortgage[\-\._]?corporation\-|easycanvasprintscom[\-\._]?ad[\-\._]?partner|empire[\-\._]?today[\-\._]?affiliate|solarbrightfloodlightcom_|First[\-\._]?bank[\-\._]?of[\-\._]?nigeria|snxutxjap|sistemreminderwwasd|confrimation\-pymentbiling|terminix[\-\._]?pest[\-\._]?control[\-\._]?advisors|mini[\-\._]swamp[\-\._]cooler[\-\._]|avant[\-\._]credit[\-\._]card[\-\._]|instacooler[\-\._]?product[\-\._]?offer|actionautosales[\-\._]leads|instacooler[\-\._]?portable[\-\._]?fan|ethos_life_help\-|shop[\-\._]?instacooler\-|leaffilter\.promo\-|empire[\-\._]?today[\-\._]?partner\-|airdoctor[\-\._]?affiliate\-|instacooler[\-\._]?product\-|shop[\-\._]?instacooler\-|choose[\-\._]?your[\-\._]?mortgage\-|instacooler[\-\._]?network\-|bathroom[\-\._]?remodeling[\-\._]?contractors|Huusk[\.\-_]Knives|genexa\-sleep\-aid|expert\.windows\-|terminix\.pest\.control\-|american[\-\._]?home[\-\._]?shield[\-\._]?affiliates\-|expert_windows\-|leaf[\-\._]?filter[\-\._]?com[\-\._]?affiliate\-|american[\-\._]?home[\-\._]?shield[\-\._]?warranty\-|usps[\-\._]?gift[\-\._]?team[\-\._]?sales\=|mini[\-\._]?swamp[\-\._]?cooler\-|be[\-\._]?sure[\-\._]?with[\-\._]?the_shield[\-\._]?ahs\-|first[\-\._]?american[\-\._]?home[\-\._]?warranty\-|terminix[\-\._]?partner\-).*\@/i header JR_ENVELOPE_FROM4A EnvelopeFrom =~ /^[<]?(customerservicesummaryreport[0-9]{6}\-|oc\-card\-co\-jp|sharperinsurance[\-_\.]manager\-|vivint[\-_\.]security[\-_\.]provider\-|quicken[\-_\.]loans[\-_\.]info\-|account\+team|fall[\-_\.]windowdeals\-|instahard[\-_\.](ed|performance|promo|erections)\-|get[\-_\.]instahard\-|smart[\-_\.]home[\-_\.]security\-|bathroom[\-_\.]remodeling[\-_\.]estimates\-|terminix[\-_\.]pest[\-_\.]control\-|instahard\-promo\-|getinstahard\.com\-|homeowner[\-_\.]offers\-|quickenloanscom[\-_\.]partner\-|new[\-_\.]virtual[\-_\.]consultation\-|carshield[\-_\.]usa\-|get[\-_]instahard\-|endure[\-_\.]instahard\-|instahard\-|amerisave[\-_]mortgage[\-_]corporation\-|amerisave[\-_]wholesale[\-_]mortgage[\-_]solutions\-|vivintpremierprovider\-|(smart|us)[\-_\.]home[\-_\.]security[\-_\.](summer|fall|winter|spring)[\-_\.]offer\-|endure[\-_\.]instahard\-|national[\-_\.]family[\-_\.]assurance[\-_\.]offer\-|nationalfamily[\-_\.]com\-|health[\-_\.]usa\-|earwax[\-_\.]cleaner\-|military[\-_\.]veteran[\-_\.]savings\-|provide[\-_\.]insurance[\-_\.]insurance[\-_\.]savings\-|welcome[\-_\.]to[\-_\.]remote[\-_\.]consultations\-|renewal[\-_\.]by[\-_\.]andersen[\-_\.]lowe\-|home[\-_\.]warranty[\-_\.]ahs\-|instahard[\-_\.]partner\-|mysenior[\-_\.]perks\-|get[\-_\.]simple[\-_\.]home[\-_\.]quotes\-|adt[\-_\.]security\-).*\@/i header JR_ENVELOPE_FROM5A EnvelopeFrom =~ /^[<]?(easy[\-_\.]home[\-_\.]projects\-|joint[\-_\.]pain[\-_\.]remedy\-|Gutter[\-_\.]?Guardian|Gift[\-_\.]?Card[\-_\.]?Promo|blood[\-_\.]?pressure[\-_\.]?fix\-|avant[\-_\.]credit[\-_\.]card\-|avant[\-_\.](mastercard|card[\-_\.]offer)\-|neck[\-_\.]relaxer[\-_\.]pro\-|joint[\-_\.]?restore[\-_\.]?gummies\-|muamaryoko|DHL\-PACKAGE\-DHL\-SHIPMENT\-EXPRESS\-TRACKING\-PARCEL|harbourmaster_olvia|ypercallcenter|comfortableshoes|ultramanifestation|mortgage\.net\-|solarbrightfloodlightcom[\-_\.]?secure[\-_\.]?home\-|blue\-sky\-auto\-|myseniorperks\-|hormonalweightgain|knee[\-_\.]?pain[\-_\.]?relief\-|mortgagenet[\-_\.]?affiliate\-|avoid\-melatonin\-|found\-money\-guide\-|hot[\-_\.]?russia[\-_\.]?babes\-|havenlife\.insurance\-|select[\-_\.]my[\-_\.]policy\-auto\-|solarbright[\-_\.]floodlights\-|meet[\-_\.]?asian[\-_\.]?lady\-|remote[\-_\.]consultations[\-_\.]available-|ukraine[\-_\.]?beauty\-|ukraine[\-_\.]?brides[\-_\.]?4[\-_\.]?you\-|one_loan_stop\-|canvas_prints_promo\-|meet[\-_\.]?hot[\-_\.]?russian\-|mortgagenet[\-_\.]refinance\-|outlo0k_service|MYLIFEINSURANCEOPTIONS|MelsmodelhorsesCom|new_habits_news\-|Find[\-_\.]?Russian[\-_\.]?Girls|costco[\-_\.]success\-|local[\-_\.]pharma\-|cvs[\-_\.]today\-|sams[\-_\.]gifts[\-_\.]vouchs\-|blissy[\-_\.]affiliate\-|KetoChallenge|dothisdaily|doctorsshocked|prostate911).*\@/i header JR_ENVELOPE_FROM6A EnvelopeFrom =~ /^[<]?(singlecolombian\-|colombian[\-_\.]girls\-|ukrainian[\-_\.]beauties|beautiful[\-_\.]latin[\-_\.]girls|befreeofyourtimeshare|back\-to\-life\-|choice[\-_\.]home[\-_\.]warranty\-|medicare[\-_\.]providers\-|my\-tactical\-drone\-|homelight[\-_\.]partner\-|WalgreensOpinionRequested|FixBloodSugarProblems|lowbackpain|supplement[\-_\.]hydrossential|match[\-_\.]seniors[\-_\.]elite[\-_\.]dating|vivintoffers[\-_\.]affiliate\-|meet[\-_\.]latin[\-_\.]woman|CuteRussianWoman|KohlsShopperGiftCardChance|cute\-?russian\-?lady\-|you[\-_\.]were[\-_\.]nominated\-|professional[\-_\.]recognition\-|date[\-_\.]?senior[\-_\.]?russian\-|singleflirt\-|your[\-_\.]?ukrainian[\-_\.]?girl\-|ukrainian[\-_\.]beauties\-|meet[\-_\.]?latin[\-_\.]?woman\-|audiobooks\-|silversingles[\-_\.]?offer\-|russian[\-_\.]?beauty\-|hot[\-_\.]?russian[\-_\.]?babes\-|latin[\-_\.]?beauty\-|ukraine[\-_\.]?brides\-|find[\-_\.]?russia[\-_\.]?brides\-|clean[\-_\.]?zone[\-_\.]?deal\-|ukrainian[\-_\.]?girls[\-_\.]?for[\-_\.]?u|find[\-_\.]?ukrainian[\-_\.]?love|exotic[\-_\.]?ukrainian[\-_\.]?women|gold[\-_\.]?allied[\-_\.]?trust[\-_\.]?(retirement|offer)\-|smart[\-_\.]?timeshare[\-_\.]?owner|huusk[\-_\.]?knives[\-_\.]?offer|canvasprints[\-_\.]ad|easy[\-_\.]?canvas[\-_\.]?discounts|home[\-_\.]light\-|singlecolombian\-|high[\-_\.]?flying[\-_\.]?team\-).*\@/i header JR_ENVELOPE_FROM7A EnvelopeFrom =~ /^[<]?(light[\-_\.]?haus[\-_\.]usa[\-_\.]affiliate\-|enence[\-_\.]translator\-|renewal[\-_\.]?by[\-_\.]?andersen[\-_\.]?(facts?|deals?|affiliate|replacements?|network|partner)\-|getinstahard[\-_\.]?com[\-_\.]?help\-|necformulahelp[\-_\.](case|trial|lawsuit)|huusk\-[A-z]{2,20}\=[A-z\-_0-9]{2,40}\.[A-z]{2,8}|bathroom[\-_\.]remodel\-|holiday[\-_\.]?gifts[\-_\.]?wallet[\-_\.]?guru\-|windows[\-_\.]?by[\-_\.]?renewal[\-_\.]?by[\-_\.]?andersen\-|renewal[\-_\.]?by-andersen[\-_\.]?\-|bathroom[\-_\.]remodeler\-|canvas[\-_\.]?prints[\-_\.]?(affiliate|promo)\-|leaffilter[\-_\.](affiliate|partner|network|deals|offer|advertisement)\-|life[\-_\.]?line[\-_\.]?screening[\-_\.]?(partner|affiliate|network|deals?|offer)\-|harrys[\-_\.]offer\-|affordable[\-_\.]heater\-|easy[\-_\.]?canvas[\-_\.]?(affiliate|partner|network|deals|offer)\-|holiday[\-_\.]?gifts[\-_\.]?from[\-_\.]?wallet[\-_\.]?guru\-|gadgets[\-_\.]?laboratory\-|portable[\-_\.]?heater[\-_\.]?max[\-_\.]?heater[\-_\.]?pro\-|?$/i describe JR_COLLEGE_SPAM1 Envelope-From contains Username_dot_EDU addresses seen in spam score JR_COLLEGE_SPAM1 10 ################### OLEVBMacro Plugin ################### #OLE/VB MACROs : From Kevin McGrail (KAM) Rules # Modified for Business Environment # Replaced PDS_FROMNAME_SPOOFED_EMAIL with __PDS_FROM_2_EMAILS ifplugin Mail::SpamAssassin::Plugin::OLEVBMacro # increase number of mime parts checked olemacro_num_mime 8 olemacro_max_file 2048000 # skip psd and other files from macro checks olemacro_skip_exts (?:dotx|potx|ppsx|pptx|psd|sldx|xltx|oxps)$ if (version >= 3.004005) body KAM_OLEMACRO eval:check_olemacro() describe KAM_OLEMACRO Attachment has an Office Macro score KAM_OLEMACRO 0.5 body KAM_OLEMACRO_MALICE eval:check_olemacro_malice() describe KAM_OLEMACRO_MALICE Potentially malicious Office Macro score KAM_OLEMACRO_MALICE 10.0 body KAM_OLEMACRO_ENCRYPTED eval:check_olemacro_encrypted() describe KAM_OLEMACRO_ENCRYPTED Has an Office doc that is encrypted score KAM_OLEMACRO_ENCRYPTED 5.0 #This may cause more CPU usage olemacro_extended_scan 1 olemacro_exts ((?:doc|docx|dot|one|pot|ppa|pps|ppt|rtf|sldm|xl|xla|xls|xlsx|xlt|xltx|xslb)$) body KAM_OLEMACRO_RENAME eval:check_olemacro_renamed() describe KAM_OLEMACRO_RENAME Has an Office doc that has been renamed score KAM_OLEMACRO_RENAME 2.5 meta GB_OLEMACRO_REN_VIR ( KAM_OLEMACRO_RENAME && FORGED_OUTLOOK_HTML ) describe GB_OLEMACRO_REN_VIR Olemacro and fake Outlook score GB_OLEMACRO_REN_VIR 10 if (version >= 3.004006) if (version >= 4.000000) # olemacro_download_marker ((?:cmd(?:\.exe)? \/c ms\^h\^ta ht\^tps?:\/\^\/)|SysWow.{1,15}\s.{1,5}RETURN|RET.{1,4}URN.{1,25}\.exe) olemacro_download_marker ((?:cmd(?:\.exe)? \/c ms\^h\^ta ht\^tps?:\/\^\/)|SysWow.{1,15}\s.{1,5}RETURN|RET.{1,4}URN.{1,25}\.exe|powershell\s+Invoke\-WebRequest) endif #NO good reason to add a "cmd.exe" invocation inside an Excel file. body GB_OLEMACRO_DOWNLOAD_EXE eval:check_olemacro_download_exe() describe GB_OLEMACRO_DOWNLOAD_EXE Malicious code inside the Office doc that tries to download a .exe file detected score GB_OLEMACRO_DOWNLOAD_EXE 10 endif endif body KAM_OLEMACRO_ZIP_PW eval:check_olemacro_zip_password() describe KAM_OLEMACRO_ZIP_PW Has an Office doc that is password protected in a zip score KAM_OLEMACRO_ZIP_PW 5.0 body KAM_OLEMACRO_CSV eval:check_olemacro_csv() describe KAM_OLEMACRO_CSV Macro in csv file score KAM_OLEMACRO_CSV 10.0 meta KAM_OLEMACRO_ZIP_BOT ( KAM_OLEMACRO_ZIP_PW && ( MISSING_MID || __PDS_FROM_2_EMAILS ) ) describe KAM_OLEMACRO_ZIP_BOT OLE macro sent by a bot / ratware score KAM_OLEMACRO_ZIP_BOT 10.0 if (version >= 4.000000) if can(Mail::SpamAssassin::Plugin::OLEVBMacro::has_olemacro_redirect_uri) body OLEMACRO_URI_TARGET eval:check_olemacro_redirect_uri() describe OLEMACRO_URI_TARGET Code inside the Office doc that tries to redirect to an uri score OLEMACRO_URI_TARGET 0.001 endif if can(Mail::SpamAssassin::Plugin::OLEVBMacro::has_olertfobject) body OLEMACRO_RTF eval:check_olertfobject() describe OLEMACRO_RTF Rtf file embedded in an Office document score OLEMACRO_RTF 0.01 endif endif endif ############### BODY PHRASES AND ATTACHMENTS ############## ## CREATING RULES: JR_EXPLOIT.cf ## ## Setting up body phrase rules: Payment/Invoice schemes ## body T_JR_OPEN_ME_A /It\swas\sscanned\sand\ssent\sto\syou\susing\sa\sSamsung\sMFP\.|Inserted\sare\sthe\sthree\sinvoices\sthat\sneed\sto\sbe\scorrected|View\sThe\sEnclosed\sAttached\sAnd\sRedeem\sYour\sReward\.|I\sam\sattaching\sthe\sinvoice\syou\sasked\sme\son\sthe\sphone\.|invoice\sfor\spayment\sin\srespect\sof\sthe\sservice\sduring|Kindly\sview\sthe\sattached|Find\sthe\sattached\sswift\scopy\spayment\sreceipt|Please\sreview\sthe\sattached\sacknowledgement\sreport|Please\ssend\sus\sinvoice\sfor\sthe\sattached\sorder\,\splease\sconfirm\sorder|Please\sgive\sme\sthe\squote\sfor\sthe\slisted\sitems\sin\sthe\sattached\sPO|You\sreceived\sa\sPayPal\spayment\.\slogin\shere:|send\svia\sMAERSKLINE\sattached\.|update\sprofile\simmediately\sby\sdownloading\sthe\sattached\sfile|Please\scheck\sthe\sscreenshot\si\shave\sattached\sand\stell\sme|You\scan\sfind\sthe\ssubpoena\sattached\.|Please\sopen\sthe\sattached\sdocument\.\sIt\swas\sscanned|Please\sfind\sattached\sbelow\sthe\spayment\scopy\sfor\syour\sconfirmation\.|advise\sthe\sbest\sprice\sand\sdelivery\sfor\sthe\sitems\sas\sper\sthe\sbelow\sattached\srequisition|^Follow\sthe\sattached\sinstruction(\W|$)|Please\squote\syour\slowest\sprice\salong\swith\scatalogue\sfor\sthe\sfollowing\sattached\sitems\.|Kindly\sfind\sthe\sattachment\sfor\syour\saccount\sdept\./m body T_JR_OPEN_ME_B /Access\sattached\sdocument\sto\sread\.|Enclosed\sis\sour\scompany\srequirement\,\splease\ssend\sus|Attached\sherewith\sbalance\sof\spayment\scopy\sfor\syour\sreference|^View\sattached\sdocument\sfor\smore\sinformation\.|CLOSING\sDATE\sFOR\sPURCHASE\sOF\sTENDER\sDOCUMENT:|reconfirm\syour\saccount\sdetails\sin\sthe\sattachment\sif\sits\scorrect|Download\sthe\sattached\sTCC\,\sYour\sofficial\sTCC\sNumber\sis|kindly\ssee\sthe\sattached\smy\sproposal\sCharities\sdonation|Await\syour\sresponds|we\scan\sproceed\swith\sadvance\spayment|Please\srefer\sto\sthe\sattached\sPO\sand\sadvise\sthe\sdelivery\sdate\.\sThank\syou|Attached\sfor\syour\simmediate\saction\sis\sthe\sabove\sreferenced\sPurchase\sOrder\sMaster\sDocument\.|subscription\son\syour\'\saccount\sin\sthe\sattachment|As\sper\sour\sdiscussion\,\skindly\sfind\sthe\sattached\sProof\sOf\sPayment|Some\simportant\sdocs\shas\sbeen\ssent|Million\,\sOpen\sthe\sattached\sfile|Please\sadvise\sclearance\sstatus\sfor\sattached\sshipment\.|Kindly\sfind\sattache?d\sTechnical\sRequirements|Invoice\sand\sdo\sthe\sneedful|Download\sproof\sof\spayment\/Pro\-Forma\sInvoice|please\svisit\sattached\sto\sview\syour\spackage\sdetails|attached\sreport\sfor\sthe\sapproved\swire\stransfer|Kindly\,\sprepare\syour\sproform\sinvoice\swith\sour\sorder\snumber\safter\sconfirmation/m body T_JR_OPEN_ME_C /we\sneed\sto\sknow\sthe\sbelow\sattached\sprice\slist|See\sattached\sorder\!|Our\sOrder\-Sheet\shas\sbeen\suploaded\sin\sOneDrive\,\sfor\syou\sto\sdownload\seasily|open\sattach\sdocument|Attached\sis\syour\sinvoice\sfor\sInvoice|(Can|can)\syou\shandle\sthis\sproject\,?\sview\s(this\s)?attachment\sfor\sdetail|Please\ssee\sattached\spayment\sdetails|Attached\sis\sthe\sPayment\sDetails\swe|shared\swith\syou\svia\sdropbox\sapp|I\sshare\sthe\simages\sof\sshipping\sdocuments|please\slook\sinto\sattached\srevised\sinvoice\sand\scheck\sthe\samendment|photos\sand\squestionnaire\sare\sattached|find\sattached\smy\sresume\swith\smy\swork\sand\scompetition\sexperience|Please\sfind\sattached\sRemittance\sPayment\sAdvise\sof|Please\ssave\sthe\sattached\sfile\sto\syour\shard\sdrive|Attached\sare\sthe\slatest\sstatements\sreceived\sfrom\syour\sbank|Please\sreview\sthe\sattached\sCBE\sform|find\sattached\sour\sinvoice\sfor\syour\sattention\s\-\spayment|Kindly\sconfirm\sthat\sthe\sstated\sprices\sare\scorrect\.|Attached\sis\sa\sEstimate\/Invoice|You\shave\sa\snew\sdocument\sshared|Read\sAttached\sBusiness\sProposal|Kindly\sRe\-confirm\sthe\sattached\sproforma|attached\sbill\sof\slading\sto\sverify\sthat\severything\sis\scorrect|^looking\sforward\sto\syour\svaluable\sreply\./m body T_JR_OPEN_ME_D /Kindly\sopen\sthe\sattachment\sand\ssend\sback\sthe\srevised\sPI|Can\sMake\sProvission\sfor\sthe\sattached\sOrder|We\sneed\squotation\sfor\sthe\sbelow\spurchase\sorders\.|We\swould\srequest\syou\sto\splease\sdo\sacknowledge\sthe\sfund\sreceipt\sonce\safter\sBank|Attached\sI\swould\slike\sto\shave\sa\sfew\smain\stypes\sof\ssteel\spipe|can\syou\splease\sconfirm\sif\sthe\sattached\sinvoice\shas\sbeen\sissued\sby\syou|The\spassword\sfor\sthe\sdocument\sis\s1234|kindly\squote\sthe\slisted\sproduct\sas\sattached\sin\sthe\sdocument|our\sproduct\sspecification\sorder\sfor\sthe\sactual\sproduct\sneeded|below\sattached\sone\sshows\sas\sBill\sof\sLading|PLEASE\sREAD\sATTACH\sLETTER\sFOR\sYOUR|We\swant\sto\sbuy\sthis\sattached\sproduct\sfrom\syour\scompany|give\sme\sa\svery\sgood\sprice\squote\sfor\sattached\srequested\sproducts|Attached\sis\sour\sNew\sOrder\sbeing\sthe\sfirst\sOrder|Further\sto\sthis\stransfer\swe\shave\smade\san\sNEFT\stransfer|Please\,\scheck\sattached\sagreement\,\sand\ssend\sme\sback\ssigned\sand\sstamped\scopy|Please\sfind\sour\surgent\sInquiry\sand\sPurchase\sOrder\sattached\.|view\sPurchase\sOrder\swhich\sour\scustomer\sneed\surgent|sending\sattached\sherewith\sthe\sswift\spayment\sslip|Kindly\sSee\sAttachment\sfor\sover|Please\sfind\sattached\stelegraphic\stransfer\scopy/m body T_JR_OPEN_ME_E /We\sare\sso\smuch\sinterested\sin\spurchasing\syour\sproducts|Kindly\squote\sus\syour\sbest\sprice\sfor\sthe\sattached\srequirement|attached\sscanned\simage\sfor\s+request\sfor\squotation|Please\srefer\sto\sthe\srevised\spurchase\sorder\sattached\sfor\syour\sconfirmation|agreed\sthat\syour\sinheritance\/contract\spayment\ssum|the\sshipment\sby\syour\sself|charity\sof\syour\schoice\sany\swhere\sin\sthe\sworld|Pls\sfind\sbelow\sorder\sform\sSaadat\sas\sattached|Please\sFind\sattached\sOrder\sSheet\sand\sQuotation\sfor\syour\sreference|Please\sfind\sthe\sattached\stransfer\sslip\sfrom\sour\sbank|We\s+require\s+to\s+purchase\s+the\s+following\s+as\s+per\s+attach\s+list|best\sprices\sand\savailability\sfor\sthe\sattached\ssubject\srequisition|Please\sfind\sthe\sattachment\sour\sQuotation\sas\syou\srequested\.|check\sour\sattached\spurchase\sorder\sand\ssend\sus\syour\sproforma\sinvoice|click\son\sattach\sfor\sfurther\sdetails|chosen\sby\slaw\sfor\sa\sRestitution|kindly\sprovide\sthe\sfollowing\sprice\sfor\sour\sofficial\sP\.O\.|Attached\sdraft\sbl\sfor\syour\sconfirmation|attached\scopy\sof\sPayment\sSwift\sReceipt|Please\semail\sus\sthe\sProforma\sInovice\s\/\spricing\surgently|Below\sis\sSlip\spayment\sfor\sUSD|your\sshipment\sEZ[0-9]{9,11}AU\sis\sstill\swaiting\sfor\sinstructions\sfrom\syou/m body T_JR_OPEN_ME_F /proceed\snew\sorder\s\-\sdelivery\saddress\s\-|The\spassword\sfor\sthe\sattached\sdocument\sis:\s1234|Please\sKindly\sfind\sthe\sattached\sPurchase\sOrder|Congratulations\;\sOpen\sAttachment|confirm\sthe\sbalance\sin\sorder\sand\sadvise\syour\sbank\sdetails\sfor\spayment\sprocess|Attached\sis\sa\scopy\sof\sthe\spayment\sslip\sfor\sthe\sprevious\sInvoice|Please\squote\syour\sbest\sprice\sand\searliest\sdelivery\stime\sfor\sthe\ssupply\son\sattached\sinquiry|business\sproposal\s+\(of\smutual\sgain\)|refer\sto\sthe\sattachment\sfor\sour\schoice\sof\sgoods|DETAILS\sare\sin\sthe\sattached\.|login\sverification\smight\sbe\srequire\sfor\sfirst\stime\suser|Please\sfind\sthe\sattached\spurchase\sorder\sand\sarrange|refer\sto\sthe\sattachment\sfor\sour\soffer|Please\scheck\sthe\sabove\sattachment\sfor\syour\sreference\.|wants\sthis\sproduct\sat\slea\-time\surgently|kindly\sconfirm\sAttached\sand\sget\sback\sto\sus\.|Kindly\sopen\sattached\sfor\sdetails\sregarding\sdonation\sfrom|Kindly\sconfirm\syour\spayment\sdetails\sbelow\sbefore\swe\ssend\sit|kindly\srequested\sto\ssend\sus\s+price\sCIF\slist\sfor\sthe\sattached\s+item|urgent\srequirement\sas\sper\sattached\ssamples|find\sagain\sattached\sour\sPO\sfor\snew\sorders\sand\salso|Please\,?\sfind\sattached\sour\spurchase\sOrder\sfor\syour\sconfirmation/m body T_JR_OPEN_ME_G /Attached\sis\sour\sorder\slist\salong\swith\sour\scompany\sprofile|we\shave\sattached\sthe\slist\sof\sproduct\swe\swant\sto\sorder|due\sto\sour\ssearch\sfor\sa\scompany\/individual|Attached\sherewith\sthe\spayment\sadvice\sfor\sreference\.|Have\syou\sconfirmed\sthe\sbelow\sproforma\sinvoice\?|Did\syou\shave\sa\schance\sto\scheck\sestimation\swe\shave\ssent\syou|Attached\sour\sRequest\sfor\sQuotation|Check\slast\sreport\sattached\.|I\shave\sattached\sthe\scurrent\sinvoice\sand\sthe\spassword\sfor\sthe\sdocument|DOWNLOAD\sPAYMENT\sPROOF\.|Acknowledgement\scopy\sas\sattached\sagainst\syour\sPurchase\sOrder|Read\sattached\sbusiness\sproposal|scanned\scopy\sof\sPurchase\sOrder\sKindly\sacknowledge\son\sreceipt|We\shad\sa\srequest\sfor\ssome\sproducts\sin\sattachment|enclosed\sthe\squotation\sfor\syour\srefrence|P\-a\-s\-s\-w\-o\-r\-d|i\srefer\sto\sthe\sbelow\sattached\sPurchase\sOrder\,|kindly\srevert\sto\sus\sfor\simmediate|Please\sCheck\sYour\sAttachment\sFile\.|Please\sfind\sattach\sour\srepeat\sorder\!\!|VIEW\sSWIFT\sCONFIRMATION\sIN\sATTACHMENT|Have\syou\sactually\saccepted\sdocuments\sthat\sI\semailed\syou\sshortly\sago\?\sI\ssend\sthem\sfor\sa\ssecond\stime|issuance\sof\sSales\sInvoice\sand\sCollection\sReceipt|remittance\sSlip\sfor\syour\sBank/m body T_JR_OPEN_ME_H /the\sattached\sis\sthe\snew\sorder\,\splease\ssend\sPI\sfor\sthe\spayment\sprocess|Estamos\sesperando\ssu\srespuesta\surgente\scon\ssu|\(Read\senclosed\sfile\sdetails\)\sThe\sdelivery\sattempt\sfailed|Kindly\scancel\sthe\sprevious\sOrder\,\swe\shave\sadded\smore\sorder|DONATION\.\sKINDLY\sOPEN\sATTACHED\sFOR\sINFO|Kindly\sgive\syour\sbest\sprice\soffer\sfor\sthe\sattached\sfile\.|Invoice\sdetails\sdoes\snot\sbear\syour\sCompany|Please\sfind\sthe\sattached\sswift\scopy\sfor\sbelow\spayment\.|Label\sNumber:\s\(Read\senclosed\sfile\sdetails\)|Kindly\ssend\sus\sacknowledgement\sand\scopy\sof\sProforma\sInvoice|Waiting\sfor\syour\sbank\scontract\sfor\sthis\sshipment\.|DOWNLOAD\.\.\.\.\.\.\.\.\.\.DETAILS|PLEASE\sKINDLY\sVIEW\sTHE\sATTACHMENT\sAND\sGET\sBACK\sTO\sME|VIEW\sTHE\sFILE\sFOR\sPAYMENT\!+|zip\spass\s777|go\sthrough\sthe\sattached\sin\sother\sto\scontact|dispatched\stoday\,\splease\sfind\sattached\sInvoice|lowest\sprice\sfor\sitems\sat\sin\sattached\sRFQ|VIEW\sTHE\sFILE\sFOR\sPAY\!\!|Please\ssee\sattached\sswift\sregarding\sour\slatest\spayment|attached\sproforma\sinvoice\sfor\syour\sfinal\sapproval|Kindly\sfind\sattached\srevised\sPI\,|Looking\sforward\sto\syour\sreply\sso\swe\scan\sprovide\syou\swith\sour\sorder\srequest\sand\sspecification/m body T_JR_OPEN_ME_I /Pls\.\sfind\sattached\saccount\sstatement\swith\soutstanding\sbalance|agreement\sdocuments\sas\sassigned\sto\sdeliver\sto\syou|CHECK__DOWNLOAD|Pls\sfind\sattached\sour\snew\spurchase\sorder\sfor\syour\sreference\.|kindly\sview\sthe\smail\sattachment\sand\scontact\sthe\sClaim\sManager|Read\sAttached\sFile\sFor\sClaim|Ask\syou\sto\sinspect\sthe\sattached\sreport|We\smade\ssome\sinclusion\sin\sour\spurchase\sorder|Attached\sis\sthe\sinvoice\sreceived\sfrom\syour\sbank|I\sam\sa\sbanker\swith\sDanske\sBank|Details\srelated\sthe\stransaction\swill\sbe\smade\savailable\sto\syour\sreach|Kindly\sdownload\sexcel\sfile\shere\sattached\.|We\ssend\sDEBIT\sNOTE\.|Kindly\splease\sfind\sattached\s+payment\scopy\sof|along\swith\sthe\sfollowings\sPrices|go\strough\sthe\sattach\sitems|Invoices\sdue\sfor\sreconcilation\sPayments|large\sOrder\stoo\sbig\sto\sattached|open\sthe\sattachment\sfile\sfor\syou\xE2\x80\x99re\swinning\snotification|expecting\sto\shear\sfrom\syou\sas\sregards\sto\smy\sprevious\smessage\sin\sview\sof|that\swill\shelp\sme\sin\sthis\sdifficult\slife|we\srequest\syou\sto\s\squote\sthe\sfollowing\sitems\sin\sthe\sattached\simage|Open\sAttachment\sfor\smore\sdetails|change\sin\sthe\sdestination\son\sthe\sattached\sshipping\sdocuments|Meanwhile\sYour\sPositive\sResponse\sis\sNeeded/m body T_JR_OPEN_ME_J /Attached\sis\sthe\sPO\sfor\syour\sreference\.\s\(2\spages\)\s\.\sPlease\scheck|Please\sfind\sbelow\swire\stransfer\sconfirmation\scopy\sas\sinstructed\sby\sour\sclient|Kindly\srefer\sto\sattached\spayment\sdetails\sfor\syour\sreference|The\sattached\sinclude\sswift\scopy\,\sremittance\sadvice|Kindly\sfind\sattached\sflyer\sand\sloan\sapplication|I\'ve\sjust\sprocessed\sthe\swire\spayment|Please\skindly\sfind\sattached\sour\sPurchase\sOrder|wish\sto\sadvise\swith\sattached\sthat\swe\swired\son|View\smy\sproposal\sand\sget\sback|open\sthe\sattached\sfile\sto\sobtain\smore\sdetails|Kindly\sissue\sthe\sProforma\sinvoice\sso\sthat\swe\scan\sproceed|Your\semail\sjust\swon,\sPlease\sOpen\sAttachment|Please\skindly\sreview\sand\sconfirm\sdelivery\sdate\.|Kindly\sreleased\sour\spayment\simmediately|Also\sfind\sthe\sfollowing\soutstanding\sdetails\sas\sbelow|PLEASE\sVIEW\sTHE\sATTACHED\sFILE\sAND\sGET\sBACK\sTO\sUS|KINDLY\sOPEN\sTHE\sATTACHED\sFILE\sFROM|view\sthe\sattached\sverification\sform\sfor\sfurther\sdetails|with\sthe\srequired\sdocument\slisted\sbelow\sto\sEmail\son\sthe\sApplication\sForm\sAttached|\(See\sattached\syour\sprice\slist\sfor\syour\sreference\)|We\sare\spleased\sto\sinform\syou\sthat\syour\scompany\sproducts\ssuits\sour\ssearch\sand\swe\swould\slike/m body T_JR_OPEN_ME_K /Find\syour\sattached\sprice\slist\sand\supdate\sus|Please\sI\sseek\sfor\syour\sconsent\sas\sa\sBusiness\sPartnership|Pour\srelancer\snotre\sdemande\sde\sProforma\,\snous\savons|de\snous\senvoyer\svotre\sproforma\spour\sla\sliste\sde|Your\semail\sjust\swon\son\sour\sonline\sBMW\ssweepstakes|Please\sfind\sattached\sInvoice\-[0-9]{4,5}\sand\sget\sback\sto\sus\svery\surgent|We\sare\spleased\sto\sattach\sherewith\sour\sOrder\sNo\.|Kindly\sfind\sthe\sattachment\sof\spurchase\sorder|send\sus\syour\sproforma\sinvoice\sas\ssoon|Please\splace\sa\sPO\sfor\sthe\sAttached\sItems\sasap|kindly\sopen\sthe\sattach\sfile\sfor\sfurther\sdirectives|Please\sconfirm\syour\saccount\sdetails\sto\senable\sus\sproceed\sfor\sthe\ssecond\spayment\.|Please\sfind\sattached\sswift\smessage\sreceived\sfrom\sBank\.|Attached\sis\sthe\sverification\sprocessor\.|Please\ssee\sthe\sattached\sform\.|Kindly\sconfirm\sreceipt\sof\sfunds\.|please\ssee\sour\snew\sFOB\sQuotation\sfor\syour\sApproval|Kindly\sFind\sAttached\sFile\sOur\sOfficial|Attached\syou\swill\sfind\sthe\sswift\,|We\sare\splsd\sto\sappoint\syour\sgood\scompany|Sorry\sfor\sthe\sattachment\serror\splease\sfind\srevised\sdocument\sfor\syour\sreference|\bsmartsousou\.com\b|reconfirm\sshipping\sdocuments\sasap\sand\srevert\sback\simmediately/m body T_JR_OPEN_ME_L /In\sattached\syou\swill\salso\sfind\sour\scompany\sBusiness\slicenses|Kindly\ssee\sattached\sour\starget\sprice\slist\sfor\syour\sreference\sand\slet\sus\sknow|\(\.DOWNLOAD\.+INFO\.\)|find\sattached\spayment\sadvice\sfor\syour\sreference|supply\sus\swith\sthe\smentioned\sequipment\son\sthe\sattachment\sASAP|invoice\sand\spacking\slist\sattached\.\sfor\surgent\sshipment|Please\sfind\sthe\sattachment\sfor\sthe\spurchase\sorder\sdetails\.|verify\sthe\sattachment\sbelow\swas\ssent\sby\syour\sCompany|enabling\syou\sto\suse\sthe\sfunds\swithout\sproblem\sand\sto\sprotect\syou|Kindly\scheck\smentioned\sinvoices\sare\sshowing\sin\syour\ssystem|Please\sKindly\sfind\sattached\soutstanding\spayment\sdetail|Find\sthe\sattached\sswift\scopy\spayment\sreceipt|Here\sfind\sthe\sattached\sinvoice\she\ssent\sme\swith\sthe\scorresponding\sPO\.|Has\sestado\sen\scorrespondencia\scon\smi\scolega\scon\srespecto\sa\snuestro\spedido\sgrande|Kindly\sfind\sthe\sattached\sletters\-testamentary\sfrom\sprobate\scourt|Pls\scheck\sattached\sfinal\sbest\squote\sand\ssample|find\sattach\ssheet\scopy\sof\sPurchase\sOrder|confirm\sthe\sPO\s\&\sArrange\sto\sdispatch\simmediately|Attached\sis\sthe\sdocument\srequested\sclick\shere\sto\sview\sattached\sfile|^Please\scheck\sthis\sdocument\scarefully\sand\sreport\smistakes\simmediately\./m body T_JR_OPEN_ME_M /has\sbeen\slisted\sfor\stermination\scheck\sattached\sfor\smore\sdetails|Kindly\sfind\sthe\sattached\sour\snew\sorder|New\sorder\sin\sattached\sfile\.|reply\sme\swith\sthe\sestimated\sdelivery\stime\sso\sthat\si\scan\sconfirm\sthis\sorder|Attached\sis\sthe\sshipping\sdocument\sfor\sclearing\sand\sreference|Please\sfind\sattached\sour\sBank\sTransfer\sCopy|proposed\spayment\splan\sand\srevert\saccordingly|Kindly\sfind\sattach\sthe\spending\scorresponding\sinvoice|Attached\sis\sconfirmation\sof\spayment\sfor\sall\soutstanding\sinvoices|Read\sthe\sattached\svital\sproposal\sfrom|Fill\sthe\sloan\sapplication\sform\sand\sreturn\sit\sback\swith\syour\sID\scopy\sor\sInternational\spassport|Attached\sherewith\sis\sour\spurchase\sorder\sfor\syour\sconfirmation|Kindly\sarrange\sall\snecessary\sdocuments\sand\spro-forma\sinvoice\sfor\spayment|Please\skindly\sfind\sattached\sbank\scopy\sfor\sconfirmation|reference\sfor\syour\skind\sperusal\sand\simmediate\squotation|Kindly\sfind\sAttached\sinvoice\s\&\spacking\slist\sfor\syour\sreference|Kindly\sfind\sattached\sour\snew\sorders\sfor\sApril\,\sPO|Mime\sFile\sis\s\/usr\/tmp\/mail[0-9]{5,6}\.[0-9]{4,5}|KINDLY\sOPEN\sTHE\sATTACHED\sFILE|Open\sAttachments\sthat\shave\sbeen\ssent|further\sdelay\swith\sregards\sto\sthis\sspeculations/m body T_JR_OPEN_ME_N /I\shave\ssomething\sinteresting\sfor\syou\.\sPlease\ssee\sthe\sdocument\sattached\.|Here\sis\san\sinteresting\sinfo\sin\sthe\sdocument\sattached|ATTACHMENT\sDOWNLOAD|please\sconfirm\sthe\sattach\sbeneficiary\sname\sand\saccount\snumber\son\sthis\sinvoice|please\sfind\sour\sPO\sattached\sfile\sof\sour\scompany|Below\sInvoices\shas\sbeen\ssettled|kindly\scheck\sattachment\sto\sview\sand\sprint\sshipping\sdocument\.|login\swith\syour\semail\sID\sto\sview\sthe\sproof\sof\spayment|Please\sfind\shere\sattached\sa\scopy\sof\sour\snew\sremittance\sof|Payment\salready\ssent\sas\sinstructed\sby\syour\scustomer|attached\splease\sfind\spayment\se\-Advice\sfor\syour\sreference|Please\srespond\sASAP\sso\sthat\swe\scould\sdeliberate\son\spayment\smethod\sand\sshipping|The\senclosed\sfile\sis\smy\sbusiness\sdeal\soffer\.|Kindly\ssee\sattached,\sas\swe\sexpect\sto\sreceive\syour\squote\sand\sbest\sprices|Download\sto\sview\sthe\sattached\sPayment\sLetter\,\sComptroller|Use\sAttachment\sto\sFix|kindly\s+confirm\s+your\s+invoice\s+and\s+bank\s+details\s+as\s+attached|Attach\s+for\s+your\s+reference\.|Please\sopen\sthe\sattached\sfile\sfor\syour\srelief\spackage|Please\sopen\sthe\sattached\sWinning\sFile|IF\sTHIS\sMESSAGES\sIS\sSPAM|We\shave\ssent\sbank\stransfer\sbalance|Please\sattach\sfile\sas\sfollow\./m body T_JR_OPEN_ME_O /We\swant\sto\sinform\syou\sthat\swe\shave\sarranged\sinvoice\s[0-9]{4,6}|please\sQuote\sus\saccording\sto\sthe\sRequirements\sin\sthe\sattachment|download\s\&\scheck\sthe\sattached\sthe\sBL\,\sCommercial\sInvoice\s\&\sPacking\slist\sfor\syour\sperusal|Confirm\sthe\sattached\sdetails\sso\swe\scan\sinstruct\sour\sbank\sto\smake\sthe\spayment|your\sshipment\swith\sthe\sabove\-mentioned\stracking\snumber|Your\spayments\shas\sbeen\sconfirmed\.|Kindly\sfind\sattached\sremittance\sreceipt\sfor\syour\sreference\.|Security\sUpdated\sDoc\sAttached|Security\sDocument\sAttached|please\sfind\senclosed\sthe\sbank\-slip\sfor\syour\skind\srecords|Review\sAwaiting\sfile\(s\)\sbelow\:|We\sreceived\san\sattached\scopy\sof\syour\sdeposit\scertificate|Please\sView\sThe\sAttachment\sLetter\.|VIEW\sTHE\sATTACHMENTS|Please\sattached\sis\sthe\spurchase\sorder\,|VIEW\sATTACHMENTS\sFOR\sMORE\sDETAILS|VIEW\s+THE\s+ATTACHED\s+MESSAGE\s+FOR\s+MORE\s+INFORMATION|marketing\sdepartment\,\sfind\senclosed\sthe\sproforma\sinvoice|Kindly\sconfirm\sif\sthe\sbanking\sdetails|View\sthe\senclosed\sattached\sand\sredeem\syour\sreward|Attached\sis\syour\snew\sdocuments\.|The\sattached\spurchase\sorder\sis\sissued\sat\sthe\srequest\sof\sour\scustomer|confirm\sback\simmediately\sto\senable\squick\sFollowup/m body T_JR_OPEN_ME_P /Kindly\ssee\sattached\sfile\sand\sacknowledge\scopy\sof\sPurchase\sOrder|Please\sget\sback\sto\sus\sASAP\.\sBecause\swe\shave\ssome\sitems\swe\swant\sto\sorder|the\sattached\snew\sOrder\simmediately|Thank\syou\svery\smuch\sfor\syour\smessage\sand\sinstruction\sof\sthe\sshipment\sfor|CONFIRMATION\sOF\sYOUR\sATTACHED\sSHIPPING\sDOCUMENT|Please\sfind\sattached\sprelim\sHUD\sattached|get\sback\sto\sus\swith\sa\sgoods\squotation|I\sawaits\sfor\syour\sgoods\squotation\sand\sproforma\sinvoice|Please\sfind\sattached\squotation\,\sspecification\sand\sreference\spictures\sfor\syour\sinformation|kindly\sconfirm\sand\srevert\swith\ssignature|Kindly\sfind\sattached\sdocument\sof\sthe\ssigned\scopy\sof\scontract\sfor\sour\snew\sorder|Confirm\sand\srevert\sback\sto\sus\svia\sE\-mail|Please\scheck\sattached\sour\sPurchasing\sorder\sfor\sSeptember|Please\sfind\sattached\sscanned\scopy\sof\sshipping\sdocuments\sfor\syour\sreference|price\squote\sfor\sAttached\sorder\slist|Please\sAdvice\sOn\sthe\sattached\sOutsanding\sInvoice|Kindly\sask\syou\sto\s\sprovide\syour\sbest\soffer\sas\ssoon\sas\spossible|Please\srefer\sto\sthe\sattached\scopy\sof\sthe\s+BL\s+Surrender\s\/\sTELEX\sversion|Please\sfind\shere\sbelow\spayment\sSwift\.|Scan0025\.xls\b|please\scheck\sthe\sattached\ssmall\sguarantee\sletter/m body T_JR_OPEN_ME_Q /You\shave\s\([0-9]\)\snew\spending\sfile\son\sOnedrive\:\sPO|\bPlease\squote\sas\sper\sPO\sattached\sbasis\son\b|attached\stechnical\sspecifications\sand\sadvise\syour\sbest\squotes|Kindly\srefer\spayment\sdetails\sas\sper\sattached\sand\splease\sproceed\sour\sorder\sasap|Hello\sDear\svalued\spartner\,|Kindly\sview\sattached\son\show\sto\sclaim\syour\sAward\.|Kindly\sView\sAttached\sletters\son\show\sto\sapply\.|RELIEF\sFUND\sATTACHED\sVIA\sTHE\sPDF\sFILE|provide\sus\sprice\squotation\sfor\sas\sattached\sPurchase\sOrder\srequisition|Please\sfind\sattached\sPO\-[a-zA-Z][0-9]{7,9}\sfor\syour\sreference\sand\saction\.|Thanks\sfor\sthe\sproforma\sno\.\s[0-9]{7,8}\.|Can\syou\sas\swell\soffer\sas\sper\sattached\?|Please\sfind\sattached\syour\sPO\sacknowledgement\sof\sorder\sN\xC2\xB0|For\syour\sinformation\swe\sdidn\xE2\x80\x99t\sreceive\sa\sQuotation\syet\.|Please\srefer\sto\sthe\sattached\sPO\,\swe\shave\stried\sgetting\syou\son\sthe\sphone|Kindly\ssend\sus\squotation\sfor\sthe\sfollowing\,\sas\ssoon\sas\swe\sreceive\sthe\squotation\swe\swill\ssend\sofficial\sPO|See\sattachment\swith\sstandard\spassword|Find\senclosed\spayment\sadvice\.|Please\sfind\snew\sorder\sper\sthe\sattached\sfrom\s|Please\sfind\sattached\sdocuments\spertaining\sto\sour\sinvoice|Invoice\/Packing\slist\sfor\sthe\ssubject\sshipment/m body T_JR_OPEN_ME_R /attached\s+New\s+Order\s+for\s+your\s+reference|Please\sfind\senclosed\sour\snew\spurchase\sorder\sfor\syour\sreference|sent\sclosing\sstatement\svia\ssecured\ssite\ssee\sattached|Endeavour\sto\sconfirm\sreceipt\sof\sfunds\saccordingly\.|your\spayment\swas\sapprovedopen|file\s\(Docx\)\sto\sview\syour\sInvoice|Please\sstudy\sDocument\sproperly\sfor\scontract\smeeting\spresentation|documents\shas\sbeen\sshared\swith\syou\son\s[a-z0-9._\-]+\@[a-z0-9.\-]+\sSharepoint\sStorage|inviare\stassativamente\sla\sconferma\sordine\.|Buongiorno\,\sin\sallegato\svi\sinvio\sun\snuovo\sordine\.|Please\ssee\sthe\sattachment\sfor\sPurchase\sOrder\s[A-Z0-9]{10}\sand\sconfirm|To\ssign\syour\sdocument\sonline\splease\sfollow\sthe\scommand\sbelow|forward\sto\syour\sBANK\svia\sFedEx|summit\syour\sproforma\sinvoice|VIEW\sTHE\sATTACHMENT\sFILE|Please\sfind\sthe\sdocument\sattached\sand\sfollow\sthe\son\-screen\sinstructions|unable\sto\ssend\svia\sPDF\sdue\sto\sscanner\sand\sprinter\serror\.|confirm\sthe\snew\saccount\sdetails\sfor\sus\sto\sproceed\swith\spayment|open\sthe\sinvoice\,\sattached\sto\sthis\sletter|confirm\sand\slets\sproceed\swith\spayment|Onedrive\sfor\sbetter\sview\sand\salso\sdue\sto\sthe\ssize|the\sproduct\sspecification\sin\sthe\sattachment|instructed\sour\sbanker\sto\swire\sthe\spayment/m body T_JR_OPEN_ME_S /Kindly\sfind\sthe\sattachment\sfor\sthe\srevised\sm&e\sdrawing\sfor\syour\sreference\.|complete\sthe\sapplication\sform\sherewith\sattached|Follow\sthe\slink\sbelow\sto\strack\sand\sdownload\sfinal\sdocuments\.|Here\'s\sthe\sNew\scontract\sdocument\sthat\s[a-z0-9._\-]+\.[a-z0-9._\-]+\sshared\swith\syou|Kindly\sfind\sattached\sfor\syour\sconfirmation\.|Kindly\sfollow\sbelow\sbutton\sto\sdownload\sfile\sto\saccess\sthe\sExcel\sfile|invite\syour\sgood\scompany\sto\squote\sthe\sbest\sprice|The\sattached\spayment\sadvice\sis\sissued\sat\sthe\srequest\sof\sour\scustomer\.|The\sadvice\sis\sfor\syour\sreference\sonly\.|An\sorder\sfor\ssome\sof\sthe\sproducts\sit\ssells\sis\sattached|kindly\scheck\sattached\sto\sconfirm\sour\sinterested\sproducts|we\swill\ssend\sour\sfull\scompany\sdetails\sand\sshipping\saddress\sfor\sgoods|Please\sfind\sattached\sa\snew\s+order\sfor\sus\snote\sour\srequested\sdelivery\stime|Please\s+see\s+attached\s+proof\s+of\s+payment\s+for\s+your\s+reference\.|Someone\sfrom\syour\scontact\sshared\sa\sfile\swith\syou|Please\ssee\sattached\scopy\sof\sthe\sPurchase\sOrder\slist|Kindly\sforward\sthe\squote\swith\scomplete\sspecification\,\sorigin\sand\sprice\.|Please\sconfirm\sand\shelp\sfill\syour\scorrect\sbanking\sinformation|New\sContract\.xls/m body T_JR_OPEN_ME_T /attached\sContainer\sdetails\sand\sshipping\sdocuments|Kindly\srevert\squote\simmediately\.|pricelist\sand\scontract\sfind\sthe\sNew\-Order|view\smy\sfile\sfor\slist\sof\sPurchase\sOrder\swith\sdetailed\sspecification|Swift_BNK132\.pdf|Subject\sconsignment\sexpected\sto\sarrive\syour\sport|We\ssubmitted\spayment\stwice\sas\sattached\stransfer\srequest|Attached\shere\sis\sa\scopy\sof\sthe\sreciept\sfor\sthe\spayment\smade|Please\skeep\sor\schange\spassword\.\.\.|TikTok\sFor\sQuickMeet18\+|INV934\-45\.pdf|I\sattach\sthe\snew\sorder\spurchase\sNumber|Attached\sis\smy\scompleted\sProduct\sOrder\.|Herewith\s+is\s+the\s+attached\s+letter\.|Pls\sarrange\sto\sneedful\surgently\.|IMPORTANT:\sPlease\sfind\sattached\sreference\sPayment\sReport\.|Please\s+provide\sthe\sprice\sand\sdelivery\sfor\sthe\sattached\sOrder|attached\sis\sthe\sswift\scopy\sof\spayment\sfrom\sour\sbank|DETAILS\sABOUT\sYOUR\sWINNING\sTICKET|the\sattached\sTT\sswift\scopy|KINDLY\sOPEN\sYOUR\sATTACHED\sFILE|Find\sattached\scopy\sof\syour\swinning\snotification\sletter|payment\sattached\swift\scopy|Please\sKindly\sdownload\sthe\sattachment|provide\sus\swith\syour\sUpdated\sproduct|Pay\-slip\sfor\sthe\sMonth\sof\sApril\s20[0-9]{1,3}\-PDF|PLS\sQUOTE\sOUR\sREF\sIN\sALL\sFUTURE\sCORRESPONDENCE|Please\sfind\sour\sBank\sPayment\sTransfer\sfor\sPI/m body T_JR_OPEN_ME_U /Descargar\stodo\s.*\.zip\sarchivos\sadjuntos|Kindly\sfill\sout\sthe\scontact\sform\sattached\sand\ssend\sback\sto\sus|download\sand\sreview\syour\sreceipt\sin\sthe\sfollowing\spdf\s\-\sDate\:|requested\srevised\sinvoice\sfrom\sour\scostumer|Kindly\sconfirm\savailability\sand\sgive\sQuote|Courier\swas\sunable\sto\sdeliver\sthe\sparcel\sto\syou|KINDLY\s+VIEW\s+THE\s+FILE\s+CAREFULLY|please\sfind\sattached\sour\sPO\sand\spayment\scopy\sand\ssend\sus\sdelivery\sdetails|Find\sattach\sletter\sfor\syoUR|what\sis\sthe\sETD\swe\sneed\sthe\sorder\surgently\s.|we\shave\sevaluated\syour\sPI\syou\ssent\sto\sus\spreviously|Kindly\ssee\sthe\sorder\sattached\sand\scheck\sif\syou\scan\sship\sbefore\sthe\send|download\sand\sreview\syour\sreceipt\sin\sthe\sfollowing\spdf\s\-|your\sProforma\sinvoice\swith\syour\sbank\saccount|But\sthe\sterms\sof\spayment\sshould\sbe\sby\sT\.T\sagainst\sB\/L\scopy|I\s+hope\s+you\s+are\s+well\,\s+Please\s+see\s+the\s+attached\s+payment\s+for\s+the\s+invoice|Kindly\sissue\sproforma\sinvoice\swith\sitems\sserial\snumber\sas\sin\sorder|The\simportant\sinformation\sfor\syou\.|We\swould\slike\sto\sinquire\sabout\syour\sproduct\scould\splease\ssend\sus\smore\sdetails|So\,\sa\spurchase\sorder\scan\sbe\sprepared|Kindly\sprovide\sus\swith\syour\sinvoice\sshowing\sall\snecessary\sinformation\./m body T_JR_OPEN_ME_V /READ\sTHE\sATTACHMENT\sLETTER|This\sdocument\swas\sscanned\sand\ssent\sto\syou\susing\sa\sHSBC_Payment\s\sMultifunction\sPrinter|Kindly\sprovide\sPro\sForma\supon\sreceipt\sof\sthis\sOrder\sto\sconfirm|Find\sour\squotation\sorder\sin\sthe\sattached\sfile\sview\sand|Find\sthe\sAttached\sfile\sfor\syour\saddress\sconfirmation\.|File\sAccess:\s+Your\semail\spassword\sis\srequired\.|Please\,\sfind\sattached\spurchase\sorder\ssigned\sand\swaiting\sfor\syour\sconfirmation\.|We\swish\sto\splace\sa\snew\sOrder\sagainst\sour|Hope\syou\sare\sfine\sand\salso\skeeping\ssafe\sout\sthere\.|Confirm\sIdentity\sto\sProve\sYou\sare\snot\sa\sRobot|purchase\squantity\sand\sorder\sspecification\swhen\swe\sgo\sthrough\syour\scatalogue\sand\sinformation\syou\shave\sprovided\sus\swith|Please\sfind\sattached\sour\sPI\.\sT\.T\sagainst\sB\/L\scopy\,\sas\snow\sthe\smaterials\sare\sin\sshort\ssupply\.|We\sare\sinterested\sin\sthe\sattached\sproducts\.\sPls\scheck\sand\ssend\sme\syour\smost\scompetitive\sprices\.|Let\sme\sknow\sif\syou\sneed\sany\sre\svisions\.|^Please\ssee\sattached\,\sdid\sapprove\,\sok\sto\spay\.