# This SpamAssassin ruleset was auto-generated from signatures provided by
# SaneSecurity <http://www.sanesecurity.com/clamav/>, originally intended
# for use with ClamAV.  As such, it should be considered experimental at
# this stage, and not used in production environments without extensive
# testing first.
# 
# This rule file is quite large, and should only be used in environments
# where the sa-compile utility is available to optimize the large number
# of regular expressions it contains.  Even so, there will be performance
# implications--a larger memory footprint at the very least.
# 
# The script that was used to produce this rule file (ndb2cf.pl) was
# written by Robert LeBlanc <rjl@renaissoft.com>.  Bug reports, comments
# and suggestions should be directed to that address.
# 
# This rule file is provided as-is, without warranty or conditions of any
# kind, either express or implied.  Use of these rules is at your own risk.

# File: 80_SS_Phish.cf
# Auto-generated: 2008-08-08 11:28:03 UTC
# Rule count: 9017

# Html.Phishing.Sanesecurity.TestSig
body     SS_PHISH_TEST /<sanesecurity>dr1aylariadiax!_!lebr_awoewiehi5s1oapro8yl\#chlac7iutoezouqluviud<\/sanesecurity>/i
describe SS_PHISH_TEST SaneSecurity: HTML-based phishing test signature
score    SS_PHISH_TEST 0.001

# Email.Sanesecurity.TestSig_Type4_Hdr
rawbody  SS_TEST4H /Subject:.{0,30}rrg63Uhj2UCyECcruX7D83A4qd5UA5vnlgwJp6b6fmPZpObZJAbftehuhRAXFby/i
describe SS_TEST4H SaneSecurity: Text-based phishing test signature
score    SS_TEST4H 0.001

# Email.Sanesecurity.TestSig_Type4_Bdy
rawbody  SS_TEST4B /body_rrg63Uhj2UCyECcruX7D83A4qd5UA5vnlgwJp6b6fmPZ0ajdjkwjnSSDfsdfsdfnwerd/i
describe SS_TEST4B SaneSecurity: Text-based phishing test signature
score    SS_TEST4B 0.001

# Html.Sanesecurity.TestSig_Type3_Bdy
body     SS_TEST3B /body_rrg63uhj2ucyeccrux7d83a4qd5ua5vnlgwjp6b6fmpzpobzjabftehuhraxfbyzzzzz/i
describe SS_TEST3B SaneSecurity: HTML-based phishing test signature
score    SS_TEST3B 0.001

# Html.Phishing.Rdi.Gen001.Sanesecurity.06030200
body     SS_PHISH_RDI_G001_06030200 /verify your account by logging into.{0,300}http:\/\/google\.com\/url\?sa=p/i
describe SS_PHISH_RDI_G001_06030200 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G001_06030200 0.001

# Html.Phishing.Rdi.Gen002.Sanesecurity.06030201
body     SS_PHISH_RDI_G002_06030201 /update your settings.{0,300}http:\/\/google\.com\/url\?sa=p/i
describe SS_PHISH_RDI_G002_06030201 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G002_06030201 0.001

# Html.Phishing.Rdi.Gen003.Sanesecurity.06030202
body     SS_PHISH_RDI_G003_06030202 /the link below.{0,300}http:\/\/google\.com\/url\?sa=p/i
describe SS_PHISH_RDI_G003_06030202 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G003_06030202 0.001

# Html.Phishing.Rdi.Gen004.Sanesecurity.06031300
body     SS_PHISH_RDI_G004_06031300 /<td align="middle"><a href="http:\/\/rds\.yahoo\.com\/_ylt=.{0,100}target="_blank"><img alt="respond now"/i
describe SS_PHISH_RDI_G004_06031300 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G004_06031300 0.001

# Html.Phishing.Rdi.Gen005.Sanesecurity.06031301
body     SS_PHISH_RDI_G005_06031301 /account active, click here:.{0,50}href="http:\/\/rds\.yahoo\.com\/_ylt/i
describe SS_PHISH_RDI_G005_06031301 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G005_06031301 0.001

# Html.Phishing.Rdi.Gen006.Sanesecurity.06031500
body     SS_PHISH_RDI_G006_06031500 /href="http:\/\/rds\.yahoo\.com\/_ylt=.{0,100}src="http:\/\/pics\.ebaystatic/i
describe SS_PHISH_RDI_G006_06031500 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G006_06031500 0.001

# Html.Phishing.Rdi.Gen007.Sanesecurity.06031501
body     SS_PHISH_RDI_G007_06031501 /click here.{0,50}href="http:\/\/rds\.yahoo\.com\/s=/i
describe SS_PHISH_RDI_G007_06031501 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G007_06031501 0.001

# Html.Phishing.Rdi.Gen008.Sanesecurity.06031502
body     SS_PHISH_RDI_G008_06031502 /your registered name is included to show this message originated from ebay\..{0,50}http:\/\/rds\.yahoo\.com\/_ylt/i
describe SS_PHISH_RDI_G008_06031502 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G008_06031502 0.001

# Html.Phishing.Rdi.Gen009.Sanesecurity.06031503
body     SS_PHISH_RDI_G009_06031503 /following link:.{0,100}href="http:\/\/rds\.yahoo\.com\/_ylt=/i
describe SS_PHISH_RDI_G009_06031503 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G009_06031503 0.001

# Html.Phishing.Rdi.Gen010.Sanesecurity.06032400
body     SS_PHISH_RDI_G010_06032400 /to see your message: <ul><li><a target=3d"_blank" href=3d"http:\/\/rds\.yahoo\.com\/_ylt/i
describe SS_PHISH_RDI_G010_06032400 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G010_06032400 0.001

# Html.Phishing.Rdi.Gen012.Sanesecurity.06032800
body     SS_PHISH_RDI_G012_06032800 /if you don't agree with this e-mail and if you need assistance with your account.{0,500}href="http:\/\/www\.google\.com\/url\?sa=u\&start=4\&q=http:\/\//i
describe SS_PHISH_RDI_G012_06032800 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G012_06032800 0.001

# Html.Phishing.Rdi.Gen013.Sanesecurity.06032801
body     SS_PHISH_RDI_G013_06032801 /<a href="http:\/\/www\.google\.com\/pagead\/iclk\?sa=.{0,200}https:\/\/www\.chase\.com\//i
describe SS_PHISH_RDI_G013_06032801 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G013_06032801 0.001

# Html.Phishing.Rdi.Gen014.Sanesecurity.06032900
body     SS_PHISH_RDI_G014_06032900 /please confirm your identity here: <a href="http:\/\/www\.google\.com\/url\?sa=u\&start=4\&q=/i
describe SS_PHISH_RDI_G014_06032900 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G014_06032900 0.001

# Html.Phishing.Rdi.Gen015.Sanesecurity.06032901
body     SS_PHISH_RDI_G015_06032901 /if you don't agree with this e-mail and if you need assistance with your account <b><a target="_blank" href="http:\/\/www\.google\.com\/url\?sa=u\&start=4\&q=/i
describe SS_PHISH_RDI_G015_06032901 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G015_06032901 0.001

# Html.Phishing.Rdi.Gen016.Sanesecurity.06032300
body     SS_PHISH_RDI_G016_06032300 /br><br>to see your message: <ul><li><a target="_blank" href="http:\/\/rds\.yahoo\.com\/_ylt/i
describe SS_PHISH_RDI_G016_06032300 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G016_06032300 0.001

# Html.Phishing.Rdi.Gen017.Sanesecurity.06033100
body     SS_PHISH_RDI_G017_06033100 /log into your account and follow the instructions\.<\/strong><\/font><\/p><p align=left><br><a href="http:\/\/www\.google\.com\/pagead\/iclk\?sa=/i
describe SS_PHISH_RDI_G017_06033100 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G017_06033100 0.001

# Html.Phishing.Rdi.Gen018.Sanesecurity.06033101
body     SS_PHISH_RDI_G018_06033101 /protect yourself from spoof \(fake\) emails at:<br><a href="http:\/\/rds\.yahoo\.com\/_ylt/i
describe SS_PHISH_RDI_G018_06033101 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G018_06033101 0.001

# Html.Phishing.Rdi.Gen019.Sanesecurity.06040500
body     SS_PHISH_RDI_G019_06040500 /click on the link below to confirm your information.{0,100}<a href="http:\/\/rds\.yahoo\.com\/_ylt=/i
describe SS_PHISH_RDI_G019_06040500 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G019_06040500 0.001

# Html.Phishing.Rdi.Gen020.Sanesecurity.06040700
body     SS_PHISH_RDI_G020_06040700 /<br>login to your <a target="_blank" href="http:\/\/www\.google\.com\/url\?sa=u\&start=4\&q=/i
describe SS_PHISH_RDI_G020_06040700 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G020_06040700 0.001

# Html.Phishing.Rdi.Gen021.Sanesecurity.06041000
body     SS_PHISH_RDI_G021_06041000 /to see your message: <ul><li><a target="_blank" href="http:\/\/rds\.yahoo\.com\/_ylt=/i
describe SS_PHISH_RDI_G021_06041000 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G021_06041000 0.001

# Html.Phishing.Rdi.Gen022.Sanesecurity.06041001
body     SS_PHISH_RDI_G022_06041001 /your account has been<br>\&nbsp\;\&nbsp\; temporarily <a href="http:\/\/www\.google\.com\/url\?q=/i
describe SS_PHISH_RDI_G022_06041001 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G022_06041001 0.001

# Html.Phishing.Rdi.Gen023.Sanesecurity.06042600
body     SS_PHISH_RDI_G023_06042600 /we have<br>\&nbsp\;\&nbsp\; temporarily <a href="http:\/\/www\.google\.com\/url\?q=http:\/\//i
describe SS_PHISH_RDI_G023_06042600 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G023_06042600 0.001

# Html.Phishing.Rdi.Gen024.Sanesecurity.06042601
body     SS_PHISH_RDI_G024_06042601 /online banking please\&nbsp\;<a href="http:\/\/www\.google\.com\/url\?q=/i
describe SS_PHISH_RDI_G024_06042601 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G024_06042601 0.001

# Html.Phishing.Rdi.Gen025.Sanesecurity.06060700
body     SS_PHISH_RDI_G025_06060700 /\/\.-\/redirection\.to\./i
describe SS_PHISH_RDI_G025_06060700 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G025_06060700 0.001

# Html.Phishing.Rdi.Gen026.Sanesecurity.06061200
body     SS_PHISH_RDI_G026_06061200 /<a target="_blank" href="http:\/\/rds\.yahoo\..{0,200}\/www\.citybank\.com/i
describe SS_PHISH_RDI_G026_06061200 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G026_06061200 0.001

# Html.Phishing.Rdi.Gen027.Sanesecurity.06061201
body     SS_PHISH_RDI_G027_06061201 /to confirm your account status please <a href="http:\/\/www\.google\.com\/url\?q=http:\/\//i
describe SS_PHISH_RDI_G027_06061201 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G027_06061201 0.001

# Html.Phishing.Rdi.Gen028.Sanesecurity.06061600
body     SS_PHISH_RDI_G028_06061600 /<a href="http:\/\/.{0,50}redirect-to-signin-ebay-/i
describe SS_PHISH_RDI_G028_06061600 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G028_06061600 0.001

# Html.Phishing.Rdi.Gen029.Sanesecurity.06062300
body     SS_PHISH_RDI_G029_06062300 /verify your account by logging into your paypal account at <a href="http:\/\/www\.google\.com\/pagead\//i
describe SS_PHISH_RDI_G029_06062300 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G029_06062300 0.001

# Html.Phishing.Rdi.Gen030.Sanesecurity.06062301
body     SS_PHISH_RDI_G030_06062301 /respond to this question in my messages.{0,200}<a href="http:\/\/rds\.yahoo\./i
describe SS_PHISH_RDI_G030_06062301 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G030_06062301 0.001

# Html.Phishing.Rdi.Gen031.Sanesecurity.06062400
body     SS_PHISH_RDI_G031_06062400 /your registered name is included to show this message originated from ebay\. <a href="http:\/\/www\.google\.com\/pagead\//i
describe SS_PHISH_RDI_G031_06062400 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G031_06062400 0.001

# Html.Phishing.Rdi.Gen032.Sanesecurity.06062500
body     SS_PHISH_RDI_G032_06062500 /\/redirect\/\.\.\.\/domain=signin\.ebay/i
describe SS_PHISH_RDI_G032_06062500 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G032_06062500 0.001

# Html.Phishing.Rdi.Gen033.Sanesecurity.06062700
body     SS_PHISH_RDI_G033_06062700 /please click on the link bellow:<br><br><br><\/font><a target="_blank" href="http:\/\/rds\.yahoo\./i
describe SS_PHISH_RDI_G033_06062700 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G033_06062700 0.001

# Html.Phishing.Rdi.Gen034.Sanesecurity.06062701
body     SS_PHISH_RDI_G034_06062701 /please click on the link bellow:<br><br><br><\/font><a target="_blank" href="http:\/\/www\.google\./i
describe SS_PHISH_RDI_G034_06062701 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G034_06062701 0.001

# Html.Phishing.Rdi.Gen035.Sanesecurity.06070700
body     SS_PHISH_RDI_G035_06070700 /banking online\.<\/p><p><a style="color: \#0000ff" href="http:\/\/rds\.yahoo\./i
describe SS_PHISH_RDI_G035_06070700 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G035_06070700 0.001

# Html.Phishing.Rdi.Gen036.Sanesecurity.06070701
body     SS_PHISH_RDI_G036_06070701 /href="http:\/\/www\.google\.com\/url.{0,50}loginmember\.do/i
describe SS_PHISH_RDI_G036_06070701 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G036_06070701 0.001

# Html.Phishing.Rdi.Gen037.Sanesecurity.06070900
body     SS_PHISH_RDI_G037_06070900 /this message originated from ebay\. <a href="http:\/\/google\.com\/url\?/i
describe SS_PHISH_RDI_G037_06070900 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G037_06070900 0.001

# Html.Phishing.Rdi.Gen038.Sanesecurity.06070901
body     SS_PHISH_RDI_G038_06070901 /respond to this question in my messages\.<\/b><\/font><\/td><\/tr><tr><td align="center"><a href="http:\/\/google\.com\/url/i
describe SS_PHISH_RDI_G038_06070901 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G038_06070901 0.001

# Html.Phishing.Rdi.Gen039.Sanesecurity.06071100
body     SS_PHISH_RDI_G039_06071100 /verification check\.<br>please <a href="http:\/\/www\.google\.com\/url\?/i
describe SS_PHISH_RDI_G039_06071100 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G039_06071100 0.001

# Html.Phishing.Rdi.Gen040.Sanesecurity.06071200
body     SS_PHISH_RDI_G040_06071200 /records click on the following link: <\/p><p><a href="http:\/\/www\.google\.com\/url\?sa/i
describe SS_PHISH_RDI_G040_06071200 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G040_06071200 0.001

# Html.Phishing.Rdi.Gen041.Sanesecurity.06071400
body     SS_PHISH_RDI_G041_06071400 /"http:\/\/www\.google\.de\/url\?q=.{0,50}ebayisapi/i
describe SS_PHISH_RDI_G041_06071400 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G041_06071400 0.001

# Html.Phishing.Rdi.Gen042.Sanesecurity.06072100
body     SS_PHISH_RDI_G042_06072100 /src="http:\/\/images\.google\.com\/images\?q.{0,150}wamu/i
describe SS_PHISH_RDI_G042_06072100 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G042_06072100 0.001

# Html.Phishing.Rdi.Gen043.Sanesecurity.06072300
body     SS_PHISH_RDI_G043_06072300 /paypal\.com\/en_us\/i\/scr\/pixel\.gif" width="1" height="1" \/><a target="_blank" href="http:\/\/www\.google\.c/i
describe SS_PHISH_RDI_G043_06072300 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G043_06072300 0.001

# Html.Phishing.Rdi.Gen044.Sanesecurity.06072400
body     SS_PHISH_RDI_G044_06072400 /please confirm your identity and <a target="_blank" href="http:\/\/www\.google\.com\/url\?/i
describe SS_PHISH_RDI_G044_06072400 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G044_06072400 0.001

# Html.Phishing.Rdi.Gen045.Sanesecurity.06072401
body     SS_PHISH_RDI_G045_06072401 /click on the link bellow:<br><br><br><\/font><a target="_blank" _ _ _ _ _ _ href="http:\/\/rds\.yahoo\.com\/_/i
describe SS_PHISH_RDI_G045_06072401 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G045_06072401 0.001

# Html.Phishing.Rdi.Gen046.Sanesecurity.06072500
body     SS_PHISH_RDI_G046_06072500 /as a new email address for<br>your paypal account\..{0,500}href="http:\/\/www\.google\.com\/pagead\/iclk/i
describe SS_PHISH_RDI_G046_06072500 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G046_06072500 0.001

# Html.Phishing.Rdi.Gen047.Sanesecurity.06080200
body     SS_PHISH_RDI_G047_06080200 /\/redirect\.to\/www\.bankofamerica/i
describe SS_PHISH_RDI_G047_06080200 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G047_06080200 0.001

# Html.Phishing.Rdi.Gen048.Sanesecurity.06080201
body     SS_PHISH_RDI_G048_06080201 /\/\.redirect\.to\.cgi1\.ebay\.com/i
describe SS_PHISH_RDI_G048_06080201 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G048_06080201 0.001

# Html.Phishing.Rdi.Gen049.Sanesecurity.06080202
body     SS_PHISH_RDI_G049_06080202 /\/redirect\.to\.signin\.ebay/i
describe SS_PHISH_RDI_G049_06080202 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G049_06080202 0.001

# Html.Phishing.Rdi.Gen050.Sanesecurity.06080203
body     SS_PHISH_RDI_G050_06080203 /\/redirect\.to\/www\.paypal/i
describe SS_PHISH_RDI_G050_06080203 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G050_06080203 0.001

# Html.Phishing.Rdi.Gen051.Sanesecurity.06080300
body     SS_PHISH_RDI_G051_06080300 /<label for=bank_routing>routing number<\/label>:.{0,100}src="http:\/\/images\.google\./i
describe SS_PHISH_RDI_G051_06080300 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G051_06080300 0.001

# Html.Phishing.Rdi.Gen052.Sanesecurity.06080400
body     SS_PHISH_RDI_G052_06080400 /href="http:\/\/www\.google\.com\/url\?q.{0,100}\.ebay\./i
describe SS_PHISH_RDI_G052_06080400 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G052_06080400 0.001

# Html.Phishing.Rdi.Gen053.Sanesecurity.06080401
body     SS_PHISH_RDI_G053_06080401 /href="http:\/\/www\.google\.com\/url\?q.{0,100}\.paypal\./i
describe SS_PHISH_RDI_G053_06080401 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G053_06080401 0.001

# Html.Phishing.Rdi.Gen054.Sanesecurity.06080700
body     SS_PHISH_RDI_G054_06080700 /<a href="http:\/\/www\.google\.com\/url\?.{0,200}take the survey!/i
describe SS_PHISH_RDI_G054_06080700 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G054_06080700 0.001

# Html.Phishing.Rdi.Gen055.Sanesecurity.06080800
body     SS_PHISH_RDI_G055_06080800 /http:\/\/www\.google\.com\/url\?q.{0,100}enrollment procedure/i
describe SS_PHISH_RDI_G055_06080800 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G055_06080800 0.001

# Html.Phishing.Rdi.Gen056.Sanesecurity.06080900
body     SS_PHISH_RDI_G056_06080900 /src="http:\/\/images\.google\.com\/images\?q.{0,4000}verification proccess/i
describe SS_PHISH_RDI_G056_06080900 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G056_06080900 0.001

# Html.Phishing.Rdi.Gen057.Sanesecurity.06081300
body     SS_PHISH_RDI_G057_06081300 /http:\/\/maps\.google\.com\/local_url\?q=http:\/\/.{0,100}paypal/i
describe SS_PHISH_RDI_G057_06081300 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G057_06081300 0.001

# Html.Phishing.Rdi.Gen058.Sanesecurity.06081301
body     SS_PHISH_RDI_G058_06081301 /http:\/\/maps\.google\.com\/local_url\?q=http:\/\/.{0,100}ebay\x0d\x0a/i
describe SS_PHISH_RDI_G058_06081301 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G058_06081301 0.001

# Html.Phishing.Rdi.Gen059.Sanesecurity.06081302
body     SS_PHISH_RDI_G059_06081302 /http:\/\/maps\.google\.com\/local_url\?q=http:\/\/.{0,100}chase\x0d\x0a/i
describe SS_PHISH_RDI_G059_06081302 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G059_06081302 0.001

# Html.Phishing.Rdi.Gen060.Sanesecurity.06081400
body     SS_PHISH_RDI_G060_06081400 /href="http:\/\/rds\.yahoo\.com\/_y.{0,150}\/www\.paypal\.com\//i
describe SS_PHISH_RDI_G060_06081400 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G060_06081400 0.001

# Html.Phishing.Rdi.Gen061.Sanesecurity.06081500
body     SS_PHISH_RDI_G061_06081500 /href="http:\/\/www\.google\.com\/pagead\/iclk.{0,300}\/www\.paypal\./i
describe SS_PHISH_RDI_G061_06081500 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G061_06081500 0.001

# Html.Phishing.Rdi.Gen062.Sanesecurity.06081501
body     SS_PHISH_RDI_G062_06081501 /href="http:\/\/www\.google\.com\/pagead\/iclk.{0,300}\/www\.ebay\./i
describe SS_PHISH_RDI_G062_06081501 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G062_06081501 0.001

# Html.Phishing.Rdi.Gen063.Sanesecurity.06081600
body     SS_PHISH_RDI_G063_06081600 /href="http:\/\/rds\.yahoo\.com\/_y.{0,300}wachovia/i
describe SS_PHISH_RDI_G063_06081600 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G063_06081600 0.001

# Html.Phishing.Rdi.Gen064.Sanesecurity.06082100
body     SS_PHISH_RDI_G064_06082100 /href="http:\/\/rds\.yahoo\.com\/_y.{0,300}paypal/i
describe SS_PHISH_RDI_G064_06082100 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G064_06082100 0.001

# Html.Phishing.Rdi.Gen065.Sanesecurity.06082500
body     SS_PHISH_RDI_G065_06082500 /<a href="http:\/\/www\.google\..{0,100}\/www\.centralmnfcu\.org\//i
describe SS_PHISH_RDI_G065_06082500 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G065_06082500 0.001

# Html.Phishing.Rdi.Gen066.Sanesecurity.06082501
body     SS_PHISH_RDI_G066_06082501 /<a href="http:\/\/www\.google\..{0,100}\/www\.eonlinebank\.com\//i
describe SS_PHISH_RDI_G066_06082501 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G066_06082501 0.001

# Html.Phishing.Rdi.Gen067.Sanesecurity.06082800
body     SS_PHISH_RDI_G067_06082800 /http:\/\/rds\.yahoo\.com\/_ylt=.{0,350}\/www\.amazon\.com\//i
describe SS_PHISH_RDI_G067_06082800 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G067_06082800 0.001

# Html.Phishing.Rdi.Gen068.Sanesecurity.06082801
body     SS_PHISH_RDI_G068_06082801 /http:\/\/www\.google\.com\/url\?q.{0,350}\/www\.amazon\.com\//i
describe SS_PHISH_RDI_G068_06082801 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G068_06082801 0.001

# Html.Phishing.Rdi.Gen069.Sanesecurity.06090600
body     SS_PHISH_RDI_G069_06090600 /href="http:\/\/www\.google\.com\/pagead\/iclk.{0,300}\/webscr/i
describe SS_PHISH_RDI_G069_06090600 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G069_06090600 0.001

# Html.Phishing.Rdi.Gen070.Sanesecurity.06090601
body     SS_PHISH_RDI_G070_06090601 /href="http:\/\/www\.google\.com\/pagead\/iclk.{0,300}paypal/i
describe SS_PHISH_RDI_G070_06090601 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G070_06090601 0.001

# Html.Phishing.Rdi.Gen071.Sanesecurity.06090602
body     SS_PHISH_RDI_G071_06090602 /href="http:\/\/www\.google\.com\/pagead\/iclk.{0,300}ebay/i
describe SS_PHISH_RDI_G071_06090602 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G071_06090602 0.001

# Html.Phishing.Rdi.Gen072.Sanesecurity.06092600
body     SS_PHISH_RDI_G072_06092600 /click the link bellow to continue:<br><a href="http:\/\/www\.google\.com\/url\?sa=u\&start=4\&q=http:\/\//i
describe SS_PHISH_RDI_G072_06092600 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G072_06092600 0.001

# Html.Phishing.Rdi.Gen073.Sanesecurity.06101100
body     SS_PHISH_RDI_G073_06101100 /please enroll in our security upgrade by<\/b><a href="http:\/\/www\.google\.com\//i
describe SS_PHISH_RDI_G073_06101100 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G073_06101100 0.001

# Html.Phishing.Rdi.Gen074.Sanesecurity.06102400
body     SS_PHISH_RDI_G074_06102400 /<a href="http:\/\/www\.aol\.com\/ams\/clickthruredirect.{0,150}moneybookers/i
describe SS_PHISH_RDI_G074_06102400 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G074_06102400 0.001

# Html.Phishing.Rdi.Gen075.Sanesecurity.06102401
body     SS_PHISH_RDI_G075_06102401 /<a href="http:\/\/www\.aol\.com\/ams\/clickthruredirect.{0,150}\.ncua\./i
describe SS_PHISH_RDI_G075_06102401 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G075_06102401 0.001

# Html.Phishing.Rdi.Gen076.Sanesecurity.06102402
body     SS_PHISH_RDI_G076_06102402 /<a href="http:\/\/www\.aol\.com\/ams\/clickthruredirect.{0,150}e-gold/i
describe SS_PHISH_RDI_G076_06102402 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G076_06102402 0.001

# Html.Phishing.Rdi.Gen077.Sanesecurity.06102403
body     SS_PHISH_RDI_G077_06102403 /<a href="http:\/\/www\.aol\.com\/ams\/clickthruredirect.{0,150}\.neteller\./i
describe SS_PHISH_RDI_G077_06102403 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G077_06102403 0.001

# Html.Phishing.Rdi.Gen078.Sanesecurity.06102404
body     SS_PHISH_RDI_G078_06102404 /<a href="http:\/\/www\.aol\.com\/ams\/clickthruredirect.{0,150}www\.paypal\.com/i
describe SS_PHISH_RDI_G078_06102404 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G078_06102404 0.001

# Html.Phishing.Rdi.Gen079.Sanesecurity.06102405
body     SS_PHISH_RDI_G079_06102405 /<a href="http:\/\/www\.aol\.com\/ams\/clickthruredirect.{0,150}\.ebay\./i
describe SS_PHISH_RDI_G079_06102405 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G079_06102405 0.001

# Html.Phishing.Rdi.Gen080.Sanesecurity.06120700
body     SS_PHISH_RDI_G080_06120700 /If you did not authorize this change or if you need assistance.{0,150}<a href="http:\/\/www\.google\.com\/url\?sa=/i
describe SS_PHISH_RDI_G080_06120700 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G080_06120700 0.001

# Html.Phishing.Rdi.Gen081.Sanesecurity.06120800
body     SS_PHISH_RDI_G081_06120800 /href.{0,5}http:\/\/www\.google\.com\/pagead\/iclk\?sa.{0,400}\.ebay\./i
describe SS_PHISH_RDI_G081_06120800 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G081_06120800 0.001

# Html.Phishing.Rdi.Gen082.Sanesecurity.06120801
body     SS_PHISH_RDI_G082_06120801 /href.{0,5}http:\/\/www\.google\.com\/pagead\/iclk\?sa.{0,400}\.paypal\./i
describe SS_PHISH_RDI_G082_06120801 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G082_06120801 0.001

# Html.Phishing.Rdi.Gen083.Sanesecurity.06120802
body     SS_PHISH_RDI_G083_06120802 /href.{0,5}http:\/\/www\.google\.com\/pagead\/iclk\?sa.{0,400}\.chase\.com/i
describe SS_PHISH_RDI_G083_06120802 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G083_06120802 0.001

# Html.Phishing.Rdi.Gen084.Sanesecurity.07011300
body     SS_PHISH_RDI_G084_07011300 /will verify your identity.*http:\/\/maps\.google\.com\/local_url\?q/i
describe SS_PHISH_RDI_G084_07011300 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G084_07011300 0.001

# Html.Phishing.Rdi.Gen085.Sanesecurity.07051800
body     SS_PHISH_RDI_G085_07051800 /http:\/\/rds\.yahoo\.com\/_ylt=.{0,300}ebay/i
describe SS_PHISH_RDI_G085_07051800 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G085_07051800 0.001

# Html.Phishing.Rdi.Gen086.Sanesecurity.07051801
body     SS_PHISH_RDI_G086_07051801 /http:\/\/www\.aol\.com\/redir\.adp\?_url=http:\/\/.{0,300}paypal/i
describe SS_PHISH_RDI_G086_07051801 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G086_07051801 0.001

# Html.Phishing.Rdi.Gen087.Sanesecurity.07052900
body     SS_PHISH_RDI_G087_07052900 /href="http:\/\/us\.ebayobjects\.com\/6k\;h=http:\/\/(0|1|2|3|4|5|6|7|8|9)/i
describe SS_PHISH_RDI_G087_07052900 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G087_07052900 0.001

# Html.Phishing.Jsc.Gen000.Sanesecurity.06030100
rawbody  SS_PHISH_JSC_G000_06030100 /isit our.{0,10}<a href="javascript:ol\('http:\/\/clic/i
describe SS_PHISH_JSC_G000_06030100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_JSC_G000_06030100 0.001

# Html.Phishing.Onf.Gen001.Sanesecurity.06030101
body     SS_PHISH_ONF_G001_06030101 /target=_blank onfiltered="return opennonhelpwindow\(this/i
describe SS_PHISH_ONF_G001_06030101 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_ONF_G001_06030101 0.001

# Html.Phishing.Hex.Gen001.Sanesecurity.06041400
body     SS_PHISH_HEX_G001_06041400 /http:\/\/0x.{0,2}\.0x.{0,2}\.0x/i
describe SS_PHISH_HEX_G001_06041400 SaneSecurity: HTML-based links contain hex
score    SS_PHISH_HEX_G001_06041400 0.001

