<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<filters>
<filter name="primary">
<log>
<option type="match true" />
<option type="rules with match" />
<option type="execution" />
</log>
<results default="accept">
<result key="accept">
<return>0</return>
<copy enabled="no" createdir="no">c:\regexflt\accepted\{yyyy}-{mm}\{smtp:rcpt_to_domain}{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt</copy>
<copy enabled="no" operation="append" mail="no" append=""{smtp:client_ip}","{smtp:helo}","
{smtp:mail_from}","{smtp:rcpt_to}","{mm}/{dd}/{yyyy} {HH}:{MM}:{SS}","{smtp:mail_from_mailbox}","
{smtp:mail_from_domain}","{smtp:rcpt_to_mailbox}",
"{smtp:rcpt_to_domain}","accept","default",
"c:\\regexflt\\accepted\\{yyyy}-{mm}\\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\\{source:filename}{smtp:recipient_id}.txt"
\r\n">c:\regexflt\accepted\{yyyy}-{mm}\log.txt</copy>
<imap enabled="no" createdir="no">c:\Program Files\Merak\mail\2150.com\rejectedmail\RegEx Accepted\{source:filename}{smtp:recipient_id}.imap</imap>
<http enabled="no">[URL unfurl="true"]http://localhost/2150/regexflt_test.asp</http>[/URL]
</result>
<result key="accept_do_nothing">
<return>0</return>
</result>
<result key="mark">
<return>0</return>
<copy enabled="no" createdir="no">c:\regexflt\accepted\{yyyy}-{mm}\{smtp:rcpt_to_domain}{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt</copy>
<copy enabled="no" operation="append" mail="no" append=""{smtp:client_ip}","{smtp:helo}","
{smtp:mail_from}","{smtp:rcpt_to}","{mm}/{dd}/{yyyy} {HH}:{MM}:{SS}","{smtp:mail_from_mailbox}","
{smtp:mail_from_domain}","{smtp:rcpt_to_mailbox}","
{smtp:rcpt_to_domain}","mark","whitelist",
"c:\\regexflt\\accepted\\{yyyy}-{mm}\\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\\{source:filename}{smtp:recipient_id}.txt"
\r\n">c:\regexflt\accepted\{yyyy}-{mm}\log.txt</copy>
<imap enabled="no" createdir="no">c:\Program Files\Merak\mail\2150.com\rejectedmail\RegEx Accepted\{source:filename}{smtp:recipient_id}.imap</imap>
<http enabled="no">[URL unfurl="true"]http://localhost/2150/regexflt_test.asp</http>[/URL]
<modifysource enabled="no">
<header enabled="no" action=
"add" item="X-RegEx-Filter" value="regex_whitelist.xml" />
<header enabled="no" action=
"add" item="X-RegEx-Filter-Title" value="{result:rule:title}" comment=
"Not yet implemented" />
<header enabled="no" action=
"add" item="X-RegEx-Filter-UID" value="{result:rule:uid}" comment=
"Not yet implemented" />
</modifysource>
</result>
<result key="mark_high">
<return>0</return>
<copy enabled="no" createdir="no">c:\regexflt\accepted\{yyyy}-{mm}\{smtp:rcpt_to_domain}{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt</copy>
<copy enabled="no" operation="append" mail="no" append=""{smtp:client_ip}","{smtp:helo}","
{smtp:mail_from}","{smtp:rcpt_to}","{mm}/{dd}/{yyyy} {HH}:{MM}:{SS}","{smtp:mail_from_mailbox}","
{smtp:mail_from_domain}","{smtp:rcpt_to_mailbox}",
"{smtp:rcpt_to_domain}","mark_high","
whitelist","c:\\regexflt\\accepted\\{yyyy}-{mm}\{smtp:rcpt_to_domain}\\{smtp:rcpt_to_mailbox}\\{source:filename}
{smtp:recipient_id}.txt"\r\n">c:\regexflt\accepted\{yyyy}-{mm}log.txt</copy>
<imap enabled="no" createdir="no">c:\Program Files\Merak\mail\2150.com\rejectedmail\RegEx Accepted\{source:filename}{smtp:recipient_id}.imap</imap>
<http enabled="no">[URL unfurl="true"]http://localhost/2150/regexflt_test.asp</http>[/URL]
<modifysource enabled="yes">
<header enabled="no" action=
"add" item="X-RegEx-Filter" value="regex_whitelist.xml" />
<header enabled="no" action="replaceoradd" item="Importance" value="High" />
<header enabled="no" action="replaceoradd" item="X-Priority" value="1 (Highest)" />
<header enabled="no" action=
"add" item="X-RegEx-Filter-Title" value="{result:rule:title}" comment=
"Not yet implemented" />
<header enabled="no" action=
"add" item="X-RegEx-Filter-UID" value="{result:rule:uid}" comment="Not yet
implemented" />
</modifysource>
</result>
</results>
<parser>
<maxlines>10000</maxlines>
<maxbuffer>500000</maxbuffer>
<quickresult>yes</quickresult>
</parser>
<rules>
<rule result="accept_do_nothing">
<title>Whitelist MAIL FROM (do nothing)</title>
<comment>Allow all email from these
addresses (outbound mailing lists)</comment>
<scope>
<mailfrom>all</mailfrom>
</scope>
<expressions oninit="score=0" logic="return score > 0">
<expression casesensitive="no" type="regex" onmatch="score += 1">clinic@yugm\.org</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">lcv@yugm\.org</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">lighthouseshoppe@yugm\.org</expression>
</expressions>
</rule>
<rule result="mark_high">
<title>Secret phrase</title>
<comment>Secret phrase to force email to be accepted unconditionally. Any email containing one of these phrases will be accepted.</comment>
<scope>
<header>all</header>
</scope>
<expressions oninit="score=0" logic="return score > 0">