$|Please\sdownload\sand\sreview\syour\sreceipt\sin\sthe\sfollowing\spdf\sformat|Bill\sof\sLading\sfor\syour\sreference\s\&\sincrease\sour\spurchase\squantity\,\sFind\sattached\snew\sPurchase\sOrder/m body T_JR_OPEN_ME_W /Attached\sis\sthe\spayment\sreceipt\sfor\sthe\spayment\smade\sto\syour\sbank\saccount\stoday\.|i\swill\shave\sto\sforward\sour\sPO\sand\sspecifications\simmediately\sto\splace\sa\strial\sorder|as\sadvised\skindly\scheck\sattach\sfile|Please\sfind\sattached\sa\spayment\sconfirmation\sfor\sour\srecent\spayment\smade\sfor\syour\srecords|our\sclient\srequested\swe\sresend\syou\sthe\sattached\scontract\sPI\sif\sany\serror\sbefore\spayment|Attached\sLetter\sfor\syour\spreview\sof\sClosure|Kindly\sfind\sattached\sour\scompany\sofficial\sorder\-2021\-PO\s\#\s[0-9]{4}|Payment\sAdvised\scopy\sagainst\sLEADTIME|Here\sis\sour\snew\sOrder\,\swhen\syou\ssend\sthrough\syour\sproforma|Please\sfind\sthe\spayment\sslip\sattached\shere\sand\sproceed\.|attached\sB\/L\sfiles\sare\sdocument\swhich\swe\shave\salready\ssent\shard\spaper\swork\scopy\strough|One\sfor\seach\sshipment\.\sI\sthink\sthis\sis\snecessary\sfor\sobtaining\sthe\s3\sIDFs\.|We\schecked\syour\scompany\sprofile\sand\swe\sare\sinterested\sin\spurchasing\sfrom\syour\scompany|Please\sfind\sthe\sattached\sscanned\sDraft\sCopy\sof\sthe\sSwift\sTransfer|Please\sconfirm\sthe\sinvoice\sof\sthe\sordered\sproducts\sbefore\swe\sinitiate\sthe\stransfer\sas\sattached\./m body T_JR_OPEN_ME_X /[A-z0-9._\-]+\@[a-z0-9.-]+\sPlease\snote\sthat\sthe\sdocument\sis\sconfidential\,\sdownload\sattached\sto\sview\.|Kindly\ssee\sattached\sour\srequest\sfor\squotation\,\skindly\sattend\sto\sour\srequest\sand\ssend\sus\syour\squotation\sof\sthe\smaterials\sin\sthe\sattachment|Please\schecked\sattached\sfor\spayment\sconfirmation\sand\supdate\sus\son\swhen\sshipment\swill\sbe\smade\sto\sus\.|Please\sfind\sattached\syour\spurchase\sorder\.\sPlease\sensure\sthat\sthe\snumber\sis\squoted\son\syour\sinvoice|The\scourier\scompany\scannot\ssend\sthe\spackage\sto\syou\.\sTo\sreceive\syour\spackage\,\splease\slog\sin\sto\sprint\sthis\sreceipt\sand\sgo\sto\sthe\snearest\soffice\.|Name\:\sDocuCentre\-V\sC3373|I\schange\sthe\sdates\sand\sname\sto\s[A-z0-9]{5,23}\.\s\sIt\sis\sattached\sas\sexcel\sif\syou\sneed\sto\smake\sany\schanges\.|reply\sso\swe\scan\sprovide\syou\swith\sour\sorder\srequest\sand\sspecification\.|Please\ssend\sme\syour\sPerforma\sinvoice\swith\syour\sbank\saccount\sin\sorder\sto\smake\spayment\.|Pls\sfind\sattached\srevised\sScope\sof\swork\.|we\sare\sinstrested\sin\sbuying\sfrom\syour\scompany\.|Kindly\sfind\sattached\sbank\sdetails\sand\sconfirm\sthat\sinformation\sis\scorrect|With\sreference\sto\sour\sprevious\smails\,\splease\sfind\sattached\shere-with\sour\sstatement\sof\saccount\still\sdate/m body T_JR_OPEN_ME_Y /Kindly\sfind\sattached\sOrder\sConfirmation\sin\sreference\sto\:|Kindly\sRead\sthe\sAttached\sLetter\sfor\sClaim\sInstructions|Also\sis\sattached\spurchase\sorder\sfor\sMay\sshipment\.|Kindly\scheck\sand\sconfirm\sby\sreturn\smail\,\sadvance\spayment\sfor\sthis\sorder\sis\sapproved|You\sneed\sto\sbe\scareful\swhen\syou\sorder\spayments\sto\savoid\sunnecessary\slost\.|that\sPayment\sfrom\sour\sclient\sto\syour\scompany\sbank\saccount\swas\sdeclined|For\sany\sfurther\squery\,\sPlease\scontact\sSales\sOperations\sDepartment\.|Please\scheck\sour\sattached\sRFQ\sand\sreply\sus\syour\squotation\sbased\son\syour\sbest\sconditions\.|Account\sDept\sshared\spayment\sreview\splan\sfor\syour\sreview\son\s[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4,4}|send\sus\syour\sURGENT\squotation\sfor\ssupply\sof\sthese\smaterials\sas\sper\sattached\sdetailed\srequirements|\(Account\sPayables\s\)|Acessment\sDoc\.\sPlease\sreview\sand\skeep\sfor\syour\srecords\.|kindly\scheck\sthe\sattached\sNew\sOder\sproduct\slist\sfor\ssupplies\sand\ssend\sus\syour\sbest\sprice\simmediately|Please\sread\sthe\sattached\sproposal\sand\sget\sback\sto\sme\sthrough\smy\scontact\semail|Appreciate\syour\sprompt\sreply\sfor\sus\sto\sproceed\swith\sremittance\saccordingly|Revised\sinvoice\-[0-9]{5}\sis\sattached\sas\sdirected\sby\sManager/m body T_JR_OPEN_ME_Z /The\spayments\swas\sprocessed\slate\syesterday\,\splease\sfind\sattached\scopy\sand\sacknowledge|Enclosed\sfind\sProforma[\-\s]Invoice\s\/\sOrder\sConfirmation\swith\sdelivery\stime\.|Kind\sAttn\:\sAccounts\sDepartment|Kindly\sinform\sif\syou\sare\s\scurrently\sprocessing\sorders\sor\sforward\smy\smail\sto\sthe\sperson\sincharge|Please\ssee\saffixed\sfile\sorganized\sby\sour\slaw\sfirms|For\sfurther\sInquiry\sand\sInformation\sabout\sour\sLoan\sFunding\sServices\semail\sus|Find\sour\ssigned\sinvoice\sand\spurchase\sorder\sattached\sand\sconfirm\sdelivery\sdate\.|Attached\snew\spayment\s[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}\s[A-z0-9:;\.]{11,13}\sfor\syour\srefrence|REQUEST\sFOR\sCTM\sARRANGMENT|acknowledgment\sfor\s+this\smail\sis\srequired\sand\srevert\sback\swith\syour\ssignature|Please\srefer\sto\sthe\sattached\sDelivery\sNote\sfor\syour\sOrder\.|Kindly\sfind\sAttached\snew\sorder\swith\sreference\snumber\sPO|Kindly\sfind\sattached\syour\sbank\sdetails\sand\sconfirm\sif\sthe\samount\sand\severything\sis\sokay|Hope\sthis\smessage\sfinds\syou\swell\.\sPlease\sfind\sattached\sand\squote\syour\sbest\sprice\.|Please\skindly\sfind\sattached\sPO\sfor\sour\snew\sorder\,\sand\smake\sPI\sfor\searly\spayment\sand\squick\sshipment|I\scame\sacross\syour\sproduct\son\swww\.alibaba\.com\,/m body T_JR_OPEN_ME_A1 /Hello\,\s\.\sYour\ssales\sorder\sis\sattached\.\s{1,2}Your\scredit\scard\son\sfile\shas\sbeen\scharged\.|Here\sis\sdid\sapprove\,\sok\sto\spay\.|This\sis\sto\snote\sthe\svessel\sdeparture\sfor\syour\sshipment\sas\sattached\.|Please\sKindly\scheck\sattached\sdocument\sand\sview\.|Message\:\sPlease\sstudy\sDocuments\sproperly\sfor\scontract|Your\saccount\sreceipt\sis\sattached\.\s\sYour\sbank\saccount\son\sfile\shas\sbeen\scharged\.|And\sAwaits\syour\sproforma\sinvoice\sfor\spayment\sprocessing|Invited\sYou\sto\sPreview\sa\snew\sproject\sdocument|See\sattached\sproof\sof\spayment\spaid\sto\syour\saccount\sthis\smorning\sand\sadvice\sif\sall\sis\sin\sorder|We\sappreciate\sif\syou\scould\sacknowledge\sreceipt\sof\sall\sour\sinvoices\sand\sdo\sthe\sneedful\sto\srelease\sthe\spayment\sat\sthe\searliest|Kindly\squote\sin\s\$Dollars\swith\scorrect\sbanking\sdetails|Please\sfind\sattached\sto\ssee\spayment\sconfirmation\.|Please\sKindly\sOpen\sThe\sAttached\sFile|received\sa\snotice\sfrom\sour\sboss\sto\scontact\syou\sregarding\sthe\soutstanding\spayment|Mr\.Paul\sDavis\.|Hi\sHere\sis\sthe\sAetna\sEFT\sSettlement\sfor\syour\sreview\.|click\sto\sdocument\slink\sto\sopen\sMicrosoft\sExcel|Usps\sinforms\syou\sthat\syour\sshipment\sN\xC2\xB0|please\sget\sback\sto\sme\/Bank|VIEW\sTHE\sPDF\sFILE/m body T_JR_OPEN_ME_A2 /Hereby\sto\srequest\syour\ssupport\sto\ssend\sme\squote\sfor\sthe\sfollowing\sequipment\s\(\s?see\sattachment\s\sspecifications\s?\)\.|Attached\sis\sthe\sOriginal\sShipping\sdocuments\sand\sBL\sas\sassigned\sto\sdeliver\sto\syou|Kindly\sfind\sattached\spayment\sconfirmation\sand\sremittance\sfor\spaid\sShippment|Please\scheck\sthe\sfiles\swith\sattachment\.|L\xC3\xBCtfen\s\xC3\xB6deme\syapmak\si\xC3\xA7in\sbanka\sbilgilerini\sonaylay\xC4\xB1n|Please\skindly\sopen\sthe\sattached\sdocument\sfor\syour\sapproval\/claim\.|Please\sKindly\sReview\sDocument\sFor\sYour\sComment|please\ssend\sus\sthe\sproforma\sinvoice\sand\sconfirm\sthe\sdelivery\sdate\sfor\sthe\sattach\sPO\.|Kindly\sgive\sus\syour\smost\scompetitive\sprice\sand\spayment\sterm\sfor\syour\snew\sorder\.|I\sPREFERRED\sYOU\.\sGo\sthrough\sthe\sattached\sfor\sDETAILS\.|Kindly\ssee\sattached\sPO\.XJ210821Q\sfor\syour\sreview\,\sWould\syou\spls\sgive\sme\sthe\spayment\sschedule\s\?|FULL\sNAME\:\sTEL\:|You\scan\sfind\sin\sthe\sattached\sbelow\sour\sinquiry\sthat\swe\sneed\,\sWe\skindly\sask|Please\sfind\sattached\sinvoice\spayment\sSent\s\s(Monday|Tuesday|Wednesday|Thursday|Friday)|I\shave\sattached\sthe\sPO\sfor\sthe\sOrder\sno\.[0-9]{5}|You\smust\sput\sall\sthe\sdata\sof\sprecise\sinformation\sso\sthat\swe\scan\sreach\syour\saddress/m body T_JR_OPEN_ME_A3 /Kindly\srevert\swith\syour\sorder\sconfirmation\sand\sprovide\syour\sproforma\sinvoice\.|You\shave\sreceived\s3\(three\)\snew\sfiles\sattachment|FYI\,\sPlease\ssee\sattached\sRegards|We\sfound\sa\sproduct\son\syour\swebsite\sthat\swe\sare\sinterested\sin\.\sKindly\sgo\sthrough\sour\ssales\scontract\.|You\smust\smake\sthe\spayment\sfor\sthe\sDelivery\stax|open\sthe\sattachment\sand\slogin\swith\syo\xCF\x85r|make\syour\sdonations\sonly\sthrough\sthe\sbitcoin\swallet\sprovided\sin\sthe\smemo|Please\ssee\sthe\sattached\sPayment\sLayout\/Invoice\,|YOU\xE2\x80\x99RE\sWINNING\sFILE\sNUMBER|KINDLY\sVIEW\sTHE\sATTACHED\sFILE|Here\sis\sthe\sAetna\sEFT\sDirect\sDeposit\sto\syour\saccount\.\sopen\sattachment\sto\sreview\syour\sDirect\sDeposit|\(\sSee\sAttached\sfile\sand\sget\sback\sto\sus\sif\syou\sare\sinterested\)|^Joint\sVenture\s\/\sPartnership|G\-DRILL\sP\.C\.|Please\sfind\sthe\sattachment\sin\srelation\sto\syour\srenewed\splan\.\.\.|Please\sfind\sthe\sorder\sattachment\,\swhich\shas\sbeen\sdispatched\.\.\.|provide\sus\syour\sbest\squotation\sas\sattached\sproject\sfile\sin\sthe\sGoogle\sDrive\slink\sbelow|enter\syour\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\semail\spassword\sto\saccess\sthis\sdocument\.|the\sinformation\sregarding\syour\sorder\sthrough\sinvoice\s\#\s[0-9]{12}/m body T_JR_OPEN_ME_A4 /Let\sus\sknow\splease\swhich\sdate\syour\scarrier\swill\scollect\sthis\sshipment\.\sWe\sneed\sit\sto\sbe\spicked\sup\stoday\.|FYI\,\sAttached\sis\sthe\scopy\sof\sthe\spayment\sdetails\.\sPlease\sconfirm\sonce\sreceived\.|kindly\sdownload\s\shere\syour\sattached\sproof\sof\spayment\sfor\sthe\sdue\sinvoice\sfor\syour\sperusal|Please\sCheck\sattached\sas\sall\sinformation\sare\sexplained\.|For\swinning\snotification\splease\sfind\sattached\.|Find\sattached\sContract\sAgreement\sLetter\sfor\syour\sperusal\sand\ssigning\.|Please\sfind\sattached\sfor\sthe\sswift\snote\sfor\sinvoice\sPU\s[0-9]{8}|\-\sPlease\smake\ssure\sto\skeep\sthe\ssame\squality\sand\spackaging\sas\sthe\sprevious\sorder\.\sOtherwise\,\sinform\sus\.|please\squote\syour\,\sBest\sPrices\sand\sDelivery\sTerm|Because\sof\sthe\ssize\si\sshared\svia\sAdobe\sonline\sPDF|Complete\sthe\sprocess\son\sour\swebpage\sfrom\sthe\sattachment\sbelow\s\.|Kindly\sawait\syour\sfeedback\son\sMOQ\,\sPrices\,\s\s?lead\stime\sand\sPayment\sterms\.|Please\sfind\sattached\syour\soutstanding\sstatment\.|NOTE\:\splease\sgive\sus\syour\sbest\sand\smost\scompetitive\sprices\sas\sour\scustomers\sare\scomparing\sprices\sand\swe\swould\slove\sto\spurchase\sfrom\syou\.|Kindly\sfind\sattached\sour\sRFQ\sand\srevert\sback\sto\sus\swith\syour\smost\scompetitive\sprices/m body T_JR_OPEN_ME_A5 /Please\squote\syour\sbest\srates\sfor\sthe\scargo\swith\sthe\sfollowing\sdetails\,\s\(Attached\)|Please\ssee\sattached\swire\sconfirmation\s\s?for\soutstanding\sinvoices\.|However\,\splease\sview\sthe\sattached\sfile\sto\ssee\sour\sNew\sorder|we\shave\scome\sacross\sthe\spublic\sprofile\sof\syour\sbusiness\sand\syour\sproducts\sand\swill\swant\sto\smake\spurchases\sfrom\syou|find\sappended\sour\sbuy\srequest\sand\ssend\sus\syour\scitation\squickly|We\sare\scurrently\sseeking\sfor\sthe\sitem\sas\sbelow\sattached|Please\scheck\sout\snew\sorder\s\sdraft\sin\sattachment|Attach\sis\sswift\scopy\sof\spayment\smade\sto\syour\saccount|Here\'s\sthe\sdocument\sthat\sBusiness\sshared\swith\syou\.|As\sdiscussed\sand\sagreed\,\sPlease\sfind\sattached\sPayment\sPlan\sfor\sthe\sOutstanding\samount|\;\sstatement\sremittance\sfor\sthe\spay\speriod\s[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}\s\-\s[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}\.\sPlease\sadvise\sif\sany\schanges\sare\sneeded|Please\scheck\sbelow\sthe\sattached\sBL\,\sCommercial\sInvoice\s\&\sPacking\slist\sfor\syour\sperusal\.|Bill\sof\sLading\sfor\sthe\scurrent\sshipment\sheading\sto\syour\sport|\=\=Kindly\sclick\sthe\sattachment\sto\sview\sMessage\=\=\=|You\shave\sreceived\s1\snew\sdocument\ssent\svia\sOnedrive\:\sNew_Order|^thanks\sfor\squick\sreply\smessage/m body T_JR_OPEN_ME_A6 /Attached\splease\sfind\syour\sEnterprise\sRent\sinvoice\/PO\.|We\swould\sbe\sdelighted\sif\syou\swould\sgive\sus\syour\sbest\spossible\sprice\sfor\sthese\sitems\.|Should\severything\sbe\sin\sorder\,\sno\saction\sis\srequired\sas\sthis\sdocument\swill\sbe\sautomatically\sapproved\sbefore\svessel\sdeparture\.|This\sis\sto\sinform\syou\sthat\sa\spayment\sof\s\$[0-9]{4}\.[0-9]{2}\swas\sscheduled\sto\syou\sfrom\sa\sWells\sFargo\sCustomer|Attached\sis\syour\sInvoice\s\-\{[0-9]{8}_\)copy\.\,|pls\skindly\shelp\sconfirm\sorder\sbelow\sand\ssend\sme\slist|Please\sstudy\sDocument\sproperly\sfor\scontract\smeeting\spresentation\sand\ssubsequent\spayments|We\sneed\syour\sprice\sfor\sTender\swhich\swe\sare\sparticipating\sin\,|please\scheck\sthe\sattached\,\sAnd\sconfirm\sour\sorder\sto\syou|Please\skindly\sfind\sattched\sour\sPurchase\sOrder\slist\sand\salso\slet\sus\sknow\smore\sdetails\sabout\syour\sprices\sfor\sfurther\sdiscussions|Hope\,\sI\swill\sreceive\sa\spositive\sreply\svery\ssoon|Please\sfind\sattached\sscanned\scopy\sof\sIMG\sand\sacknowledgement\sof\sAdvance\spayment|CKDAN\sCLOUD\sATTACHMENT|Kindly\sacknowledge\sreceipt\s\&\sadvise\sus\sthe\sdelivery\sstatus\ssoonest\spossible|Waiting\syour\skindly\sresponse|print\sthe\senclosed\sshipment\spaparwork\sfor\sthis\sdelivery\soptions/m body T_JR_OPEN_ME_A7 /Kindly\sdownload\sthe\sattache\sto\slisten\sto\syour\smessage|FIND\sATTACHED\sCOPY\sOF\sMY\sPRESENTATION|PLEASE\sFIND\sHERE\s\#|Please\sfind\sattached\sorder\,\sand\sthe\spackaging\sdesign\swith\sthe\srequested\schanges\s\!|To\saccess\syour\sfile\,\sSave\sand\sopen\sthe\sencrypted\sdocument\s\{ID\-[0-9]{7}\.html\}|kindly\sfurnish\sus\syour\sprice\slist\sto\senable\sus\sstudy\sand\sget\sback\sto\syou|I\swould\slike\sto\sorder\syour\sproduct\sas\sper\sattached\.\sPlease\sstudy\sit\sand\slet\sme\sknow\sthe\stransport\scosts\sand\sthe\stime\sof\sdelivery|Please\s\sacknowledge\supon\sreceipt\sof\s\stoday\'s\spayment\spayment|Thus\srequesting\syou\sto\sforward\syour\svaluable\sinquiries\sand\sorders|I\'m\sinterested\sin\sthis\sproducts\.\sPlease\soffer\sthe\sunit\swith\sthe\sclosest\sdimensions\sfrom\syour\sproduct\srange\.|se\sanexa\sel\sseguiente\scomprobante\sfiscal\sdigital\sRemitente|Please\ssee\sattached\sBL\sDraft\sCopy\sand\sshipping\sDocuments\sat\sthe\srequest\sof\sour\sCustomer\sand\sconfirm\sdetails\sfor\sapproval|Identificamos\suna\sFactura\sen\ssu\snombre\sque\snecesita\sser\srevisada\sy\snos\sinforme\ssi\sesta\sde\sacuerdo|Please\schecking\sand\sconfirm\sback\sin\sreturn\s\.|OPEN\sTHE\sATTACHED\sPDF\sFOR\sMORE\sINFO|Please\sfind\senclosed\sattached\scredit\snote\sfor\syour\srecords\,/m body T_JR_OPEN_ME_A8 /we\shereby\srequest\syou\sto\supdate\sand\ssign\/stamp\sand\ssend\sback\sas\sto\srelease\sall\sthe\sdue\samounts\sat\sthe\searliest|Your\sfiles\sis\sready\sfor\sdownload|Attached\ssigned\sdocs\sas\srequired\.Thanks|Attached\sis\sthe\sshipping\sdocuments\sand\sE\.T\.A\sshipment\sarrival\snotice\.|Please\ssee\sattached\ssigned\sproforma\sinvoice\sand\sconfirm\sso\swe\scan\sproceed\swith\spayment\.|Please\scheck\scarefully\sthe\saccount\sdetails\sotherwise\syou\swill\sbe\sresponsible|Please\ssend\sme\sthe\sProforma\sInvoice\simmediately\sfor\spayment\.|Kindly\scontact\sso\swe\scan\sdiscuss\sfurther\salso\splease\sfind\sattachment\(s\)\sas\senclosed\sfor\smore\sinformation\son\sthe\sproduct\sspecifications|Please\scheck\sattached\sDoc\sbelow\sto\sconfirm\syour\sShipping\sDocs\.|kindly\ssend\sus\syour\supdated\sprice\slist\sand\scatalog\,\sMOQ\sfor\sour\spurchase\sreference\sand\slet\sus\sknow\syour\spossible\sdelivery\stime|Please\sconfirm\sthat\sthe\sattached\sinvoice\sis\scorrect\sas\swe\sare\smaking\sinvoice\sbalance\spayments\sAccording\sto\spayment\sterms|How\sare\syou\?\s\sAs\sper\syour\srequest\,\sI\shave\sattached\sherewith\sPrice\sQuotation\sfor\syour\sreference\.|interested\sin\ssome\sof\syour\sproducts\sto\sbe\smarketed\sin\sAsian\smarket\sas\swe\sare\sin\sneed\sof\sa\sgood\ssupplier|so\s\s?that\swe\scan\sprocess\sPayment\sas\sthe\sitems\sis\s\s?needed\surgently|Please\sbe\sinformed\sthat\swe\sare\sready\sto\sPurchase\sand\ssell\sfrom\sthis\smonth/m body T_JR_OPEN_ME_A9 /Kindly\scheck\sthe\sproduct\slist\sof\swhat\sthey\sare\sinterested\sin\sattached\sand\slet\sus\sknow\sif\sthey\sare\savailable|Please\sfind\sattached\sour\sBank\sTransfer|On\sDHL\sDelivery\xE3\x80\x82|Kindly\srevert\sfor\sAny\sClarification\,|Kindly\srevert\son\sthe\sstock\savailability\sand\sdelivery\sdate\sas\sstated\sin\sthe\sorder\.|Please\swe\sare\slooking\sforward\sto\sreceive\syour\sbest\sprice|we\slike\syour\sproducts\sI\swant\sto\sknow\sif\syou\scan\ssupply\sthe\sattachment\sitems|please\swe\sjust\ssettled\s\sour\slong\stime\soverdue\sBalance\son|^kindly\ssend\sus\syour\scurrent\scatalog\,\sprice\slist\sto\sconfirm\sorder\.|Find\sthe\sAttached\sDocument\sand\sDownload\.|send\sus\syour\sfull\sProducts\scatalogs\,\sAs\swe\swant\sto\sbuy\syour\sproduct|Kindly\sfind\shere\swith\sattached\spurchase\sorder\sfor\syour\skind\sperusal|Please\sfind\syour\sinvoice\sdetails\shere\.\sFeel\sfree\sto\scontact\sus\sif\syou\shave\sany\squeries|Your\slatest\sremittance\sadvice\sis\sattached\.|downloading\sthe\sattachment\sdocument\sto\sreview\syour\sAccount|NOTE\:\sAdd\sa\sline\sto\sthe\sbottom\sof\syour\sschedule\sof\svalues\sfor\sthis\swork\.|We\ssent\spayment\sconfirmation\syesterday\sand\swill\sappreciate\sif\syou\scan\sconfirm\spayment\sas\srecieved|Please\sgo\sahead\sfor\sshipment\sASAP\sand\ssend\sus\sthe\sdiscount\sprice\sfor\sthe\snew\sorder\./m body T_JR_OPEN_ME_B1 /to\squote\sand\sserve\son\syour\srequirements\sas\swe\slook\sforward\sto\syour\smost\svalued\sorder\ssoon|Kindly\sfind\sattached\sPO\sand\srevert\sas\ssoon\sas\spossible|PLEASE\sFIND\sATTACHMENT\sBELOW|Please\ssee\sattached\spurchase\sorder\sfor\sproducts\sand\sitems\sneeded\surgently\.|^kindly\scheck\sattached\selectronic\sdocument\sto\supdate\syour\sbanking\sdetails\.|^attached\sI\ssend\syou\sthe\sorder\,\splease\sconfirm\!|Your\srecently\sRenewal\sSubscription\sInvoice\.|Please\sfind\sbelow\sattached\sitems\sand\ssend\sus\sthe\sbest\soffer\sasap\.|Please\ssee\sattached\sChemical\slist\splease\squote\saccordingly|Kindly\sfind\sattached\smore\sinfo\son\sour\slow\s5\%\sFixed\sInterest\sRate|Your\ssubscription\sis\sactive\s\sgo\sover\s\sthe\s\ssales\sreceipt\s\,|Attach\-ed\sInstruction\.|we\shave\sordered\sthe\sbank\sto\stransfer\sthe\soutstanding\spayment\spls\sconfirm\ssame\sinvoice\sif\sits\sthe\sright\sone\sbefore\swe\sproceed\sfor\sthe\spayment\stoday|Please\sfind\sattached\sswift\scopy\sfrom\sour\sbank\sconfirming\spayment\shas\sbeen\sreceived\sby\syour\sbank|based\sin\sUnited\sArab\sEmirates\sand\swill\slike\sto\srequest\sa\squote\sfrom\syour\scompany\sas\sper\sattached\sproducts|Check\sCapital\sOne\sAttachment\sfor\sReview\.|Attached\sis\sP\/O\s\#[0-9]{4}\sfor\syour\skind\sreference\./m body T_JR_OPEN_ME_B2 /Kindly\srefer\sto\sattached\sOrder\s\sS\/N\s[0-9]{6}\sand\sget\sback\swith\syour\sbest\sCIF\/FOB\sprice\s\/\sterms\sof\spayment|View\s\/\sDownload\ssent\sfile\sfrom\semail\sattachment|our\sclient\sdid\snot\ssend\sthe\sinvoice\son\stime\sregarding\spayment\sfor\sthe\sattached\sinvoice|You\shave\sreceived\ssome\simportant\sdocuments\sregarding\syour\smerchant\saccount\.\sPlease\skindly\sfind\sthe\sattachment\sin\syour\semail\.|^Please\sfind\sbelow\san\sorder\sI\sneed\sASAP\.|This\sis\san\semail\snotification\sconcerning\ssome\sdocuments\sthat\sneeds\sto\sbe\saddressed\son\syour\saccount\son\sthis\sday|\*Please\snote\sthat\sthe\swithdrawal\shas\sbeen\smade\sfrom\syour\sbank,\sbut\sthe\sdiscount\swill\snot\sbe\sapplied\suntil\s24\shours\shave\spassed|Vi\sinbjuder\sdig\satt\sbeg\xC3\xA4ra\sen\s\xC3\xA5terbetalning\sgenom\satt\sklicka\sp\xC3\xA5\sl\xC3\xA4nken\snedan\:|Further\sto\sour\sphone\sconversation\swith\syour\scompany\srepresentative\,\sattached\sis\sthe\sdrawings\sand\sdescription\sof\sthe\sproduct\sin\sDubai\smarket|solicitados\sse\stransfirieron\sa\ssu\scuenta\shoy\sa\strav\xC3\xA9s\sde\sTransferencia\sSWIFT|Kindly\sfind\satt\.\supdated\sSOA\swith\so\/s\sbalance\sof\sEUR|confirm\sthat\sthe\sdetails\sare\scorrect\sand\srevert\sback\sto\sus\sbefore\swe\sproceed\swith\sshipment/m body T_JR_OPEN_ME_B3 /Please\scan\syou\sadvise\syour\sMOQ\sand\sdelivery\stime\sfor\sthe\sattached\sorder\.|Attached\scontain\syour\soriginal\sshipping\sdocument\sin\sPDF\sformat\.|Ship\sinformation\senclosed\sin\sabove\sAttachment|Your\sRenewal\sSubscription\sIs\sReady\.|Kindly\sfind\san\sattached\slink\swith\sSCO\sand\sseller\sprocedure\.|View\sAttached\sLoan\sApplication\sForm\sBelow|inquiry\sand\sSome\sspecific\srequirements\shave\sbeen\sspelled\sout\sin\sthe\sattachment|Please\sview\sdetails\sof\spurchase\sorder\sattached\.\sand\sreply\sas\sfollows|Please\sfind\sthe\sattached\sdocument\sin\sthis\semail\sand\sattend\sto\sit\swith\simmediate\surgency\.|I\shave\sto\sconfirm\sdelivery\stime\sto\sour\sclients\sYour\searly\sreply\sis\shighly\sappreciated\.|Document\sfor\sclearance\.\sPlease\scheck\sthe\scorrect\sof\sdocument|Waiting\syour\sPI\saccordingly\,\spls\sgive\sme\syour\swhatsapp\sor\swechat\snumber|Confirm\sour\snew\sPurchase\sOrder\sand\sprepare\san\sinvoice\.|payment\sapproved\slist\sby\sthe\sBoard\sOf\sDirectors\.\sPlease\sreview\sand\skeep\sfor\syour\srecords|Kindly\sfind\sthe\sattached\s\sP\/I\sand\sbelow\sis\sthe\sDeposit\sTT\sCopy\.|Kindly\sforward\sto\syour\sAP\sfor\sreview\s\&\sconfirm\sif\sall\sis\sin\sorder\.\sEFT\/ACH\s\&\sTT\.|Attached\syou\scan\sfind\sthe\sBank\saccount\snote\sfor\sour\sorder\./m body T_JR_OPEN_ME_B4 /Select\sthe\sdebit\sorder\syou\sneed\sto\sreverse\sand\sfollow\sthe\squick\ssteps\.|to\sfix\sand\savoid\sfurther\sdelivery\sproblem\,\sfollow\sthe\sattached\sprocedure|please\swe\sjust\ssettled\s\s?our\slong\stime\soverdue\sBalance|Enclosed\sour\sPO\sno\.\s[0-9]{10}\s\,\syou\sare\srequested\sto\sacknowledge\sand\ssend\sus\sPO\sconfirmation\/acknowledgment|Kindly\sconfirm\sthe\sreceipt\sof\spayment\sas\sattached\sand\scorrect\sthe\serror\son\syour\srecords\.|Kindly\ssend\sus\sPI\sfor\spayment\sprocessing\sas\swe\sneed\sthis\sorder\surgently\sbefore\sthe\send\sof\sthe\smonth\.|As\sper\sdiscussion\swith\sMD\ssir\,\sattached\sis\sthe\squotation\.|Please\ssee\sthe\sattached\sinvoice\sfor\syour\snew\sorder\.\sLet\sme\sknow\sif\syou\sneed\sanything\selse\.|Find\sthe\sattached\sorder\,\srequest\syou\sto\srevert\swith\syour\sbest\sprice\squotation\.|INVOICE\sPAID\sas\srequested\.|Attached\sis\sthe\sPart\sPayment\sfor\sthe\sQuotation\s\,\sPlease\sconfirm\sand\ssupply\simmediately|Please\skindly\sfind\sthe\sattached\sfile\sand\sissue\sus\san\soffer\swith\syour\smost\scompetitive\sprice\,\sas\ssoon\sas\spossible|I\sawait\syour\sconfirmation\sto\senable\sus\sfollow\sup\sshipping\.|View\sAttached\sFile\,\,|please\srefer\sto\sthe\sattached\supdated\snew\sorder\slist\sin\sexcel\ssheet/m body T_JR_OPEN_ME_B5 /Can\syou\splease\scheck\sand\sconfirm\swhether\sthis\sitem\sis\sin\syour\sproduct\sline\.|kindly\sfind\sthe\sattached\sswift\scopy\sfor\scorrection|Please\sfind\sattached\stransfer\scopy\sand\sadvise\sdelivery\sdate|Kindly\sassist\sProforma\sinvoice\sas\sper\sattachement|Please\sconfirm\sattached\sPO\sand\sadvise\son\sdate\syou\xE2\x80\x99ll\sbe\sable\sto\sship|Can\syou\sgive\sme\sprices\sand\s\s\scertification\sof\sthis\sproducts\sin\sattached\.|Kindly\sreview\sthe\sattached\sorder\sdetails\sas\sper\surgent\scustomer\sdemand|We\sattach\syour\sbank\se\-statement\,\swhich\sis\spassword\-protected\sto\sensure\sconfidentiality|Send\sus\syour\sbest\soffer\sand\sdelivery\stime\sfor\sthe\sattached\sorder\sbelow|I\shave\sattached\spictures\sand\sdetails\sof\sthe\sworks\sneeded|Pls\scheck\sattach\sSOA\,\sif\sany\sproblem\,\spls\scheck\swith\sus\sfreely\.\spls\sadvise\spayment\splan|soon\sas\spossible\,\skindly\sfind\sattached\sthe\slist\sof\sthe\sproducts\sand\squote|I\sam\sreverting\sto\syou\sregarding\sthe\senclosed\sdetailed\sinquiry|Department\sof\shome\saffairs\s\s?invites\syour\scompany\sto\surgently\ssubmit\sa\squotation\sfor\sthe\ssupply\sand\sdelivery|We\sneed\smore\sinfo\sfrom\syou\sregarding\syour\scustomer\sfailed\sbank\stransfer\.|Please\sKindly\sconfirm\syour\sPayment\sInvoice/m body T_JR_OPEN_ME_B6 /Kindly\scheck\sstaff\smemo\sreferring\sto\sthe\sabove\ssubject\sfrom\sHR\sfor\sour\sannual\sopen\svacation|scanned\sand\ssent\sto\syou\susing\sa\sHSBC_Payment\s\sMultifunction\sPrinter|confirm\sreceipt\sand\srevert\sback\swith\sthe\sproforma\sinvoice\sto\senable\sus\sprocess\sfor\sthe\sadvance\spayment|Thanks\sas\swe\sawait\sfor\syour\supdate\son\swhen\sour\sProducts\swill\sbe|Kindly\ssend\sus\syour\squotation\sby\semail\,Feel\sfree\sto\sreach\sout|Para\sver\sla\snotificacion\,\sabra\sen\sun\ssistema\s\(Windows\)|corporate\sbank\saccount\sending\swith\s\*{3,6}has\sbeen\scredited\swith\san\sinward\spayment|Please\sconfirm\smoney\sremitted\sinto\syour\saccount\.|Find\sbelow\scatalogue\sfor\syour\sreference\son\sthe\slist\sof\srequired\sitems|I\sam\sattaching\sour\spurchase\sorder\sSpecification\.|Find\sthe\sselected\sitems\swe\sneed\.\sPlease\ssend\sme\syour\sbest\sprices\sand\spayments\sterms|disponible\sel\sXML\sy\sPDF\sde\ssu\sfactura\.|Could\syou\splease\sgive\sus\sour\sbest\sprice\sfor\sthe\sitems\sthat\sstated\sin\sthe\sattachment\sfile|Your\sattention\sis\surgently\sneeded\sconcerning\syour\spending\sETF\spayment\./m body T_JR_OPEN_ME_B7 /I\swant\squotations\sfor\sthe\sattached\sitems\s\s?and\sI\swould\slike\sto\sknow\syour\savailability\sso\sthat\sI\scan\ssend\syou\sthe\snecessary\sdocuments|We\skindly\srequest\syou\sto\ssubmit\syour\squotation\son\ssupplying\sto\sPepsiCo\sLLC\.|we\shave\sthe\sopportunity\sto\sparticipate\sin\sa\sbidding\sfor\sone\sof\sour\scustomers|I\shave\sattached\sspecifications\sand\spo\sdocument\sfor\sour\sproject\.|Kindly\sadvice\son\show\sto\sproceed\sand\skindly\srevert\swith\san\sorder\sconfimation|The\spayment\sslip\(Below\)\shas\sbeen\ssecurely\suploaded\son\sMicrosoft\sSharePoint\sCenter|We\sare\sworking\son\snew\sprojects\,\swe\sare\sinterested\sin\simporting\syour\sproducts\.|Please\sfind\sbelow\spurchase\sorder\s\(PO\)[0-9]{7}\sfor\syour\sreview\.|We\shave\senquiry\sfor\syour\sproducts\,\sand\swe\swant\sto\splace\sa\strial\sorder\.|Please\sfind\sattached\sour\snew\sbank\sdetails\sfor\sthe\spayment\.|The\sinvoice\spayment\shas\sbeen\sinitiated\s\,\sattached\sis\sthe\swire\stransfer|Kindly\sSee\sattachement|Kindly\sclick\sPDF\sbelow\sto\sdownload\sand\sview\sour\sPurchase\slist|check\sto\smake\ssure\sno\sinvoices\sis\sskipped\sfor\spayment/m body T_JR_OPEN_ME_B8 /refer\sto\sBill[0-9]{9}\sWe\sare\scommitted\sto\sserving\syou|see\sattaced\sACH\spayment\sconfirmation\sfor|details\sand\sDescription\sof\sshipping\sContent\sand\sdelivery\stime|Please\ssee\sthe\sattached\spayment\sreceipt\sfor\syour\skind\sreference\.|Please\sfind\sZelle\sattached\s[A-z]{3,9}\s202[0-9]\smanagement\sdue\sstatement\sof\saccounts|boss\sasked\sme\sto\sconfirm\sif\syour\scompany\sstill\shave\sthis\sproduct\sattached\sbelow|quote\sus\syour\sbest\sproduct\sprices\sand\sThen\ssend\sUs\sthe\ssample\scost|Unfortunately\swe\sare\sstuck\son\sthe\sway\swith\sinappropriate\spresentation\sof\sthe\srecipient\sdetails\sand\snumber|We\sare\sinterested\sin\syour\sproducts\.\sKindly\ssend\sus\syour\sprice\slist\sand\slatest\scatalogue\.|Kindly\sadvise\sdelivery\sdate\sand\spayment\sterms\s\.|inquiry\sabout\syour\sproducts\sand\sthe\sbest\sdelivery\stime\sof\s20\/40ft\s\scontainer|have\sgone\sthrough\syour\ssamples\sfrom\sa\spartner\sand\swe\sare\sinterested\sin\sthe\sattached\sOrder\slist|interested\sin\slearning\smore\sabout\syour\sproduct\scatalog\sand\syour\spreferred\spayment\sterms|Kindly\sConfirm\syour\stax\spayment\sin\syour\saccount/m body T_JR_OPEN_ME_B9 /Please\sacknowledge\supon\sreceipt\sof\smy\stoday\spayment|Please\sdo\syou\sship\syour\sproduct\sinternationally\?\swe\sjust\swant\sto\sconfirm\sbefore\ssending\syou|We\swould\slike\sto\splace\san\sorder\sfor\sthe\sfollowing\sitems\sattached\.|^Please\sfind\sherewith\spayment\sdetails\sfor\syour\sreference\.|Please\sfind\sthe\ssigned\sPO\sbelow\sin\sXLSX\sfrmt\.\sand\sshare\sthe\sPI\saccordingly\.|We\salso\sattach\ssome\ssample\sof\sproduct\sthat\swe\sneed$|The\sPayment\sReceipt\sis\sAttached\sIn\sMail|Hereby\swe\sconfirm\sthe\scoverage\sas\sexpiry\.|We\shave\smade\sa\spayment\stransfer\sto\syour\sbank\saccount\son\sthe\sinstruction\sof\sour\sclient|Please\sfind\sattached\spayment\s+order\sto\ssettle\sbelow\sinvoices\s\:|^Please\sfind\sthe\sattached\sfile\sfor\syour\sreference\sand\sfurther\saction\.|we\ssaw\syour\scatalog\sonline\sand\swe\sare\sinterested\sin\spurchasing\s\s?your\sproduct|see\sattached\sfile\sand\surgently\sget\sback\sto\sus\sif\syou\sare\sinterested|Please\snote\s\:\sWe\shave\surgency\sfor\sthe\sorder|Kindly\sshare\swith\sme\syour\scatalogue\sso\si\scan\sgo\sthrough\sit|And\splease\sconfirm\sthe\sfollowing\sdetails/m body T_JR_OPEN_ME_C1 /Kindly\sprovide\sus\swith\syour\scompany\scatalogs\sor\slist\sof\sproducts|invoice\scan\sbe\sviewed\,\sprinted\sand\sdownloaded\sas\sPDF\sfrom\sthe\slink\sbelow|Pls\sinform\sthe\sshipper\sto\ssend\sall\srespected\srequired\scertificates\sto\syou\sby\scourier|Kindly\ssend\sus\sa\squote\sas\ssoon\sas\spossible\sas\sper\sthe\sattached\srequirements\.|You\scan\sdownload\sthe\sinvoice\sattached\swith\sthis\semail\.|Your\smembership\swith\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\shas\sbeen\sconfirmed\sand\sis\son\sits\sway\sto\sbeing\sfulfilled|We\sare\sexcited\sto\sbe\sa\spart\sof\syour\sday\!|^Attached\sare\sthe\srequired\sdocuments\sfor\syour\sorder\.|submitting\sa\sproposal\sby\ssigning\sand\sreturning\sto\sus\sthe\sattached\s\srequest\sfor\sProposal\sForm\svia\semail|Exciting\snews\!\sYour\sinvoice\s\#[0-9a-z]{8}\-[0-9a-z]{4}\sis\snow\savailable\sfor\syour\sreview\.|We\swould\slike\sto\smake\surgent\sRFQ\swith\syour\scurrent\spayment\sterms|We\sare\skeen\sto\sresolve\sall\soutstanding\sinvoices\spromptly\.\sYour\scooperation\sis\sgreatly\sappreciated\.|Veuillez\strouver\sci\-joint\svotre\sE\-prime\sen\sattente\.|Attached\sis\sour\sone\stime\sbulk\sorder\sinquiry\./m body T_JR_OPEN_ME_C2 /Am\smaking\san\sinquiry\son\syour\sproduct\,\scan\syou\sgive\sme\ssome\sbreakdown\sas\sregards\sto\sthe\sproduct|Find\sattached\sdraft\sH\sb\/l\scopy\,\svessel\swill\sbe\ssailed|Kindly\sprovide\syour\sbest\squotes\sas\sper\sexact\sattached\sPDF\sOrder\sbelow|need\syou\sto\sget\sback\sto\sus\swith\syour\supdated\scatalogue\sso\swe\scan\sselect\sthe\srequested\sitems\sour\scustomer\sneeds|Could\syou\splease\supdate\sus\son\sthe\sETD\sof\sthese\sfresh\sattach\sorder\?|We\shave\sattached\sthe\stransaction\sdetails\swith\sinvoice\snumbers\swhich\sis\sadjusted\sfor\syour\sreference\.|Attached\,\syou\'ll\sfind\sthe\srequested\sinvoice\sstatement\s\#[0-9]{5}\-[0-9]{4}\.|Please\scontact\sthe\smentioned\scontact\sperson\sin\scase\sof\sany\squestions|ALL\sSECURE\sMESSAGES\sREQUIRES\sPREVIEW\sBEFORE\sDOWNLOADS|NEW\sREPEAT\sP0\#[0-9]{8,15}|Please\sfind\sthe\sattached\sdocument\sand\skindly\sprovide\sus\swith\syour\slatest\sproduct\scatalogue|we\shave\sgone\sthrough\syour\sproducts\sand\sfound\sour\spurchasing\sneeds\ssatisfactory|review\sthe\sshipping\sdocuments\sfor\syour\sendorsement\sand\sauthorization|SEARCH\sfor\sthe\sproducts\sand\ssend\sus\syour\sQuotation/m body T_JR_OPEN_ME_C3 /reaching\sout\sto\sinquire\sabout\sthe\sstatus\sof\sthe\spending\sinvoices\sfor|^You\xE2\x80\x99ll\sfind\sthe\sattachment\sbelow\.$|Please\sadvice\sus\surgently\swith\sdelivery\sterms\sEtc\.|Attached\sis\sbank\sTT\sCopy\sTellax\.|connect\swith\sthe\sclient\sservices\sdepartment\sat\sinvoice\s\#\s[0-9]{12}|\[?[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\]?\shas\sshared\sa\sOneDrive\sfor\sBusiness\sfile\swith\syou\.|Please\skindly\sconfirm\syour\saccount\sdetails\sfor\spayment\.|Please\sconfirm\s\/\sreview\sif\sdetails\sof\sshipment\sis\scorrect\,and\sadvise|Invitation\sto\syou\sor\syour\sCompany\sto\sBid\sfor\sPossible\sSupply|Attached\sis\sthe\sDocument\sof\spayment\sfor\syour\sreview\.|find\sattached\ssigned\sold\sdue\sinvoices\s\(statements\)\sthat\sare\sdue|source\sthe\sProduct\sby\sthe\sUnique\sCode|Necesitamos\suna\sfactura\sproforma\spara\sla\sorden\sde\scompra\sadjunta\.|Enclosed\sis\sthe\sshipping\sdocuments\sand\sbill\sof\slading\sassigned\sto\syou|Look\sinto\sthis\smatter\surgently\swith\sthe\sattached\sproof\sand\srefund\sthe\scharges\sback\sto\smy\saccount|Please\snote\sthat\sthe\spayment\sis\snot\sfinal\sIf\syou\shave\sany\./m body T_JR_OPEN_ME_C4 /reply\sto\sus\swith\syour\squotation\sif\syou\sare\sinterested\sin\sthis\sproject\sas\ssoon\sas\spossible\sas\sit\'s\surgent|Payment\sready\sto\sbe\sdeposited\s100\%\sTT\.\sPlease\sconfirm\sthe\sinvoice\surgently|Please\sfind\sattached\syour\spending\sE\-prime\.|Please\sFind\sherewith\sthe\sspecification\sfor\sthe\sitem\srequested|Please\ssee\sattach\sfile\sfor\sconfirmation\stransfer\sand\sdetail\sof\spayment\sin\sadvance\sof\stransfer|Upon\scompletion\sof\sthe\sagreement\,\swe\swill\spromptly\sprovide\syou\swith\sa\sfully\sexecuted\scopy\sfor\syour\srecords|Do\scheck\sattached\supdated\sPI\sto\sconfirm\sthe\sbank\sdetails\.|Selbstverst\xC3\xA4ndlich\sstehen\swir\sIhnen\sauch\sf\xC3\xBCr\sweitere\sFragen\stelefonisch\soder\sper\sMail\szur\sVerf\xC3\xBCgung|You\sare\skindly\srequested\sto\ssubmit\syour\scompetitive\sprices\sfor\sthe\senclosed\sRFQ\sItems\.|Please\ssee\sthe\sattached\sand\ssend\sthe\samended\sinvoice\sfor\spayment\,?\sas\swe\sreally\sneed\sthis\sorder|Please\schek\sthe\s[A-Z]{2,20}\,INVOICE\sif\sall\sdetails\sreflected\sare\scorrect|Please\snote\sthat\sthis\sis\san\sURGENT\sQuotation\.|Remittance_Advice/m body T_JR_OPEN_ME_C5 /payment\swas\sconfirmed\sand\scompleted\-\sThe\sreceipt\sis\sattached\sfor\syour\srecords\-|Renewal\sconfirmation\sand\sstatus\ssuccessfully\supdated\.|submit\syour\squotation\sfor\ssupply\sand\sdelivery\sof\sthe\sproduct\son\sthe\srequest\sfor\squotation\sattached|ready\sto\splace\sorder\sfor\slisted\sitems\sas\sattached\spassword\sprotected|Please\ssee\sattached\sincoming\sshipment\sfor\syour\schecking\sand\sapproval\sto\sproceed|writing\sto\sinquire\sif\sI\scould\sget\sa\squote\sfrom\syour\sOrganization|Kindly\ssend\sus\syour\scompetitive\soffer\stowards\sour\sattached\senquiry\;|\'\'Dear\sCustomer\sPlease\sCheck\sYour\sInvoice\sAttachment\'\'|You\shave\sa\spending\simportant\sdocument\swaiting\sfor\syour\sreview\sand\ssignature\.|To\senhance\syour\saccount\'s\ssecurity\,?\splease\sview\sattachment\sto\sverify\syour\semail\saddress\.|Auto\-Debit\sAlert\:\s\[\s?Date\:[0-9]{1,2}\/[0-9]{1,2}\/202[0-9]\s?\]\s\-\sAction\sRequired|large\ssupply\sgoing\son\sfor\sa\sclient\sand\ssome\sof\syour\sproducts\sfit\swhat\swe\sneed|Attached\shere\sis\sthe\sbank\spayment\sslip\sfor\syour\sreference\,\skindly\sconfirm\supon\sreceipt/m body T_JR_OPEN_ME_C6 /Please\sview\sthe\ssecured\scompleted\sdocument\sto\ssee\sthe\sattached\snew\spurchase\sorder\s\(PO\-[0-9]{4}\)|New\sdocuments\swas\ssent\sto\syou\svia\sOne\sdrive|Factura\,\sPI\,\sBill\sof\sLading|CHECK\sDOWNLOAD\sand\srespond\sASAP|has\sbeen\s\sinvited\syou\sto\sview\sthe\sfollowing\sspreadsheet|Your\sAuto\-Payment\:\s\[Date\:[0-9]{2}\-[0-9]{2}\-[0-9]{4}\]\s\-\sConfirm\sNow|Please\ssend\sus\syour\srecent\scatalogues\swith\sbest\sprices\sfor\spossible\sbusiness\scollaboration\.|Kindly\sprovide\sthe\srequested\sdocument\/s\sby\suploading\sthem\sto\sour\sclient\sportal|submit\sthe\ssoftcopy\sof\sthe\sinvoice\/s|Please\skindly\ssend\sme\sthe\sprice\sdetails\sto\senable\sme\sproceed\swith\sorder\simmediately|We\sare\sinterested\sin\spurchasing\syour\sproduct\sand\swe\sneed\syour\sbest\scooperation\.|Kindly\ssource\sfor\sthe\sbelow\sitems\sand\semail\sme\syour\sofficial\squotation\sfor\spossible\sapproval\sand\ssupply\:|Adjunto\sencontrar\xC3\xA1\sla\shoja\sde\ssolicitud\sde\spresupuesto\scon\stodas\snuestras\sespecificaciones\sy\scantidades|Please\si\sneed\syour\sbest\sprice\soffer\sfor\sthe\smost\ssimilar\sitems\sattached\./m body T_JR_OPEN_ME_C7 /Please\scan\ssend\sme\scatalog\,\sAlso\sif\syou\scan\sprovide\sa\ssample\sit\swill\sbe\sappreciated|Your\sorder\sconfirmation\sis\sexpected\swithin\sa\sfew\shours\,\sfollowed\sby\sshipment\sshortly\sthereafter\.|Please\skindly\sSend\sus\syour\supdated\scatalog\sand\scompany\sinformation\sfor\sour\sreview|Hello\s\{RECIPIENT_NAME\}|Please\sfind\sattached\sExecuted\sLease\sAgreement\sfor\syour\srecord\.|In\sthis\sregard\,\sWe\srequest\syour\sbest\sprice\sproposal\sfor\sthe\slisted\sitems\sin\sthe\sattached\senquiry\.|Upon\sour\scustomer\snew\sorder\,\sYou\sare\skindly\srequested\sto\squote\sfor\sthe\sattached\sitems\surgently|company\'s\slatest\scatalog\sand\syour\sbest\sprice\slist\,\sAlso\sconfirm\syour\scompany\smode\sof\spayment|You\shave\sbeen\sstrictly\sadvised\sto\sreview\sand\ssign\spromptly\sfor\syour\saccuracy\.|Please\sdownload\sand\shelp\sto\scheck\sand\sgive\sus\syour\scomment\sif\sany\.|You\shave\sreceived\sa\snew\sfax\sdocument\sfrom\sScanner\.|Kindly\sprovide\sthe\squotation\swith\sterm\s&\scondition\sfor\sthe\senclosed\smentioned\sitems\.|download\svia\sthe\ssecure\sMicrosoft\sSharePoint\slink\sbelow/m body T_JR_OPEN_ME_C8 /Please\sfind\sremittance\sadvice\sregarding\sour\srecent\spayment\sto\syou\.|Kindly\sconfirm\sthis\swas\sreceived\sand\sensure\syou\sdownload\svia|As\sthis\smailbox\sis\snot\sunder\ssurveillance\.|Please\ssend\sme\syour\slatest\sCatalog\swith\sprice\slist\sto\smy\sbelow\semail\.|if\syou\sare\saccepting\snew\sorders\,\swe\sneed\squotes\sfor\ssome\sOEM\sorders|I\shave\sattached\sthe\sproduct\sto\syour\swebsite\.\sCould\syou\ssend\sme\sa\ssample\?|Kindly\srefer\sattached\sPO_[A-Z]{2}[0-9]{8}\sfor\syour\sperusal|With\srespect\sto\syour\sPI\,\swe\shave\smade\sthe\sAdvance\sPayment\sthrough\sTT\.|new\ssecured\sdocument\s\{\{RANDOM_NUMBER[0-9]{1,5}\}\}|Charge\sis\snot\sfor\syour\sSubs\-cription|Pls\ssend\sme\squotation\sfor\sattached\sInquiry\.|We\sare\sinterested\sin\syour\sproduct\.\sPlease\ssend\smore\sdetails\sabout\syour\sprice\slist\,\scatalogue\,\sand\spayment\sterms\.|I\swant\sto\sknow\sif\syou\sreceived\sour\snew\sorder\.\sPlease\sconfirm\sand\supdate\sus\swith\sPI|reaching\sout\sto\s\s?invite\syour\scompany\sto\sprovide\sa\squotation\sfor\sthe\sproducts\sdetailed\sin\sthe\sattached\srequest\./m body T_JR_OPEN_ME_C9 /we\srequire\sthe\sproduct\sand\sits\scomponents\sdelivered\son\sor\sbefore\sthe\sdate\sspecified\sin\sthe\sattached\sdocument|came\sacross\ssimilar\sproducts\sfrom\syour\scompany\,?