# Email.Phishing.Hex.Gen002.Sanesecurity.06041401
rawbody  SS_PHISH_HEX_G002_06041401 /http:\/\/0x.{0,2}\.0x.{0,2}\.0x/i
describe SS_PHISH_HEX_G002_06041401 SaneSecurity: Text-based links contain hex
score    SS_PHISH_HEX_G002_06041401 0.001

# Html.Phishing.Hex.Gen003.Sanesecurity.06070700
body     SS_PHISH_HEX_G003_06070700 /<a href="http:\/\/0xd.{0,50}\/chaseonline\.chase\.com/i
describe SS_PHISH_HEX_G003_06070700 SaneSecurity: HTML-based links contain hex
score    SS_PHISH_HEX_G003_06070700 0.001

# Html.Phishing.Hex.Gen004.Sanesecurity.06080700
body     SS_PHISH_HEX_G004_06080700 /to get started, please follow the link below: <b><a target="_blank" href="http:\/\/0x/i
describe SS_PHISH_HEX_G004_06080700 SaneSecurity: HTML-based links contain hex
score    SS_PHISH_HEX_G004_06080700 0.001

# Email.Phishing.Hex.Gen005.Sanesecurity.06122300
rawbody  SS_PHISH_HEX_G005_06122300 /eBay\. <A href="http:\/\/0x/i
describe SS_PHISH_HEX_G005_06122300 SaneSecurity: Text-based links contain hex
score    SS_PHISH_HEX_G005_06122300 0.001

# Html.Phishing.Hex.Gen006.Sanesecurity.06122800
body     SS_PHISH_HEX_G006_06122800 /href=3d"http:\/\/0x.{0,150}ebayisapi/i
describe SS_PHISH_HEX_G006_06122800 SaneSecurity: HTML-based links contain hex
score    SS_PHISH_HEX_G006_06122800 0.001

# Html.Phishing.Hex.Gen007.Sanesecurity.07011000
body     SS_PHISH_HEX_G007_07011000 /registered email address is included to show this message originated from eBay\. <a href="http:\/\/0x/i
describe SS_PHISH_HEX_G007_07011000 SaneSecurity: HTML-based links contain hex
score    SS_PHISH_HEX_G007_07011000 0.001

# Html.Phishing.Hex.Gen008.Sanesecurity.07022300
body     SS_PHISH_HEX_G008_07022300 /<a href="http:\/\/0x.{0,250}online account/i
describe SS_PHISH_HEX_G008_07022300 SaneSecurity: HTML-based links contain hex
score    SS_PHISH_HEX_G008_07022300 0.001

# Html.Phishing.Hex.Gen009.Sanesecurity.07052900
body     SS_PHISH_HEX_G009_07052900 /http:\/\/0x.*http:\/\/pics\.ebaystatic/i
describe SS_PHISH_HEX_G009_07052900 SaneSecurity: HTML-based links contain hex
score    SS_PHISH_HEX_G009_07052900 0.001

# Email.Phishing.Hex.Gen010.Sanesecurity.07122700.pdf
rawbody  SS_PHISH_HEX_G010_07122700_PDF /\%PDF-.*\/A<<\/Type\/Action\/S\/URI\/URI\(http:\/\/0x/i
describe SS_PHISH_HEX_G010_07122700_PDF SaneSecurity: Text-based links contain hex
score    SS_PHISH_HEX_G010_07122700_PDF 0.001

# Html.Phishing.Cur.Gen001.Sanesecurity.06050700
body     SS_PHISH_CUR_G001_06050700 /http:\/\/dsl-.{0,30}prod-empresarial\.com\.mx/i
describe SS_PHISH_CUR_G001_06050700 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G001_06050700 0.001

# Html.Phishing.Cur.Gen002.Sanesecurity.06050701
body     SS_PHISH_CUR_G002_06050701 /http:\/\/dsl-.{0,50}\/paypal\//i
describe SS_PHISH_CUR_G002_06050701 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G002_06050701 0.001

# Html.Phishing.Cur.Gen003.Sanesecurity.06050702
body     SS_PHISH_CUR_G003_06050702 /http:\/\/dsl-.{0,50}\/online\.wamu\.com\//i
describe SS_PHISH_CUR_G003_06050702 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G003_06050702 0.001

# Html.Phishing.Cur.Gen004.Sanesecurity.06050703
body     SS_PHISH_CUR_G004_06050703 /http:\/\/static-.{0,50}\/paypal\//i
describe SS_PHISH_CUR_G004_06050703 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G004_06050703 0.001

# Html.Phishing.Cur.Gen005.Sanesecurity.06051500
body     SS_PHISH_CUR_G005_06051500 /http:\/\/dsl-.{0,50}\/online\.wamu\.com\//i
describe SS_PHISH_CUR_G005_06051500 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G005_06051500 0.001

# Html.Phishing.Cur.Gen006.Sanesecurity.06052000
body     SS_PHISH_CUR_G006_06052000 /http:\/\/.{0,20}\/horde\/.{0,30}webscr/i
describe SS_PHISH_CUR_G006_06052000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G006_06052000 0.001

# Html.Phishing.Cur.Gen007.Sanesecurity.06052001
body     SS_PHISH_CUR_G007_06052001 /http:\/\/.{0,20}\/horde\/.{0,30}ebay/i
describe SS_PHISH_CUR_G007_06052001 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G007_06052001 0.001

# Html.Phishing.Cur.Gen008.Sanesecurity.06052002
body     SS_PHISH_CUR_G008_06052002 /http:\/\/.{0,20}\/horde\/.{0,30}chase/i
describe SS_PHISH_CUR_G008_06052002 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G008_06052002 0.001

# Html.Phishing.Cur.Gen009.Sanesecurity.06052003
body     SS_PHISH_CUR_G009_06052003 /http:\/\/.{0,20}\/horde\/.{0,30}paypal/i
describe SS_PHISH_CUR_G009_06052003 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G009_06052003 0.001

# Html.Phishing.Cur.Gen010.Sanesecurity.06071100
body     SS_PHISH_CUR_G010_06071100 /\.rr\.com2\&puserid=\&siteid=0\&pagetype=\.\.\." target=_blank><font color=\#003399>view the dispute thread to respond/i
describe SS_PHISH_CUR_G010_06071100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G010_06071100 0.001

# Html.Phishing.Cur.Gen011.Sanesecurity.06071101
body     SS_PHISH_CUR_G011_06071101 /item \#300005830966<br><br><a href="http:\/\/cpe/i
describe SS_PHISH_CUR_G011_06071101 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G011_06071101 0.001

# Html.Phishing.Cur.Gen012.Sanesecurity.06071300
body     SS_PHISH_CUR_G012_06071300 /<a href="http:\/\/.{0,30}\/sitebuilder\/.{0,30}\.bankofamerica/i
describe SS_PHISH_CUR_G012_06071300 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G012_06071300 0.001

# Html.Phishing.Cur.Gen013.Sanesecurity.06071301
body     SS_PHISH_CUR_G013_06071301 /<a href="http:\/\/.{0,30}\/sitebuilder\/.{0,30}\.chase\.com/i
describe SS_PHISH_CUR_G013_06071301 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G013_06071301 0.001

# Html.Phishing.Cur.Gen014.Sanesecurity.06071302
body     SS_PHISH_CUR_G014_06071302 /http:\/\/.{0,20}\/horde\/.{0,30}bellsouth/i
describe SS_PHISH_CUR_G014_06071302 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G014_06071302 0.001

# Html.Phishing.Cur.Gen015.Sanesecurity.06071303
body     SS_PHISH_CUR_G015_06071303 /http:\/\/.{0,50}\/~.{0,100}\/ebayisapi_dll/i
describe SS_PHISH_CUR_G015_06071303 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G015_06071303 0.001

# Html.Phishing.Cur.Gen016.Sanesecurity.06071304
body     SS_PHISH_CUR_G016_06071304 /<!-- saved from url=\(0080\)https:\/\/www\.paypal\.com\/us\//i
describe SS_PHISH_CUR_G016_06071304 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G016_06071304 0.001

# Html.Phishing.Cur.Gen017.Sanesecurity.06071305
body     SS_PHISH_CUR_G017_06071305 /src="http:\/\/0x.{0,30}paypal/i
describe SS_PHISH_CUR_G017_06071305 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G017_06071305 0.001

# Html.Phishing.Cur.Gen018.Sanesecurity.06071306
body     SS_PHISH_CUR_G018_06071306 /http:\/\/0x.{0,30}chase/i
describe SS_PHISH_CUR_G018_06071306 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G018_06071306 0.001

# Html.Phishing.Cur.Gen019.Sanesecurity.06071307
body     SS_PHISH_CUR_G019_06071307 /http:\/\/0x.{0,30}bank/i
describe SS_PHISH_CUR_G019_06071307 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G019_06071307 0.001

# Html.Phishing.Cur.Gen020.Sanesecurity.06071308
body     SS_PHISH_CUR_G020_06071308 /\.imageshack\.us\/img.{0,300}credit union/i
describe SS_PHISH_CUR_G020_06071308 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G020_06071308 0.001

# Html.Phishing.Cur.Gen020.Sanesecurity.06071308
body     SS_PHISH_CUR_G020_06071308 /\.imageshack\.us\/img.{0,300}paypal/i
describe SS_PHISH_CUR_G020_06071308 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G020_06071308 0.001

# Html.Phishing.Cur.Gen021.Sanesecurity.06071400
body     SS_PHISH_CUR_G021_06071400 /proxad\.net\/\%20\/aw-cgi\/index\.html/i
describe SS_PHISH_CUR_G021_06071400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G021_06071400 0.001

# Html.Phishing.Cur.Gen022.Sanesecurity.06071800
body     SS_PHISH_CUR_G022_06071800 /http:\/.{0,30}\.250free\.com.{0,200}chase\.com/i
describe SS_PHISH_CUR_G022_06071800 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G022_06071800 0.001

# Html.Phishing.Cur.Gen023.Sanesecurity.06071801
body     SS_PHISH_CUR_G023_06071801 /\.cox\.net:81\/update\/"><img src="http:\/\/images\.paypal/i
describe SS_PHISH_CUR_G023_06071801 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G023_06071801 0.001

# Email.Phishing.Cur.Gen024.Sanesecurity.06071802
rawbody  SS_PHISH_CUR_G024_06071802 /\.cox\.net:81\/update\/index\.php/i
describe SS_PHISH_CUR_G024_06071802 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G024_06071802 0.001

# Html.Phishing.Cur.Gen025.Sanesecurity.06071803
body     SS_PHISH_CUR_G025_06071803 /\.cox\.net:81\/update\/index\.php/i
describe SS_PHISH_CUR_G025_06071803 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G025_06071803 0.001

# Html.Phishing.Cur.Gen026.Sanesecurity.06071804
body     SS_PHISH_CUR_G026_06071804 /http:\/\/.{0,30}\/xampp\/.{0,150}ebay/i
describe SS_PHISH_CUR_G026_06071804 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G026_06071804 0.001

# Html.Phishing.Cur.Gen027.Sanesecurity.06071805
body     SS_PHISH_CUR_G027_06071805 /http:\/\/.{0,30}\/xampp\/.{0,150}paypal/i
describe SS_PHISH_CUR_G027_06071805 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G027_06071805 0.001

# Html.Phishing.Cur.Gen028.Sanesecurity.06071806
body     SS_PHISH_CUR_G028_06071806 /http:\/\/.{0,30}\/xampp\/.{0,150}\/webscr\//i
describe SS_PHISH_CUR_G028_06071806 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G028_06071806 0.001

# Html.Phishing.Cur.Gen028.Sanesecurity.06072100
body     SS_PHISH_CUR_G028_06072100 /http:\/\/.{0,30}hinet\.net.{0,150}secure message center/i
describe SS_PHISH_CUR_G028_06072100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G028_06072100 0.001

# Html.Phishing.Cur.Gen029.Sanesecurity.06072101
body     SS_PHISH_CUR_G029_06072101 /\.comcast\.net:81\/update\/"><img src="http:\/\/images\.paypal/i
describe SS_PHISH_CUR_G029_06072101 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G029_06072101 0.001

# Html.Phishing.Cur.Gen030.Sanesecurity.06072300
body     SS_PHISH_CUR_G030_06072300 /\.dynamic\.cndata\.com\/index\.html"><font color=\#003399>log on to pnc online banking\./i
describe SS_PHISH_CUR_G030_06072300 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G030_06072300 0.001

# Html.Phishing.Cur.Gen031.Sanesecurity.06072301
body     SS_PHISH_CUR_G031_06072301 /\/help\/css\/alltimeonline\.sbbt\.com\/enroll\/index\.htm"><font color=\#003399>log on to/i
describe SS_PHISH_CUR_G031_06072301 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G031_06072301 0.001

# Html.Phishing.Cur.Gen032.Sanesecurity.06072302
body     SS_PHISH_CUR_G032_06072302 /\/phpBB2\/images\/login\/bofa\.com/i
describe SS_PHISH_CUR_G032_06072302 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G032_06072302 0.001

# Html.Phishing.Cur.Gen033.Sanesecurity.06072303
body     SS_PHISH_CUR_G033_06072303 /href=http:\/\/www\.53\.com\.wps\.portal\.secure\./i
describe SS_PHISH_CUR_G033_06072303 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G033_06072303 0.001

# Html.Phishing.Cur.Gen034.Sanesecurity.06072304
body     SS_PHISH_CUR_G034_06072304 /\.dynamic\.cndata\.com\/cuna\/www\.cuna\.org\//i
describe SS_PHISH_CUR_G034_06072304 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G034_06072304 0.001

# Html.Phishing.Cur.Gen035.Sanesecurity.06072400
body     SS_PHISH_CUR_G035_06072400 /http:\/\/.{0,30}\/horde\/services\/.{0,60}\.ebay\./i
describe SS_PHISH_CUR_G035_06072400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G035_06072400 0.001

# Html.Phishing.Cur.Gen036.Sanesecurity.06072401
body     SS_PHISH_CUR_G036_06072401 /\.dynamic\.cndata\.com\/index\.html">online banking/i
describe SS_PHISH_CUR_G036_06072401 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G036_06072401 0.001

# Html.Phishing.Cur.Gen037.Sanesecurity.06072402
body     SS_PHISH_CUR_G037_06072402 /\.comcast\.net:31337\/ws\/ebay/i
describe SS_PHISH_CUR_G037_06072402 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G037_06072402 0.001

# Email.Phishing.Cur.Gen038.Sanesecurity.06072600
rawbody  SS_PHISH_CUR_G038_06072600 /"http:\/\/.{0,30}\.rr\.com.{0,60}www\.paypal\.com/i
describe SS_PHISH_CUR_G038_06072600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G038_06072600 0.001

# Html.Phishing.Cur.Gen039.Sanesecurity.06072601
body     SS_PHISH_CUR_G039_06072601 /http:\/\/.{0,30}\.sbcglobal\.net.{0,30}ebay/i
describe SS_PHISH_CUR_G039_06072601 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G039_06072601 0.001

# Html.Phishing.Cur.Gen040.Sanesecurity.06072700
body     SS_PHISH_CUR_G040_06072700 /<!-- saved from url=\(0081\)https:\/\/www\.paypal\.com/i
describe SS_PHISH_CUR_G040_06072700 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G040_06072700 0.001

# Html.Phishing.Cur.Gen041.Sanesecurity.06072701
body     SS_PHISH_CUR_G041_06072701 /http:\/\/.{0,30}\.comcast\.net.{0,50}visit the resolution center/i
describe SS_PHISH_CUR_G041_06072701 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G041_06072701 0.001

# Html.Phishing.Cur.Gen042.Sanesecurity.06072800
body     SS_PHISH_CUR_G042_06072800 /http:\/\/.{0,30}\/horde\/services\/.{0,30}nationalbank/i
describe SS_PHISH_CUR_G042_06072800 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G042_06072800 0.001

# Html.Phishing.Cur.Gen043.Sanesecurity.06072801
body     SS_PHISH_CUR_G043_06072801 /http:\/\/.{0,30}\.charter\.com.{0,30}ebayisapi/i
describe SS_PHISH_CUR_G043_06072801 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G043_06072801 0.001

# Html.Phishing.Cur.Gen044.Sanesecurity.06072802
body     SS_PHISH_CUR_G044_06072802 /http:\/\/.{0,30}\.cox\.net.{0,30}paypal\.com/i
describe SS_PHISH_CUR_G044_06072802 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G044_06072802 0.001

# Html.Phishing.Cur.Gen045.Sanesecurity.06072803
body     SS_PHISH_CUR_G045_06072803 /http:\/\/.{0,30}\.cox\.net.{0,30}ebayisapi/i
describe SS_PHISH_CUR_G045_06072803 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G045_06072803 0.001

# Html.Phishing.Cur.Gen046.Sanesecurity.06072804
body     SS_PHISH_CUR_G046_06072804 /http:\/\/.{0,30}\.charter\.com.{0,30}paypal\.com/i
describe SS_PHISH_CUR_G046_06072804 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G046_06072804 0.001

# Html.Phishing.Cur.Gen047.Sanesecurity.06073000
body     SS_PHISH_CUR_G047_06073000 /http:\/\/.{0,30}\/horde\/services\/.{0,60}netspend/i
describe SS_PHISH_CUR_G047_06073000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G047_06073000 0.001

# Html.Phishing.Cur.Gen048.Sanesecurity.06073001
body     SS_PHISH_CUR_G048_06073001 /http:\/\/.{0,30}\/horde\/services\/.{0,60}bankfranklin/i
describe SS_PHISH_CUR_G048_06073001 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G048_06073001 0.001

# Html.Phishing.Cur.Gen049.Sanesecurity.06073001
body     SS_PHISH_CUR_G049_06073001 /http:\/\/.{0,30}\/horde\/services\/.{0,200}internet banking/i
describe SS_PHISH_CUR_G049_06073001 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G049_06073001 0.001

# Html.Phishing.Cur.Gen050.Sanesecurity.06073100
body     SS_PHISH_CUR_G050_06073100 /http:\/\/.{0,30}\.rr\.com.{0,60}paypal/i
describe SS_PHISH_CUR_G050_06073100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G050_06073100 0.001

# Html.Phishing.Cur.Gen051.Sanesecurity.06073101
body     SS_PHISH_CUR_G051_06073101 /http:\/\/.{0,200}\.comcast\.net.{0,500}\.wamu\.com/i
describe SS_PHISH_CUR_G051_06073101 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G051_06073101 0.001

# Html.Phishing.Cur.Gen052.Sanesecurity.06080200
body     SS_PHISH_CUR_G052_06080200 /complete the verification.{0,200}<a href="http:\/\/static/i
describe SS_PHISH_CUR_G052_06080200 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G052_06080200 0.001

# Html.Phishing.Cur.Gen053.Sanesecurity.06080201
body     SS_PHISH_CUR_G053_06080201 /<a href="http:\/\/adsl.{0,100}citizens/i
describe SS_PHISH_CUR_G053_06080201 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G053_06080201 0.001

# Html.Phishing.Cur.Gen054.Sanesecurity.06080300
body     SS_PHISH_CUR_G054_06080300 /http:\/\/static-.{0,100}verizon\.net.{0,100}\/www\.paypal\./i
describe SS_PHISH_CUR_G054_06080300 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G054_06080300 0.001

# Html.Phishing.Cur.Gen057.Sanesecurity.06080400
body     SS_PHISH_CUR_G057_06080400 /http:\/\/.{0,50}\/horde\/services\/.{0,60}bank/i
describe SS_PHISH_CUR_G057_06080400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G057_06080400 0.001

# Html.Phishing.Cur.Gen059.Sanesecurity.06080402
body     SS_PHISH_CUR_G059_06080402 /http:\/\/pool.{0,100}learn more/i
describe SS_PHISH_CUR_G059_06080402 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G059_06080402 0.001

# Html.Phishing.Cur.Gen060.Sanesecurity.06080403
body     SS_PHISH_CUR_G060_06080403 /\.comcast\.net\/cgi\.ebay\.com\/index\.htm/i
describe SS_PHISH_CUR_G060_06080403 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G060_06080403 0.001

# Html.Phishing.Cur.Gen061.Sanesecurity.06080500
body     SS_PHISH_CUR_G061_06080500 /href="http:\/\/.{0,50}\/~.{0,100}halifax/i
describe SS_PHISH_CUR_G061_06080500 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G061_06080500 0.001

# Html.Phishing.Cur.Gen062.Sanesecurity.06080501
body     SS_PHISH_CUR_G062_06080501 /http:\/\/static-.{0,30}\.broadviewnet\.net.{0,50}bankofamerica/i
describe SS_PHISH_CUR_G062_06080501 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G062_06080501 0.001

# Html.Phishing.Cur.Gen063.Sanesecurity.06080600
body     SS_PHISH_CUR_G063_06080600 /src="file:\/\/d:\/documents\%20and\%20settings\/safe\%20house\%20-\%201\//i
describe SS_PHISH_CUR_G063_06080600 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G063_06080600 0.001

# Html.Phishing.Cur.Gen064.Sanesecurity.06080601
body     SS_PHISH_CUR_G064_06080601 /\.mail333\.com\/index\.html/i
describe SS_PHISH_CUR_G064_06080601 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G064_06080601 0.001

# Html.Phishing.Cur.Gen065.Sanesecurity.06080602
body     SS_PHISH_CUR_G065_06080602 /http:\/\/adsl.{0,500}online bank account/i
describe SS_PHISH_CUR_G065_06080602 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G065_06080602 0.001

# Html.Phishing.Cur.Gen066.Sanesecurity.06080603
body     SS_PHISH_CUR_G066_06080603 /http:\/\/.{0,50}\/horde\/.{0,150}amazon/i
describe SS_PHISH_CUR_G066_06080603 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G066_06080603 0.001

# Html.Phishing.Cur.Gen067.Sanesecurity.06080604
body     SS_PHISH_CUR_G067_06080604 /http:\/\/.{0,50}\/horde\/.{0,150}paypal/i
describe SS_PHISH_CUR_G067_06080604 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G067_06080604 0.001

# Html.Phishing.Cur.Gen068.Sanesecurity.06080605
body     SS_PHISH_CUR_G068_06080605 /http:\/\/.{0,50}\/horde\/.{0,150}ebay/i
describe SS_PHISH_CUR_G068_06080605 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G068_06080605 0.001

# Html.Phishing.Cur.Gen069.Sanesecurity.06080607
body     SS_PHISH_CUR_G069_06080607 /http:\/\/.{0,50}\/horde\/.{0,150}alaskausa/i
describe SS_PHISH_CUR_G069_06080607 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G069_06080607 0.001

# Html.Phishing.Cur.Gen070.Sanesecurity.06080608
body     SS_PHISH_CUR_G070_06080608 /http:\/\/.{0,50}\/horde\/.{0,150}chase/i
describe SS_PHISH_CUR_G070_06080608 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G070_06080608 0.001

# Html.Phishing.Cur.Gen071.Sanesecurity.06080701
body     SS_PHISH_CUR_G071_06080701 /visit\.gif\?us1142376053" alt="setstats" border="0" width="1" heigh t="1"><\/noscript><img src="http:\/\/geo\.yahoo\.com\/serv\?s=76001524\&t=1142376053/i
describe SS_PHISH_CUR_G071_06080701 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G071_06080701 0.001

# Html.Phishing.Cur.Gen073.Sanesecurity.06080801
body     SS_PHISH_CUR_G073_06080801 /paypal email id pp468<\/span><\/td><\/tr><script type="text\/javascript">document\.write\('\\u/i
describe SS_PHISH_CUR_G073_06080801 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G073_06080801 0.001

# Html.Phishing.Cur.Gen074.Sanesecurity.06080900
body     SS_PHISH_CUR_G074_06080900 /http:\/\/adsl-.{0,150}westernunion/i
describe SS_PHISH_CUR_G074_06080900 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G074_06080900 0.001

# Html.Phishing.Cur.Gen075.Sanesecurity.06080901
body     SS_PHISH_CUR_G075_06080901 /http:\/\/membres\.lycos\..{0,100}\.paypal\.com/i
describe SS_PHISH_CUR_G075_06080901 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G075_06080901 0.001

# Html.Phishing.Cur.Gen076.Sanesecurity.06081000
body     SS_PHISH_CUR_G076_06081000 /http:\/\/.{0,50}\/~.{0,100}isapidll/i
describe SS_PHISH_CUR_G076_06081000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G076_06081000 0.001

# Html.Phishing.Cur.Gen077.Sanesecurity.06081001
body     SS_PHISH_CUR_G077_06081001 /\.optonline\.net\/www\.ebay\.com\//i
describe SS_PHISH_CUR_G077_06081001 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G077_06081001 0.001

# Html.Phishing.Cur.Gen078.Sanesecurity.06081100
body     SS_PHISH_CUR_G078_06081100 /http:\/\/.{0,50}\/horde\/.{0,150}enrollment procedure/i
describe SS_PHISH_CUR_G078_06081100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G078_06081100 0.001

# Html.Phishing.Cur.Gen079.Sanesecurity.06081101
body     SS_PHISH_CUR_G079_06081101 /http:\/\/.{0,50}\/horde\/.{0,150}banking/i
describe SS_PHISH_CUR_G079_06081101 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G079_06081101 0.001

# Html.Phishing.Cur.Gen080.Sanesecurity.06081102
body     SS_PHISH_CUR_G080_06081102 /http:\/\/adsl.{0,150}ebay/i
describe SS_PHISH_CUR_G080_06081102 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G080_06081102 0.001

# Html.Phishing.Cur.Gen081.Sanesecurity.06081103
body     SS_PHISH_CUR_G081_06081103 /http:\/\/adsl.{0,150}paypal/i
describe SS_PHISH_CUR_G081_06081103 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G081_06081103 0.001

# Email.Phishing.Cur.Gen083.Sanesecurity.06081300
rawbody  SS_PHISH_CUR_G083_06081300 /<!-- saved from url=\(0114\)ftp:\/\/sotdgdbj:hammer1\@ftp\.sotdgilde\.de\/www\.sotdgilde\.de\/Barclays-UK\/Barclays-UK\/ibank\.barclays\.co\.uk\/barmail\.html/i
describe SS_PHISH_CUR_G083_06081300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G083_06081300 0.001

# Html.Phishing.Cur.Gen084.Sanesecurity.06081301
body     SS_PHISH_CUR_G084_06081301 /http:\/\/rds\.yahoo\.com\/_https:\/\/ibank\.barclays\.co\.uk\//i
describe SS_PHISH_CUR_G084_06081301 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G084_06081301 0.001

# Html.Phishing.Cur.Gen085.Sanesecurity.06081302
body     SS_PHISH_CUR_G085_06081302 /http:\/\/www\.paypal\.com\.cgi-bin\.us-webscr\.php-cmd\.login-run\./i
describe SS_PHISH_CUR_G085_06081302 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G085_06081302 0.001

# Html.Phishing.Cur.Gen086.Sanesecurity.06081303
body     SS_PHISH_CUR_G086_06081303 /\/\%20\/https:\/www\.halifax-online\.co\.uk\//i
describe SS_PHISH_CUR_G086_06081303 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G086_06081303 0.001

# Html.Phishing.Cur.Gen087.Sanesecurity.06081304
body     SS_PHISH_CUR_G087_06081304 /\/\.\%20\/module\.dll\.php\?customerid/i
describe SS_PHISH_CUR_G087_06081304 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G087_06081304 0.001

# Html.Phishing.Cur.Gen088.Sanesecurity.06081400
body     SS_PHISH_CUR_G088_06081400 /http:\/\/adsl.{0,150}\/www\.cfefcu\.com\//i
describe SS_PHISH_CUR_G088_06081400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G088_06081400 0.001

# Html.Phishing.Cur.Gen089.Sanesecurity.06081500
body     SS_PHISH_CUR_G089_06081500 /http:\/\/.{0,30}singin.{0,5}ebay/i
describe SS_PHISH_CUR_G089_06081500 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G089_06081500 0.001

# Html.Phishing.Cur.Gen091.Sanesecurity.06081800
body     SS_PHISH_CUR_G091_06081800 /http:\/\/ip.{0,30}\.cox\.net.{0,150}ebay/i
describe SS_PHISH_CUR_G091_06081800 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G091_06081800 0.001

# Html.Phishing.Cur.Gen092.Sanesecurity.06081801
body     SS_PHISH_CUR_G092_06081801 /http:\/\/ip.{0,30}\.cox\.net.{0,150}paypal/i
describe SS_PHISH_CUR_G092_06081801 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G092_06081801 0.001

# Html.Phishing.Cur.Gen093.Sanesecurity.06081802
body     SS_PHISH_CUR_G093_06081802 /http:\/\/ip.{0,30}\.cox\.net.{0,150}chase/i
describe SS_PHISH_CUR_G093_06081802 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G093_06081802 0.001

# Html.Phishing.Cur.Gen094.Sanesecurity.06082000
body     SS_PHISH_CUR_G094_06082000 /\/singinviewitemnumber\.ebay\.html" target=/i
describe SS_PHISH_CUR_G094_06082000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G094_06082000 0.001

# Html.Phishing.Cur.Gen095.Sanesecurity.06082100
body     SS_PHISH_CUR_G095_06082100 /http:\/\/.{0,30}\.cableone\.net.{0,150}ebay/i
describe SS_PHISH_CUR_G095_06082100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G095_06082100 0.001

# Html.Phishing.Cur.Gen096.Sanesecurity.06082101
body     SS_PHISH_CUR_G096_06082101 /http:\/\/.{0,30}\.cableone\.net.{0,150}paypal/i
describe SS_PHISH_CUR_G096_06082101 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G096_06082101 0.001

# Html.Phishing.Cur.Gen097.Sanesecurity.06082102
body     SS_PHISH_CUR_G097_06082102 /http:\/\/.{0,30}\.cableone\.net.{0,150}chase/i
describe SS_PHISH_CUR_G097_06082102 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G097_06082102 0.001