<expression casesensitive="no" type="regex" onmatch="score += 1" comment="Secret phrase or word">prayer</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1" comment="Secret phrase or word">\[accept\]</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1" comment="Secret phrase or word">\[AGRM-LIST\]</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1" comment="Secret phrase or word">\[DEVELOPMENT\]</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1" comment="Secret phrase or word">board meeting</expression>
</expressions>
</rule>
<rule result="mark">
<title>Whitelist MAIL FROM</title>
<comment>Allow all email from these addresses</comment>
<scope>
<mailfrom>all</mailfrom>
</scope>
<expressions oninit="score=0" logic="return score > 0">
<expression casesensitive="no" type="regex" onmatch="score += 1">zyxxxyz</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">register4less\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">pc@max\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">Dave\.Benefiel@avenuea-razorfish\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">bcms@auna\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">ssg2359@comcast\.net</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">HavenatYakima@aol\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">ericstoothoff@charter\.net</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">gbliss@blisspages\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">teresa@thehomestead\.info</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">mopar@gorge\.net</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">jodi_sargent81@yahoo\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">johnhatfield@comcast\.net></expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">jonathan@zav\.om\.org</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">martinlopez1957@msn\.co</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">ericstoothoff@charter\.net</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">familiesnorthwest\.org</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">diersinc\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">envelopeconverting\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">pastordennis@yakimatbc\.org</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">digitalriver\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">xpedx\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">ipaper\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">danieleburrow@yahoo\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">hsabank\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">FloydPeg@aol\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">f-prot\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">\bugm\.org\b</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">patricia_2005@earthlink\.net</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">Christloves9@aol\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">timelesstexts\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">pat dodd</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">rescuecollege\.org</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">chris@servantchurch\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">digikey\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">Christloves9@aol\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">nsadownick@bellintl\.ca</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">abbotts\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">accs\.net</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">biblestudylessons\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">billygraham\.org</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">chaplainjim</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">christianbook\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">culver@spiritone\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">danieleburrow@earthlink\.net</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">designedhometheater\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">desiringgod\.org</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">editpadpro\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">editwrx\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">feinsteinfoundation\.org</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">fern@rockisland\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">ga\.wa\.gov</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">goldwinggadgets\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">gospelway\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">griff208@charter\.net</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">hp\.com</expression>regexbuddy.com