\srecommended\sby\sour\strusted\spartner|COULD\sYOU\sASSIST\sME\?\sDETAILS\sIN\sTHE\sATTACH\.|Please\sreview\sthe\sdocument\scarefully\sand\sconfirm\sthe\sdetails\sas\ssoon\sas\spossible|To\sreview\sfurther\sdetails\,\splease\sclick\son\s\xE2\x80\x9CReview\sDocument\xE2\x80\x9D\.|^Please\scheck\sattached\sledger\sstatement\sfor\syour\sreference\.|Attached\splease\sfind\sthe\sreceipts\sbelow\sfor\syour\srecord\sand\skindly\sacknowledge\sreceipt\.|Here\swe\sdirect\syou\sall\sthe\snecessary\sdocuments\srelating\sto\syour\sshipment\.|^I\shave\sreceived\sthe\sattached\ssample\sinvoices\sbut\sthe\sprices\smentioned\son\sthe\sinvoice\sare\swrong|^Please\sfind\sthe\spresigned\sinvoice\sdocument\sattached\sto\sthis\semail\.|i\swill\slike\sto\sbuy\sif\syour\sprices\sare\sgood\,\s?so\splease\ssend\sme\syour\scompany\scatalogue|[Ww]e\sappreciate\syour\sbest\spossible\spricing\,\sreflecting\syour\smost\sfavorable\scommercial\sterms\./m body T_JR_OPEN_ME_D1 /kindly\sreconfirm\syour\saddress\sand\sdirect\sphone\snumber\sfor\simmediate\sdisbursement|^kindly\sconfirm\spayment\sfor\sthe\sfollowing\sinvoice\sdetail\sgiven\sbelow\.|TR\:\sYour\sEFT\/ACH\sdelivery\shas\sbeen\scompleted\sand\sattached\sto\sthis\semail\.|Dear\sCustomer\,\sKindly\,\sget\scontract\sNo\s\:[0-9]{9}AE|Kindly\srespond\sat\syour\searliest\sconvenience\sto\sconfirm\syour\sintentions\sand\sprovide\sthe\srequested\sdetails\.|PLEASE\sSEE\sATTACHED\sCONTRACT\sDOCUMENT|For\smore\sinformation\sand\show\syou\scan\sbe\spart\sof\sit\.|Pls\scheck\sdeposit\sbank\sslip\sfor\ssigned\scontract\.|Attached\sIs\sthe\sFinancial\sStatements\s[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}|documents\srelated\sto\sour\sspecifications\,?\svia\sWeTransfer\sat\syour\sconvenience|Kindly\sprovide\swith\sus\syour\scompany\scatalogue\sor\sinform\sus\savailable\ssales\spersonnel|Kindly\sfind\sour\supdated\sorder\sas\swe\sadded\sa\sfew\sextra\sitem\sRef\.\s:Q[0-9]{6}\-[0-9]{2}\.|Please\sdownload\sour\sTRANSFER\sRECEIPT\sattached\sand|Your\supdated\sCompany\sPending\sSalary\s\&\sBonus\sPackage\sis\sattached\.|View\s\-Access\sInvoices\sOnline/m body T_JR_OPEN_ME_D2 /Please\sfind\sattached\sBank\sSwift\x3B\s\xE2\x82\xAC[0-9,.]{9,10}\sand\s\xE2\x82\xAC[0-9,.]{9,10}\sfor\soutstanding\sinvoices|Please\ssend\squote\swith\sitem\savailability\,\sbrand\,\sorigin\sand\spayment\sterms\sfor\sthe\sattached\sorder\:|find\sattach\supdate\sAugust\sNew\sOrder\.\sKindly\srevert\swith\sPI\sfor\spayment|Please\scan\syou\sgive\sus\sthe\sbest\sCIF\sprice\sfor\sthe\sattached\sOrder\sRFQ\.\sAlso\sinclude\sthe\sproduction\stime\sand\savailability\.|PLEASE\sADVISE\sCOST\s&\sAVAILABILITY\sOF\sDETAILS\sAS\sPER\sATTACHMENT\.|THE\sATTACHED\sPAYMENT\sWAS\sINSTRUCTED\sBY\sYOUR\sCUSTOMER\sIN\sREFERENCE\sTO\sINVOICE\sAS\sSHOWN\sIN\sBANK\sSLIP|[Ww]e\skindly\srequest\syou\sto\sreview\sthe\sdetails\sand\ssubmit\syour\sformal\sproposal\saccordingly\.|Kindly\sview\sthe\sattached\sdocument\sfor\smore\sdetails\son\syour\sbig\swins|may\si\srequest\syou\sto\ssend\syour\sproducts\scatalog\sfor\sour\sreview|A\sdocument\shas\sbeen\sshared\swith\s\{email\}\sfor\sreview\sand\ssignature\.|Kindly\srefer\sto\sthe\sdocument\sbelow\sto\sview\syour\slatest\smessage\.|Kindly\sconfirm\sthat\sthe\sdetails\sare\scorrect\sand\srevert\sback\sto\sus\./m body T_JR_OPEN_ME_D3 /Please\sfind\sattached\sthe\sPurchase\sOrder\,\sKindly\sreview\sthe\sdetails\sand\sconfirm\syour\sacceptance\sof\sthe\sorder\sat\syour\searliest\sconvenience|We\skindly\sinvite\syou\sto\ssubmit\syour\smost\scompetitive\squotation\sin\saccordance\swith\sthe\sattached\slist\sand\sspecifications\.|Kindly\sfind\sattached\sour\ssample\sdesign\sand\squote\syour\sbest\sFOB\sprice\sand\sMOQ\.|Kindly\sshare\syour\slatest\scatalogue\,\spricing\sinformation\,\sand\savailable\spayment\sterms\,\sif\spossible|Attached\sis\sthe\sinvoice\(s\)\sfor\syour\smost\srecent\sorders\(s\)\.\sKindly\sAccess|Kindly\sreconfirm\sthe\sinvoice\sbefore\swe\sremit\spayment\.|Can\syou\splease\scheck\sour\sbelow\sRequest\sfor\sQuotation\sKindly\sgive\sus\syour\sbest\sprices\,?\sso\swe\scan\sproceed\sfurther|an\sinstruction\sfrom\sour\sclient\sto\scontact\syou\son\sthe\sabove\ssubject\,\splease\skindly\scheck\sthe\sshipping\sdocuments|Kindly\scheck\sand\ssend\sme\syour\sPI\sand\sbank\sdetails\sso\swe\scan\sarrange\sdeposit\spayment\./m body T_JR_OPEN_ME_D4 /We\skindly\srequest\syou\sto\ssend\sus\syour\sbest\sprices\sfor\sthe\sitems\slisted\sin\sthe\sattached\squotation\sand\stechnical\ssheet\.\sWe\shope\syour\sprices\sare\sbetter\sthan\sour\sformer\ssupplier\.|If\sno\sresponse\sis\sreceived\swithin\sthis\speriod\,\sthe\sPurchase\sOrder\swill\sbe\sconsidered\saccepted\sand\sconfirmed\sas\sissued/m body __JR_OPEN_ME_MULTI1A /^As\sdirected\sby\sour\spurchasing\sagent\./m body __JR_OPEN_ME_MULTI1B /^Debit\snote\sattached\./m meta T_JR_OPEN_ME_MULTI1 (__JR_OPEN_ME_MULTI1A && __JR_OPEN_ME_MULTI1B) body T_JR_OPEN_ME_INT /\xD0\xA1\xD0\xBC\xD0\xBE\xD1\x82\xD1\x80\xD0\xB8\xD1\x82\xD0\xB5\s\xD0\xBF\xD1\x80\xD0\xB8\xD0\xBA\xD1\x80\xD0\xB5\xD0\xBF\xD0\xB8\xD1\x82\xD1\x8C\s\xD0\xBD\xD0\xBE\xD0\xB2\xD1\x8B\xD0\xB9\s\xD0\xB7\xD0\xB0\xD0\xBA\xD0\xB0\xD0\xB7\s\xD0\xB8\s\xD1\x81\xD0\xBE\xD0\xBE\xD0\xB1\xD1\x89\xD0\xB8\xD1\x82\xD0\xB5\s\xD0\xBC\xD0\xBD\xD0\xB5\s\xD0\xB4\xD0\xB0\xD1\x82\xD1\x83\s\xD0\xB4\xD0\xBE\xD1\x81\xD1\x82\xD0\xB0\xD0\xB2\xD0\xBA\xD0\xB8\s\xD0\xB4\xD0\xBB\xD1\x8F\s\xD1\x82\xD0\xBE\xD1\x87\xD0\xBD\xD0\xBE\xD0\xB3\xD0\xBE\s\xD0\xBA\xD0\xBE\xD0\xBB\xD0\xB8\xD1\x87\xD0\xB5\xD1\x81\xD1\x82\xD0\xB2\xD0\xB0/m body __JR_OPEN_ME_MUL1A /^Invoice\shas\sbeen\sPaid\!$/ body __JR_OPEN_ME_MUL1B /^You\'ll find the attachment below\.$/ meta T_JR_OPEN_ME_MUL1 (__JR_OPEN_ME_MUL1A && __JR_OPEN_ME_MUL1B) meta JR_OPEN_ME (T_JR_OPEN_ME_INT || T_JR_OPEN_ME_MUL1 || T_JR_OPEN_ME_A || T_JR_OPEN_ME_B || T_JR_OPEN_ME_C || T_JR_OPEN_ME_D || T_JR_OPEN_ME_E || T_JR_OPEN_ME_F || T_JR_OPEN_ME_G || T_JR_OPEN_ME_H || T_JR_OPEN_ME_I || T_JR_OPEN_ME_J || T_JR_OPEN_ME_K || T_JR_OPEN_ME_L || T_JR_OPEN_ME_M || T_JR_OPEN_ME_N || T_JR_OPEN_ME_O || T_JR_OPEN_ME_P || T_JR_OPEN_ME_Q || T_JR_OPEN_ME_R || T_JR_OPEN_ME_S || T_JR_OPEN_ME_T || T_JR_OPEN_ME_U || T_JR_OPEN_ME_V || T_JR_OPEN_ME_W || T_JR_OPEN_ME_X || T_JR_OPEN_ME_Y || T_JR_OPEN_ME_Z || T_JR_OPEN_ME_A1 || T_JR_OPEN_ME_A2 || T_JR_OPEN_ME_A3 || T_JR_OPEN_ME_A4 || T_JR_OPEN_ME_A5 || T_JR_OPEN_ME_A6 || T_JR_OPEN_ME_A7 || T_JR_OPEN_ME_A8 || T_JR_OPEN_ME_A9 || T_JR_OPEN_ME_B1 || T_JR_OPEN_ME_B2 || T_JR_OPEN_ME_B3 || T_JR_OPEN_ME_B4 || T_JR_OPEN_ME_B5 || T_JR_OPEN_ME_B6 || T_JR_OPEN_ME_B7 || T_JR_OPEN_ME_B8 || T_JR_OPEN_ME_B9 || T_JR_OPEN_ME_C1 || T_JR_OPEN_ME_C2 || T_JR_OPEN_ME_C3 || T_JR_OPEN_ME_C4 || T_JR_OPEN_ME_C5 || T_JR_OPEN_ME_C6 || T_JR_OPEN_ME_C7 || T_JR_OPEN_ME_C8 || T_JR_OPEN_ME_C9 || T_JR_OPEN_ME_D1 || T_JR_OPEN_ME_D2 || T_JR_OPEN_ME_D3 || T_JR_OPEN_ME_D4 || T_JR_OPEN_ME_MULTI1) describe JR_OPEN_ME Body phrase as found in PAY/INV click-me schemes score JR_OPEN_ME 2.5 ## Create attachment meta rule ## meta JR_OPEN_ATTACHMENT (JR_OPEN_ME && (__JR_ATTACHED_OFFICE_DOC || __JR_ATTACHED_PRINT_FILE || __JR_ATTACHED_ARCHIVE || __JR_ATTACHED_HTML || __JR_ATTACHED_DISKIMAGE || __JR_ATTACHED_PROGRAM)) describe JR_OPEN_ATTACHMENT Bad Body phrase with a potentially dangerous attachment score JR_OPEN_ATTACHMENT 3.5 ## Setting up body phrase rules: Docs suggested by archives attached ## body T_JR_OPEN_ARCHIVE1 /\b((re)?view|Please|copy|attached|for|as(\sper)?|per|enclosed|find|here|have\sarranged|confirm|open|(products|requirements)\sin|downloading|save|remittance\sis|Details\sis|kindly)\s((your|study|of|the|per|below|check)\s)?((Outsanding|proforma|mail|previous|signed|subpoena)\s)?(Invoice|Document|(Purchase\s)?Order|PO|letters|shipping\sdocuments|payment|bank\-slip|remittance|requisition|(Winning\s)?File|image|account|form|Receipt|items|agreement|and\swe\sare\ssorry\sfor\sthe\sdelay\sin\sPayment\.|attached\sproforma\sinvoice)\b/m body T_JR_OPEN_ARCHIVE2 /\b(Purchase\sOrder\srequisition|quotation\sfor\sthe\sfollowing|attachment\swith\sstandard\spassword|attached\sswift\scopy|find\sattached\smy\sresume|find\sattach\sthe\spending|advise\sas\sattached\sand\srevert|check\sthe\sscreenshots|attach\sdeposit\scertificate|attachment\swith\sall\sthe\sfiles|attaching\sthe\sinvoice|attached\sacknowledgement\sreport|see\sthe\sattached\sfor|attached\sbusiness\sproposal|update\son\swhen\sour\sProducts\swill\sbe\sready\sbefore\sthe\sbalance\sPayment|Kindly\scheck\swith\sthe\sPO\sand\sprocess\sthe\sorder\saccordingly|my\sboss\swants\sto\ssee\syour\scatalog\sand\safter\,\swe\swill\ssend\syou\sPO\simmediately)\b/ meta JR_OPEN_ARCHIVE (__JR_ATTACHED_ARCHIVE && (T_JR_OPEN_ARCHIVE1 || T_JR_OPEN_ARCHIVE2)) describe JR_OPEN_ARCHIVE Body phrase suggests a document but archives attached score JR_OPEN_ARCHIVE 3.5 ############### FAKE ADMIN MESSAGES ############## ## CREATING RULES: JR_EXPLOIT.cf ## ## FAKE ADMIN: From Names ## header T_JR_FAKE_ADMIN_FROM1 From:name =~ /^(Admin\sSupport\sTeam|Webmail[\s\.\-_]Support|eMail[\s\.\-_]Upgrade|IT\sSupport\-.*\..*|it\.helpdesk\@.*|MailBox\sDe\-activation\xC2\xA9|E\-Mail\sSecurity|Account\sTeam\!+|Roundcube\sAdministrator|MAIL\sSUPPORT|E_mail\sSever|Mail\sServices|Email\sService|Mail\sAdministrator\sNotice\s\#[0-9]{4}|ITHelpDesk|Mail\ssecurity|Mandate|Email\-Security\-[a-z\-_0-9]{2,40}\.[a-z]{2,8}|Email\sAccount\sTeam|Mail\sHelpDesk|webmail\s\-\steam|Service\sDesk\s\(I\.T\)|MAIL\sQUOTA|Dont\sBe\sLocked\sOut|Mail\sAdminstractor|.*\sHelpdesk\sSupport\sonline\s.*|Email\sAdministration\sTeam|Email\sServer|IT\-Help\.Desk|Zimbra\sService\sIT\sMail|Mail\sDNS|ONE\sDRIVE|EMAIL\sADMINISTRATOR|MaiI\-DeIiveryNotification|SERVICEINC|\x60\sServer\sNotification|Hosting\sTeam|Email\sAlerts\s\#[0-9]{4}|CPANEL\s\-\sIT\sREPORT|Email\sSecurity|Roundcube\sCpanel|ADMIN\sMAILBOX\sPORTAL|Email\sManagement\sTeam|Mail\sManagment|Malware\sAlert|RoundCube\sSupport|([A-z\-_.0-9]{2,40}\s)?Webmail\sSecurity\sNotifications|Webmail\sSecurity|Support\sCenter\xC2\xAE|Microsoft\ssecurity|Password\s\sExpiry\sNotification|Important\sUpdate:\sicloud\snotification\!|roundcube|E\-mail\sQuarantine|ControlAccountSupport\@ConnectWise\.com|Email\-Quarantine\sNotification|Mail\sstorage|Webmail\sRoundcube\sTeam|Administrator\-Support.*|.*\sPortalNotification|.*cPanel\sE\-mail\sHost|cP\sMail\sSupport\/[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|cPanel\s(E\-mail\sAdministrator|Delivery\sSystem|Postmaster|E\-mail\sAdmin)|Webmail_Roundcube\s\|\sSupport\sTeam|Onedrive\-Notification\-[0-9]{1,2}|[a-z\-_0-9]{2,40}\.[a-z]{2,8}\semail\ssupport|cPanel\sdomain\sadministrator)$/ ## FAKE ADMIN: Subjects ## header T_JR_FAKE_ADMIN_SUBJ1 Subject =~ /^((Re|RE|Fw|FW|Ref|Fwd|FWD):\s)?(?:Your\sMail\-Box\s.*\@.*\srequires\supgrade|NOTICE\:\sMessage\sReport\sFrom\s.*\@.*\sSupport\sSystem|Warning\sYour\sAccount\swill\sbe\sSuspended\sin\s24h|Accounts\ssuspension\snotice\s\[Proceed\sto\sresolve\snow\]|Confirm\syour\semail\sdeactivation\srequest\sfor\s.*\@.*|.*\shas\sinitiated\sRemoval\sof\sYour\sAccount|You\sHave\s\([0-9]\)\sPending\sUndelivered\sEmail|Mailbox\sQuota:\s+.*\@.*\s+Blocked|Your\sEmail\sMailbox\s.*\sServer\sNotification|.*\sYou\shave\spending\smessages|Mailbox\sstorage\sWarning\!\s\!|.*\sMail\sSession\sExpiration\sWarning|Urgent\sServer\sWarning\!|Your\sAccount\sHas\sBeen\sBlocked|Warning:Something\swrong\swith\syour\saccount\s\!|Security\sScam\sWarning\.|Account\sde\-activation\sfinal\swarning\!+|Dear\sAccount\sOwner|Urgent\sSecurity\sUpdate|New\sSecurity\sNotification\:|Please\sYour\sAttention\sIs\sNeeded\!+|Incoming\smessage\(s\)\son\shold\sfrom\s.*\..*|Mailbox\sQuota\:\s.*\@.*\sBlocked|Mail\sdelivery\sfailed\:You\shave\s\([0-9]\)\snew\sdelayed\smessages|UUPGRADE\sEMAIL\sACCOUNT\.|MAILBOX\sSYNCHRONIZATION\sFAILED\!|EMAIL\sACCOUNT\s.*\sTERMINATION\sREQUEST|There\sare\snew\smessages\sin\syour\sEmail\sQuarantine|Mail\sSystem\s\-\sNotification|You\shave\s[0-9]{1,3}\snew\spending\smails\son\syour\semail\sPortal)$/ header T_JR_FAKE_ADMIN_SUBJ2 Subject =~ /^((Re|RE|Fw|FW|Ref|Fwd|FWD):\s)?(?:Warning\:\s[0-9]\sPending\sMessages\sin\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sDeactivation\sin\s24\s?HRS|Mail\sNotification:\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s(\:Password\sexpiring|\:Your\sPassword\sis\sexpiring)|Attention\srequired:\s(Two|Three|Four|Five|Six)\s\([0-9]\)\sUndelivered\snew\smessages\sthat\scouldn\'t\sbe\sdelivered\sto\sthe\smailbox|[A-z0-9\-_\.]{2,50}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\shave\s[0-9]\sPending\sincoming\semails|[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s{1,3}Blocked\s{1,3}in\s{1,3}24HRS|Last\s{1,2}Warning:\s{1,2}Blocked\s{1,2}in\s{1,2}24HRS\s{1,2}Notification|Email\sDeactivation\sNotice\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sexpires\stoday|VERIFY\sACCOUNT\sTO\sUPGRADE\sMAILBOX|Your\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sAccount\sEmail\sVerification\!{2,3}|Sever\/\/Error|Spam\sNotification:\s1\sNew\sMessages|[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sMove\s[0-9]\sPending\sMails\sto\sInbox[,.:;\!]?|[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\ssent\syou\sfiles\svia\sWeTransfer|[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sYou\shave\s\([0-9]\)\sseven\spending\smessages[,.:;\!]?)$/ header T_JR_FAKE_ADMIN_SUBJ3 Subject =~ /^((Re|RE|Fw|FW|Ref|Fwd|FWD):\s)?(?:[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sWarning:\saddress\sconfirmation\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|EMAIL\sBOX\s\sSTORAGE\sLOW|[Mm]ailbox\s\"[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\"\swill\sbe\sShutdown\sToday|File\sattachment\s:\sDoc\s\#[0-9]{5}|ATTENTION:\sMessages\sHas\s(Failed|Faild)\sTo\sDeliver\sTo\sYour\sInbox|Delayed\smailbox\sRequest\s\#[0-9]{6}|Un\-received\s\([0-9]{1,2}\)\sIncoming\sImportant\sEmails|[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}\sQuota\sIs\sDue\sFor\sUpdate|VALIDATION\sREQUIRED\sON\sYOUR\sACCOUNT|[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sDeactivation\sRequest|Invalid\s\sMessage\sDelivery\sNotice\.|[a-z]{2,40}\supdate\syour\smailbox\smalware\ssecurity|You\shave\s[0-9]\snew\sencrypted\sdocuments\sattached\sfor\syour\sreview|Mail\sNotification:\sYou\shave\s[0-9]\sEncrypted\sMessages|Mailbox\sThe\smailbox\shas\sreached\syour\squota\slimit\s\"\sID\#:[0-9]{6}|An\serror\sin\syour\sPOP\/IMAP\sSettings\sis\sblocking\ssome\sof\syour\sincoming\smails\sin\sthis\sMailbox\.|SERVER\sERROR\sNOTIFICATION[0-9]|Zimbra\sNotice\s:\sInstant\sAccount\s[A-z]{2,20}\sDisconnection\s\,\sUpdate\snow|You\shave\sThree\s\([0-9]\)\sMessages\sPending\sDelivery|cPanel\sis\sdelaying\s\([0-9]\)\sincoming\smessages)$/ header T_JR_FAKE_ADMIN_SUBJ4 Subject =~ /^((Re|RE|Fw|FW|Ref|Fwd|FWD):\s)?(?:M\sa\si\sl\sb\so\sx\sSynchronization\x3A\sStor\xCD\x8Fage\sFull|Urgent\sWarning:\sNew\sSecurity\sMessage|MailBox\sServer\-Timeout:\sUrgent\sAction\sRequired\.|Unusual\sactivity\swhen\syou\ssign\sin\sto\syour\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\saccount|Important\sSecurity\sNotice:\sPassword\sExpired\!|You\shave\spending\sattachments|[0-9]\sEMAIL\sBLOCKED|\[Important\]\sIncrease\sMail\sStorage\sCapacity\!\s\[Action\sneeded\]|Mail\-box\sClosure\sPending\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|[0-9]\sPending\svoice\sMessage|[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sa\snew\sfile\swas\ssend\sto\syou\svia\sWeTransfer|Approved\stermination\srequest\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Confirmation:\sImportant\sInformation\sAbout\sYour\sAccount|Final\sWarning\s\:Password\sExpired|Warning\sYour\smailbox\sis\salmost\sfull\.|Email\sAccount\sUpdate\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|You\sCurrently\sHave\s[0-9]\sQuarantined\sIncoming\sEmails|Your\semail:\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\swill\sbe\sblocked|Pa\xC2\xADsswo\xC2\xADrd\sf\xC2\xADor\sus\xC2\xADe\xC2\xADr\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\swi\xC2\xADl\xC2\xADl\sex\xC2\xADp\xC2\xADi\xC2\xADr\xC2\xADe\sT\xC2\xADOD\xC2\xADA\xC2\xADY|Notification\ssign\-out:\s[A-z]{6,9}\,\s[A-z]{3,10}\s[0-9]{1,2}\,\s[0-9]{4}|cPanel\sis\sdelaying\s\([0-9]\)\sincoming\smessages)$/ header T_JR_FAKE_ADMIN_SUBJ5 Subject =~ /^((Re|RE|Fw|FW|Ref|Fwd|FWD):\s)?(?:[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s:\sPassword\sreset\!|Review\sMailbox\s\!\!\!|Your\sImmediate\sRectification\sOn\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s:\sAutomatic\sPassword\sUpdate\sFailed\!|Mailbox\sStorage\sLimit\sExceeded\s[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}\s[0-9]{1,2}:[0-9]{1,2}:[0-9]{1,2}\s[ap]\.m\.|Deactivate\sand\sdeleting\syour\semail\saccount\sis\sprocessing|First\sUpdate\sof\sthe\smonth\sfor\syour\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sMail\sbox|\[\sTicket:\s\#\#[0-9]{5}\#\#\]\s:\sEmail\sservices\shas\sbeen\sdisabled\sby\syour\sassigned\sAdministrator|Mailbox\sVersion\sOutdated\s\-\sTo\sFix\sErrors\s\-\sCritical\sError|Incoming\sFax\sMessage\s\-\sOnHold|Your\sMailbox\sstorage\shas\sexceeded\slimit|Warning:\smailbox\sclose\sto\squota|You\shave\s\([0-9]\)\sSuspended\sincoming\smessages|\/\/\sQueued\sMessages\sNotification\s\/\/|Bounce\sfrom\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s\!|Review\sAnd\sApprove\supdate\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|SMTP\/POP\sError|Action\sRequired\x3A\s\xE2\x9C\x89\sYou\shave\s\[[0-9]\]\squarantined\smessages|I\sRECORDED\sYOU\sAND\sSTOLE\sYOUR\sDATA\!|FINAL\sWARNING\!{3,18}\sAccount\sTermination|Email\sPassword\sExpired\.\.\.|Your\sdevice\sis\shacked)$/ header T_JR_FAKE_ADMIN_SUBJ6 Subject =~ /^((Re|RE|Fw|FW|Ref|Fwd|FWD):\s)?(?:\[IMPORTANT\]\sWe\'re\snow\sdeactivating\syour\saccount\sif\swe\sdon\'t\s\shear\sany\sactions\sfrom\syou[,.:;\!]?|Event:\sMailbox\sQuota\sNotification:\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|[0-9]\s\xE2\x9C\x89\sAction\sRequired\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Server\sPassword\sRecovery\sOn\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|\([0-9]\)\sUndelivered\sMails|[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}\s[0-9]{1,2}\:[0-9]{1,2}\:[0-9]{1,2}\s[ap]\.m\.{1,2}\,\syour\smailbox\sreturned\s\([0-9]{1,2}\)\sincoming\smails[,.:;\!]?|Un\-Received\s\([0-9]{1,2}\)\sImportant\s{1,2}Incoming\sEmails|WARNING:\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sStorage\sis\salmost\sfull\.|AlaskaUSA\s\-\sAn\sImportant\seNotification|Security\sMail\s\-\sNew\sSign\sIn\sActivity\.|[a-z0-9.\-]+\.[a-z0-9.\-]+\sShared\sNew\sProject\sContract\sDocument|Email\sSecurity\sAlert\s[a-z0-9.]+\@[a-z0-9.-]+\s?Authentication\sRequired|Sent\sMail\sError|You\shave\s\{[0-9]{1,3}\}\sIncoming\smessages\sNot\sdeliver|[a-z0-9.\-]+\.[a-z0-9.\-]+\s+Sign\-in\sAlert:\sAction\sRequested\s\!+|Inbox\smessage\srejected\sby\sserver\s\:\s[a-z0-9.-_]{2,55}\@[a-z0-9.-]{2,45}|\([0-9]\)\smessages\sare\spending|You\shave\s[0-9]{1,2}\simportant\spending\smessages)$/ header T_JR_FAKE_ADMIN_SUBJ7 Subject =~ /^((Re|RE|Fw|FW|Ref|Fwd|FWD):\s)?(?:Warning:\sLow\sstorage\sin\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s\-\s[0-9]{1,2}\sEmails\sPending|Urgent\sWarning:\smessage\s[0-9A-z]{6}\-[0-9A-z]{6}\-[0-9A-z]{2}\sdelayed\s24\shours|\([0-9]{1,2}\)\sINCOMING\sMESSAGES\sBLOCKED\sBY\sADMIN|Accounting\swants\sto\sshare\sthe\sfile\s[a-z]{2,25}\s6424\.64\.pdf\swith\syou|E\-mail\sAccount\sNotification\sFor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s\!\!\!|[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sAction\sRequired:\sSync\serror\s\([0-9]\)\sreturned\smails|Password\sExpiry\sAlert\sMail|All\sof\syour\sdata\shas\sbeen\scopied\.\sYour\ssystem\sis\scompromised\.|Failed:\s\([0-9]\)\sMessage\sFailure\sDelivery\sNotice|[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\shave\sExpired|Security\sMail\s\-\sSomeone\sjust\sSigned\sinto\syour\sAccount\.|Pending\sincoming\smessages:\sAction\sRequired|Service\sdelete\srequest\([0-9]{1,2}\s(Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s[0-9]{4}\)\sStarted|Update\syour\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\saccount|MAILBOX\sDE\-ACTIVATION\sIN\sPROGRESS|(\xE8\xB4\xA6\xE6\x88\xB7\xE9\x80\xBE\xE6\x9C\x9F\xE9\x80\x9A\xE7\x9F\xA5\xE3\x80\x90\xE9\x87\x8D\xE8\xA6\x81\xE6\x8F\x90\xE7\xA4\xBA\xE3\x80\x91))$/ header T_JR_FAKE_ADMIN_SUBJ8 Subject =~ /^((Re|RE|Fw|FW|Ref|Fwd|FWD):\s)?(?:WARNING:\sThe\s\xE2\x80\x9C[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\xE2\x80\x9D\saccount\sis\snearly\sfull\.|URGENT:\sEmail\sDeativation\sNotice|Your\spersonal\sdata\shas\sleaked\sdue\sto\ssuspected\sharmful\sactivities\.|.{2,15}\sShut\-Down\sAlert\!\sLow\sDisk\sUsage|You\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sreceived\sa\sshare\sdocument\svia\sOnedrive|Your\s\[EMail\]\swill\sbe\sblocked|[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sServer\s\-\sPassword\sExpired|Delivery\sreport\-\s[0-9]inbox\smessages\ssuspended|action\sRequire:Your\sAmazon\sPriame\smembership\shas\sExpired|Document\sApproval\sRequest:\sj[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sYour\sSignature\sIs\sRequired|[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sPending\smessages\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\son\sPortal\ssettings|Chase\sVerification\sServices\s:\sSecure\sYour\sFunds|Time\-Sensitive\sUpdate:\sUnattended\sCorrespondence\sin\sYour\sBank\sAccount|Message\sis\sfrom\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\strusted\ssource|.*\|\sAttn:\sPassword\sReminder\sSystem\sNotification|.{1,20}Delivery\snotice\sto\sREF\sNo:AWB[0-9]{7}\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Clear\sYour\sCache\sImmediately\sTo\sAvoid\sService\sInterruption)$/ header T_JR_FAKE_ADMIN_SUBJ9 Subject =~ /^((Re|RE|Fw|FW|Ref|Fwd|FWD):\s)?(?:[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sVerify\sYour\saddress\sto\savoid\semail\sBlocking|Your\sAttention\sNeeded:\sEmail\sDelivery\sProblems\son\s[A-z0-9\-_\.]{2,40}\@[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}|Take\surgent\saction\sto\ssecure\syour\smailbox|\xE8\xAF\xB7\xE7\xAB\x8B\xE5\x8D\xB3\xE6\x9B\xB4\xE6\x96\xB0\xE5\xAF\x86\xE7\xA0\x81\xEF\xBC\x8C\xE7\xA1\xAE\xE4\xBF\x9D\xE8\xB4\xA6\xE6\x88\xB7\xE5\xAE\x89\xE5\x85\xA8|Take\surgent\saction\sto\ssecure\syour\smailbox|routine\scheck:\sVerify\syour\saccount\sto\savoid\ssuspension|Delivery\sIssue:\sYour\sSent\sEmails\sAre\son\sHold.*|Your\semail\:\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\swill\sbe\sblocked|Your\sentire\sdata\shas\sbeen\scopied\.|[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s:\sAction\sRequired\sUnresolved\!\!+|[a-z0-9_\-]{2,15}:\sYour\ssalary\sfor\sthe\smonth\sof\s[A-z]{3,15}\-2025\sis\snot\syet\sapproved|[a-z0-9\-_\.]{2,40}\@[a-z\-_0-9\.]{2,40}\.[a-z]{2,8}\sPassword\swill\sExpired|Your\saccount\shas\sbeen\shacked\.\sYour\sdata\swas\sstolen.*|SECURE\sMESSAGE\s\-\s\{Your\semail\sis\soutdated\}|.*Update\sService\sTerms\sand\sCondtions\son\s[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}\sTo\sAvoid\s[A-z0-9\-_\.]{2,40}\@[A-z\-_0-9\.]{2,40}\.[A-z]{2,8}\sbeing\sterminated|PASSW0RD\sEXP1RED)$/ header T_JR_FAKE_ADMIN_SUBJ10 Subject =~ /^((Re|RE|Fw|FW|Ref|Fwd|FWD):\s)?(?:EXP1RED\sN0T1CE|Suspended\sincoming\smessages|Suspension\sof\sYour\sMailbox\sAccount|Retrieve\sMails\sFrom\sserver\!\.|F1NAL\sREM1NDER|Inv\-oice\#\#\sReady:\sPay_ment\sInstructions\sAtt\-ached|ATTENTION:\sMailbox\sTermination\s\!\!|\xE2\x9B\x94Urgent\sattention\srequired:\saccount\srestricted\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Please\sComplete\sUpdate:W\se\sb\sm\sa\si\sl\s\-A\sp\sp\sAvailable|\[Action\srequired\]\sSystem\serror\!|Alert\s\-\sIf_unauthorized_contact_support_[0-9]{3}\-[0-9]{3}\-[0-9]{4}.*|Your\sMailbox\shas\sbeen\sflagged\sfor\sreview\.\sValidate\syour\saccount\snow\!|Account\sNotice\s\xE2\x80\x94\sPlease\sReview\sYour\sInformation\s\(Ref:\s\#\#[0-9]{7}\#\#\)|Action\srequired\s\-\sIMAP\sPOP3\sDelivery\sFail\son\s[a-z0-9\-_\.]{2,40}\@[a-z\-_0-9\.]{2,40}\.[a-z]{2,8})$/ header T_JR_FAKE_ADMIN_SUBJ_START1 Subject =~ /^(?:MailBox\sDe\-activation|Final\sMailbox\sDe\-activation\sWarning|.*\smailbox\:\sNew\sfound\smessages\sin\squarantine|Upgrade\smailbox\squota\srequest\sfor|Action\sRequired\:\s.*\syou\shave\s\([0-9]{1,3}\)\sNew\sPending\sIncoming\sMessages|Mail\sNotification\sAlert|SSL\sSecurity\sAlert\:\sUpgrade\sthis\sAccount|SERVER\sUPGRADE\s\(2020\sUPDATE\)|You\shave\s[0-9]\spending\smessage\(s\)\sin\s|Pending\sMail\s:\sYou\shave\sUndelivered\spending\sMails|Important\:\sYou\shave\s[0-9]{1,3}\sPending\sincoming\semails|WARNING\:\sThe\s\xE2\x80\x9C[a-z0-9.]+\@[a-z0-9.-]+\xE2\x80\x9D\semail\saccount\sis\snearly\sfull|Upgrade\sMailbox\sQouta|Please\sverify\syour\semail\saccount\s[a-z0-9.]+\@[a-z0-9.-]+|You\shave\s\{[0-9]\}\smessages\sundelivered\sfor\s[a-z0-9.]+\@[a-z0-9.-]+|(URGENT\:|Mailjet\s\-)\s?Important\salert\son\syour\saccount|[a-z0-9.]+\@[a-z0-9.-]+\sDe\-activation\sNotice|Action\sRequired:\sYou\shave\s[0-9]\sblocked\smessages|IT\sWarning\sfor\s[a-z0-9.]+\@[a-z0-9.-]+\sMailBox\sAccount|\([a-zA-Z\-_]{2,40}\.[a-zA-Z\]{2,10}\)\sEmployee\sNewsletter\sfor\s[A-Z]{3,9}\s20[0-9][0-9]|Mandatory\sEmail\sVerification|Mailbox\sStorage\sFailure|Email\sAccount\sSecurity\sNotification|P\sA\sS\sS\sW\sO\sR\sD\s+E\sX\sP\sI\sR\sA\sT\sI\sO\sN\s+N\sO\sT\sI\sC\sE|\[[0-9]{1,2}\]\sImportant\sNew\sMessage\sOn\sYour\sAccount)/ header T_JR_FAKE_ADMIN_SUBJ_START2 Subject =~ /^(?:Inbox\semails\sfailed\sto\sdeliver\s[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}|Mailbox\sis\sout\sof\squota|We\sdetected\ssomething\sunusual\sabout\sa\srecent\ssign\-in|Mailbox\s100\%\sFull|Email\sPassword\sExpired\.|Your\s[_A-z0-9.-]+\@[A-z0-9-]+\.[A-z]{2,8}\spassword\sExpires\sNow|NOTE:\s\(3\)\sIncoming\sE\-mails\sPending\sDelivery\.|Your\smailbox\sis\salmost\sfull\s[A-z]{2,50}\s[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}|Mail\sdelivery\sfailed\;\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\shave\s\[[0-9]\]\sPending\sincoming\smessages|Accounting\swants\sto\sshare\sthe\sfile|A\sContract_Documents_Has\sBeen_Shared\sFor_Your\sReview|Email\sShutdown\sAlert\sFor:|Mailbox\sDeactivation\sNoticy|Validation\serror\s\-\s[0-9]{1,2}\spending\sMessages\.\s[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}|Mailbox\sClosure\son\sprocess|Mail\sdelivery\sdefarred\!\!\!|Re:\sSyncing\sError\s\-\s\([0-9]\)\sIncoming\sfailed\smails\.|Do\snot\sget\slocked\sout\sfrom\syour\sexisting\saccounts|Server\sAdministrator:\sEmail\sConfirmation|Warning\s:\sPassword\sExpire\s\s|Password__Expiry__Noticification|You\sReceived\s\([0-9]\)\sInquiry\sDocument\(s\)\son\sSharepoint\/OneDrive|\[[0-9]{1,2}\]\sNotifications:\sMailBox\sStorage\sFull|ACTION\sREQUIRED:\sFailure\sdelivery\smessages|Urgent:\sYour\sQuickBooks\sAccount\sIs\sOn\sHold)/ header T_JR_FAKE_ADMIN_SUBJ_START3 Subject =~ /^(?:\[Secure\sMail\]\sThis\sis\san\semail\sthat\srequires\sauthentication|messages\sare\swaiting\sthrough\syour\sUltraBranch\ssecure\sChannel|Password\sExpiration\sNotice\!{2}|PREVIEW:\sCase\sID\#[0-9]{9}\sMailbox\squota\s\supdate\sE\-mail\s:|Your\sinbound\smails\sbounced\,\sindicating\sthat\syour\squota\shas\sbeen\sexceeded|Action\srequired:\sPassword\sexpired|\[Important\sNotification\]\s\*\sThree\s\(3\)\sUndelivered\snew\smessages|RE:\sInvoice\s\&\sSigned\sContract\s\-NEW\sORDER\-[0-9]{6}|No\sspace\sin\sstorage\sdisc\!|Mail\sservice\shalted\,\sStorage\sFull\sfor\sID:|De\-activation\sof\sMailbox\s\xE2\x9C\x89|Review\syour\semail\sactivity\simmediately\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|(\xE5\x85\xB3\xE6\x9C\xBA\xE6\x9B\xB4\xE6\x96\xB0\xE9\x87\x8D\xE8\xA6\x81\xE9\x80\x9A\xE7\x9F\xA5)|(\xE9\x82\xAE\xE7\xAE\xB1\xE5\xB7\xB2\xE8\xBF\x87\xE6\x9C\x9F\!\!)|[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sScheduled\sPrivate\sEmail\sSoftware\sUpgrade|We\sdetected\ssomething\sunusual\sabout\sa\srecent\ssign\-in\sto\syour\se\-mail|cPanel\sis\sdelaying\s\([0-9]{1,2}\)\sincoming\smessages|Avoid\smailbox\sClosure\sof\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\son|Action\sRequired:\sMail\sservice\shalted\sover\sstorage\scapacity|\[\-Account\sPassword\sExpiry\-security\sinfo\sverification\-\])/ header T_JR_FAKE_ADMIN_SUBJ_START4 Subject =~ /^(?:Warning:\sEmail\supgrade\srequired\sfor\syour\smailbox\s\-|Kindly\sConfirm\sYour\sSecured\sDocument|[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\:\-Notification:|Youhave\sreceived\sa\svoice\smessage\sfrom\s\+1|Suspended\sincoming\smessages\sin\syour\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sserver|YOUR\sMAILBOX\sCLOSED\sIN\s[0-9]{2}\s?HOURS|New\sMEssage\sReceived|\(\(\(IMPORTANT\)\)\)\sWEBMAIL\sUPDATE|ALERT:\sYour\sPC\smay\sbe\sinfected\!|Payment\sAdvice\s\-\sRef:\s\[HSBC[0-9]{6}\]\s\/\sRFQ\sPriority\sPayment|Email\sverification\sprocess\s:|Security\sAlert\!\s:\sDo\syou\scall\sto\sreset\syour\spassword|Urgent\s\-\sEmail\sDelivery\sStatus\sIssue|RoundCube\sWebMail\sAccount\swill\sbe\sSuspended|\-\-\-\-Action\-Required\-[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Deactivation\sRequest\sIn\sProgress\sFor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sAs\sRequested|Account\sUpdate\s:\sSecurity\sUpdate|\-\sIMPORTANT:\s\-\sSecure\sCredentials|Action\sRequired:\sPassword\sHas\sExpired\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Signature\sRequired:\sDoc\sVia\-Sign\s\#[0-9]|Review_[A-z]{2,20}\-Document93282\-[0-9]{2}\.(html|HTML)|Notification:\sPassword\sExpires\sToday|.*0neDRlVE_Portal|Final\sWarning:Your\saccount\swill\sbe\sblocked\sfrom\ssending\sand\sreceiving)/ header T_JR_FAKE_ADMIN_SUBJ_START5 Subject =~ /^(?:All\syour\sfiles\swill\sbe\sdeleted\ssoon$|Warning\!\!\sMailbox\sQuota\supgrade|Your\sdevice\swill\sbe\slocked|You\'re\smy\svictim$|High\slevel\sof\srisk\.\sYour\saccount\shas\sbeen\shacked\.|Final\sRemainder:\sPassword\sExpiry\sAlert\sRefID:|Your\sAccount\sWill\sBe\sBlocked\.|Complete\syour\squickbooks\saccount\sverification\snow|[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sValidate\sto\savoid\semail\sBlocking|Server\sUpdate\sIssue\!|You\sHave\s\([0-9]\)\sFailed\sMessages|Your\stime\sis\salmost\sup\.$|Account\sownership\sroutine\scheck|Expire\sLogin\s\([A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\)|Complete\svia\sDoc\sSign:\sSigning\sfor\sdocument\ssignature\sneeded|\!\!\!PUSH\sYOUR\sFORMAT\sON\sMY\sCOMPUTER|URGENT:\sYour\saccount\sand\spage\swill\sbe\s(restricted|disable|Block)|Webmail\saccount\svalidation\sfor\s[a-z\-_.0-9]{2,40}\.[a-z]{2,8}\suser\(s\)|\([A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\)\scPanel\sMail\sService\sNotification|ACCOUNT\sDE\-ACTIVATION\sIN\sPROGRESS|You\sJust\sReceived\sAn\sImportant\sNotification|Final\sWarning:\sYour\saccount\sis\sscheduled\sto\sbe\sforbidden\sfrom\suse|MailBox\sRequesting\sAuthentication\!|\*\*Subject:\sAction\sRequired:\sReview\sYour\sRoundcube\sWebmail|You\shave\s2\(two\)\snew\simportant\sdocument$)/ header T_JR_FAKE_ADMIN_SUBJ_START6 Subject =~ /^(?:[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sDiscontinuation\sNotice\!\!\s\(TAKE\sACTION\sNOW\)|Update\sRequired\sto\sEnsure\sUninterrupted\sService\s\(Ref:\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s\#[0-9]{6}\)|Last\schance\sto\sclear\syour\sdues$|Sharepiont\sFile\sFor\sadmin|Warning:\sDe\-activation\sRequest\son\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Y\sou\sr\sP\sas\ssw\so\srd\si\ss\sA\sb\sout\st\so\sE\sx\sp\sir\se|Action\srequired:\sMailbox\spassword\sexpired\s2025\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Se\srvi\sce\sInt\ser\srupt\sion\sNo\sti\sce|No\sti\sce\sf\so\sr|\xE2\x9A\xA0\sSecurity\sUpdate\x3A\sAction\sRecommended\sto\sProtect\sYour\sAccount|Micros0ft\sTeams\sSubscripti0n|\xF0\x9D\x99\x88\xF0\x9D\x99\x96\xF0\x9D\x99\x9E\xF0\x9D\x99\xA1\s\xF0\x9D\x98\xBF\xF0\x9D\x99\x9A\xF0\x9D\x99\x96\xF0\x9D\x99\x98\xF0\x9D\x99\xA9\xF0\x9D\x99\x9E\xF0\x9D\x99\xAB\xF0\x9D\x99\x96\xF0\x9D\x99\xA9\xF0\x9D\x99\x9E\xF0\x9D\x99\xA4\xF0\x9D\x99\xA3|.*\xF0\x9D\x98\xBF\xF0\x9D\x99\x9A\xF0\x9D\x99\x96\xF0\x9D\x99\x98\xF0\x9D\x99\xA9\xF0\x9D\x99\x9E\xF0\x9D\x99\xAB\xF0\x9D\x99\x96\xF0\x9D\x99\xA9\xF0\x9D\x99\x9E\xF0\x9D\x99\xA4\xF0\x9D\x99\xA3\s\xF0\x9D\x99\x8D\xF0\x9D\x99\x9A\xF0\x9D\x99\xA6\xF0\x9D\x99\xAA\xF0\x9D\x99\x9A\xF0\x9D\x99\xA8\xF0\x9D\x99\xA9)/ header T_JR_FAKE_ADMIN_SUBJ_START7 Subject =~ /^(?:Important\sNotice\!\!\!\sSecure\sYour\sAccount\sSettings$|Y\sou\sr\sP\sas\ssw\so\srd\si\ss\sA\sb\sout\st\so\sE\sx\sp\sir\se|\[Action\srequired\]\sSystem\serror\!|.*Email\sdeativation\sNotice\s[0-9]{2}\/[0-9]{2}\/2026|Action\srequired:\sPassword_expiry_notice_Update|\xE2\x9C\x93\sAuthentication\sexpiration\sNotice|\xD8\xB1\xD8\xAF\s\xD8\xAA\xD9\x84\xD9\x82\xD8\xA7\xD8\xA6\xD9\x8A:\sImportant\smessage\swaiting)/ ## FAKE ADMIN: Body Phrases ## body T_JR_FAKE_ADMIN_BODY1 /(^|\b|\s)(?:2019\sEmail\sAdministrator|Your\sMailbox\sstorage\scapacity\shas\sreach\sits\squota\slimit\.|The\sEmail\sTeam|Your\smailbox\swill\sstop\ssending\sand\sreceiving\smessages\sshortly|Warning:\sFailure\sto\sdo\sthis\swill\slead\stotal\ssuspension\sof\syour\semail\saccount|The\sEmail\sSecurity\sTeam|Email\sAdministrator\s2019|Source:\sEmail\sSecurity\sTeam|Request\sto\sdeactivate\syour\semail\swas\smade\sand\sthis\srequest\swill\sbe|We\swill\sdelete\syour\semail\saccount\swithin|We\sadvice\syou\sUpdate\/Increase|auto\-generated\sfrom\sE\-mail\ssecurity\sserver|Update\syour\semail\sby\sAccessing\syour\semail\saccount|Update\syour\semail\sby\sAccessing\syour\semail\saccount|if\syou\sdo\snot\sretrieve\syour\sundelivered\semails\snow,\sthey\smay\sbe\slost\sfor\sever\.|message\sis\sauto\-generated\sfrom\sEmail\ssecurity\sservice|Kindly\supdate\syour\semail\sto\sthe\slatest\sserver|2019\sEmail\sSecurity|wish\sto\sreceive\sthe\sundelivered\semail\,\sKindly\sconfirm\sbelow|we\swill\sassume\sshut\sdown\sfor\syour\semail\saccount|eMail\sService\sLLC|Welcome\sto\ssystem\se\-mail\sverification\sprocess\.\.|[a-z]{2,54}\.[a-z]{2,8}\sMailbox\sService|Warning\:\sfailure\sto\sprocess\saction\swould\s\s?lead\sto\saccount\sfinal\stermination|VERIFICATION\sIS\sFREE\sOFF\sCHARGE\.)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY1 nosubject body T_JR_FAKE_ADMIN_BODY2 /(^|\b|\s)(?:Check\sbelow\sand\slog\-in\sto\sget\supdated\smailbox|Kindly\sclick\sbelow\sto\supdate\syour\smail\sstorage|deactivated\sand\sall\syour\semail\sdata\swill\sbe\spermanently\slost|request\sto\sredirect\sincoming\semails\sto\sa\sthird\sparty\saccount|in\spurpose\sto\sprovide\sa\smore\ssecured\splatform|The\sEmail\saccount\steam|Re\-validate\syour\semail\sfor\sfree|We\sare\sauthenticating\sall\sEmails\son\sthe\s.*\splatform\.|webmail\sSecurity\sTeam|you\srecently\smade\sa\srequest\sto\sshutdown\syour\semail|pending\sundelivered\semails\,\sawaiting\syour\sconfirmation\snow|quarantined\smessages\sby\sgoing\sto\sthe\sSecurity\sand\sCompliance\sPortal|disabled\sintermediately\swe\sconfirm\supgrade\ssuccessful|messages\swas\sheld\sdue\sto\slow\semail\sstorage|users\sMust\sUpdate\stheir\sEmail\sAccount|a\sPermanent\sDisable\sof\syour\semail\saccount|your\semail\svalid\sfor\sconscious\ssecurity\sreason|Email\saddress\sverification\sis\srequired\sto\scontinue\susing\sthis\semail\!|Security\sMaintenance\sTeam|Your\smailbox\sfull\sand\sthis\swill\sblock\/effect\sincoming\se\-mail\scontaining\sattachment\(s\)|Failure\sto\sverify\syour\se\-mail\saccount\sshall\sresult\sin\saccount\slock\sout\.|ALLOCATE\sMORE\sDATA\sTO|exceeding\syour\sfree\sdata\svolume|^E\-mail\sSupport\s2025\.)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY2 nosubject body T_JR_FAKE_ADMIN_BODY3 /(^|\b|\s)(?:complete\scontact\sdetails\sand\sverified\semail\saddresses\sacross|Email\sService\sTeam\.|because\syou\sfailed\sto\sresolve\serrors\son\syour\smail|moved\sto\sclutter\sfolder\sdue\sto\sinsufficient\sstorage|Email\sService\sTeam\s.(2020|2019)|Scheduled\sMail\sServer\sUpgrade\sFor\sOur\sHosting\sService\sAnd\sEmail\sUsers|The\semail\ssecurity\steam\@20(19|20|18)|security\supdate\sto\senhance\syour\semail\sfunction\.|We\sreceived\san\sinstruction\sfew\shours\sago\sto\sterminate\syour\semail|avoid\spermanent\sclosure\sof\sthis\semail\sAccount|request\sto\sdeactivate\syour\s\se\-mail\swill\sbe\sprocessed|Tap\sbelow\sto\sverify\syour\semail\sand\sget\sa\smore\sorganized\smailbox|Your\smailbox\sis\sset\sto\sbe\spermanently\slimited|Email\sAccount\swill\sbe\sBlocked\/suspend(ed)?|Unauthenticated\sEmails\swill\sbe\sdeactivated\sfrom\sthe|Please\sam\shaving\sproblem\saccessing\smy\sother\semail|You\shave\sfew\sincoming\smails\spending\son\sserver|Feel\sfree\sto\swrite\sto\sus\svia\s\ssupport\.mailsecurity\.account|Login\sbelow\sto\sverify\syour\saccount\sand\supgrade\syour\saccount\ssecurity\sto\savoid\saccount\scancellation\.)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY3 nosubject body T_JR_FAKE_ADMIN_BODY4 /(^|\b|\s)(?:There\sare\snew\smessages\sin\syour\sEmail\sQuarantine\smessages\swill\sbe\sautomatically\sremoved|EMail\sCenter\sNotification\.|Dear\sEmail\sID\sOwner|Your\smailbox\swill\sbe\stemporarily\sunavailable\sdue\sto\sthe\srecent\supgrades|more\sorganized\smailbox\sto\savoid\sbeing\sdeactivated|we\swill\shave\sno\sother\schoice\sthan\sto\sdelete\syour\smailbox\sdatabase\simmediately|IT\sDesk\s\xC2\xA9\sCopyright\s20(19|20)|kindly\sto\sadd\smore\sMB\sto\syour\smailbox|If\sdon't\sadd\sMB\sto\syour\smail\sbox\,\syou\swill\snot\sreceive\semails|Your\sMailbox\sstorage\scapacity\shas\sreach\sits\squota\slimit\.|To\scontinue\susing\syour\smailbox\,\syou\sneed\sto\supgrade\sand\sverify\syour\smailbox|If\syou\sdo\snot\sre\-verify\,\syour\smailbox\saccount\swill\sbe\spermanently|Stay\ssafer\sonline\swith\sthe\snew\sSecurity\sand\sUpgrade|Your\smailbox\swill\sstop\ssending\sand\sreceiving\smessages\sshortly|Warning:\sFailure\sto\sdo\sthis\swill\slead\stotal\ssuspension\sof\syour\semail\saccount|your\smailbox\srecord\sto\srelease\sand\sretrieve\syour|have\ssome\sUndelivered\smails\sin\sserver|[a-z]{2,54}\.[a-z]{2,8}\s\ssetup\steam\.|All\syour\spayments\shas\scurrently\sbeen\sput\son\shold\.|Use\sbelow\sbutton\sto\skeep\sor\supdate\scurrent\scredentials\.)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY4 nosubject body T_JR_FAKE_ADMIN_BODY5 /(^|\b|\s)(?:your\smailbox\sis\susing\sold\ssecurity\ssettings|To\ssynchronize\syour\smailbox\swith\syour\shost\.\sclick|cPanel\sWebMail\!