# Html.Phishing.Cur.Gen098.Sanesecurity.06082100
body     SS_PHISH_CUR_G098_06082100 /http:\/\/.{0,20}\/horde\/.{0,30}creditunion/i
describe SS_PHISH_CUR_G098_06082100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G098_06082100 0.001

# Html.Phishing.Cur.Gen099.Sanesecurity.06082300
body     SS_PHISH_CUR_G099_06082300 /\/\.login\/index2\.html>www\.ebay\.com/i
describe SS_PHISH_CUR_G099_06082300 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G099_06082300 0.001

# Html.Phishing.Cur.Gen100.Sanesecurity.06082301
body     SS_PHISH_CUR_G100_06082301 /\/\.login\/index2\.html><strong>https:\/\/signin\.ebay\.com\//i
describe SS_PHISH_CUR_G100_06082301 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G100_06082301 0.001

# Html.Phishing.Cur.Gen101.Sanesecurity.06082400
body     SS_PHISH_CUR_G101_06082400 /<a href="http:\/\/.{0,50}\/~.{0,150}\/amazon\//i
describe SS_PHISH_CUR_G101_06082400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G101_06082400 0.001

# Html.Phishing.Cur.Gen102.Sanesecurity.06082401
body     SS_PHISH_CUR_G102_06082401 /<a target="_blank" href="http:\/\/cpe-.{0,150}www\.cuna\.org/i
describe SS_PHISH_CUR_G102_06082401 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G102_06082401 0.001

# Html.Phishing.Cur.Gen103.Sanesecurity.06082800
body     SS_PHISH_CUR_G103_06082800 /visit\.gif\?us1154771428" alt="setstats" border="0" width="1" height="1"><\/noscript><img src="http:\/\/geo\.yahoo\.com\/serv\?s=76001061\&t=1154771428/i
describe SS_PHISH_CUR_G103_06082800 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G103_06082800 0.001

# Html.Phishing.Cur.Gen104.Sanesecurity.06082900
body     SS_PHISH_CUR_G104_06082900 /\/forum\/phpbb2\/.{0,500}online banking/i
describe SS_PHISH_CUR_G104_06082900 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G104_06082900 0.001

# Html.Phishing.Cur.Gen105.Sanesecurity.06090100
body     SS_PHISH_CUR_G105_06090100 /\.dsl\.speakeasy\.net\/bancanetempresarial\.banamex\.com\.mx\//i
describe SS_PHISH_CUR_G105_06090100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G105_06090100 0.001

# Html.Phishing.Cur.Gen106.Sanesecurity.06090200
body     SS_PHISH_CUR_G106_06090200 /http:\/\/www\.yourscamurl\.com\/webscr\/login_submit/i
describe SS_PHISH_CUR_G106_06090200 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G106_06090200 0.001

# Html.Phishing.Cur.Gen107.Sanesecurity.06090300
body     SS_PHISH_CUR_G107_06090300 /<a href="http:\/\/adsl.{0,150}bank/i
describe SS_PHISH_CUR_G107_06090300 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G107_06090300 0.001

# Html.Phishing.Cur.Gen108.Sanesecurity.06090301
body     SS_PHISH_CUR_G108_06090301 /<a href="http:\/\/.{0,150}\.shawcable\.net.{0,150}mfcisapi/i
describe SS_PHISH_CUR_G108_06090301 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G108_06090301 0.001

# Html.Phishing.Cur.Gen109.Sanesecurity.06090302
body     SS_PHISH_CUR_G109_06090302 /<a href="http:\/\/.{0,150}\.shawcable\.net.{0,150}ebay/i
describe SS_PHISH_CUR_G109_06090302 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G109_06090302 0.001

# Html.Phishing.Cur.Gen110.Sanesecurity.06090303
body     SS_PHISH_CUR_G110_06090303 /<a href="http:\/\/.{0,150}\.shawcable\.net.{0,150}paypa/i
describe SS_PHISH_CUR_G110_06090303 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G110_06090303 0.001

# Html.Phishing.Cur.Gen111.Sanesecurity.06090304
body     SS_PHISH_CUR_G111_06090304 /<a href="http:\/\/.{0,150}\.shawcable\.net.{0,150}chase/i
describe SS_PHISH_CUR_G111_06090304 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G111_06090304 0.001

# Email.Phishing.Cur.Gen112.Sanesecurity.06090305
rawbody  SS_PHISH_CUR_G112_06090305 /rid=3Dlouisss00112233\&amp\;reporteduserid=3Dfomocoace\&amp\;emaildate=3D2005/i
describe SS_PHISH_CUR_G112_06090305 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G112_06090305 0.001

# Html.Phishing.Cur.Gen113.Sanesecurity.06090306
body     SS_PHISH_CUR_G113_06090306 /\.adsl-dhcp\.tele\.dk.{0,50}ebay/i
describe SS_PHISH_CUR_G113_06090306 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G113_06090306 0.001

# Html.Phishing.Cur.Gen114.Sanesecurity.06090307
body     SS_PHISH_CUR_G114_06090307 /\.adsl-dhcp\.tele\.dk.{0,50}paypal/i
describe SS_PHISH_CUR_G114_06090307 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G114_06090307 0.001

# Html.Phishing.Cur.Gen115.Sanesecurity.06090500
body     SS_PHISH_CUR_G115_06090500 /<a href="ftp:\/.{0,150}\/signin\.ebay\.com/i
describe SS_PHISH_CUR_G115_06090500 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G115_06090500 0.001

# Html.Phishing.Cur.Gen116.Sanesecurity.06090700
body     SS_PHISH_CUR_G116_06090700 /\/https:\/\/\/www\.paypal\.com\/\//i
describe SS_PHISH_CUR_G116_06090700 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G116_06090700 0.001

# Html.Phishing.Cur.Gen117.Sanesecurity.06090701
body     SS_PHISH_CUR_G117_06090701 /target=_blank rel=nofollow _><font color=\#003399 size=3>150024091558<\/font><\/a>/i
describe SS_PHISH_CUR_G117_06090701 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G117_06090701 0.001

# Email.Phishing.Cur.Gen118.Sanesecurity.06090700
rawbody  SS_PHISH_CUR_G118_06090700 /url=\(0151\)https:\/\/onlineeast\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G118_06090700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G118_06090700 0.001

# Email.Phishing.Cur.Gen119.Sanesecurity.06091000
rawbody  SS_PHISH_CUR_G119_06091000 /<!-- saved from url=3D\(0040\)http:\/\/perkal\.co\.za\/pdf\/chase\//i
describe SS_PHISH_CUR_G119_06091000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G119_06091000 0.001

# Html.Phishing.Cur.Gen121.Sanesecurity.06091200
body     SS_PHISH_CUR_G121_06091200 /\.mail333\.com\/ebayisapi_dll/i
describe SS_PHISH_CUR_G121_06091200 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G121_06091200 0.001

# Email.Phishing.Cur.Gen122.Sanesecurity.06091300
rawbody  SS_PHISH_CUR_G122_06091300 /<!-- saved from url=\(0035\)http:\/\/www\.crdunion\.info\/letter\.htm/i
describe SS_PHISH_CUR_G122_06091300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G122_06091300 0.001

# Email.Phishing.Cur.Gen123.Sanesecurity.06091301
rawbody  SS_PHISH_CUR_G123_06091301 /<!-- saved from url=\(0034\)http:\/\/purplehosting\.com\/chase\.txt/i
describe SS_PHISH_CUR_G123_06091301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G123_06091301 0.001

# Html.Phishing.Cur.Gen124.Sanesecurity.06091302
body     SS_PHISH_CUR_G124_06091302 /\/www\/contactebymemberr\/ebayisapidll/i
describe SS_PHISH_CUR_G124_06091302 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G124_06091302 0.001

# Html.Phishing.Cur.Gen125.Sanesecurity.06091400
body     SS_PHISH_CUR_G125_06091400 /height="1"><img src="sanya_files\/s\.htm" height="1"><\/td><\/tr><tr><td height="50"><img src="http:\/\/www\./i
describe SS_PHISH_CUR_G125_06091400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G125_06091400 0.001

# Html.Phishing.Cur.Gen126.Sanesecurity.06091401
body     SS_PHISH_CUR_G126_06091401 /><font color="bloe"/i
describe SS_PHISH_CUR_G126_06091401 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G126_06091401 0.001

# Html.Phishing.Cur.Gen127.Sanesecurity.06091402
body     SS_PHISH_CUR_G127_06091402 /<a href="http:\/\/ebay-singin-html\./i
describe SS_PHISH_CUR_G127_06091402 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G127_06091402 0.001

# Html.Phishing.Cur.Gen128.Sanesecurity.06091500
body     SS_PHISH_CUR_G128_06091500 /color:\#666666">dear customer \(\$to\)/i
describe SS_PHISH_CUR_G128_06091500 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G128_06091500 0.001

# Html.Phishing.Cur.Gen129.Sanesecurity.06091501
body     SS_PHISH_CUR_G129_06091501 /\/index\.html ">http:\/\/www \.nationwide\.co\.uk\/secure\/update\/ssl\.cfm<\/a>/i
describe SS_PHISH_CUR_G129_06091501 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G129_06091501 0.001

# Html.Phishing.Cur.Gen130.Sanesecurity.06091502
body     SS_PHISH_CUR_G130_06091502 /\/trust-update-paymnet-account-/i
describe SS_PHISH_CUR_G130_06091502 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G130_06091502 0.001

# Html.Phishing.Cur.Gen131.Sanesecurity.06092100
body     SS_PHISH_CUR_G131_06092100 /just follow this link <br><br><br><a onmouseover="a\("https:\/\/https:\/\/www\.paypal\.com\/cgi-bin\/webscr\?cmd=_login-run"\)\;return true" onmouseout=b\(\)/i
describe SS_PHISH_CUR_G131_06092100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G131_06092100 0.001

# Email.Phishing.Cur.Gen132.Sanesecurity.06092300
rawbody  SS_PHISH_CUR_G132_06092300 /<!-- saved from url=3D\(0080\)https:\/\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G132_06092300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G132_06092300 0.001

# Html.Phishing.Cur.Gen133.Sanesecurity.06092301
body     SS_PHISH_CUR_G133_06092301 /providianintroflagcard, date: feb\. 3, 2005 11:36:15 pst\; country: us/i
describe SS_PHISH_CUR_G133_06092301 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G133_06092301 0.001

# Html.Phishing.Cur.Gen134.Sanesecurity.06102000
body     SS_PHISH_CUR_G134_06102000 /\.cz\/www\/singino\/ws2\/co\/partnerid\//i
describe SS_PHISH_CUR_G134_06102000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G134_06102000 0.001

# Html.Phishing.Cur.Gen135.Sanesecurity.06100500
rawbody  SS_PHISH_CUR_G135_06100500 /\/\.\%20\/\.cgi-bin\//i
describe SS_PHISH_CUR_G135_06100500 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G135_06100500 0.001

# Html.Phishing.Cur.Gen136.Sanesecurity.06100600
body     SS_PHISH_CUR_G136_06100600 /\/customerid8972347\/secureidxjskid893oe99280-2oeujdywhhhek\/index\.htm/i
describe SS_PHISH_CUR_G136_06100600 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G136_06100600 0.001

# Html.Phishing.Cur.Gen137.Sanesecurity.06101600
body     SS_PHISH_CUR_G137_06101600 /<!-- saved from url=\(0073\)https:\/\/olb2\.nationet\.com\//i
describe SS_PHISH_CUR_G137_06101600 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G137_06101600 0.001

# Html.Phishing.Cur.Gen138.Sanesecurity.06102200
body     SS_PHISH_CUR_G138_06102200 /<a href="http:\/\/www3\.netbank\.commbank\.com\.au\./i
describe SS_PHISH_CUR_G138_06102200 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G138_06102200 0.001

# Email.Phishing.Cur.Gen139.Sanesecurity.06103000
rawbody  SS_PHISH_CUR_G139_06103000 /<!-- saved from url=\(0053\)https:\/\/www3\.netbank\.commbank\.com/i
describe SS_PHISH_CUR_G139_06103000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G139_06103000 0.001

# Html.Phishing.Cur.Gen140.Sanesecurity.06110700
body     SS_PHISH_CUR_G140_06110700 /<a href="http:\/\/.{0,50}\/~.{0,100}\/ws\/ebayisapi/i
describe SS_PHISH_CUR_G140_06110700 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G140_06110700 0.001

# Html.Phishing.Cur.Gen141.Sanesecurity.06110701
body     SS_PHISH_CUR_G141_06110701 /\/\.secure\/www\.sears\.com\//i
describe SS_PHISH_CUR_G141_06110701 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G141_06110701 0.001

# Html.Phishing.Cur.Gen142.Sanesecurity.06110702
body     SS_PHISH_CUR_G142_06110702 /\/\.connect\.to\.paypal\//i
describe SS_PHISH_CUR_G142_06110702 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G142_06110702 0.001

# Html.Phishing.Cur.Gen143.Sanesecurity.06110703
body     SS_PHISH_CUR_G143_06110703 /:82\/signin\.ebay\.com\//i
describe SS_PHISH_CUR_G143_06110703 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G143_06110703 0.001

# Html.Phishing.Cur.Gen144.Sanesecurity.06110704
body     SS_PHISH_CUR_G144_06110704 /http:\/\/online\.wellsfargo\.com-/i
describe SS_PHISH_CUR_G144_06110704 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G144_06110704 0.001

# Html.Phishing.Cur.Gen145.Sanesecurity.06110705
body     SS_PHISH_CUR_G145_06110705 /http:\/\/www\.53\.com\.portal/i
describe SS_PHISH_CUR_G145_06110705 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G145_06110705 0.001

# Html.Phishing.Cur.Gen146.Sanesecurity.06110706
body     SS_PHISH_CUR_G146_06110706 /:2121\/webscrr\//i
describe SS_PHISH_CUR_G146_06110706 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G146_06110706 0.001

# Html.Phishing.Cur.Gen147.Sanesecurity.06110707
body     SS_PHISH_CUR_G147_06110707 /:84\/ws\/ebayisapi/i
describe SS_PHISH_CUR_G147_06110707 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G147_06110707 0.001

# Html.Phishing.Cur.Gen148.Sanesecurity.06110708
body     SS_PHISH_CUR_G148_06110708 /\/icons\/\.ws\/ebayisapi/i
describe SS_PHISH_CUR_G148_06110708 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G148_06110708 0.001

# Html.Phishing.Cur.Gen149.Sanesecurity.06110709
body     SS_PHISH_CUR_G149_06110709 /\/\.www\.wachovia\.com/i
describe SS_PHISH_CUR_G149_06110709 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G149_06110709 0.001

# Html.Phishing.Cur.Gen150.Sanesecurity.06110710
body     SS_PHISH_CUR_G150_06110710 /\/\%20\/\/ebay\.htm\?cmd/i
describe SS_PHISH_CUR_G150_06110710 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G150_06110710 0.001

# Html.Phishing.Cur.Gen151.Sanesecurity.06110711
body     SS_PHISH_CUR_G151_06110711 /:8080\/signin\.ebay\.com\//i
describe SS_PHISH_CUR_G151_06110711 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G151_06110711 0.001

# Html.Phishing.Cur.Gen152.Sanesecurity.06110712
body     SS_PHISH_CUR_G152_06110712 /\/\%20\%20\/amazon\/exec/i
describe SS_PHISH_CUR_G152_06110712 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G152_06110712 0.001

# Html.Phishing.Cur.Gen153.Sanesecurity.06110713
body     SS_PHISH_CUR_G153_06110713 /\.\.\.\/sc\/ws\/ebayisapi/i
describe SS_PHISH_CUR_G153_06110713 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G153_06110713 0.001

# Html.Phishing.Cur.Gen154.Sanesecurity.06110714
body     SS_PHISH_CUR_G154_06110714 /\/\.www\.fairwinds\.org\//i
describe SS_PHISH_CUR_G154_06110714 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G154_06110714 0.001

# Html.Phishing.Cur.Gen155.Sanesecurity.06110715
body     SS_PHISH_CUR_G155_06110715 /\/\%20\/usa\.visa\.com\//i
describe SS_PHISH_CUR_G155_06110715 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G155_06110715 0.001

# Html.Phishing.Cur.Gen156.Sanesecurity.06111100
body     SS_PHISH_CUR_G156_06111100 /\.shawcable\.net\/update_paypal\//i
describe SS_PHISH_CUR_G156_06111100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G156_06111100 0.001

# Html.Phishing.Cur.Gen157.Sanesecurity.06111101
body     SS_PHISH_CUR_G157_06111101 /href="http:\/\/.{0,50}\/~.{0,150}\.paypal\.co/i
describe SS_PHISH_CUR_G157_06111101 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G157_06111101 0.001

# Html.Phishing.Cur.Gen158.Sanesecurity.06111102
body     SS_PHISH_CUR_G158_06111102 /href="http:\/\/.{0,50}\/~.{0,150}\.ebay\.co/i
describe SS_PHISH_CUR_G158_06111102 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G158_06111102 0.001

# Email.Phishing.Cur.Gen159.Sanesecurity.06111103
rawbody  SS_PHISH_CUR_G159_06111103 /:9070\/vk\/volksbank\.de\/DesktopDefault\.aspx\/tabid=43\&tabindex=-1\//i
describe SS_PHISH_CUR_G159_06111103 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G159_06111103 0.001

# Html.Phishing.Cur.Gen160.Sanesecurity.06111104
body     SS_PHISH_CUR_G160_06111104 /:9070\/vk\/volksbank\.de\/desktopdefault\.aspx\/tabid=43\&tabindex=-1\//i
describe SS_PHISH_CUR_G160_06111104 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G160_06111104 0.001

# Html.Phishing.Cur.Gen161.Sanesecurity.06111105
body     SS_PHISH_CUR_G161_06111105 /\/horde\/services\/images\/signin\.ebay\.com\//i
describe SS_PHISH_CUR_G161_06111105 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G161_06111105 0.001

# Html.Phishing.Cur.Gen162.Sanesecurity.06111106
body     SS_PHISH_CUR_G162_06111106 /sys_cpanel\/images\/ws\/signin\.ebay\/ebayisapi\.dl\/signin/i
describe SS_PHISH_CUR_G162_06111106 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G162_06111106 0.001

# Html.Phishing.Cur.Gen163.Sanesecurity.06111107
body     SS_PHISH_CUR_G163_06111107 /http:\/\/mujweb\.cz\/.{0,150}ebay/i
describe SS_PHISH_CUR_G163_06111107 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G163_06111107 0.001

# Html.Phishing.Cur.Gen164.Sanesecurity.06111108
body     SS_PHISH_CUR_G164_06111108 /http:\/\/mujweb\.cz\/.{0,150}signin/i
describe SS_PHISH_CUR_G164_06111108 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G164_06111108 0.001

# Html.Phishing.Cur.Gen165.Sanesecurity.06111109
body     SS_PHISH_CUR_G165_06111109 /http:\/\/signin\.ebay\.com\..{0,30}\.com\/.{0,30}ebayisapi/i
describe SS_PHISH_CUR_G165_06111109 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G165_06111109 0.001

# Html.Phishing.Cur.Gen167.Sanesecurity.06111400
body     SS_PHISH_CUR_G167_06111400 /\/www\.ebay\.comsigninregisterignin/i
describe SS_PHISH_CUR_G167_06111400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G167_06111400 0.001

# Html.Phishing.Cur.Gen168.Sanesecurity.06111600
body     SS_PHISH_CUR_G168_06111600 /\/\.secure\/\.webscr/i
describe SS_PHISH_CUR_G168_06111600 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G168_06111600 0.001

# Html.Phishing.Cur.Gen169.Sanesecurity.06111601
body     SS_PHISH_CUR_G169_06111601 /\/\.cancel\/\.webscr/i
describe SS_PHISH_CUR_G169_06111601 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G169_06111601 0.001

# Html.Phishing.Cur.Gen170.Sanesecurity.06111602
body     SS_PHISH_CUR_G170_06111602 /\/\.us\/paypal\.com\//i
describe SS_PHISH_CUR_G170_06111602 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G170_06111602 0.001

# Html.Phishing.Cur.Gen171.Sanesecurity.06111603
body     SS_PHISH_CUR_G171_06111603 /\/~www\.paypal\.com\//i
describe SS_PHISH_CUR_G171_06111603 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G171_06111603 0.001

# Html.Phishing.Cur.Gen172.Sanesecurity.06111604
body     SS_PHISH_CUR_G172_06111604 /\/~webscr\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G172_06111604 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G172_06111604 0.001

# Html.Phishing.Cur.Gen173.Sanesecurity.06111605
body     SS_PHISH_CUR_G173_06111605 /\/icons\/\.cgi\/paypal/i
describe SS_PHISH_CUR_G173_06111605 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G173_06111605 0.001

# Html.Phishing.Cur.Gen174.Sanesecurity.06111606
body     SS_PHISH_CUR_G174_06111606 /\/\.login\.ebay\.com\./i
describe SS_PHISH_CUR_G174_06111606 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G174_06111606 0.001

# Html.Phishing.Cur.Gen175.Sanesecurity.06111607
body     SS_PHISH_CUR_G175_06111607 /\/paypal\.com\.cgi-bin\./i
describe SS_PHISH_CUR_G175_06111607 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G175_06111607 0.001

# Html.Phishing.Cur.Gen176.Sanesecurity.06111608
body     SS_PHISH_CUR_G176_06111608 /:8081\/signin\.ebay\.com\/ws\/ebayisapi/i
describe SS_PHISH_CUR_G176_06111608 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G176_06111608 0.001

# Html.Phishing.Cur.Gen177.Sanesecurity.06111609
body     SS_PHISH_CUR_G177_06111609 /\/https:\/signin\.ebay\.com\//i
describe SS_PHISH_CUR_G177_06111609 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G177_06111609 0.001

# Html.Phishing.Cur.Gen178.Sanesecurity.06111610
body     SS_PHISH_CUR_G178_06111610 /http:\/\/www\.paypal\.com\.user/i
describe SS_PHISH_CUR_G178_06111610 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G178_06111610 0.001

# Html.Phishing.Cur.Gen179.Sanesecurity.06111611
body     SS_PHISH_CUR_G179_06111611 /http:\/\/www\.ljk-sang\.com\/refund\/\?code/i
describe SS_PHISH_CUR_G179_06111611 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G179_06111611 0.001

# Html.Phishing.Cur.Gen180.Sanesecurity.06111612
body     SS_PHISH_CUR_G180_06111612 /\/\%20\/www\.chase\.com\//i
describe SS_PHISH_CUR_G180_06111612 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G180_06111612 0.001

# Html.Phishing.Cur.Gen181.Sanesecurity.06111613
body     SS_PHISH_CUR_G181_06111613 /\/\.citicards\.com\//i
describe SS_PHISH_CUR_G181_06111613 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G181_06111613 0.001

# Html.Phishing.Cur.Gen182.Sanesecurity.06111614
body     SS_PHISH_CUR_G182_06111614 /\/albums\/userpics\/.{0,150}www\.amazon\.com/i
describe SS_PHISH_CUR_G182_06111614 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G182_06111614 0.001

# Html.Phishing.Cur.Gen183.Sanesecurity.06111615
body     SS_PHISH_CUR_G183_06111615 /\/albums\/userpics\/.{0,150}www\.paypal\.com/i
describe SS_PHISH_CUR_G183_06111615 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G183_06111615 0.001

# Html.Phishing.Cur.Gen184.Sanesecurity.06111616
body     SS_PHISH_CUR_G184_06111616 /\/albums\/userpics\/.{0,150}ebay/i
describe SS_PHISH_CUR_G184_06111616 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G184_06111616 0.001

# Html.Phishing.Cur.Gen185.Sanesecurity.06111617
body     SS_PHISH_CUR_G185_06111617 /\/albums\/userpics\/.{0,150}signin/i
describe SS_PHISH_CUR_G185_06111617 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G185_06111617 0.001

# Html.Phishing.Cur.Gen186.Sanesecurity.06111700
body     SS_PHISH_CUR_G186_06111700 /<a href="http:\/\/host.{0,100}\.signin\.ebay\.com/i
describe SS_PHISH_CUR_G186_06111700 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G186_06111700 0.001

# Html.Phishing.Cur.Gen187.Sanesecurity.06112000
body     SS_PHISH_CUR_G187_06112000 /\/\.www\.citibank\.com\//i
describe SS_PHISH_CUR_G187_06112000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G187_06112000 0.001

# Html.Phishing.Cur.Gen188.Sanesecurity.06112001
body     SS_PHISH_CUR_G188_06112001 /\/\.www\.citibank\.com\//i
describe SS_PHISH_CUR_G188_06112001 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G188_06112001 0.001

# Html.Phishing.Cur.Gen189.Sanesecurity.06112002
body     SS_PHISH_CUR_G189_06112002 /\/\.www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G189_06112002 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G189_06112002 0.001

# Html.Phishing.Cur.Gen190.Sanesecurity.06112003
body     SS_PHISH_CUR_G190_06112003 /\/\.us\/paypal\/index/i
describe SS_PHISH_CUR_G190_06112003 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G190_06112003 0.001

# Html.Phishing.Cur.Gen191.Sanesecurity.06112004
body     SS_PHISH_CUR_G191_06112004 /\/\.secure\/cgi-bin\/webscr\//i
describe SS_PHISH_CUR_G191_06112004 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G191_06112004 0.001

# Html.Phishing.Cur.Gen192.Sanesecurity.06112000
body     SS_PHISH_CUR_G192_06112000 /http:\/\/.{0,50}\/~.{0,100}\/chaseonline\.chase\.com/i
describe SS_PHISH_CUR_G192_06112000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G192_06112000 0.001

# Html.Phishing.Cur.Gen193.Sanesecurity.06112001
body     SS_PHISH_CUR_G193_06112001 /http:\/\/.{0,50}\/~.{0,100}\/ebayisapi/i
describe SS_PHISH_CUR_G193_06112001 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G193_06112001 0.001

# Html.Phishing.Cur.Gen194.Sanesecurity.06112100
body     SS_PHISH_CUR_G194_06112100 /\/\.account\/paypal\/login/i
describe SS_PHISH_CUR_G194_06112100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G194_06112100 0.001

# Html.Phishing.Cur.Gen195.Sanesecurity.06112200
body     SS_PHISH_CUR_G195_06112200 /\/\.www\.ebay\.com\./i
describe SS_PHISH_CUR_G195_06112200 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G195_06112200 0.001

# Email.Phishing.Cur.Gen196.Sanesecurity.06112300
rawbody  SS_PHISH_CUR_G196_06112300 /<!-- saved from url=\(0071\)http:\/\/www\.rbs\.co\.uk\/Personal_Finances\/Bank_Online\//i
describe SS_PHISH_CUR_G196_06112300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G196_06112300 0.001

# Html.Phishing.Cur.Gen197.Sanesecurity.06112301
body     SS_PHISH_CUR_G197_06112301 /\/images\/www\.paypal\.com\/index\.html"><u>https:\/\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G197_06112301 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G197_06112301 0.001

# Html.Phishing.Cur.Gen198.Sanesecurity.06112302
body     SS_PHISH_CUR_G198_06112302 /:82\/httpsiginin\.ebay\.com\//i
describe SS_PHISH_CUR_G198_06112302 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G198_06112302 0.001

# Html.Phishing.Cur.Gen199.Sanesecurity.06112400
body     SS_PHISH_CUR_G199_06112400 /src="\.\.\/\.\.\/safe\%20house\%20-\%201\/ebay_files\/x\.gif/i
describe SS_PHISH_CUR_G199_06112400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G199_06112400 0.001

# Html.Phishing.Cur.Gen200.Sanesecurity.06112401
body     SS_PHISH_CUR_G200_06112401 /\/\%20\/cgi-bin\/webscr/i
describe SS_PHISH_CUR_G200_06112401 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G200_06112401 0.001

# Html.Phishing.Cur.Gen201.Sanesecurity.06112600
body     SS_PHISH_CUR_G201_06112600 /\/\.subscription\//i
describe SS_PHISH_CUR_G201_06112600 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G201_06112600 0.001

# Html.Phishing.Cur.Gen202.Sanesecurity.06112900
body     SS_PHISH_CUR_G202_06112900 /\/\.web\/online\%20services\//i
describe SS_PHISH_CUR_G202_06112900 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G202_06112900 0.001

# Html.Phishing.Cur.Gen203.Sanesecurity.06112901
body     SS_PHISH_CUR_G203_06112901 /\/\.online\//i
describe SS_PHISH_CUR_G203_06112901 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G203_06112901 0.001

# Html.Phishing.Cur.Gen204.Sanesecurity.06112902
body     SS_PHISH_CUR_G204_06112902 /http:\/\/ftp:\/\/.{0,150}signin\.ebay\.com/i
describe SS_PHISH_CUR_G204_06112902 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G204_06112902 0.001

# Html.Phishing.Cur.Gen205.Sanesecurity.06112903
body     SS_PHISH_CUR_G205_06112903 /\%20\%20\/www\.wellsfargo\.com\//i
describe SS_PHISH_CUR_G205_06112903 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G205_06112903 0.001

# Html.Phishing.Cur.Gen206.Sanesecurity.06112904
body     SS_PHISH_CUR_G206_06112904 /\/\%20\/fairwindsonline\.org\//i
describe SS_PHISH_CUR_G206_06112904 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G206_06112904 0.001

# Html.Phishing.Cur.Gen207.Sanesecurity.06112905
body     SS_PHISH_CUR_G207_06112905 /\/\%20\/etimebanker\.bankofthewest\.com\//i
describe SS_PHISH_CUR_G207_06112905 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G207_06112905 0.001

# Html.Phishing.Cur.Gen208.Sanesecurity.06112906
body     SS_PHISH_CUR_G208_06112906 /:84\/www\.royalbank\.com\//i
describe SS_PHISH_CUR_G208_06112906 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G208_06112906 0.001

# Html.Phishing.Cur.Gen209.Sanesecurity.06120300
body     SS_PHISH_CUR_G209_06120300 /\/aw\/pics\/\/email\/btnRespond\.gif"/i
describe SS_PHISH_CUR_G209_06120300 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G209_06120300 0.001