<expression casesensitive="no" type="regex" onmatch="score += 1">hrcaerica@hm\.honda\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">icewarp\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">charter\.net</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">Linda@pedersonbros\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">lindsund@comcast\.net</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">lists.cciusa\.org</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">lists.gospelcom\.net</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">lmhsoft\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">lynnnathe@msn\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">martinlopez1957@msn\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">mcafee\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">mikeeclark@hotmail\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">nwinfo\.net</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">online-bible-college\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">onPhilanthropy\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">paypal\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">pilgrim@gracegems\.org</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">raldrich@owt\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">rcpddp@hotmail\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">Register4less\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">rejoyce3@msn\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">reply\.ebay\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">rob@powerviewsystems\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">simpledns\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">sosexchange1</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">ssutton@edcc\.edu</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">taspro6support</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">tharp_m@televar\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">walkintheword\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">weightwatchers\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">xecute\.com</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1">service@paypal\.com</expression>
</expressions>
</rule>
<rule result="mark">
<title>Whitelist RCPT TO</title>
<comment>Allow all email from these addresses (can be used to effectively disable filtering to specific users/domains, though the index is a better way to do this</comment>
<scope>
<rcptto>all</rcptto>
</scope>
<expressions oninit="score=0" logic="return score > 0">
</expressions>
</rule>
<rule result="mark">
<title>Whitelist body</title>
<comment>Whitelist based on these expressions being in the body of an email</comment>
<scope>
<body>all</body>
</scope>
<expressions oninit="score=0" logic="return score > 0">
<expression casesensitive="no" type="regex" onmatch="score += 1">EVHS1985</expression>
</expressions>
</rule>
</rules>
</filter>
<filter name="secondary">
<log>
<option type="match true" />
<option type="rules with match" />
<option type="execution" />
</log>
<results default="accept">
<result key="accept">
<return>0</return>
<copy enabled="no" createdir="no">c:\regexflt\accepted\{yyyy}-{mm}\{smtp:rcpt_to_domain}{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt</copy>
<copy enabled="no" operation="append" mail="no" append=""{smtp:client_ip}","{smtp:helo}","
{smtp:mail_from}","{smtp:rcpt_to}","{mm}/{dd}/{yyyy} {HH}:{MM}:{SS}","{smtp:mail_from_mailbox}","
{smtp:mail_from_domain}","{smtp:rcpt_to_mailbox}",
"{smtp:rcpt_to_domain}","accept","default",
"c:\\regexflt\\accepted\\{yyyy}-{mm}\\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\\{smtp:rcpt_to_domain}\\{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt"\r\n">c:\regexflt\accepted{yyyy}-{mm}\log.txt</copy>
<imap enabled="no" createdir="yes">c:\Program Files\Merak\mail\2150.com\rejectedmail\RegEx Accepted\{source:filename}{smtp:recipient_id}.imap</imap>
<http enabled="no">[URL unfurl="true"]http://localhost/2150/regexflt_test.asp</http>[/URL]
</result>
<result key="mark">
<return>0</return>
<copy enabled="no" createdir="yes">c:\regexflt\accepted\{yyyy}-{mm}\{smtp:rcpt_to_domain}{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt</copy>
<copy enabled="no" operation="append" mail="no" append=""{smtp:client_ip}","{smtp:helo}","
{smtp:mail_from}","{smtp:rcpt_to}","{mm}/{dd}/{yyyy} {HH}:{MM}:{SS}","{smtp:mail_from_mailbox}","
{smtp:mail_from_domain}","{smtp:rcpt_to_mailbox}","
{smtp:rcpt_to_domain}","mark","whitelist",
"c:\\regexflt\\accepted\\{yyyy}-{mm}\\{smtp:rcpt_to_domain}\{smtp:rcpt_to_mailbox}\\{smtp:rcpt_to_domain}\\{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt"\r\n">c:\regexflt\accepted{yyyy}-{mm}\log.txt</copy>
<imap enabled="no" createdir="yes">c:\Program Files\Merak\mail\2150.com\rejectedmail\RegEx Accepted\{source:filename}{smtp:recipient_id}.imap</imap>
<http enabled="no">[URL unfurl="true"]http://localhost/2150/regexflt_test.asp</http>[/URL]
<modifysource enabled="yes">
<header enabled="yes" action="add" item="X-RegEx-Filter" value="regex_whitelist.xml" />