|deactivating\sall\smailbox\susers\sthat\sare\sstill\susing\sthe\sold\sVersion|to\sRelease\sthese\smessage\(s\)\sto\syour\sinbox\sfolder|upgrade\syour\smailbox\sto\sthe\slatest\sversion|Check\sbelow\sand\slog\-in\sto\sget\supdated\smailbox|Kindly\sclick\sbelow\sto\supdate\syour\smail\sstorage|deactivated\sand\sall\syour\semail\sdata\swill\sbe\spermanently\slost|Please\skindly\supgrade\s\&\sverify\syour\smailbox|will\slead\sto\sde\-activation\sof\sMailbox|Recent\sserver\supdate\.\sKindly\supdate\sto\sthe\slatest|To\scontinue\susing\syour\smailbox\,\syou\sneed\sto\simmediately\supgrade|Tap\sbelow\sto\sverify\syour\semail\sand\sget\sa\smore\sorganized\smailbox|Your\smailbox\sis\sset\sto\sbe\spermanently\slimited|your\smailbox\striggered\sa\smembership\sdeactivation\scode|This\smay\scause\syour\smailbox\sfault\sor|you\sFail\sto\supgrade\syour\smailbox|There\swas\s[0-9]\srecent\smessages\sto|To\scontinue\susing\syour\saddress\sconfirm\syour\sownership\,|You\shave\s[0-9]\sincoming\spending\smessages\sas\sof\s[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}|incoming\smessages\swhich\swas\sreturned|cPanel\sadded\sa\snew\semail\ssecurity\sfeatures)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY5 nosubject body T_JR_FAKE_ADMIN_BODY6 /(^|\b|\s)(?:inbox\sfolder\sfor\sproper\sinteragtion|Please\skindly\sUPDATE\sYOUR\sACCOUNT\sHERE\s\s\,\sto\sReceive\sthese\smessage\(s\)|Ignoring\sthis\smessage\swill\scause\sblock\sor\sthe\sclosure\sof\sthis\saccount|Update\sthrough\sthe\slink\sbelow\sto\savoid\sdeactivation\.|kindly\smove\sto\sinbox\sfor\smore\seffective\supgrade\sprocedure\.|Account\sSecurity\sTeam\.|This\smessage\sis\ssent\sto\sinform\syou\sthat\syour\saccount\swill\sbe\sterminated\son\sdue\sdate|recently\snot\s\sbeen\supdated\s+verify\syour\saccount\s\sto\shelp\sus\ssecure|we\swill\sassume\sshut\sdown\sfor\syour\semail\saccount\,|To\scontinue\susing\syour\smailbox\,\syou\sneed\sto\supgrade\sand\sverify\syour\smailbox|We\sare\sauthenticating\sall\sEmails\son\sthe\s.*\splatform\.|Source:\sEmail\sSecurity\sTeam|We\swill\sdelete\syour\semail\saccount\swithin|We\sadvice\syou\sUpdate\/Increase|Upgrade\syour\smail\squota\swith\sextra\s[0-9]{1,2}(GB|MB)\simmediately\sto\skeep\susing|the\slink\sbelow\sto\sverify\sand\supdate\syour\sE\-mail|Please\sreconfirm\syour\semail\saddress\sto\savoid\sbeing\sblocked|been\ssubjected\sto\sverification\sin\sorder\sto\srestore\syour\sAccount|remind\syou\sthat\syour\semail\saccount\s{1,3}[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s\swill\sbe\sterminated)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY6 nosubject body T_JR_FAKE_ADMIN_BODY7 /(^|\b|\s)(?:failure\sto\srenew\syour\se\-mail\saccount\.\sIt\swill\sbe\spermanently\sdisabled|Failure\sto\scomplete\sthe\svalidation\sprocess\scan\sresult\sin\sdisabling\saccount|blacklisted\sfrom\sour\sserver\sdue\sto\sspam\smessage|mail\sdelivery\smalfunction\sand\ssecurely\supgrade|2019\sAdministration\s\-\sAll\srights\sreserved|Your\saccount\shas\sbeen\srestricted\,\sFor|if\syou\sdo\snot\scancel\sthis\srequest\,your\saccount\swill\sbe\sshutdown\sshortly|Kindly\sfollow\sthe\sstep\sbelow\sto\sdeliver\spending\smessages:|click\sbelow\sto\srectify\sthe\snondelivery\sissues|IT\sDesk\s\xC2\xA9\sCopyright\s20(20|19)|Kindly\sUPDATE\syour\saccount\sbelow|Account\smaintenance\steam|All\sstaffs\/Outlook\sUsers|You\sreceived\sthis\semail\sfrom\sour\sWebmaster\sfor|To\sview\sFax\,\splease\srefer\sto\sbelow\sand\sauthenticate\suser\sto\senable\sinstant\saccess|[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\shas\sprevented\sthe\sdelivery\sof\s[0-9]{1,2}\snew\semails|[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sAccount\sMaintenance\sReport|closing\sall\sold\sversion\sof\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|INCREASE\sMAILBOX\sCAPACITY|Learn\smore\sabout\sRevenueStripe|YOU\sWILL\sLOSE\sYOUR\sEMAIL\sADDRESS\sIF\sYOU\sDO\sNOT\sVERIFY\sYOUR\sACCOUNT|You\sshould\sclear\scache\sto\srelease\spending\smessages\sand\sfree\ssome\sspace)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY7 nosubject body T_JR_FAKE_ADMIN_BODY8 /(^|\b|\s)(?:access\sincoming\smessages\sand\sto\savoid\smail\smalfunction|Mail\sAdmin\s\(C\)\s2020\sSecured\sService|Mail\sAdministrator\swill\salways\skeep\syou\sposted\sof\ssecurity\supdates|has\sbeen\sused\sin\ssending\sBulk\smessage\sthis\swill\scause\syour\smailbox|Kindly\sre-verify\sMailbox\sto\supdate\sMailbox\sand\sstop\stemporary\sshutdown|mailbox\sto\sbe\stemporarily\sclosed\suntil\sre-verification\sprocess|Microsoft\sWebmail\ssystem|visit\sthe\slink\sbelow\sto\srestore\saccess\syour\semail|n\xC2\xADe\xC2\xADw\s\xC2\xADm\xC2\xADails\s\xC2\xADt\xC2\xADo\sy\xC2\xADo\xC2\xADur|has\sbeen\slisted\sfor\stermination\scheck\sattached\sfor\smore\sdetails|Please\sclear\syour\smailing\schannel\simmediately|Clear\smailing\schannel\snow|your\smailing\schannel\sis\scleared|update\syour\saccount\snow\sto\sget\smore\semail\sspace\squota|webmail\sSecurity\sTeam|You\shave\spending\sincoming\semails\sthat\syou\sare\syet\sto\sreceive|Anti\-Spam\sSystem\sfor|Server\sEmail\sDeactivation\sNotice\.|\(C\)\s2020\ssecurity\sservices|\xC2\xA92022\scPanel\,\sL\.L\.C\.|If\sthe\smessages\sare\snot\sretrieved\sin\stime\,\sthe\smails\swill\sbe\sreturned)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY8 nosubject body T_JR_FAKE_ADMIN_BODY9 /(^|\b|\s)(?:quickly\sclick\son\sthe\sbutton\sbelow\sto\scancel\sthe\sdeactivation\srequest|Server\sEmail\sService\sSecurity\.|detectou\sque\ssuas\scredenciais\sde\sseguranca\sjuntamente\scom\sseu\sCartao\sPessoal\sde\sCoordenadas|WebHosting\(C\)\s2020\sSecured\sService|IT\sDesk\s\xC2\xA9\sCopyright\s2019|If\sdon\'t\sadd\sMB\sto\syour\smail\sbox\,\syou\swill\snot\sreceive\semails|You\shave\s[0-9]{1,3}\sfailed\/unsent\smessages\son|This\swas\scaused\sdue\sto\sa\ssystem\sfailure|Receive\sDelayed\sMessages|The\sunreceived\semails\swill\sbe\sdeleted\sfrom\sthe\sserver\swithin|You\shave\s[0-9]\squarantined\smessages\sin\syour\squarantine\smessage\sportal|Our\sserver\ssecurity\shas\sdetected\sthat\s\([0-9]\)\sincoming\smessages\son|if\syou\sdo\snot\scancel\sthis\srequest\syour\smail\swill\sbe\sshutdown\sshortly|your\smail\sto\savoid\sautomatic\sclosure\sof\syour\soutlook\smail|confimation\sto\savoid\smail\smalfunction|If\syou\sdo\snot\scomplete\,\sthe\saccount\swill\sbe\sdeactivated\.|Keep\scurrent\sPassword|cPanel\shas\sa\snew\sadministration\spolicy\sthat\saffects\sa\sportion\sof\sincoming\smessages|You\shave\simportant\spending\sfile\son\sOneDrive\scloud)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY9 nosubject body T_JR_FAKE_ADMIN_BODY10 /(^|\b|\s)(?:Mail\sdelivery\sfailed\:You\shave\s\([0-9]\)\snew\sdelayed\smessages|lead\sto\sPermanent\sclosure\sof\sAccount|Your\smailbox\shas\sexceeded\sits\smail\-quota\sand\sdue\sfor\supgrade|download\spending\semails\sand\scontinue\sto\sreceive\semails\son\syou|since\syou\shave\sQuarantine\snotification|by\sthe\ssystem\sto\sby\snotification\sonly|problem\sverifying\syour\sidentity\swe\s|avoid\stemporarily\sservice\sinterruption|access\sto\syour\s\sMail\sAccount\swill\sbe\sDenied|review\syour\sundelivered\semails\sand\sautomatcally\sresend\semail\srequest|We\sfound\s[0-9]{1,3}\sincoming\sundelivered\semails\smostly\sfrom\syour\scontacts|Some\sof\syour\smails\shas\sbeen\sput\son\shold|will\snot\sbe\sheld\sresponsible\sfor\syour\smailbox\smalfunction|If\syou\sare\ssure\syou\sgave\sthis\sinstruction\sfor\syour\saccount\stermination\,|stop\sthe\srequest\,\sif\sit\swas\smade\sin\serror\sor|Webmail\sSecurity\steam|Mail\sCenter\sHelpdesk|Kindly\sLogon\sbelow\sto\srestore\syour\saccount|Go\sto\sEmail\saccount\ssettings\sbelow\sto\sreview\sheld\smessages\sand\sfix\sbugs|[A-z0-9\-]{2,20}\,\sYour\sGroup\ssent\syou\sa\smessage\.)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY10 nosubject body T_JR_FAKE_ADMIN_BODY11 /(^|\b|\s)(?:20[0-9]{2}\sEmail\sSecurity\.|We\sdetected\sa\ssynchronization\serror\son\syour\saccount\spending\s[0-9]\sincoming\smessages|Kindly\supdate\syour\semail\sto\sfix\serror\snotification\smessages|Attached\sis\syour\snew\sdocuments\.|Please\slogin\shere\sto\shelp\sus\sattention|due\sto\sinvalidation\sof\syour\smailbox|recover\sthese\smessages\sby\svalidating\syour\smailbox|Failed\sto\ssync\sand\sreturned\s\([0-9]\)\sincoming\smails|MAILBOX\sSYNCHRONIZATION\sFAILED\!|account\swill\sbe\sOfficially\sPermanently|an\sautomated\sbehavior\sthat\sviolates\sour\sRules|follow\sthe\ssteps\sto\sconfirm\sthat\syou\sare\sthe\svalid\saccount\sowner|disable\sthe\s\"Quota\:\:MailboxWarning\"\stype\sof\snotification|Due\sto\sa\srecent\sconfiguration\serror\,\ssome\sof\syour\semails|This\smay\salso\scause\saccount\sto\slost\simportant\smails\sif\signored|awaiting\syour\saction\sto\sbe\sdelivered\sto\s\(\s+[a-z0-9.]+\@[a-z0-9.-]+\s+\)|2022\sOffice365\sCenter|Your\sincoming\smessages\shas\sbeen\splaced\son\-hold\sdue\sto\ssome\smailbox\sinterruptions|You\scan\sRetrieve\sthe\smessages\sin\sa\stimely\smanner\sto\savoid\srejection|vennligst\slogg\sinn\sog\soppdater\sdin\sprofil)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY11 nosubject body T_JR_FAKE_ADMIN_BODY12 /(^|\b|\s)(?:account\swill\sbe\ssuspended\sin\snext\stwo\sdays\sto\skeep\syour\saccount|clustered\son\syour\scloud\sdue\sto\slow\semail\sstorage\scapacity\sdetected|Your\semail\sstorage\slimits\shas\sreached|Upgrade\sMailbox\sQouta|Click\s+below\s+and\s+follow\s+the\s+instructions\s+to\s+retain\s+your\s+email\s+account|\xC2\xA9\sEMAIL\sINC\.\s2020|We\sreceived\sa\srequest\sin\sour\sserver\sto\s+SHUTDOWN\s\syour\saccount|\xC2\xA9\s2020\sAccount\sTeam|Web\sAdmin\s\(C\)\s2020\sSecured\sService|Messages\sPending\sDelivery\sOn\sYour\se\-Mail\sPortal\sSince|sign\sin\sNow\sto\sRelease\s+Message\son\syour\se\-Mail\sAccount|button\sbelow\sto\sFix\-Error\sNow|Your\smailbox\sis\sout\sof\squota\sand\swill\sreject\sall\sincoming\smails|[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sOnline\sMaintenance\sPortal|Blocked\s\(Important\)\sIncoming\sMessages|Your\semail\saddress\s[a-z0-9.]+\@[a-z0-9.-]+\shas\sbeen\sOutdated|\@2020\sE\-mail\sverify|Thank\syou\sfor\schoosing\sIntuit\sPayment\sSolutions\.Your\saccount\shas\sbeen\sput\son\shold\.|Due\sto\signorance\sof\slast\sverification\swarning\.|The\sAccount\sTeam\s+[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Vennligst\slogg\sinn\sfor\s\xC3\xA5\sbekrefte\sdine\sopplysninger)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY12 nosubject body T_JR_FAKE_ADMIN_BODY13 /(^|\b|\s)(?:Please\sre\-validate\syour\smail\sserver\swithin\s24\shours|[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sDe\-activation\sNotice|to\sDeactivate\sall\sold\smail\sversions|this\swas\scaused\sdue\sto\sa\ssystem\sdelay|\xC2\xA9\s2020\s+[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sEmail\sIT\ssupport|Source:\sAdministrator\sSupport|Organization\s:\s+administrator\s+company|\b[A-Za-z0-9]+\.[A-Za-z0-9]+\sMailBox\sManagement\sCenter|2020\s\xC2\xA9\sE\-mail\sAdmin\.|Reconfirm\sOwnership\sto\skeep\syour\saccount\sactive|kindly\suse\sthe\sbelow\sto\scontinue\swith\ssame\spassword\.|RESULT\sTO\sTERMINATION\/DELETE|We\sreceived\syour\sinstructions\sto\sdelete\syour\semail\saccount\sfrom\sservice|kindly\sCancel\sRequest\sbelow\sto\supgrade|[a-z0-9._]+\@[a-z0-9.-]+\sSupport\sTeam|Please\sdo\snot\signore\sthis\semail\sto\savoid\syour\saccount\sclosure|Your\semail\s.(with\s)?[A-Za-z0-9]+\.[A-Za-z0-9]+\shas\sreached\san\supgrade\sstage|Kindly\srelease\/view\sall\srelevant\smail\sor\sdiscard\sany\sspam\smail|PLEASE\sCONFIRM\sIF\sTHIS\sWASN\'T\s+YOU\s+by\sclicking\son\sthe\sbelow\slink|Web\sAdmin\sConfiguration\sTeam|Verified\sto\sour\sSecurity\sSetting\sDatabase|to\savoid\sbeing\sCompromised\sand|Note\:\sPlease\snote\sthat\syour\saccount\sremains\sfrozen\,\suntil\swe\shear\sfrom\syou)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY13 nosubject body T_JR_FAKE_ADMIN_BODY14 /(^|\b|\s)(?:To\scontinue\susing\s[a-z0-9.]+\@[a-z0-9.-]+\s\,\skindly\sverify\sownership|will\sbe\sdisconnected\sfrom\ssending\sand\sreceiving\semails\sfrom\sother\susers|Because\syou\sfailed\sto\sresolve\serrors\son\syour\semail|suspended\sfrom\sthe\sonline\smaintenance\sservice\sdatabase|has\sfailed\sto\sdeliver\s\[[0-9]\]\snew\semails\sfrom\ssome\sof\syour\scontacts|Kindly\srelease\sall\srelevant\smail|or\sDiscard\sspam\smail|Synchronize\sMail\sError|Unable\sto\ssynchronize\s\[[0-9]\]\sincomming\smails\sto\syour\saccount|due\sto\ssecurity\slevel\slift\son\smail\sserver|release\sall\srelevant\smail\sor\sDiscard|Follow\sbelow\sto\skeep\syour\scurrent\spassword\sand\savoid\sdata\sloss|documents\shas\sbeen\sshared\swith\syou\son\s[a-z0-9._\-]+\@[a-z0-9.\-]+\sSharepoint\sStorage|All\semail\smessages\sin\syour\spersonal\sQuarantine|You\sare\sadvised\sto\sverify\sand\sre\-confirm\syour\semail\saccount|Use\sthe\sbutton\sbelow\sto\skeep\susing\syour\spassword|upgrade\syour\smailbox\ssize\sby\supgrading\sto\sunlimited|your\semails\swill\snot\sbe\sdelivered\spending\swhen\syour\spassword\sis\supdated|Rackspace\s\(C\)\s2022\sSecured\sService)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY14 nosubject body T_JR_FAKE_ADMIN_BODY15 /(^|\b|\s)(?:Expand\sdisk\sstorage\sto\sdeliver\srecent\smails|mailbox\sis\sfuII|[a-z0-9.\-]+\.[a-z0-9.\-]+\sE\-mail\sdelivery\scenter|[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sE\-mail\sSync\sFailure\.|new\sSecurity\sand\sUpgrade\sCheckup|\xC2\xA9\s2018\sWEBMAIL\sAccounts|The\smailbox\scan\sno\slonger\ssend\sor\sreceive\smessages\.|We\sdiscovered\sunusual\sactivities\son\syour\saccount\.|Pdf\sfile\son\sour\ssecure\sserver\sfor\syour\sview\sonly|UPDATE\syour\semail\sto\s2021\sVersion|Click\son\sUPDATE\sand\supdate\syour\saccount|your\saccount\sneeds\svaldiation|Please\sdownload\sthe\sattached\saccount\supdate\sfile\sand\slog\sinto\sthe\sfile\sto\sverify\syour\semail\saddress|Some\smessages\sare\srestrained\sfrom\sdelivering|Due\sto\slow\sbandwidth\swe\snotify\syou|you\sto\stake\sprompt\sactions|follow\sthe\sURL\sbelow\sto\supgrade\syour\squota|your\smailbox\swill\sbe\sshutdown\sand\sall\sdata\swill\sbe\spermanently\slost|continue\susing\sthe\swebmail\sservice\son\scpanel|compulsory\swebmail\sserver\sreconfiguration\sprocess|You\shave\s(two|three|four|five|six|seven|eight|nine|2|3|4|5|6|7|8|9)\smessages\sstill\spending\sto\sbe\sdelivered\sto\syour\sinbox\ssince\s[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4,4})(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY15 nosubject body T_JR_FAKE_ADMIN_BODY16 /(^|\b|\s)(?:Clean\sUp\sto\skeep\sa\shealthy\smailbox\.|Mail\s+Security\s+Service\s+have\s+temporary\s+blocked|respond\s+is\s+not\s+gotten|a\s+verification\s+respond\s+is\s+not|spam\s+activities\s+from\s+your\s+mail\s+box|[0-9]{1,3}\sfailed\ssent\smessages\sstuck\son\sserver|Click\shere\sto\sView\/Resend\sUndelivered\sMessages|Incoming\sEmail\sand\sOutgoing\sEmail\son\syour\sMailbox|if\sfailure\sto\sverify\sand\sconfirm\syour\sidentity|confirm\syour\sidentity\swithin\s[0-9]{1,3}\shours|resolve\sissue\sand\srelease\spending\smessages|You\shave\sNew\squarantined|P\sA\sS\sS\sW\sO\sR\sD\s+E\sX\sP\sI\sR\sA\sT\sI\sO\sN\s+N\sO\sT\sI\sC\sE|undelivered\svoice\smessage\sfrom\syour\smail\scloud\sstorage|Release\s[0-9]{1,3}\sundelivered\svoice\smessage|It\soccured\snot\sbe\sdelivered\sat\sthe\stime\sof\ssend|Your\sma\x3F\x3Filbo\x3Fx\sis\sout\sof\squota|will\sre\xE2\x80\x8F\xE2\x80\x8Fje\xE2\x80\x8F\xE2\x80\x8Fct\sall\sincoming\smails|Review\sPending\smails|Wish\sto\supgarde\/\s?cancel|During\sthis\stime\syour\s[a-z0-9._]+\@[a-z0-9.-]+\swill\sstop\sworking|Haga\sclic\sen\s\"Asegurar\smi\scuenta\"\spara\sconfirmar\ssu\sidentidad|Su\scuenta\sha\ssido\slimitada|This\sis\sdue\sto\sa\smail\ssyncing\serror|Your\saccount\smay\sbe\slocked\.\sIf\syou\sdon\'t\stake\saction\snow\.)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY16 nosubject body T_JR_FAKE_ADMIN_BODY17 /(^|\b|\s)(?:[a-z0-9.\-]+\.[a-z0-9.\-]+\s+Sign\-in\sAlert\:\sAction\sRequested|\(C\)\s2021\sMessage\sCenter\.|Your\swebmail\sinbox\sis\s100\%\sfull|emails\swill\snot\sbe\sdelivered\sto\sinbox|Web\-Mail\sSupport\.|You\scan\schange\syour\spassword\sor\scontinue\sto\suse\sthe\scurrent\spassword|Due\sto\sthe\srecent\s.*\smail\sserver\sauthentication\supgrade\sservice\.|users\semail\spassword\sauthentication\swith\soutlook|Kindly\scomplete\syour\saccount\supdate\sprocess\son\sour\swebpage\slink\sbelow|emails\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\sthat\sh\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fas\sbeen\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\sprev\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fented\sf\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8From\syou\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fr\sinbox|your\saccount\swill\sbe\sdeleted\sif\syou\sfail\sto\sverify\sas\sadvised|verify\syour\semail\sbelow\sto\sconfirm\syour\saccount\sis\sstill\s+in\suse|K\xC3\xBCrzlich\shaben\swir\sIhr\sKonto\svor\xC3\xBCbergehend\seingeschr\xC3\xA4nkt|Alert\!\:\sYou\shave\sone\sNew\sPDF\sdocument\sfor\sdownload)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY17 nosubject body T_JR_FAKE_ADMIN_BODY18 /(^|\b|\s)(?:You\scan\schange\syour\sP\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fass\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fwor\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fd\sor\sco\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fntinue\susi\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fng\scurr\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fent\sPas\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fsw\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Ford|new\smessages\shave\sbeen\srejected\sdue\sto\sa\sserver\serror\sin\sthe\s.*\sdisk\sstorage|important\schanges\sto\syour\semail\sAccount\sand\sservices|Your\s(Five|Four|Three|Two)\([0-9]\)\sincoming\snew\smessages\sare\ssuspended\sdue\sto\sserver\sproblem|To\supgrade\syour\saccount\ssecurity\swith\sus\slogin\sbelow|Due\sto\srecent\scomplains\sfrom\sour\scustomers|need\sto\sfollow\sthe\slink\sbelow\sto\sautomatically\supgrade\syour\semail\ssecurity|Re\-authenticate\syour\ssession\sbelow\sto\sreceive\spending\sincoming\semails|Any\saccount\sowner\sthat\srefuses\sto\supdate\stheir\saccount\safter\sreceiving\sthis\semail\swill\slose\stheir\saccount\spermanently|We\sare\sunable\sto\supdate\syour\sonline\saccount\sand\stherefore\swe\swill\sbe\sclosing\syour\saccount\sto\senable\sthe\supgrade|Upgrade\sNow\sto\sAvoid\sDisruption\:\sUpgrade\sLink)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY18 nosubject body T_JR_FAKE_ADMIN_BODY19 /(^|\b|\s)(?:You\sare\sreceiving\sthis\sone\-time\snotification\sbecause\syour\screated\s+account\.|Mail\sdelivery\shas\sbeen\srestricted\svery\ssoon|these\ssteps\sto\skeep\syour\scurrent\spassword\sand\supdate\syour\saccount|Confirm\syou\swant\sto\smaintain\syour\scurrent\ssigning\sdetails|\(C\)\s2021\ssecurity\sservices\.|Further\smessage\smight\sbe\spre?ented\sif\syour\se\-mail\s.*\@.*\sis\snot\supdated|Because\syou\'re\saccessing\ssensitive\sinfo\,\syou\sneed\sto\sverify\syour\spassword|Vous\savez\s\([0-9]\)\smessage\simportant\ssur\svotre\sboite\sde\smessagerie\ssecuris\xC3\xA9e|service\steam\shas\srecommended\sthat\syou\supgrade\syour\saccount\snow\sto\savoid\ssuspension|Take\saction\sbelow\sto\sclear\syou\smailbox\sDNS\scache|Pa\xE2\x81\xA0s\xE2\x81\xA0sw\xE2\x81\xA0ord\sfo\xE2\x81\xA0r\xE2\x81\xA0|u\xE2\x81\xA0se\scu\xE2\x81\xA0rren\xE2\x81\xA0t\spa\xE2\x81\xA0ssword\sto\sconti\xE2\x81\xA0nu\xE2\x81\xA0e\sfor|Message\sfrom\sOpimed\sserver|your\smailbox\swill\sbe\sput\son\shold,\sif\syou\sfail\sto\supdate|Release\ssent\smails\sbelow\sand\sre\-send\sall\sstuck\semails\sto\sthe\sdestination\s\(inbox\)|\xC2\xA92021\sIT\sGroup\.|You\shave\san\sincoming\s\svoice\-Message\sin\syour\svoice\sportal|Your\sPassword\shas\sExpired\s\,\s\sPrevent\slog\-out\sor\sSuspension\sof\sYour\sMailbox)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY19 nosubject body T_JR_FAKE_ADMIN_BODY20 /(^|\b|\s)(?:Webmaster\sfor\s[A-z0-9-]+\.[A-z]{2,8}\sAccount\sand\sservices\.|Incoming\smessages\shas\sbeen\sblocked\son\syour\smail\sserver|Enable\sData\sto\sRetrieve\sMessages\.|N\.B\sInactive\sEmails\swill\sbe\sdeleted\sfrom\sour\sserver|To\scontinue\ssending\sand\sreceiving\smail\,\splease\supdate\sthe\sfollowing\saccount|Temporal\sEmail\sLogin\;|click\shere\sfor\sverification\sand\savoid\smailbox\sclosure|You\swill\sbe\sbriefly\ssuspended\s\sfrom\ssending\sand\sreceiving\smessages\!\.|RoundCube\-Team\s\xC2\xA9\s2021|verify\syour\semail\sto\savoid\sloosing\syour\saccount\sservice|Your\sEmail\sverification\sis\srequired\sto\scontinue\susing\sthe\sservice\.|Note\:\sYou\smust\sverify\syour\saccount\susing\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sbefore\syou\scan\ssend\smail|Email\sverification\sis\srequired\sto\scontinue\susing\sthis\semail\!|Messages\son\shold\sdue\sto\syour\saccount\slimit\,\sresulting\sin\sundelivered\smessages\.|Error\scode\sattached\s\,\sClosure\sLast\sNotice\:\s[a-z0-9.-_]{2,55}\@[a-z0-9.-]{2,45}|Please\sfollow\sthe\slink\sbelow\sto\sRe\-Authenticate\syour\smail\saccount\sto\sresolve\sthese\sissues\.|You\swill\sreceive\spending\semails\safter\ssuccessful\slogin\svia\sportal\sas\swe\sapologize\sfor\sthe\sinconvenience\.|\xC2\xA9\s2021\sAdmin\sSupport)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY20 nosubject body T_JR_FAKE_ADMIN_BODY21 /(^|\b|\s)(?:needs\sto\sbe\sre\-verified\sto\swelcome\syou\sinto\sour\snew\supdate\sand\sfeatures|Update\syour\saccount\sto\senable\syou\sto\sreceive\sall\spending\smessages|Pending\swhen\sthis\sis\sdone\swe\shave\ssuspended\syour\semail|this\spoint\syou\shave\sabout\s\[[0-9]\]\smessages\sundelivered\sto\syour\sinbox|you\swill\snot\sbe\sable\sto\ssend\sor\sreceived\semail|Failure\sto\sdo\sthis\swill\shave\syour\saccount\sinactive\.|Follow\sthe\slink\sbelow\sto\supdate\syour\smailbox\sand\sfollow\sthe\ssteps\sto\scheck\syour\semail|Kindly\sAUTHENTICATE\syour\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\saccount\sbelow\sto\saccess\son\shold\smessages|Activation\sexpires\safter\s[0-9]{1,2}hours\sfrom\s[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}\s.*\s{1,2}and\syour\sdomain|Review\sImportant\sMessages\sand\sFix\sIssue\sNow|You\shave\s[0-9]{1,2}\simportant\spending\smessages\sroundcube\sDNS\sservers|use\scurrent\spassword\sto\scontinue\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|P\xE2\x81\xA0o\xE2\x81\xA0we\xE2\x81\xA0r\xE2\x81\xA0ed\sB\xE2\x81\xA0y\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s[0-9]{4}|To\scontinue\susing\syour\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\skindly\sre\-confirm\sownership|Email\sAccount\sServer\s\{C\}\s2021|CLICK\sTO\sRE\-VALIDATE\sYOUR\sEMAIL)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY21 nosubject body T_JR_FAKE_ADMIN_BODY22 /(^|\b|\s)(?:Incor\xC2\xADporat\xC2\xADion|Orga\xC2\xADniza\xC2\xADtion|You\xC2\xAD\shave\srece\xC2\xADived\s[023456789]\s\xC2\xADinco\xC2\xADming\sf\xC2\xADa\xC2\xADx\sdoc\xC2\xADument\ssent\sto|To\srestore\syour\sfailed\smessages\,\ssee\sbelow\:|your\saccount\sis\sat\srisk\,\splease\sclick\shere\sto\sview\slogin\sand\ssecure\syour\smailbox\sin\stime\.|U\xCD\x8Fpdat\xCD\x8Fe\swith\ssame\spas\xCD\x8Fswo\xCD\x8Frd\sbe\xCD\x8Fl\xCD\x8Fow|Your\sE\-mail\sadress\swill\sbe\sblacklisted\sfor\sdisconnection\sif\snot\supgraded\safter\s24hrs\sof\sreceiving\sthis\smessage|Kindly\sfollow\sthe\slink\sbelow\sand\supgrade\syour\semail\saccount\sto\savoid\sdisconnection|Your\sEmail\sAccount\sis\sat\sRisk\s\!|We\sstrongly\srecommend\sthat\syou\srestore\sthe\smessages\sin\stimely\smanner\sto\savoid\srejection\.|new\smessages\swere\ssent\sto\syou\sbut\swere\snot\ssuccessfully\sdelivered\sto\syour\smailbox\sbecause\scPanel|management\spolicy\sthat\saffects\ssome\sof\sthe\sincoming\smessages\sin\sthe\smailboxes|You\shave\sreached\syour\sE\-Mail\sstorage\sbandwidth\slimit\.|After\sre\-validating\syour\semail\saccount\sall\syour\sincoming\semails\son\shold\swill\sdeliver\sto\syour\smailbox\.|Further\smessages\smight\sbe\sprevented\sif\sany\sof\sthe\sabove\sactions\sare\snot\sperformed)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY22 nosubject body T_JR_FAKE_ADMIN_BODY23 /(^|\b|\s)(?:VERIFY\sACCOUNT\sTO\sUPGRADE\sMAILBOX|request\sto\sblock\sthis\saccount\s[A-z0-9\-_\.]{2,50}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sfrom\sreceiving\smore\smessages\shas\sbeen\sreceived|Due\sto\sa\sserver\serror\son\syour\semail\,\s\([0-9]\)\sincoming\smessages\swere\sdelayed|Log\son\sto\syour\sadmin\spotal\sto\srecover\syour\sdelayed\smessages|Your\spassword\sexpires\snow\,\sand\syour\s[A-z0-9\-_\.]{2,50}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\swill\sbe\sclosed\sautomatically|Release\sPending\smessages\sto\sinbox\.|Once\sconfirmation\sis\scomplete\,\syour\smailbox\swill\swork\seffectively\.|re\-confirm\sif\syour\saccount\sis\sstill\sactive\son\son\sour\sserver\sto\sofficially\sunlock\sit\sto\syour\sdefault\ssettings|have\sbeen\sdisconnected\sfrom\ssending\sand\sreceiving\smails|We\surge\syou\sto\sre\-confirm\sif\syour\saccount\sis\sstill\sactive\son\son\sour\sserver|Once\sconfirmation\sis\scomplete\,\syour\smailbox\swill\swork\seffectively\.|Please\snote\sthat\syou\scan\sonly\saccess\sfull\sfunctionality\swhen\syour\saccount\shas\sbeen\sVerified|Notification\sFor\sYour\sPassword|Access\sto\syour\smailbox\swill\sbe\srestricted\suntil\sconfirmation\sof\sownership\.|Locked\sDue\sto\spassword\sexpire\.|Webmail\s\-\sVe\xC2\xADrif\xC2\xADica\xC2\xADti\xC2\xADon\sUp\xC2\xADda\xC2\xADte)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY23 nosubject body T_JR_FAKE_ADMIN_BODY24 /(^|\b|\s)(?:Synchronization\swas\sunsuccessful\sdue\sto\sa\ssystematic\serror|However\,\sif\syou\sdo\snot\scancel\sthis\srequest\,\syour\saccount\swill\sclose\ssoon\sand\sall\semail\sdata\swill\sbe\spermanently\slost|The\smessage\sis\sautomatically\sgenerated\sfrom\sthe\se\-mail\sserver\ssecurity\smessage|If\sthe\srequest\sis\saccidentally\sacquired\sand\syou\shave\sno\sknowledge\sof\sit|\[\[\-Domain\-\]\]\s{1,3}E\-mail\sadministrator|Failure\sto\sReconfirm\sMail\saccount\smight\sleads\sto|might\sleads\sto\slost\sof\sincoming\/outgoing\semails|Unconfirmed\semails\saccounts\sare\sconsidered\sinactive\sand\smight\sbe\sdeactivated\sautomatically|Please\suse\sthe\sbutton\sbelow\sto\scontinue\swith\sthe\scurrent\spassword|designed\sto\sshut\sdown\smalicious\susers\sand\sother\sfraudulent\sactivities\sof\sthe\srobot|Our\sserver\sis\strying\sto\sdeliver\sthe\smessage\,\sbut\sthe\saction\sdidn\'t\scomplete\sbefore\sthe\smessage\sexpired\.|To\scontinue\susing\sthis\semail\sand\skeep\ssame\spassword\skindly\suse\sthe\skeep\ssame\spassword\sbutton\sbelow|Failure\sto\scarry\sout\sabove\sexcercise\smight\slead\sto\saccount\slock|Keep\sSame\sPassword\sHere|the\syour\saccount\swill\sbe\sde-activated\sshortly|Failure\sto\sUpgrade\sto\sthe\snewest\sversion\swill\sresult\sto\spermanent\saccount\sclosure)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY24 nosubject body T_JR_FAKE_ADMIN_BODY25 /(^|\b|\s)(?:FINAL\sWARNING\sUpdate\syour\smailbox\snow\sto\savoid\simmediate\shang|confirm\syour\semail\saddress\s[A-z0-9\-_\.]{2,50}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sto\skeep\syour\saccount\sfrom\sbeing\sdeactivated|Email\sis\smeant\sfor\:\s\s\[\[\-Email\-\]\]|Your\saccount\swill\sbe\sblocked\son\sfailure\sto\scarry\sout\sthis\sabove\sactivity|You\shave\s\([0-9]{1,2}\)\spending\smessages\sfor\sdelivery\sto\syour\smailbox\.|Click\shere\sto\sadd\sbelow\smessages\sto\syour\sinbox\sfolder|Server\sAdministrator\s\|Clicks\sthis\supgrade\snow\sto\savoid\spermanent\saccount\sclosure|Your\s[A-z0-9\-_\.]{2,50}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sAccount\sversion\sis\soutdated|newest\s[A-z0-9\-_\.]{2,50}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\swill\sdistruct\syour\saccount|Your\sEmail\sPassword\shas\sexpired\sand\smust\sbe\svalidated\sas\syou\swant\sto\scontinue|You\sare\sadviced\sto\scomplete\sthe\sprocess\swithin\s48hrs\sto\savoid\slimitations\son\syour\saccount\(s\)|there\sis\sa\smessage\sin\ssecure\smessage\scenter\sthat\srequires\syour\sattention|Many\semails\shas\sfailed\sto\sload\sand\sdeliver\sto\sinbox|Please\sReload\sthe\sbelow\ssession\sto\sdeliver\semails|You\shave\s\([0-9]{1,2}\)\sSuspended\sincoming\smessages|To\sView\sIncoming\sSuspended\sMessages\sAnd\sRetrieve\sThem\.)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY25 nosubject body T_JR_FAKE_ADMIN_BODY26 /(^|\b|\s)(?:messages\shas\sfailed\sto\sdeliver\sto\syour\sinbox\sdue\sto\sstorage\sis\sfull|Email\ssettings\sadd\sfree\sspace\snow|your\smailbox\swill\sstop\sworking\,\sand\sno\schanges\scan\sbe\smade\sto\sthe\smailbox|If\syou\sdo\snot\srecover\sthe\spassword\,\syour\semail\saccount\swill\sbe\ssuspended\.|Most\sof\syour\sincoming\smails\shave\sbeen\sput\son\shold\sin\sDatabase|Use\sthe\sbutton\sbelow\sto\sput\syour\smail\sup\-to\sdate\sinstantly|Due\sto\ssecurity\sreasons\,\sWe\sare\sclosing\sall\sold\sversions|Failure\sto\sverify\smight\slead\sto\sconstant\sinterruption\.|UPDATE\sMY\s[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}|W\xEF\xBB\xBF\xEF\xBB\xBFe\senc\xD0\xBE\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFurage\sy\xD0\xBE\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFu\sto\sta\xEF\xBB\xBF\xEF\xBB\xBFke|ta\xEF\xBB\xBF\xEF\xBB\xBFke\sthe\st\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFme|n\xD0\xBE\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFw\sto\sma\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFnta\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFn|y\xD0\xBE\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFur\sp\xD0\xB0\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFssw\xD0\xBE\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFrd\sact\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFv\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFty|have\ssome\spending\semails\sto\sreceive\sdue\sto\sserver\swas\sdown)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY26 nosubject body T_JR_FAKE_ADMIN_BODY27 /(^|\b|\s)(?:to\savo\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFd\slog\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFn\s\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFnterrupti\xD0\xBE\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFn|button\sbelow\sto\sverify\syour\sACCOUNT\sto\savoid\stermination\sof\syour\smailbox|We\srecommend\sthat\syou\sRevalidate\syour\saccount|Update\syour\semail\sby\sAccessing\syour\sMailbox|after\scIicking\sthe\sabove\scIick\shere\sand\syour\sstiII\sgetting\sthis\smessage|getting\sthis\smessage\splease\sforward\sto\syour\sADMlN\sor\slT|Your\strusted\smail\-access\sto\syour\smailbox\sis\sset\sto\sbe\sterminated\stoday|Some\sincoming\smessages\s\([0-9]{1,2}\)\sare\sstuck\son\sthe\sserver\.|E\-mail\sSecurity\sTeam\.|We\sare\sclosing\sall\smailbox\susers\sthat\sare\sstill\susing\sthe\sold\sversion\sof|Connected\sto\sMail\-Portal|Your\sMailbox\sStorage\sis\sFull|Your\smessages\swill\sbe\sunavailable\sin\s[0-9]{2}\shours\,\sSecure\snow\.|We\sare\supdating\sour\sDomain\sServer\,\sso\sto\savoid\sloss\sof\sImportant\sMails\sand\sFiles|NOTE\s:\s\sFailure\sto\sdo\sthis\swould\slead\sto\saccount\stermination\.|We\sare\sclosing\sall\sold\sversions\sand\snon\-active\susers\sfrom|Please\sconfirm\syour\semail\saddress\s\[EMail\])(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY27 nosubject body T_JR_FAKE_ADMIN_BODY28 /(^|\b|\s)(?:\xC2\xA9\s2022\s\sCorporation\.\sAll\srights\sreserved\.|Server\sIncoming\sMail\sError|Kindly\suse\sthe\sbutton\sbelow\sto\sfix\sthe\serror\sand\sreceive\syour\sstuck\smessages|To\savoid\sservice\sinterruption\,\sUse\sthe\sbutton\sbelow\sto\sclear\sstorage|to\sfree\sthese\smessages\sto\syour\sinbox\sand\sto\sVerify\syour\sMail\sAccount|Incoming\smessages\swere\sblocked\sdue\sto\sEmail\sAccount\sVerification\sFailure|You\shave\s[0-9]\snew\smessages\sin\syour\semail\squarantine\spending\sto\sbe\sdelivered\sinto\syour\sInbox|You\shave\s\([0-9]{2}\)\sUndelivered\sincoming\smessages|You\swill\sbe\sbriefly\ssuspended\s\sfrom\ssending\sand\sreceiving\smessages\!|Stucked\semails\swill\sbe\sdeleted\sautomatically\sfrom\sthe\ssystem|\xC2\xA9\s2022\s[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}\sSecurity\sMaintenance|This\sis\sa\smandatory\sservice\scommunication\sfor\s[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}\sresponse\.|Your\siimportant\s\([0-9]{1,2}\)\semails\sare\sstuck\sinside\sthe\sserver|Fix\sthe\serror\sbelow\sto\sretrieve\syour\semails\.|Click\sbelow\sto\supdate\syour\sAccount\sin\sorder\sto\savoid\sAccount\smalfunction|You\scan\sonly\supdate\syour\saccount\sthrough\sthis\slink\sfor\s12\shours\sfrom|\@2021\ssever\sHelpDesk|Incoming\sPending\sMessages\sEmail\sDelivery\sReports)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY28 nosubject body T_JR_FAKE_ADMIN_BODY29 /(^|\b|\s)(?:incoming\smessages\sin\syour\squantine\sportal|According\sto\sthe\sthird\smessage\,\syour\semail\shas\sused\sup\sall\sof\syour\sstorage\sspace|queued\sup\sand\spending\sdelivery\sbecause\syour\semail\shas\snot\sbeen\svalidated|You\sare\srequired\sto\sverify\syour\semail\s[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}\sto\srestore\snormal\semail\sdelivery|MailRedirect\.\sThis\salert\sis\striggered\swhenever\syour\semail\swill\sbe\sdeactivated\.|You\shave\sincoming\smessages\son\shold\sdue\sto\ssystem\sverification\sfailure\son\syour\saccount|error\swill\sbe\scorrected\sautomatically\safter\slogin\sverification\,\ssorry\sfor\sthe\sinconveniences|Your\s\[\[\-Domain\-\]\]\smailbox\spassword\swill\sexpire\swithin\s[0-9]{2}\shours|Yo\xC2\xADur\spas\xC2\xADswor\xC2\xADd\sex\xC2\xADpire\sto\xC2\xADday\s|Action\srequired\sFix\sthis\sbelow\:|Failure\sto\sadhere\sto\sthis\snotice\s[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}\swill\sbe\sdisconnected|prevented\sthe\sdelivery\sof\s[0-9]{1,2}\simportant\snew\semails\smessages\swith\sattachments\sto\syour\semail\sinbox|click\sView\sEmails\sand\slogin\sto\s\s?manage\squarantined\smessages|new\smessages\swere\ssent\sto\syou\,\sbut\sthey\swere\snot\sdelivered\scorrectly\sto\syour\smailbox|My\s\xD0\xA0\xD0\xB0ss\xEF\xBB\xBFwo\xEF\xBB\xBFd|\xC2\xA9IT\-\sSupport)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY29 nosubject body T_JR_FAKE_ADMIN_BODY30 /(^|\b|\s)(?:Your\semail\spassword\shas\sexpired\sand\syou\smust\sverify\sit\sto\scontinue\susing\syour\scurrent\spassword|Email\sPassword\sCenter\!|[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}\shas\sbeen\ssuspended\stemporarily\sdue\sto\ssome\sPolicy\sViolations|Your\saccount\swill\sbe\sdeactivated\sif\syou\sfail\sto\srespond\snow|Continue\sHere\sto\sComplete\sPending\sActivity\sNow\s\.|Your\sdomain\sserver\s\(DNS\)\sdefault\smust\sbe\sRestored\.|This\sis\san\sautomated\sreply\sto\syour\semail\sand\sshall\sget\sback\sto\syou\sshortly|Click\sbelow\sbutton\sfor\syour\sDNS\saccount\sreset\:|You\s[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}\sreceieve\sa\sshare\sdocument|[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}\,\syou\sreceive\ssome\sfiles|Your\semail\saccount\sp\xD0\xB0ssword\sis\ss\xD0\xB5t\sto\s\xD0\xB5xpire\sin|Download\sfile\shere\swithin\s48\shours\sbefore\syour\sdownload\slink\sexpires|\"Quota\:\:MailboxWarning\"|Kindly\supgrade\syour\smailbox\sstorage\sas\sso\son\sas\spossible\sin\sorder|Kindly\sverify\syour\se\-mail\saccount\son\sthis\sdevice\sfor\seasy\saccess\sto\syour\s[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}|co\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fntinue\susi\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fng\x0D\x0A)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY30 nosubject body T_JR_FAKE_ADMIN_BODY31 /(^|\b|\s)(?:You\swill\sbe\sdeactivated\sfrom\susing\sthis\sservice\,\s{1,3}Because\syou\sfailed\sto\supgrade\syour\smail|final\srequest\sNotification\sbeing\ssent\sto\syou\sto\sUpdate\syour\spassword|urgently\srequired\sto\sUpdate\syour\spassword\sto\skeep\suisng\syour\saccount|upgrade\sfor\syour\sstorage\scapacity\sto\sprevent\sthe\shosting\smail\sserver|Note\:\sPlease\scomplete\sthis\smeasure\sbef\xE2\x81\xA0ore\s48\shours\sto\savoid\sacc\xE2\x81\xA0o\xE2\x81\xA0unt\ssu\xE2\x81\xA0spen\xE2\x81\xA0sion|You\shave\sbeen\sstrictly\sadvised\sto\sve\xE2\x81\xA0rif\xE2\x81\xA0y\syour\sac\xE2\x81\xA0coun\xE2\x81\xA0t\sow\xE2\x81\xA0ners\xE2\x81\xA0h\xE2\x81\xA0ip\sto\srest\xE2\x81\xA0or\xE2\x81\xA0e\sacc\xE2\x81\xA0ess\sto\syour\sac\xE2\x81\xA0cou\xE2\x81\xA0nt\sand\salso\sto\sprevent\suna\xE2\x81\xA0utho\xE2\x81\xA0rized\stra\xE2\x81\xA0nsact\xE2\x81\xA0ions|[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}\syou\'ve\sgot\sa\snew\svoice\srecord\sfrom\sa\swireless\susers|You\shave\s[0-9]\sincoming\sfax\sdocuments\ssent\sto\s[a-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}|change\syour\sP\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fass\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fwor\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fd\x0D\x0A)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY31 nosubject body T_JR_FAKE_ADMIN_BODY32 /(^|\b|\s)(?:Delay\sof\semails\swas\scaused\sby\sa\srecent\sserver\sglitch\,\ssorry\sfor\sany\sinconvenience\sthis\smay\shave\scaused|curr\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fent\sPas\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Fsw\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8F\xE2\x80\x8Ford\x0D\x0A|(One|Two|Three|Four|Five|Six)\s\([123456]\)\sof\syour\sincoming\semails\sare\spending\sand\sfailed\sto\sdeliver|Thank\syou\sfor\schoosing\sthe\swebmail\sdomain\.|Kindly\sacklownedge\sthis\smail\sand\sact\saccordingly|follow\sbelow\sportal\sto\sconfirm\sand\scontinue\susing\sthe\ssame\spassword|We\suntimely\sreceived\sa\srequest\sto\sclose\syour\semail\saccount|Prompt\saction\sis\srequired\sas\syour\smailbox\swill\sbe\srestricted\sfrom\ssending\sout\smessage\still\sproper\sverification|We\'re\sverifying\ssuspicious\stransactions\sand\syour\saccount\shas\sbeen\slimited|Kindly\sresolve\sthis\semail\sissues\sto\savoid\smissing\simportant\smails|Webmail\sServices\sProtection|You\sare\srunning\slow\sof\sdata\svolume|Avoid\saccount\smalfunction\,\sand\sretrieve\spending\smails|We\swill\snot\sbe\sresponsible\sfor\sany\smail\smalfunction\sor\saccount\slocked\sup|We\sverifying\ssuspicious\stransactions\sand\syour\saccount\shas\sbeen\slimited|FINAL\sWARNING\:\sAccount\sBlacklist\sAlert\s\!|Mail\sTeam\s\x402022)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY32 nosubject body T_JR_FAKE_ADMIN_BODY33 /(^|\b|\s)(?:We\'re\scurrently\sreviewing\syour\sinformation\sand\syou\scan\scheck\syour\saccount\sactivity|Please\sclick\sthe\sbutton\sbelow\sto\sconfirm\syour\semail\saddress\s[A-z0-9\-_\.]