# Html.Phishing.Cur.Gen210.Sanesecurity.06120800
body     SS_PHISH_CUR_G210_06120800 /:82\/redirect\.paypal\.com\//i
describe SS_PHISH_CUR_G210_06120800 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G210_06120800 0.001

# Email.Phishing.Cur.Gen211.Sanesecurity.06120801
rawbody  SS_PHISH_CUR_G211_06120801 /\/\%20\/www\.eBay\.com\//i
describe SS_PHISH_CUR_G211_06120801 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G211_06120801 0.001

# Html.Phishing.Cur.Gen212.Sanesecurity.06120802
body     SS_PHISH_CUR_G212_06120802 /\/\.e\/cgi\.ebay\.com\/ws\//i
describe SS_PHISH_CUR_G212_06120802 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G212_06120802 0.001

# Html.Phishing.Cur.Gen213.Sanesecurity.06120803
body     SS_PHISH_CUR_G213_06120803 /\/\%20\/bankofamerica\//i
describe SS_PHISH_CUR_G213_06120803 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G213_06120803 0.001

# Html.Phishing.Cur.Gen214.Sanesecurity.06120900
body     SS_PHISH_CUR_G214_06120900 /\/\%20\/tyndallfcu\//i
describe SS_PHISH_CUR_G214_06120900 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G214_06120900 0.001

# Html.Phishing.Cur.Gen215.Sanesecurity.06121100
body     SS_PHISH_CUR_G215_06121100 /\/\%20\/www\.ebay\.com\//i
describe SS_PHISH_CUR_G215_06121100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G215_06121100 0.001

# Html.Phishing.Cur.Gen216.Sanesecurity.06121101
body     SS_PHISH_CUR_G216_06121101 /:82\/redirect\.nafcu\//i
describe SS_PHISH_CUR_G216_06121101 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G216_06121101 0.001

# Email.Phishing.Cur.Gen217.Sanesecurity.06121200
rawbody  SS_PHISH_CUR_G217_06121200 / <!--reviewLink:0060558121:ARNU07N2YIKP1 --><\/a><\/b></i
describe SS_PHISH_CUR_G217_06121200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G217_06121200 0.001

# Html.Phishing.Cur.Gen218.Sanesecurity.06121201
body     SS_PHISH_CUR_G218_06121201 /\/\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G218_06121201 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G218_06121201 0.001

# Email.Phishing.Cur.Gen219.Sanesecurity.06121202
rawbody  SS_PHISH_CUR_G219_06121202 /<img src=3D"http:\/\/.{0,20}\.imageshack\.us\/.{0,2150}bankofamerica/i
describe SS_PHISH_CUR_G219_06121202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G219_06121202 0.001

# Html.Phishing.Cur.Gen220.Sanesecurity.06121300
body     SS_PHISH_CUR_G220_06121300 /http:\/\/.{0,50}\/~.{0,100}alltimeonline\.sbbt\.com/i
describe SS_PHISH_CUR_G220_06121300 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G220_06121300 0.001

# Html.Phishing.Cur.Gen221.Sanesecurity.06121301
body     SS_PHISH_CUR_G221_06121301 /http:\/\/.{0,50}\/~.{0,100}bankofamerica/i
describe SS_PHISH_CUR_G221_06121301 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G221_06121301 0.001

# Html.Phishing.Cur.Gen222.Sanesecurity.06121302
body     SS_PHISH_CUR_G222_06121302 /http:\/\/.{0,50}\/~.{0,100}barclay\.co\.uk/i
describe SS_PHISH_CUR_G222_06121302 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G222_06121302 0.001

# Email.Phishing.Cur.Gen224.Sanesecurity.06121305
rawbody  SS_PHISH_CUR_G224_06121305 /http:\/\/.{0,50}\/~.{0,50}\.ebay\./i
describe SS_PHISH_CUR_G224_06121305 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G224_06121305 0.001

# Html.Phishing.Cur.Gen225.Sanesecurity.06121306
body     SS_PHISH_CUR_G225_06121306 /http:\/\/.{0,50}\/~.{0,100}\.wellsfargo\.com/i
describe SS_PHISH_CUR_G225_06121306 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G225_06121306 0.001

# Html.Phishing.Cur.Gen226.Sanesecurity.06121307
body     SS_PHISH_CUR_G226_06121307 /<img src="http:\/\/upload\.wikimedia\.org\/wikipedia\/fr\/thumb\/9\/92\/logo_bank_america\.jpg\/250px-logo_bank_america\.jpg".*account/i
describe SS_PHISH_CUR_G226_06121307 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G226_06121307 0.001

# Html.Phishing.Cur.Gen227.Sanesecurity.06122000
body     SS_PHISH_CUR_G227_06122000 /\/\.ebay\.com\./i
describe SS_PHISH_CUR_G227_06122000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G227_06122000 0.001

# Html.Phishing.Cur.Gen228.Sanesecurity.06122001
body     SS_PHISH_CUR_G228_06122001 /\/\.comdirect\.de\//i
describe SS_PHISH_CUR_G228_06122001 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G228_06122001 0.001

# Html.Phishing.Cur.Gen229.Sanesecurity.06122100
body     SS_PHISH_CUR_G229_06122100 /\/\.hsbc\.co\.uk\//i
describe SS_PHISH_CUR_G229_06122100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G229_06122100 0.001

# Html.Phishing.Cur.Gen230.Sanesecurity.06122200
body     SS_PHISH_CUR_G230_06122200 /\/\.onlinebanking\//i
describe SS_PHISH_CUR_G230_06122200 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G230_06122200 0.001

# Html.Phishing.Cur.Gen231.Sanesecurity.06122400
body     SS_PHISH_CUR_G231_06122400 /\/\.\.\.\/www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G231_06122400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G231_06122400 0.001

# Html.Phishing.Cur.Gen232.Sanesecurity.06122401
body     SS_PHISH_CUR_G232_06122401 /http:\/\/.{0,15}:7640\/.{0,100}citibank\.de/i
describe SS_PHISH_CUR_G232_06122401 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G232_06122401 0.001

# Html.Phishing.Cur.Gen233.Sanesecurity.06122402
body     SS_PHISH_CUR_G233_06122402 /http:\/\/.{0,15}:7640\/.{0,100}online-identifikation/i
describe SS_PHISH_CUR_G233_06122402 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G233_06122402 0.001

# Email.Phishing.Cur.Gen234.Sanesecurity.06122800
rawbody  SS_PHISH_CUR_G234_06122800 /http:\/\/mujweb\.cz\/www\/.{0,100}eBayISAPIdll/i
describe SS_PHISH_CUR_G234_06122800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G234_06122800 0.001

# Html.Phishing.Cur.Gen235.Sanesecurity.06122801
body     SS_PHISH_CUR_G235_06122801 /\/icons\/\.x\/signin/i
describe SS_PHISH_CUR_G235_06122801 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G235_06122801 0.001

# Html.Phishing.Cur.Gen236.Sanesecurity.06123000
body     SS_PHISH_CUR_G236_06123000 /online banking alert"=20 src=3d"file:\/\/\/c:\/documents\%20and\%20settings\//i
describe SS_PHISH_CUR_G236_06123000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G236_06123000 0.001

# Html.Phishing.Cur.Gen237.Sanesecurity.06123001
body     SS_PHISH_CUR_G237_06123001 /http:\/\/.{0,30}\/xampp\/.{0,150}www\.wellsfargo\.com/i
describe SS_PHISH_CUR_G237_06123001 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G237_06123001 0.001

# Html.Phishing.Cur.Gen238.Sanesecurity.07010900
body     SS_PHISH_CUR_G238_07010900 /\/\.www\.wellsfargo\.com/i
describe SS_PHISH_CUR_G238_07010900 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G238_07010900 0.001

# Html.Phishing.Cur.Gen239.Sanesecurity.07010901
body     SS_PHISH_CUR_G239_07010901 /\/\.www\.citizensbank\.com\//i
describe SS_PHISH_CUR_G239_07010901 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G239_07010901 0.001

# Html.Phishing.Cur.Gen240.Sanesecurity.07011000
body     SS_PHISH_CUR_G240_07011000 /\/\.verification\/www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G240_07011000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G240_07011000 0.001

# Email.Phishing.Cur.Gen241.Sanesecurity.07012000
rawbody  SS_PHISH_CUR_G241_07012000 /signin\.ebay\.comwseBayISAPI\.dllSignIn\&co_partnerId=2\&pUserId/i
describe SS_PHISH_CUR_G241_07012000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G241_07012000 0.001

# Html.Phishing.Cur.Gen242.Sanesecurity.07015000
body     SS_PHISH_CUR_G242_07015000 /http:\/\/.{0,50}\/~.*safeharbor/i
describe SS_PHISH_CUR_G242_07015000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G242_07015000 0.001

# Email.Phishing.Cur.Gen243.Sanesecurity.07012200
rawbody  SS_PHISH_CUR_G243_07012200 /<!-- saved from url=\(0104\)https:\/\/online\.westpac\.com\.au\//i
describe SS_PHISH_CUR_G243_07012200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G243_07012200 0.001

# Email.Phishing.Cur.Gen244.Sanesecurity.07012300
rawbody  SS_PHISH_CUR_G244_07012300 /http:\/\/www\.paypaI\./i
describe SS_PHISH_CUR_G244_07012300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G244_07012300 0.001

# Email.Phishing.Cur.Gen245.Sanesecurity.07012400
rawbody  SS_PHISH_CUR_G245_07012400 /\/\.ssl\/www\.wellsfargo\.com/i
describe SS_PHISH_CUR_G245_07012400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G245_07012400 0.001

# Email.Phishing.Cur.Gen246.Sanesecurity.07012401
rawbody  SS_PHISH_CUR_G246_07012401 /<a href='http:\/\/.{0,15}\/~.{0,100}php\?usrtr=/i
describe SS_PHISH_CUR_G246_07012401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G246_07012401 0.001

# Email.Phishing.Cur.Gen247.Sanesecurity.07012800
rawbody  SS_PHISH_CUR_G247_07012800 /\/\.isapi\.dl\.signin\.co\./i
describe SS_PHISH_CUR_G247_07012800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G247_07012800 0.001

# Email.Phishing.Cur.Gen248.Sanesecurity.07020400
rawbody  SS_PHISH_CUR_G248_07020400 /\/\.ws1\/www\.desjardins\.com\//i
describe SS_PHISH_CUR_G248_07020400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G248_07020400 0.001

# Email.Phishing.Cur.Gen249.Sanesecurity.07020401
rawbody  SS_PHISH_CUR_G249_07020401 /\/\.ws1\/rbaccess\//i
describe SS_PHISH_CUR_G249_07020401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G249_07020401 0.001

# Email.Phishing.Cur.Gen250.Sanesecurity.07022100
rawbody  SS_PHISH_CUR_G250_07022100 /<!-- saved from url=\(0063\)http:\/\/0120\.0067\.0123\.0036\//i
describe SS_PHISH_CUR_G250_07022100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G250_07022100 0.001

# Email.Phishing.Cur.Gen251.Sanesecurity.07030400
rawbody  SS_PHISH_CUR_G251_07030400 /src="http:\/\/\.\.\/Desktop\/Bank\+of\+America\+\+Online\+Banking/i
describe SS_PHISH_CUR_G251_07030400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G251_07030400 0.001

# Email.Phishing.Cur.Gen252.Sanesecurity.07030500
rawbody  SS_PHISH_CUR_G252_07030500 /\/\.amazon\.com\/index\.htm/i
describe SS_PHISH_CUR_G252_07030500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G252_07030500 0.001

# Email.Phishing.Cur.Gen253.Sanesecurity.07030800
rawbody  SS_PHISH_CUR_G253_07030800 /<a href="http:\/\/.{0,50}\/~.*barclays/i
describe SS_PHISH_CUR_G253_07030800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G253_07030800 0.001

# Email.Phishing.Cur.Gen254.Sanesecurity.07030800
rawbody  SS_PHISH_CUR_G254_07030800 /<a href="http:\/\/.{0,50}\/~.*www\.hsbc\.co\.uk/i
describe SS_PHISH_CUR_G254_07030800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G254_07030800 0.001

# Email.Phishing.Cur.Gen255.Sanesecurity.07031100
rawbody  SS_PHISH_CUR_G255_07031100 /\/signin\.ebay\.com\.ebayasap\.dll\.htm/i
describe SS_PHISH_CUR_G255_07031100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G255_07031100 0.001

# Email.Phishing.Cur.Gen256.Sanesecurity.07032700
rawbody  SS_PHISH_CUR_G256_07032700 /\/\.www\.natwest\.com\//i
describe SS_PHISH_CUR_G256_07032700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G256_07032700 0.001

# Email.Phishing.Cur.Gen257.Sanesecurity.07040600
rawbody  SS_PHISH_CUR_G257_07040600 /You have added <\/FONT><A href="http:\/\/.{0,30}\/~.{0,500}as a new e-mail address for/i
describe SS_PHISH_CUR_G257_07040600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G257_07040600 0.001

# Email.Phishing.Cur.Gen258.Sanesecurity.07040601
rawbody  SS_PHISH_CUR_G258_07040601 /\/phpMyAdmin\/libraries\/export\/\.ssh\.html">Go To Home Banking/i
describe SS_PHISH_CUR_G258_07040601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G258_07040601 0.001

# Email.Phishing.Cur.Gen259.Sanesecurity.07040602
rawbody  SS_PHISH_CUR_G259_07040602 /\/\.\%20\/www\.paypal\.fr\/"><img border="0"/i
describe SS_PHISH_CUR_G259_07040602 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G259_07040602 0.001

# Email.Phishing.Cur.Gen260.Sanesecurity.07040603
rawbody  SS_PHISH_CUR_G260_07040603 /<A href="http:\/\/ip-.*<IMG alt="" src="https:\/\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G260_07040603 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G260_07040603 0.001

# Email.Phishing.Cur.Gen261.Sanesecurity.07041200
rawbody  SS_PHISH_CUR_G261_07041200 /\.biz\.rr\.com\/www\.amazon\.com\/gp\/yourstore\//i
describe SS_PHISH_CUR_G261_07041200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G261_07041200 0.001

# Email.Phishing.Cur.Gen262.Sanesecurity.07041201
rawbody  SS_PHISH_CUR_G262_07041201 /http:\/\/app\.nordea\.se\.cprocedure_id.{0,100}\/widecarea\.aspx\//i
describe SS_PHISH_CUR_G262_07041201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G262_07041201 0.001

# Email.Phishing.Cur.Gen263.Sanesecurity.07041202
rawbody  SS_PHISH_CUR_G263_07041202 /http:\/\/bancopostaonline\.poste\.it\./i
describe SS_PHISH_CUR_G263_07041202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G263_07041202 0.001

# Email.Phishing.Cur.Gen264.Sanesecurity.07041500
rawbody  SS_PHISH_CUR_G264_07041500 /\/icons\/\.paypal\.com\//i
describe SS_PHISH_CUR_G264_07041500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G264_07041500 0.001

# Email.Phishing.Cur.Gen265.Sanesecurity.07041700
rawbody  SS_PHISH_CUR_G265_07041700 /From: "eBay-Mitglied /i
describe SS_PHISH_CUR_G265_07041700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G265_07041700 0.001

# Email.Phishing.Cur.Gen266.Sanesecurity.07041701
rawbody  SS_PHISH_CUR_G266_07041701 /\/eBayISAPI\.dll\.ssh128bitssecureconectionws32/i
describe SS_PHISH_CUR_G266_07041701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G266_07041701 0.001

# Email.Phishing.Cur.Gen267.Sanesecurity.07041900
rawbody  SS_PHISH_CUR_G267_07041900 /\/icons\/cgi\/www\.flagstar\.com\//i
describe SS_PHISH_CUR_G267_07041900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G267_07041900 0.001

# Email.Phishing.Cur.Gen268.Sanesecurity.07042300
rawbody  SS_PHISH_CUR_G268_07042300 /http:\/\/.{0,50}\/~.{0,100}\/www\.e-gold\.com/i
describe SS_PHISH_CUR_G268_07042300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G268_07042300 0.001

# Email.Phishing.Cur.Gen269.Sanesecurity.07042700
rawbody  SS_PHISH_CUR_G269_07042700 /\/\.a\/paypl\.html"/i
describe SS_PHISH_CUR_G269_07042700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G269_07042700 0.001

# Email.Phishing.Cur.Gen270.Sanesecurity.07042701
rawbody  SS_PHISH_CUR_G270_07042701 /http:\/\/vms\.gjwebs\.com\/manual\/cgi-bin\//i
describe SS_PHISH_CUR_G270_07042701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G270_07042701 0.001

# Email.Phishing.Cur.Gen271.Sanesecurity.07043000
rawbody  SS_PHISH_CUR_G271_07043000 /http:\/\/pages2\.ebay\.com\.ws\./i
describe SS_PHISH_CUR_G271_07043000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G271_07043000 0.001

# Email.Phishing.Cur.Gen272.Sanesecurity.07043001
rawbody  SS_PHISH_CUR_G272_07043001 /\.ru\/modules\/Update\/update\.php><INPUT type=submit/i
describe SS_PHISH_CUR_G272_07043001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G272_07043001 0.001

# Html.Phishing.Cur.Gen273.Sanesecurity.07043002
body     SS_PHISH_CUR_G273_07043002 /<a href="http:\/\/tinyurl\.com\/.{0,300}src="http:\/\/pics\.ebaystatic\.com/i
describe SS_PHISH_CUR_G273_07043002 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G273_07043002 0.001

# Email.Phishing.Cur.Gen274.Sanesecurity.07043003
rawbody  SS_PHISH_CUR_G274_07043003 /\.land\.ru\/SignIn26co_partnerId/i
describe SS_PHISH_CUR_G274_07043003 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G274_07043003 0.001

# Html.Phishing.Cur.Gen275.Sanesecurity.07050100
body     SS_PHISH_CUR_G275_07050100 /\/\.ws\/scgi\/ebayisapi\.dll/i
describe SS_PHISH_CUR_G275_07050100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G275_07050100 0.001

# Email.Phishing.Cur.Gen274.Sanesecurity.07050101
rawbody  SS_PHISH_CUR_G274_07050101 /From: eBay <suspesion\@ebay\.com>/i
describe SS_PHISH_CUR_G274_07050101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G274_07050101 0.001

# Email.Phishing.Cur.Gen275.Sanesecurity.07050102
rawbody  SS_PHISH_CUR_G275_07050102 /\/\.secure\/signon\.html">PayPal Security Center/i
describe SS_PHISH_CUR_G275_07050102 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G275_07050102 0.001

# Email.Phishing.Cur.Gen276.Sanesecurity.07050103
rawbody  SS_PHISH_CUR_G276_07050103 /\/ebay\.com\/eBayISAPI\/index\.htm">Click here<\/a> \. <\/p>/i
describe SS_PHISH_CUR_G276_07050103 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G276_07050103 0.001

# Email.Phishing.Cur.Gen277.Sanesecurity.07050300
rawbody  SS_PHISH_CUR_G277_07050300 /\/\.us\/cgi-bin\/webscrcmd/i
describe SS_PHISH_CUR_G277_07050300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G277_07050300 0.001

# Email.Phishing.Cur.Gen278.Sanesecurity.07050301
rawbody  SS_PHISH_CUR_G278_07050301 /http:\/\/wvw-ebaiy-com\./i
describe SS_PHISH_CUR_G278_07050301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G278_07050301 0.001

# Email.Phishing.Cur.Gen279.Sanesecurity.07050302
rawbody  SS_PHISH_CUR_G279_07050302 /http:\/\/www\.53\.com-New/i
describe SS_PHISH_CUR_G279_07050302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G279_07050302 0.001

# Email.Phishing.Cur.Gen280.Sanesecurity.07050303
rawbody  SS_PHISH_CUR_G280_07050303 /http:\/\/cgi\.ebay\.com\/ws\/eBayISAPI\.dll\?ViewItem\&amp\;item=199106424190/i
describe SS_PHISH_CUR_G280_07050303 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G280_07050303 0.001

# Email.Phishing.Cur.Gen281.Sanesecurity.07050400
rawbody  SS_PHISH_CUR_G281_07050400 /sign-in\.paypl\./i
describe SS_PHISH_CUR_G281_07050400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G281_07050400 0.001

# Email.Phishing.Cur.Gen282.Sanesecurity.07050401
rawbody  SS_PHISH_CUR_G282_07050401 /http:\/\/.{0,50}\/~.{0,100}www\.co-operativebank\.co\.uk/i
describe SS_PHISH_CUR_G282_07050401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G282_07050401 0.001

# Email.Phishing.Cur.Gen283.Sanesecurity.07050500
rawbody  SS_PHISH_CUR_G283_07050500 /\/\.\.signin\.ebay\.com\//i
describe SS_PHISH_CUR_G283_07050500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G283_07050500 0.001

# Email.Phishing.Cur.Gen284.Sanesecurity.07050501
rawbody  SS_PHISH_CUR_G284_07050501 /\/\.html\/bancoposta\//i
describe SS_PHISH_CUR_G284_07050501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G284_07050501 0.001

# Email.Phishing.Cur.Gen285.Sanesecurity.07050500
rawbody  SS_PHISH_CUR_G285_07050500 /as a new e-mail address.*http:\/\/.{0,50}\/~/i
describe SS_PHISH_CUR_G285_07050500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G285_07050500 0.001

# Email.Phishing.Cur.Gen286.Sanesecurity.07050501
rawbody  SS_PHISH_CUR_G286_07050501 /\/bbs\/ws\/scgi\/eBayISAPI\.dll\//i
describe SS_PHISH_CUR_G286_07050501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G286_07050501 0.001

# Email.Phishing.Cur.Gen287.Sanesecurity.07050600
rawbody  SS_PHISH_CUR_G287_07050600 /\.verizon\.net\/www\.poste\.it\//i
describe SS_PHISH_CUR_G287_07050600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G287_07050600 0.001

# Email.Phishing.Cur.Gen288.Sanesecurity.07050601
rawbody  SS_PHISH_CUR_G288_07050601 /\/\.ws\/eBayISAPI\.dll/i
describe SS_PHISH_CUR_G288_07050601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G288_07050601 0.001

# Email.Phishing.Cur.Gen289.Sanesecurity.07050602
rawbody  SS_PHISH_CUR_G289_07050602 /\/\%20\/cgi\/unlock\/decrypted\/index\.php/i
describe SS_PHISH_CUR_G289_07050602 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G289_07050602 0.001

# Email.Phishing.Cur.Gen290.Sanesecurity.07050603
rawbody  SS_PHISH_CUR_G290_07050603 /\/\.online\.wellsfargo\.com\//i
describe SS_PHISH_CUR_G290_07050603 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G290_07050603 0.001

# Email.Phishing.Cur.Gen291.Sanesecurity.07050800
rawbody  SS_PHISH_CUR_G291_07050800 /From: "aw-confirm\@ebay\.com"<aw-confirm\@e-bay\.com>/i
describe SS_PHISH_CUR_G291_07050800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G291_07050800 0.001

# Email.Phishing.Cur.Gen292.Sanesecurity.07050802
rawbody  SS_PHISH_CUR_G292_07050802 /http:\/\/.{0,50}\/~.{0,100}www\.cahoot\.com/i
describe SS_PHISH_CUR_G292_07050802 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G292_07050802 0.001

# Email.Phishing.Cur.Gen293.Sanesecurity.07050803
rawbody  SS_PHISH_CUR_G293_07050803 /target="_blank" href="http:\/\/.{0,30}\.free\.fr\/.*www\.paypal\.com\//i
describe SS_PHISH_CUR_G293_07050803 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G293_07050803 0.001

# Email.Phishing.Cur.Gen294.Sanesecurity.07050804
rawbody  SS_PHISH_CUR_G294_07050804 /\/\.paypal\/cgi-bin\//i
describe SS_PHISH_CUR_G294_07050804 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G294_07050804 0.001

# Email.Phishing.Cur.Gen295.Sanesecurity.07050805
rawbody  SS_PHISH_CUR_G295_07050805 /http:\/\/.{0,50}\/~.{0,100}www\.Cahoot\.com/i
describe SS_PHISH_CUR_G295_07050805 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G295_07050805 0.001

# Email.Phishing.Cur.Gen296.Sanesecurity.07050900
rawbody  SS_PHISH_CUR_G296_07050900 /\/\.bancopostaonline\.poste\.it\//i
describe SS_PHISH_CUR_G296_07050900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G296_07050900 0.001

# Email.Phishing.Cur.Gen297.Sanesecurity.07051000
rawbody  SS_PHISH_CUR_G297_07051000 /\/Home_files\/signin\.php\?email_from=3Dauctions/i
describe SS_PHISH_CUR_G297_07051000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G297_07051000 0.001

# Email.Phishing.Cur.Gen298.Sanesecurity.07051001
rawbody  SS_PHISH_CUR_G298_07051001 /\.kr\/mail\/halifax-online\.co\.uk\//i
describe SS_PHISH_CUR_G298_07051001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G298_07051001 0.001

# Email.Phishing.Cur.Gen299.Sanesecurity.07051002
rawbody  SS_PHISH_CUR_G299_07051002 /\.webshots\.com\/image\/.*http:\/\/www\.poste\.it\//i
describe SS_PHISH_CUR_G299_07051002 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G299_07051002 0.001

# Html.Phishing.Cur.Gen300.Sanesecurity.07051100
body     SS_PHISH_CUR_G300_07051100 /<strong>ebay unpaid item dispute \#.*<a href="http:\/\/singin/i
describe SS_PHISH_CUR_G300_07051100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G300_07051100 0.001

# Email.Phishing.Cur.Gen301.Sanesecurity.07051001
rawbody  SS_PHISH_CUR_G301_07051001 /\/\.arizona\.php">http:\/\/www\.azfcu\.com\//i
describe SS_PHISH_CUR_G301_07051001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G301_07051001 0.001

# Email.Phishing.Cur.Gen302.Sanesecurity.07051002
rawbody  SS_PHISH_CUR_G302_07051002 /\.verizon\.net\/redirect_boa\.html"><span id="lw_1178618015_2">www\.bankofamerica\.com/i
describe SS_PHISH_CUR_G302_07051002 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G302_07051002 0.001

# Html.Phishing.Cur.Gen303.Sanesecurity.07051200
body     SS_PHISH_CUR_G303_07051200 /ebay sent this message to.*http:\/\/uk\.f262\.mail\.yahoo\.com\/ym\/compose\?to/i
describe SS_PHISH_CUR_G303_07051200 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G303_07051200 0.001

# Email.Phishing.Cur.Gen304.Sanesecurity.07051300
rawbody  SS_PHISH_CUR_G304_07051300 /\/SIG=148vsd1jp\/EXP=1138544186\//i
describe SS_PHISH_CUR_G304_07051300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G304_07051300 0.001

# Email.Phishing.Cur.Gen305.Sanesecurity.07051301
rawbody  SS_PHISH_CUR_G305_07051301 /\/SIG=12cpokol2\/EXP=1155942076\//i
describe SS_PHISH_CUR_G305_07051301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G305_07051301 0.001

# Email.Phishing.Cur.Gen306.Sanesecurity.07051302
rawbody  SS_PHISH_CUR_G306_07051302 /\/\%20\/www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G306_07051302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G306_07051302 0.001

# Email.Phishing.Cur.Gen307.Sanesecurity.07051303
rawbody  SS_PHISH_CUR_G307_07051303 /http:\/\/signin\.cgi\.com\.wsisapii\.dll\.usingssl\.mybay\.co-partnerid\.sapii/i
describe SS_PHISH_CUR_G307_07051303 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G307_07051303 0.001

# Email.Phishing.Cur.Gen308.Sanesecurity.07051304
rawbody  SS_PHISH_CUR_G308_07051304 /http:\/\/singin.{0,150}ebay/i
describe SS_PHISH_CUR_G308_07051304 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G308_07051304 0.001

# Email.Phishing.Cur.Gen309.Sanesecurity.07051305
rawbody  SS_PHISH_CUR_G309_07051305 /http:\/\/singin.{0,150}eBay/i
describe SS_PHISH_CUR_G309_07051305 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G309_07051305 0.001

# Email.Phishing.Cur.Gen310.Sanesecurity.07051306
rawbody  SS_PHISH_CUR_G310_07051306 /\/\.account\/www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G310_07051306 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G310_07051306 0.001

# Email.Phishing.Cur.Gen311.Sanesecurity.07051307
rawbody  SS_PHISH_CUR_G311_07051307 /\/\.secure-red\//i
describe SS_PHISH_CUR_G311_07051307 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G311_07051307 0.001

# Email.Phishing.Cur.Gen312.Sanesecurity.07051308
rawbody  SS_PHISH_CUR_G312_07051308 /ftp:\/\/.{0,150}\.ebay\./i
describe SS_PHISH_CUR_G312_07051308 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G312_07051308 0.001

# Email.Phishing.Cur.Gen313.Sanesecurity.07051308
rawbody  SS_PHISH_CUR_G313_07051308 /http:\/\/adsl.{0,150}\/www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G313_07051308 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G313_07051308 0.001

# Email.Phishing.Cur.Gen314.Sanesecurity.07051309
rawbody  SS_PHISH_CUR_G314_07051309 /http:\/\/www\.postbank\.de\.-snm-/i
describe SS_PHISH_CUR_G314_07051309 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G314_07051309 0.001

# Email.Phishing.Cur.Gen315.Sanesecurity.07051310
rawbody  SS_PHISH_CUR_G315_07051310 /http:\/\/www\.nordea\.com\.sitemod\.session/i
describe SS_PHISH_CUR_G315_07051310 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G315_07051310 0.001

# Email.Phishing.Cur.Gen316.Sanesecurity.07051311
rawbody  SS_PHISH_CUR_G316_07051311 /http:\/\/online\.bbt\.com\.onlineservlet_id/i
describe SS_PHISH_CUR_G316_07051311 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G316_07051311 0.001

# Email.Phishing.Cur.Gen317.Sanesecurity.07051400
rawbody  SS_PHISH_CUR_G317_07051400 /\/\.wumt\/asp\/westernunion\.com\//i
describe SS_PHISH_CUR_G317_07051400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G317_07051400 0.001