<header enabled="no" action="add" item="X-RegEx-Filter-Title" value="{result:rule:title}" comment="Not yet implemented" />
<header enabled="no" action="add" item="X-RegEx-Filter-UID" value="{result:rule:uid}" comment="Not yet implemented" />
</modifysource>
</result>
<result key="mark_high">
<return>0</return>
<copy enabled="no" createdir="yes">c:\regexflt\accepted\{yyyy}-{mm}\{smtp:rcpt_to_domain}{smtp:rcpt_to_mailbox}\{source:filename}{smtp:recipient_id}.txt</copy>
<copy enabled="no" operation="append" mail="no" append=""{smtp:client_ip}","{smtp:helo}","
{smtp:mail_from}","{smtp:rcpt_to}","{mm}/{dd}/{yyyy} {HH}:{MM}:{SS}","{smtp:mail_from_mailbox}","
{smtp:mail_from_domain}","{smtp:rcpt_to_mailbox}",
"{smtp:rcpt_to_domain}","mark_high","
whitelist","c:\\regexflt\\accepted\\{yyyy}-{mm}\{smtp:rcpt_to_domain}\\{smtp:rcpt_to_mailbox}\\{source:filename}
{smtp:recipient_id}.txt"\r\n">c:\regexflt\accepted\{yyyy}-{mm}log.txt</copy>
<imap enabled="no" createdir="yes">c:\Program Files\Merak\mail\2150.com\rejectedmail\RegEx Accepted\{source:filename}{smtp:recipient_id}.imap</imap>
<http enabled="no">[URL unfurl="true"]http://localhost/2150/regexflt_test.asp</http>[/URL]
<modifysource enabled="yes">
<header enabled="yes" action="add" item="X-RegEx-Filter" value="regex_whitelist.xml" />
<header enabled="yes" action="replaceoradd" item="Importance" value="High" />
<header enabled="yes" action="replaceoradd" item="X-Priority" value="1 (Highest)" />
<header enabled="no" action="add" item="X-RegEx-Filter-Title" value="{result:rule:title}" comment="Not yet implemented" />
<header enabled="no" action="add" item="X-RegEx-Filter-UID" value="{result:rule:uid}" comment="Not yet implemented" />
</modifysource>
</result>
</results>
<parser>
<maxlines>1000</maxlines>
<maxbuffer>10000</maxbuffer>
<quickresult>yes</quickresult>
</parser>
<rules>
<rule result="mark">
<title>Whitelist subject</title>
<comment>Exclude subject lines with a date at the end or with "order"/"confirm"/"reservation" in them to catch online orders and reservations that append an order # that otherwise would flag immediately as SPAM.</comment>
<scope>
<header>all</header>
</scope>
<expressions oninit="score=0" logic="return score > 0">
<expression casesensitive="no" type="regex" onmatch="score -= 10" comment="If viagra is in the subject, don't allow whitelist subjects to work">^subject:.+\bv[iI1]agra\b</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Exclude any from address with 'advize'">^from:.+advize</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Exclude any subject with 'debt'">^subject:.+debt</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'order' if it starts with 'you can'">^subject:.+\byou can order\b</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'order' if it has 'diet'">^subject:.+\bdiet</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'order' if it has 'drugs'">^subject:.+\bdrugs</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'order' if it has 'log in'">^subject:.+\blog +in</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'order' if it has 'medication'">^subject:.+\bmedication</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'order' if it has 'meds'">^subject:.+\bmeds</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'order' if it has 'offer confirmation'">^subject:.+\boffer +confirmation</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'order' if it has 'order approved'">^subject:.+\border +approved</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'order' if it has 'penis'">^subject:.+pen[iIl1]s</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'order' if it has 'porno'">^subject:.+p[oO0]rn[oO0]</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'order' if it has 'virgin'">^subject:.+\bv[iI1]rg[iI1]n</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'order' if it has 'waiting on your'">^subject:.+\bwaiting +on +your</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'order' if it has 'we want'">^subject:.+\bwe +want</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'order' if it has 'xanax'">^subject:.+\bxanax</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'order' if it has 'you can order'">^subject:.+\byou +can +order</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">^subject:.+\border\b</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'confirm' if it has 'your information'">^subject:.+\byour +information</expression>
<expression casesensitive="no" type="regex" onmatch="score -= 1" comment="Don't whitelist based on 'confirm' if it has 'as seen on">^subject:.+\bas +seen +on</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">^subject:.+\bconfirmation</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">^subject:.+\breservation</expression>
<expression casesensitive="no" type="regex" onmatch="score += 1">^subject:.+\bshipment</expression>
</expressions>
</rule>
</rules>
</filter>
</filters>
</configuration>