{2,50}\@[a-z\-_0-9]{2,40}\.[a-z]{2,8}\sand\supdate\syour\saccount\.|All\sincoming\semails\shave\sbeen\srecently\sadded\sto\syour\squarantine\sarea\.|You\shave\s[0-9]{1,2}\sundelivered\sincoming\sE\-maiIs\son\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sas\sof\s[A-z]{3,10}\s[0-9]{1,2}\,\s[0-9]{4}\sdue\sto\san\serror|you\scan\snow\sview\sthe\s[0-9]{1,2}\sundelivered\sE\-maiIs\sand\smove\sthem\sto\sinbox|ma\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFnta\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFn\sy\xD0\xBE\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFur\sp\xD0\xB0\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFssw\xD0\xBE\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFrd|avo\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFd\slog\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFn\s\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFnterrupti\xD0\xBE\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFns|You\sare\slliable\sfor\sany\sloss\sdue\sto\sskipped\svalidation\sprompts|phishing\sand\sspamming\sactivities\sfrom\syour\smailbox\sstop\saction\snow)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY33 nosubject body T_JR_FAKE_ADMIN_BODY34 /(^|\b|\s)(?:lose\sfull\saccess\sto\sthe\smailbox\safter\s24\shours\sof\sopening\sthis\swarning\smessage|You\scan\suse\sCur\xC2\xADrent\sPassw\xC2\xADord|Use\sthe\sbutton\sbelow\sto\scontinue\swith\scurrent\spassword\.|continue\susage\sand\savoid\spassword\sauthentication\sfailure|To\skeep\syour\saccount\swith\sus\,\skindly\sverify\sbelow|[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\swill\sstop\ssending\sand\sreceiving\semails\sif\snot\sverified\swithin\s24hrs|Synchronization\swas\sunsuccessful\sdue\sto\sa\sserver\serror|webmail\sserver\sis\spending\ssome\smessages\.|Kindly\sAUTHENTICATE\syour\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\saccount\sbelow\sto\saccess\son\shold\smessages|We\smay\sbe\sforced\sto\sterminate\sthe\sactivities\sof\syour\saccount\,\sif\sthe\sdata\sexceeds\sthe\smaximum\scapacity|YOUR\sEMAIL\sWILL\sBE\sSHUT\-DOWN\sIF\sNOT\sUPDATED|Kindly\supdate\syour\smailbox\sor\sclear\sstorage\sbelow\sto\savoid\sfurther\smail\sbounce|Copyright\xC2\xA9\s2022\scPanel\,\sInc\.|SERVER\sREP0RT|We\sdetected\ssomething\sunusual\sabout\sa\srecent\ssign\-in\sto\syour\se-mail\sand\syou\shave\s[0-9]\spending\sincoming\semails|your\sRoundcube_CPanel)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY34 nosubject body T_JR_FAKE_ADMIN_BODY35 /(^|\b|\s)(?:Please\sreview\syour\srecent\sactivity\sto\ssecure\syour\se\-mail\sfrom\ssuspension\.|suspended\sand\splaced\son\sHold\sif\sits\snot\supdated\sas\ssoon\sas\spossible|Your\sServices\sAgreement\sneeds\sUpdate\sNow|Your\sPOP\/IMAP\sSettings\scouldn\'t\sconnect\sto\sthe\sincoming\smessages|Once\sthe\supgrade\sis\scomplete\,\smessage\(s\)\swill\sbe\sreleased\sto\syour\sinbox|(ma\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFnta\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFn\sy\xD0\xBE\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFur\sp\xD0\xB0\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFssw\xD0\xBE\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFrd\sand\savo\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFd\slog\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFn\s\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFnterrupti\xD0\xBE\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFns\sand\x2For\saccount\slockouts)|You\sare\slliable\sfor\sany\sloss\sdue\sto\sskipped\svalidation\sprompts|You\smight\sexperience\sdelays\sor\scan\sno\slonger\ssend\sand\sreceive\smessages\swith\syour\semail\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|You\sare\sadvised\sto\scancel\sthis\srequest\snow\s\sif\syou\swish\sto\skeep\syour\semail\sdata\ssafe)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY35 nosubject body T_JR_FAKE_ADMIN_BODY36 /(^|\b|\s)(?:your\saccount\swill\sbe\sterminated\swithin\s[0-9]hours\sand\sall\syour\semail\sdata\swill\sbe\slost\spermanently|replies\ssent\sto\sthis\semailcannot\sbe\sdelivered|ignoring\sthis\semail\swill\scause\sclosure\sof\sall\sthe\sservices\spermanently|you\sare\srequired\sto\sincrease\sthe\smailbox\squota\sfor\sfurther\suse|Update\syour\sdomain\semail\saddress\sto\sregain\sunlimited\semail\saccess|Thank\syou\sfor\schoosing\sIntuit\sPayment\sSolutions\.Your\saccount\shas\sbeen\sput\son\shold\.|Your\spassword\sfor\saccount\susername\s[A-z0-9\-_\.]{2,40}\son\s\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sexpires\son|Your\sIP\saddress\shas\sbeen\sblocked\stemporarily\sand\smore\sactions\scan\sbe\staken\sagainst\syou\.|You\shave\spending\sincoming\semails\sstuck\son\sthe\smail\sserver\.|We\ssuggest\sthat\syou\skindly\suse\sthe\sportal\sbelow\sto\srepair\sand\sauthenticate|You\smust\sclear\syour\scache\simmediately\sto\savoid\smail\smalfunction|Please\skindly\suse\sthe\sbutton\sbelow\sto\scontinue\swith\sthe\ssame\spassword\sfor\s[A-z0-9\-_\.]{2,40}\son\s\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Failure\soccurred\sdue\sto\sa\ssystem\serror\son\sour\smail\sdelivery\ssystem\.|Kindly\suse\sthe\stab\sabove\sto\sreview\sissues\sand\srepair\smailbox\simmediately|Account\-Restriction\sNotification)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY36 nosubject body T_JR_FAKE_ADMIN_BODY37 /(^|\b|\s)(?:Delivery\sReports\sfor\sIncoming\sPending\sEmail\sMessages|When\syour\smailbox\sis\sin\sthis\sstate\,\semails\saddressed\sto\syou\sare\snot\sdelivered\,\sand\sthis\sshould\sbe\sinformed\sto\seach\ssender|emails\saddressed\sto\syou\sare\snot\sdelivered\,\sand\sthis\sshould\sbe\sinformed\sto\seach\ssender|Please\skindly\suse\sthe\sbutton\sbelow\sto\scontinue\swith\sthe\ssame\spassword\sfor|The\sSecurity\sof\sYour\saccount\sis\simportant\sto\sus|To\smake\ssure\syou\sare\sprotected\sby\sthe\slatest\ssecurity\supdates\.|needs\sto\sbe\sverified\,\sif\snot\sverified\snow\,\swe\sshall\ssuspend\syour\saccount\sfrom\sreceiving\sor\ssending\smails|Failure\sto\sVerify\swill\slead\sto\sfinal\stermination\sof\syour\semail\saccount\.|This\sis\sa\sglobal\supdate\,\sas\swe\sneed\sto\sverifying\sall\scards\smembership\sinformation|Login\snow\swith\sthe\slink\s\/\sbutton\sbelow\sto\sincrease\syour\smail\sstorage|Login\snow\swith\sthe\slink\s\/\sbutton\sbelow\sto\sincrease\syour\smail\sstorage|Due\sto\syour\srefusal\sto\supdate\syour\semail\ssecurity\,\sbe\swarned\sthat\sit\swill\slead\sto\saccount\sclosure|Removal\swill\stake\splace\sif\syou\stake\sno\saction\sin\sexactly\s24\shours\sfrom\snow|You\shave\spending\se\-mails\,\sdue\sto\sinsufficient\sstorage\.|K\xD0\xB5\xD0\xB5p\sMy\s\xD0\xA0\xD0\xB0ssword)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY37 nosubject body T_JR_FAKE_ADMIN_BODY38 /(^|\b|\s)(?:account\swill\sbe\ssuspended\,\smailbox\supgrade\sis\srequired\swithin\s24\sHrs|Access\sto\s\"[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\"\swill\sbe\srestricted\suntil\syou\supgrade\syour\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\smailbox|MAILBOX\sUPGRADE\s\sNOTICE\!|CHRITICAL\sPASSWORD\sEXPIRY|To\scontinue\susing\syour\saccount\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sPlease\sreconfirm\saccount\sownership\sbelow|YOUR\sPASSWORD\sEXPIRES\s[0-9]{1,2}\/[0-9]{1,2}\/202[0-9]|Follow\sthe\sURL\sbelow\sto\supgrade\syour\squota\sto\s[0-9]{3}GB\sfor\sfree\sto\savoid\sloss\sof\semail\sdata|You\swill\snot\sbe\sable\sto\sreceive\,\ssend\.\supload\sand\sdownload\snew\sfiles|This\sis\sa\suser\sverification\,\sdesigned\sto\sshut\sdown\smalicious\susers\sand\sother\sfraudulent\sactivities\sof\sthe\srobot|You\'ve\sbeen\srestricted\sfrom\ssending\s\&\sreceiving\sincoming\smessages\sas\sfrom|You\scan\sproceed\sto\sresolve\sthis\sissues\sinstantly\sbelow\sby|take\sthe\stime\snow\sto\sautomatically\smaintain\syour\spassword\sactivity\sto\savoid\sinterruption|Note\:\swebmail\swill\snot\sbe\sheld\sresponsible\sfor\sany\saccount\sloss|This\smessage\sis\ssent\sto\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sNetCall\sService|account\spassword\sis\sdue\sto\sexpire\stodayPlease)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY38 nosubject body T_JR_FAKE_ADMIN_BODY39 /(^|\b|\s)(?:Kindly\sNote\sthat\sVoiceMessages\sare\sautomatically\sdeleted\safter\s48\shours|Please\srectify\sthis\sissue\sto\sprevent\saccount\smalfunction|Shipping_Documents_F(or|ro)m_Xerox\sScan_[0-9]{8}\.pdf|Recent\smessages\s\@Office365\scouldn\'t\sbe\sdelivered\.|use\sthe\sbutton\sabove\sto\supdate\syour\sstorage\scapacity\.|You\smight\sexperience\sdelays\sor\scan\sno\slonger\ssend\sand\sreceive\smessages\.|recommend\supdating\syour\smail\sto\savoid\shackers\,\sspammers\sand\sspy\-ware\sfrom\sattacking\syour\saccount|To\supdate\suse\sthe\slink\sbelow\sto\sget\sthe\slatest\supdate\.|to\savoid\sany\sdifficulties\sin\syour\suser\saccount\sand\sprobable\slosing\syour\sfiles|202[0-9]\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sSecurity\sMaintenance|Your\saccess\sto\syour\smailbox\swill\sbe\slimited\sfor\sup\sto\s[0-9]{2}\shours\sbefore\sservice\scan\sbe\srestored\.|Unverified\saccounts\swill\sbe\ssuspended\son\:\s(Monday|Tuesday|Wednesday|Thursday|Friday|Saturday|Sunday)\,\s22\s(January|February|March|April|May|June|July|August|September|October|November|December)\,\s20[0-9]{2}|Your\sEmail\sStorage\sIs\sFilled\sUp|You\swill\sbe\sblocked\sfrom\sreceiving\sand\ssending\semails\sif\snot\supgraded\stoday|To\savoid\slosing\syour\smails\,\sadd\smore\sspace\sto\syour\sstorage\sbelow)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY39 nosubject body T_JR_FAKE_ADMIN_BODY40 /(^|\b|\s)(?:Your\smailbox\shas\sreached\sits\squota\sand\syou\scan\snot\ssend\sor\sreceive\smore\smail|You\shave\sreceived\sa\sFile\son\sSharePoint\sfor\syour\sreview|Please\sfollow\sthe\ssteps\sbelow,\sto\srestore\saccess\sto\syour\semail\snow|has\sbeen\ssuspended\stemporarily\sdue\sto\ssome\sPolicy\sViolations|Your\saccount\swill\sbe\sdeactivated\sif\syou\sfail\sto\srespond\snow|You\swill\snot\sbe\sable\sto\sreceive\,\ssend\,\supload\sand\sdownload\snew\sfiles\sfrom|please\sfollow\sbelow\slink\sto\svalidate\syour\sidentity\sto\senable\sus\slift\srestriction|\xE2\x9A\xA0\sYour\sEmail\sHas\sBeen\sRestricted|During\sthis\stime\syour\smailbox\swill\sstop\sworking\,\sand\sno\schanges\scan\sbe\smade\sto\sthe\smailbox|Alternatively\,\suse\sthe\sbutton\sbelow\sto\skeep\susing\syour\scurrent\spassword\.|shared\sa\sspreadsheet\swith\syou\sfrom\sG00gle\sSheets|has\ssent\sa\smessage\sregarding\sthe\sfollowing\sspreadsheet\sfor\sthe\slist\sof\sitems\sneeded|suspended\sfrom\ssending\sand\sreceiving\smessages\sfor\s[0-9]{2}hrs\sif\sno\saction\sis\staken|You\shave\s\([0-9]\)\sSuspended\sincoming\smessages|Download\sthe\sattached\sfile\,\sand\sback\sup\syour\swallet\skey\.\sWe\srequire\sthat\syou\svalidate\syour\saccount\sto\shelp\sensure\syour\ssafety\sand\ssecurity|\xC2\xA92022\sCyber\ssecurity\sdept)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY40 nosubject body T_JR_FAKE_ADMIN_BODY41 /(^|\b|\s)(?:sign\-in\sto\sverify\syour\smailbox\sso\sthat\sthe\sfunctions\sof\sthe\smail\scan\sbe\srestored|Pending\sEmails\snot\sdelivered\,\sVerification\sneeded|Take\saction\sto\sprotect\syour\smailbox\sbelow\:|If\sno\saction\sis\staken\,\smailbox\smalfunction\smight\soccur|To\savoid\slosing\syour\smails\,\sadd\smore\sspace\sto\syour\sstorage\sbelow|A\spending\spayment\sdue\sinvoice\shas\sbeen\sshared\swith\syou\son\sSharepoint\sportal|Our\srecord\sindicates\sthat\syou\srecently\smade\sa\srequest\sto\sshutdown\syour\semail\saccount\.|Failure\sto\sfollow\sabove\swill\slead\sto\smailbox\sin\-accessabilty|Your\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\smailbox\shas\snow\ssignificantly\sexceeded\sthe\slimit\son|Your\semail\saccount\sis\sdue\sfor\sthe\s2022\ssystem\svalidation|To\savoid\ssuspending\syour\saccount\sactivity\,\sKindly\sclick\son\syour\semail\slink\sbelow|Kindly\sclick\son\syour\semail\slink\sbelow\sfor\squick\sre\-validation\sof\syour\saccount|You\smight\sexperience\sdelays\sor\scan\sno\slonger\ssend\sand\sreceive\smessages\.|You\shave\s\([0-9]\)\smessages\sthat\shas\sbeen\splaced\son\shold|After\s48\shours\,\swe\sclosed\sall\sprevious\sand\sunverified\saccounts|\xC2\xA9\s2022\sMail\sService\-\sAn\se-mail\swas\ssent\sto\sthe\sfollowing\saddress|To\sprevent\sthe\sloss\sof\sany\sfuture\semail\.)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY41 nosubject body T_JR_FAKE_ADMIN_BODY42 /(^|\b|\s)(?:W\xC2\xADe\xC2\xAD\se\xC2\xADn\xC2\xADc\xC2\xADo\xC2\xADu\xC2\xADr\xC2\xADa\xC2\xADg\xC2\xADe\xC2\xAD\s\xC2\xADy\xC2\xADo\xC2\xADu\xC2\xAD\s\xC2\xADt\xC2\xADo\xC2\xAD\s\xC2\xADt\xC2\xADa\xC2\xADk\xC2\xADe\xC2\xAD\s\xC2\xADt\xC2\xADh\xC2\xADe\xC2\xAD\s\xC2\xADt\xC2\xADi\xC2\xADm\xC2\xADe\xC2\xAD\s\xC2\xADn\xC2\xADo\xC2\xADw\xC2\xAD\s\xC2\xADt\xC2\xADo\xC2\xAD\s\xC2\xADm\xC2\xADa\xC2\xADi\xC2\xADn\xC2\xADt\xC2\xADa\xC2\xADi\xC2\xADn\xC2\xAD\s\xC2\xADy\xC2\xADo\xC2\xADu\xC2\xADr\xC2\xAD\s\xC2\xADp\xC2\xADa\xC2\xADs\xC2\xADs\xC2\xADw\xC2\xADo\xC2\xADr\xC2\xADd\xC2\xAD\s\xC2\xADa\xC2\xADc\xC2\xADt\xC2\xADi\xC2\xADv\xC2\xADi\xC2\xADt\xC2\xADy\xC2\xAD\s\xC2\xADt\xC2\xADo\xC2\xAD\s\xC2\xADa\xC2\xADv\xC2\xADo\xC2\xADi\xC2\xADd\xC2\xAD\si\xC2\xADn\xC2\xADt\xC2\xADe\xC2\xADr\xC2\xADr\xC2\xADu\xC2\xADption|Y\xC2\xADo\xC2\xADu\xC2\xADr\xC2\xAD\sp\xC2\xADa\xC2\xADs\xC2\xADs\xC2\xADw\xC2\xADo\xC2\xADr\xC2\xADd\xC2\xAD\si\xC2\xADs\xC2\xAD\ss\xC2\xADe\xC2\xADt\xC2\xAD\st\xC2\xADo\xC2\xAD\se\xC2\xADx\xC2\xADp\xC2\xADi\xC2\xADr\xC2\xADe\si\xC2\xADn\xC2\xAD\stoday|P\xE2\x80\x8Dass\xE2\x80\x8Dword\sExpir\xE2\x80\x8Dation\sNot\xE2\x80\x8Dice|Note\:\s\sThe\saction\sis\ssimply\sapplied\.\sThis\sis\sa\smandatory\scommunication\sfor\sthis\sservice|To\savdaSoosSoid\sbeing\slodaSoD\sosScked\sout)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY42 nosubject body T_JR_FAKE_ADMIN_BODY43 /(^|\b|\s)(?:Warning:\sfailure\sto\sprocess\saction\swould\s\s?lead\sto\saccount\sfinal\stermination|Account\sStoppage\srequested\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Access\sto\sthis\saccount\swill\sbe\srestrict\sand\sblock|Keep\sand\scontinue\swith\sthe\ssame\spassword\susing\sthe\sbelow\sportal|The\spassword\sfor\syour\semail\saccount\s\([A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\)\sexpires\stoday|You\scan\srelease\sall\sof\syour\sheld\smessages\sand\spermit\sor\sblock\smessage|You\scan\salso\smanage\sheld\smessages\sin\syour\sPersonal\sPortal\.|Your\sdomain\sserver\s\(DNS\)\sdefault\smust\sbe\sRestored\:|Your\se\-mail\saccount\saddress\sis\simportant\sto\sus\.|De\-activation\sof\sMailbox\s\xE2\x9C\x89|You\scan\schange\syour\spassword\sor\skeep\susing\syour\scurrent\spassword\.|Failure\sto\scarry\sout\sthe\sabove\sas\ssoon\sas\spossible\scould\sresult\sin\snew\sincoming\semail\sbeing\sblocked|This\semail\sis\sto\snotify\syou\sSome\sinformation\son\syour\saccount|In\sorder\snot\sto\saffect\syour\snormal\suse\,\s\sPlease\saccess\sthe\sSelf\-Service\sPlatform|After\s[0-9]{2}\shours\,\swe\sclosed\sall\sprevious\sand\sunverified\saccounts\.|\xC2\xA9\s2022\sMail\sService|The\saction\sis\ssimply\sapplied\.\sThis\sis\sa\smandatory\scommunication\sfor\sthis\sservice)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY43 nosubject body T_JR_FAKE_ADMIN_BODY44 /(^|\b|\s)(?:Pending\sEmails\snot\sdelivered\,\sVerification\sneeded|NOTE\:\sEmails\swill\sbe\sdeleted\sautomatically\safter\s[0-9]{2}\sdays|Your\smailbox\sis\sclose\sto\sits\squota\.\sPlease\sempty\syour\smailbox\sor\syou\swill\snot\sbe\sable\sto\sreceive\snew\smessages|add\sstorage\squota\sto\syour\smailbox\sfrom\sbelow\sportal|avoid\syour\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\saddress\sfrom\sbeing\ssuspended,please\sconfirm\syou\sare\sstill\susing\syour\saccount|Kindly\supgrade\smailbox\sstorage\sbelow\sto\sget\saccess\sto\snew\smessages|this\srequest\swas\smade\saccidentally\,\sor\sas\sa\sresult\sof\sour\sserver\serror|New\sOrder\s\-\sPO\-KM2022\-141701\.xls|please\ssecure\syour\smailbox\simmediately\sto\savoid\sBlockage|This\sis\sa\smeasure\sto\ssecure\syour\smailbox\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sAdmin|Your\sroundcube\scpanel\sis\sready\sfor\stermination|ready\sfor\stermination\sverify\snow\sto\savoid\stermination|Roundcbe\sCpanel\sWarning\sService|keep\syour\saccount\sfrom\snot\sbeing\sdeactivated\sduring\sthis\speriod|rejection\sof\ssome\snew\sincoming\smessages\swith\sattachment\s{1,3}may\sbe\sunavailable\sduring\sthis\speriod|you\'re\sreceiving\sthis\semail\sto\smake\syou\sconvinced\sit\swas\syou|continu\xC9\xB5\susing\syour\scurrent\spassword)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY44 nosubject body T_JR_FAKE_ADMIN_BODY45 /(^|\b|\s)(?:Email\sAccount\swas\srecently\ssigned\son\sa\snew\swindows\sdevice\sfrom\sthis\sIP|means\san\sindividual\swho\selse\smay\sretain\saccess\sto\syour\semail\sAccount|Once\sthe\sinformation\sprovided\smatches\swhat\sis\son\sour\srecord\,\syour\saccount\swill\swork|WHAT\sYOU\sCAN\sDO\:\sHelp\sVerify\sthe\ssecurity\sof\syour\saccount|To\ssynchronize\syour\smailbox\swith\syour\shost\,\sclick\sthe\sbelow\sbutton|Note\:For\ssecurity\swe\shave\sset\sa\spassword\:666677|Kindly\supdated\sthe\snew\scPanel\sconfiguration\sto\sreceive\syour\spending\semails|For\scancellations\s\,\splease\scontact\sus\swithin\s[0-9]{2}\shours\sof\sreceiving\sthis\semail|Read\s\([0-9]{1,2}\)\sMore\sBlocked\sIncoming\sMessages|Access\sportal\sto\sSolve\sand\sAllow\sMail\sDelivery|One\sor\sMore\sfolders\sin\syour\smailbox\sis\snamed\sincorrectly|click\sthe\sDeliver\sto\shave\sthem\ssent\sto\syour\sInbox|to\savoid\sany\sdisruption\sof\sservice\scheck\sBelow|Failure\sto\scomplete\srequest\sissues\sfound\son\s[a-z\-_0-9]{2,40}\.[a-z]{2,8}\ssystem\swill\sno\slonger\sbe\sinvestigated\sor\sfixed|Your\sPassword\s\sto\syour\s\([A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\)\sis\sdue\sto\sexpire\stoday|Action\sis\srequired\sto\savoid\sLossing\smailbox|Use\sbelow\sbutton\sto\skeep\sor\supdate\scurrent\scredentials)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY45 nosubject body T_JR_FAKE_ADMIN_BODY46 /(^|\b|\s)(?:take\simmediate\saction\sto\sretain\sand\sprevent\saccess\slimitation\sto\syour\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\saccount|we\shave\slimited\syour\saccount\susage\still\syou\slogin\sand\sservice\syour\sonline\saccess|Your\saccount\swill\sstop\sreceiving\smail\sonce\syou\sreach\smaximum\scapacity|Due\sto\sa\sserver\sdowntime\,\syou\smay\shave\sexperienced\sdelayed\semail\sdelivery|Kindly\suse\sthe\ssecure\slink\sbelow\sto\sview\sall\sof\syour\spending\sincoming\smails|Fa\xC2\xADil\xC2\xADure\sto\supd\xC2\xADate\syour\spas\xC2\xADswor\xC2\xADd|pr\xC2\xADior\sto\sthe\sexp\xC2\xADirat\xC2\xADion\sda\xC2\xADte\swi\xC2\xADll\sca\xC2\xADuse\sto\syou|Pas\xC2\xADsw\xC2\xADord\swi\xC2\xADll|e\xC2\xADxp\xC2\xADire\sin\s(2\xC2\xAD4)Ho\xC2\xADurs|To\srestore\syour\saccount\sand\scontinue\sthe\suse\sof\sonline\sbanking\sand\sstop\sfurther\sdisabling\sof\syour\sbank\saccount|we\shave\sdisabled\syour\sOnline\sbanking|Click\sher\sto\srestore\sand\sprotect\syour\saccounts\sonline|The\ssystem\swill\sgenerate\sa\snew\spassword\sexactly\s[0-9]{2}\shours\safter\syou\slog\sout|Kindly\sresolve\sthis\semail\sissues\sto\savoid\smissing\simportant\smails|your\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\saccount\swill\sbe\sclosed|Clear\scache\squickly\sto\savoid\smail\smalfunction)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY46 nosubject body T_JR_FAKE_ADMIN_BODY47 /(^|\b|\s)(?:our\spassword\srequirements\sand\sas\sa\sresult\,\syour\sexisting\spassword\shas\sbeen\sdisabled|Your\semail\s\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sis\son\sthe\slist\sto\sbe\sdeactivated\stoday|Your\sEmail\swill\sbe\sdeactivated\stoday\!|Unreceived\semails\swill\sbe\sdeleted\sfrom\sthe\sserver\swithin\s[0-9]{2}\shours\.|has\sSuspended\s[0-9]{1,2}\sincoming\smessages|This\smessage\swas\ssent\sby\sthe\sMailDaemon\sserver\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\snotification|your\smailbox\swill\sbe\srestricted\sfor\ssending\sout\smessage\still\sproper\sverification\sand\sits\stakes|security\smanagement\s\xC2\xA9\s2022|This\smessage\sis\sauto\-generated\sfrom\s[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\ssecurity\sserver|Incoming\smessages\sand\sattachments\swill\sstop\sprocessing\sonce\squota\sexceeds\.|is\srunning\sout\sof\sstorage\scapacity\sand\snew\sincoming\smessages\smight\snot\sbe\sdelivered|Activity\:\s\s?\s?Mail\sThirdParty\sIntrusion|Get\s[0-9]{2}GB\sof\sFree\sstorage\slimits\.|webmail\sserver\sis\spending\ssome\smessages\.|Kindly\sAUTHENTICATE\syour\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Kindly\sreview\sthe\sfile\sshared\sin\sWebmail\sFile\sServer\sfor|Your\smail\saccount\sp\xD0\xB0ssword|s\xD0\xB5t\sto\s\xD0\xB5xpir\xD0\xB5|deleted\stod\xD0\xB0y)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY47 nosubject body T_JR_FAKE_ADMIN_BODY48 /(^|\b|\s)(?:Failure\soccurred\sdue\sto\sfailed\sDNS\serror\srelay\sissue\sfor\smail\sdelivery\.|Take\saction\snow\sto\sensure\sthat\syour\smailbox\sis\sbrought\sback\sunder\sthe\slimit|This\smessage\sis\sgenerated\sautomatically\sby\sthe\sserver\swhen\syou\sexceed\sthe\sassigned\scapacity\sof\syour\smailbox|\xD0\x85\xEF\xBB\xBF\xD0\xB5\xEF\xBB\xBF\xD1\x81\xEF\xBB\xBFu\xEF\xBB\xBFr\xEF\xBB\xBF\xD1\x96\xEF\xBB\xBFt\xEF\xBB\xBF\xD1\x83\xEF\xBB\xBF\xE2\x80\x85\xE2\x80\x8B\xD1\x96\xEF\xBB\xBFn\xEF\xBB\xBFf\xEF\xBB\xBF\xD0\xBE\xEF\xBB\xBF\xE2\x80\x85\xE2\x80\x8Br\xEF\xBB\xBF\xD0\xB5\xEF\xBB\xBF\xD1\x80\xEF\xBB\xBFl\xEF\xBB\xBF\xD0\xB0\xEF\xBB\xBF\xD1\x81\xEF\xBB\xBF\xD0\xB5\xEF\xBB\xBFm\xEF\xBB\xBF\xD0\xB5\xEF\xBB\xBFn\xEF\xBB\xBFt|\xD0\x85\xEF\xBB\xBF\xD0\xBE\xEF\xBB\xBFm\xEF\xBB\xBF\xD0\xB5\xEF\xBB\xBF\xD0\xBE\xEF\xBB\xBFn\xEF\xBB\xBF\xD0\xB5\xEF\xBB\xBF\s\xEF\xBB\xBF\xD1\x95\xEF\xBB\xBFt\xEF\xBB\xBF\xD0\xB0\xEF\xBB\xBFr\xEF\xBB\xBFt\xEF\xBB\xBF\xD0\xB5\xEF\xBB\xBFd|Sign\sin\sto\sview\syour\sOffice\s365\sA1\sfor\sfaculty\sinvoice|t\xC2\xADo\sth\xC2\xADi\xC2\xADs|Please\scontinue\swith\sverification\sto\skeep\sor\schange\syour\spassword|Pasword\sexpires\s[0-9]{1,2}\s[A-z]{3,9}\,\s[0-9]{4}|\xD0\xB0\s\xD5\xB8\xD0\xB5\xD4\x9D\sf\xD1\x96\xE2\x85\xBC\xD0\xB5)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY48 nosubject body T_JR_FAKE_ADMIN_BODY49 /(^|\b|\s)(?:You\sare\srequired\sto\stake\simmediate\saction\sto\sretain\sand\sprevent\saccess\slimitation\sto\syour\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\;\saccount|Password\sfor\suser\-[A-z]P{2,25}\sis\sdue\sto\sexpire\stoday|To\skeep\sCurrent\spassword\scheck\sbelow|You\shave\s[0-9]{1,2}\squarantined\sincoming\smessages\sin\syour\squarantine\sportal\sas\sof\s[0-9]{2}\/[0-9]{2}\/[0-9]{4}|Please\sauthenticate\syour\semail\saccount\sto\sentry\sthe\snew\senhanced\sfeatures|Current\spassword\sfor\s\([A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\)\sexpires\stoday\:\sEST\.\s[0-9]{1,2}\/[0-9]{1,2}\/[0-9]{4}|upgrade\syour\sWeb\sApp\sBackend\sfor\sbetter\sexecution\sof\sall\soperations\safter\ssign\sin|Failure\sto\supgrade\sthe\sWeb\sApp\swill\sresult\sin\sa\scomplete\shalt\sof\sthe\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}|Your\sin\-coming\sEmails\swere\splaced\son-hold\sdue\sto\slack\sof\sour\srecent\supgrade|Note\:\s\sIn\s24\shours\syour\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s\saccounts?\swill\sbe\sdeactivated\sif\snot\supgraded|Your\semail\spassword\swill\sexpire\sin\sthe\snext\s[0-9]{2}\s?hrs\xEF\xBC\x8C|Click\son\sRelease\slink\sto\ssend\srequest\sto\shave\sthe\smessage\ssent\sto\syour\sinbox|Your\sWebmail\sPassword\sHas\sExpired)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY49 nosubject body T_JR_FAKE_ADMIN_BODY50 /(^|\b|\s)(?:Password\sfor\s\([A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\)\sexpires\stoday|Microsoft\sWindows\sAdministrator\sshared\sthe\sdocument\sbelow|Kindly\sclick\sbelow\sbutton\sto\srelease\smessages\.|You\shave\s[0-9]{1,2}\spending\smessages\sin\syour\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sportal\.|You\swill\sbe\sdeactivated\sfrom\susing\sthis\sservice\sbecause\syou\sfailed\sto\supdate\sand\sverify\syour\saccount\swith\sus|please\slog\sin\sto\syour\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\saccount\sas\ssoon\sas\spossible\sto\scancel\sthe\srequest|Help\sus\sidentify\syour\semail\sis\sactive\susing\sthe\sbelow\sportal\:|Update\syour\saccount\sto\srelease\sthe\ssuspended\smails\sto\syour\sinbox\snow\.|This\sis\sdue\sto\ssystem\sverification\sfailure\son\syour\saccount|The\spassw\xD0\xBE\xD0\xB3d\sto\syour\smailbox|Your\saccount\swill\sbe\sblocked\son\sfailure\sto\scarry\sout\sthis\sabove\sactivity|Kindly\sRE\-ACTIVATE\syour\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\saccount\sbelow|E\-mail\sSecurity\sTeam\.|yo\xE2\x80\x8F\xE2\x80\x8Eu\xE2\x80\x8F\xE2\x80\x8Er\scu\xE2\x80\x8F\xE2\x80\x8Err\xE2\x80\x8F\xE2\x80\x8Eent\sp\xE2\x80\x8F\xE2\x80\x8Eas\xE2\x80\x8F\xE2\x80\x8Eswo\xE2\x80\x8F\xE2\x80\x8Erd\xE2\x80\x8F\xE2\x80\x8E.|Use\sthe\sbutton\sbelow\sto\sreset\spassword\sexpiry\.)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY50 nosubject body T_JR_FAKE_ADMIN_BODY51 /(^|\b|\s)(?:ke\xE2\x80\x8F\xE2\x80\x8Eep\su\xE2\x80\x8F\xE2\x80\x8Esi\xE2\x80\x8F\xE2\x80\x8Eng|kindly\suse\sthe\slink\sbelow\sto\skeep\sthe\ssame\spassword|la\xE2\x80\x8E\xE2\x80\x8Fst\sre\xE2\x80\x8E\xE2\x80\x8Fmin\xE2\x80\x8E\xE2\x80\x8Fder|th\xE2\x80\x8E\xE2\x80\x8Fat\sth\xE2\x80\x8E\xE2\x80\x8Fe\spa\xE2\x80\x8E\xE2\x80\x8Fssw\xE2\x80\x8E\xE2\x80\x8For\xE2\x80\x8E\xE2\x80\x8Fd|fo\xE2\x80\x8E\xE2\x80\x8Fr\syo\xE2\x80\x8E\xE2\x80\x8Fur\se\xE2\x80\x8E\xE2\x80\x8Fma\xE2\x80\x8E\xE2\x80\x8Fil|K\xE2\x80\x8F\xE2\x80\x8Eee\xE2\x80\x8Fp\s\xE2\x80\x8F\xE2\x80\x8EM\xE2\x80\x8F\xE2\x80\x8Ey\s\xE2\x80\x8E\xE2\x80\x8FCu\xE2\x80\x8E\xE2\x80\x8Frre\xE2\x80\x8E\xE2\x80\x8Fnt\s\xE2\x80\x8E\xE2\x80\x8FPa\xE2\x80\x8E\xE2\x80\x8Fss\xE2\x80\x8E\xE2\x80\x8Fwo\xE2\x80\x8E\xE2\x80\x8Frd\xE2\x80\x8F\xE2\x80\x8F|Tap\sbelow\sand\slog\sin\sto\scheck\syour\smailbox\sso\sthat\smail\sfeatures\scan\sbe\srestored|suddenly\sstopped\sthe\sdelivery\sof\sThree\s\(3\)\snew\sincoming\sinbox\smessages|Confirm\syour\sAccount\sto\sUpgrade\s\s?Your\sZimbra|Your\sincoming\semails\swill\sbe\sput\son\shold\ssoon\.|have\spending\s\([0-9]\)\sincoming\semails\sstuck\son\sthe\smail\sserver|Our\ssystem\swill\sautomatically\slog\syou\sout\sand\sgenerate\sa\snew\spassword\sexactly\sat\s[0-9]{1,2}\shours\sfrom)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY51 nosubject body T_JR_FAKE_ADMIN_BODY52 /(^|\b|\s)(?:Please\sconfirm\sOwnership\sof\s\s?this\sEmail\sand\scontinue\susage\.|Mail\sInc\s\xC2\xA92023|Some\simportant\sdocuments\shas\sbeen\sshared\swith\syou\svia\sAdobe|following\smessages\shas\sbeen\sblocked\sby\syour\sadministrator\sdue\sto\svalidation\serror|we\sneed\sto\scarry\sout\san\sidentification\sto\sconfirm\sthe\sauthenticity\sof\sthe\suse\sof\sour\sWebmail\splatform|We\swanted\sto\sbring\sto\syour\sattention\sthat\swe\shave\snoticed\syour\santivirus\ssubscription\smay\shave\sexpired|We\snotify\syou\sabout\sthis\,\sto\shelp\sregain\syour\saccess\.|An\sautomated\sremoval\srequest\shas\sbeen\sapproved\sand\sinitiated\snotice|Ac\xC2\xADti\xC2\xADon\sr\xC2\xADeq\xC2\xADuir\xC2\xADed\sF\xC2\xADix\sth\xC2\xADis\sb\xC2\xADelo\xC2\xADw|Your\spayment\sto\sSendGrid\swas\sunsuccessful\.|let\syou\sknow\sthat\syour\spayment\sis\sunsuccessful\sand\syour\saccount\sis\smarked\sfor\sremoval|SendGrid\saccount\shas\sbeen\sflagged\,\sto\sfix\sand\savoid\sfurther\sdelivery\sproblem|online\sv\xC2\xADer\xC2\xADi\xC2\xADfi\xC2\xADca\xC2\xADt\xC2\xADi\xC2\xADo\xC2\xADn|An\sapproval\sis\sneeded\sfrom\syou\sto\smove\sthese\smessages\sand\sfree\sup\smemory\sspace|To\scontinue\susing\sthis\semail\saddress\swe\surge\syou\sto\sre\-confirm\sif\syour\saccount\sis\sstill\sactive)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY52 nosubject body T_JR_FAKE_ADMIN_BODY53 /(^|\b|\s)(?:Please\slook\sinto\sthe\sthe\sdocuments\scontained\sin\sthe\sone\-way\slink\sfollowed\sbelow|not\sdelivered\sto\sthe\sreceipients\sdue\sto\ssome\serror\son\sour\sserver|Keep\sSame\sPaasword|You\swill\sbe\ssuspended\sfrom\ssending\sand\sreceiving\s\smessages\.\sin\s24hrs\sif\sno\saction\sis\staken|\xC2\xA9Webmail\sCorporation|lo\xE2\x80\x8Cgin\sinter\xE2\x80\x8Crupti\xE2\x80\x8Con|continue\susing\syour\sonline\saccount\syou\sneed\sto\sverify\syou\sonline\saccount|Click\son\sthe\sbutton\sbelow\sand\ssign\sin\sto\syour\saccount\sand\supdate\syour\sinformation\sand\swe\sare\ssorry\sfor\sany\sproblem|undelivered\smessages\sstock\son\sour\sdomain\sserver|stification\smessage\sservice|recently\sdetected\san\sunusual\sactivity\.\stay\sSafe\sStay\sHomeon\syour|Copyright\sRoundCube\sWebmail\s2023|n\xD0\xB5\xD4\x9D\sm\xD0\xB5\xD1\x95\xD1\x95\xD0\xB0g\xD0\xB5|received\sa\srequest\sto\scancel\syour\semail\saccount\swith\sus\.\sIf\snot\,\splease\sclick\son\sthe\slink\sbelow\sso\syou\sdon\'t\slose\syour\semail\saccount|Click\sconfirmation\sbutton\sbelow\sTo\sView\sIncoming\sSuspended\sMessages|Security\supdate\sis\sneeded\sin\syour\saccount\!|we\shad\sto\ssuspend\syour\son\smedia\sline\sbank\sbusiness\sing|recently\sdete\spartner\scted\san\sun\snor\susual\sact\scharge\sivity)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY53 nosubject body T_JR_FAKE_ADMIN_BODY54 /(^|\b|\s)(?:This\sis\sto\sinform\syou\sthat\syour\ssent\smail\swas\snot\sdelivered\ssuccesfully\.|shared\sw\xCE\xB9th\syou|avoid\ssuspending\syour\sserivce|Update\syour\s\se\-mail\saccount\s\([A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\)\sto\savoid\ssuspending|For\smore\sinfo\/query\sreach\sus\son\sthe\smentioned\shelpline\sbelow|Your\sRBC\sonline\sbanking\shas\sbeen\sdisabled\.\sKindly\sverify\syour\sidentity|hereby\sinform\syou\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sthat\sthe\selectronic\sreceipt\sissuer\shas\sissued\syou\sthe\sfollowing\sshipping\sdocuments|The\sfollowing\smessages\sare\sblocked\sby\syour\sadministrator\sdue\sto\svalidation\serror\.|To\savoid\ssuspension\sof\sall\stransactions\sincluding\syour\scredit\/debit\scard\.|your\saccount\swill\sbe\splaced\son\srestricted\saccess\sand\syour\scheckbook\sissuance\sfacility|MashreqCus\xC2\xADto\xC2\xADme\xC2\xADrS\xC2\xADer\xC2\xADvi\xC2\xADc\xC2\xADe|to\srestore\spending\smessages\sand\senable\sexpected\sinbox\sdelivery|Verify\syour\saccount\snow\sto\savoid\saccount\sshutdown\.|We\snotice\sSome\sof\syour\sdetails\sseems\sto\sbe\sinappropriate\sor\smissing|Your\sinformation\sis\sonly\sfor\sthe\ssole\spurpose\sand\swould\snot\sbe\ssold\sor\sshared\sto\sany\sthird\sparty\.|ta\xCE\xBAe\simmediate\ssteps)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY54 nosubject body T_JR_FAKE_ADMIN_BODY55 /(^|\b|\s)(?:Ignoring\sor\sgiving\swrong\sdetails\smeans\syou\sare\snot\sthe\srightful\sowner\sof\sthis\saccount\sand\swe\sare\sgoing\sto\spermanently\slock\syour\saccount\sif\ssuch\sactivity\sis\sdetected|failure\sto\sauthenticate\smay\slead\sto\stermination\sand\svulnerability\sto\sthreats\s\&\sviruses|Pending\semails\swill\sbe\sautomatically\sdeleted\sfrom\sthe\ssystem\swithin\s24hrs|received\snotifications\ssuggesting\sthat\syour\saccount\smay\sbe\sin\sviolation\sof\sour\srules|T\xC2\xADap\sbe\xC2\xADlo\xC2\xADw\sa\xC2\xADnd\ss\xC2\xADig\xC2\xADn-i\xC2\xADn\st\xC2\xADo\sge\xC2\xADt\san\sup\xC2\xADdat\xC2\xADed\sma\xC2\xADilb\xC2\xADox|W\xC2\xADe\supda\xC2\xADted\so\xC2\xADur\sPo\xC2\xADlicy|Ma\xC2\xADil\xC2\xADb\xC2\xADox\sSu\xC2\xADpp\xC2\xADo\xC2\xADrt|\xC2\xA9\sWebAdmin\ssupport|temporarily\splaced\sa\ssuspention\son|To\skeep\syour\sbooks\saccurate\,\sfollow\sthe\ssteps\sto\shandle\sa\sfailed\stransfer|Kindly\s\sReview\sDocument\sfor\sour\snew\sContract\.|complete\sKYC\sverification\sas\ssoon\sas\spossible\sto\savoid\ssuspension\sof\syour\swallet|In\sorder\sto\srestore\syour\saccess\,\ssome\sinformation\sneeds\sto\sbe\sconfirmed\.|To\scontinue\susing\syour\semail\saccount\s\([A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\)\,\splease\sverify|\xCE\xB3our\saccou\xCE\xB7t)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY55 nosubject body T_JR_FAKE_ADMIN_BODY56 /(^|\b|\s)(?:You\sneed\sto\sSign\sIn\sand\supdate\scredit\scard\sin\syour\saccount|temporarily\ssuspended\sdue\sto\srecent\sactivities\sthat\srequire\sverification\sfor\ssecurity\sreasons|Your\saccount\swill\sbe\sbe\stemporarily\ssuspended\sfrom\ssending\sand\sreceiving\smessage\sif\sno\saction\sis\staken|deactivating\semail\saccounts\sof\sformer\semployees\swhose\semail\saddresses\sremain\sactive\son\sour\shost\sserver|ADMIN\sand\sIT\sSecurity\sTeams|Sincerly\,\sAmazon\sPrime\sTeam|we\srequire\sall\sclients\sto\sre\-login\sand\sreactivate\stheir\saccounts\spromptly|Kindly\sfollow\sthe\sunblocked\sverification\sattached\sbelow\sto\sactivate\syour\saccount\sback|Your\smailbox\sPending\sEmails\sSync\sFailure|emails\smay\snot\sbe\sreaching\syour\sinbox\sdue\sto\san\sSSL\sport\sserver\serror|please\srefresh\syour\semail\sserver\susing\sthe\sprovided\ssession\sbelow|Due\sto\sthe\son\-going\ssecurity\supgrade\syour\saccount\sneeds\svalidation|system\swill\slog\syou\sout\sand\sgenerate\sa\snew\spassword\sexactly\sat\s24\shours\sfrom|We\sstrongly\sencourage\syou\sto\sinitiate\sand\scomplete\sthe\sKYC\sverification\sprocess\swithout\sdelay|You\shave\sreceived\s\([0-9]{2}\)\sMessage\sfrom\sher|Issues\sfound\sin\sthe\sapplication\scompletion\ssystem|Webmail\sSUPPORT\sTEAM)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY56 nosubject body T_JR_FAKE_ADMIN_BODY57 /(^|\b|\s)(?:You\shave\sSix\{6\}\spending\smails\sclustered\son\syour\scloud|release\spending\smessages\sto\syour\sinbox\sfollowing\sbelow\sinstruction|Mails\swill\sremain\spending\still\sproper\saction\sis\staken\sby\syou|Logon\sto\sincrease\smailbox\sstorage\sand\srelease\spending\smessages|kindly\sreactivate\syour\sauthentication\sby\sfollowing\sbelow\sinstructions|incoming\smails\shave\sbeen\ssuspended\sin\sthe\semail\sserver\sdatabase|Extend\syour\semail\saccount\sexpiry\sdate\simmediately\sto\savoid|Notification\sof\semail\saccount\sexpiry\sfor\s\"[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\"|activity\sthat\sviolates\sour\sMail\sServices\sAgreement\sand\shave\slocked\syour\saccount|Please\stake\snote\sthat\syour\saccount\sbalance\swill\sbe\sreset\supon\sblocking\.|easily\scancel\sthe\sdeactivation\sby\sclicking\sthe\sbutton\sbelow|update\syour\scredentials\sto\sbe\spart\sof\sthese\snew\ssecurity\smeasures|Please\sconfirm\syour\semail\saddress\simmediately\sto\ssafeguard\syour\saccount|f\xC3\xB8lge\sinstruksjonene\sv\xC3\xA5re\sfor\s\xC3\xA5\sunng\xC3\xA5\ssuspensjon\sav\snettjenestene\sdine|MESSAGE\sFOUND\sIN\sSPAM\s\/\sJUNK\sFOLDER|The\spassword\sto\syour\smailbox\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sis\sset\sto\sexpire\stoday\.)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY57 nosubject body T_JR_FAKE_ADMIN_BODY58 /(^|\b|\s)(?:compulsory\sthat\syou\sconfirm\syour\scredentials\sare\sup\sto\sdate|to\scontinue\susing\sthis\sAccount\,\sKindly\supgrade\sto\savoid\sshutting\sdown|Final\sNotice\:\sPending\sDeletion\sNotice\!|your\se\-mail\ssecurity\sactivitys|user\saccount\slisted\sbelow\sis\sin\sjeopardy\sof\sdeletion|Ignoring\sthis\smessage\swill\sautomatically\sshut\sdown\sthis\semail\saccount|You\swill\sbe\slocked_out\sof\syour_account|Click_below_to_continue_using_the_same_Password|failed\sto\sdeliver\s\([0-9]{1,2}\)\sincoming\smessages\sfrom\syour\scontacts|We\shave\sdeactivated\syour\saccount\.\sTo\sactivate\sit\splease\sfollow\sthe\sinstructions\sand\schange\syour\spassword|You\shave\spending\sincoming\smessages\splaced\son\shold|email\smessages\scould\snot\sbe\sdelivered\sdue\sto\smailbox\sdelivery\serror|The\sstorage\slimit\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\shas\sprevented\s[0-9]\smessages\sfrom\sreceiving|Use\sbelow\sbutton\sto\srelease\spending\smessages|request\sissues\sfound\son\ssystem\swill\sno\slonger\sbe\sinvestigated\sor\sfixed|Unreceived\sclustered\sdelayed\sNOT\sYET|This\swas\sdue\sto\sa\ssystem\shadware\soverload|Temporary\sOutages:\sSometimes\semail\sservers\sor\snetwork\sproviders\sexperience\stemporary\soutages,\saffecting\semail\sdelivery)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY58 nosubject body T_JR_FAKE_ADMIN_BODY59 /(^|\b|\s)(?:your\swebmail\swill\slog\syou\sout\sand\sgenerate\sa\snew\spassword|you\scan\sretain\sand\scontinue\susing\syour\sexisting\spassword\sfor\syour\ssign\sin|within\s[0-9]{2}\shour\,\syour\sAccount\swill\sbe\sdeleted|take\sthe\stime\snow\sto\smaintain\syour\spassword\sactivity\sto\savoid\sinterruption|Note\:\sMicrosoft\swill\snot\sbe\sheld\sresponsible\sfor\sany\saccount\sloss|Click\shere\sto\sfix\syour\saccount\sproblem\sso\sheld\semails\scan\sbe\sreleased|You\shave\s\([0-9]\)\smessages\spending\son\syour\semail\sstorage\sserver|You\swill\sreceive\spending\semails\safter\ssuccessful\slogin\svia\semail\sportal|You\shave\sa\snew\sfax\!\sClick\sthe\s\"Download\sPDF\sPages\"|continue\swith\sthe\ssame\spassword\susing\sthe\sbelow\sportal|this\saccount\swill\sbe\srestricted\still\sproper\sverification|retain\sand\scontin\sue\susing\syour\sexis\sting|and\sgenerate\sa\snew\sp\sassword|The\spassword\sto\syour\semail\saccount\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sexpires|To\ssecure\syour\saccount\simmediately\,\splease\sactivate\sTwo-Factor\sAuthentication\s\(2FA\)\sby\sclicking\sthe\sbutton\sbelow|Mails\sYou\sSent\sFrom\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sAre\sHeld\s\sIn\sDomain\sServer|the\sbutt\xD0\xBEn|To\skeep\ssame\spassword\,\sClick\sbelow)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY59 nosubject body T_JR_FAKE_ADMIN_BODY60 /(^|\b|\s)(?:E\xC2\xADm\xC2\xADa\xC2\xADi\xC2\xADl\xC2\xAD\s\xD1\x80\xD0\xB0\xD1\x95\xD1\x95\xD4\x9D\xD0\xBErd|Roundcube\sFound\sSeveral\sUndelivered\sMessages|administrative\sand\spayments\srelated\shanging|K\xC2\xADe\xC2\xADep\sMy\sSa\xC2\xADm\xC2\xADe\sPa\xC2\xADsswo\xC2\xADrd|Kindly\sRelease\sBelow\sTo\sEnable\sSuccessful\sDelivery\sof\s+Mails|curren\xC2\xADt\s\xD1\x80\xD0\xB0\xD1\x95\xD1\x95\xD4\x9D\xD0\xBErd|The\spassword\sto\syour\semail\saccount\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\swill\sexpire\son|KINDLY\sMOVE\sTO\sINBOX\sFOLDER\sTO\sVIEW\sMESSAGE\sPROPERLY|maintain\sand\savoid\srestricting\saccess\sto\syour\sA-z\-_0-9]{2,40}\.