# Email.Phishing.Cur.Gen318.Sanesecurity.07051401
rawbody  SS_PHISH_CUR_G318_07051401 /\/\%20\/arizona-security\/index/i
describe SS_PHISH_CUR_G318_07051401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G318_07051401 0.001

# Email.Phishing.Cur.Gen319.Sanesecurity.07051402
rawbody  SS_PHISH_CUR_G319_07051402 /\.bravehost\.com\/PlaceYourCreditCard\.aspx/i
describe SS_PHISH_CUR_G319_07051402 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G319_07051402 0.001

# Email.Phishing.Cur.Gen320.Sanesecurity.07051500
rawbody  SS_PHISH_CUR_G320_07051500 /\/\%20\%20\/bancopostaonline\.poste\.it/i
describe SS_PHISH_CUR_G320_07051500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G320_07051500 0.001

# Email.Phishing.Cur.Gen321.Sanesecurity.07051501
rawbody  SS_PHISH_CUR_G321_07051501 /<a href="http:\/\/0x.{0,30}\/bancopostaon-line\.poste\.it\//i
describe SS_PHISH_CUR_G321_07051501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G321_07051501 0.001

# Email.Phishing.Cur.Gen322.Sanesecurity.07051502
rawbody  SS_PHISH_CUR_G322_07051502 /You have 1 New Secure Message!.*<A href="http:\/\/search\.aol\.com\/aolcom\/redir\?src=websearch\&requestId=/i
describe SS_PHISH_CUR_G322_07051502 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G322_07051502 0.001

# Email.Phishing.Cur.Gen323.Sanesecurity.07051503
rawbody  SS_PHISH_CUR_G323_07051503 /From:.{0,50}\@paypal\.com>.*http:\/\/ourworld\.cs\.com\/.*rect" coords=/i
describe SS_PHISH_CUR_G323_07051503 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G323_07051503 0.001

# Email.Phishing.Cur.Gen324.Sanesecurity.07051600
rawbody  SS_PHISH_CUR_G324_07051600 /\/\.https\/signin\.ebay\.com\//i
describe SS_PHISH_CUR_G324_07051600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G324_07051600 0.001

# Email.Phishing.Cur.Gen325.Sanesecurity.07051601
rawbody  SS_PHISH_CUR_G325_07051601 /\/formlogin\.txt" target="_blank"><img src="http:\/\/www\.poste\.it\//i
describe SS_PHISH_CUR_G325_07051601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G325_07051601 0.001

# Email.Phishing.Cur.Gen326.Sanesecurity.07051700
rawbody  SS_PHISH_CUR_G326_07051700 /http:\/\/signin\.ebay\.com\.ws\./i
describe SS_PHISH_CUR_G326_07051700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G326_07051700 0.001

# Email.Phishing.Cur.Gen327.Sanesecurity.07051701
rawbody  SS_PHISH_CUR_G327_07051701 /http:\/\/www\.saake\.de\/mediac\/400_0\/media\/ebay_logo_sm\.gif/i
describe SS_PHISH_CUR_G327_07051701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G327_07051701 0.001

# Email.Phishing.Cur.Gen328.Sanesecurity.07051702
rawbody  SS_PHISH_CUR_G328_07051702 /\/cache\/signin\.ebay\.com\/ws\/eBayISAPI\.dll/i
describe SS_PHISH_CUR_G328_07051702 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G328_07051702 0.001

# Email.Phishing.Cur.Gen329.Sanesecurity.07051703
rawbody  SS_PHISH_CUR_G329_07051703 /\/http\.www\.bankofamerica\.com\.deposits\.checksave\.index/i
describe SS_PHISH_CUR_G329_07051703 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G329_07051703 0.001

# Email.Phishing.Cur.Gen330.Sanesecurity.07051704
rawbody  SS_PHISH_CUR_G330_07051704 /\/\.ibank\.postaonline\.poste\.it\//i
describe SS_PHISH_CUR_G330_07051704 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G330_07051704 0.001

# Email.Phishing.Cur.Gen331.Sanesecurity.07052000
rawbody  SS_PHISH_CUR_G331_07052000 /\/\.\%20\/Poste\/bancopostaonline\.poste\.it\//i
describe SS_PHISH_CUR_G331_07052000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G331_07052000 0.001

# Email.Phishing.Cur.Gen332.Sanesecurity.07052100
rawbody  SS_PHISH_CUR_G332_07052100 /PosteItaliane.*\.imageshack\.us\/img/i
describe SS_PHISH_CUR_G332_07052100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G332_07052100 0.001

# Email.Phishing.Cur.Gen333.Sanesecurity.07052101
rawbody  SS_PHISH_CUR_G333_07052101 /poste\.it.*\.webshots\.com\/image\//i
describe SS_PHISH_CUR_G333_07052101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G333_07052101 0.001

# Email.Phishing.Cur.Gen334.Sanesecurity.07052200
rawbody  SS_PHISH_CUR_G334_07052200 /\/\.flagstar\.com\//i
describe SS_PHISH_CUR_G334_07052200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G334_07052200 0.001

# Email.Phishing.Cur.Gen335.Sanesecurity.07052201
rawbody  SS_PHISH_CUR_G335_07052201 /www\.geocities\.com.*http:\/\/www\.poste\.it\//i
describe SS_PHISH_CUR_G335_07052201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G335_07052201 0.001

# Email.Phishing.Cur.Gen336.Sanesecurity.07052202
rawbody  SS_PHISH_CUR_G336_07052202 /http:\/\/www\.poste\.it\/.*http:\/\/cpe-.{0,100}\.rr\.com\//i
describe SS_PHISH_CUR_G336_07052202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G336_07052202 0.001

# Email.Phishing.Cur.Gen337.Sanesecurity.07052300
rawbody  SS_PHISH_CUR_G337_07052300 /\/\.wumt\.westernunion\.com\//i
describe SS_PHISH_CUR_G337_07052300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G337_07052300 0.001

# Email.Phishing.Cur.Gen338.Sanesecurity.07052400
rawbody  SS_PHISH_CUR_G338_07052400 /:82\/www\.ebay\.com\//i
describe SS_PHISH_CUR_G338_07052400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G338_07052400 0.001

# Email.Phishing.Cur.Gen339.Sanesecurity.07052500
rawbody  SS_PHISH_CUR_G339_07052500 /\/user\/SingInUssingISSAPI/i
describe SS_PHISH_CUR_G339_07052500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G339_07052500 0.001

# Email.Phishing.Cur.Gen340.Sanesecurity.07052501
rawbody  SS_PHISH_CUR_G340_07052501 /www\.paypal\.compaypalcgi/i
describe SS_PHISH_CUR_G340_07052501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G340_07052501 0.001

# Email.Phishing.Cur.Gen341.Sanesecurity.07052700
rawbody  SS_PHISH_CUR_G341_07052700 /http:\/\/signin\.ebay\.com\.ebay/i
describe SS_PHISH_CUR_G341_07052700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G341_07052700 0.001

# Email.Phishing.Cur.Gen342.Sanesecurity.07052900
rawbody  SS_PHISH_CUR_G342_07052900 /\/\.paypal\.com\//i
describe SS_PHISH_CUR_G342_07052900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G342_07052900 0.001

# Email.Phishing.Cur.Gen343.Sanesecurity.07052901
rawbody  SS_PHISH_CUR_G343_07052901 /<a href="http:\/\/.{0,50}\/www\.paypal\.com\/.*<img src="http:\/\/.{0,50}\.imageshack\.us\//i
describe SS_PHISH_CUR_G343_07052901 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G343_07052901 0.001

# Email.Phishing.Cur.Gen344.Sanesecurity.07052902
rawbody  SS_PHISH_CUR_G344_07052902 /\/\.cgi\/www\.flagstar\.com\//i
describe SS_PHISH_CUR_G344_07052902 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G344_07052902 0.001

# Email.Phishing.Cur.Gen345.Sanesecurity.07060100
rawbody  SS_PHISH_CUR_G345_07060100 /:82\/eBayISAPI\.dll/i
describe SS_PHISH_CUR_G345_07060100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G345_07060100 0.001

# Email.Phishing.Cur.Gen346.Sanesecurity.07060400
rawbody  SS_PHISH_CUR_G346_07060400 /phpBB2\/includes\/Wellsfargo/i
describe SS_PHISH_CUR_G346_07060400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G346_07060400 0.001

# Email.Phishing.Cur.Gen347.Sanesecurity.07060401
rawbody  SS_PHISH_CUR_G347_07060401 /http:\/\/signin\.ebay\.com\.(0|1|2|3|4|5|6|7|8|9)/i
describe SS_PHISH_CUR_G347_07060401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G347_07060401 0.001

# Email.Phishing.Cur.Gen348.Sanesecurity.07060402
rawbody  SS_PHISH_CUR_G348_07060402 /\.ws43\.com\/eBayISAPI/i
describe SS_PHISH_CUR_G348_07060402 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G348_07060402 0.001

# Email.Phishing.Cur.Gen349.Sanesecurity.07060403
rawbody  SS_PHISH_CUR_G349_07060403 /\/\.~\/ws\/eBayISAPI/i
describe SS_PHISH_CUR_G349_07060403 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G349_07060403 0.001

# Email.Phishing.Cur.Gen350.Sanesecurity.07060404
rawbody  SS_PHISH_CUR_G350_07060404 /amp\;item=130025826611\&amp\;sspagename/i
describe SS_PHISH_CUR_G350_07060404 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G350_07060404 0.001

# Email.Phishing.Cur.Gen351.Sanesecurity.07060405
rawbody  SS_PHISH_CUR_G351_07060405 /\/ws\.signin\.ebay\.com\.www\.ebay\.com\.eBayISAPI/i
describe SS_PHISH_CUR_G351_07060405 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G351_07060405 0.001

# Email.Phishing.Cur.Gen352.Sanesecurity.07060406
rawbody  SS_PHISH_CUR_G352_07060406 /\/~mysql\/index\.html" target="_blank"><img src="http:\/\/www\.compassbank/i
describe SS_PHISH_CUR_G352_07060406 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G352_07060406 0.001

# Email.Phishing.Cur.Gen353.Sanesecurity.07060407
rawbody  SS_PHISH_CUR_G353_07060407 /\/\.\%20\.\%20\%20\/index\.html">https:\/\//i
describe SS_PHISH_CUR_G353_07060407 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G353_07060407 0.001

# Email.Phishing.Cur.Gen354.Sanesecurity.07060500
rawbody  SS_PHISH_CUR_G354_07060500 /<!-- saved from url=\(0074\)https:\/\/www\.halifax-online\.co\.uk\//i
describe SS_PHISH_CUR_G354_07060500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G354_07060500 0.001

# Email.Phishing.Cur.Gen355.Sanesecurity.07060600
rawbody  SS_PHISH_CUR_G355_07060600 /\.2itb\.com" rel=nofollow><FONT face=arial color=\#003399 size=2>http:\/\/www\.ebay\.co/i
describe SS_PHISH_CUR_G355_07060600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G355_07060600 0.001

# Email.Phishing.Cur.Gen356.Sanesecurity.07060700
rawbody  SS_PHISH_CUR_G356_07060700 /\/~www\/online\.compassweb\.com\//i
describe SS_PHISH_CUR_G356_07060700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G356_07060700 0.001

# Email.Phishing.Cur.Gen357.Sanesecurity.07060701
rawbody  SS_PHISH_CUR_G357_07060701 /\/www\.paypal\.com\/\.us\/cgi-bin\//i
describe SS_PHISH_CUR_G357_07060701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G357_07060701 0.001

# Email.Phishing.Cur.Gen358.Sanesecurity.07060800
rawbody  SS_PHISH_CUR_G358_07060800 /alt="royal bank login\.\.\." src="http:\/\/new\.egg\.com/i
describe SS_PHISH_CUR_G358_07060800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G358_07060800 0.001

# Email.Phishing.Cur.Gen359.Sanesecurity.07061000
rawbody  SS_PHISH_CUR_G359_07061000 /<IMG src="file:\/\/\/D:\/12-14-04_VISA_email\.jpg">/i
describe SS_PHISH_CUR_G359_07061000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G359_07061000 0.001

# Email.Phishing.Cur.Gen360.Sanesecurity.07061001
rawbody  SS_PHISH_CUR_G360_07061001 /sessionid=0000ysubPS5QGj4H1ydcBhrNbn\/index\.htm"/i
describe SS_PHISH_CUR_G360_07061001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G360_07061001 0.001

# Email.Phishing.Cur.Gen361.Sanesecurity.07061002
rawbody  SS_PHISH_CUR_G361_07061002 /\/\.poste\//i
describe SS_PHISH_CUR_G361_07061002 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G361_07061002 0.001

# Email.Phishing.Cur.Gen362.Sanesecurity.07061003
rawbody  SS_PHISH_CUR_G362_07061003 /\.com\.mx\/rra\/vacu\/index\.html"><i>click here<\/i>/i
describe SS_PHISH_CUR_G362_07061003 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G362_07061003 0.001

# Email.Phishing.Cur.Gen363.Sanesecurity.07061004
rawbody  SS_PHISH_CUR_G363_07061004 /\.imageshack\.us\/.*www\.poste\.it/i
describe SS_PHISH_CUR_G363_07061004 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G363_07061004 0.001

# Email.Phishing.Cur.Gen364.Sanesecurity.07061005
rawbody  SS_PHISH_CUR_G364_07061005 /\/\.paypalsecure\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G364_07061005 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G364_07061005 0.001

# Email.Phishing.Cur.Gen365.Sanesecurity.07061100
rawbody  SS_PHISH_CUR_G365_07061100 /\/\.sitekey\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G365_07061100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G365_07061100 0.001

# Email.Phishing.Cur.Gen366.Sanesecurity.07061101
rawbody  SS_PHISH_CUR_G366_07061101 /From:Flagstar Bank<update\@flagstar\.org>/i
describe SS_PHISH_CUR_G366_07061101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G366_07061101 0.001

# Email.Phishing.Cur.Gen367.Sanesecurity.07061102
rawbody  SS_PHISH_CUR_G367_07061102 /hostingprod\.com\/\@yourflagstarbanking/i
describe SS_PHISH_CUR_G367_07061102 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G367_07061102 0.001

# Email.Phishing.Cur.Gen368.Sanesecurity.07061200
rawbody  SS_PHISH_CUR_G368_07061200 /:82\/powersellers\/ebay\.com\//i
describe SS_PHISH_CUR_G368_07061200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G368_07061200 0.001

# Email.Phishing.Cur.Gen369.Sanesecurity.07061201
rawbody  SS_PHISH_CUR_G369_07061201 /From: "Bank Of America"<online\@bankofamerica\.com>/i
describe SS_PHISH_CUR_G369_07061201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G369_07061201 0.001

# Email.Phishing.Cur.Gen370.Sanesecurity.07061300
rawbody  SS_PHISH_CUR_G370_07061300 /:82\/cgi-eBayISAPI\.dll\//i
describe SS_PHISH_CUR_G370_07061300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G370_07061300 0.001

# Email.Phishing.Cur.Gen371.Sanesecurity.07061301
rawbody  SS_PHISH_CUR_G371_07061301 /Dear ebay Member,/i
describe SS_PHISH_CUR_G371_07061301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G371_07061301 0.001

# Email.Phishing.Cur.Gen372.Sanesecurity.07061302
rawbody  SS_PHISH_CUR_G372_07061302 /From: "eBay"<SNPDNOTICE\@eBay\.com>/i
describe SS_PHISH_CUR_G372_07061302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G372_07061302 0.001

# Email.Phishing.Cur.Gen373.Sanesecurity.07061303
rawbody  SS_PHISH_CUR_G373_07061303 /\.narod\.ru\/httppayypal11/i
describe SS_PHISH_CUR_G373_07061303 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G373_07061303 0.001

# Email.Phishing.Cur.Gen374.Sanesecurity.07061304
rawbody  SS_PHISH_CUR_G374_07061304 /pixel\.gif" width=1 border=0>58M63536JS494714B<\/TD><\/TR><\/TBODY><\/TABLE><BR>/i
describe SS_PHISH_CUR_G374_07061304 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G374_07061304 0.001

# Email.Phishing.Cur.Gen375.Sanesecurity.07061500
rawbody  SS_PHISH_CUR_G375_07061500 /http:\/\/.{0,50}\/~.{0,100}www\.wachovia\.com/i
describe SS_PHISH_CUR_G375_07061500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G375_07061500 0.001

# Email.Phishing.Cur.Gen376.Sanesecurity.07061501
rawbody  SS_PHISH_CUR_G376_07061501 /- eCommerce Davison/i
describe SS_PHISH_CUR_G376_07061501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G376_07061501 0.001

# Email.Phishing.Cur.Gen377.Sanesecurity.07061700
rawbody  SS_PHISH_CUR_G377_07061700 /http:\/\/.{0,50}\.by\.ru\/.*http:\/\/pics\.ebaystatic\.com\//i
describe SS_PHISH_CUR_G377_07061700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G377_07061700 0.001

# Email.Phishing.Cur.Gen378.Sanesecurity.07061701
rawbody  SS_PHISH_CUR_G378_07061701 /\.com\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G378_07061701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G378_07061701 0.001

# Email.Phishing.Cur.Gen379.Sanesecurity.07061702
rawbody  SS_PHISH_CUR_G379_07061702 /\/https\/ebay\.com\/eBayISAPIdll/i
describe SS_PHISH_CUR_G379_07061702 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G379_07061702 0.001

# Email.Phishing.Cur.Gen380.Sanesecurity.07061703
rawbody  SS_PHISH_CUR_G380_07061703 /Online Banking at <a target="_blank" href="http:\/\/host/i
describe SS_PHISH_CUR_G380_07061703 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G380_07061703 0.001

# Email.Phishing.Cur.Gen381.Sanesecurity.07061800
rawbody  SS_PHISH_CUR_G381_07061800 /redirect_boa\.html"><span id=3D"lw_1178618015_7">www\.bankofamerica/i
describe SS_PHISH_CUR_G381_07061800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G381_07061800 0.001

# Email.Phishing.Cur.Gen382.Sanesecurity.07061801
rawbody  SS_PHISH_CUR_G382_07061801 /\.land\.ru\/eb\.html\?ws\/eBayISAPI\.dll/i
describe SS_PHISH_CUR_G382_07061801 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G382_07061801 0.001

# Email.Phishing.Cur.Gen383.Sanesecurity.07061802
rawbody  SS_PHISH_CUR_G383_07061802 /http:\/\/cable-.*http:\/\/pics\.ebaystatic\.com\//i
describe SS_PHISH_CUR_G383_07061802 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G383_07061802 0.001

# Html.Phishing.Cur.Gen384.Sanesecurity.07061900
body     SS_PHISH_CUR_G384_07061900 /href="http:\/\/host.{0,150}sign in to bank of america online banking/i
describe SS_PHISH_CUR_G384_07061900 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G384_07061900 0.001

# Email.Phishing.Cur.Gen385.Sanesecurity.07062100
rawbody  SS_PHISH_CUR_G385_07062100 /From: "Paypal"<support\@paypal\.com>/i
describe SS_PHISH_CUR_G385_07062100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G385_07062100 0.001

# Email.Phishing.Cur.Gen386.Sanesecurity.07062200
rawbody  SS_PHISH_CUR_G386_07062200 /http:\/\/adsl-.{0,100}\/www\.midamericabank\.com\//i
describe SS_PHISH_CUR_G386_07062200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G386_07062200 0.001

# Email.Phishing.Cur.Gen387.Sanesecurity.07062201
rawbody  SS_PHISH_CUR_G387_07062201 /\/\.x\/index\.htm" target=_blank>/i
describe SS_PHISH_CUR_G387_07062201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G387_07062201 0.001

# Email.Phishing.Cur.Gen388.Sanesecurity.07062202
rawbody  SS_PHISH_CUR_G388_07062202 /\/\.https:\/www\.amazon\.com\//i
describe SS_PHISH_CUR_G388_07062202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G388_07062202 0.001

# Email.Phishing.Cur.Gen389.Sanesecurity.07062203
rawbody  SS_PHISH_CUR_G389_07062203 /\/anylogin\/SingInUssingISSAPIfromeBayVerifyaccount/i
describe SS_PHISH_CUR_G389_07062203 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G389_07062203 0.001

# Email.Phishing.Cur.Gen390.Sanesecurity.07062204
rawbody  SS_PHISH_CUR_G390_07062204 /\/\.wb\/">message CLICK HERE TO CONTINUE<\/a>/i
describe SS_PHISH_CUR_G390_07062204 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G390_07062204 0.001

# Email.Phishing.Cur.Gen391.Sanesecurity.07062205
rawbody  SS_PHISH_CUR_G391_07062205 /\.land\.ru\/.*http:\/\/www\.poste\.it\//i
describe SS_PHISH_CUR_G391_07062205 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G391_07062205 0.001

# Email.Phishing.Cur.Gen392.Sanesecurity.07062206
rawbody  SS_PHISH_CUR_G392_07062206 /\.pop3\.ru\/.*http:\/\/www\.poste\.it\//i
describe SS_PHISH_CUR_G392_07062206 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G392_07062206 0.001

# Email.Phishing.Cur.Gen393.Sanesecurity.07062207
rawbody  SS_PHISH_CUR_G393_07062207 /\/\.ssl\/azcentralcu\.org\//i
describe SS_PHISH_CUR_G393_07062207 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G393_07062207 0.001

# Email.Phishing.Cur.Gen394.Sanesecurity.07062500
rawbody  SS_PHISH_CUR_G394_07062500 /\/\.www\.ebay\.com\/eBayISAPI/i
describe SS_PHISH_CUR_G394_07062500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G394_07062500 0.001

# Email.Phishing.Cur.Gen395.Sanesecurity.07062501
rawbody  SS_PHISH_CUR_G395_07062501 /\.free\.fr\/http\/www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G395_07062501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G395_07062501 0.001

# Email.Phishing.Cur.Gen396.Sanesecurity.07062700
rawbody  SS_PHISH_CUR_G396_07062700 /target="_blank" href="http:\/\/adsl-.*Please visit Online Banking at/i
describe SS_PHISH_CUR_G396_07062700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G396_07062700 0.001

# Email.Phishing.Cur.Gen397.Sanesecurity.07062800
rawbody  SS_PHISH_CUR_G397_07062800 /\.onlinehome-server\.info\/sitekey\.bankofamerica/i
describe SS_PHISH_CUR_G397_07062800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G397_07062800 0.001

# Email.Phishing.Cur.Gen398.Sanesecurity.07070200.doc
rawbody  SS_PHISH_CUR_G398_07070200_DOC /AAAAR2VvAAAAAAAAAAAAHgAAAAEAAAAAAAAAHgAAAAEAAAAAAAAAHgAAAAEA.{0,3}AAAAAAAAHgAAAAQAAABHZW8AAAAAAAAAAAAeAAAAAgAAADEAAABAAAAAAAAA/i
describe SS_PHISH_CUR_G398_07070200_DOC SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G398_07070200_DOC 0.001

# Email.Phishing.Cur.Gen399.Sanesecurity.07070201
rawbody  SS_PHISH_CUR_G399_07070201 /http:\/\/xoomer\.alice\.it\/.*eBay/i
describe SS_PHISH_CUR_G399_07070201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G399_07070201 0.001

# Email.Phishing.Cur.Gen400.Sanesecurity.07070202
rawbody  SS_PHISH_CUR_G400_07070202 /http:\/\/www\.paypal\.com\.cgi\.bin\./i
describe SS_PHISH_CUR_G400_07070202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G400_07070202 0.001

# Email.Phishing.Cur.Gen401.Sanesecurity.07070203
rawbody  SS_PHISH_CUR_G401_07070203 /http:\/\/www\.rbs\.co\.uk\./i
describe SS_PHISH_CUR_G401_07070203 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G401_07070203 0.001

# Email.Phishing.Cur.Gen402.Sanesecurity.07070300
rawbody  SS_PHISH_CUR_G402_07070300 /\/robots\.txt\?signin\.ebay\.com\/ws\//i
describe SS_PHISH_CUR_G402_07070300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G402_07070300 0.001

# Email.Phishing.Cur.Gen403.Sanesecurity.07070301
rawbody  SS_PHISH_CUR_G403_07070301 /From: "eBay"<unpaiditem\@ebay\.com>/i
describe SS_PHISH_CUR_G403_07070301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G403_07070301 0.001

# Email.Phishing.Cur.Gen404.Sanesecurity.07070302
rawbody  SS_PHISH_CUR_G404_07070302 /\.cox\.net\/images\/flagstar\.anti-fraud\/index\.html/i
describe SS_PHISH_CUR_G404_07070302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G404_07070302 0.001

# Email.Phishing.Cur.Gen405.Sanesecurity.07070400
rawbody  SS_PHISH_CUR_G405_07070400 /\/\.x\/webscr\/cmd=_login-run\.html/i
describe SS_PHISH_CUR_G405_07070400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G405_07070400 0.001

# Email.Phishing.Cur.Gen406.Sanesecurity.07070401
rawbody  SS_PHISH_CUR_G406_07070401 /http:\/\/.{0,30}paypai\.com\//i
describe SS_PHISH_CUR_G406_07070401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G406_07070401 0.001

# Email.Phishing.Cur.Gen407.Sanesecurity.07070402
rawbody  SS_PHISH_CUR_G407_07070402 /http:\/\/home\.comcast\.net\/~.*http:\/\/pics\.ebaystatic\.com\//i
describe SS_PHISH_CUR_G407_07070402 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G407_07070402 0.001

# Email.Phishing.Cur.Gen408.Sanesecurity.07070600
rawbody  SS_PHISH_CUR_G408_07070600 /\/\.\.\.\/Chase_Online_Reward_Survey\/index\.htm/i
describe SS_PHISH_CUR_G408_07070600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G408_07070600 0.001

# Email.Phishing.Cur.Gen409.Sanesecurity.07070900
rawbody  SS_PHISH_CUR_G409_07070900 /\/\.ws\/singin\.ebay\.com\//i
describe SS_PHISH_CUR_G409_07070900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G409_07070900 0.001

# Email.Phishing.Cur.Gen410.Sanesecurity.07070901
rawbody  SS_PHISH_CUR_G410_07070901 /http:\/\/.{0,30}\.hinet-ip\.hinet\.net\/.*pics\.ebaystatic\.com/i
describe SS_PHISH_CUR_G410_07070901 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G410_07070901 0.001

# Email.Phishing.Cur.Gen411.Sanesecurity.07071000
rawbody  SS_PHISH_CUR_G411_07071000 /http:\/\/cpe-.*https:\/\/www\.paypay\.com\//i
describe SS_PHISH_CUR_G411_07071000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G411_07071000 0.001

# Email.Phishing.Cur.Gen412.Sanesecurity.07071001
rawbody  SS_PHISH_CUR_G412_07071001 /\.free\.fr\/.*lloydstsb\.co\.uk/i
describe SS_PHISH_CUR_G412_07071001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G412_07071001 0.001

# Email.Phishing.Cur.Gen413.Sanesecurity.07071002
rawbody  SS_PHISH_CUR_G413_07071002 /https:\/\/Securityalert\.HSBC\.co/i
describe SS_PHISH_CUR_G413_07071002 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G413_07071002 0.001

# Email.Phishing.Cur.Gen414.Sanesecurity.07071100
rawbody  SS_PHISH_CUR_G414_07071100 /\/\.wumt\/wumt\.westernunion\.com\//i
describe SS_PHISH_CUR_G414_07071100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G414_07071100 0.001

# Email.Phishing.Cur.Gen415.Sanesecurity.07071600
rawbody  SS_PHISH_CUR_G415_07071600 /\/paypaI_form"><img src="/i
describe SS_PHISH_CUR_G415_07071600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G415_07071600 0.001

# Email.Phishing.Cur.Gen416.Sanesecurity.07071601
rawbody  SS_PHISH_CUR_G416_07071601 /\/\.ws\/SignIn\/index\..*<BR>eBay/i
describe SS_PHISH_CUR_G416_07071601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G416_07071601 0.001

# Email.Phishing.Cur.Gen417.Sanesecurity.07071800
rawbody  SS_PHISH_CUR_G417_07071800 /\/\%20\.\/Internet\%20Banking\.htm/i
describe SS_PHISH_CUR_G417_07071800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G417_07071800 0.001

# Email.Phishing.Cur.Gen418.Sanesecurity.07071900
rawbody  SS_PHISH_CUR_G418_07071900 /<p><a target="_blank" rel="nofollow" href="http:\/\/paypaiconfirmation/i
describe SS_PHISH_CUR_G418_07071900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G418_07071900 0.001

# Email.Phishing.Cur.Gen419.Sanesecurity.07071901
rawbody  SS_PHISH_CUR_G419_07071901 /http:\/\/sigin-ebay-cgi-com\./i
describe SS_PHISH_CUR_G419_07071901 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G419_07071901 0.001

# Email.Phishing.Cur.Gen420.Sanesecurity.07071902
rawbody  SS_PHISH_CUR_G420_07071902 /message regarding item <A href="http:\/\/www\.ebay-com-ws/i
describe SS_PHISH_CUR_G420_07071902 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G420_07071902 0.001

# Email.Phishing.Cur.Gen421.Sanesecurity.07071903
rawbody  SS_PHISH_CUR_G421_07071903 /http:\/\/www\.signin-ebay-/i
describe SS_PHISH_CUR_G421_07071903 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G421_07071903 0.001

# Email.Phishing.Cur.Gen422.Sanesecurity.07072000
rawbody  SS_PHISH_CUR_G422_07072000 /Your account is limited\. <a rel=nofollow href="http:\/\/(0|1|2|3|4|5|6|7|8|9)/i
describe SS_PHISH_CUR_G422_07072000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G422_07072000 0.001

# Email.Phishing.Cur.Gen423.Sanesecurity.07072001
rawbody  SS_PHISH_CUR_G423_07072001 /google\.com\/images\?q=.*This email is sent from our secure server/i
describe SS_PHISH_CUR_G423_07072001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G423_07072001 0.001

# Email.Phishing.Cur.Gen424.Sanesecurity.07072300
rawbody  SS_PHISH_CUR_G424_07072300 /\/\.x\/paypal\/cmd=_login-run/i
describe SS_PHISH_CUR_G424_07072300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G424_07072300 0.001

# Email.Phishing.Cur.Gen425.Sanesecurity.07072301
rawbody  SS_PHISH_CUR_G425_07072301 /<a href="http:\/\/.{0,50}\.narod\.ru\/.*https:\/\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G425_07072301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G425_07072301 0.001

# Html.Phishing.Cur.Gen426.Sanesecurity.07072302
body     SS_PHISH_CUR_G426_07072302 /<title>question from ebay member -- respond now<\/title><meta name="generator" content="namo webeditor/i
describe SS_PHISH_CUR_G426_07072302 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G426_07072302 0.001

# Email.Phishing.Cur.Gen427.Sanesecurity.07072500
rawbody  SS_PHISH_CUR_G427_07072500 /been added to your PayPal account: <br><b><a href="http:\/\/.{0,100}by\.ru/i
describe SS_PHISH_CUR_G427_07072500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G427_07072500 0.001

# Email.Phishing.Cur.Gen428.Sanesecurity.07072501
rawbody  SS_PHISH_CUR_G428_07072501 /Your account is limited\..{0,100}http:\/\/.{0,50}\.dhcp\.embarqhsd\.net/i
describe SS_PHISH_CUR_G428_07072501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G428_07072501 0.001

# Email.Phishing.Cur.Gen429.Sanesecurity.07072502
rawbody  SS_PHISH_CUR_G429_07072502 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,100}\/pp\/" target="_blank" ><img src="http:\/\/images\.paypal/i
describe SS_PHISH_CUR_G429_07072502 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G429_07072502 0.001

# Email.Phishing.Cur.Gen430.Sanesecurity.07072600
rawbody  SS_PHISH_CUR_G430_07072600 /http:\/\/mysite\.verizon\.net\/.*\/signin\.ebay\.com/i
describe SS_PHISH_CUR_G430_07072600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G430_07072600 0.001

# Email.Phishing.Cur.Gen431.Sanesecurity.07072700
rawbody  SS_PHISH_CUR_G431_07072700 /http:\/\/www\.hsbc\.co\.uk\.session/i
describe SS_PHISH_CUR_G431_07072700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G431_07072700 0.001

# Email.Phishing.Cur.Gen432.Sanesecurity.07072701
rawbody  SS_PHISH_CUR_G432_07072701 /http:\/\/wsip-.{0,300}www\.paypal\.com/i
describe SS_PHISH_CUR_G432_07072701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G432_07072701 0.001

# Email.Phishing.Cur.Gen433.Sanesecurity.07072702
rawbody  SS_PHISH_CUR_G433_07072702 /http:\/\/sing-in-ebay-/i
describe SS_PHISH_CUR_G433_07072702 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G433_07072702 0.001

# Email.Phishing.Cur.Gen434.Sanesecurity.07072703
rawbody  SS_PHISH_CUR_G434_07072703 /\/\.vacu\/index\.html/i
describe SS_PHISH_CUR_G434_07072703 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G434_07072703 0.001

# Email.Phishing.Cur.Gen435.Sanesecurity.07072800
rawbody  SS_PHISH_CUR_G435_07072800 /\/\.www\.vacu\.org\//i
describe SS_PHISH_CUR_G435_07072800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G435_07072800 0.001

# Email.Phishing.Cur.Gen436.Sanesecurity.07072900
rawbody  SS_PHISH_CUR_G436_07072900 /http:\/\/www\.paypal\.com\.(0|1|2|3|4|5|6|7|8|9).{0,100}\/cmd-confirm\/login\.php/i
describe SS_PHISH_CUR_G436_07072900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G436_07072900 0.001

# Email.Phishing.Cur.Gen437.Sanesecurity.07072901
rawbody  SS_PHISH_CUR_G437_07072901 /http:\/\/signin\.ebay\.com\.(0|1|2|3|4|5|6|7|8|9).{0,100}\/saw-cgi\/eBayISAPI\.dll\//i
describe SS_PHISH_CUR_G437_07072901 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G437_07072901 0.001

# Email.Phishing.Cur.Gen438.Sanesecurity.07072902
rawbody  SS_PHISH_CUR_G438_07072902 /http:\/\/www\.weblog\.ro\/.*\/signin\.ebay\.com\/ws\.ebayISAPI\.dll/i
describe SS_PHISH_CUR_G438_07072902 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G438_07072902 0.001

# Email.Phishing.Cur.Gen439.Sanesecurity.07072903
rawbody  SS_PHISH_CUR_G439_07072903 /http:\/\/userconfirmationform-id(0|1|2|3|4|5|6|7|8|9).{0,100}userdirectory\/eBayISAPI\.dll\//i
describe SS_PHISH_CUR_G439_07072903 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G439_07072903 0.001

# Email.Phishing.Cur.Gen440.Sanesecurity.07072904
rawbody  SS_PHISH_CUR_G440_07072904 /\[http:\/\/site\.voila\.fr\/.{0,100}\/item9722396496\.html/i
describe SS_PHISH_CUR_G440_07072904 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G440_07072904 0.001

# Email.Phishing.Cur.Gen441.Sanesecurity.07072905
rawbody  SS_PHISH_CUR_G441_07072905 /http:\/\/singin.{0,150}ebay/i
describe SS_PHISH_CUR_G441_07072905 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G441_07072905 0.001

# Email.Phishing.Cur.Gen442.Sanesecurity.07072906
rawbody  SS_PHISH_CUR_G442_07072906 /http:\/\/xoomer\.alice\.it\/signin.{0,150}eBay/i
describe SS_PHISH_CUR_G442_07072906 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G442_07072906 0.001

# Email.Phishing.Cur.Gen443.Sanesecurity.07073000
rawbody  SS_PHISH_CUR_G443_07073000 /http:\/\/wumt\.westernunion\.com\.asp\./i
describe SS_PHISH_CUR_G443_07073000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G443_07073000 0.001

# Email.Phishing.Cur.Gen444.Sanesecurity.07073001
rawbody  SS_PHISH_CUR_G444_07073001 /\.imageshack\.us\/.*<b>Estimado cliente Visa<\/b>/i
describe SS_PHISH_CUR_G444_07073001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G444_07073001 0.001

# Email.Phishing.Cur.Gen445.Sanesecurity.07073002
rawbody  SS_PHISH_CUR_G445_07073002 /From: "PayPal Corp\."<service\@paypal\.com>.*<html><a href="http:\/\/(0|1|2|3|4|5|6|7|8|9)/i
describe SS_PHISH_CUR_G445_07073002 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G445_07073002 0.001

# Email.Phishing.Cur.Gen446.Sanesecurity.07073003
rawbody  SS_PHISH_CUR_G446_07073003 /From: "eBay"<secure\@ebay\.com>.*\.gif" border="0"><\/a><\/html>/i
describe SS_PHISH_CUR_G446_07073003 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G446_07073003 0.001

# Email.Phishing.Cur.Gen447.Sanesecurity.07073004
rawbody  SS_PHISH_CUR_G447_07073004 /<title>New Page 1<\/title>.*<img id="logo" alt="Wells Fargo Home/i
describe SS_PHISH_CUR_G447_07073004 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G447_07073004 0.001

# Email.Phishing.Cur.Gen448.Sanesecurity.07073005
rawbody  SS_PHISH_CUR_G448_07073005 /http:\/\/signlnmember\..*ebay\.com/i
describe SS_PHISH_CUR_G448_07073005 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G448_07073005 0.001

# Email.Phishing.Cur.Gen449.Sanesecurity.07073100
rawbody  SS_PHISH_CUR_G449_07073100 /\/\.cgi-bin\/wumt\/wumt\.westernunion\.com\//i
describe SS_PHISH_CUR_G449_07073100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G449_07073100 0.001

# Email.Phishing.Cur.Gen450.Sanesecurity.07073101
rawbody  SS_PHISH_CUR_G450_07073101 /http:\/\/sitekey\.bankofaemrica\.com-/i
describe SS_PHISH_CUR_G450_07073101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G450_07073101 0.001

# Email.Phishing.Cur.Gen451.Sanesecurity.07080600
rawbody  SS_PHISH_CUR_G451_07080600 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,30}\/eBayISAPI\.dll\.html/i
describe SS_PHISH_CUR_G451_07080600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G451_07080600 0.001

# Email.Phishing.Cur.Gen452.Sanesecurity.07080601
rawbody  SS_PHISH_CUR_G452_07080601 /<b>Resolution Center:<\/b> Your account is limited.*http:\/\/.{0,30}\.res\.rr\.com\//i
describe SS_PHISH_CUR_G452_07080601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G452_07080601 0.001

# Email.Phishing.Cur.Gen453.Sanesecurity.07080700
rawbody  SS_PHISH_CUR_G453_07080700 /<title>New Page 1<\/title>.*you are the account holder, you will need to reset your sign-in/i
describe SS_PHISH_CUR_G453_07080700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G453_07080700 0.001

# Email.Phishing.Cur.Gen454.Sanesecurity.07080800
rawbody  SS_PHISH_CUR_G454_07080800 /\/\.account-update\/index\.php/i
describe SS_PHISH_CUR_G454_07080800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G454_07080800 0.001

# Email.Phishing.Cur.Gen455.Sanesecurity.07080900
rawbody  SS_PHISH_CUR_G455_07080900 /href="msgpaypal_fichiers\/editdata\.mso">/i
describe SS_PHISH_CUR_G455_07080900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G455_07080900 0.001

# Email.Phishing.Cur.Gen456.Sanesecurity.07080900
rawbody  SS_PHISH_CUR_G456_07080900 /http:\/\/.{0,50}\/~.{0,100}<b>Click here to remove the limitation/i
describe SS_PHISH_CUR_G456_07080900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G456_07080900 0.001

# Email.Phishing.Cur.Gen457.Sanesecurity.07080901
rawbody  SS_PHISH_CUR_G457_07080901 /<input type=3D"hidden" name=3D"Mail_To" value=3D".*\.ebaystatic\.com\//i
describe SS_PHISH_CUR_G457_07080901 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G457_07080901 0.001

# Email.Phishing.Cur.Gen458.Sanesecurity.07081700
rawbody  SS_PHISH_CUR_G458_07081700 /\.vps\.webfusion\.co\.uk\/www\.nwolb\.com\//i
describe SS_PHISH_CUR_G458_07081700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G458_07081700 0.001

# Email.Phishing.Cur.Gen459.Sanesecurity.07081800
rawbody  SS_PHISH_CUR_G459_07081800 /http:\/\/bankingportal\.sparkasse\.de\./i
describe SS_PHISH_CUR_G459_07081800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G459_07081800 0.001

# Email.Phishing.Cur.Gen460.Sanesecurity.07081801
rawbody  SS_PHISH_CUR_G460_07081801 /\.session-(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9).{0,50}\.mibank\.com\./i
describe SS_PHISH_CUR_G460_07081801 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G460_07081801 0.001

# Email.Phishing.Cur.Gen461.Sanesecurity.07081802
rawbody  SS_PHISH_CUR_G461_07081802 /\.session-(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9).{0,50}\.citizensbank\.com\./i
describe SS_PHISH_CUR_G461_07081802 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G461_07081802 0.001

# Email.Phishing.Cur.Gen462.Sanesecurity.07081803
rawbody  SS_PHISH_CUR_G462_07081803 /\.session-(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9).{0,50}\.godaddy\.com\./i
describe SS_PHISH_CUR_G462_07081803 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G462_07081803 0.001

# Email.Phishing.Cur.Gen463.Sanesecurity.07081804
rawbody  SS_PHISH_CUR_G463_07081804 /connect-(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9).{0,50}\.northforkbank\.com\./i
describe SS_PHISH_CUR_G463_07081804 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G463_07081804 0.001

# Email.Phishing.Cur.Gen464.Sanesecurity.07081805
rawbody  SS_PHISH_CUR_G464_07081805 /session-(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9).{0,50}\.co\.uk\./i
describe SS_PHISH_CUR_G464_07081805 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G464_07081805 0.001

# Email.Phishing.Cur.Gen465.Sanesecurity.07081806
rawbody  SS_PHISH_CUR_G465_07081806 /session-(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9).{0,50}\.ameritrade\.com\./i
describe SS_PHISH_CUR_G465_07081806 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G465_07081806 0.001

# Email.Phishing.Cur.Gen466.Sanesecurity.07081807
rawbody  SS_PHISH_CUR_G466_07081807 /userconfirmationform-id(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9).{0,50}\.ebay\.com\./i
describe SS_PHISH_CUR_G466_07081807 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G466_07081807 0.001

# Email.Phishing.Cur.Gen467.Sanesecurity.07081808
rawbody  SS_PHISH_CUR_G467_07081808 /signin\.ebay\.com\.(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)/i
describe SS_PHISH_CUR_G467_07081808 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G467_07081808 0.001

# Email.Phishing.Cur.Gen468.Sanesecurity.07081809
rawbody  SS_PHISH_CUR_G468_07081809 /www\.paypal\.com\.(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)/i
describe SS_PHISH_CUR_G468_07081809 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G468_07081809 0.001

# Email.Phishing.Cur.Gen469.Sanesecurity.07081810
rawbody  SS_PHISH_CUR_G469_07081810 /xoomer\.alice\.it\/.{0,100}ebay/i
describe SS_PHISH_CUR_G469_07081810 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G469_07081810 0.001

# Email.Phishing.Cur.Gen470.Sanesecurity.07081811
rawbody  SS_PHISH_CUR_G470_07081811 /xoomer\.alice\.it\/.{0,100}Ebay/i
describe SS_PHISH_CUR_G470_07081811 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G470_07081811 0.001

# Email.Phishing.Cur.Gen471.Sanesecurity.07081812
rawbody  SS_PHISH_CUR_G471_07081812 /http:\/\/sitzungid_(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9).{0,50}\.sparkasse\.de\./i
describe SS_PHISH_CUR_G471_07081812 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G471_07081812 0.001

# Email.Phishing.Cur.Gen472.Sanesecurity.07081813
rawbody  SS_PHISH_CUR_G472_07081813 /http:\/\/ebanking-services-id(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9).{0,50}\.usbank\.com\./i
describe SS_PHISH_CUR_G472_07081813 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G472_07081813 0.001

# Email.Phishing.Cur.Gen473.Sanesecurity.07081814
rawbody  SS_PHISH_CUR_G473_07081814 /http:\/\/webexpress\.tdbanknorth\.com\./i
describe SS_PHISH_CUR_G473_07081814 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G473_07081814 0.001

# Email.Phishing.Cur.Gen474.Sanesecurity.07081900
rawbody  SS_PHISH_CUR_G474_07081900 /http:\/\/nfbconnect\.northforkbank\.com\./i
describe SS_PHISH_CUR_G474_07081900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G474_07081900 0.001

# Email.Phishing.Cur.Gen475.Sanesecurity.07081901
rawbody  SS_PHISH_CUR_G475_07081901 /\/\.\%20\/http:\/halifax-online\.co\.uk\//i
describe SS_PHISH_CUR_G475_07081901 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G475_07081901 0.001

# Email.Phishing.Cur.Gen476.Sanesecurity.07081902
rawbody  SS_PHISH_CUR_G476_07081902 /\/\.redirect\.ebay\.de\//i
describe SS_PHISH_CUR_G476_07081902 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G476_07081902 0.001

# Email.Phishing.Cur.Gen477.Sanesecurity.07081903
rawbody  SS_PHISH_CUR_G477_07081903 /http:\/\/www\.mybusinessbank\.co\.uk\./i
describe SS_PHISH_CUR_G477_07081903 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G477_07081903 0.001

# Email.Phishing.Cur.Gen478.Sanesecurity.07081904
rawbody  SS_PHISH_CUR_G478_07081904 /http:\/\/site\.voila\.fr\/.{0,100}item9722396492\.html/i
describe SS_PHISH_CUR_G478_07081904 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G478_07081904 0.001

# Email.Phishing.Cur.Gen479.Sanesecurity.07081905
rawbody  SS_PHISH_CUR_G479_07081905 /<o:Author>liliac<\/o:Author>.{0,100}<o:Revision>5<\/o:Revision>.{0,100}<o:Created>2007-03-21T13:17:00Z<\/o:Created>/i
describe SS_PHISH_CUR_G479_07081905 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G479_07081905 0.001

# Email.Phishing.Cur.Gen480.Sanesecurity.07081906
rawbody  SS_PHISH_CUR_G480_07081906 /Dear Value Customer,.{0,500}we have temporarily limited access/i
describe SS_PHISH_CUR_G480_07081906 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G480_07081906 0.001

# Email.Phishing.Cur.Gen481.Sanesecurity.07081907
rawbody  SS_PHISH_CUR_G481_07081907 /http:\/\/geocities\.com\/thegolden\.thegolden\/golden\.txt/i
describe SS_PHISH_CUR_G481_07081907 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G481_07081907 0.001

# Email.Phishing.Cur.Gen482.Sanesecurity.07082000
rawbody  SS_PHISH_CUR_G482_07082000 /http:\/\/mybusinessbank\.alliance-leicester\.co\.uk\./i
describe SS_PHISH_CUR_G482_07082000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G482_07082000 0.001

# Email.Phishing.Cur.Gen483.Sanesecurity.07082400
rawbody  SS_PHISH_CUR_G483_07082400 /http:\/\/www\.halifax-online\.co\.uk\./i
describe SS_PHISH_CUR_G483_07082400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G483_07082400 0.001

# Email.Phishing.Cur.Gen484.Sanesecurity.07082401
rawbody  SS_PHISH_CUR_G484_07082401 /\/\.www\.westernunion\.com\//i
describe SS_PHISH_CUR_G484_07082401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G484_07082401 0.001

# Email.Phishing.Cur.Gen485.Sanesecurity.07082402
rawbody  SS_PHISH_CUR_G485_07082402 /http:\/\/us\.etrade\.com\./i
describe SS_PHISH_CUR_G485_07082402 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G485_07082402 0.001

# Email.Phishing.Cur.Gen486.Sanesecurity.07082403
rawbody  SS_PHISH_CUR_G486_07082403 /http:\/\/www\.paypal\.com\.(a|b|c|d|e|f|g|h|i|J|k|l|m|n|o|p|q|r|s|t|u|v|w|x|y|z)\./i
describe SS_PHISH_CUR_G486_07082403 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G486_07082403 0.001

# Email.Phishing.Cur.Gen487.Sanesecurity.07082800
rawbody  SS_PHISH_CUR_G487_07082800 /http:\/\/(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9).{0,30}bankofamerica\.com/i
describe SS_PHISH_CUR_G487_07082800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G487_07082800 0.001

# Email.Phishing.Cur.Gen488.Sanesecurity.07082801
rawbody  SS_PHISH_CUR_G488_07082801 /http:\/\/www\.halifax\.co\.uk\./i
describe SS_PHISH_CUR_G488_07082801 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G488_07082801 0.001

# Email.Phishing.Cur.Gen489.Sanesecurity.07082802
rawbody  SS_PHISH_CUR_G489_07082802 /http:\/\/www\.hsbc\.co\.uk\./i
describe SS_PHISH_CUR_G489_07082802 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G489_07082802 0.001

# Email.Phishing.Cur.Gen490.Sanesecurity.07082900
rawbody  SS_PHISH_CUR_G490_07082900 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,15}\/www\.flagstarbanking2\.com\//i
describe SS_PHISH_CUR_G490_07082900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G490_07082900 0.001

# Email.Phishing.Cur.Gen491.Sanesecurity.07082901
rawbody  SS_PHISH_CUR_G491_07082901 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,15}\/accesd\.desjardins\.com\//i
describe SS_PHISH_CUR_G491_07082901 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G491_07082901 0.001

# Email.Phishing.Cur.Gen492.Sanesecurity.07083000
rawbody  SS_PHISH_CUR_G492_07083000 /target="_blank" title="http:\/\/www\.ncua\.gov">.{0,500}\.imageshack\.us\//i
describe SS_PHISH_CUR_G492_07083000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G492_07083000 0.001

# Email.Phishing.Cur.Gen493.Sanesecurity.07083001
rawbody  SS_PHISH_CUR_G493_07083001 /http:\/\/halifax\.co\.uk\./i
describe SS_PHISH_CUR_G493_07083001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G493_07083001 0.001

# Email.Phishing.Cur.Gen494.Sanesecurity.07083002
rawbody  SS_PHISH_CUR_G494_07083002 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,15}\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G494_07083002 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G494_07083002 0.001

# Email.Phishing.Cur.Gen495.Sanesecurity.07083100
rawbody  SS_PHISH_CUR_G495_07083100 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,15}\/signin\.ebay\.com/i
describe SS_PHISH_CUR_G495_07083100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G495_07083100 0.001

# Email.Phishing.Cur.Gen496.Sanesecurity.07083101
rawbody  SS_PHISH_CUR_G496_07083101 /http:\/\/nfbconnect\.cashman\.cgi-bin/i
describe SS_PHISH_CUR_G496_07083101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G496_07083101 0.001

# Email.Phishing.Cur.Gen497.Sanesecurity.07090100
rawbody  SS_PHISH_CUR_G497_07090100 /http:\/\/www\.online\.lloydstsb\.co\.uk\./i
describe SS_PHISH_CUR_G497_07090100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G497_07090100 0.001

# Email.Phishing.Cur.Gen498.Sanesecurity.07090101
rawbody  SS_PHISH_CUR_G498_07090101 /\/halifax-online\.co\.uk\/_mem_\/formslogin\.asp\/">http:\/\/halifax/i
describe SS_PHISH_CUR_G498_07090101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G498_07090101 0.001

# Email.Phishing.Cur.Gen499.Sanesecurity.07090300
rawbody  SS_PHISH_CUR_G499_07090300 /http:\/\/www\.rbsdigital\.com\./i
describe SS_PHISH_CUR_G499_07090300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G499_07090300 0.001

# Email.Phishing.Cur.Gen500.Sanesecurity.07090400
rawbody  SS_PHISH_CUR_G500_07090400 /http:\/\/www\.citibank\.co\.uk\./i
describe SS_PHISH_CUR_G500_07090400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G500_07090400 0.001

# Email.Phishing.Cur.Gen501.Sanesecurity.07090401
rawbody  SS_PHISH_CUR_G501_07090401 /http:\/\/session-(0|1|2|3|4|5|6|7|8|9).{0,15}\.paylinks\.cunet\.org\./i
describe SS_PHISH_CUR_G501_07090401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G501_07090401 0.001

# Email.Phishing.Cur.Gen502.Sanesecurity.07090402
rawbody  SS_PHISH_CUR_G502_07090402 /http:\/\/connect-(0|1|2|3|4|5|6|7|8|9).{0,15}\.abbey\.co\.uk\./i
describe SS_PHISH_CUR_G502_07090402 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G502_07090402 0.001

# Email.Phishing.Cur.Gen503.Sanesecurity.07090403
rawbody  SS_PHISH_CUR_G503_07090403 /http:\/\/online-business\.lloydstsb\.co\.uk\./i
describe SS_PHISH_CUR_G503_07090403 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G503_07090403 0.001

# Email.Phishing.Cur.Gen504.Sanesecurity.07090500
rawbody  SS_PHISH_CUR_G504_07090500 /http:\/\/www\.nwolb\.com\./i
describe SS_PHISH_CUR_G504_07090500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G504_07090500 0.001

# Email.Phishing.Cur.Gen505.Sanesecurity.07090501
rawbody  SS_PHISH_CUR_G505_07090501 /\/\.amazon-security-account\//i
describe SS_PHISH_CUR_G505_07090501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G505_07090501 0.001

# Email.Phishing.Cur.Gen506.Sanesecurity.07090502
rawbody  SS_PHISH_CUR_G506_07090502 /<b>Dear Lloyds TSB Customer,<\/b>.*http:\/\/pics\.ebaystatic\.com/i
describe SS_PHISH_CUR_G506_07090502 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G506_07090502 0.001

# Email.Phishing.Cur.Gen507.Sanesecurity.07090503
rawbody  SS_PHISH_CUR_G507_07090503 /http:\/\/olb2\.nationet\.com\./i
describe SS_PHISH_CUR_G507_07090503 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G507_07090503 0.001

# Email.Phishing.Cur.Gen508.Sanesecurity.07090700
rawbody  SS_PHISH_CUR_G508_07090700 /http:\/\/bancorpsouthonline\.inview\./i
describe SS_PHISH_CUR_G508_07090700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G508_07090700 0.001

# Email.Phishing.Cur.Gen509.Sanesecurity.07090701
rawbody  SS_PHISH_CUR_G509_07090701 /In order to read the message<b>.{0,50}http:\/\/mail\..{0,100}\/etrade\/"><i>click here<\/i><\/a> <\/b>to login/i
describe SS_PHISH_CUR_G509_07090701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G509_07090701 0.001

# Email.Phishing.Cur.Gen510.Sanesecurity.07090702
rawbody  SS_PHISH_CUR_G510_07090702 /return top\.js\.OpenExtLink\(window,event,this\)" href="http:\/\/.{0,100}\.land\.ru\/.*\.ebay\.com/i
describe SS_PHISH_CUR_G510_07090702 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G510_07090702 0.001

# Email.Phishing.Cur.Gen511.Sanesecurity.07090703
rawbody  SS_PHISH_CUR_G511_07090703 /\.webshots\.com\/image\/.*using our service you have to renew your online account\. If not, your online/i
describe SS_PHISH_CUR_G511_07090703 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G511_07090703 0.001

# Email.Phishing.Cur.Gen512.Sanesecurity.07090900
rawbody  SS_PHISH_CUR_G512_07090900 /vps\.webfusion\.co\.uk\/welcome27\.co-operativebank\.co\.uk\//i
describe SS_PHISH_CUR_G512_07090900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G512_07090900 0.001

# Email.Phishing.Cur.Gen513.Sanesecurity.07090901
rawbody  SS_PHISH_CUR_G513_07090901 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,100}alt=3D"Respond Now" src=3D"http:\/\/pics/i
describe SS_PHISH_CUR_G513_07090901 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G513_07090901 0.001

# Email.Phishing.Cur.Gen514.Sanesecurity.07091000
rawbody  SS_PHISH_CUR_G514_07091000 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,100}\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G514_07091000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G514_07091000 0.001

# Email.Phishing.Cur.Gen515.Sanesecurity.07091001
rawbody  SS_PHISH_CUR_G515_07091001 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,500}View the dispute thread/i
describe SS_PHISH_CUR_G515_07091001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G515_07091001 0.001

# Email.Phishing.Cur.Gen516.Sanesecurity.07091200
rawbody  SS_PHISH_CUR_G516_07091200 /\/\.webapps\/www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G516_07091200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G516_07091200 0.001

# Email.Phishing.Cur.Gen517.Sanesecurity.07091201
rawbody  SS_PHISH_CUR_G517_07091201 /\/\.connect\.to\.amazon\.com\//i
describe SS_PHISH_CUR_G517_07091201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G517_07091201 0.001

# Email.Phishing.Cur.Gen519.Sanesecurity.07091203
rawbody  SS_PHISH_CUR_G519_07091203 /\.vps\.webfusion\.co\.uk\/rbsdigital\.com\//i
describe SS_PHISH_CUR_G519_07091203 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G519_07091203 0.001

# Email.Phishing.Cur.Gen520.Sanesecurity.07091300
rawbody  SS_PHISH_CUR_G520_07091300 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,500}http:\/\/images\.paypal\.com\//i
describe SS_PHISH_CUR_G520_07091300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G520_07091300 0.001

# Email.Phishing.Cur.Gen521.Sanesecurity.07091301
rawbody  SS_PHISH_CUR_G521_07091301 /http:\/\/mellon-(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9).{6}\.inet\.web-access\.com\./i
describe SS_PHISH_CUR_G521_07091301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G521_07091301 0.001

# Email.Phishing.Cur.Gen522.Sanesecurity.07091302
rawbody  SS_PHISH_CUR_G522_07091302 /http:\/\/.{0,50}\.citizensbank\.com\./i
describe SS_PHISH_CUR_G522_07091302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G522_07091302 0.001

# Email.Phishing.Cur.Gen523.Sanesecurity.07091303
rawbody  SS_PHISH_CUR_G523_07091303 /http:\/\/onlinesession-(0|1|2|3|4|5|6|7|8|9).{0,100}\.natwest\.com\./i
describe SS_PHISH_CUR_G523_07091303 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G523_07091303 0.001

# Email.Phishing.Cur.Gen524.Sanesecurity.07091304
rawbody  SS_PHISH_CUR_G524_07091304 /http:\/\/.{0,50}\.rbs\.co\.uk\./i
describe SS_PHISH_CUR_G524_07091304 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G524_07091304 0.001

# Email.Phishing.Cur.Gen525.Sanesecurity.07091305
rawbody  SS_PHISH_CUR_G525_07091305 /\.paylinks\.cunet\.org\./i
describe SS_PHISH_CUR_G525_07091305 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G525_07091305 0.001

# Email.Phishing.Cur.Gen526.Sanesecurity.07091306
rawbody  SS_PHISH_CUR_G526_07091306 /http:\/\/.{0,50}\.rasbank\.it\./i
describe SS_PHISH_CUR_G526_07091306 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G526_07091306 0.001

# Email.Phishing.Cur.Gen527.Sanesecurity.07091307
rawbody  SS_PHISH_CUR_G527_07091307 /http:\/\/www\.bancaintesa\.it\./i
describe SS_PHISH_CUR_G527_07091307 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G527_07091307 0.001

# Email.Phishing.Cur.Gen528.Sanesecurity.07091308
rawbody  SS_PHISH_CUR_G528_07091308 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,500}>Click to Resolve<\/span><\/b><\/a>/i
describe SS_PHISH_CUR_G528_07091308 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G528_07091308 0.001

# Email.Phishing.Cur.Gen529.Sanesecurity.07091600
rawbody  SS_PHISH_CUR_G529_07091600 /\/\.eBay\.com\//i
describe SS_PHISH_CUR_G529_07091600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G529_07091600 0.001

# Email.Phishing.Cur.Gen530.Sanesecurity.07091601
rawbody  SS_PHISH_CUR_G530_07091601 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,500}\/www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G530_07091601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G530_07091601 0.001