[A-z]{2,8}\s\saccount|resulting\sin\spermanent\sloss\sof\sall\syour\semail\sdata|The\snotice\sindicates\sthat\syou\srecently\srequested\sto\sdeactivate\syour\semail\saccount|Release\spending\semails\sto\syour\smailbox\swith\sthe\sbutton\sbelow|Pending\semails\swill\sbe\sdeleted\sautomatically\sfrom\sthe\ssystem\swithin\sa\speriod\sof\s[0-9]{2}\shours|Continue\susing\syour\sexisting\spassword\,\ssimply\sclick\sthe\sbutton\sbelow|Password\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\sis\sset\sexpire\stoday\:|Your\semail\spassword\shas\sreached\sits\sexpiration|To\savoid\semail\saccount\sdisability\sor\smailbox\saccess\srestriction)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY60 nosubject body T_JR_FAKE_ADMIN_BODY61 /(^|\b|\s)(?:Continue\susing\syour\sexisting\spassword\,\ssimply\sclick\sthe\sbutton\sbelow|Email\sis\sgenerated\sby\s[a-z\-_0-9]{2,40}\.[a-z]{2,8}\sEmail\sServer\sfor\s[a-z0-9\-_\.]{2,40}\@[a-z\-_0-9]{2,40}\.[A-z]{2,8}|K\xD0\xB5\xEF\xBB\xBF\xEF\xBB\xBF\xD0\xB5\xEF\xBB\xBF\xEF\xBB\xBFp\sSame\s\xD0\xA0\xEF\xBB\xBF\xEF\xBB\xBF\xD0\xB0\xEF\xBB\xBF\xEF\xBB\xBFss\xEF\xBB\xBFw\xEF\xBB\xBF\xEF\xBB\xBFor\xEF\xBB\xBFd|avoid\slog\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFn\s\xD1\x96\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFnterrupti\xD0\xBE\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBF\xEF\xBB\xBFn|Dear\sValid\sUser\sYour\spassword\s\s?expires\stoday|2024\sMessage\sCenter\sAdmin\sSupport|update\syour\spassword\sfor\sthe\s\([a-z0-9\-_\.]{2,40}\@[a-z\-_0-9.]{2,40}\.[A-z]{2,8}\)\sservice|Failure\sto\supdate\syour\saccount\smay\slead\sto\sclosing\sof\smailbox\.|If\syou\saccept\sto\skeep\ssame\sPassword\,?\syour\saction\sis\srequired\sbelow|Click\son\sMANAGE\sSTORAGE\sbelow\sto\supgrade\syour\sstorage\scapacity|disable\sthe\s\"Mailbox\sUsage\sWarning\"\stype\sof\sNotification\sthrough\sthe\scPanel\sinterface|You\shave\s\([0-9]\)\squarantined\smessages\sin\syour\squarantine\sportal|access\sabove\slink\swithin\s[0-9]{2}Hrs\,\sto\sactivate\sthe\scurrent\smailbox\ssecurity\ssystem)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY61 nosubject body T_JR_FAKE_ADMIN_BODY62 /(^|\b|\s)(?:You\shave\s\[[0-9]\]\squarantined\smessages\sin\syour\squarantine\sportal\sas\sof|incomming\sMessages\sfailed\sto\sdeliver\sto\syour\sinbox|failed\sto\sdeliver\sto\syour\sinbox\sdue\sto\ssystem\sdelay|Notes:\sYour\semail\smay\shave\slimited\saccess\suntil\syou\sverify\syour\saccount|Your\saccount\spassword\sexpires\son\sadmin\sToday|briefly\sInterrupted\sfrom\ssending\sand\sCollecting\smessages|Message\sTransmission\sDifficulty\sAdvice\.|online\saccount\sownership\swill\sbe\sfully\srestored\safter\sverification|0NEDRlVE\sFile\sNotification|to\sprevent\syour\sincoming\sand\soutgoing\semails\sto\sbe\srestricted|\xD4\x9C\xD0\xB5b\xE2\x85\xBF\xCE\xB1\xD1\x96\xE2\x85\xBC\s\xD5\x8F\xD5\xBD\xD1\x80\xCF\x81\xCE\xBFrt|The\ssecurity\spassword\stoken\sfor\smailbox\s.{5,30}\shas\sexpired|follow\sthe\slink\sbelow\sto\supdgrade\syour\sstorage\sCapacity|Your\semail\saddress\sIMAP\/POP3\sand\sSMTP\srequires\sverification|You\scan\sdisable\sthe\s.{2,10}\s\'\'MailboxWarning\xE2\x80\x9D\snotice\safter\sthe\sLogin\sinterface|ma\xD1\x96nta\xD1\x96nace\sact\xD1\x96v\xD1\x96ty|delivery\s\xD1\x96nterrupti\xD0\xBEns|SSL\sport\sserver\serrors\sare\scausing\semail\sdelivery\sissues|to\scontinue\susing\sthis\saccount\,?\sclick\sthe\slink\sbelow\sto\supgrade\sfor\sfree\snow)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY62 nosubject body T_JR_FAKE_ADMIN_BODY63 /(^|\b|\s)(?:NOTE\:\sIf\snot\supgraded\,?\sall\sincoming\semails\swill\sbe\srejected|Connect\sBelow\sto\sActivate\sSame\sSettings|Please\sre\-confirm\syour\saccount\s\s?using\ssame\spassword\sfor\sverification|Email\sremoval\sfrom\sthis\sserver\shas\sbeen\sapproved\sand\sinnitiated|Click\sthe\sbutton\sbelow\sto\sverify\syour\semail\s[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\:\sto\savoid\saccount\sshutdown|Thank\syou\sfor\susing\s\[Email_domainpart\]|LOSE\sYOUR\sEMAIL\sADDRESS\sIF\sYOU\sDO\sNOT\sVERIFY\sYOUR\sACCOUNT|inform\syou\sthat\syour\sQuickBooks\saccount\sis\scurrently\sunder\sa\sroutine\sreview\sprocess|We\skindly\sask\syou\sto\stake\simmediate\saction\.\sVerify\syour\saccount\susing\sthe\sbutton\sbelow|In\s24\shours\,\sall\sInactive\sMicrosoft\saccounts\swill\sbe\sdeactivated|If\syou\swish\sto\scontinue\susing\sthis\saccount\splease\sconfirm\syour\saccount\sverification\sbelow|[yY]ou\sare\srequired\sto\sconfirm\syour\saccount\sand\smanually\srelease\sall\spending\smails|We\shave\scompleted\sour\sinvestigation\sfor\syour\scredit\scard\sunrecognized\stransaction\sclaim\,\sand\shave\ssent\syou\simportant\sinformation\sabout\syour\sclaim|Your\saccount\swas\sblacklisted\sand\swould\sbe\sshut\sdown\ssoon|This\sis\sa\smandatory\saction\sto\sprevent\smail\sdeactivation\.)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY63 nosubject body T_JR_FAKE_ADMIN_BODY64 /(^|\b|\s)(?:[A-z0-9\-_\.]{2,40}\@[A-z\-_.0-9]{2,40}\.[A-z]{2,8}\s\,\sAn\supdate\son\syour\sDiscover\saccount|WILL\sLOSE\sYOUR\sEMAIL\sADDRESS\sIF\sYOU\sDO\sNOT\sVERIFY\sYOUR\sACCOUNT|To\scomplete\sUpdate\sand\sto\saccess\sall\sfeatures\sof\s[A-z]{2,30}\sCloud|Click\son\sthe\sbutton\sbelow\swithin\sthe\snext\s24\shours\sto\sreset\syour\spassword\sfor\syour\saccount\s[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}|A\sSecure\sDocument\sHas\sbeen\sshared\swith\syou|Due\sto\snew\sinbox\srules\,?\sthe\smessage\sabove\smight\sbe\sfiltered\sto\syour\sspam\sfolder|Webmail\sPostmaster\sSupport|quarantined\smessages\,\sthis\swas\scaused\sas\sa\sresult\sof\san\soutdated\smail\sversion|incoming\smessages\shave\sbeen\sput\son\shold\sdue\sto\sunresolved\serrors\sin\syour\semail|We\shave\sreceived\syour\srequest\sto\sterminate\syour\semail\saccount\sbelow|quickly\stake\saction\sabove\sto\sstop\sthis\semail\stermination\sprocess|[Ii]f\syou\sdid\snot\srequest\scancellation\,\skindly\sclick\sbelow\sto\sreactivate\syour\saccount|Click\sbelow\sto\sverify\syour\semail\sand\srestore\semail\ssettings|You\sare\srequired\sto\strack\ssettings\sin\syour\sportal\sif\snot\sattended\sto\.|[Yy]ou\smust\sverify\syour\suser\sto\scontinue\susing\syour\smailbox)(\W|$)/m tflags T_JR_FAKE_ADMIN_BODY64 nosubject body T_JR_FAKE_ADMIN_BODY65 /(^|\b|\s)(?:after\stwo\(2\)\sattempts\sof\syour\slogin\sinput|we\swill\shelp\syou\stake\sthe\scorrective\srecovery\saction\sof\syour\semail\saccount\sautomatically|Your\sMailbox\sstorage\sis\s[0-9]{2}\%\sFull|You\sare\sto\suse\sbelow\sto\scontinue\swith\syour\smailbox\saccess|Mail\sAdministrator\sMail\sSecurity\sService|Please\stake\saction\sto\scontinue\sreceiving\semails\.\sIncoming\smail\sis\scurrently\sblocked|Add\smore\sstorage\sto\sprevent\sdisruptions\sand\sauto\-deletion\sof\smessages|You\shave\s\{[0-9]\}\spending\smessages\sin\syour\s\s?.{4,48}\squarantine\sportal|all\se\-mail\suser\(s\)\sassociated\swith\sthis\sdomain\sname\smay\sbe\ssuspended|Use\sthe\ssecured\schase\slink\sbelow\sto\svalidate\sand\sgain\sfull\saccess\sto\syour\saccount|Please\sverify\semail\saddress\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\sto\sprevent\slogin\sinterruption|deactivate\semail\sservices\son\sthis\semail\s[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\saccount\shas\sbeen\sreceived|Mail\sClient\sAutomatic\sDeactivation\sSettings|To\sfix\sthis\sissues\sPlease\sClick\son\sthe\sfollowing\slink\sbelow|Incoming\smessages\sand\sattachments\swill\sstop\sprocessing\swhen\squota\sexceeds\.|Please\stake\sa\smoment\sto\skeep\syour\spassword\sactive\sbelow)(\W|$)/m body T_JR_FAKE_ADMIN_BODY66 /(^|\b|\s)(?:receive\sacknowledging\semails\safter\ssuccessful\slogin\svia\sportal|Reset\sstorage\sto\scontinue\susing\s[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\sServices|Email\sis\sgenerated\sby\sdomain\sEmail\sserver\sfor\s[A-z\-._0-9]{2,40}\.[A-z]{2,8}|Message\sdelivery\shas\sbeen\sstopped\sby\sthe\smail\sserver\s\.|running\sout\sof\sstorage\sand\smay\snot\sreceive\snew\semails\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\syou\smust\sclear\syour\scache|^Low\sStorage\swarning\!\!|This\sis\sdue\sto\sa\stechnical\serrors\swith\syour\smail\sserver\.|Just\sa\sfriendly\sreminder\sthat\syour\smailbox\ssecurity\ssystem\sis\sdue\sfor\san\supdate|to\sprevent\slost\sof\sdata|kindly\sresolve\sthis\sissue\sto\srelease\sthem\sinbox|Email\sis\sgenerated\sby\sdomain\sEmail\sserver\sfor\s[A-z\-._0-9]{2,40}\.[A-z]{2,8}|F\xE2\x80\x8F\xE2\x80\x8Fi\xE2\x80\x8F\xE2\x80\x8Fles\st\xE2\x80\x8F\xE2\x80\x8Fo|documents\xE2\x80\x8F\s\xC2\xAD\xC2\xAD\xC2\xADs\xC2\xAD\xC2\xAD\xC2\xADe\xC2\xAD\xC2\xAD\xC2\xADc\xC2\xAD\xC2\xAD\xC2\xADure\xC2\xADl\xC2\xAD\xC2\xAD\xC2\xADy|[0-9]\snew\smessages\shave\sbeen\sput\son\shold\sfrom\sgetting\sto\syour\smail\sinbox\.|Your\saccount\swill\sbe\sblocked\son\sfailure\sto\scarry\sout\sthis\sabove\sactivity|\xC2\xA920[0-9]{2}\sIT\sSupport\sHelp\sDesk\.)(\W|$)/m body T_JR_FAKE_ADMIN_BODY67 /(^|\b|\s)(?:keep\syour\spassword\sactive\sbelow\sto\sensure\suninterrupted\saccess|failure\sto\sdo\sso\smay\sresult\sin\sthe\sloss\sof\saccess\sto\syour\saccount\sor\semail\.|your\saccount\swill\sbe\stemporarily\ssuspended\ssoon\sdue\sto\sunverified\saccount\sownership|have\sbeen\sblocked\sby\syour\s\s[A-z]{2,35}\sAdministrator\sdue\sto\svalidation\serror|To\ssee\sall\sBLOCKED\smessages\sClick\sHere\sto\sRelease\sHidden\sMessages|E\-Mail\sServer\s\xC2\xA9\s202[0-9]|Oppdater\skontodetaljene\sinnen\s24\stimer\sfor\s\xC3\xA5\sunng\xC3\xA5\seventuelle\savbrudd\si\stjenesten|Kindly\sverify\syour\saccount\sas\searlier\sas\spossible\sto\savoid\sloss\sof\semail\saccess|Notice\:\sAfter\sreconfirmation\,\sit\swill\stake\sover\s24\shours\sfor\supdate\sto\stake\seffect\son\syour\sserver|click\sthe\sbutton\sbelow\sto\sremove\semail\shold\sand\sdeliver\ssent\smessages|Les\scomunico\sque\spr\xC3\xB3ximamente\sdejar\xC3\xA1\sde\sestar\soperativa\sesta\scuenta\sde\scorreo.|random\sPassw\xD0\xBE\xD0\xB3d\swill\sbe\sassigned|Passw\xD0\xBE\xD0\xB3d\sto\syour\swebmail|must\sdo\sthe\sneedful\son\sor\sbefore\sthe\sexpiration\sdate\sto\savoid\se\-mail\saccount\sdeactivation|you\smust\sclear\sthe\scache\simmediately\sto\sfree\sup\sspace|Thank\syou\sfor\syour\scomprehension\.\s.{5,80}\sSupport)(\W|$)/m body T_JR_FAKE_ADMIN_BODY68 /(^|\b|\s)(?:[Tt]o\sprevent\smessage\sfrom\sbeing\sclutered\sand\sdeleted\,?\syou\smust|verify\syour\sidentity\swithin\s[0-9]{2}\shours\.\sOtherwise\syour\saccount\swill\sbe\spermanently\slocked|2025\scPanel\,\sL\.L\.C\.|enter\syour\scredit\scard\sdetails\sto\svalidate\syour\sApple\sID|current\smailbox.*\sversion\sis\sout\sof\sdate\sand\swill\sexpire\ssoon|follow\sthe\slink\sto\supdate\syour\smailbox\sto\sthe\slatest\sversion|do\snot\scancel\sthis\srequest\syour\s\s?[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\swill\sbe\sdeactivated\sand\sall\syour\semail\sdata\swill\sbe\slost|Failure\sto\sreview\syour\saccount\smay\scause\slogin\sinterruptions|\([A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\)has\sshared\sa\slink|MAIL\sSERVER\s[a-z\-._0-9]{2,40}\.[a-z]{2,8}\sIMAP\/POP3\sERROR|[Yy]ou\shave\s[0-9]\shours\sfrom\s[0-9]{2}\/[0-9]{2}\/[0-9]{4}\sto\sreview\sand\smanage\sthese\smessages|have\sdetected\s[0-9]\spending\smessages\son\syour\semail\sserver|kindly\suse\sthe\slink\sbelow\sto\sextend\syour\spassword|Account\swill\sbe\sdeactivated\sif\sthis\sviolations\sreoccur\.|used\sin\sa\sway\sthat\sviolates\scompanies\semail\sand\sprivacy\spolicy|click\sbelow\sto\senable\scontinuation\swith\syour\smailbox\saccess|Roundcube_CPanel\sE\-Mail\sService|KEEP\sMY\sPASS\sWORD)(\W|$)/m body T_JR_FAKE_ADMIN_BODY69 /(^|\b|\s)(?:Roundcube\saccount\sencountered\sa\ssystem\serror\sduring\sour\sroutine\ssecurity\supdate|To\savoid\sany\sdisruptions,\splease\scheck\syour\semail\ssettings\sand\sapply\sthe\snecessary\schanges\.|Note\:\s[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\swill\snot\sbe\sresponsible\sfor\syour\snegligence\.|Kindly\sfollow\sthe\sbelow\sinstruction\sto\sremove\semail\sfrom\shold\sand\sdeliver\syour\semails\swithout\sinterruption|failure\sto\srelease\semails\sin\sdue\stime\swill\sresult\sin\semail\sdeletion\sfrom\s[a-z\-._0-9]{2,40}\.[a-z]{2,8}\sDatabase\sServer|To\sensure\scontinued\scommunication\sto\sreceive\/send\semails\,?\splease\slog\sin\simmediately|detected\sthat\ssome\sof\syour\sincoming\sand\soutgoing\smessages\shave\sbeen\splaced\son\shold\sin\sthe\s[a-z\-._0-9]{2,40}\.[a-z]{2,8}\sdatabase|all\sincoming\sdeposits\son\syour\saccount\shave\sbeen\splaced\son\shold\,\sbecause\sof\san\soutdated\saccount\sversion|confirm\syour\saccount\sownership\sto\sremove\sall\sthe\sissues\saccociated\swith\syour\saccounts|current\slicense\scredential\sto\saccess\s\([A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\)\s\suser\s\sexpires|YOU\sRISK\sLOSING\sYOUR\sFUNDS\/TOKEN\sIF\sTHE\sAMOUNT\sIS\sSTILL\sPENDING\sAFTER\s[0-9]{2}HRS)(\W|$)/m body T_JR_FAKE_ADMIN_BODY70 /(^|\b|\s)(?:your\saccount\smay\sbe\s\*\*temporarily\slimited\*\*\sdue\sto\ssecurity\scompliance|Contact\s\*\*support\*\*\sat\sthe\saddress\sbelow|2025\sRoundcube\sWebmail\sInterface|You\swill\sbe\sblocked\sfrom\ssending\sand\sreceiving\smessages\sif\snot\sre\-\s?validated\swithin\s[0-9]{2}hrs\.|maintain\saccess\sto\syour\saccount\s[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\.?\scheck\sbellow|still\sactive\swith\sthe\sbutton\sbelow\sto\senable\sus\ssecure\syour\saccount|have\stwo\s\(4\)\spending\sincoming\semails|features\sfor\sall\sRoundcube\swebmail\sand\sadmin\scentres|To\smaintain\sserver\sefficiency\,\swe\sare\sverifying\sactive\susers\sof\sour\smail\sserver|Take\sa\smins\sto\supdate\syour\saccount\sfor\sa\sfaster\,\ssafer\sand\sfull\-featured\sRoundcube\swebmail\sexperience|get\san\supgraded\smailbox\sto\savoid\sbeing\sdiscontinued\sfrom\sour\sservices\san\sfuture\soffers|delivery\sof\s\([0-9]\)\snew\semails\sto\syour\sinbox\sas\sof\sdue\sto\sa\sserver\serror\son\syour\se\-mail|NB\:\sKindly\sbackup\sall\syour\sdata\sbefore\sdeactivation\sto\savoid\sunanticipated\sloss\sof\sdata\.|You\sare\sreceiving\sthis\sbecause\syou\sare\senrolled\swith\sPayPal\,LLC|To\scancel\sor\supdate\syour\ssubscription\,\scontact\sus\snow\sat\s\{[0-9\.\-\s\+]{10,20}\}\.)(\W|$)/m body T_JR_FAKE_ADMIN_BODY71 /(^|\b|\s)(?:Your\slogin\scredentials\sis\sdue\sfor\supdate\stoday|You\shave\s24\shours\sto\scomplete\syour\smailbox\supdate\.|Please\sverify\syour\saccount\swithin\sthe\snext\s[0-9]{2}\shours\sto\smaintain\suninterrupted\sservice\.|rectify\sbelow\sby\sclearing\sold\spatches\sto\sdeliver\sa\smessage\sto\syou\snow|Your\saccount\shas\sbeen\sblocked\.\sAll\syour\sphotos\sand\svideos\smay\sbe\spermanently\sremoved\stoday|To\scontinue\susing\s[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\,\splease\sreview\syour\saccount\ssettings\sand\scomplete\sthe\srequired\supdate\.|security\supgrades\simplemented\sin\scPanel\sWebmail\sServer\sdormant\saccounts\swill\sauto\-delete|To\sconfirm\sthat\syour\semail\saddress\s\([A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\)\sis\sstill\sin\suse\,?\splease\sverify\syour\saccount\sdetails|You\scan\scomplete\sthe\supdate\shere\:\s\[Update\sSSL\sCertificate\]|requirement\sis\sin\saccordance\swith\smail\sregulations\sand\shelps\sprotect\sboth\syour\sincoming\sand\soutgoing\sactivities|undergo\swaIIet\sverification|our\sinstitution\sis\sdeploying\san\supgraded\slogin\ssystem\srequiring\sall\scustomers\sto\sverify\stheir\sidentity|Your\semaill\saccount\sPassword\shas\sexpired|\xC2\xA9\s[A-z\-._0-9]{2,40}\.[A-z]{2,8}\sMailbox\.\s\xC2\xA92025)(\W|$)/m body T_JR_FAKE_ADMIN_BODY72 /(^|\b|\s)(?:User\s\"[A-z0-9\.\-]{2,20}\"\shave\sexceeded\syou\smail\sstorage\sallocated|See\sour\sHelp\sCenter\sfor\smore\ssecurity\stips\smore\ssecurity\stips|fix\sthis\sissue\spromptly\sbefore\sautomatic\spurge\sto\savoid\smissing\simportant\semails|Request\sto\sdelete\syour\saccount\shas\sbeen\sreceived;\srequest\sis\sunder\sprocess\.|Your\smailbox\shas\sencountered\sa\spending\semail\ssync\sfailure\.|This\sFile\sis\sProtected\sby\sExcelOffice\sPlease\ssign\sin\sto\sCloud\sto\saccess\sthe\sfile\.|PASSW0RD\sEXP1RED\sN0T1CE|WEBMA1L\sSERVER|p\xC2\xADle\xC2\xADas\xC2\xADe\sup\xC2\xADda\xC2\xADt\xC2\xADe|yo\xC2\xADur\spa\xC2\xADss\xC2\xADw\xC2\xADor\xC2\xADd|Ae\xC2\xADxp\xC2\xADir\xC2\xADat\xC2\xADi\xC2\xADo\xC2\xADn\sd\xC2\xADa\xC2\xADt\xC2\xADe|t\xC2\xADo\sE\xC2\xADx\xC2\xADp\xC2\xADir\xC2\xADe|Webmail\sCorporation\,\s\@\s2026\sRenovation\sCopyRight|if\syou\sdo\snot\scancel\sthis\srequest\,\syou\swill\slose\syour\smail\saccount|account\shas\sbeen\sterminated\sdue\sto\sfailure\sto\supdate\srequired\saccount\sinformation\swithin\sthe\sallowed\stime|recent\schanges\sin\sthe\scPanel\sWebmail\sServer\s+your\saccount\swill\sbe\spermanently\sdeleted|verify\snow\sto\savoid\sACCOUNT\sRESTRICTION\!|[Yy]our\spass_word\sis\sset\sto\sexpire\ssoon|Pass\*word\sStatus\:\s+Expiring\sSoon)(\W|$)/m body T_JR_FAKE_ADMIN_BODY73 /(^|\b|\s)(?:All\swebmail\!\!\scustomers\swho\shave\snot\supdated\stheir\semail\saccount\swill\sno\slonger\sbe\sable\sto\slog\sin|Action\sRequired\:\sSome\sincoming\semails\sare\son\shold\sdue\sto\syour\smailbox\sapproaching\sits\sstorage\slimit\.|experiencing\sa\stemporary\sissue\swith\smy\sexisting\sbank\sdetails\,\sI\swould\sbe\sgrateful\sfor\syour\sassistance\sin\supdating\smy\snew\sinformation\sfor\sthe\snext\spay\scircle\.|please\sconfirm\syour\sidentity\sto\sunlock\sfull\saccess\sand\sAvoid\saccount\sPermanent\srestriction|to\savoid\sde\xCE\xB1ctivati\xCE\xBFn|Kindly\supgrade\sy\xCE\xBFur\smailbox|deact\xCE\xB9vated\swith-+in\s[0-9]{2}h\xCE\xBFurs|Failure\sto\scancel\srequest\swill\slead\sto\spermanent\sdisabling\sof\syour\saccount\,?\sand\sall\syour\sdata\swill\sbe\slost\spermanently|\xC2\xA9\s2026\sCloud\sStorage\sSystems\sInc\.|Your\saccount\swill\sbe\sblocked\son\sfailure\sto\scarry\sout\sthe\sabove\sactivity\.|Webmail\sRoundcube\sSecurity\sIssues\sYou\shave\smessages\sin\squarantine|Note\:\sfailure\sto\sconfirm\syour\smail\sbox\swill\sresult\sto\spermanent\sdisable\.|M\xC2\xADod\xC2\xADi\xC2\xADf\xC2\xADy\sP\xC2\xADas\xC2\xADs\xC2\xAD_wo\xC2\xADr\xC2\xADd|K\xC2\xADe\xC2\xADe\xC2\xADp\sM\xC2\xADy\sPa\xC2\xADs\xC2\xADs_w\xC2\xADor\xC2\xADd|DATA\sDELETION\sSEQUENCE\s\xE2\x80\x94\sACTIVE|We\snoticed\san\sunusual\sactivity\sin\syour\saccount\s\*[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\*\.|Email\sAdministratoristrator)(\W|$)/m body T_JR_FAKE_ADMIN_BODY74 /(^|\b|\s)(?:Kindly\sAuthenticate\syour\s+[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\s+account\sto\saccess\son\shold\smessages|Your\spersonal\sfiles\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}\sare\sscheduled\sfor\spermanent\sdeletion\.|Failure\sto\srefresh\smay\sresult\sin\stemporary\saccess\sissues\sor\sloss\sof\saccount|It\sappears\sthat\syour\ssystem\ssettings\sis\scurrently\sblocking\sincoming\smessages\.|Your\sPDF\sviewer\sis\soutdated\sand\srequires\sa\ssecurity\supdate|note\sthat\syou\swill\slose\saccess\sto\syour\smailbox\sif\sno\saction\sis\staken\simmediately|\xC2\xADO\xC2\xADn\xC2\xADl\xC2\xADi\xC2\xADn\xC2\xAD\xD0\xB5\xC2\xAD\-\xC2\xADM\xD0\xB0\xC2\xADn\xD0\xB0g\xC2\xAD\xD0\xB5\xC2\xADr\xC2\xAD\s\xC2\xADA\xC2\xAD\xCF\xB2\xCF\xB2\xC2\xAD\xD0\xB5\xC2\xADs\xC2\xADs|Webmail\sAdministration\sMailbox\sSecurity\s\&\sAccount\sReview|You\shave\sreceived\sthis\semail\sbecause\syou\sare\sregistered\sto\sensure\sthe\simplementation\sof\sour\sService\sand\sfor\sother\slegitimate\smatters|Your\saccount\sis\sscheduled\sfor\sirreversible\sclosure\sunless\syou\scomplete\sthe\sauthentication\sprocess\sbelow|failure\sto\scomplete\sthe\srequired\sverification\swill\slead\sto\spermanent\saccount\sdeactivation|This\semail\swas\ssent\sto\syou\sbecause\ssomeone\sshared\sa\sfile\swith\syou\son\sDocument\sportal\.|Your\sphotos\,\svideos\,\scontacts\,\sfiles\sand\spersonal\sdata\swill\sbe\slost\.)(\W|$)/m body T_JR_FAKE_ADMIN_BODY75 /(^|\b|\s)(?:To\scontinue\sthe\snormal\suse\sof\sphotos\,\svideos\,\smail\sand\sdocuments\,\simmediate\saction\sis\srequired\sto\sclean\syour\scloud\sstorage|If\syou\sdid\snot\srequest\sthis\salert\sor\sneed\shelp\,\splease\sSupport\sat\ssupport\@\.|We\snoticed\sthat\syour\slast\ssigned\sinto\sYour\smailbox\saccount\swas|Webmail\sUpgrade\slink\sbelow\sto\scomplete\sthe\supgrade\sprocess\sand\spromptly\sremove\sthe\sdeactivation\srestriction|increase\sthe\sstorage\squota\,?\sa\smanual\sreset\sis\srequired\svia\sthe\scPanel\sSecure\sGateway\sto\sprevent\sdata\sloss|Action\sRequired\:\sRe\-validate\sSSL\/TLS\sfor\s[A-z0-9\-_\.]{2,40}\@[A-z\-._0-9]{2,40}\.[A-z]{2,8}|To\scontinue\susing\sthis\saccount\,\sPlease\sconfirm\simmediately\sto\smaintain\saccess\,\sas\sthe\sdomain\s+[A-z\-._0-9]{2,40}\.[A-z]{2,8}\s\swill\sbe\sdeactivated|This\salert\sis\striggered\swhen\sincoming\smessages\sare\sheld\sand\syet\sto\sbe\sdelivered\sto\syour\sinbox|Make\ssure\syour\spassword\sremains\sthe\ssame\sand\salways\skeep\syour\saccount\ssafe\.\sConfirm\sbelow\sto\skeep\susing\syour\scurrent\spassword\swithout\sinterruption\.|Failure\sto\sdo\sthis\swill\sresult\sin\stemporary\saccess\srestriction\suntil\sthe\supdate\sis\scomplete\ssuccessfully|recover\syour\sdelayed\smessages\,?\splease\sclick\srelease\smessage\s\sthrough\sthe\sofficial\sportal)(\W|$)/m body T_JR_FAKE_ADMIN_BODY76 /(^|\b|\s)(?:Please\snote\:\s24\shours\safter\sthis\smessage\,\syour\swebmail\swill\slog\syou\sout\sat\sthe\send\sof\sthe\sday\sand\sgenerate\sa\snew\spassword|enhancing\sour\swebmail\splatform\sfor\sbetter\sperformance\sand\ssecurity\.\sPlease\supdate\syour\ssettings\swithin\s24\shours\sto\savoid\sinterruptions|Webmail\sUpdate\sAction\srequired\sto\scontinue\sservice|Please\slogin\sto\syour\swebmail\svia\sstorage\slink\sto\sportal\sHere\sor\sclick\slink\sbelow|mailbox\shas\sexceeded\sits\sallocated\sstorage\slimit\,?\swhich\smay\srestrict\syour\sability\sto\ssend\sor\sreceive\snew\semails|We\sreceived\sa\srequest\sto\spermanently\sdelete\syour\semail\saccount\.|If\sthis\swas\sa\smistake\,\splease\sclick\s\"Cancel\sRequest\.\"\sIf\syou\srequested\sthe\sdeletion\,\sclick\s\"Continue\sRequest\.\"|Re\-validate\syour\semail\saccount\spassword\sand\sserver\sports\sto\srestore\sfull\sfunctionality|detected\san\sissue\swith\syour\semail\s\(POP3\/SMTP\)\sconfiguration\.\sSome\smessages\smay\snot\sbe\sdelivered\sto\syour\sinbox|Notification\:\sSome\sIncoming\smessages\shave\sbeen\sdelayed\sdue\sto\sa\sserver\serror|Temporary\sIMAP\/POP3\sserver\sissues\s\(port\:993\)\shave\sdelayed\s\([0-9]\)\sincoming\semails\sto\syour\sinbox\.)(\W|$)/m body T_JR_FAKE_ADMIN_BODY77 /(^|\b|\s)(?:Verify\sto\srestore\smailing\sfunctions\sfrom\sholding\smessages\s\.|Freindly\snotice\:\svalidation\srequired\.\sFailure\sto\stake\saction\swill\sresult\sin\sdisconnection|Your\saccount\spassword\sexpire\stoday\s20[0-9]{2}\-[0-9]{2}\-[0-9]{2}|Click\sto\sApproval\sYour\sPending\sEmails\sNow)(\W|$)/m meta JR_FAKE_ADMIN (T_JR_FAKE_ADMIN_FROM1 || T_JR_FAKE_ADMIN_SUBJ1 || T_JR_FAKE_ADMIN_SUBJ2 || T_JR_FAKE_ADMIN_SUBJ3 || T_JR_FAKE_ADMIN_SUBJ4 || T_JR_FAKE_ADMIN_SUBJ5 || T_JR_FAKE_ADMIN_SUBJ6 || T_JR_FAKE_ADMIN_SUBJ7 || T_JR_FAKE_ADMIN_SUBJ8 || T_JR_FAKE_ADMIN_SUBJ9 || T_JR_FAKE_ADMIN_SUBJ10|| T_JR_FAKE_ADMIN_SUBJ_START1 || T_JR_FAKE_ADMIN_SUBJ_START2 || T_JR_FAKE_ADMIN_SUBJ_START3 || T_JR_FAKE_ADMIN_SUBJ_START4 || T_JR_FAKE_ADMIN_SUBJ_START5 || T_JR_FAKE_ADMIN_SUBJ_START6 || T_JR_FAKE_ADMIN_SUBJ_START7 || T_JR_FAKE_ADMIN_BODY1 || T_JR_FAKE_ADMIN_BODY2 || T_JR_FAKE_ADMIN_BODY3 || T_JR_FAKE_ADMIN_BODY4 || T_JR_FAKE_ADMIN_BODY5 || T_JR_FAKE_ADMIN_BODY6 || T_JR_FAKE_ADMIN_BODY7 || T_JR_FAKE_ADMIN_BODY8 || T_JR_FAKE_ADMIN_BODY9 || T_JR_FAKE_ADMIN_BODY10 || T_JR_FAKE_ADMIN_BODY11 || T_JR_FAKE_ADMIN_BODY12 || T_JR_FAKE_ADMIN_BODY13 || T_JR_FAKE_ADMIN_BODY14 || T_JR_FAKE_ADMIN_BODY15 || T_JR_FAKE_ADMIN_BODY16 || T_JR_FAKE_ADMIN_BODY17 || T_JR_FAKE_ADMIN_BODY18 || T_JR_FAKE_ADMIN_BODY19 || T_JR_FAKE_ADMIN_BODY20 || T_JR_FAKE_ADMIN_BODY21 || T_JR_FAKE_ADMIN_BODY22 || T_JR_FAKE_ADMIN_BODY23 || T_JR_FAKE_ADMIN_BODY24 || T_JR_FAKE_ADMIN_BODY25 || T_JR_FAKE_ADMIN_BODY26 || T_JR_FAKE_ADMIN_BODY27 || T_JR_FAKE_ADMIN_BODY28 || T_JR_FAKE_ADMIN_BODY29 || T_JR_FAKE_ADMIN_BODY30 || T_JR_FAKE_ADMIN_BODY31 || T_JR_FAKE_ADMIN_BODY32 || T_JR_FAKE_ADMIN_BODY33 || T_JR_FAKE_ADMIN_BODY34 || T_JR_FAKE_ADMIN_BODY35 || T_JR_FAKE_ADMIN_BODY36 || T_JR_FAKE_ADMIN_BODY37 || T_JR_FAKE_ADMIN_BODY38 || T_JR_FAKE_ADMIN_BODY39 || T_JR_FAKE_ADMIN_BODY40 || T_JR_FAKE_ADMIN_BODY41 || T_JR_FAKE_ADMIN_BODY42 || T_JR_FAKE_ADMIN_BODY43 || T_JR_FAKE_ADMIN_BODY44 || T_JR_FAKE_ADMIN_BODY45 || T_JR_FAKE_ADMIN_BODY46 || T_JR_FAKE_ADMIN_BODY47 || T_JR_FAKE_ADMIN_BODY48 || T_JR_FAKE_ADMIN_BODY49 || T_JR_FAKE_ADMIN_BODY50 || T_JR_FAKE_ADMIN_BODY51 || T_JR_FAKE_ADMIN_BODY52 || T_JR_FAKE_ADMIN_BODY53 || T_JR_FAKE_ADMIN_BODY54 || T_JR_FAKE_ADMIN_BODY55 || T_JR_FAKE_ADMIN_BODY56 || T_JR_FAKE_ADMIN_BODY57 || T_JR_FAKE_ADMIN_BODY58 || T_JR_FAKE_ADMIN_BODY59 || T_JR_FAKE_ADMIN_BODY60 || T_JR_FAKE_ADMIN_BODY61 || T_JR_FAKE_ADMIN_BODY62 || T_JR_FAKE_ADMIN_BODY63 || T_JR_FAKE_ADMIN_BODY64 || T_JR_FAKE_ADMIN_BODY65 || T_JR_FAKE_ADMIN_BODY66 || T_JR_FAKE_ADMIN_BODY67 || T_JR_FAKE_ADMIN_BODY68 || T_JR_FAKE_ADMIN_BODY69 || T_JR_FAKE_ADMIN_BODY70 || T_JR_FAKE_ADMIN_BODY71 || T_JR_FAKE_ADMIN_BODY72 || T_JR_FAKE_ADMIN_BODY73 || T_JR_FAKE_ADMIN_BODY74 || T_JR_FAKE_ADMIN_BODY75 || T_JR_FAKE_ADMIN_BODY76 || T_JR_FAKE_ADMIN_BODY77) describe JR_FAKE_ADMIN Fake Admin message signatures detected score JR_FAKE_ADMIN 7 ############### SCRIPTINFO PLUGIN ############## ### Thanks to Kent Oyer of MXGuardian ### ################################################ ifplugin Mail::SpamAssassin::Plugin::ScriptInfo script JR_SCRIPT_JS1 /(?:document\.getElementById\(\"glk\"\)\.|aHR0cHM6Ly9jYXJkaW9hbmdpby5jb20uYnIvd2VkenppL2V6ZXIucGhw|glitch\.me|\(function\(_0x366279\,_0x253f07\)|\{return\s_0x39f9\(_0x21ad09\-\s\-0x204\,_0x19a04b\)\;\}|aHR0cHM6Ly9wbGF0b29udGVjaG5pY2Fscy5vbmxpbmUvb3JkZXIvUE9fRVNMMjAyNDEyLmh0bWw|document\.oncontextmenu\s\=\sfunction\(\)\s\{\sreturn\sfalse\;\s\}|\/\/alert\(\"Username\scannot\sbe\sempty\"\)|function\s_0x254e\(\)\{var\s_0x114165\=\[)/ describe JR_SCRIPT_JS1 SCRIPT: Harmful JavaScript contained in an attachment score JR_SCRIPT_JS1 7 script JS_PHISHING eval:check_script_contains_email() describe JS_PHISHING SCRIPT: JavaScript with Email Address in an attachment score JS_PHISHING 10 script_ignore_md5 10DBD19204B70CF81AB952A0F6CABEA7 endif ############# AARON SMITH/SEXTORTION RULES ############ ## CREATING RULES: JR_EXPLOIT.cf ## body __JR_SEXTORT1 /BTC\saddress\sto\ssend\sto|CaSe\sSeNSiTiVe\sso\scopy\sand\spaste\sit|I\sembed\sa\strojan\son\sthe\sweb\ssite\swith\sporn|I\sburied\sa\strojan\son\sthe\sweb\spage\swith\spornography|I\sinfiltrated\syour\sPC\svia\sporno\swebsite|infiltrated\syour\sPC\sthrough\sporno\ssite|disgrace\/life\sruine|during\syour\sporn\-site\svisit|all\sof\syour\sprivate\sinformation\swill\sbe\sdeleted|I\srespectfully\sinsist\syou\sread\sthis\smessage\scarefully|My\smalware\scaptured\sall\syour\sprivate\sinformation|I\'ll\ssend\sdirt\sto\sall\syour\scontacts|my\sexploit\sdownloaded\smy\smalicious\scode|send\sout\syour\svideo\srecording\sto\sall\sof\syour\scontacts\sincluding\srelatives|You\shave\s48\shour\sin\sorder\sto\smake\sthe\spayment|visit\sthe\spolice\sstation\sbut\sthey\swill\snot\shelp\syou|You\sentered\sa\spassword\son\sone\sof\sthe\ssites\syou\svisited\,\sand\sI\sintercepted\sit|Dieses\sist\seine\sKopie\sder\sfolgenden\sNachricht\,\sdie\san|I\sinfected\syou\swith\sa\smalware\s\(RAT\)|My\sspyware\srecorded|Tambi\xC3\xA9n\sprometo\sdesactivar\sy\seliminar\stodo\sel\ssoftware\smalicioso\sde\ssus\sdispositivos|I\s{1,2}\s{1,2}know\s{1,2}\s{1,2}a\s{1,2}lot\s{1,2}\s{1,2}of\s{1,2}secrets\s{1,2}about\s{1,2}\s{1,2}you\,\s{1,2}therefore\s{1,2}\s{1,2}in\s{1,2}\s{1,2}case\s{1,2}\s{1,2}your\s{1,2}status\s{1,2}\s{1,2}is\s{1,2}valuable/ tflags __JR_SEXTORT1 nosubject multiple maxhits=5 body __JR_SEXTORT2 /advise\sto\sContact\smoney\stransfer\swestern\sUnion\soffice|showing\syour\snasty\ssexual\sactions|Once(I\sget\sthe\smoney|\smoney\sis\s(sent|received\sby\sme))\,\sI\swill\s(delete|destroy)\syour\s(video|recording)|your\sfilthy\ssexual\sdoings\sand\svideo|I\swill\s(email|send)\syour\svideo\sto\syour\s(friends|contacts)\sunless\syou\s(pay|send)\sme|the\sporno\swebsite\syou\swatched|I\swill\ssend\syour\svideo\sto\s[0-9]\sof|email\syour\svideo\sto\syour\sfriends\sunless\syou\spay\sme|put\sa\smalware\son\sthe\sweb\spage\swith\sporn\swhich\syou\shave|I\shave\suploaded\smalicious\selement|began\sworking\sas\srdp\ssupplied\swith\skeylogger\.|placed\sa\smalware\son\sthe\sadult\svideo\sclips|destroy\sthe\svideo\simmidiately|definately\ssend\sout\syour\svideo|Be\swarned\si\sknow\swhen\syou\shave\sopened|I\shave\splaced\sa\sMalware\son\san\sadult\swebsite|forward\sthe\svideo\sto\sall\sthe\scollected\scontacts|you\swere\sinfected\swith\smalware\sthrough\san\sadult\ssite|I\swill\sdelete\sthe\svideo\sand\syou\swill\snever\shear\sme\sagain|I\swill\serase\sthe\scompromising|I\swill\salso\sdelete\sall\sdata\sand\svideos|I\srecorded\sa\svideo\sof\syou\shaving\sfun|and\s+I\s+reecorded\s+you|Unfortunately\,\sthere\sare\ssome\sbad\snews\sfor\syou|Do\snot\stry\sto\sfind\sand\sdestroy\smy\svirus/ tflags __JR_SEXTORT2 nosubject multiple maxhits=5 body __JR_SEXTORT3 /got\svideo\sof\syou\smasturbating|I\shave\sall\sof\syour\sprivate\sdata\,\scontacts\sand\sfriends\slists\.|I\'m\sa\shacker\swho\scracked\syour\semail\sand\sdevice|message\sfor\smaking\sthe\stransaction|I\sAM\sFOR\sREAL\sAND\sNOT\sA\sSCAM\sIF\sYOU\sNEED\sTO\sVERIFY\sME|that\sin\smind\,\syou\sare\sadvice\sto\scomply|deleted\sautomatically\safter\stransfer\sconfirmation|daze\sof\syour\scopulation\sfantasies|intimate\scontent\ssites\sthat\syou\soccasionally\svisit|my\svirus\sand\sdirty\sphotos\swith\syou|screenshot\sof\sthe\sintimate\swebsite\swhere\syou|while\sat\sthe\spornweb\ssite|is\squite\sa\sfair\sprice\sto\sdestroy\sthe\sdirt\sI\screate|I\shacked\syour\soperating\ssystem\sand\sgot\sfull\saccess\sto\syour\saccount|share\sthis\spersonal\srecord\swith\syour\scontacts|my\smalware\supdated\sit\severy\stime|hacker\swho\scracked\syour\sdevices|i\soffer\sin\sdark\sside\sof\sthe\sinterne|and\salso\s(target|object)\sis\s(apparently|evidently)\syou|receiving\sexchanges\sonly\svia\sBtc\saka\sbitcoin|solutions\sthat\si\ssell\sin\sdarknet|send\sthis\svideo\sto\sall\syour\scontacts|I\smade\sscreenshots\sof\sthe\sadult\ssites\syou\senjoy|you\scan\swatch\syourself\sjerking\soff\son\sadult\smovies|I\scan\salso\sshare\saccess\sto\sall\syour\se-mail\scorrespondence\sand\smessengers\sthat\syou\suse/ tflags __JR_SEXTORT3 nosubject multiple maxhits=5 body __JR_SEXTORT4 /You\snow\shave\s[0-9][0-9]\shours\sto\sbalance\stransfer|this\sis\smy\sbtc\stransaction\saddress|this\sis\smy\sbtc\saddress\s\-|i\sgive\sin\sdark\sside\sof\sthe\sinternet|exchanges\ssolely\sthrough\sBtc\saka\sbitcoin|virus\son\sa\swebsite\swith\svideos\sfor\sadults|will\srecieve\svideo|Ill\ssend\sthis\svideo\sto\sthree\scontacts|installed\sthe\smalicious\ssoft\son\sa\swebsite|Trojan\sVirus\sgives\sme\sfull\saccess\sand\scontrol|my\srat\ssoftware\supdate\sit\severy\stime|Do\snot\stry\sto\sfind\sand\sdestroy\smy\svirus|my\svirus\sand\sdirty\sscreenshots|RDP\swith\sa\skey\slogger|my\svirus\sand\sdirty\sscreenshots|little\sbit\sto\ssafe\syour\ssocial\sstatus|Trojan\sVirus\sgives\sme\sfull\saccess\sand\scontrol|Trojan\sVirus\sgives\sme\sfull\saccess\sand\scontrol\sover\sa\scomputer|due\sto\srecent\ssecurity\supdates\son\sour\ssystems\swe\srequire\sall\sour\susers\sto\sactivate\stheir\slogin|your\sprivy\sbackground\sbelongs\sto\sme|device\swas\scontrolled\sby\sthe\svirus|send\syour\smasturbation\svideo|because\smy\scode\sis\snot\sset\sto\ssteal\spasswords|When\scoins\sare\ssubmitted\,\sthe\svideo\swith\syou\sdoing|you\svisited\sa\spornographic\swebsite|I\sfail\sto\sget\sbitcoins\,\sI\'ll\simmediately\ssend\syour|I\shave\sthe\sdata\sof\sall\syour\scontact|I\s(got|gained|had|have)\saccess\sto\sall\syour\saccounts/ tflags __JR_SEXTORT4 nosubject multiple maxhits=5 body __JR_SEXTORT5 /I\sposted\sa\smalicious\scode\s\(exploit\)\sto\san\sadult\ssite|I\simmediately\sdestroy\sthe\svideo\.|Warum\shat\sIhr\sAntivirus\skeine\sMalware\sentdeckt\?|Meine\sBitcoin-Adresse\s\(BTC\sWallet\)\slautet:|people\sthat\semplaced\smy\sprivate\scomputer\sworm|soft\smarks\sthat\sdownloaded\smy\svirus|I\sam\sreceiving\stransactions\ssolely\svia\sBitcoin|people\swhich\swere\sinfected\sby\smy\svirus|a\sscreenshot\sof\syour\sjoys|I\sposted\sa\smalicious\sprogram\son\sadults|RECORDED\sYOU\sSATISFYING\sYOURSELF|I\swill\serase\sthe\scompromising\svideo\srecords|police\sstation\sbut\sno\sone\scan\'t\shelp\syou|I\scan\ssend\sthis\svideo\sto\sall\syour\semails\sand\scontacts\son\ssocial\snetworks|Trojan\sVirus\sgives\sme\sfull\saccess\sand\scontrol\sover\sa\scomputer|if\syou\sdon\`t\spay\sme\s500\sdollars\svalue\sin\sBitColn|videos\srecords\swhere\syou\smasturbating|I\sposted\sEternalBlue\sExploit\smodification\son\sporn\ssite|We\shave\sinstalled\sone\sRAT\ssoftware|record\swith\sthe\scamera\sonly\swhen\syou\swatch\sadult\scontent|you\swere\swatching\swhile\smasturbating|money\sis\ssafely\skept\spending\sthe\sestablishment|on\sthis\semail\sfor\sa\sproper\sexplanation|my\smalware\sand\sdirty\svideo\swill\sself\-destruct|enjoying\s{1,2}interesting\svideo\s{1,2}clips\swhilst\s{1,2}experiencing\sso\smuch\s{1,2}pleasure/ tflags __JR_SEXTORT5 nosubject multiple maxhits=5 body __JR_SEXTORT6 /have\s(record|vid)\swith\syou\scaressing\syour\sbody|got\svid\swith\syou\smasturbating|My\ssquad\swill\snot\sruin\syour\slife\sif\syou\sobey|the\smalicious\ssoft\sturned\son\syour\swebcam|I\sinfected\syou\swith\smy\sprivate\smalware|not\sacquire\stoo\smuch\sof\stime|video\sclip\sof\syou\sbeating\soff|I\sobtained\sa\svideo\sof\syou\sflogging\sthe|that\swall\sclock\sis\s(beating|clacking)|thanks\sto\sa\sgreat\sass\ssoftware\sprogram\sI\shave|an\sincredible\sass\sapplication\sI\shave|I\sacquired\sa\sfootage\sof\syou\s+jackin|thanks\sto\sa\sgood\sass\sprogram|through\sbi\'Tc?in|footage\sof\syou\scommiting\sspermicide|at\sa\spornweb\ssite\syou\sare\svisited|Remote\sDesktop\swith\sa\sk?y\slogger|no\sdoubt\ssend\syour\svideo\srecording|infected\swith\smy\smalware|I\swill\sdelete\sall\syour\sdata\sand\syou\scan|I\scollected\sall\syour\sprivate\sdata\sand\sRECORDED|movie\sof\syou\schokin\'\sthe\schicken|all\sthe\sdigital\scameras\sand\sa\smicrophone\sstart\sworking|pornweb\ssite\syou're\sbeen|i\splac?d\sa\ss?ftware\son\sthe\sadult|infected\swith\smy\sprivate\smalware|gives\sme\saccess\sto\syour\scamera\sand\smicrophone|you\swould\snot\slike\sto\sshow\sthis\svideo\sto\syour|short\svideo\swith\syou\swhen\syou\swere\swatching\sadult\smovies|agree\sto\smy\sterms\sor\sthe\svideos\sare\spublished/ tflags __JR_SEXTORT6 nosubject multiple maxhits=5 body __JR_SEXTORT7 /tootin\xE2\x80\x99\syour\shorn\sto\sporn|on\sanother\syour\sonline\scam\swith\su\son\sit|poisoned\swith\smy\scomputer\svirus|malware\sstarted\sworking\son\syou\ssystem|turned\son\syour\scamera\sand\srecorded\sthe\sact\sof\sur|You\sentered\sa\spasswords\son|hacker\swho\shas\saccess\sto\syour\soperating\ssystem|infected\swith\smalware\sthrough\san\sadult\ssite|video\sshowing\show\syou\ssatisfy\syourself|I\shave\sbuild\sin\smalware\ssoftware|My\swallet\sBTC\sAddress\:|I\sam\san\shacker\swho\scracked\syour\semail\sand\ssystem|EXTORTING\sMONEY\sFROM\sYOU|I\shave\ssome\sfunds\sI\sinherited\sfrom\smy\slate\shusband|REGARD\sTHE\sTRANSFER\sOF\sYOUR\sFUNDS|member\sof\san\sinternational\shacker\sgroup\.|infected\sby\sthe\svirus\swe\'ve\screated|data\swill\sbe\serased\sonce\sthe\smoney\sare\stransferred|videos\srecorded\swill\sbe\sautomatically\ssent\sto\sall\syour\scontacts|recorded\syour\sdoings\son\sporn\swebsite|computer\swas\sinfected\swith\smy\sprivate\sRAT|seeing\syou\sMASTRUBATE|I\sRECORDED\sYOU|spy\son\syou\sover\syour\swebcam|placed\sa\smalware\son\sthe\sporn\swebsite|negligent\sof\syou\sto\skeep\sold\ssoftware|you\sare\s\sa\sbig\s\sfan\sof\s\sporno\swebsites|This\sapplication\sgives\s{1,2}me\sentry\s{1,2}to\sall\s{1,2}your\sgadgets|I\shave\smanaged\sabsolute\saccess\sto\syour\semail\sdetails/ tflags __JR_SEXTORT7 nosubject multiple maxhits=5 body __JR_SEXTORT8 /I\swill\sonly\sbe\sof\shelp\sif\syou\sagreed\sto\sfollow\smy\sinstructions|element\sto\syour\sComputer|obtained\sa\sfootage\sof\syou\swanking\soff|that\sclock\sis\sclacking|create\sthe\svideo\swhere\syou\scum\sin\sone\spart\sof\sthe\sscreen|I\shacked\syour\sOS\sand\sgained\scomplete\scontrol|2019\sAnonymous\sOfficial|U\sstopped\sat\sthe\sonline\sadult\sporn\ssite|I\shacked\sit\sand\splaced\smy\smalicious\scode|my\steam\sinfected\sporn\ssite|I\'m\sknow\syour\ssecret\slife|small\samount\sfor\smy\ssilence|I\ssent\sthis\smessage\sfrom\syour\saccount|adults\scontents\swith\sunderage\steens|I\shave\sfull\scontrol\sof\syour\sdevice|recorded\sa\svideo\sof\syou\smasturbating|Letter\(gift\)\sSupplier_2021\.pdf\.gz|you\s+MASTRUBATE|Hace\sunos\smeses\stuve\sacceso\sa\ssus\sdispositivos\sque\susa\spara\snavegar\spor\sInternet|Creo\sque\srealmente\sno\squieres\seso\,\sdados\slos\sdetalles\sde\slos\svideos\sque\sdisfrutas\sviendo|I\s\sam\sable\s\sto\sruin\syour\s\sdaily\slife\s\sforever|your\s{1,2}dirty\smoments\s{1,2}when\s{1,2}you\s{1,2}jack\soff\s{1,2}and\sachieve\s{1,2}male\s{1,2}orgasms|You\shave\s2\sdays\sto\smake\sthe\stransfer\,\sthat\'s\sreasonable|it\sgave\sme\saccess\sto\sall\syour\sfiles,\saccounts\sand\scontacts|I\swill\sstraight\saway\sproceed\swith\smaking\syour\sprivate\svideos\spublic/ tflags __JR_SEXTORT8 nosubject multiple maxhits=5 body __JR_SEXTORT_V4 /I\xE2\x80\x99ve\sencrypted\sthe\s(files|information)\.\s(Here\sis|Next\syou\scan\sfind)\s(a|your)\s(password|passcode)|I\ssend\sa\scopy\sof\sthat\sconversation\shere|Not\sone\sperson\shas\spaid\sme\sto\scheck\sabout\syou|Some\stime\sago\sI\shave\spurchased\saccess\sto\smail\saccounts|provides\sme\swith\saccess\sto\sall\sthe\scontrollers\sof\syour\sdevices|I\shave\salready\sinstalled\sTrojan\svirus\sto\sOperating\sSystems|uploaded\sa\sTrojan\shorse\son\sthe\sdriver\sbasis|I\sgot\saccess\sto\sthe\sdevice\syou\sare\susing\sto\sbrowse\sthe\sinternet|accessed\s\sthe\s\sgadgets\sthat\s\syou\spreviously\s\sused\sto\s\sget\son\-line|love\sto\s\sgo\sto\s\sporn\sweb\ssites\s\sand\swatch\sfilthy\s\svids|My\s{1,2}trojan\s{1,2}up\-dates\ssignatures\s{1,2}\&\sremains\s{1,2}hidden|I\sgot\saccess\sto\sthe\sdevice\syou\sare\susing|all\syour\scontacts\swill\sreceive\sthe\spictures|full\scontrol\sof\syour\sinternet\saccounts\,\sinformation\sand\ssocial\smedia|DARKWEB\sCR3W|With\shelp\sof\sthe\sTrojan\sVirus\,|I\sHAVE\sRECORDED\sSEVERAL\sKINKY\sSCENES\sOF\sYOU|the\sprice\sis\srelatively\slow\,\sconsidering\sthat\sI\shave\sbeen\schecking\sout\syour\sprofile|Once\sI\sget\sthe\spayment\,\sI\swill\sremove\severything\,\sbe\ssure\,|in\sdisregard\sabout\stheir\sinformation\sbeing\sexposed\sto\sa\shacking\sgroup/m tflags __JR_SEXTORT_V4 nosubject multiple maxhits=5 body __JR_SEXTORT_V4A /to\smy\sBitcoin\swallet\,\sand\sI\swill\sforget\sabout\sthe\sentire\sthing|Additionally\,\sit\sgives\sme\saccess\sto\syour\scamera\sand\smicrophone|the\sletter\salong\swith\smy\sBitcoin\swallet\scannot\sbe\stracked|awesome\sidea\sto\screate\sthe\svideo\swhere\syou\scum\sin\sone\spart|that\sI\scan\seasily\ssend\sthis\svideo\sto\sall\syour\scontacts\swith\sa\sfew\sclicks|can\sfigure\sout\show\sto\spurchase\sBitcoins\susing\ssearch\sengines|video\swill\sbe\simmediately\sshared\,\sand\syour\scontacts\swill\sbe\sthe\sfirst\sto\sreceive\sit|The\sfollowing\s\sis\s\syour\slast\swarning\.