# Email.Phishing.Cur.Gen531.Sanesecurity.07091800
rawbody  SS_PHISH_CUR_G531_07091800 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,500}\/sitekey\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G531_07091800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G531_07091800 0.001

# Email.Phishing.Cur.Gen532.Sanesecurity.07091801
rawbody  SS_PHISH_CUR_G532_07091801 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,500}<\/b>your <b>PayPal Online Account<\/b>/i
describe SS_PHISH_CUR_G532_07091801 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G532_07091801 0.001

# Email.Phishing.Cur.Gen533.Sanesecurity.07091802
rawbody  SS_PHISH_CUR_G533_07091802 /http:\/\/citibank\.com\.online/i
describe SS_PHISH_CUR_G533_07091802 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G533_07091802 0.001

# Email.Phishing.Cur.Gen534.Sanesecurity.07091803
rawbody  SS_PHISH_CUR_G534_07091803 /http:\/\/www\.capitalone\.com\.online/i
describe SS_PHISH_CUR_G534_07091803 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G534_07091803 0.001

# Email.Phishing.Cur.Gen535.Sanesecurity.07091804
rawbody  SS_PHISH_CUR_G535_07091804 /http:\/\/www\.citibank\.com\.online/i
describe SS_PHISH_CUR_G535_07091804 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G535_07091804 0.001

# Email.Phishing.Cur.Gen536.Sanesecurity.07091805
rawbody  SS_PHISH_CUR_G536_07091805 /\/thumbs\/admin\/db\/www\.nationwide\.co\.uk\//i
describe SS_PHISH_CUR_G536_07091805 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G536_07091805 0.001

# Email.Phishing.Cur.Gen537.Sanesecurity.07091806
rawbody  SS_PHISH_CUR_G537_07091806 /\/\.secure\/www\.irs\.gov\//i
describe SS_PHISH_CUR_G537_07091806 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G537_07091806 0.001

# Email.Phishing.Cur.Gen538.Sanesecurity.07091900
rawbody  SS_PHISH_CUR_G538_07091900 /To confirm your Online Banking records click.{0,50}http:\/\/0x/i
describe SS_PHISH_CUR_G538_07091900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G538_07091900 0.001

# Email.Phishing.Cur.Gen539.Sanesecurity.07091901
rawbody  SS_PHISH_CUR_G539_07091901 /http:\/\/www\.capitalone\.com\.upd/i
describe SS_PHISH_CUR_G539_07091901 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G539_07091901 0.001

# Email.Phishing.Cur.Gen540.Sanesecurity.07092000
rawbody  SS_PHISH_CUR_G540_07092000 /\/\.index2\.htm">here<\/a>, complete the renew form/i
describe SS_PHISH_CUR_G540_07092000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G540_07092000 0.001

# Email.Phishing.Cur.Gen541.Sanesecurity.07092100
rawbody  SS_PHISH_CUR_G541_07092100 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,500}\/www\.wachovia\.com\//i
describe SS_PHISH_CUR_G541_07092100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G541_07092100 0.001

# Email.Phishing.Cur.Gen542.Sanesecurity.07092101
rawbody  SS_PHISH_CUR_G542_07092101 /Internet Banking service" href="http:\/\/myuploadfolder\.com\//i
describe SS_PHISH_CUR_G542_07092101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G542_07092101 0.001

# Email.Phishing.Cur.Gen543.Sanesecurity.07092400
rawbody  SS_PHISH_CUR_G543_07092400 /\/\.\%20\/update\/BankOfAmerica\/update\/verify\/update\.bankofamerica\.us\//i
describe SS_PHISH_CUR_G543_07092400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G543_07092400 0.001

# Email.Phishing.Cur.Gen544.Sanesecurity.07092500
rawbody  SS_PHISH_CUR_G544_07092500 /New ALERT message.{0,50}complete the update form.{0,50}http:\/\/adsl-/i
describe SS_PHISH_CUR_G544_07092500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G544_07092500 0.001

# Email.Phishing.Cur.Gen545.Sanesecurity.07092600
rawbody  SS_PHISH_CUR_G545_07092600 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,500}Bank of America Customer Service/i
describe SS_PHISH_CUR_G545_07092600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G545_07092600 0.001

# Email.Phishing.Cur.Gen546.Sanesecurity.07092601
rawbody  SS_PHISH_CUR_G546_07092601 /\.tinypic\.com\/.{0,500}Online Banking account, and multiple/i
describe SS_PHISH_CUR_G546_07092601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G546_07092601 0.001

# Email.Phishing.Cur.Gen547.Sanesecurity.07092602
rawbody  SS_PHISH_CUR_G547_07092602 /\/httpsbank\.barclays\.co\.uk\//i
describe SS_PHISH_CUR_G547_07092602 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G547_07092602 0.001

# Email.Phishing.Cur.Gen548.Sanesecurity.07092700
rawbody  SS_PHISH_CUR_G548_07092700 /http:\/\/service\.bankofamerica\.com\./i
describe SS_PHISH_CUR_G548_07092700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G548_07092700 0.001

# Email.Phishing.Cur.Gen549.Sanesecurity.07092701
rawbody  SS_PHISH_CUR_G549_07092701 /\.moneymanagergps\.com\./i
describe SS_PHISH_CUR_G549_07092701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G549_07092701 0.001

# Email.Phishing.Cur.Gen550.Sanesecurity.07092702
rawbody  SS_PHISH_CUR_G550_07092702 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,500}Mondo BancoPosta/i
describe SS_PHISH_CUR_G550_07092702 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G550_07092702 0.001

# Email.Phishing.Cur.Gen551.Sanesecurity.07092800
rawbody  SS_PHISH_CUR_G551_07092800 /\.www\.capitalone\.com\//i
describe SS_PHISH_CUR_G551_07092800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G551_07092800 0.001

# Email.Phishing.Cur.Gen552.Sanesecurity.07100100
rawbody  SS_PHISH_CUR_G552_07100100 /:8080\/www\.visa\.com\//i
describe SS_PHISH_CUR_G552_07100100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G552_07100100 0.001

# Email.Phishing.Cur.Gen553.Sanesecurity.07100101
rawbody  SS_PHISH_CUR_G553_07100101 /To access the form for your tax refund.{0,500}http:\/\/rds\.yahoo\.com\/\*\*http:\/\//i
describe SS_PHISH_CUR_G553_07100101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G553_07100101 0.001

# Email.Phishing.Cur.Gen553.Sanesecurity.07100200
rawbody  SS_PHISH_CUR_G553_07100200 /http:\/\/id-.{0,30}\.citizensbankmoneymanagergps\.com\./i
describe SS_PHISH_CUR_G553_07100200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G553_07100200 0.001

# Email.Phishing.Cur.Gen554.Sanesecurity.07100201
rawbody  SS_PHISH_CUR_G554_07100201 /\.citizensbankmoneymanagergps\.com\./i
describe SS_PHISH_CUR_G554_07100201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G554_07100201 0.001

# Email.Phishing.Cur.Gen555.Sanesecurity.07100300
rawbody  SS_PHISH_CUR_G555_07100300 /http:\/\/www\.geocities\.com\/.{0,200}>You have 1 new Message!.*Login and resolve/i
describe SS_PHISH_CUR_G555_07100300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G555_07100300 0.001

# Email.Phishing.Cur.Gen556.Sanesecurity.07100500
rawbody  SS_PHISH_CUR_G556_07100500 /eBay is available to answer questions, but since it is the rights owner.*http:\/\/(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)/i
describe SS_PHISH_CUR_G556_07100500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G556_07100500 0.001

# Email.Phishing.Cur.Gen557.Sanesecurity.07100600
rawbody  SS_PHISH_CUR_G557_07100600 /www\.egg\.co\.uk\./i
describe SS_PHISH_CUR_G557_07100600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G557_07100600 0.001

# Email.Phishing.Cur.Gen558.Sanesecurity.07100601
rawbody  SS_PHISH_CUR_G558_07100601 /\/http:www\.visaeurope\.com\.country=uk/i
describe SS_PHISH_CUR_G558_07100601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G558_07100601 0.001

# Email.Phishing.Cur.Gen559.Sanesecurity.07100800
rawbody  SS_PHISH_CUR_G559_07100800 /From: "U\.S\. Bank"<online\.accounts\@aw-usbank\.com>/i
describe SS_PHISH_CUR_G559_07100800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G559_07100800 0.001

# Email.Phishing.Cur.Gen560.Sanesecurity.07100900
rawbody  SS_PHISH_CUR_G560_07100900 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,500}http:\/\/www\.lloydstsbbusiness\.com/i
describe SS_PHISH_CUR_G560_07100900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G560_07100900 0.001

# Email.Phishing.Cur.Gen561.Sanesecurity.07101000
rawbody  SS_PHISH_CUR_G561_07101000 /www\.natwest\.co\.uk\./i
describe SS_PHISH_CUR_G561_07101000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G561_07101000 0.001

# Email.Phishing.Cur.Gen562.Sanesecurity.07101001
rawbody  SS_PHISH_CUR_G562_07101001 /From: c-71-236-228-127\.hsd1\.or\.comcast\.net/i
describe SS_PHISH_CUR_G562_07101001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G562_07101001 0.001

# Email.Phishing.Cur.Gen563.Sanesecurity.07101300
rawbody  SS_PHISH_CUR_G563_07101300 /\/\.eByDLL\/index\.php/i
describe SS_PHISH_CUR_G563_07101300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G563_07101300 0.001

# Email.Phishing.Cur.Gen564.Sanesecurity.07101600
rawbody  SS_PHISH_CUR_G564_07101600 /\.vps\.webfusion\.co\.uk\/olb4\.nationet\.com\//i
describe SS_PHISH_CUR_G564_07101600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G564_07101600 0.001

# Email.Phishing.Cur.Gen565.Sanesecurity.07101601
rawbody  SS_PHISH_CUR_G565_07101601 /From: "service\@lloydstsb\.co\.uk"<service\@lloydstsb\.co\.uk>/i
describe SS_PHISH_CUR_G565_07101601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G565_07101601 0.001

# Email.Phishing.Cur.Gen566.Sanesecurity.07101602
rawbody  SS_PHISH_CUR_G566_07101602 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,500}\/www\.mazuma\.org\//i
describe SS_PHISH_CUR_G566_07101602 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G566_07101602 0.001

# Email.Phishing.Cur.Gen567.Sanesecurity.07101700
rawbody  SS_PHISH_CUR_G567_07101700 /\/LloydsTsb_customer\.htm/i
describe SS_PHISH_CUR_G567_07101700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G567_07101700 0.001

# Email.Phishing.Cur.Gen568.Sanesecurity.07102200
rawbody  SS_PHISH_CUR_G568_07102200 /http:\/\/wcma\.businesscenter\.BCPrivate\.asp/i
describe SS_PHISH_CUR_G568_07102200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G568_07102200 0.001

# Email.Phishing.Cur.Gen569.Sanesecurity.07102300
rawbody  SS_PHISH_CUR_G569_07102300 /http:\/\/www\.bxs\.inview\.session/i
describe SS_PHISH_CUR_G569_07102300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G569_07102300 0.001

# Email.Phishing.Cur.Gen570.Sanesecurity.07102400
rawbody  SS_PHISH_CUR_G570_07102400 /http:\/\/paylinks\.cunet\.org\.session-/i
describe SS_PHISH_CUR_G570_07102400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G570_07102400 0.001

# Email.Phishing.Cur.Gen571.Sanesecurity.07102500
rawbody  SS_PHISH_CUR_G571_07102500 /\.free\.fr\/www\.bankofameria\.com\//i
describe SS_PHISH_CUR_G571_07102500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G571_07102500 0.001

# Email.Phishing.Cur.Gen572.Sanesecurity.07102501
rawbody  SS_PHISH_CUR_G572_07102501 /please verify your personal online account.*src="http:\/\/tbn0\.google\.com\/images\?q=/i
describe SS_PHISH_CUR_G572_07102501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G572_07102501 0.001

# Email.Phishing.Cur.Gen573.Sanesecurity.07102502
rawbody  SS_PHISH_CUR_G573_07102502 /<img src="http:\/\/upload\.wikimedia\.org\/wikipedia\/commons\/thumb\/4\/4e\/Internal_Revenue_Service_logo\.png\/120px-Internal_Revenue_Service_logo\.png.*Individual Taxpayer Identification Number: 346 66 2715/i
describe SS_PHISH_CUR_G573_07102502 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G573_07102502 0.001

# Email.Phishing.Cur.Gen574.Sanesecurity.07102503
rawbody  SS_PHISH_CUR_G574_07102503 /http:\/\/www\.natwest\.co\.uk\./i
describe SS_PHISH_CUR_G574_07102503 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G574_07102503 0.001

# Email.Phishing.Cur.Gen575.Sanesecurity.07102700
rawbody  SS_PHISH_CUR_G575_07102700 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,500}Mobile Banking/i
describe SS_PHISH_CUR_G575_07102700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G575_07102700 0.001

# Email.Phishing.Cur.Gen576.Sanesecurity.07102900
rawbody  SS_PHISH_CUR_G576_07102900 /http:\/\/session03094009-natwest\.co\.uk\./i
describe SS_PHISH_CUR_G576_07102900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G576_07102900 0.001

# Email.Phishing.Cur.Gen577.Sanesecurity.07103000
rawbody  SS_PHISH_CUR_G577_07103000 /\.vps\.webfusion\.co\.uk\/myonlineaccounts3\.abbeynational\.co\.uk\//i
describe SS_PHISH_CUR_G577_07103000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G577_07103000 0.001

# Email.Phishing.Cur.Gen578.Sanesecurity.07103100
rawbody  SS_PHISH_CUR_G578_07103100 /\.free\.fr\/www\.nationwide\.co\.uk\//i
describe SS_PHISH_CUR_G578_07103100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G578_07103100 0.001

# Email.Phishing.Cur.Gen579.Sanesecurity.07110200
rawbody  SS_PHISH_CUR_G579_07110200 /http:\/\/(0|1|2|3|4|5|6|7|8|9).{0,500}\/paypal-secure\//i
describe SS_PHISH_CUR_G579_07110200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G579_07110200 0.001

# Email.Phishing.Cur.Gen580.Sanesecurity.07110201
rawbody  SS_PHISH_CUR_G580_07110201 /http:\/\/vr-networld\.de\./i
describe SS_PHISH_CUR_G580_07110201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G580_07110201 0.001

# Email.Phishing.Cur.Gen581.Sanesecurity.07110202
rawbody  SS_PHISH_CUR_G581_07110202 /\/www\.nationwides\.co\.uk\//i
describe SS_PHISH_CUR_G581_07110202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G581_07110202 0.001

# Email.Phishing.Cur.Gen582.Sanesecurity.07110400
rawbody  SS_PHISH_CUR_G582_07110400 /http:\/\/hiring-.{0,30}\.monster\.com\./i
describe SS_PHISH_CUR_G582_07110400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G582_07110400 0.001

# Email.Phishing.Cur.Gen583.Sanesecurity.07110401
rawbody  SS_PHISH_CUR_G583_07110401 /\.tdcanadatrust\.com\./i
describe SS_PHISH_CUR_G583_07110401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G583_07110401 0.001

# Email.Phishing.Cur.Gen584.Sanesecurity.07110402
rawbody  SS_PHISH_CUR_G584_07110402 /\.compassbank\.com\./i
describe SS_PHISH_CUR_G584_07110402 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G584_07110402 0.001

# Email.Phishing.Cur.Gen585.Sanesecurity.07110403
rawbody  SS_PHISH_CUR_G585_07110403 /\.comcast\.net\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G585_07110403 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G585_07110403 0.001

# Email.Phishing.Cur.Gen586.Sanesecurity.07110404
rawbody  SS_PHISH_CUR_G586_07110404 /\.bellsouth\.net\/www\.bancadiroma\.it\//i
describe SS_PHISH_CUR_G586_07110404 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G586_07110404 0.001

# Email.Phishing.Cur.Gen587.Sanesecurity.07110405
rawbody  SS_PHISH_CUR_G587_07110405 /\.bellsouth\.net\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G587_07110405 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G587_07110405 0.001

# Email.Phishing.Cur.Gen588.Sanesecurity.07110406
rawbody  SS_PHISH_CUR_G588_07110406 /http:\/\/home\.graffiti\.net\/.{0,200}QQcmdZacViewItem\.html/i
describe SS_PHISH_CUR_G588_07110406 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G588_07110406 0.001

# Email.Phishing.Cur.Gen589.Sanesecurity.07110407
rawbody  SS_PHISH_CUR_G589_07110407 /http:\/\/home\.myspace\.com\.index\.cfm\.fuseaction\.user\.mytoken\./i
describe SS_PHISH_CUR_G589_07110407 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G589_07110407 0.001

# Email.Phishing.Cur.Gen590.Sanesecurity.07110408
rawbody  SS_PHISH_CUR_G590_07110408 /http:\/\/secure\.paypal\.com\.login\./i
describe SS_PHISH_CUR_G590_07110408 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G590_07110408 0.001

# Email.Phishing.Cur.Gen591.Sanesecurity.07110409
rawbody  SS_PHISH_CUR_G591_07110409 /http:\/\/signin\.motors\.com\./i
describe SS_PHISH_CUR_G591_07110409 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G591_07110409 0.001

# Email.Phishing.Cur.Gen592.Sanesecurity.07110410
rawbody  SS_PHISH_CUR_G592_07110410 /http:\/\/site\.voila\.fr\/.{0,50}\/item972239649/i
describe SS_PHISH_CUR_G592_07110410 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G592_07110410 0.001

# Email.Phishing.Cur.Gen593.Sanesecurity.07110411
rawbody  SS_PHISH_CUR_G593_07110411 /\.cox\.net\/amazon\.com\//i
describe SS_PHISH_CUR_G593_07110411 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G593_07110411 0.001

# Email.Phishing.Cur.Gen594.Sanesecurity.07110412
rawbody  SS_PHISH_CUR_G594_07110412 /\.cox\.net\/www\.amazon\.com\//i
describe SS_PHISH_CUR_G594_07110412 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G594_07110412 0.001

# Email.Phishing.Cur.Gen595.Sanesecurity.07110413
rawbody  SS_PHISH_CUR_G595_07110413 /\.cox\.net\/paypal\.com\//i
describe SS_PHISH_CUR_G595_07110413 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G595_07110413 0.001

# Email.Phishing.Cur.Gen596.Sanesecurity.07110414
rawbody  SS_PHISH_CUR_G596_07110414 /\.cox\.net\/signin\.ebay\.com\//i
describe SS_PHISH_CUR_G596_07110414 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G596_07110414 0.001

# Email.Phishing.Cur.Gen597.Sanesecurity.07110415
rawbody  SS_PHISH_CUR_G597_07110415 /\.vps\.webfusion\.co\.uk\/olb(0|1|2|3|4|5|6|7|8|9)\.nationet\.com\//i
describe SS_PHISH_CUR_G597_07110415 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G597_07110415 0.001

# Email.Phishing.Cur.Gen598.Sanesecurity.07110416
rawbody  SS_PHISH_CUR_G598_07110416 /http:\/\/www\.eport\.equifax\.com\./i
describe SS_PHISH_CUR_G598_07110416 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G598_07110416 0.001

# Email.Phishing.Cur.Gen599.Sanesecurity.07110500
rawbody  SS_PHISH_CUR_G599_07110500 /http:\/\/citibankonline\.europe\.citigold\.citibank\.sessionstart/i
describe SS_PHISH_CUR_G599_07110500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G599_07110500 0.001

# Email.Phishing.Cur.Gen600.Sanesecurity.07110501
rawbody  SS_PHISH_CUR_G600_07110501 /http:\/\/session.{0,30}rbs\.co\.uk\./i
describe SS_PHISH_CUR_G600_07110501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G600_07110501 0.001

# Email.Phishing.Cur.Gen601.Sanesecurity.07110600
rawbody  SS_PHISH_CUR_G601_07110600 /<TD><IMG height=4 src="http:\/\/pics\.ebaystatic\.com\/aw\/pics\/s\.gif"><\/TD><\/TR><\/TBODY><\/TABLE><A title=http:\/\/(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)/i
describe SS_PHISH_CUR_G601_07110600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G601_07110600 0.001

# Email.Phishing.Cur.Gen602.Sanesecurity.07110601
rawbody  SS_PHISH_CUR_G602_07110601 /<title>New Page.*During our regular update and verification of the/i
describe SS_PHISH_CUR_G602_07110601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G602_07110601 0.001

# Email.Phishing.Cur.Gen603.Sanesecurity.07110700
rawbody  SS_PHISH_CUR_G603_07110700 /http:\/\/tbn0\.google\.com\/images\?q=tbn:.*For your security, your online banking profile has been locked/i
describe SS_PHISH_CUR_G603_07110700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G603_07110700 0.001

# Email.Phishing.Cur.Gen604.Sanesecurity.07110701
rawbody  SS_PHISH_CUR_G604_07110701 /http:\/\/sparkasse\.de\./i
describe SS_PHISH_CUR_G604_07110701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G604_07110701 0.001

# Email.Phishing.Cur.Gen605.Sanesecurity.07110702
rawbody  SS_PHISH_CUR_G605_07110702 /www\.hsbc\.co\.uk\./i
describe SS_PHISH_CUR_G605_07110702 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G605_07110702 0.001

# Email.Phishing.Cur.Gen606.Sanesecurity.07110703
rawbody  SS_PHISH_CUR_G606_07110703 /http:\/\/business\.ebanking-services\.nubi\./i
describe SS_PHISH_CUR_G606_07110703 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G606_07110703 0.001

# Email.Phishing.Cur.Gen607.Sanesecurity.07110800
rawbody  SS_PHISH_CUR_G607_07110800 /http:\/\/abbeynational\.co\.uk\./i
describe SS_PHISH_CUR_G607_07110800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G607_07110800 0.001

# Email.Phishing.Cur.Gen608.Sanesecurity.07110900
rawbody  SS_PHISH_CUR_G608_07110900 /\.abbeynational\.co\.uk\./i
describe SS_PHISH_CUR_G608_07110900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G608_07110900 0.001

# Email.Phishing.Cur.Gen609.Sanesecurity.07111100
rawbody  SS_PHISH_CUR_G609_07111100 /:82\/eBayISAPII/i
describe SS_PHISH_CUR_G609_07111100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G609_07111100 0.001

# Email.Phishing.Cur.Gen610.Sanesecurity.07111101
rawbody  SS_PHISH_CUR_G610_07111101 /http:\/\/www\.banesto\.es\./i
describe SS_PHISH_CUR_G610_07111101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G610_07111101 0.001

# Email.Phishing.Cur.Gen611.Sanesecurity.07111102
rawbody  SS_PHISH_CUR_G611_07111102 /http:\/\/myonlineaccounts.{0,3}\.abbey\.com\.agent/i
describe SS_PHISH_CUR_G611_07111102 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G611_07111102 0.001

# Email.Phishing.Cur.Gen612.Sanesecurity.07111200
rawbody  SS_PHISH_CUR_G612_07111200 /You have 1 new Message Alert.*http:\/\/cpe-.{0,20}\.rr\.com\//i
describe SS_PHISH_CUR_G612_07111200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G612_07111200 0.001

# Email.Phishing.Cur.Gen613.Sanesecurity.07111201
rawbody  SS_PHISH_CUR_G613_07111201 /http:\/\/(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9).{0,150}\/irs\.gov\//i
describe SS_PHISH_CUR_G613_07111201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G613_07111201 0.001

# Email.Phishing.Cur.Gen614.Sanesecurity.07111700
rawbody  SS_PHISH_CUR_G614_07111700 /http:\/\/myonlineaccounts.{0,10}\.abbey\.co\.uk\./i
describe SS_PHISH_CUR_G614_07111700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G614_07111700 0.001

# Email.Phishing.Cur.Gen615.Sanesecurity.07111701
rawbody  SS_PHISH_CUR_G615_07111701 /http:\/\/myonlineaccounts.{0,10}\.abbey\.com\./i
describe SS_PHISH_CUR_G615_07111701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G615_07111701 0.001

# Email.Phishing.Cur.Gen616.Sanesecurity.07111702
rawbody  SS_PHISH_CUR_G616_07111702 /\.webshots\.com\/.*Mondo BancoPosta/i
describe SS_PHISH_CUR_G616_07111702 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G616_07111702 0.001

# Email.Phishing.Cur.Gen617.Sanesecurity.07111703
rawbody  SS_PHISH_CUR_G617_07111703 /"><IMG alt=https:\/\/signin\.ebay\.com\/ws\/eBayISAPI\.dll\?SignIn hspace=0 src="http:\/\//i
describe SS_PHISH_CUR_G617_07111703 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G617_07111703 0.001

# Email.Phishing.Cur.Gen618.Sanesecurity.07111704
rawbody  SS_PHISH_CUR_G618_07111704 /Important Information Regarding Your Account.*<a href='http:\/\/.{0,30}\/\.\/~.{0,30}\/\.\/.{0,50}\.php\?cdn=/i
describe SS_PHISH_CUR_G618_07111704 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G618_07111704 0.001

# Email.Phishing.Cur.Gen619.Sanesecurity.07111705
rawbody  SS_PHISH_CUR_G619_07111705 /<td align="right" height="1"><img title="" heighA member of/i
describe SS_PHISH_CUR_G619_07111705 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G619_07111705 0.001

# Email.Phishing.Cur.Gen620.Sanesecurity.07111706
rawbody  SS_PHISH_CUR_G620_07111706 /westwood1967<\/A><A onclick="return top\.js\.OpenExtLink\(window,event,this\)" href="http:\/\//i
describe SS_PHISH_CUR_G620_07111706 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G620_07111706 0.001

# Email.Phishing.Cur.Gen621.Sanesecurity.07112100
rawbody  SS_PHISH_CUR_G621_07112100 /http:\/\/session.{0,30}\.sparkasse\.de\./i
describe SS_PHISH_CUR_G621_07112100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G621_07112100 0.001

# Email.Phishing.Cur.Gen622.Sanesecurity.07112200
rawbody  SS_PHISH_CUR_G622_07112200 /http:\/\/online\.lloydstsb\.co\.uk\./i
describe SS_PHISH_CUR_G622_07112200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G622_07112200 0.001

# Email.Phishing.Cur.Gen623.Sanesecurity.07112500
rawbody  SS_PHISH_CUR_G623_07112500 /http:\/\/(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9).{0,150}\/www\.regions\.com\//i
describe SS_PHISH_CUR_G623_07112500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G623_07112500 0.001

# Email.Phishing.Cur.Gen624.Sanesecurity.07112501
rawbody  SS_PHISH_CUR_G624_07112501 /http:\/\/login\.paypal\.com\.webscr\./i
describe SS_PHISH_CUR_G624_07112501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G624_07112501 0.001

# Email.Phishing.Cur.Gen625.Sanesecurity.07112600
rawbody  SS_PHISH_CUR_G625_07112600 /\/cgi1-ebay-com-wwwebaycomsent/i
describe SS_PHISH_CUR_G625_07112600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G625_07112600 0.001

# Email.Phishing.Cur.Gen626.Sanesecurity.07112601
rawbody  SS_PHISH_CUR_G626_07112601 /\/www-paypal-com\//i
describe SS_PHISH_CUR_G626_07112601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G626_07112601 0.001

# Email.Phishing.Cur.Gen627.Sanesecurity.07112602
rawbody  SS_PHISH_CUR_G627_07112602 /\/com\/www\.natwest\.com\//i
describe SS_PHISH_CUR_G627_07112602 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G627_07112602 0.001

# Email.Phishing.Cur.Gen628.Sanesecurity.07112800
rawbody  SS_PHISH_CUR_G628_07112800 /http:\/\/www\.paypalsecuitymeasures\./i
describe SS_PHISH_CUR_G628_07112800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G628_07112800 0.001

# Email.Phishing.Cur.Gen629.Sanesecurity.07112801
rawbody  SS_PHISH_CUR_G629_07112801 /From: "service\@paypal\.com"<service\@paypal\.com>/i
describe SS_PHISH_CUR_G629_07112801 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G629_07112801 0.001

# Email.Phishing.Cur.Gen630.Sanesecurity.07112900
rawbody  SS_PHISH_CUR_G630_07112900 /\/\.www\.downeysavings\.com\//i
describe SS_PHISH_CUR_G630_07112900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G630_07112900 0.001

# Email.Phishing.Cur.Gen631.Sanesecurity.07112901
rawbody  SS_PHISH_CUR_G631_07112901 /Poste Italiane.*http:\/\/g\.msn\.it\//i
describe SS_PHISH_CUR_G631_07112901 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G631_07112901 0.001

# Email.Phishing.Cur.Gen632.Sanesecurity.07113000
rawbody  SS_PHISH_CUR_G632_07113000 /<img name="poste" src="http:\/\/.{0,50}\.gif" border="0" id="poste" usemap=.{0,100}<area shape="rect" coords="63,314,440,329" href="http:\/\//i
describe SS_PHISH_CUR_G632_07113000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G632_07113000 0.001

# Email.Phishing.Cur.Gen633.Sanesecurity.07113001
rawbody  SS_PHISH_CUR_G633_07113001 /<img src="http:\/\/www\.paypal\.com\/en_US\/i\/scr\/pixel\.gif" alt="".*src="http:\/\/tbn0\.google\.com\/images\?q=/i
describe SS_PHISH_CUR_G633_07113001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G633_07113001 0.001

# Email.Phishing.Cur.Gen634.Sanesecurity.07113002
rawbody  SS_PHISH_CUR_G634_07113002 /heaward\.org\/images\/involved\/lloyds\.jpg ">/i
describe SS_PHISH_CUR_G634_07113002 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G634_07113002 0.001

# Email.Phishing.Cur.Gen635.Sanesecurity.07113003
rawbody  SS_PHISH_CUR_G635_07113003 /From: "PayPaI"<no-reply\@paypai\.com>/i
describe SS_PHISH_CUR_G635_07113003 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G635_07113003 0.001

# Email.Phishing.Cur.Gen636.Sanesecurity.07120100
rawbody  SS_PHISH_CUR_G636_07120100 /\/Safe\%20House\%20-\%201\/ebay_files\/x\.gif"/i
describe SS_PHISH_CUR_G636_07120100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G636_07120100 0.001