|I\smounted\sa\s{1,2}Trojan\sviruses\son\s{1,2}the\ssystems\sin\sall\s{1,2}systems|provided\sme\saccess\sto\syour\sdisplay\sscreen\sand\swebcam|Change\syour\spassword\s.*\simmediately\.\sYour\saccount\shas\sbeen\shacked\.|software\sthat\shas\sbeen\sinfested\sinto\syour\sdevice\sby\strojans|I\scan\ssend\sthis\svideo\sto\sall\syour\scontacts|we\swill\suse\sthis\sinformation\sagains\st\syou|have\sa\svideo\sof\syou\swanking\son\sthe\sleft\sscreen|You\slove\svisiting\sporn\swebsites\sand\swatching\sexciting\svideos|My\svirus\shas\sinfected\syour\sdevice\svia\san\sadult\swebsite|I\scan\saccess\sall\sthe\scontrollers\sof\syour\sdevices|due\sto\sthe\ssecurity\sholes\syou\shad\sin\syour\syour\ssite\/server/m tflags __JR_SEXTORT_V4A nosubject multiple maxhits=5 body __JR_SEXTORT_V4B /made\s\sa\scam\srecording\s\sof\syou\s\swanking\s\soff|Carefully\s\sconsider\s\syour\sforthcoming\s\sfuture\.|via\sBitcoin\s\sequivalent\sat\s\sthe\smoment\s\sof\sfinancial\s\stransaction|happy\sto\sshare\sthese\sinteresting\svideos\swith\syour\saddress\slist|easily\sdirect\s\sthis\sfootage\sto\severyone\swho\s\sknow\s\swho\syou\s\sare|I\sgot\s{1,2}terrible\s{1,2}information\s{1,2}for\syou\.\sEarlier\s{1,2}I\sgot\sconnection\sto\s{1,2}your\spersonal\s{1,2}systems\.|I\sfound\ssome\sillegal\sinfo\sabout\syour\sillegal\sactivity|Unless\s{1,2}you\sforward\s{1,2}funds\,\syour\s{1,2}video\s{1,2}and\sall\s{1,2}your\s{1,2}info\swill\s{1,2}be\sposted|malware\son\sthe\sadult\svids\s\(porno\)\sweb\-site|hacker\swho\scracked\syour\semail\sand\sdevices|pornweb\ssite\syou\'re\swent\sto|I\swill\scancel\sthe\ssex\svideo\swith\syou|You\scan\savoid\sthis\smess\sby\spaying\sa\sfee\sto\sdelete\sthe\sfiles\swe\shave|You\struly\senjoy\schecking\sout\sporn\swebsites|Your\ssystem\shas\sbeen\scracked\.|another\spart\sshows\sa\sporn\svideo\sthat\syou\swere\swatching\sat\sthat\stime|now\syou\sunderstand\swhy\sI\swas\snever\sdetected\suntil\sI\ssent\sthis\sletter|gained\sus\sremote\scontrol\sof\spretty\smuch\severything\sthat\swas\son\sthe\sserver|the\scompromising\smaterial\swill\sbe\spublished/m tflags __JR_SEXTORT_V4B nosubject multiple maxhits=5 body __JR_SEXTORT_V4C /caught\syou\swhile\syou\shave\sbeen\smasturbating|all\syour\scontacts\swill\sget\scrazy\sshots\sfrom\syour\sdark\ssecret\slife|BTC\saddress\:\s|my\sBitcoin\scryptocurrency\swallet:|you\swere\smasturbating\son\sporn\svideos|I\speriodically\stake\sphotos\sand\svideos\swith\syou|you\svisited\sthe\ssites\sthat\sinterest\sme|Using\syour\spassword\,\sour\steam\sgot\saccess\sto\syour\semail|you\srecently\snoticed\sthat\sI\shave\se\-mailed\syou\sfrom\syour\saccount|your\scomputer\swas\sinfected\swith\smy\sprivate\strojan|Well\,\si\shave\smanaged\sto\srecord\sa\snumber\sof\syour\sdirty\sscenes|I\sstole\sall\syour\sdata\sand\sthen\sI\sremoved\smy\strojan|send\syour\sdata\swith\sthe\sproof\sof\syour\sactivities\sto\sthe\spolice|Next\stime\skeep\syour\sdevice\supdated\swith\sthe\snewest\ssecurity\spatches|I\sshall\serase\syour\svideo\sand\sshall\snot\sbother\syou\sanymore|I\scan\ssend\sthe\sdata\sof\syour\sE-mail\sand\syour\smessengers\sto\sanybody|I\sproceeded\sto\sinstall\sa\sTrojan\shorse\svirus\son\sthe\soperating\ssystems\sof\sall\syour\sdevices|bought\sspecial\saccess\sto\sseveral\semail\saccounts\sfrom\shackers|I\shave\sfull\saccess\sto\syour\scomputer\sthanks\sto\smy\sTrojan\svirus|Good\sluck\,\smy\sperverted\sfriend|think\swe\sare\sso\sstupid\sto\sbe\stracked\sby\san\semail\saddress/m tflags __JR_SEXTORT_V4C nosubject multiple maxhits=5 body __JR_SEXTORT_V4D /I\'ve\suploaded\sa\sTrojan\shorse|my\ssoftware\sgathered\sall\syour\scontacts|if\syou\sdon\'t\spay\,\sI\'ll\ssend\sdirt\sto\sall\syour\scontacts|use\syour\semail\sand\sphone\snumber\sto\ssend\sthe\smost\sprivate\sand\sdamaging\scontent\sto\syour\scontacts|malware\soriginating\sfrom\san\sadult\swebsite\sthat\syou\svisited|trojan\sallows\sme\sto\saccess\sall\scontrollers\sof\syour\scomputer|I\swill\sdelete\sall\sthis\sdirty\sstuff\sright\saway|enjoy\schecking\sout\sporn\swebsites\sand\swatching\sdirty\svideos|I\sKNOW\sEXACTLY\sABOUT\sYOUR\sILLEGAL\sACTIVITIES|device\sgot\sinfected\swith\smy\sprivate\strojan|Trojan\svirus\sgrants\sme\sentire\saccess\sand\scontrol\sover\syour\sdevice|made\sa\svideo\swhere\sone\spart\sof\sa\sscreen\sdemonstrates\syou\smasturbating|the\swhole\sdata\shas\salready\sbeen\sdownloaded\sto\scluster\sof\smy\sservers|I\spromise\sto\sdelete\sall\sthose\svideos\sand\sdisappear\sfrom\syour\slife|Ti\ssto\sosservando\sda\squalche\smese\sormai\.|I\swill\spermanently\sdelete\sall\svideos\scompromising\syou|No\sone\sknows\swhere\syour\sperversion\smight\slead\sin\sthe\sfuture|my\sAll\-seeing\seye\sis\swatching\sall\syour\sactions|masturbating\sto\sextremely\scontroversial\svideos|I\shave\ssucceeded\sto\sgain\sa\stotal\saccess\sto\sall\syour\sdevices/m tflags __JR_SEXTORT_V4D nosubject multiple maxhits=5 body __JR_SEXTORT_V4E /I\sproceeded\sto\smonitor\sall\syour\sactivities\son\sthe\sInternet|I\sproceeded\sto\smonitor\sall\syour\sactivities\son\sthe\sInternet|the\svideo\swill\sbe\simmediately\sshared\sand\syour\scontacts\swill\sbe\sthe\sfirst\sto\sreceive\sit|recording\ssome\sof\syour\snaughty\ssolo\ssessions\sand\scompiling\sthem\sinto\sseveral\svideos|You\sreally\senjoy\sbrowsing\sporn\swebsites|I\sam\susing\sharmful\ssoftware\sthat\sis\sdriver\-based|I\sknow\sall\syour\ssecrets\,\sthat\sis\syour\sbusiness\sand\slife|I\scan\salso\smake\spublic\sall\syour\semails\sand\schat\shistory|video\sclip\sof\syou\splaying\swith\syourself|notified\sof\spayment\swhich\swe\swill\sthen\sdelete\sthe\sinformation\swe\shave\sobtained|Ho\sanche\spieno\saccesso\sal\stuo\saccount\.|Transfer\s\$[0-9]{3}\sUS\sDollar\sto\smy\sbitcoin\swallet|I\'ve\slearned\sabout\sall\saspects\sof\syour\sprivate\slife|sent\sit\sfrom\sa\stemp\semail\sso\sI\sam\suntraceable|we\srecorded\syou\smasturbating|you\smust\stransfer\s\$[0-9]{4}\sin\sBitcoin\sto\sthis\sBTC|My\sunique\svirus\sis\sincessantly\srefreshing\sits\ssignatures|Because\sof\sthis\sTrojan\sI\sam\sable\sto\sgain\saccess|I\shave\sstarted\sobserving\syour\sinternet\sactivities|I\smoved\son\swith\sinstalling\sa\sTrojan\svirus|I\shacked\syour\sdevice\'s\sOS/m tflags __JR_SEXTORT_V4E nosubject multiple maxhits=5 body __JR_SEXTORT_V4F /WHILE\sPASSIONATELY\sMASTURBATING|illegal\sinfo\sabout\syour\sillegal\sactivity|study\sthis\sspicy\sinfo|this\stype\s\sof\scontent\s\swould\s\sbe\sgood\sfor\s\syour\s\spersonal\sprofile|not\sonly\swill\swe\sbe\smonetizing\soff\sit\swith\sour\smethods\sbut\smade\spublic|Sono\sun\shacker\se\ssono\sriuscito\sad\saccedere\sal\stuo\ssistema\soperativo\.|Please\scheck\sthe\sscreenshot\si\shave\sattached\sand\stell\sme|Il\strojan\smi\sd\xC3\xA0\spieno\saccesso\se\scontrollo\ssul\smio\scomputer\so\s\x0D\x0Aaltro\sdispositivo|posso\sinviare\squesto\svideo\sa\stutti\si\stuoi\scontatti\se-mail\se\ssui\ssocial\smedia|recorded\smany\svideos\sof\syou\sjerking\soff|Every\snumber\sin\syour\scontact\sbook\swill\ssuddenly\sreceive\sthese\svideos|I\shave\saccess\sto\sall\syour\sdevices|Remote\scontrol\sDesktop\swith\s?\skeylogger|from\sthat\smoment\syou\shave\sexactly\s2\sdays\sto\ssend\sthe\smoney|pornography\son\sthe\sinternet\sthat\smost\snormal\speople\swould\sconsider\sperverted|then\sgained\saccess\sto\sall\sof\syour\sdevices|I\sam\sable\sto\sgain\saccess\sto\sentire\sset\sof\scontrollers\sin\sdevices|you\swere\skind\senough\sto\sclick\ssome\sof\sthe\slinks|I\sbought\san\sexclusive\saccess\sfrom\shackers|regular\suser\sof\swebsites\shosting\snasty\sadult\scontent|Hi\,\smy\sprey/m tflags __JR_SEXTORT_V4F nosubject multiple maxhits=5 body __JR_SEXTORT_V4G /mouse\sclicks\sto\smake\sall\sthose\svideos\swith\severyone\syou\sknow|lustful\sthings\sdemonstrated\sin\syour\scommonly\swatched\svideos|I\sam\sable\sto\supload\sall\sthat\svideo\scontent\sonline\sfor\severyone\sto\ssee|record\scertain\snasty\ssolo\saction\swith\syou|produced\sa\sfew\svideos\sexposing\syour\smasturbation\sand\scumming\sscenes|I\scan\sconfirm\sthat\sall\sthe\sTrojan\ssoftware\sis\sgoing\sto\sbe\sdisabled|I\scontrol\sall\syour\ssystems\sand\scontinuously\smonitor\sthem|your\snasty\sclip\swill\sbe\sshared\swith\spublic|my\sTrojan\svirus\scontrols\sall\sprocesses\sremotely|There\'s\sno\spoint\sin\scalling\spolice\sor\sany\sother\stypes\sof\ssecurity\sservices|All\syou\shave\sis\s48\shours\sand\sthe\scountdown\sbegins\sonce\sthis\semail\sis\sopened|Your\sEmail\sVerification\sLink|[Mm]y\svirus\sconstantly\supdates\ssignatures|really\slike\sto\svisit\sporn\ssites\sand\swatch\sdirty\svideos|you\sare\sa\sbig\sfan\sof\sadult\swebsites|I\scan\ssend\sthis\svideo\sto\severyone\swho\sknows\syou|give\syou\s[0-9]\sworking\sdays\sto\stransfer\sthe\smoney|do\snot\sknow\sanything\sabout\sme\showever\sI\sknow\sALOT\sabout\syou|scrolling\sthrough\sthose\sfilthy\svideos|I\sgive\su\s1\sday\safter\sopening\sthis\smessage|my\svirus\scollected\sall\syour\scontacts\sfrom\smessengers/m tflags __JR_SEXTORT_V4G nosubject multiple maxhits=5 body __JR_SEXTORT_V4H /Good\sluck\sand\sdo\snot\sdo\sanything\sstupid.\sThink\sabout\syour\sfuture|Do\snot\stry\sto\scontact\sthe\spolice\s.{2,35}\sotherwise\syour\sdata\swill\sbe\spublished|I\shacked\syour\soperating\ssystem|I\swill\simmediately\sremove\sall\sthis\sdirt\sfrom\smy\sservers|Do\snot\stry\sto\scomplain\sanywhere\,?\sas\sthere\sis\sno\sway\sto\strack\sthe\swallet|Now\sI\shave\sall\syour\scontacts\,\ssee\sdata\sand\sall\slogs\sfrom\schats|I\srecorded\syour\smasturbation\sand\sthe\svideo|when\syou\swere\svisiting\san\sadult\swebsite|My\sTrojan\smalware\sallows\sme\sto\saccess|can\sruin\syour\slife\sby\ssending\sthis\smaterial\sto\severyone\syou\sknow|If\syou\sdo\snot\sknow\show\sto\sbuy\sBitcoins\,\suse\sGoogle\,\sthere\sare\smany\sguides|It\sdoes\snot\sdetect\sAV\sbecause\sit\sis\sencrypted\sand\scannot\sbe\sdetected|[Bb]een\skeeping\stabs\son\syour\spathetic\sexistence|[Ee]xtracted\squite\sa\sbit\sof\sjuicy\sinfo\sfrom\syour\ssystem|footage\sof\syou\sdoing\sembarrassing\sthings\sin\syour\sroom|your\shard\sluck\sthat\sI\sfound\syour\sbad\sdeeds|all\syour\slife\su\swas\snotified\sto\ssurf\sweb\scatiously|I\sadjusted\sthe\smalicious\ssoft\son\sa\sweb\-site\swith\svideos\sfor\sadults|I\swill\sdestroy\sthe\svideo\simmediately|tracing\sme\sthrough\sthe\sBitcoin\saddress\sis\simpossible/m tflags __JR_SEXTORT_V4H nosubject multiple maxhits=5 body __JR_SEXTORT_V4I /access\sto\syour\sOS\sand\sgained\scomplete\scontrol|I\'m\stalk\syou\sabout\ssites\sfor\sadults|Your\sfantasy\sis\sshifted\sfar\saway\sform\sthe\snormal|know\sthat\syou\swould\snot\slike\sto\sshow\sthese\sscreenshots\sto\syour\sfriends|\$[0-9]{3,4}\sis\sa\s(very,\s)?very\ssmall\samount\sfor\smy\ssilence|spying\son\syou\sfor\sso\slong\,?\shaving\sspent\sa\slot\sof\stime|Trojan\sVirus\sto\sOperating\sSystems\sof\sall\sthe\sdevices|someone\sfrom\syour\scircle\sof\scolleagues\saccepted\sa\svirus\sapp|suffer\sthe\sconsequences\sthat\scan\slead\sto\ssignificant\sfinancial\slosses|you\smust\stransfer\sa\spayment\sto\sthis\sbtc|established\sa\sconnection\s(to\svia|to|via)\sthe\sopened\s3389\sport|[Mm]y\svirus\scontinuously\srefreshes\sthe\ssignatures|I\sput\sa\strojan\son\sthe\sweb\spage\swith\spornography|the\strojan\ssaved\syour\scontact\slist|I\swill\sremove\sthe\scompromising\svideo\sand\sdata\sif\syou\spay\sme|malware\sgrabbed\sall\syour\spersonal\sdata|I\sknow\sabout\syour\ssecret\sand\sI\shave\sevidence\sof\sit|definitely\ssend\syour\svideo\srecording\sto\syour\sentire\scontacts|make\sall\sthis\sdisappear\scompletely\sand\spay\sme\smy\sconfidentiality\sfee|will\snot\sstop\sthe\sevidence\sfrom\sdestroying\syour\sdaily\slife|under\ssurveillance\sfor\san\sextended\speriod\sof\stime/m tflags __JR_SEXTORT_V4I nosubject multiple maxhits=5 body __JR_SEXTORT_V4J /your\smisfortune\sthat\sI\sstumbled\sacross\syour\smisdemeanor|I\sactually\ssetup\sa\smalware\son\sthe\sadult\svideos|your\sbrowser\sinitiated\sfunctioning\sas\sa\sRdp|when\srelatives\sand\sbuddies\slearn\syour\sdirty\svideo|I\shave\staken\ssteps\sin\sorder\sthat\sthis\se\-mail\scan\'t\sbe\slinked|You\scontinue\son\swith\syour\sdaily\slife\slike\snothing\slike\sthis\sever\soccurred|malware\sgrabbed\sall\syour\spersonal\sdata\sand\sswitched\son\syour\swebcam|which\scaptured\sthe\sprocess\sof\syour\smasturbation|I\smost\scertainly\swill\swithout\sdelay\sremove\syour\svideo|I\sactually\splaced\sa\smalware\son\sthe\sadult\svids|I\swill\ssend\sout\syour\svideo\srecording\sto\syour\s[0-9]{1,2}\sfriends|and\s2nd\spart\sdisplays\sthe\srecording\sof\syour\scam|but\sdestroy\syour\slife\swithout\sa\sword\sin\sa\ssecond|so\sit\xE2\x80\x99s\simpossible\sto\sidentify\sme\susing\sthe\sprovided\saddress|still\sso\sangry\sso\sdo\sNOT\stry\sme|[Yy]ou\shave\s[0-9]{2}\shours\sto\sdo\sthe\stransfer\safter\sopening\sthat\semail|thanks\sto\syour\spredilection\sfor\sporn\ssites|I\scan\ssee\severything\sthat\shappens\son\syour\sscreen\sand\sin\sfront\sof\syour\sscreen|I\salso\shave\sthe\scontact\saddresses\syou\suse\smost\soften|you\sdownloaded\sa\snasty\ssoftware\sI\screated|THIS\sIS\sMY\sLAST\sWARNING\!/m tflags __JR_SEXTORT_V4J nosubject multiple maxhits=5 body __JR_SEXTORT_V5A /you\smasturbating\sto\sthis\shardcore\sstuff|want\sme\sto\suninstall\sthe\snasty\ssoftware\sfrom\syour\sdevice|I\sthink\s[0-9]\,[0-9]{3}\sUSD\sis\sa\sfair\sprice\sfor\smy\ssilence|You\sare\sreally\sscrewed\snow\sand\syou\sbetter\sread\sthis|This\sis\svery\simportant\!\s\s?\(zip\-archive\sattached\)|sent\syou\san\semail\sfrom\sYOUR\shacked\saccount|\$[0-9]{3,4}\s\(USD\)\sis\sa\sfair\sprice\sfor\sour\slittle\ssecret|I\swill\salso\sgo\sahead\sand\sreveal\syour\ssecrets|I\shave\sa\sunique\spixel\swithin\sthis\smessage|is\scheating\son\syour?\.\sHere\sa\sproof|put\smy\smalicious\scode\son\sit|you\swould\snot\slike\sto\sshow\sthese\ssceenshots\sto\syour\sfriends|[Yy]ou\sentered\sa\spasswords\son\sthe\swebsites|Hello\spervert\,\sI\xE2\x80\x99ve\ssent\sthis\smessage|I\xE2\x80\x99ve\ssent\sthis\smessage\sfrom\syour\siCloud\smail|Every\snumber\sin\syour\scontact\slist\swill\ssuddenly\sreceive\sthese|I\sinstalled\sit\son\sall\syour\sdevices\sbecause\syou\swere\snot\squite\schoosy\sabout\swhat\slinks\sto\sclick|Don\xE2\x80\x99t\sthink\sof\syourself\sas\san\sinnocent\svictim|from\sthat\smoment\syou\shave\sexactly\s[0-9]{2}\shours\sto\ssend\sthe\smoney|Don\xE2\x80\x99t\stry\sto\sreset\sor\sdestroy\syour\sdevices|send\sthis\svideo\sto\sall\syour\scontacts\sif\sI\sdon\'?t\sget\spaid/m tflags __JR_SEXTORT_V5A nosubject multiple maxhits=5 body __JR_SEXTORT_V5B /your\sshitty\svideo\swill\sinstantly\sstart\sgetting\ssent\sto\syour\scontacts|scrolling\sthose\sadult\svideos\sand\sventuring\sinto\sthe\sdarker\scorners|Extracted\squite\sa\sbit\sof\sjuicy\sinfo\sfrom\syour\ssystem|You\sdo\snot\sknow\sanything\sabout\sme\sbut\sI\sknow\sEVERYTHING\sabout\syou|talking\sabout\ssomething\sserious\shere,\sand\sI\sain\'t\splaying\sgames|got\sfootage\sof\syou\sdoing\sfilthy\sthings\sin\syour\shouse|I\splaced\sa\sspyware\scalled\s\"Pegasus\"\son\sa\sapp|and\sI\shave\sgot\saccess\sto\sall\syour\semails\,\scontacts|I\shave\saccess\sto\sall\syour\saccounts,\ssocial\snetworks|most\sstruck\sby\sthe\sintimate\scontent\ssites|Send\sthe\sabove\samount\son\smy\sbitcoin\swallet|quite\sa\sfair\sprice\sto\sdestroy\sthe\sdirt\sI\screated|took\sscreenshots?\sthrough\sthe\scamera\sof\syour\sdevice|we\shave\srecord\swith\syou\scaressing\syour\sbody|if\syou\swant\sto\savoid\sthe\sshame\syou\smust\spay\sus\s[0-9]{3,4}|pay\sthis\slittle\ssum\snot\sto\slose\syour\shabitual\slife|[0-9]{4}\svictims\sthat\swere\sinfected\sby\smy\svirus|Your\slittle\ssecret\sWill\sremain\syour\ssecret|the\slast\stime\syou\svisited\sthe\sporno\swebpages|my\sspyware\swas\striggered\sinside\syour\scomputer|I\smade\sa\sscreenshot\sof\syour\sjoys|the\swallet\sis\suntraceable/m tflags __JR_SEXTORT_V5B nosubject multiple maxhits=5 body __JR_SEXTORT_V5C /I\scan\sprovide\syou\smy\sprivate\sshots\sand\seven\svideo|Hemos\sinstalado\sun\ssoftware\sRAT|frontal\stoma\svideos\scada\svez\squq\ste\smasturbas|([Ii]\shave|[Ii]\'ve|[Ii]\sput)\san?\s(special|specific|unique)\spixel|(You\swill|You\'ll)\smake\sthe\spayment\s(via|by|with|using)\sBitcoin|then\sI\s(created|made)\sa\sdouble\svideo|installed\sa\smalware\son\sthe\sadult\svids|([Ff]irst|1st)\s(solution|alternative|choice)\sis\sto\s(disregard|dismiss|ignore|neglect)\sthis\s(email|message|e\-mail)|([Ll]atter|[Nn]ext|[Nn]umber\s(two|2))\s(choice|alternative|solution)\s(would|should)\sbe\sto\sgive\sme\s\$[0-9]{2,4}|going\sto\sthe\s(law\senforcement(\sofficials)?|police)|this\s(email|e\smail|e\-mail|message)\scannot\sbe\s(traced|tracked)|the\s(awkwardness|disgrace)\syou\s(will|would)\s(((definitely\s|certainly|most\scertainly)?get)|feel)|(describe\sit\sas|[Ll]et\sus\scall\sit|(regard|think)\sof\sit\sas)\sa\sdonation|if\sI\s(do\snot|don\'t)\s(receive|get)\sthe\sBitCoins|I\swill\serase\sthe\scompromising\svideo\srecords|your\santivirus\scannot\sdetect\smy\smalicious\ssoftware|scenes\sof\syou\shappily\smasturbating|\/?on\sthe\sscreen\/?\swhile\ssatisfying\syourself|record\sa\snumber\sof\syour\sdirty\sscenes|purchased\saccess\sto\semail\saccounts\sfrom\shackers/m tflags __JR_SEXTORT_V5C nosubject multiple maxhits=5 body __JR_SEXTORT_V5D /your\sfull\sAMadision\sprofile\sand\sproof\sof\sit|Pay\sONLY\sin\sBitcoins|my\svirus\sand\sdirty\sscreenshots|hacked\sthis\srouter\sand\splaced\smy\smaliciious\scode|put\stogether\sa\svideo\sat\syour\sMasturbation|u\smasturbate\sto\ssex\swith\skids|immediately\ssend\sdirt\son\syour\scontacts|recorded\sa\svideo\sat\su\smasturbating|understand\sthat\su\'re\sjust\sstalling|[Mm]asturbation\sand\sadded\svideos\s(with|of)\schild\sporn|direct\syour\svideofile\sto\seach\sof\syour\scontacts|turn\sa\sdeaf\sear\smy\smail|relatives\sand\sbuddies\suncover\syour\sdirty\svideotape|no\sone\shas\spaid\sme\sto\scheck\sabout\syou|can\salso\smake\spublic\sall\syour\semails\sand\schat\shistory|[Kk]indly\sensure\syou\scomplete\sthe\sabovementioned\stransfer\swithin\s[0-9]{2}\shours|what\syou\sneed\sto\sdo\s\-\stransfer\sthe\sequivalent\sof\s[0-9]{3,4}|I\sam\svery\scareful,\scalculative\sand\snever\smake\smistakes|allow\sthose\svids\sfor\saccess\sof\spublic\sas\swell|taste\sfor\snontraditional\sand\sdisputed\sadult\scontent|introduced\sdiscreet\sspyware\son\syour\scomputer|providing\sus\saccess\sto\severy\syour\sdevices|one\sof\sthose\sapparently\sbenign\spop-ups\son\sprivate\ssites|invaded\syour\sphone\sand\sPC\scameras|I\swill\sdelete\sall\scompromising\svideos|recorded\sfootage\sof\syou\sinvolved\sin\sacts/m tflags __JR_SEXTORT_V5D nosubject multiple maxhits=5 body __JR_SEXTORT_V5E /no\soption\snonetheless\sto\sreveal\sthe\sdamaging\sclips|Imagine\sthe\sirreversible\sharm\sto\syour\sreputation|a\sstain\sthat\scan\sin\sno\sway\sbe\sfully\sobliterated|competently\straversed\sthe\sdepths\sof\sthe\sonline\sworld\sbefore|friends\sand\scolleagues\swere\sto\sfind\sout\sthe\sdeviant\sthings\syou\sengage\sin|long\-term\sinfluence\sthis\scould\shave\son\syour\sworld\sand\sthe\srelationships|[Yy]our\sreply\sin\sthe\snext\s48\shours\swill\sdetermine\sthe\sresult\sof\sthis\saffair|participate\sin\sregular\sor\seven\smore\sintense\sadult\scontent|simply\sconcentrated\son\sa\specuniary\sresolution|inaction\swill\snot\sonly\sstain\syour\sreputation|provides\saccess\sto\syour\swebcam\,\smessengers|recordings\sof\syou\sself\-pleasuring|self\-pleasuring\sto\sextremely\squestionable\serotic\sclips|permanently\sdelete\severy\srecordings\sjeopardizing\syou|you\shave\sexactly\s[0-9]{2}\shours\sto\stransfer\sthe\smoney|hope\syou\swill\smake\sthe\sright\sdecision\sand\sthis\sis\sthe\sfinal\stime\swe\scommunicate|either\saccept\sto\sthese\sconditions\sor\sthe\sclips\sare\sexposed|delete\sPegasus\sfrom\sall\sof\syour\sdevices|where\syour\sdeviance\smay\slead\sin\sthe\sfuture|[Ee]very\scontact\sin\syour\scontact\sbook\swill\ssuddenly\sobtain\sthese\sclips|I\sjust\shacked\sthis\srouter/m tflags __JR_SEXTORT_V5E nosubject multiple maxhits=5 body __JR_SEXTORT_V5F /Have\syou\s(heard|learned|read)\sabout\sPegasus|[Ee]xtracted\squite\sa\sbit\sof\sinfo\sfrom\syour\ssystem|footage\sof\syou\sdoing\sembarrassing\sthings\sin\syhour\shouse|\(nice\ssetup\,\sby\sthe\sway\)|got\saccess\sto\sall\syour\saccounts\sand\swe\sstole\sall\syour\sdata|You\sgot\s[0-9]\sdays\stime\sto\stransfer\s\$[0-9]{4}\sin\sbitcoin\sto\sthe\saddress|inform\syou\sabout\sthe\ssecurity\shole\sand\swe\swill\sremove\sall\sthe\sstolen\sdata|we\swill\sleak\sall\syour\sdata\sand\sall\syour\saccounts|As\syou\scan\ssee\,\sthe\semail\swas\ssent\sfrom\syour\semail\saccount|sent\sfrom\syour\semail\saccount\,?\sthat\smeans\sthat\syour\saccount\swas\shacked|Lets\sget\sstraight\sto\sthe\spurpose\.|I\shave\sa\sspecific\spixel\swithin\sthis\se\-?mail|[Ss]econd\swise\soption\sis\sto\spay\sme|[Ll]ets\sdiscuss\swhat\swill\shappen\sif\syou\sselect\sthis\schoice|transfer\sthe\samount\sand\sI\swill\sonly\saccept\sBitcoins|[Bb]een\skeeping\stabs\son\syour\spathetic\sexistence|your\sgarbage\swill\sinstantly\sstart\sgetting\ssent\sto\syour\scontacts|something\sserious(\shere)?\,?\sand\sI\sain\'t\splaying\sgames|I\'ll\sbegin\sby\ssaying\sthat\sI\shacked\sthis\s(device|account|e\-?mail|one\spart\sof\sthe\sscreen\sand\smasturbating\sin\sthe\sother|device\swas\sinfected\swith\sour\svirus)/m tflags __JR_SEXTORT_V5F nosubject multiple maxhits=5 body __JR_SEXTORT_V5G /As\syou\scan\ssee\,?\sthe\semail\swas\ssent\sfrom\syour\semail\saccount|you\sdo\ssomething\sstupid\,\sI\swill\sdistribute\sthe\svideo|uploaded\sa\sTrojan\shorse\son\sa\sdriver\sbasis|if\su\swant\sme\sto\sdestroy\sur\sdisgrace|I\sknow\sthat\svisiting\s.{4,40}\swould\sbe\sa\smore\seffective\sway\sto\scontact\sif\syou\sdon\'t\stake\saction|you\swere\snot\squite\sselective\sabout\swhat\shyperlinks\sto\sclick|I\swould\slike\sto\senlighten\syou\sabout\sa\svery\sbad\ssituation\sfor\syou|transfer\s\$[0-9]{3,4}\sin\sbitcoin\sto\sthe\saddress\:|footage\sof\syou\salong\swith\sthe\sexplicit\scontent|only\s[0-9]{2}\stime\speriods\sto\sfinalize\sthe\spayment|instantly\serase\severy\sdamaging\sinformation|talk\syou\sabout\ssites\sfor\sadults|videotape\swith\syour\smasturbation|If\syou\swant\sto\sdelete\sthe\srecords\s?\-\spay\sme\s[0-9]{3,4}\seuro|proceed\swith\smaking\syour\sprivate\svideos\spublic|video\sof\syou\sflogging\sthe\sdolphin|you\smust\ssend\sme\sthe\sLitecoin\s\(LTC\)\spayment|I\scollected\sall\syour\sprivate\sdata\sand\sI\sRECORDED\sYOU|Ich\sbin\sein\sprofessioneller\sHacCker\sund\shabe\serfolgreich\sIhr\sBetriebssystem\sgehackt|Derzeit\shabe\sich\svollen\sZugriff\sauf\sIhr\sKonto|dieses\sVideo\san\salle\sE-Mail-Adressen\sund\sMessenger-Kontakte|embedded\smalware\sinto\san\sadult\ssite/m tflags __JR_SEXTORT_V5G nosubject multiple maxhits=5 body __JR_SEXTORT_V5H /[Yy]our\ssystem\shas\sbeen\shacked\swith\sa\sTrojan\svirus|I\spossess\scomplete\scontrol\sover\syour\sdevice|movie\sthat\syou\swere\swatching\sat\sthat\stime\sand\smasturbating|I\scan\ssend\sthis\svideo\sfrom\syour\sE-mail\sor\sthe\smessenger|[Aa]fter\sthe\spayment\sI\swill\sremove\sthe\svideo\sand\sthe\svirus|My\swallet\sand\san\sE\-mail\scannot\sbe\stracked|the\svideo\swill\sbecome\spublicly\savailable\sat\sonce|will\sdestroy\syour\sreputation\sforever\sand\sall\syour\sdata\swill\sgo\spublic|Just\stransfer\s[0-9]{4}\sUSD\s\(US\sdollars\)\sto\sBitcoin\swallet:|\(BTC\sWallet\)\:|have\san\soverall\saccess\sto\syour\slist\sof\scontacts\sand\sthe\ssocial\smedia\sprofiles|learn\sabout\syour\spassion\sfor\sthe\sporn\ssites|through\sadult\sportals\swhich\syou\ssometimes\svisit|Vielleicht\sfragen\sSie\ssich\,\swarum\sIhr\sAntivirusprogramm\smeine\sSchadsoftware\snicht\serkennen\skann|Ihre\sprivaten\sVideos\s\xC3\xB6ffentlich\szu\smachen|recei\xCE\xBDe\sthe\spayment\,\sI\xE2\x80\x99ll\serase\severything|Don\xE2\x80\x99t\splay\sthe\svictim|no\sreason\sto\srelax\sat\sall\sbut\syou\s\xD4\x81on\xE2\x80\x99t\sneed\sto\spanic|I\shave\sbeen\smonitoring\syour\sinternet|corner\sof\syour\sweb\sactivity\sexamined|Do\snot\stry\sto\scomplain\sanywhere|makes\sa\srdp\ssupplied\swith\skeylogger/m tflags __JR_SEXTORT_V5H nosubject multiple maxhits=5 body __JR_SEXTORT_V5I /I\xE2\x80\x99ll\serase\severything\.\sNo\sleaks\.\sNo\straces|your\scamera\sand\smicrophone|granting\sme\sunrestricted\saccess|extensi\xCE\xBDe\sstash|sensiti\xCE\xBDe\sdata\sextracted|pretty\scontroversial\smoments|have\sfront\-row\sseats\sto\sa\sspectacle|clicking\sunsafe\slinks\sand\svisiting|embedded\smalware\sinto\san\sadult\ssite|Now\,\shere\xE2\x80\x99s\sthe\sdeal|Do\snot\sattempt\sto\scontact\sthe\spolice|Pay\sme\sto\skeep\sthis\smatter\sburied|do\snot\sknow\show\sto\stransfer\smoney\sand\swhat\sBitcoin\sis|Your\slife\scan\sbe\sruined|see\swhy\sI\swent\sundetected\suntil\sthis\sletter|recorded\sseveral\svideos\sof\syou\sjerking\soff|public\saccess\sto\sthe\sInternet\sif\syou\sdo\snot\sgo\sto\smy\sconditions|have\saccess\sto\sall\sof\syour\spersonal\sdata|virus\sis\sconstantly\supdating\sits\ssignature|I\scould\sruin\syour\slife\sforever|jerking\soff\sto\shighly\scontroversial\sadult\svideos|[Aa]ll\sdata\sfrom\syour\sdevices\shas\sbeen\scopied\sto\smy\sservers|I\shave\saccess\sto\sall\syour\smessengers|put\sin\spublic\saccess\sto\sthe\sInternet\sif\syou\sdo\snot\sgo\sto\smy\sconditions|able\sto\shack\syour\sdevice\'s\soperating\ssystem|I\scan\ssee\syour\sentire\scontact\slist\snot\sonly\sfrom\syour\sphone|gives\sme\sfull\saccess\sand\scontrol\sover\syour\sdata/m tflags __JR_SEXTORT_V5I nosubject multiple maxhits=5 body __JR_SEXTORT_V5J /I\swas\sable\sto\sinfect\syour\sdevice\swith\sa\svirus|made\sa\svideo\sof\syou\sjerking\soff|the\spornographic\ssites\syou\speriodically\svisit|I\scan\ssend\sthat\svideo\sto\syour\sentire\slist\sof\sphone|data\sfrom\syour\semail\sas\swell\sas\syour\smessengers|I\'ll\simmediately\sdestroy\syour\svideo|no\sway\sto\strace\sthis\stext\sor\smy\sbitcoin\saddress|your\spersonal\svideo\swill\sbe\simmediately\ssent|I\sinfected\syour\sdevice\swith\sa\sTrojan\svirus|that\syou\smay\sdeem|Approximately\sone\-two\smonths\sago|I\swent\sahead\sto\sput|[Cc]onsequently\,?\sI\ssmoothly\sdownloaded|I\shave\sthe\smeans\sto|shock\sabout\sthe|to\sunwanted\seffects|I\swill\simmediately\srelease\sthe\svideos|videos\sof\syou\sengaging\sin\shighly\sexplicit\sactivities|will\sdistribute\sthese\svideos\sto\severyone\sin\syour\scontacts?|I\shave\sinstalled\ssophisticated\sspyware|already\shave\scompromising\sinformation\s(of|with|about|on)\syou|exposure\swill\shave\ssevere\sconsequences\sfor\syour\spersonal\sand\sprofessional\slife|[0-9]{2}\shours\sfrom\sthe\smoment\syou\sopen\sthis\semail\sto\smake\sthe\spayment|I\'?ll\ssend\svideo\swith\syou\sto\sall\syour\scontacts|started\smonitoring\syour\sonline\sactivities|bought\saccess\sto\shacked\se\-mail\saccounts|installed\sa\sTrojan\svirus\son\sall\syour\sdevices/m tflags __JR_SEXTORT_V5J nosubject multiple maxhits=5 body __JR_SEXTORT_V5K /giving\sme\saccess\sto\syour\smicrophone|visit\sadult\swebsites\sand\swatch\sexplicit\svideos|My\s(virus|malware)\supdates\sitself|created\svideos\sof\syou\spleasuring\syourself|I\scan\sshare\sthese\svideos\swith\syour\sfriends|receive\sthe\smoney\,?\s(We|I)\swill\sremove\sthe\smalware\sfrom\syour\sdevices|the\svideos\sare\sstored\son\sremote\sservers|will\snot\sshare\syour\svideos\safter\s(i|we)\sreceive\sthe\smoney|will\srelease\sthe\svideos\simmediately|I\ssent\sit\sfrom\sa\shacked\sserver|I\swill\sdelete\severything\sright\saway|dollars\sto\smy\sLTC\s\(Litecoin\)\swallet|[Dd]o\snot\scontact\sthe\spolice\sor\sanyone\selse|Keep\schanging\syour\spasswords\sfrequently|browsing\sunsecured\swebsites|Crypto\s\xCE\x91\xD0\xA2\xCE\x9C|I[0-9]want[0-9]to|inform[0-9]you|You[0-9]can|be[0-9]sure[0-9]\-|I[0-9]strongly[0-9]warn[0-9]|have[0-9]sick[0-9]perversion|controversial[0-9]porn[0-9]videos|you[0-9]jerking[0-9]off|my[0-9]perverted[0-9]friend|Given[0-9]that[0-9]the|your[0-9]webcam\,[0-9]messengers|infected\shacked\sby|other\stool\sthat\syou\shave\sin\syour\scontrol|footage\syou\swere\swatching\sat\sthat\smoment|\xE1\xB9\x81y\sBTC\saccount|I\swill\sadvance\sthrough|connected\swith\sinteraction\svia\son\syour\sgadget\sor\sPC|theasecuritysof|youraaccountuand|preventupermanentatermination/m tflags __JR_SEXTORT_V5K nosubject multiple maxhits=5 body __JR_SEXTORT_V5L /authorizeathisoactivity|requireiassistance|BankpofqAmerica|promptaattention|criticalimatter|BanklofiAmerica|verifyiyourqrecentcactivity|your\scamera\sand\syour\sactions\swhile\swatching\sporn|Curious\svideos\swere\srecorded\sfrom\syour\scamera|have\scopied\sall\sthe\sdata\sfrom\syour\sdevice\sto\sour\sown\sservers|\xE2\x82\xBFitcoin\-wallets?|your\svideo\sand\saudio\srecordings\swill\sbe\scompletely\sdestroyed|have\saccess\sto\sall\sthe\scontacts\sin\syour\sphone\sbook\sand\ssocial\snetworks|send\sthis\svideo\sto\syour\sfriends,\sfamily\sand\sfriends|Once\sthe\smoney\sis\sreceived\,\swe\swill\sinform\syou\sabout\sthe\ssecurity\shole|If\syou\sdon\'t\stransfer\sthe\smoney,\swe\swill\sleak\sall\syour\sdata|and\sI\sam\snever\skidding\sat\sall|probably\sdo\snot\sbe\saware|[Ii]t\'s\sa\spretty\srevealing\sclip|time\sreplying\sor\sattempting\sin\sorder\sto\stalk|in\smy\sBitcoin\saddress|I\sembedded\smalware\son\sa|to\sdiv\sersi\sfied|un\sique\saccess|installed\sa\sTrojan\svirus\sin\syour\sOS|email\sac\scount|week\saf\sterwar\sds|you\swere\skind\senough\sto\sopen\ssome\sof\slinks\sprovided|inbox\sema\sils|internet\sact\sivities|My\sTrojan\svirus|finally\sund\serstand|relat\sives\sof\syo\surs|kee\sping\sin\smind|dirty\sthings\syou\slike\sto\swatch|hot\scontent\sonl\sine|same\sas\smy\sBTC\saddress/m tflags __JR_SEXTORT_V5L nosubject multiple maxhits=5 body __JR_SEXTORT_V5M /will\scom\spletely\sruin|your\sre\spu\stati\son|si\sncerely\shope|this\sunp\sle\sasant\saccident|the\smalic\sious\ssoftware|great\sba\srgain|transfer\sbi\stcoins|re\scording\sand\str\sacking|Here\sis\sBitcoins\swallet|gained\sa\sfull\saccess\sto\sall\sdevices\sused\sby\syou|all\sde\svices\sthat|pe\srsonal\sinfo\scompi\slation|you\sare\sa\shuge\sadmirer\sand\sregular\sguest\sof\swebsites|endure\sa\slot\sof\spl\seasure|chec\sking\sout\sporn\swebs\sites|all\sthose\snasty\svideos\swith\syou\swill\sbe\sshared|br\seatht\saking\sorgas\sms|pe\srsonal\sinfo\scompi\slation|ma\sst\surbation\ssession|those\snaughty\ssolo\sscenes\swith\syou|the\ssequ\sence\sof\sevents|address\san\sissue\ssignificant\sbetween\sus|Your\sdigital\sactivities\shave\sbeen\srather|permitting\sme\sunrestricted\saccess|some\sdisturbing\snews\sthat\s.{2,6}\sare\sabout\sto\sbe\sinformed\sof|mailbox\swithout\sbreaking\sa\ssweat|will\sremove\sall\straces\sof\smy\smalware|private\sdata\sassembling|types\sof\selectronics|require\sis\ssimply\sto\sclick\smy\smouse|your\sfull\sfocus|Embedded\smalware\son\ssites\,?\sand\syou\scame\sacross\sit|label\sit\sa\ssecrecy\sfee|information\swill\sbe\skept\ssafe\,?\sand\sno\sone\swill\sever\sfind\sout|featuring\sthe\sperson\sjerking\soff|malicious\swebsite\scontaining\smy\siframe/m tflags __JR_SEXTORT_V5M nosubject multiple maxhits=5 body __JR_SEXTORT_V5N /Send\s[0-9]{4,5}\sAmerican\sdollars\sin\sBTC|I\smake\sno\smistakes\sand|wait\sfor\smy\smoney|considerable\squantity\sof\ssensitive\sdetails|Your\sonline\sactivities|full\scontrol\sto\syour\scontacts\slist|funds\sis\sreceived|American\sdollars\sin\sBTC\sto\smy\swallet\:|the\svideos\syou\'re\swatching|Do\snot\strouble\sto\sreply|compromising\sone\sdevice|US\scurrency\sto\smy\sBitcoin\saddress\:|complete\sreach\sto\syour\shardware|twisted\scompanion|the\sOmniscient\sEye|a\sdeal\:\sa\slittle\sof\scash\sin\sexchange|compromised\sby\smy\sprivate\smalware|FOOTAGE\sOF\sYOU\sMASTRUBATING|collected\sall\syour\sprivate\sdata|Within\sone\sweek\safterwards|frequent\svisitor\sof\spages\swith\smature\sthemes|few\sclicks\sto\sshare\syour\sprivate\svideo\swith\sfriends|to\smonitor\syou\svia\syour\scamera|resume\syour\snormal\slife\speacefully|you\spleasuring\syourself|while\sself\-pleasuring|cryptocurrencies\sremain\spseudonymous|\"Buy\sBitcoin\"|choosy\sabout\swhat\swebsites\sopen\son\sthe\sinternet|captured\snumerous\srecordings|currencies\sremain\sunknown\sterritory|will\sremove\sthe\sfootage/m tflags __JR_SEXTORT_V5N nosubject multiple maxhits=5 ## PUNYCODE WORD DICTIONARY ## body JR_SEXTORT_UTF_WORDS0 /(^|\b)(x_x_free\-tools\-aaanooonismaaa|ple\xCE\xB1se|tr\xCE\xB1nsfer|benefici\xCE\xB1ry|em\xCE\xB1il|fu\xC5\x84ds|b\xCE\xB1nk|\xCE\xB1cc\xCE\xBFount|\xCE\xB1ttenti\xCE\xBFn|b\xCE\xB1nking|priv\xCE\xB1te|c\xCE\xBFnvenience|det\xCE\xB1ils|sig\xC5\x84ific\xCE\xB1nt|dece\xCE\xB1sed(\'s)?|\xD1\x81ompromising|videotap\xC4\x97|analyz\xC4\x97|ab\xC5\x91\xC5\xA9t|Bitc\xC5\x91in|v\xC4\xABde\xC5\x91|donati\xC5\x8Dn|p\xC5\x8Drno|porn\xC5\x8D|y\xC5\x8D\xC5\xA9r|Yo\xC5\xA9|s\xC5\x8Dftware|y\xC5\x8D\xC5\xA9|y\xC5\x8Du|ab\xC5\x8D\xC5\xA9t|Bitc\xC5\x91in|p\xC3\xA0yment|\xC3\xA0dult|softwar\xC4\x95|rec\xC5\x8Drding|v\xC4\xA9deo|v\xC4\xA9d\xC4\x95o|malw\xC3\xA0re|s\xC5\x8Dcial|rec\xC5\x8Drding|yo\xC5\xA9rs|pornogr\xC3\xA0phy|gather\xC4\x95d|alternativ\xC4\x95s|enf\xC5\x8Drcement|cont\xC3\xA0cts|thes\xC4\x9B|donat\xC4\xA9on|porn\xC5\x8D|Bitc\xC5\x8D\xC4\xA9n|certa\xC4\xA9nly|softwar\xC4\x9B|passphr\xC3\xA4ses|\xC3\xA4ccess\xC4\xA9bility|\xC5\x8Dpt\xC4\xA9on|vi\xC4\x9Bwing|p\xC3\xA4rtic\xC5\xB3lars|yo\xC5\xB3r|\xC5\x8Dffic\xC4\xA9als|cl\xC4\xA9ps|\xC4\xA9nitiat\xC4\x9Bd|pornogr\xC3\xA0phy|em\xC3\xA0il|br\xC5\x8Dwser|M\xC4\x95ss\xC4\x95nger|enf\xC5\x8Drcement|\xC3\xA0ltern\xC3\xA0tives|ema\xC4\xA9l|rec\xC5\x8Drding|pornograph\xC4\xBAc|malwar\xC4\x9B|v\xC4\xBAde\xC5\x91|br\xC5\x91wser|v\xC4\xBAdeo|bitc\xC5\x91in|b\xC5\xA9y|paym\xC4\x9Bnt|y\xC5\x91\xC5\xA9r|addr\xC4\x9Bss|m\xCE\xB1lw\xCE\xB1re|\xCF\x81\xCE\xBFrn|webs\xCE\xB9\xCF\x84e|scree\xCE\xB7|webc\xCE\xB1m|vis\xCE\xB9ted|secre\xCF\x84|F\xCE\xB1cebo\xCE\xBF\xCE\xBA|v\xCE\xB9ew\xCE\xB9ng|w\xCE\xB1\xCF\x84chi\xCE\xB7g|\xCE\xBD\xCE\xB9deo|\xCE\xB7\xCE\xB1sty|sof\xCF\x84ware|\xCF\x84\xCE\xB1s\xCF\x84e|p\xCE\xB1yme\xCE\xB7\xCF\x84|\xCE\xB2itc\xCE\xBFi\xCE\xB7|mess\xCE\xB1ge|\xCE\xB2itc\xCE\xBF\xCE\xB9n|c\xCE\xBF\xCE\xB7\xCF\x84\xCE\xB1c\xCF\x84s|\xCE\xBAnow|Wh\xCE\xB1\xCF\x84|\xCE\xB2i\xCF\x84c\xCE\xBFi|where\xCE\xB1bou\xCF\x84sn|secre\xCF\x84|\xCE\xB1ga\xCE\xB9n|\xCE\xB9mmed\xCE\xB9\xCE\xB1\xCF\x84ely|l\xCE\xB9ttle|\xCE\xB2\xCE\xB9tc\xCE\xBFi\xCE\xB7|\xCE\xB2i\xCF\x84c\xCE\xBFin|B\xC4\xABtc\xC5\x91in|yo\xC5\xA9rself|bitc\xC5\x91in|disr\xC4\x93g\xC3\xA4rd|sm\xC3\xA4rter|y\xC5\x91u|y\xC5\x91\xC5\xA9|yo\xC5\xA9|\xC3\xA4nd|ign\xC5\x91r\xC4\x93|d\xC5\x91\xC4\xABng|le\xC3\xA4ve|bitc\xC5\x91in|b\xC5\xA9y|paym\xC4\x9Bnt|y\xC5\x91\xC5\xA9r|v\xC4\x81l\xD1\x96date|mast\xC5\xA9rbat\xD1\x96ng|\xC4\x81cquir\xC4\x95d|pl\xC4\x81ces|yo\xC5\xA9rself|\xC5\x8Fbserving|vide\xC5\x8Fs|for\xC5\xA9m|\xC4\x81ct\xD1\x96on|gr\xC5\x8F\xC5\xA9ps|som\xC4\x95|re\xC4\x81lly|h\xC4\x81v\xC4\x95|\xC4\x81nd|yo\xC5\xA9|passphr\xC4\x81ses|d\xC4\x9Btails|act\xC5\xABal|paym\xC4\x9Bnt|v\xC4\xADde\xC5\x8F|disr\xC4\x9Bgard|scr\xC4\x9B\xC4\x9Bn|del\xC4\x9Bte|R\xC4\x99m\xC5\x8Dt\xC4\x99|v\xC4\xB0de\xC5\x8Ds|N\xC5\x8Dbody|actu\xC3\xA0l|\xC3\xA0ll|comp\xC4\x9Bns\xC3\xA4ted|softwar\xC4\x9B|h\xC3\xA4v\xC4\x9B|\xC4\x9Bvery|w\xC4\x9Bre|aft\xC4\x95r|r\xD5\xBD\xD1\x96\xD5\xB8\xD1\x96\xD5\xB8\xD6\x81|integ\xC8\x93ated)(\W|$)/ tflags JR_SEXTORT_UTF_WORDS0 multiple maxhits=4 describe JR_SEXTORT_UTF_WORDS0 UTF: Word hit in Punycode dictionary score JR_SEXTORT_UTF_WORDS0 0.8 body JR_SEXTORT_UTF_WORDS1 /(^|\b)(\xCF\x81\xCE\xBFr\xCE\xB7|c\xCE\xBFntac\xCF\x84s|Rem\xCE\xBFte|\xCE\x92\xCE\xB9\xCF\x84co\xCE\xB9n|p\sC3\sA0sswords|\xC4\x9Bm\xC3\xA0il|r\xC4\x9Bcording|th\x3Fnk|j\xC5\x8Fke|m\xC3\xA0st\xC5\xB3rbat\xD1\x96ng|cont\xC3\xA0ct|rec\xC5\x8Frded|b\xD1\x96tc\xC5\x8F\xD1\x96n|y\xC5\x8Fur|y\xC5\x8F\xC5\xB3|sh\xC5\x8Fw|v\xC3\xA0lid\xC3\xA0t|n\xC5\x8Fw|d\xD1\x96scover|p\xC5\x8Fst\xD1\x96ng|alm\xC5\x8Fst|ha\xC2\xADrd|ad\xC2\xADult|ac\xC2\xADcounts|h\xC2\xADacked|secre\xC2\xADt|cam\xC2\xADera|ph\xC2\xADotos|ema\xC2\xADil|his\xC2\xADtory|wan\xC2\xADt|fil\xC2\xADes|Bitc\xC2\xADoin|hidin\xC2\xADg|masturbat\?on|v\?deo|masturbatio\?|se\?d|s\xCF\x81l\xCE\xB9\xCF\x84\-scree\xCE\xB7|\xCE\xB2i\xCF\x84c\xCE\xBF\xCE\xB9\xCE\xB7|lit\xCF\x84le|\xCE\xBAeylogger|d\xCE\xB9s\xCF\x81l\xCE\xB1y|v\xCE\xB9si\xCF\x84ed|\xCE\xB1cc\xCE\xBFu\xCE\xB7t|\xCE\xB7asty|th\xCE\xB1\xCE\xB7|ex\xCE\xB1c\xCF\x84ly|wh\xCE\xB1\xCF\x84|wh\xCE\xB1\xCF\x84|u\xCF\x81lo\xCE\xB1d|ca\xCE\xB7|bee\xCE\xB7|th\xCE\xB9nk|b\xCE\xB9\xCF\x84coin|co\xCE\xB7t\xCE\xB1c\xCF\x84|t\xCE\xB9me|masturba\xCF\x84i\xCE\xB7g|ig\xCE\xB7\xCE\xBFred|s\xCE\xBFo\xCE\xB7|v\xCE\xB9de\xCE\xBFs|\xCE\xB7\xCE\xB9ce|de\xCF\x84\xCE\xB1\xCE\xB9ls|act\xCE\xB9\xCE\xBDi\xCF\x84\xCE\xB9es|\xCE\xB2\xCE\xB9\xCF\x84c\xCE\xBF\xCE\xB9\xCE\xB7|r\xCE\xB9gh\xCF\x84|\xCE\xB7ow|uplo\xCE\xB1d|S\xCF\x84\xCE\xBF\xCF\x81|d\xCE\xBF\xCE\xB9ng|wo\xCE\xB7der|sho\xCF\x81p\xCE\xB9\xCE\xB7g|\xCE\xB9\xCF\x84|d\xCE\xB9ck|a\xCE\xB7d|co\xCE\xB7\xCF\x84ac\xCF\x84|wi\xCF\x84hi\xCE\xB7|\xCE\xB2i\xCF\x84co\xCE\xB9\xCE\xB7|arou\xCE\xB7d|de\xCF\x84\xCE\xB1\xCE\xB9ls|\xCF\x81orn|keyl\xCE\xBFgger|\xCE\xBDis\xCE\xB9\xCF\x84ed|\xCE\xBA\xCE\xB7\xCE\xBFw|Des\xCE\xBA\xCF\x84\xCE\xBF\xCF\x81|acc\xCE\xBFu\xCE\xB7\xCF\x84|webs\xCE\xB9\xCF\x84e|d\xCE\xB9splay|\xCE\xB2\xCE\xB9tco\xCE\xB9\xCE\xB7|\xCE\x92itc\xCE\xBFin|\xCE\xBDiew\xCE\xB9ng|u\xCE\xB7ique|p\xCE\xB1yment|n\xCE\xB1s\xCF\x84y|th\xCE\xB7gs|\xCF\x81\xCE\xBFr\xCE\xB7|\xCE\xBD\xCE\xB9si\xCF\x84ed|fu\xCE\xB7|m\xCE\xB1lw\xCE\xB1re|\xCE\xBD\xCE\xB9ewing|\xCE\x92i\xCF\x84c\xCE\xBFin|p\xCE\xB1yme\xCE\xB7t|\xCE\xB2\xCE\xB9\xCF\x84c\xCE\xBFin|\xCE\xB2\xCE\xB9tc\xCE\xBFi\xCE\xB7|d\xCE\xB9splay|softw\xCE\xB1re|accoun\xCF\x84|w\xCE\xB1tchi\xCE\xB7g|em\xCE\xB1\xCE\xB9l|l\xCE\xB9ttle|n\xCE\xB1s\xCF\x84y|af\xCF\x84er|f\xCE\xB9rst|\xCE\xB1ccess|\xCE\x99mporta\xCE\xB7\xCF\x84|tha\xCE\xB7|\xCE\xBA\xCE\xB7ow|\xCF\x84hngs|malw\xCE\xB1re|webs\xCE\xB9te|\xCE\xBD\xCE\xB9sited|h\xCE\xB1\xCE\xBDe|keyl\xCE\xBFgger|\xCE\xBD\xCE\xB9deo|\xCE\xB2\xCE\xB9\xCF\x84co\xCE\xB9n|f\xCE\xB1\xCE\xB9r|lit\xCF\x84le|scree\xCE\xB7|\xCE\xB1cc\xCE\xBFu\xCE\xB7\xCF\x84|\xCE\xB2i\xCF\x84co\xCE\xB9\xCE\xB7|mali\xE1\xB8\x89ious|a\xE1\xB8\x89tors|\xC4\xA5onor|\xE2\xB1\xBCust|b\xE1\xBB\xB9|entr\xC8\xB3|m\xC3\xA5lw\xC3\xA5re)(\W|$)/ tflags JR_SEXTORT_UTF_WORDS1 multiple maxhits=4 describe JR_SEXTORT_UTF_WORDS1 UTF: Word hit in Punycode dictionary score JR_SEXTORT_UTF_WORDS1 0.8 body JR_SEXTORT_UTF_WORDS2 /(^|\b)(purch\xE1\xBA\xB3se|\xCF\x81r\xCE\xB9ce|\xCF\x81\xCE\xB1yme\xCE\xB7t|\xCE\xB2i\xCF\x84c\xCE\xBFin|sof\xCF\x84ware|\xCF\x81r\xCE\xBF\xCE\xB9ded|p\xCE\xB1yme\xCE\xB7\xCF\x84|\xCE\xBD\xCE\xB9deo|bel\xCE\xB9eve|malw\xCE\xB1re|rec\xCE\xBFrded|\xCE\xB7asty|Y\xC3\xB6ur|em\xC3\xA4il|acc\xC3\xB6unt|w\xC3\xB6n|T\xC3\xB6|f\xC3\xA4cilitat\xC3\xA9|th\xC3\xA9|cl\xC3\xA4ims|pr\xC3\xB6cess|s\xC3\xA9nd|y\xC3\xB6u|nam\xC3\xA9|v\xC3\xA9rific\xC3\xA4tion|c\xC3\xB6de|t\xC3\xB6|\xC3\xB6ur|\xC3\xA4ttorn\xC3\xA9y|Industri\xC3\xA9s|compens\xCE\xB1t\xCE\xAFon|cons\xCE\xAFde\xC9\xBC|sec\xC9\xBCet|m\xCE\xB1stu\xC9\xBCb\xCE\xB1t\xCE\xAFo\xC9\xB3|\xC9\xBCeco\xC9\xBCded|\xCE\xB1utom\xCE\xB1t\xCE\xAFc\xCE\xB1lly|co\xC9\xBC\xC9\xBCespondence|softw\xCE\xB1\xC9\xBCe|c\xCE\xB1me\xC9\xBC\xCE\xB1|ever\xD9\x97y|po\xC9\xBCn|\xC9\xBCece\xCE\xAFve|tu\xC9\xBCned|you\xC9\xBC|numbe\xC9\xBCs|messenge\xC9\xBCs|not\xCE\xAFf\xCE\xAFc\xCE\xB1t\xCE\xAFon|u\xC9\xBC|h\xCE\xB1\xC9\xBCd|b\xCE\xAFt\-Co\xCE\xAFn|p\xC9\xBCog\xC9\xBC\xCE\xB1m|cont\xCE\xB1cts|\xCE\xB1ccess|v\xCE\xAFs\xCE\xAFted|B\xCE\xAFtco\xCE\xAFn|c\xC9\xBCe\xCE\xB1ted|spy\xCE\xAFng|\xCE\xB1nd|downlo\xCE\xB1ded|w\xCE\xB1llet|v\xCE\xAFdeos|w\xCE\xB1tch\xCE\xAFng|Incor\xC2\xADporat\xC2\xADion|Orga\xC2\xADniza\xC2\xADtion|U\xCD\x8Fpdat\xCD\x8Fe|pas\xCD\x8Fswo\xCD\x8Frd|be\xCD\x8Fl\xCD\x8Fow|K\xC2\xADe\xC2\xADep|[Ss]\xC2\xADa\xC2\xADme|P\xE2\x81\xA0o\xE2\x81\xA0we\xE2\x81\xA0r\xE2\x81\xA0ed|Pa\xE2\x81\xA0s\xE2\x81\xA0sw\xE2\x81\xA0ord|conti\xE2\x81\xA0nu\xE2\x81\xA0e|em\xC2\xADai\xC2\xADls|meet\xCE\xB9ng|presentat\xCE\xB9on|c\xD9\x96ountry|liv\xD6\xACe|s\xCD\xA6exy|t\xCC\xA8r\xCC\x96av\xCC\x8Del|R\xCD\xA0ussia|fr\xD9\x90iends|Goo\xD6\xAEd|We\xCD\x91lc\xCC\x8Bome\xD9\x8D|ex\xD6\x97plorer|sc\xCC\x93r\xD6\xB8e\xCD\xA3enname|int\xD6\xA7ere\xCD\xA9sted|her\xD9\x93e\xD9\x8E|he\xCC\x8Fard|harmoniou\xCD\x92s|f\xD9\x9F\x23cker|r\xD6\x9Belation|ni\xCD\xACcknam\xCD\x9Ee|Loo\xCC\x87king|sweet\xD6\x93hea\xD6\xA6r\xCD\x8Ct|a\xD6\xA3r\xCC\x8Cea|sin\xCD\x81gle|matte\xCD\xA8r|fin\xCD\xA0d|ev\xCD\xABerything|furth\xC3\xA9r|assistanc\xC3\xA9|N\xC3\xA9\xC3\xA9d|H\xC3\xA9lp|qu\xC3\xA9ry|pl\xC3\xA9as\xC3\xA9|s\xC3\xA9rvic\xC3\xA9|b\xC3\xA9\xC3\xA9n|d\xC3\xA9bit\xC3\xA9d|D\xC3\xA9ar|t\xD9\x97o|w\xCC\x8Fill|faceb\xCC\xBEook|everyt\xCC\xB0hin\xCC\x9Bg|o\xCD\x9En|wi\xCC\xBBth|\xCE\xB3\xC3\xB8u\x0D\x0A|w\xC3\xA9r\xE1\xBA\xB9|\xC4\x87h\xC3\xB8s\xE1\xBA\xB9n|f\xC3\xB8r|d\xC3\xB8n\xCE\xB1t\xC3\xAD\xC3\xB8n|\xC3\xBEr\xC3\xB8gr\xCE\xB1m|\xC4\x8D\xC3\xB3nt\xC3\xA1ct|f\xC3\xB0r|m\xC3\xB0r\xC3\xA9|d\xC3\xA9t\xCE\xB1\xC3\xADl\xC5\xA1|u\xC5\xA1|\xC4\x8Dertainl\xC3\xBF|messa\xC4\xA1e)(\W|$)/ tflags JR_SEXTORT_UTF_WORDS2 multiple maxhits=4 describe JR_SEXTORT_UTF_WORDS2 UTF: Word hit in Punycode dictionary score JR_SEXTORT_UTF_WORDS2 0.8 body JR_SEXTORT_UTF_WORDS3 /(^|\b)(\xCE\xB2\xCE\xB9\xCF\x84co\xCE\xB9n|w\xD0\xBEnderful\sman|her\xD0\xB5\s\xD0\xB0nd|\xD1\x80r\xD0\xBEfil\xD0\xB5\shere|l\xD0\xBE\xD0\xBEk\xD1\x96ng\sfor|je\xD0\xB0l\xD0\xBEus\sof\san\xD0\xBEth\xD0\xB5r|\xD1\x95\xD0\xB0y\sit|kn\xD0\xBEw\s\xCE\x95ngl\xD1\x96\xD1\x95h\slangu\xD0\xB0g\xD0\xB5|h\xC3\xA1ve|d\xC3\xA9cent|\xC3\xBEr\xC3\xB3po\xC5\xA1al|\xC3\xBElea\xC5\xA1e|\xC5\xA1end|re\xC5\xA1p\xC3\xB3ns\xC3\xA9|\xC3\xA9ma\xC3\xADl|t\xC3\xB3\sth\xC3\xADs|eyesight\xC3\xA2\xE2\x82\xAC\xC2\xA6|blindness\xC3\xA2\xE2\x82\xAC\xC2\xA6|night\xC3\xA2\xE2\x82\xAC\xC2\xA6|good\xC3\xA2\xE2\x82\xAC\xC2\xA6|\xCE\xB3our|accou\xCE\xB7t|\xCE\xB3ou|ta\xCE\xBAe|\xCF\x81assword|A\xC3\xA7ti\xCE\xBFn|pre\xCE\xBDent|\xCE\x9Aeep|in\xCE\xBDestigated|S\xCE\xBAip|confid\xC3\xA9|C\xC3\xA1n|ple\xC3\xA1se|em\xC3\xA1il|vi\xC3\xA1|K\xD0\xB5\xEF\xBB\xBF\xEF\xBB\xBF\xD0\xB5\xEF\xBB\xBF\xEF\xBB\xBFp|M\xEF\xBB\xBFy|\xD0\xA0\xEF\xBB\xBF\xEF\xBB\xBF\xD0\xB0\xEF\xBB\xBF\xEF\xBB\xBFss\xEF\xBB\xBFw\xEF\xBB\xBF\xEF\xBB\xBFor\xEF\xBB\xBFd|withdr\xD0\xB0w\xD0\xB0l|G\xD0\xBE|t\xD0\xBE|\xC3\xBDo\xC3\xBA|\xC4\x87\xC3\xA1n|b\xC3\xA9|tr\xC3\xBAst\xC3\xA9d|y\xC3\xA9s|\xC4\x87\xC3\xB3nt\xC3\xA1ct|m\xC3\xBD|\xC3\xBEriv\xC3\xA1te|\xC3\xA9m\xC3\xA1il|\xC3\xBEr\xC3\xB8po\xC5\xA1\xC3\xA1l|\xE2\x85\xBF\xD0\xB5\xD1\x95\xD1\x95\xD0\xB0\xD6\x81\xD0\xB5|\xD1\x95h\xD5\xBDt\xE2\x85\xBE\xD0\xBE\xD4\x9D\xD5\xB8|fr\xCE\xBF\xE2\x85\xBF|\xE2\x85\xBE\xD1\x96\xD1\x95r\xD0\xB5\xD6\x81\xD0\xB0r\xE2\x85\xBE|\xD0\xB0\xE2\x85\xBE\xE2\x85\xBE\xD1\x96t\xD1\x96\xCE\xBF\xD5\xB8\xD0\xB0\xE2\x85\xBC|Custom\xC3\xA9r|th\xC3\xA9|b\xC3\xA9low|me\xD6\xBAssage\xD9\x9Bs|\xCE\xB1\xD1\x81\xD1\x81\xD0\xBE\xD5\xBD\xD5\xB8t|busin\xC4\x99ss|prop\xC3\xB6sal|H\xC4\x99llo|Pleas\xC4\x99|c\xC3\xB6ntact|pers\xC3\xB6nal|f\xC3\xB6r|\xD1\x80\xD0\xB5rv\xD0\xB5rsi\xD0\xBEn|\xC3\xBCpdate|s\xC3\xADgnat\xC3\xBCres|mast\xC3\xBCrbate|rece\xC3\xADv\xC3\xADng|mo\xC3\xBCse|B\xC5\xA4C|d\xC3\xADstr\xC3\xADb\xC3\xBCted|ho\xC3\xBCrs|B\xC3\xBCy|thro\xC3\xBCgh|ant\xC3\xADv\xC3\xADr\xC3\xBCs|v\xC3\xADs\xC3\xADted|fam\xC3\xADl\xC3\xADar|F\xC3\xADl\xC3\xADng|t\xC3\xADmer|vid\xD0\xB5\xD0\xBEs|\xD1\x80unishm\xD0\xB5nt|recei\xCE\xBDe|T\xCF\x89o|\xCF\x89orks|\xE1\xBA\x8Four|the\xE1\xBA\x8F|merc\xE1\xBA\x8F|re\xD1\xB5eal|Ho\xCF\x89e\xCE\xBDer|\xCF\x89a\xE1\xBA\x8F|\xE1\xBA\x8Four|\xCF\x89ith|kno\xCF\x89|\xCF\x89ell|\xCF\x89andered|no\xCF\x89|\xCF\x89ebsites|beha\xD1\xB5ior|\xD1\xB5ery|secretl\xE1\xBA\x8F|s\xE1\xBA\x8Fstem|\xCF\x89as|\xE1\xBA\x87as|acti\xD1\xB5ities|e\xD1\xB5er\xE1\xBA\x8Fthing|excessi\xD1\xB5e|acti\xD1\xB5ate|\xCF\x89ouldn\xE2\x80\x99t|del\xD1\xB5e|be\xE1\xBA\x8Fond|\xC7\xB9owadays|qui\xE1\xB9\xADe|ma\xC5\x8Baged|O\xE1\xB9\x87e|la\xC6\xABer|deplo\xE1\xBB\xB3ed|breat\xE1\xB8\xA7e|\xC8\x99hared)(\W|$)/ tflags JR_SEXTORT_UTF_WORDS3 multiple maxhits=4 describe JR_SEXTORT_UTF_WORDS3 UTF: Word hit in Punycode dictionary score JR_SEXTORT_UTF_WORDS3 0.8 body JR_SEXTORT_UTF_WORDS4 /(^|\b)(\xCF\x89atching|kno\xCF\x89|\xD1\xB5ie\xCF\x89ing|vi\xCE\xBDid|\xD4\x81etails|\xCF\x89a\xE1\xBA\x8F|cryptocurrenc\xE1\xBA\x8F|Ha\xC2\xADve|ni\xC2\xADce|P\xC2\xADlea\xC2\xADse|con\xC2\xADfirm|pa\xC2\xADym\xC2\xADent|rec\xC2\xADei\xC2\xADpt|AS\xC2\xADAP|e\xC2\xADma\xC2\xADil|gre\xD0\xB0t\sr\xD0\xB5lati\xD0\xBEnsh\xD1\x96\xD1\x80|f\xC3\xB3r|y\xC3\xB0u|r\xD0\xB5\xD1\x81\xD0\xB5\xD1\x96\xE2\x85\xB4\xD0\xB5\xE2\x85\xBE|\xE1\xBA\x8Fou|webc\xCE\xB1m|co\xCE\xB7\xCF\x84\xCE\xB1cts|\xCE\xB1\xCE\xB7d|k\xCE\xB7\xCE\xBFw|Facebo\xCE\xBF\xCE\xBA|\xCF\x81art|payme\xCE\xB7\xCF\x84|c\xCE\xBF\xCE\xB7t\xCE\xB1cts|record\xCE\xB9ng|e\xCE\xBD\xCE\xB9de\xCE\xB7ce|Desk\xCF\x84\xCE\xBF\xCF\x81|tha\xCF\x84|\xCE\xBD\xCE\xB9de\xCE\xBF|\xCE\xBAeylogger|dis\xCF\x81l\xCE\xB1y|wh\xCE\xB1\xCF\x84|don\xC3\xA0tion|p\xC3\xA4ssphr\xC3\xA4ses|comp\xC4\x93nsated|vide\xC5\x8D|\xC3\xA4ltern\xC3\xA4tive|k\xC4\x93ylogg\xC4\x93r|m\xC3\xA4d\xC4\x93|enf\xC5\x8Drc\xC4\x93ment|em\xC3\xA4il|BitC\xC5\x8Dins|r\xC4\x93cording|\xC5\x8Dp\xC4\x93rating|sexu\xC3\xA4lly|pers\xC5\x8Dn\xC3\xA4l|y\xC5\x8D\xC5\xAB|R\xC4\x9Bmote|Deskt\xC5\x91p|s\xC4\x9Bnd|belo\xE1\xBA\x87|pri\xD1\xB5acy|an\xE1\xBA\x8F|\xD1\xB5isit|gu\xE1\xBA\x8F|\xE1\xBA\x87ere|extensi\xCE\xBDe|sensiti\xCE\xBDe|re\xD1\xB5eal|Hol\xE1\xBA\x8F|net\xE1\xBA\x87ork|entirel\xE1\xBA\x8F|ha\xD1\xB5e|disco\xD1\xB5er|ad\xD4\x81ress|an\xE1\xBA\x8F|belo\xE1\xBA\x87|m\xE1\xBA\x8F|reall\xE1\xBA\x8F|or\xD4\x81inar\xE1\xBA\x8F|abilit\xE1\xBA\x8F|\xCF\x89ithin|\xD1\xB5i\xD4\x81eos|\xF0\x9D\x97\xB5\xF0\x9D\x97\xAE\xF0\x9D\x98\x80|\xF0\x9D\x97\xBB\xF0\x9D\x97\xBC\xF0\x9D\x98\x81|h\xC3\xA5ve|\xC3\xADmport\xC3\xA5nt|m\xC3\xA5tter|d\xC3\xADscuss|w\xC3\xADth|s\xD0\xB5nt|s\xD0\xBEm\xD0\xB5|fil\xD0\xB5s|y\xD0\xBEu|[Ss]ubj\xD0\xB5ct|[Rr]\xD0\xB5vis\xD0\xB5d|[Rr]\xD0\xB5c\xD0\xB5iv\xD0\xB5d|[Tt]\xD0\xBEtal|[Rr]\xD0\xB5ci\xD1\x80i\xD0\xB5nt|[Tt]im\xD0\xB5|[Ii]t\xD0\xB5ms|care\xC6\x92ul|calcula\xE1\xB9\xADive|mis\xC8\x9Bakes?|\xC5\xA3ha\xC5\xA3|\xC8\x9Bhis|wi\xC5\xA5h|wi\xE1\xBA\x97h|maki\xC5\x89g|priva\xC8\x9Be|he\xC7\xB9ce|\xE1\xB9\xAFhe|cou\xC7\xB9\xC6\xABdow\xC7\xB9|e\xC7\xB9sure|comple\xC8\x9Be|aboveme\xC5\x86\xC6\xABio\xC5\x86ed|\xE1\xB9\xADra\xE1\xB9\x89s\xC6\x92er|wi\xC8\x9Bhi\xC5\x84|\xC6\xABhe|amou\xC5\x88\xC5\xA5|\xE1\xB9\xADra\xE1\xB9\x8Bs\xC6\x92erred|Approxima\xC5\xA3ely|\xE1\xB8\x9Few|mo\xC5\x88\xE1\xB9\xB1hs|gai\xC7\xB9ed|\xE1\xB9\xAFo|i\xC5\x88\xC8\x9Ber\xC5\x88e\xC8\x9B|browsi\xC7\xB9g|A\xE1\xB8\x9F\xC5\xA5er|A\xE1\xB8\x9F\xC5\xA5er|\xC5\xA5ar\xC5\xA5ed|\xE1\xB9\xAFracki\xC5\x89g|\xE1\xB9\xB1he|seque\xC5\x89ce|\xC8\x9Bime|\xE1\xB8\x9From|o\xC6\x92|m\xC4\xADnute|\xE1\xB9\x99ev\xC4\xA9ew|m\xD1\x83|Aft\xD2\xBFr|expli\xC4\x89it|a\xC3\xA7ts|involvin\xC4\x9F|\xE1\xBA\xA1\xC4\xA1\xE1\xBA\xA1in)(\W|$)/ tflags JR_SEXTORT_UTF_WORDS4 multiple maxhits=4 describe JR_SEXTORT_UTF_WORDS4 UTF: Word hit in Punycode dictionary score JR_SEXTORT_UTF_WORDS4 0.8 body JR_SEXTORT_UTF_WORDS5 /(^|\b)(\xC7\xB9o\xE1\xB9\xB1|i\xE1\xB9\x87ge\xE1\xB9\x87ious|pro\xC7\xA5ram|i\xE1\xB9\x89box|li\xE1\xB9\x85ks|micropho\xC3\xB1e|a\xE1\xB9\x85d|o\xE1\xB9\x8B|dow\xC5\x89loaded|da\xC5\xA3a|pho\xC5\xA5os?|docume\xE1\xB9\x85\xE1\xB9\xADs|his\xC5\xA5ory|\xE1\xB9\xB1o|\xC5\x86ews|messe\xE1\xB9\x89gers?|\xE1\xB9\x87e\xE1\xB9\xADworks?|his\xE1\xB9\xABory|cha\xC6\xAB|a\xC3\xB1d|co\xC5\x88\xE1\xB9\xADac\xE1\xB9\xADs?|co\xC5\x88\xC5\xA3i\xC5\x88uously|re\xC6\x92reshes|\xC5\xA5he|sig\xE1\xB9\x89a\xE1\xB9\xADures?|he\xC3\xB1ce|remai\xC5\x8Bs|i\xC7\xB9visible|\xE1\xBB\xB5ou|\xC5\x89ow|u\xC5\x84ders\xC5\xA3a\xC5\x84d|s\xE1\xB9\xADayed|u\xC5\x88de\xC5\xA3ec\xC5\xA3ed|u\xC5\x8B\xE1\xB9\xABil|ga\xC5\xA5heri\xE1\xB9\x89g|i\xC5\x84\xE1\xB8\x9Forma\xE1\xB9\xADio\xC5\x84|abou\xE1\xBA\x97|\xE1\xB9\xAFha\xE1\xB9\xAF|\xE1\xB8\x9Fa\xE1\xB9\x8B|adul\xC5\xA5|websi\xE1\xB9\xABes?|por\xE1\xB9\x85o?|visi\xC5\xA3i\xC5\x84g|wa\xE1\xBA\x97chi\xE1\xB9\x85g|exci\xC8\x9Bi\xC5\x84g|e\xC7\xB9ormous|amou\xC5\x88\xC6\xAB|\xC5\x84umber|ma\xC3\xB1aged|u\xC5\x88de\xC5\xA3ec\xC5\xA3ed|u\xC5\x8B\xE1\xB9\xABil|Pro\xE1\xB9\xAFec\xE1\xB9\xAFio\xC5\x8B|\xC6\xA6egula\xE1\xB9\xB1io\xC3\xB1|\xC6\x92i\xC5\x8Be|\xC5\x88o\xC5\xA3|wa\xC5\x86\xE1\xB9\xAB|wha\xE1\xB9\xAB|\xC5\xA3ra\xC5\x89s\xE1\xB8\x9Fer|Bi\xE1\xB9\xADcoi\xE1\xB9\x8B|accou\xC7\xB9\xC5\xA5|ou\xE1\xB9\xB1|o\xE1\xB9\x85li\xE1\xB9\x85e|Bi\xE1\xB9\xB1coi\xC5\x84|i\xC5\x89\xE1\xB8\x9Forma\xE1\xBA\x97io\xC5\x89|accou\xC5\x86\xE1\xB9\xAF|dele\xC5\xA5i\xC5\x8Bg|li\xC6\x92e|o\xC5\x86ce|\xC6\x92or|\xC3\xB1o\xC8\x9Bi\xE1\xB8\x9Fica\xC8\x9Bio\xC3\xB1|righ\xE1\xB9\xAB|a\xC6\x92\xE1\xB9\xADer|ope\xC7\xB9|\xE1\xB9\x87ever|I\xE1\xB8\x9F|o\xE1\xB9\xADhers|unde\xE2\x80\x8Flive\xE2\x80\x8Fred|So\xE2\x80\x8Fur\xE2\x80\x8Fce|ava\xC4\xABlable|seve\xE1\xB9\x99al|t\xC5\x97oubl\xE1\xB8\xAFng|\xE1\xB8\xAFnfo\xC8\x93mat\xE1\xB8\xAFon|challeng\xC4\xABng|secu\xC8\x93ed|ent\xC5\x95y|you\xC5\x99|b\xC9\x8Dows\xC3\xACng|fo\xC5\x95|S\xC4\xA9nce|t\xE1\xB9\x9Dack\xE1\xB8\xADng|you\xC9\x8D|\xC3\xACnte\xE1\xB9\x99net|se\xC9\x8Buence|occu\xE1\xB9\x9B\xE1\xB9\x9Bences?|expla\xC4\xA9ned|fo\xC5\x97|you\xE1\xB9\x9B|\xC4\xAFn|beg\xC4\xAFnn\xC4\xAFng|p\xE1\xB9\x9Focu\xE1\xB9\x9Fed|exclus\xC4\xADve|un\xC4\xAB\xC9\x8Bue|ent\xC8\x91y|f\xC8\x91om|hacke\xC8\x91s|mal\xE1\xB8\xADc\xE1\xB8\xADous|acto\xE1\xB9\x9Ds?|la\xE1\xB9\x9Dge|l\xE1\xB8\xADst|add\xC8\x93esse|cu\xC5\x97\xC5\x97ent|onl\xC4\xA9ne|env\xC4\xAD\xE1\xB9\x9Donment|th\xC3\xADs|\xC3\xAFs|qu\xC4\xAFte|p\xC8\x93evalent|eas\xC4\xAFly|a\xC8\x93\xC8\x93anged|onl\xC4\xAFne|uncompl\xC3\xACcated|fo\xE1\xB9\x99|\xC4\xADnto|s\xC4\xA9gn|\xC3\xACnto|you\xE1\xB9\x99|ema\xE1\xB8\xADl|\xD0\xB5\xD1\x85\xD1\x80o\xD1\x95\xD0\xB5|tr\xE1\xBA\xA1\xC5\x84spire|t\xE1\xB8\xA9is|\xC4\x9Five|si\xC7\xA7nificant|\xC7\xA7ot)(\W|$)/ tflags JR_SEXTORT_UTF_WORDS5 multiple maxhits=4 describe JR_SEXTORT_UTF_WORDS5 UTF: Word hit in Punycode dictionary score JR_SEXTORT_UTF_WORDS5 0.8 body JR_SEXTORT_UTF_WORDS6 /(^|\b)(ensu\xC5\x95e|[Tt]\xE1\xB9\x9Fojan|d\xE1\xB8\xAFsabled|el\xE1\xB8\xADm\xE1\xB8\xADnated|c\xC5\x95yptocu\xC5\x95\xC5\x95ency|\xC9\x8Dece\xC4\xAFve|t\xC5\x95ansfe\xC5\x95\xC5\x95\xC3\xAEng|st\xE1\xB9\x9Da\xC4\xA9ghtfo\xE1\xB9\x9Dwa\xE1\xB9\x9Dd|spec\xE1\xB8\xAFf\xE1\xB8\xAFc|t\xC5\x95ojan|ope\xC8\x91at\xC4\xAFonal|secu\xC8\x91\xC4\xAFty|po\xC5\x97nog\xC5\x97aph\xE1\xB8\xAFc|webs\xC3\xAEtes?|expl\xC4\xA9c\xC4\xA9t|cl\xC3\xADps?|featu\xC5\x97\xC3\xAEng|showcas\xC4\xA9ng|\xE1\xB8\xAFnt\xE1\xB8\xAFmate|\xC9\x8Deal\xE1\xB8\xAFty|d\xC4\xAFvulge|\xE1\xB9\x9Beco\xE1\xB9\x9Bd\xE1\xB8\xAFngs?|\xC4\xA9nfo\xE1\xB9\x99mat\xC4\xA9on|onl\xC3\xAEne|publ\xC4\xABc|ac\xC9\x8Doss|env\xC4\xAD\xE1\xB9\x9Donment|matte\xC5\x97|w\xE1\xB8\xAFdely|s\xC3\xAFgn\xC3\xAFf\xC3\xAFcant|\xC4\xAFntens\xC4\xAFf\xC4\xAFes|befo\xC8\x91e|\xC3\xACt|add\xC5\x99ess|\xE1\xB9\x9Femedy|c\xC5\x95yptocu\xC5\x95\xC5\x95ency|v\xC4\xADdeos?|sens\xC4\xA9t\xC4\xA9ve|eve\xC8\x91yth\xC3\xAEng|gua\xC8\x91antee|m\xD0\xB0\xD1\x95t\xD5\xBDrb\xD0\xB0t\xD1\x96\xD5\xB8\xD6\x81|\xD1\x83\xCE\xBF\xD5\xBD|\xD0\xB0ll\xCE\xBF\xD4\x9D\xD0\xB5d|r\xD0\xB0\xD5\xB8\xD1\x95\xD0\xBEm\xD4\x9D\xD0\xB0r\xD0\xB5|\xD1\x83o\xD5\xBDr|d\xD0\xB5v\xD1\x96\xD1\x81es|r\xD0\xB5m\xD0\xBEt\xD0\xB5l\xD1\x83|r\xD0\xB5m\xD0\xBEv\xD0\xB5|th\xD0\xB5|v\xD1\x96r\xD5\xBD\xD1\x95|\xD6\x81\xD0\xB0\xD1\x96\xD5\xB8\xD0\xB5d|\xD0\xB0\xD1\x81\xD1\x81\xD0\xB5\xD1\x95\xD1\x95|\xD1\x83\xD0\xBE\xD5\xBDr|d\xD0\xB5v\xD1\x96\xD1\x81\xD0\xB5|\xD1\x95\xD0\xB5\xD5\xB8ding|\xD1\x81\xCE\xBF\xD5\xB8t\xD0\xB0\xD1\x81t\xD1\x95|r\xD0\xB5l\xD0\xB5\xD0\xB0\xD1\x95\xD0\xB5|th\xD0\xB5\xD1\x95\xD0\xB5|d\xD0\xB0t\xD0\xB0|\xCE\xBF\xD5\xB8|m\xD0\xB0\xD5\xB8\xD1\x83|\xD4\x9D\xD0\xB5b\xD1\x95\xD1\x96t\xD0\xB5\xD1\x95|\xD0\xB0\xD5\xB8d|t\xC9\x8Dansfe\xC9\x8D|US\xE1\xB8\x92|\xD5\xB8ot\xD1\x96f\xD1\x96\xD0\xB5d|\xD0\xB5m\xD0\xB0\xD1\x96l|t\xD1\x96\xD5\xB8\xD1\x83|\xD0\xB0m\xCE\xBF\xD5\xBD\xD5\xB8t|dir\xC5\xA3y|sce\xC3\xB1es?|a\xC5\x8Bd|mo\xC5\x88\xC8\x9Baged?|porn\xC5\x8D|footag\xE1\xBB\x81|\xD0\x92\xD1\x96t\xD0\xA0\xD0\xB0\xD1\x83|\xD1\x96\xD5\xB8t\xD0\xB5r\xD0\xB0\xD1\x81t\xD1\x96\xCE\xBF\xD5\xB8|t\xEF\xBB\xBF\xE2\x81\xA0he|\xE2\x80\x8Bmo\xEF\xBB\xBF\xE2\x81\xA0st|i\xC2\xADmp\xC2\xADor\xEF\xBB\xBFta\xE2\x81\xA0nt|d\xC2\xADoc\xC2\xADum\xE2\x80\x8Ben\xE2\x81\xA0ts|co\xE2\x81\xA0nc\xE2\x81\xA0er\xE2\x81\xA0ni\xE2\x81\xA0ng|\xE2\x80\x8Byo\xEF\xBB\xBFur|sh\xEF\xBB\xBFip\xE2\x81\xA0me\xE2\x80\x8Bnt|K\xC2\xADee\xC2\xADp|Pa\xC2\xADss\xC2\xADwor\xC2\xADd|a\xE1\xB9\x95\xE1\xB9\x95aratu\xE1\xB9\xA3|\xE1\xB9\x97rofe\xE1\xB9\xA9\xE1\xB9\xA9ional|\xE1\xB9\xA1\xE1\xB9\x95eciali\xE1\xB9\xA1t|\xE1\xB9\xA3ucce\xE1\xB9\xA3\xE1\xB9\xA3fully|o\xE1\xB9\x95eration\xE1\xB9\xA3|\xE1\xB9\xA1u\xE1\xB9\x97ervi\xE1\xB9\xA1ing|mo\xE1\xB9\x87itori\xE1\xB9\x87g)(\W|$)/ tflags JR_SEXTORT_UTF_WORDS6 multiple maxhits=4 describe JR_SEXTORT_UTF_WORDS6 UTF: Word hit in Punycode dictionary score JR_SEXTORT_UTF_WORDS6 0.8 body JR_SEXTORT_UTF_WORDS7 /(^|\b)(restri\xE1\xB8\x89ts|re\xE1\xB9\x81ain\xC5\x9D|la\xE1\xB9\x97to\xE1\xB9\x97|wa\xE1\xB9\xA7|\xE1\xB9\x83alevolent|\xC5\xA1\xE1\xB9\x95yware|\xE1\xB8\xBFe|ex\xE1\xB9\x95lain|co\xE1\xB9\x81\xE1\xB9\x95ri\xC5\x9Fe\xC5\x9F|Thank\xE1\xB9\xA1|Tro\xD1\x98an|\xE1\xB8\xBFalware|\xE1\xB8\xBFanage|acce\xE1\xB9\xA3\xE1\xB9\xA3|further\xE1\xB8\xBFore|\xE1\xB9\xA3\xD2\xBF\xE1\xB9\xBD\xD2\xBFral|acce\xC8\x99\xC8\x99|\xE1\xB9\xA7witch|a\xE1\xB9\xA9|\xC8\x99i\xE1\xB8\xBFilar|\xE1\xB9\x81o\xE1\xB9\x81ent|\xE1\xB9\x83o\xE1\xB9\x83ent|ab\xE1\xB9\xA7ent|corre\xE1\xB9\xA1\xE1\xB9\x97ondence|re\xE1\xB9\xA7tricted|\xE1\xB9\x81ay|a\xC8\x99king|\xE1\xB9\x83alware|\xE1\xB9\xA7canner|illu\xC5\x9Ftrate\xC5\x9F|u\xC5\x9Fing|har\xE1\xB8\xBFful|\xE1\xB9\x81alware|function\xE1\xB9\xA3|\xE1\xB9\xA5oftware|driver\xE1\xB9\xA9|refre\xC5\x9Fhe\xC5\x9F|\xC5\xA1ignature\xC5\xA1|anti\xD1\xB5iru\xE1\xB9\xA1|re\xC5\x9Dult|continue\xE1\xB9\xA9|co\xE1\xB9\x81\xE1\xB9\x95ilation|\xE1\xB8\xBFade|\xE1\xB8\xBFa\xE1\xB9\xA3turbating|\xE1\xB9\x95ortion|corre\xE1\xB9\xA7\xE1\xB9\x95ondence|contact\xE1\xB9\xA1|\xE1\xB9\x81e\xE1\xB9\xA1\xE1\xB9\xA1enger|\xE1\xB9\x83ake|o\xE1\xB9\x95en|\xE1\xB9\x83e\xE1\xB9\xA5\xE1\xB9\xA5age\xE1\xB9\xA5|conver\xC5\x9Bation|extre\xE1\xB8\xBFely|\xE1\xB9\x83eticulou\xE1\xB9\xA5|\xE1\xB9\xA9trategic|circu\xE1\xB9\x83\xE1\xB9\xA7tance\xE1\xB9\xA7|\xE1\xB9\x83ake|fault\xE1\xB9\xA5|\xC5\x9Btraight|\xE1\xB9\x95ro\xE1\xB9\x83\xE1\xB9\x95tly|\xE1\xB9\x83aking|\xE1\xB9\x95rivate|cli\xE1\xB9\x97\xC5\x9F|unco\xE1\xB9\x81\xE1\xB9\x97licated|\xE1\xB8\xBFethod|nece\xC8\x99\xC8\x99ary|a\xE1\xB9\x81ount|ha\xC5\x9D|tran\xE1\xB9\xA3ferred|coin\xC5\x9B|ca\xE1\xB9\xA5h|\xE1\xB9\x97oint|re\xE1\xB9\x83oving|\xE1\xB9\xA1tate\xE1\xB8\xBFent|\xE1\xB9\xA7hared|thi\xC8\x99|\xE2\x82\xBFitcoin|gadg\xE1\xBB\x85t\xC5\x9D|conver\xC5\xA1ation|obtain\xE1\xBB\x85d|\xE1\xB8\xA3e\xC5\xA1itate|breat\xC4\xA5e|in\xC4\xA7alation|foc\xC5\xAF\xE1\xB9\xA5|t\xE2\xB1\xA8i\xC5\x9B|me\xE1\xB9\xA3\xE1\xB9\xA3age|cr\xC8\x97cial|t\xC4\xA5at|yo\xC8\x97|addre\xC8\x99\xC8\x99ing|i\xC5\x9F\xC5\x9F\xC6\xB0e|\xE1\xB9\xB7\xC8\x99|Yo\xE1\xBB\xA7|w\xE1\xB8\xA7o|t\xC4\xA5i\xE1\xB9\xA3|yo\xC5\xAD\'re|\xC8\x99\xE1\xB8\xA5ame|cond\xC3\xBBct|wo\xC6\xB0ld|watc\xE1\xB8\xA7|error\xE1\xB9\xA3|it\'\xC5\x9F|f\xE1\xBB\xA7tile|t\xE1\xB8\xA7ink|abo\xE1\xBB\xA7t|re\xC5\xA1et|anyt\xE1\xB8\xABing|\xC5\x9Dy\xC5\x9Dtem|j\xE1\xBB\xAB\xC5\x9Dt|co\xC3\xBBntdown|kick\xC8\x99|cryptoc\xC7\x94rrency|tran\xC5\xA1action|n\xC4\x95w\xE1\xB9\xA3|\xE1\xB9\xA5tart\xC8\x85d|th\xE1\xB8\x97|\xE1\xB9\xA3\xC8\x87qu\xC8\x87nc\xC8\x87|ha\xE2\xB1\xB1\xC3\xAA|acc\xC8\xA9\xE1\xB9\xA1\xE1\xB9\xA1|n\xD2\xBF\xD2\xBFd|pe\xC9\x8Dfo\xC9\x8Dm|\xC4\x87on\xC4\x87lude|not\xE1\xB8\xADce)(\W|$)/ tflags JR_SEXTORT_UTF_WORDS7 multiple maxhits=4 describe JR_SEXTORT_UTF_WORDS7 UTF: Word hit in Punycode dictionary score JR_SEXTORT_UTF_WORDS7 0.8 body JR_SEXTORT_UTF_WORDS8 /(^|\b)(\xE1\xB8\xBFonth\xE1\xB9\xA7|\xE1\xB9\xA1ituation|Y\xEF\xBB\xBFo\xEF\xBB\xBFu\xEF\xBB\xBFr\xEF\xBB\xBF|Micros0ft|Subscripti0n|did\sn0t|auth0rize|Am0unt|m_nthly|c0ntact|supp0rt|av0id|interrupti0n|Inv0ice|N0tice|Aut0\-Renewal|s\xEF\xBB\xBForr\xEF\xBB\xBFy|t\xEF\xBB\xBFo\xEF\xBB\xBFl\xEF\xBB\xBFe\xEF\xBB\xBFt\xEF\xBB\xBF|p\xEF\xBB\xBFa\xEF\xBB\xBFc\xEF\xBB\xBFk\xEF\xBB\xBFa\xEF\xBB\xBFg\xEF\xBB\xBFe|wil\xEF\xBB\xBFl\xEF\xBB\xBF|d\xEF\xBB\xBFe\xEF\xBB\xBFl\xEF\xBB\xBFi\xEF\xBB\xBFver\xEF\xBB\xBFe\xEF\xBB\xBFd\xEF\xBB\xBF|as\xEF\xBB\xBF|s\xEF\xBB\xBFoo\xEF\xBB\xBFn|t\xEF\xBB\xBFh\xEF\xBB\xBFe\xEF\xBB\xBF|ad\xEF\xBB\xBFdr\xEF\xBB\xBFe\xEF\xBB\xBFss\xEF\xBB\xBF|pl\xEF\xBB\xBFe\xEF\xBB\xBFa\xEF\xBB\xBFse|u\xEF\xBB\xBFpd\xEF\xBB\xBFat\xEF\xBB\xBFe|y\xEF\xBB\xBFou\xEF\xBB\xBFr\xEF\xBB\xBF|pos\xEF\xBB\xBFsi\xEF\xBB\xBFbl\xEF\xBB\xBFe\xEF\xBB\xBF|No\xEF\xBB\xBFte\x3A\xEF\xBB\xBF|t\xC8\xAD|ab\xC8\xAFut|m\xC3\xB4ment|t\xC5\x8F|deepl\xE1\xBA\x99|f\xC8\xAFcus|full\xC6\xB4|imp\xE1\xB9\x8Frtant|\xC5\xB7\xE1\xBB\x8Fu\|\xC3\xB5ffer|\xC3\xBD\xE1\xBB\x8Fur|c\xC3\xB4ncentrati\xC3\xB4n|n\xE1\xBB\x8Ft|wh\xC8\x8D|wh\xE1\xBB\x91|\xC3\xBFou|n\xE1\xBB\x9Bw|\xE1\xBB\xB9\xE1\xB9\x91u\'re|curi\xC7\x92us|hazard\xC3\xB3us|scr\xE1\xBB\x99lling|thr\xC5\x8Fugh|sp\xC8\xB3ware|f\xE1\xB9\x93und|\xC8\xB3\xC6\xA1u|\xE1\xBB\xB5\xE1\xB9\x8Durself|smartph\xE1\xBB\x97ne|seri\xC8\xABusl\xE1\xBA\x99|m\xC6\xA1nit\xC6\xA1r|rem\xC6\xA1tel\xE1\xBA\x8F|p\xE1\xBB\x91ssess|t\xE1\xBB\x95tal|c\xE1\xBB\x9Bntr\xE1\xBB\x9Bl|ever\xE1\xBA\x8Fthing|sh\xC8\x8Fcking|rec\xE1\xBB\x97rding|disc\xC3\xB4mf\xC3\xB4rt|c\xE1\xBB\x9Dmpensati\xE1\xBB\x9Dn|p\xC3\xB2ssess|c\xC3\xB3untd\xC3\xB3wn|c\xC8\x8F\-w\xC8\x8Frkers|c\xE1\xB9\x93mpani\xE1\xB9\x93ns?|spe\xC4\x89ial|un\xE1\xB8\x89ertainties|\xC3\xA7ompiling|whi\xE1\xB8\x89h|a\xC7\xB9\xE1\xB9\xABivirus|pani\xC4\x87|\xC3\xA0dult|vid\xC4\x9Bo|vide\xC5\x91s|\xC4\x8Donsidering|med\xCE\xAF\xCE\xB1|\xC9\xBCece\xCE\xAFve|mi\xE1\xB8\x89rophone|wh\xE1\xBA\x99|\xF0\x9D\x96\xB8\xF0\x9D\x97\x88\xF0\x9D\x97\x8E\xF0\x9D\x97\x8B|\xF0\x9D\x97\x8F\xF0\x9D\x97\x82\xF0\x9D\x96\xBD\xF0\x9D\x96\xBE\xF0\x9D\x97\x88\xF0\x9D\x97\x8C|\xF0\x9D\x96\xBB\xF0\x9D\x96\xBE|\xE1\xBA\xA1|c\xE1\xBA\xB1\xC3\xB1|t\xE1\xB8\xA3is|e\xE1\xB9\x8Bjoy|\xE1\xBA\xB5bsolutely|rui\xC5\x8B|mi\xE1\xB8\x89rophone|\xCE\xBAnow|\xC5\x88\xC7\xBBug\xE2\xB1\xA8ty|w\xE1\xB8\xA9o|w\xE2\xB1\xA8o|wonderin\xC4\x9D|\xC8\x9Fazardous|viewin\xC7\xB5|visitin\xC7\xA7|s\xE1\xB8\xABockin\xC7\xA7|t\xE2\xB1\xA8e|w\xC4\xA5en|t\xC8\x9Fe|di\xC7\xB5ital|be\xC4\x9Dins|t\xE1\xB8\xABis|p\xC4\xA7one|tryin\xC4\x9F)(\W|$)/ tflags JR_SEXTORT_UTF_WORDS8 multiple maxhits=4 describe JR_SEXTORT_UTF_WORDS8 UTF: Word hit in Punycode dictionary score JR_SEXTORT_UTF_WORDS8 0.8 body JR_SEXTORT_UTF_WORDS9 /(^|\b)(se\xC4\x89ured|cl\xC3\xACp|r\xD0\xB5\xD1\x80\xD5\xBDt\xD0\xB0t\xD1\x96\xD0\xBE\xD5\xB8|log\si\xC5\x8B|\xE1\xB8\x89onsequen\xE1\xB8\x89e|\xC4\x8Bonfidential|re\xC3\xA7order|ke\xC6\xB4pad|Desk\xCF\x84o\xCF\x81|h\xCE\xB1p\xCF\x81e\xCE\xB7|\xCF\x81\xCE\xB1ssword|\xCE\xB1cc\xCE\xBFun\xCF\x84|relativel\xE1\xBA\x99|ver\xE1\xBA\x99|ele\xC4\x89troni\xC4\x89s|\xC6\x88onta\xC6\x88ts|\xC4\x8Bhat|\xC4\x89ould|unlikel\xC5\xB7|\xC3\xA7aught|pr\xC8\xB1babl\xE1\xBA\x8F|logi\xC3\xA7|\xC4\x89ouldn\'t|\xE1\xBB\xB3ou|finall\xC5\xB7|\xF0\x9D\x97\x89\xF0\x9D\x97\x81\xF0\x9D\x97\x88\xF0\x9D\x97\x8D\xF0\x9D\x97\x88\xF0\x9D\x97\x8C|\xF0\x9D\x96\xBA\xF0\x9D\x97\x87\xF0\x9D\x96\xBD|\xF0\x9D\x97\x90\xF0\x9D\x97\x82\xF0\x9D\x97\x85\xF0\x9D\x97\x85|\xF0\x9D\x97\x8B\xF0\x9D\x96\xBE\xF0\x9D\x97\x86\xF0\x9D\x97\x88\xF0\x9D\x97\x8F\xF0\x9D\x96\xBE\xF0\x9D\x96\xBD|\xF0\x9D\x96\xBA\xF0\x9D\x96\xBC\xF0\x9D\x96\xBC\xF0\x9D\x97\x88\xF0\x9D\x97\x8E\xF0\x9D\x97\x87\xF0\x9D\x97\x8D|\xF0\x9D\x97\x82\xF0\x9D\x97\x87\xF0\x9D\x96\xBF\xF0\x9D\x97\x88\xF0\x9D\x97\x8B\xF0\x9D\x97\x86\xF0\x9D\x96\xBA\xF0\x9D\x97\x8D\xF0\x9D\x97\x82\xF0\x9D\x97\x88\xF0\x9D\x97\x87|\xF0\x9D\x96\xA8\xF0\x9D\x97\x87\xF0\x9D\x96\xBF\xF0\x9D\x97\x88\xF0\x9D\x97\x8B\xF0\x9D\x97\x86\xF0\x9D\x96\xBA\xF0\x9D\x97\x8D\xF0\x9D\x97\x82\xF0\x9D\x97\x88\xF0\x9D\x97\x87|\xF0\x9D\x96\xA2\xF0\x9D\x97\x81\xF0\x9D\x96\xBE\xF0\x9D\x96\xBC\xF0\x9D\x97\x84|\xF0\x9D\x96\xAF\xF0\x9D\x97\x85\xF0\x9D\x96\xBE\xF0\x9D\x96\xBA\xF0\x9D\x97\x8C\xF0\x9D\x96\xBE|w\xE1\xBA\xB7\xE1\xB9\x87t|\xE1\xB9\x87otify|\xE1\xBA\xA1bout|g\xC3\xA2i\xC5\x86|\xC3\xA2re|willi\xC5\x8Bg|respo\xC3\xB1d|rece\xC5\x89t|mo\xC5\x86t\xE2\xB1\xA8s?|w\xE1\xBA\xB1s|co\xE1\xB8\xBF\xE1\xB9\x95ro\xE1\xB8\xBFi\xC5\x9Fe|\xE1\xB8\xBFulti\xE1\xB9\x97le|ba\xC4\x89kdoor|\xC4\xA7o\xC5\x88est|messeng\xC2\xADers|m\xE1\xBA\xB1y|u\xC5\x8Bf\xE1\xBA\xABmili\xE1\xBA\xABr|\xC3\xA3ttempt|illustr\xC3\xA4te|t\xC4\xA5\xC4\x85t|\xE1\xB8\xA7elp|Troj\xC3\xA0\xC3\xB1|m\xE1\xBA\xAFlicious|softw\xE1\xB8\x81re|obt\xE1\xBA\xABi\xC5\x84|gre\xC7\xBBt|b\xE1\xBA\xA5rg\xE1\xBA\xA5i\xC5\x86|\xC4\xA5\xE1\xBA\xB3ppe\xC5\x89|keepi\xC5\x86g|i\xE1\xB9\x89|\xC3\xB1\xE1\xBA\xA3sty|\xC4\x85ctivities|eve\xC3\xB1|re\xC8\x81lize|\xE1\xBA\xB5bout|w\xE1\xBA\xAFtc\xE1\xB8\xAB|\xE1\xBA\xADccou\xC5\x88ts?|t\xE2\xB1\xA8roug\xE2\xB1\xA8|equiv\xC3\xA0le\xC5\x88t|vi\xC3\xA2|bitcoi\xC5\x8Bs?|kiddin\xC4\x9F|sli\xC4\x9D\xE1\xB8\xA3test|t\xE1\xB8\xABe|t\xC4\xA5rou\xC7\xA5\xC4\xA5|\xE2\xB1\xA8VN\xC4\x8C|allowin\xC7\xB5|switc\xE2\xB1\xA8|watc\xE1\xB8\xA9|everyt\xC4\xA5in\xC4\xA3|\xC4\xA5appenin\xC4\x9F|\xC4\x9Fad\xC4\x9Fets|\xE2\xB1\xA8i\xC4\xA3\xE2\xB1\xA8ly|ne\xC4\x9Fotiate|s\xE1\xB8\xA7uttin\xC7\xB5|e\xE1\xBA\xA7ch|\xE1\xBA\x89hile|\xE1\xBA\xAFt|le\xE1\xBA\xADst)(\W|$)/ tflags JR_SEXTORT_UTF_WORDS9 multiple maxhits=4 describe JR_SEXTORT_UTF_WORDS9 UTF: Word hit in Punycode dictionary score JR_SEXTORT_UTF_WORDS9 0.8 body JR_SEXTORT_UTF_WORDS10 /(^|\b)(e\xCE\xBDery|de\xD1\xB5ice|se\xCE\xB7si\xCF\x84i\xCE\xBDe|kno\xC5\xB5|fe\xE1\xBA\x98|\xE1\xBA\xAF\xC4\xA3o|m\xE1\xBA\xB7l\xE1\xBA\x85\xE1\xBA\xB7re|th\xC7\xBBt|rem\xC3\xA3inin\xC4\x9D|h\xC3\xA0rd\xE1\xBA\x85\xC3\xA0re|net\xE1\xBA\x83ork|\xE1\xBA\x98ithout|\xC3\xA5ny|obst\xE1\xBA\xAFcles?|p\xC8\x83yment|thre\xC7\xBBt|inform\xC3\xA1tion|im\xE1\xBA\xB5\xC4\xA1e|trust\xC5\xB5orthy|b\xC7\x8Esed|inter\xE1\xBA\xB7ction|mess\xE1\xBA\xA3\xC7\xA5e|provoc\xC7\xBBtive|\'\xE1\xBA\xB5dult\'|foot\xE1\xBA\xAD\xC7\xA5e|sa\xD1\xB5e\xD4\x81|Th\xC4\xAB\xC5\x9F|\xC5\x9F\xC4\xADmply|v\xC4\xA9ru\xC8\x99|web\xC8\x99\xC4\xADte|accou\xC5\x84\xE1\xB9\xAD|w\xC3\xAFll|w\xC3\xADll|g\xC3\xAEve|Opera\xE1\xB9\xB1i\xE1\xB9\x89g|Sys\xC8\x9Bems|th\xC3\xAE\xC5\xA1|\xF0\x9D\x97\x89\xF0\x9D\x96\xBA\xF0\x9D\x97\x92\xF0\x9D\x97\x86\xF0\x9D\x96\xBE\xF0\x9D\x97\x87\xF0\x9D\x97\x8D|broadca\xC5\xA1t|\xC4\xA9nv\xC4\xA9\xC8\x99\xC4\xA9bleF|\xE1\xB9\xA5oftware|watch\xC3\xADng|\xC3\x82mer\xC4\xADcan|addre\xC5\x9F\xC5\x9F|B\xE1\xB8\xADtco\xE1\xB8\xADn|b\xC4\xADtco\xC4\xADn|hacke\xE1\xB9\x9D|\xC5\x97ecentl\xE1\xBA\x8F|\xC5\xB7ou\xC9\x8D|compute\xC5\x97|\xE1\xBA\x8Fou\xC5\x99|we\xC6\x85|\xC5\x8Dccurred|softwa\xC8\x91e|identit\xC8\xB3|eve\xE1\xB9\x9F\xC6\xB4|p\xC8\x93opose|xC5\xB7ou\xE1\xB9\x99|p\xC8\x91efe\xC8\x91\xC8\x91ed|a\xE1\xB8\x87le|penet\xC5\x95ate|othe\xC5\x95|fo\xC5\x99|\xE1\xBB\xB9ou|we\xE1\xB8\x87cam|captu\xE1\xB9\x9Bed|pleasu\xE1\xB9\x9Ding|\xC5\xB7ou\xC8\x91self|infe\xC6\x88te\xC4\x8F|mali\xC4\x87ious|\xC4\x8Do\xE1\xB8\x8Fe|\xC4\x8Doming|se\xE1\xBA\x8Dually|e\xE1\xBA\x8Dpli\xC4\x8Bit|\xE1\xB8\x89hoose|\xC4\x91isplay|a\xC4\x89tivating|\xE1\xB8\x89amera|\xE1\xB8\x8Bollars|\xC6\x88rypto\xC6\x88urren\xC6\x88y|a\xC4\x89\xC4\x89ount|Bit\xC4\x87oin|Bit\xC3\xA7oin|a\xE1\xB8\x91\xE1\xB8\x91ress|\xE1\xB8\x91evi\xC4\x8Be|a\xC8\xA1\xC8\xA1itional|har\xE1\xB8\x8Fware|a\xC4\x8D\xC4\x8Dess|a\xC8\xA1\xC8\xA1ress\xC4\x91igital|a\xC3\xA7tivities|hazar\xC4\x91ous|a\xC4\x89\xC4\x89essing|\xE1\xBA\x83ebsites?|pla\xC4\x89e\xC4\x8F|mal\xC5\xB5are|ga\xC4\x8Fgets|a\xE1\xB8\x89tivity|o\xC4\x89\xC4\x89urring|a\xC3\xA7\xC3\xA7ess|\xC4\x89onta\xC4\x89ts|transa\xE1\xB8\x89tion|Bit\xC6\x88oin|stri\xC4\x8Dtly|\xE1\xB8\x89rypto\xE1\xB8\x89urren\xE1\xB8\x89y|c\xC5\x8Dmplet\xC4\x9B|sp\xE1\xBB\x81cialist|c\xE1\xBA\x99b\xC4\x93r\-op\xC4\x93rator|notic\xC3\xA8d|\xE1\xBA\x99our|d\xC4\x95\xE1\xB9\xBDic\xC4\x95|r\xC4\x93sponding|strang\xE1\xB8\x95l\xC5\xB7|d\xC4\x93\xE2\xB1\xB1ic\xC4\x93|compromis\xE1\xBA\xBDd|gon\xE1\xB8\x9D|w\xE1\xB8\x99bsit\xE1\xB8\x99|\xC3\xA9xplicit|\xC4\x89urious|\xC4\x8Fete\xC4\x8Dt|\xE1\xB8\x89apture\xE1\xB8\x91|re\xC6\x88or\xE1\xB8\x8Fing|vi\xC4\x91eo|viewe\xE1\xB8\x8D|\xC3\xA7rypto\xC3\xA7urren\xC3\xA7y|\xC6\x88li\xC6\x88k)(\W|$)/ tflags JR_SEXTORT_UTF_WORDS10 multiple maxhits=4 describe JR_SEXTORT_UTF_WORDS10 UTF: Word hit in Punycode dictionary score JR_SEXTORT_UTF_WORDS10 0.8 ## PUNYCODE B64 WORDS ## body __JR_SEXTORT_B64 /\s(\xF0\x9D\x96\xBA\xF0\x9D\x97\x8D\xF0\x9D\x97\x8D\xF0\x9D\x96\xBE\xF0\x9D\x97\x87\xF0\x9D\x97\x8D\xF0\x9D\x97\x82\xF0\x9D\x97\x88\xF0\x9D\x97\x87|\xF0\x9D\x96\xBB\xF0\x9D\x97\x82\xF0\x9D\x97\x8D\xF0\x9D\x96\xBC\xF0\x9D\x97\x88\xF0\x9D\x97\x82\xF0\x9D\x97\x87|\xF0\x9D\x97\x8C\xF0\x9D\x97\x89\xF0\x9D\x97\x92\xF0\x9D\x97\x90\xF0\x9D\x96\xBA\xF0\x9D\x97\x8B\xF0\x9D\x96\xBE|\xF0\x9D\x97\x8F\xF0\x9D\x97\x82\xF0\x9D\x96\xBD\xF0\x9D\x96\xBE\xF0\x9D\x97\x88|\xF0\x9D\x96\xBC\xF0\x9D\x97\x88\xF0\x9D\x97\x87\xF0\x9D\x97\x8D\xF0\x9D\x96\xBA\xF0\x9D\x96\xBC\xF0\x9D\x97\x8D\xF0\x9D\x97\x8C|\xF0\x9D\x96\xBA\xF0\x9D\x96\xBD\xF0\x9D\x97\x8E\xF0\x9D\x97\x85\xF0\x9D\x97\x8D|\xF0\x9D\x97\x8B\xF0\x9D\x96\xBE\xF0\x9D\x96\xBC\xF0\x9D\x97\x88\xF0\x9D\x97\x8B\xF0\x9D\x96\xBD\xF0\x9D\x97\x82\xF0\x9D\x97\x87\xF0\x9D\x97\x80|\xF0\x9D\x96\xBA\xF0\x9D\x97\x8D\xF0\x9D\x97\x8D\xF0\x9D\x96\xBE\xF0\x9D\x97\x87\xF0\x9D\x97\x8D\xF0\x9D\x97\x82\xF0\x9D\x97\x88\xF0\x9D\x97\x87|\xF0\x9D\x97\x8C\xF0\x9D\xCF\x89orks\x97\x89\xF0\x9D\x97\x92\xF0\x9D\x97\x90\xF0\x9D\x96\xBA\xF0\x9D\x97\x8B\xF0\x9D\x96\xBE|\xF0\x9D\x96\xBB\xF0\x9D\x97\x82\xF0\x9D\x97\x8D\xF0\x9D\x96\xBC\xF0\x9D\x97\x88\xF0\x9D\x97\x82\xF0\x9D\x97\x87|\xF0\x9D\x97\x90\xF0\x9D\x96\xBE\xF0\x9D\x96\xBB\xF0\x9D\x97\x89\xF0\x9D\x96\xBA\xF0\x9D\x97\x80\xF0\x9D\x96\xBE\xF0\x9D\x97\x8C|\xF0\x9D\x97\x89\xF0\x9D\x96\xBA\xF0\x9D\x97\x8C\xF0\x9D\x97\x8C|\xF0\x9D\x97\x90\xF0\x9D\x97\x88\xF0\x9D\x97\x8B\xF0\x9D\x96\xBD|\xF0\x9D\x97\x8F\xF0\x9D\x97\x82\xF0\x9D\x96\xBD\xF0\x9D\x96\xBE\xF0\x9D\x97\x88|\xF0\x9D\x97\x8B\xF0\x9D\x96\xBE\xF0\x9D\x96\xBC\xF0\x9D\x97\x88\xF0\x9D\x97\x8B\xF0\x9D\x96\xBD\xF0\x9D\x97\x82\xF0\x9D\x97\x87\xF0\x9D\x97\x80|\xF0\x9D\x97\x8B\xF0\x9D\x96\xBA\xF0\x9D\x97\x87\xF0\x9D\x96\xBD\xF0\x9D\x97\x88\xF0\x9D\x97\x86\xF0\x9D\x97\x85\xF0\x9D\x97\x92|\xF0\x9D\x97\x84\xF0\x9D\x97\x87\xF0\x9D\x97\x88\xF0\x9D\x97\x90|\xF0\x9D\x97\xBD\xF0\x9D\x97\xB9\xF0\x9D\x97\xB2\xF0\x9D\x97\xAE\xF0\x9D\x98\x80\xF0\x9D\x98\x82\xF0\x9D\x97\xBF\xF0\x9D\x97\xB2|\xF0\x9D\x97\xBF\xF0\x9D\x97\xB2\xF0\x9D\x97\xB0\xF0\x9D\x97\xBC\xF0\x9D\x97\xBF\xF0\x9D\x97\xB1\xF0\x9D\x97\xB6\xF0\x9D\x97\xBB\xF0\x9D\x97\xB4|\xF0\x9D\x97\xB9\xF0\x9D\x97\xBC\xF0\x9D\x97\xB4\xF0\x9D\x97\xB4\xF0\x9D\x97\xB6\xF0\x9D\x97\xBB\xF0\x9D\x97\xB4|\xF0\x9D\x98\x84\xF0\x9D\x97\xB2\xF0\x9D\x97\xAF\xF0\x9D\x97\xB0\xF0\x9D\x97\xAE\xF0\x9D\x97\xBA|\xF0\x9D\x97\xB8\xF0\x9D\x97\xBB\xF0\x9D\x97\xBC\xF0\x9D\x98\x84|\xF0\x9D\x97\xAF\xF0\x9D\x97\xB6\xF0\x9D\x98\x81\xF0\x9D\x97\xB0\xF0\x9D\x97\xBC\xF0\x9D\x97\xB6\xF0\x9D\x97\xBB|\xF0\x9D\x98\x82\xF0\x9D\x97\xBB\xF0\x9D\x97\xB6\xF0\x9D\x97\xBE\xF0\x9D\x98\x82\xF0\x9D\x97\xB2|\xF0\x9D\x98\x80\xF0\x9D\x97\xB2\xF0\x9D\x97\xB9\xF0\x9D\x97\xB3|i\xE1\xB9\x89s\xE1\xB9\xADalled|unwave\xC8\x93\xC3\xAFng|\xE1\xB8\xABa\xC8\x99|propo\xC5\x9Dal|pre\xC8\x99enting|c\xC8\x9Foo\xC5\x9Be|kn\xEF\xBB\xBFow|th\xEF\xBB\xBFa\xEF\xBB\xBFt)\s/ tflags __JR_SEXTORT_B64 multiple maxhits=4 ## PUNYCODE QP 8859-1 WORDS ## body __JR_SEXTORT_QP7_7_QP_WORDS1 /\b(malw\xE1re|visi\xF4ed|g\xE1thered|\xE1ll|dis\xF1l\xE1y|F\xE1cebook|webc\xE1m|sof\xF4ware|rec\xEFrded|vide\xEF|y\xEFu|view\xE9ng|webc\xE1m|\xE7asty|Rem\xEFte|Des\xEAtop|EAeylogger|y\xEFur|co\xE7tacts|fr\xEFm|\xED\xE9de\xEF|accoun\xF4|y\xEFu|\xE2\xE9\xF4co\xE9n|bel\xE9eve|\xF1\xE1yme\xE7t|\xC2\xE9\xF4co\xE9n|\xE2i\xF4c\xEFin|\xE1cc\xEFun\xF4|wa\xF4ch\xE9ng|\xE1ccess|p\xE1ymen\xF4|w\xE1s\xF4e|includ\xE9ng|p\xE9xel|\xF1\xE1ssw\xEFrd|m\xEFre|br\xEFwser|Wh\xE1\xF4|tha\xF4|\xEDideo|includ\xE9ng|rela\xF4\xE9ves|f\xE9\xEDe|fr\xE9ends|l\xE9ttle|keyl\xEFgger|scree\xE7|co\xE7\xF4\xE1cts|ga\xF4hered|s\xEFftware|Desk\xF4\xEF\xF1|proided|webs\xE9te|exac\xF4ly|\xF4hngs|\xE1bout|n\xE1s\xF4y|th\xE9ngs|Wh\xE1\xF4|sh\xEFuld|\xE2i\xF4co\xE9\xE7|payme\xE7\xF4|\xED\xE9sited|\xE1ccou\xE7\xF4|\xED\xE9ewi\xE7g|lit\xF4le|bel\xEFw|\xC2i\xF4co\xE9n|G\xEFogle|sens\xE9tive|record\xE9ng|\xE9ncludi\xE7g|rela\xF4i\xEDes|lit\xF4le|\xE2\xE9\xF4co\xE9n|re\xF1lying|em\xE1\xE9l|f\xE1\xE9r|exce\xF1ti\xEFn\xE1l|\xF1art|p\xE1ssw\xEFrd|\xC9mpor\xF4\xE1nt|\xE9mmedia\xF4ely|v\xE9de\xEF|F\xD1\x96n\xD0\xB0nc\xD1\x96\xD0\xB0l|\xF1\xE1r\xF4|k\xE7\xEFw|s\xC8\x9Braigh\xC8\x9B|t\xC4\xA5e)\b/ tflags __JR_SEXTORT_QP7_7_QP_WORDS1 multiple maxhits=4 meta JR_SEXTORTION1 ((__JR_SEXTORT1 + __JR_SEXTORT2 + __JR_SEXTORT3 + __JR_SEXTORT4 + __JR_SEXTORT5 + __JR_SEXTORT6 + __JR_SEXTORT7 + __JR_SEXTORT8 + __JR_SEXTORT_V4 + __JR_SEXTORT_V4A + __JR_SEXTORT_V4B + __JR_SEXTORT_V4C + __JR_SEXTORT_V4D + __JR_SEXTORT_V4E + __JR_SEXTORT_V4F + __JR_SEXTORT_V4G + __JR_SEXTORT_V4H + __JR_SEXTORT_V4I + __JR_SEXTORT_V4J + __JR_SEXTORT_V5A + __JR_SEXTORT_V5B + __JR_SEXTORT_V5C + __JR_SEXTORT_V5D + __JR_SEXTORT_V5E + __JR_SEXTORT_V5F + __JR_SEXTORT_V5G + __JR_SEXTORT_V5H + __JR_SEXTORT_V5I + __JR_SEXTORT_V5J + __JR_SEXTORT_V5K + __JR_SEXTORT_V5L + __JR_SEXTORT_V5M + __JR_SEXTORT_V5N) >= 3) describe JR_SEXTORTION1 Sextortion phrases detected in message body score JR_SEXTORTION1 7 # 3 or more phrases meta JR_SEXTORTION2 (JR_SEXTORT_UTF_WORDS0 + JR_SEXTORT_UTF_WORDS1 + JR_SEXTORT_UTF_WORDS2 + JR_SEXTORT_UTF_WORDS3 + JR_SEXTORT_UTF_WORDS4 + JR_SEXTORT_UTF_WORDS5 + JR_SEXTORT_UTF_WORDS6 + JR_SEXTORT_UTF_WORDS7 + JR_SEXTORT_UTF_WORDS8 + JR_SEXTORT_UTF_WORDS9 + JR_SEXTORT_UTF_WORDS10 >= 3) describe JR_SEXTORTION2 Punycode look-alike words detected in message body score JR_SEXTORTION2 7 # 3 or more more funky UTF words meta JR_SEXTORTION3 (__JR_SEXTORT_B64 >= 3) describe JR_SEXTORTION3 Punycode look-alike words detected in message body score JR_SEXTORTION3 7 # 3 or more Base64 words meta JR_SEXTORTION4 (__JR_SEXTORT_QP7_7_QP_WORDS1 >= 3) describe JR_SEXTORTION4 Punycode look-alike words detected in message body score JR_SEXTORTION4 7 # 8859-7 QP-encoded words meta JR_SEXTORTION5 ((__JR_SEXTORT_QP7_7_QP_WORDS1 || __JR_SEXTORT_B64 || JR_SEXTORT_UTF_WORDS0 || JR_SEXTORT_UTF_WORDS1 || JR_SEXTORT_UTF_WORDS2 || JR_SEXTORT_UTF_WORDS3 || JR_SEXTORT_UTF_WORDS4 || JR_SEXTORT_UTF_WORDS5 || JR_SEXTORT_UTF_WORDS6 || JR_SEXTORT_UTF_WORDS7 || JR_SEXTORT_UTF_WORDS8 || JR_SEXTORT_UTF_WORDS9 || JR_SEXTORT_UTF_WORDS10) && (__JR_SEXTORT1 || __JR_SEXTORT2 || __JR_SEXTORT3 || __JR_SEXTORT4 || __JR_SEXTORT5 || __JR_SEXTORT6 || __JR_SEXTORT7 || __JR_SEXTORT8 || __JR_SEXTORT_V4 || __JR_SEXTORT_V4A || __JR_SEXTORT_V4B || __JR_SEXTORT_V4C || __JR_SEXTORT_V4D || __JR_SEXTORT_V4E || __JR_SEXTORT_V4F || __JR_SEXTORT_V4G || __JR_SEXTORT_V4H || __JR_SEXTORT_V4I || __JR_SEXTORT_V4J || __JR_SEXTORT_V5A || __JR_SEXTORT_V5B || __JR_SEXTORT_V5C || __JR_SEXTORT_V5D || __JR_SEXTORT_V5E || __JR_SEXTORT_V5F || __JR_SEXTORT_V5G || __JR_SEXTORT_V5H || __JR_SEXTORT_V5I || __JR_SEXTORT_V5J || __JR_SEXTORT_V5K || __JR_SEXTORT_V5L || __JR_SEXTORT_V5M || __JR_SEXTORT_V5N)) describe JR_SEXTORTION5 Sextortion phrase(s) and Punycode detected in message body score JR_SEXTORTION5 7 # Hybrid Phrases/Punycode words meta JR_SEXTORTION6 ((T_JR_EXPLOIT_BAD_URL) && (__JR_SEXTORT1 || __JR_SEXTORT2 || __JR_SEXTORT3 || __JR_SEXTORT4 || __JR_SEXTORT5 || __JR_SEXTORT6 || __JR_SEXTORT7 || __JR_SEXTORT8 || __JR_SEXTORT_V4 || __JR_SEXTORT_V4A || __JR_SEXTORT_V4B || __JR_SEXTORT_V4C || __JR_SEXTORT_V4D || __JR_SEXTORT_V4E || __JR_SEXTORT_V4F || __JR_SEXTORT_V4G || __JR_SEXTORT_V4H || __JR_SEXTORT_V4I || __JR_SEXTORT_V4J || __JR_SEXTORT_V5A || __JR_SEXTORT_V5B || __JR_SEXTORT_V5C || __JR_SEXTORT_V5D || __JR_SEXTORT_V5E || __JR_SEXTORT_V5F || __JR_SEXTORT_V5G || __JR_SEXTORT_V5H || __JR_SEXTORT_V5I || __JR_SEXTORT_V5J || __JR_SEXTORT_V5K || __JR_SEXTORT_V5L || __JR_SEXTORT_V5M || __JR_SEXTORT_V5N)) describe JR_SEXTORTION6 Sextortion phrases w/ malicious URL score JR_SEXTORTION6 7 meta JR_SEXTORTION7 ((__JR_EXPLOIT_HAS_IMAGE) && (__JR_SEXTORT1 || __JR_SEXTORT2 || __JR_SEXTORT3 || __JR_SEXTORT4 || __JR_SEXTORT5 || __JR_SEXTORT6 || __JR_SEXTORT7 || __JR_SEXTORT8 || __JR_SEXTORT_V4 || __JR_SEXTORT_V4A || __JR_SEXTORT_V4B || __JR_SEXTORT_V4C || __JR_SEXTORT_V4D || __JR_SEXTORT_V4E || __JR_SEXTORT_V4F || __JR_SEXTORT_V4G || __JR_SEXTORT_V4H || __JR_SEXTORT_V4I || __JR_SEXTORT_V4J || __JR_SEXTORT_V5A || __JR_SEXTORT_V5B || __JR_SEXTORT_V5C || __JR_SEXTORT_V5D || __JR_SEXTORT_V5E || __JR_SEXTORT_V5F || __JR_SEXTORT_V5G || __JR_SEXTORT_V5H || __JR_SEXTORT_V5I || __JR_SEXTORT_V5J || __JR_SEXTORT_V5K || __JR_SEXTORT_V5L || __JR_SEXTORT_V5M || __JR_SEXTORT_V5N)) describe JR_SEXTORTION7 Sextortion phrases w/ attached images/PDF/ZIP score JR_SEXTORTION7 7 ############# UNUSUAL PATTERNS ############ ## CREATING RULES: JR_EXPLOIT.cf JR_BODY_GEN.cf JR_META.cf TBI_MX_MISC.cf ## ## SEXTORTION FONT ## rawbody __JR_BAD_FONT1 /^(\\)/m tflags __JR_BAD_FONT1 multiple maxhits=6 meta JR_BAD_FONT_A (__JR_BAD_FONT1 >= 6) describe JR_BAD_FONT_A Message body font style seen in Sextortion scams score JR_BAD_FONT_A 15 # ## HTML TRANSPARENCY STYLE ## rawbody __JR_HTML_XPARENT1 /color:\s?transparent/im tflags __JR_HTML_XPARENT1 multiple maxhits=250 meta JR_TRANSPARENT1 (__JR_HTML_XPARENT1 >= 249) describe JR_TRANSPARENT1 Body HTML contains many transparency tags score JR_TRANSPARENT1 7 # ## TINY FONT STYLE ## rawbody __MANY_MICROFONTS /font\-size\:0\.00000001px/i tflags __MANY_MICROFONTS nosubject multiple maxhits=6 meta JR_MANY_MICROFONTS (__MANY_MICROFONTS >= 5) describe JR_MANY_MICROFONTS Message body has excessive HTML line breaks score JR_MANY_MICROFONTS 6.0 # ## UTF ZERO WIDTH SPACE ## rawbody __JR_ZWS_UTF8A /Content\-Type.*charset.*utf\-8/i body __JR_ZWS_UTF8B /\xE2\x80\x8B/ tflags __JR_ZWS_UTF8B nosubject multiple maxhits=26 meta JR_ZWS_UTF8 (__JR_ZWS_UTF8A + (__JR_ZWS_UTF8B >= 30) >= 2) describe JR_ZWS_UTF8 Body has >= 30 Zero-Width Spaces score JR_ZWS_UTF8 2.5 # ## UTF ZERO WIDTH NON-JOINERS IN WORDS ## body __JR_ZWNJ_UTF8B1 /[a-fA-F]\xE2\x80\x8C[a-fA-F]/ tflags __JR_ZWNJ_UTF8B1 nosubject multiple maxhits=11 meta JR_ZWNJ_UTF8 (__JR_ZWS_UTF8A + (__JR_ZWNJ_UTF8B1 >= 10) >= 2) describe JR_ZWNJ_UTF8 Body has >= 10 words with Zero-Width Non-Joining characters in them score JR_ZWNJ_UTF8 3.5 # ## ADJACENT LEFT->RIGHT, RIGHT->LEFT UTF DIRECTIONALS ## body JR_BODY_DUAL_LR /\xE2\x80\x8F\xE2\x80\x8E|\xE2\x80\x8E\xE2\x80\x8F/ describe JR_BODY_DUAL_LR Body has adjacent L-R and R-L UTF directionals score JR_BODY_DUAL_LR 3.0 rawbody __JR_HTML1A /(div\sDiR\=ltrdata\-SETDIr\=false|DIv\sdir\=ltrdata\-sEtdIR\=false|div\sDIR\=ltrdata\-SEtdiR\=false|dIV\sdir\=ltrdata\-SeTDir\=false|div\sDIR\=ltrdata\-sEtDir\=false|DIV\sDIr\=ltrdata\-SETdir\=false|StYLE\=\"height|STyLe\=\"height|STYle\=\"height|STyLE\=\"height|STylE\=\"height|AReA\starGEt\=|AReA\sTArgEt\=|blazdeal\.appspot\.com|newdaysit\-c9093\.appspot\.com|\|\|\|dIV\sdir\=ltrdata|\|\<\/?mAP\>|\|\|\sStYlE\=\"height|\sSTylE\=\"height|\sstYLe="height|\sstYlE\=\"height|\sstyLE\=\"height|\<\/?CEnTER\>|\|\|\|\<\/ceNTer\>|SETDIr\=false\s|sEtdIR\=false\s|SEtdiR\=false\s|SeTDir\=false\s|sEtDir\=false\s|SETdir\=false\s|\|\|\|\|\|\<\/?MaP\>|\|\<\/?CenTeR\>|\/proserial\.org\/|v1cke_editable|callback_url\=atlentixco\.com|wf\;qagv\;avi|\|\|\|\|\<\/CENtEr\>|\<\/p\>\s\|\\|\<\/a\>\|\)/ tflags __JR_HTML1A multiple maxhits=4 meta JR_JR_HTML1 (__JR_HTML1A >= 3) describe JR_JR_HTML1 Body has unusual HTML markup syntax seen in junk mail score JR_JR_HTML1 7.5 rawbody __JR_HTML_RANDOM1 /\#\#random_number_/im tflags __JR_HTML_RANDOM1 multiple maxhits=200 meta JR_HTML_RANDOM (__JR_HTML_RANDOM1 >= 199) describe JR_HTML_RANDOM Unusual RANDOM tags observed in body HTML score JR_HTML_RANDOM 10 # ## Detect Reply Headers ### header __JR_CS_HAS_REF References:raw =~ /\<.+\>/ header __JR_CS_HAS_INREP In-Reply-To:raw =~ /\<.+\>/ header __JR_CS_HAS_REPSUB Subject =~ /^(RE|FW|REF|FWD|SV|VS|VL|TR|AW|WG|FS|VB|RV|RES|ENC|Odp|PD):/i ## Message body has many mailto: uri links ## uri __URI_MAILTO /^mailto:/i tflags __URI_MAILTO multiple maxhits=20 meta __CS_MAILTO __URI_MAILTO >= 15 meta JR_MAILTO_URL (__CS_MAILTO && !(__JR_CS_HAS_REF || __JR_CS_HAS_INREP || __JR_CS_HAS_REPSUB)) describe JR_MAILTO_URL Message body has many mailto links score JR_MAILTO_URL 1.57