# Email.Phishing.Cur.Gen637.Sanesecurity.07120200
rawbody  SS_PHISH_CUR_G637_07120200 /\/\.www\.ebay\.fr\/eBayISAPI\.dll\./i
describe SS_PHISH_CUR_G637_07120200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G637_07120200 0.001

# Email.Phishing.Cur.Gen638.Sanesecurity.07120300
rawbody  SS_PHISH_CUR_G638_07120300 /http:\/\/paypulsecurity\./i
describe SS_PHISH_CUR_G638_07120300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G638_07120300 0.001

# Email.Phishing.Cur.Gen639.Sanesecurity.07120301
rawbody  SS_PHISH_CUR_G639_07120301 /\/\.us\/secure\.capitalone\.com\//i
describe SS_PHISH_CUR_G639_07120301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G639_07120301 0.001

# Email.Phishing.Cur.Gen640.Sanesecurity.07120302
rawbody  SS_PHISH_CUR_G640_07120302 /http:\/\/citibank\.de\./i
describe SS_PHISH_CUR_G640_07120302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G640_07120302 0.001

# Email.Phishing.Cur.Gen641.Sanesecurity.07120303
rawbody  SS_PHISH_CUR_G641_07120303 /30192823166\&amp\;requested=3Dcollectitall41\&amp\;qid=3D325073972/i
describe SS_PHISH_CUR_G641_07120303 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G641_07120303 0.001

# Email.Phishing.Cur.Gen642.Sanesecurity.07120304
rawbody  SS_PHISH_CUR_G642_07120304 /http:\/\/.{0,50}hsbc\.co\.uk\./i
describe SS_PHISH_CUR_G642_07120304 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G642_07120304 0.001

# Email.Phishing.Cur.Gen643.Sanesecurity.07120305
rawbody  SS_PHISH_CUR_G643_07120305 /http:\/\/www\.bancaroma\.it\./i
describe SS_PHISH_CUR_G643_07120305 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G643_07120305 0.001

# Email.Phishing.Cur.Gen644.Sanesecurity.07120306
rawbody  SS_PHISH_CUR_G644_07120306 /http:\/\/www\.sunnbnj\.com\./i
describe SS_PHISH_CUR_G644_07120306 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G644_07120306 0.001

# Email.Phishing.Cur.Gen645.Sanesecurity.07120400
rawbody  SS_PHISH_CUR_G645_07120400 /http:\/\/.{0,50}volksbank\.de\./i
describe SS_PHISH_CUR_G645_07120400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G645_07120400 0.001

# Email.Phishing.Cur.Gen646.Sanesecurity.07120401
rawbody  SS_PHISH_CUR_G646_07120401 /\/\.uk\/cgi-bin\/webscrcmd\.php/i
describe SS_PHISH_CUR_G646_07120401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G646_07120401 0.001

# Email.Phishing.Cur.Gen647.Sanesecurity.07120402
rawbody  SS_PHISH_CUR_G647_07120402 /From: Capital One<banking\@capitalone\.com>/i
describe SS_PHISH_CUR_G647_07120402 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G647_07120402 0.001

# Email.Phishing.Cur.Gen648.Sanesecurity.07120500
rawbody  SS_PHISH_CUR_G648_07120500 /http:\/\/ourworld\.cs\.com\/.{0,200}USEMAP="\#paypal-bottom"/i
describe SS_PHISH_CUR_G648_07120500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G648_07120500 0.001

# Email.Phishing.Cur.Gen649.Sanesecurity.07120501
rawbody  SS_PHISH_CUR_G649_07120501 /that your online services have expired.*-moz-background-clip: -moz-initial\; -moz-background-origin/i
describe SS_PHISH_CUR_G649_07120501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G649_07120501 0.001

# Email.Phishing.Cur.Gen650.Sanesecurity.07120502
rawbody  SS_PHISH_CUR_G650_07120502 /http:\/\/(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9).{0,150}\/eBayISAPI\.dllSignIn/i
describe SS_PHISH_CUR_G650_07120502 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G650_07120502 0.001

# Email.Phishing.Cur.Gen651.Sanesecurity.07120900
rawbody  SS_PHISH_CUR_G651_07120900 /You have 1 new ALERT message.*\.in-addr\.btopenworld\.com/i
describe SS_PHISH_CUR_G651_07120900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G651_07120900 0.001

# Email.Phishing.Cur.Gen652.Sanesecurity.07122300
rawbody  SS_PHISH_CUR_G652_07122300 /From: "U\.S\. Bank"<usbank\@servinternet\.com>/i
describe SS_PHISH_CUR_G652_07122300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G652_07122300 0.001

# Email.Phishing.Cur.Gen653.Sanesecurity.07122600
rawbody  SS_PHISH_CUR_G653_07122600 /http:\/\/online\.vodafone\.co\.uk\./i
describe SS_PHISH_CUR_G653_07122600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G653_07122600 0.001

# Email.Phishing.Cur.Gen654.Sanesecurity.07122601
rawbody  SS_PHISH_CUR_G654_07122601 /\.vps\.webfusion\.co\.uk\/new\.egg\.com\//i
describe SS_PHISH_CUR_G654_07122601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G654_07122601 0.001

# Email.Phishing.Cur.Gen655.Sanesecurity.07122602
rawbody  SS_PHISH_CUR_G655_07122602 /-natwest\.co\.uk\./i
describe SS_PHISH_CUR_G655_07122602 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G655_07122602 0.001

# Email.Phishing.Cur.Gen656.Sanesecurity.07122603
rawbody  SS_PHISH_CUR_G656_07122603 /\.free\.fr\/.{0,100}\/www\.nwolb\.com\//i
describe SS_PHISH_CUR_G656_07122603 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G656_07122603 0.001

# Email.Phishing.Cur.Gen657.Sanesecurity.07122604
rawbody  SS_PHISH_CUR_G657_07122604 /-networld\.de\./i
describe SS_PHISH_CUR_G657_07122604 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G657_07122604 0.001

# Email.Phishing.Cur.Gen658.Sanesecurity.07122605
rawbody  SS_PHISH_CUR_G658_07122605 /From: "Alliance \& Leicester Commercial Bank"<message\.buisiness\@alliance-leicester\.co\.uk>/i
describe SS_PHISH_CUR_G658_07122605 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G658_07122605 0.001

# Email.Phishing.Cur.Gen659.Sanesecurity.07122607
rawbody  SS_PHISH_CUR_G659_07122607 /http:\/\/.{0,30}\.nwolb\.co\.uk-/i
describe SS_PHISH_CUR_G659_07122607 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G659_07122607 0.001

# Email.Phishing.Cur.Gen660.Sanesecurity.07122608
rawbody  SS_PHISH_CUR_G660_07122608 /\/\.www\.my\.if\.com\//i
describe SS_PHISH_CUR_G660_07122608 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G660_07122608 0.001

# Email.Phishing.Cur.Gen661.Sanesecurity.07122609
rawbody  SS_PHISH_CUR_G661_07122609 /\.intelligentfinance\.co\.uk-/i
describe SS_PHISH_CUR_G661_07122609 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G661_07122609 0.001

# Email.Phishing.Cur.Gen662.Sanesecurity.07122610
rawbody  SS_PHISH_CUR_G662_07122610 /\.da-us\.citibank\.com\./i
describe SS_PHISH_CUR_G662_07122610 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G662_07122610 0.001

# Email.Phishing.Cur.Gen663.Sanesecurity.07122611
rawbody  SS_PHISH_CUR_G663_07122611 /\.intelligentfinance\.com-/i
describe SS_PHISH_CUR_G663_07122611 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G663_07122611 0.001

# Email.Phishing.Cur.Gen664.Sanesecurity.07122612
rawbody  SS_PHISH_CUR_G664_07122612 /\.if\.com-refid/i
describe SS_PHISH_CUR_G664_07122612 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G664_07122612 0.001

# Email.Phishing.Cur.Gen665.Sanesecurity.07122613
rawbody  SS_PHISH_CUR_G665_07122613 /\.webfusion\.co\.uk\/home\.ybonline\.co\.uk\//i
describe SS_PHISH_CUR_G665_07122613 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G665_07122613 0.001

# Email.Phishing.Cur.Gen666.Sanesecurity.07122614
rawbody  SS_PHISH_CUR_G666_07122614 /\.nwolb\.com-/i
describe SS_PHISH_CUR_G666_07122614 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G666_07122614 0.001

# Email.Phishing.Cur.Gen667.Sanesecurity.07122615
rawbody  SS_PHISH_CUR_G667_07122615 /\.natwest\.co\.uk\./i
describe SS_PHISH_CUR_G667_07122615 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G667_07122615 0.001

# Email.Phishing.Cur.Gen668.Sanesecurity.07122616
rawbody  SS_PHISH_CUR_G668_07122616 /http:\/\/citibusinessonline\.da-us\. citibank\.com/i
describe SS_PHISH_CUR_G668_07122616 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G668_07122616 0.001

# Email.Phishing.Cur.Gen669.Sanesecurity.07122700
rawbody  SS_PHISH_CUR_G669_07122700 /\/2\/myonlineaccounts2\.abbeynational\.co\.uk\//i
describe SS_PHISH_CUR_G669_07122700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G669_07122700 0.001

# Email.Phishing.Cur.Gen670.Sanesecurity.07122701
rawbody  SS_PHISH_CUR_G670_07122701 /http:\/\/www \. natwest\.com\//i
describe SS_PHISH_CUR_G670_07122701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G670_07122701 0.001

# Email.Phishing.Cur.Gen671.Sanesecurity.07122702
rawbody  SS_PHISH_CUR_G671_07122702 /\.nwolb\.co\.uk\./i
describe SS_PHISH_CUR_G671_07122702 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G671_07122702 0.001

# Email.Phishing.Cur.Gen672.Sanesecurity.07122703
rawbody  SS_PHISH_CUR_G672_07122703 /\.nwolb\.com\./i
describe SS_PHISH_CUR_G672_07122703 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G672_07122703 0.001

# Email.Phishing.Cur.Gen673.Sanesecurity.07122704
rawbody  SS_PHISH_CUR_G673_07122704 /From: "eBay"<service\@eBay\.com>/i
describe SS_PHISH_CUR_G673_07122704 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G673_07122704 0.001

# Email.Phishing.Cur.Gen674.Sanesecurity.07122705
rawbody  SS_PHISH_CUR_G674_07122705 /-my\.if\.com\./i
describe SS_PHISH_CUR_G674_07122705 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G674_07122705 0.001

# Email.Phishing.Cur.Gen675.Sanesecurity.07122706
rawbody  SS_PHISH_CUR_G675_07122706 /http:\/\/.{0,30}-my\.if\.com\./i
describe SS_PHISH_CUR_G675_07122706 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G675_07122706 0.001

# Email.Phishing.Cur.Gen676.Sanesecurity.07122800
rawbody  SS_PHISH_CUR_G676_07122800 /Is is strongly recommended to update it immediately\. Update form is located <A HREF="http:\/\/(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)/i
describe SS_PHISH_CUR_G676_07122800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G676_07122800 0.001

# Email.Phishing.Cur.Gen677.Sanesecurity.08010200
rawbody  SS_PHISH_CUR_G677_08010200 /From: "PayPal Corp\. \xab"<t/i
describe SS_PHISH_CUR_G677_08010200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G677_08010200 0.001

# Email.Phishing.Cur.Gen678.Sanesecurity.08010201
rawbody  SS_PHISH_CUR_G678_08010201 /From: "service\@paypal\.com"</i
describe SS_PHISH_CUR_G678_08010201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G678_08010201 0.001

# Email.Phishing.Cur.Gen679.Sanesecurity.08010202
rawbody  SS_PHISH_CUR_G679_08010202 /<title>New Page 1<\/title>.*abbeynational\.co\.uk/i
describe SS_PHISH_CUR_G679_08010202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G679_08010202 0.001

# Email.Phishing.Cur.Gen680.Sanesecurity.08010203
rawbody  SS_PHISH_CUR_G680_08010203 /<a href="\.\.\/\.\.\/\.\.\/www\.personal\.barclays\.co\.uk\/BRC1\/jsp\//i
describe SS_PHISH_CUR_G680_08010203 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G680_08010203 0.001

# Email.Phishing.Cur.Gen681.Sanesecurity.08010204
rawbody  SS_PHISH_CUR_G681_08010204 /\/\.eBay\.com">http:\/\/signin\.ebay\.com\//i
describe SS_PHISH_CUR_G681_08010204 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G681_08010204 0.001

# Email.Phishing.Cur.Gen682.Sanesecurity.08010400
rawbody  SS_PHISH_CUR_G682_08010400 /http:\/\/www\.facebook\.com\.profile\./i
describe SS_PHISH_CUR_G682_08010400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G682_08010400 0.001

# Email.Phishing.Cur.Gen683.Sanesecurity.08010401
rawbody  SS_PHISH_CUR_G683_08010401 /From: "Amazon"<payments\@amazon\.com>/i
describe SS_PHISH_CUR_G683_08010401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G683_08010401 0.001

# Email.Phishing.Cur.Gen684.Sanesecurity.08010402
rawbody  SS_PHISH_CUR_G684_08010402 /From: "checkout\@ebay\.com"<checkout\@ebay\.com>/i
describe SS_PHISH_CUR_G684_08010402 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G684_08010402 0.001

# Email.Phishing.Cur.Gen685.Sanesecurity.08010800
rawbody  SS_PHISH_CUR_G685_08010800 /\/data\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G685_08010800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G685_08010800 0.001

# Email.Phishing.Cur.Gen686.Sanesecurity.08011000
rawbody  SS_PHISH_CUR_G686_08011000 /From: "notice\@paypal\.com"<notice\@paypal\.com>/i
describe SS_PHISH_CUR_G686_08011000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G686_08011000 0.001

# Email.Phishing.Cur.Gen687.Sanesecurity.08011400
rawbody  SS_PHISH_CUR_G687_08011400 /- Internet Banking<\/title>.{0,50}<!-- PAYPAL EMAIL -->/i
describe SS_PHISH_CUR_G687_08011400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G687_08011400 0.001

# Email.Phishing.Cur.Gen688.Sanesecurity.08011401
rawbody  SS_PHISH_CUR_G688_08011401 /<title>New Page 1<\/title>.*unlock your account, and verify your identity/i
describe SS_PHISH_CUR_G688_08011401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G688_08011401 0.001

# Email.Phishing.Cur.Gen689.Sanesecurity.08011402
rawbody  SS_PHISH_CUR_G689_08011402 /\/www\.abbey\.co\.uk\/myonlineaccounts2\.abbeynational\.co\.uk\//i
describe SS_PHISH_CUR_G689_08011402 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G689_08011402 0.001

# Email.Phishing.Cur.Gen690.Sanesecurity.08011403
rawbody  SS_PHISH_CUR_G690_08011403 /From: "eBay"<billing\@ebay\.co\.uk>/i
describe SS_PHISH_CUR_G690_08011403 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G690_08011403 0.001

# Email.Phishing.Cur.Gen691.Sanesecurity.08011600
rawbody  SS_PHISH_CUR_G691_08011600 /\/www\.nwolb\.com\/Login\.php/i
describe SS_PHISH_CUR_G691_08011600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G691_08011600 0.001

# Email.Phishing.Cur.Gen692.Sanesecurity.08011601
rawbody  SS_PHISH_CUR_G692_08011601 /From: "HM Revenue \& Customs"<noreply\@hmrc\.gov\.uk>/i
describe SS_PHISH_CUR_G692_08011601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G692_08011601 0.001

# Email.Phishing.Cur.Gen693.Sanesecurity.08011602
rawbody  SS_PHISH_CUR_G693_08011602 /\/ebank\.hsbc\.co\.uk\/index\.php/i
describe SS_PHISH_CUR_G693_08011602 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G693_08011602 0.001

# Email.Phishing.Cur.Gen694.Sanesecurity.08011603
rawbody  SS_PHISH_CUR_G694_08011603 /From: "Lloyds TSB Bank plc"<message\@lloydstsb\.co\.uk>/i
describe SS_PHISH_CUR_G694_08011603 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G694_08011603 0.001

# Email.Phishing.Cur.Gen695.Sanesecurity.08011700
rawbody  SS_PHISH_CUR_G695_08011700 /<title>New Page.*halifax-online/i
describe SS_PHISH_CUR_G695_08011700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G695_08011700 0.001

# Email.Phishing.Cur.Gen696.Sanesecurity.08011701
rawbody  SS_PHISH_CUR_G696_08011701 />https:\/\/www\.moneybookers\.com\/accept\.php\?payment_id\?/i
describe SS_PHISH_CUR_G696_08011701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G696_08011701 0.001

# Email.Phishing.Cur.Gen697.Sanesecurity.08012100
rawbody  SS_PHISH_CUR_G697_08012100 /\.vps\.webfusion\.co\.uk\/my\.if\.com\//i
describe SS_PHISH_CUR_G697_08012100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G697_08012100 0.001

# Email.Phishing.Cur.Gen698.Sanesecurity.08012101
rawbody  SS_PHISH_CUR_G698_08012101 /From: "ebay\@ebay\.com"<ebay\@ebay\.com>/i
describe SS_PHISH_CUR_G698_08012101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G698_08012101 0.001

# Email.Phishing.Cur.Gen699.Sanesecurity.08012102
rawbody  SS_PHISH_CUR_G699_08012102 /From: "eBay-USA"<help\@ebay\.com-usa>/i
describe SS_PHISH_CUR_G699_08012102 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G699_08012102 0.001

# Email.Phishing.Cur.Gen700.Sanesecurity.08012103
rawbody  SS_PHISH_CUR_G700_08012103 /<a href=3D"http:\/\/.{0,50}\.110mb\.com"><b>.{0,100}Click to Resolve/i
describe SS_PHISH_CUR_G700_08012103 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G700_08012103 0.001

# Email.Phishing.Cur.Gen701.Sanesecurity.08012104
rawbody  SS_PHISH_CUR_G701_08012104 /From: "Citi Bank"<security\@citibank\.com>/i
describe SS_PHISH_CUR_G701_08012104 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G701_08012104 0.001

# Email.Phishing.Cur.Gen702.Sanesecurity.08012105
rawbody  SS_PHISH_CUR_G702_08012105 /\/site\/www\.citibank\.com\/">Click/i
describe SS_PHISH_CUR_G702_08012105 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G702_08012105 0.001

# Email.Phishing.Cur.Gen703.Sanesecurity.08012106
rawbody  SS_PHISH_CUR_G703_08012106 /Subject:.{0,30}the eBay customer.{0,100}sent you a question about yout/i
describe SS_PHISH_CUR_G703_08012106 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G703_08012106 0.001

# Email.Phishing.Cur.Gen704.Sanesecurity.08012200
rawbody  SS_PHISH_CUR_G704_08012200 /http:\/\/.{0,10}\.rbsdigital\.com\./i
describe SS_PHISH_CUR_G704_08012200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G704_08012200 0.001

# Email.Phishing.Cur.Gen705.Sanesecurity.08012201
rawbody  SS_PHISH_CUR_G705_08012201 /http:\/\/tbn0\.google\.com\/images\?q.*abbey\.com/i
describe SS_PHISH_CUR_G705_08012201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G705_08012201 0.001

# Email.Phishing.Cur.Gen706.Sanesecurity.08012202
rawbody  SS_PHISH_CUR_G706_08012202 /\/\.\%20\/redir\.html.{0,50}Dispute/i
describe SS_PHISH_CUR_G706_08012202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G706_08012202 0.001

# Email.Phishing.Cur.Gen707.Sanesecurity.08012203
rawbody  SS_PHISH_CUR_G707_08012203 /From: "Lloyds TSB"<info\@email\.lloydstsb\.co\.uk>/i
describe SS_PHISH_CUR_G707_08012203 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G707_08012203 0.001

# Email.Phishing.Cur.Gen708.Sanesecurity.08012204
rawbody  SS_PHISH_CUR_G708_08012204 /From: "PosteItaliane"<BPOL\@poste\.it>/i
describe SS_PHISH_CUR_G708_08012204 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G708_08012204 0.001

# Email.Phishing.Cur.Gen709.Sanesecurity.08012205
rawbody  SS_PHISH_CUR_G709_08012205 /After the last annual calculations of your fiscal activity.*http:\/\/www\.aol\.com\/redir\.adp\?_url=/i
describe SS_PHISH_CUR_G709_08012205 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G709_08012205 0.001

# Email.Phishing.Cur.Gen710.Sanesecurity.08012206
rawbody  SS_PHISH_CUR_G710_08012206 /From: "Banca di Roma spa"<servizzio\@bancadiroma\.it>/i
describe SS_PHISH_CUR_G710_08012206 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G710_08012206 0.001

# Email.Phishing.Cur.Gen711.Sanesecurity.08012207
rawbody  SS_PHISH_CUR_G711_08012207 /From: "eBay"<service\@ebay\.com>/i
describe SS_PHISH_CUR_G711_08012207 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G711_08012207 0.001

# Email.Phishing.Cur.Gen712.Sanesecurity.08012208
rawbody  SS_PHISH_CUR_G712_08012208 /From: service\@paypal\.com</i
describe SS_PHISH_CUR_G712_08012208 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G712_08012208 0.001

# Email.Phishing.Cur.Gen713.Sanesecurity.08012209
rawbody  SS_PHISH_CUR_G713_08012209 /From: "Amazon\.com"<Account\@amazon\.com>/i
describe SS_PHISH_CUR_G713_08012209 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G713_08012209 0.001

# Email.Phishing.Cur.Gen714.Sanesecurity.08012210
rawbody  SS_PHISH_CUR_G714_08012210 /From: "eBay\.com\.au"<member\@ebay\.com\.au>/i
describe SS_PHISH_CUR_G714_08012210 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G714_08012210 0.001

# Email.Phishing.Cur.Gen715.Sanesecurity.08012211
rawbody  SS_PHISH_CUR_G715_08012211 /Subject:.{0,30}From: "eBay\.com\.au"<member\@ebay\.com\.au>/i
describe SS_PHISH_CUR_G715_08012211 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G715_08012211 0.001

# Email.Phishing.Cur.Gen716.Sanesecurity.08012400
rawbody  SS_PHISH_CUR_G716_08012400 /http:\/\/businessonline\.huntington\.com\./i
describe SS_PHISH_CUR_G716_08012400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G716_08012400 0.001

# Email.Phishing.Cur.Gen717.Sanesecurity.08012401
rawbody  SS_PHISH_CUR_G717_08012401 /<title>New Page.*www\.halifax\.co\.uk/i
describe SS_PHISH_CUR_G717_08012401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G717_08012401 0.001

# Email.Phishing.Cur.Gen718.Sanesecurity.08012402
rawbody  SS_PHISH_CUR_G718_08012402 /From: "Lloyds TSB Bank plc" <message\@lloydstsb\.co\.uk>.*<title>A message from Abbey\.<\/title>/i
describe SS_PHISH_CUR_G718_08012402 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G718_08012402 0.001

# Email.Phishing.Cur.Gen719.Sanesecurity.08012403
rawbody  SS_PHISH_CUR_G719_08012403 /\.110mb\.com\/irslogo\.gif/i
describe SS_PHISH_CUR_G719_08012403 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G719_08012403 0.001

# Email.Phishing.Cur.Gen720.Sanesecurity.08012404
rawbody  SS_PHISH_CUR_G720_08012404 /For your security, your online banking pro.*Abbey National Plc/i
describe SS_PHISH_CUR_G720_08012404 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G720_08012404 0.001

# Email.Phishing.Cur.Gen721.Sanesecurity.08012405
rawbody  SS_PHISH_CUR_G721_08012405 /From: "Nationwide"<news\@nationwide\.co\.uk>/i
describe SS_PHISH_CUR_G721_08012405 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G721_08012405 0.001

# Email.Phishing.Cur.Gen722.Sanesecurity.08012406
rawbody  SS_PHISH_CUR_G722_08012406 /From: "Banca di Roma"<noresponde\@bancadiroma\.it>/i
describe SS_PHISH_CUR_G722_08012406 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G722_08012406 0.001

# Email.Phishing.Cur.Gen723.Sanesecurity.08012407
rawbody  SS_PHISH_CUR_G723_08012407 /From: Internal Revenue Service<admin\@irs\./i
describe SS_PHISH_CUR_G723_08012407 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G723_08012407 0.001

# Email.Phishing.Cur.Gen724.Sanesecurity.08012408
rawbody  SS_PHISH_CUR_G724_08012408 /From: "Banca di Roma"<noresponde\@bancaroma\.it>/i
describe SS_PHISH_CUR_G724_08012408 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G724_08012408 0.001

# Email.Phishing.Cur.Gen725.Sanesecurity.08012409
rawbody  SS_PHISH_CUR_G725_08012409 /<title>New Page.*http:\/\/www\.natwest\.com\//i
describe SS_PHISH_CUR_G725_08012409 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G725_08012409 0.001

# Email.Phishing.Cur.Gen726.Sanesecurity.08012410
rawbody  SS_PHISH_CUR_G726_08012410 /<title>New Page.*\.hsbc\.co\.uk\//i
describe SS_PHISH_CUR_G726_08012410 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G726_08012410 0.001

# Email.Phishing.Cur.Gen727.Sanesecurity.08012411
rawbody  SS_PHISH_CUR_G727_08012411 /http:\/\/business-and-commercial\.hsbc\.com\./i
describe SS_PHISH_CUR_G727_08012411 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G727_08012411 0.001

# Email.Phishing.Cur.Gen728.Sanesecurity.08012412
rawbody  SS_PHISH_CUR_G728_08012412 /http:\/\/wellsoffice\.wellsfargo\.com\./i
describe SS_PHISH_CUR_G728_08012412 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G728_08012412 0.001

# Email.Phishing.Cur.Gen729.Sanesecurity.08012413
rawbody  SS_PHISH_CUR_G729_08012413 /http:\/\/www4\.nwolb\.co\.uk\./i
describe SS_PHISH_CUR_G729_08012413 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G729_08012413 0.001

# Email.Phishing.Cur.Gen730.Sanesecurity.08012414
rawbody  SS_PHISH_CUR_G730_08012414 /http:\/\/citibusinessonline\.da-us\.citibank\.com\./i
describe SS_PHISH_CUR_G730_08012414 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G730_08012414 0.001

# Email.Phishing.Cur.Gen731.Sanesecurity.08012415
rawbody  SS_PHISH_CUR_G731_08012415 /http:\/\/.{0,10}\.natwest\.com\./i
describe SS_PHISH_CUR_G731_08012415 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G731_08012415 0.001

# Email.Phishing.Cur.Gen732.Sanesecurity.08012416
rawbody  SS_PHISH_CUR_G732_08012416 /http:\/\/.{0,10}\.rbsdigital\.com\./i
describe SS_PHISH_CUR_G732_08012416 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G732_08012416 0.001

# Email.Phishing.Cur.Gen733.Sanesecurity.08012417
rawbody  SS_PHISH_CUR_G733_08012417 /\/myonlineaccounts2\.abbeynational\.co\.uk\/CentralLogonWeb\//i
describe SS_PHISH_CUR_G733_08012417 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G733_08012417 0.001

# Email.Phishing.Cur.Gen734.Sanesecurity.08012418
rawbody  SS_PHISH_CUR_G734_08012418 /\/\.https:\/www\.wellsfargo\.com\//i
describe SS_PHISH_CUR_G734_08012418 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G734_08012418 0.001

# Email.Phishing.Cur.Gen735.Sanesecurity.08012419
rawbody  SS_PHISH_CUR_G735_08012419 /From: Credit Union</i
describe SS_PHISH_CUR_G735_08012419 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G735_08012419 0.001

# Email.Phishing.Cur.Gen736.Sanesecurity.08012420
rawbody  SS_PHISH_CUR_G736_08012420 /From: noreply\@ bankofamerica\.com <noreply\@ bankofamerica\.com>/i
describe SS_PHISH_CUR_G736_08012420 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G736_08012420 0.001

# Email.Phishing.Cur.Gen737.Sanesecurity.08012421
rawbody  SS_PHISH_CUR_G737_08012421 /From: "Wells Fargo Bank"<bank\@wellsfargo\.com>/i
describe SS_PHISH_CUR_G737_08012421 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G737_08012421 0.001

# Email.Phishing.Cur.Gen738.Sanesecurity.08012422
rawbody  SS_PHISH_CUR_G738_08012422 /From: "Downey Savings"<secure\@downeysavings\.com>/i
describe SS_PHISH_CUR_G738_08012422 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G738_08012422 0.001

# Email.Phishing.Cur.Gen739.Sanesecurity.08012423
rawbody  SS_PHISH_CUR_G739_08012423 /From: "BPOL\@poste\.it"<sicurezza\@mondobancoposta\.it>/i
describe SS_PHISH_CUR_G739_08012423 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G739_08012423 0.001

# Email.Phishing.Cur.Gen740.Sanesecurity.08012424
rawbody  SS_PHISH_CUR_G740_08012424 /From: "National Credit Union Administration"<do-not-reply\@ncua\.gov>/i
describe SS_PHISH_CUR_G740_08012424 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G740_08012424 0.001

# Email.Phishing.Cur.Gen741.Sanesecurity.08012500
rawbody  SS_PHISH_CUR_G741_08012500 /From: "\xae PayPal"</i
describe SS_PHISH_CUR_G741_08012500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G741_08012500 0.001

# Email.Phishing.Cur.Gen742.Sanesecurity.08020500
rawbody  SS_PHISH_CUR_G742_08020500 /http:\/\/www\.halifax\.co\.uk.{0,3}\.\./i
describe SS_PHISH_CUR_G742_08020500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G742_08020500 0.001

# Email.Phishing.Cur.Gen743.Sanesecurity.08020501
rawbody  SS_PHISH_CUR_G743_08020501 /<title>New Page.*Regions Bank/i
describe SS_PHISH_CUR_G743_08020501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G743_08020501 0.001

# Email.Phishing.Cur.Gen744.Sanesecurity.08020502
rawbody  SS_PHISH_CUR_G744_08020502 /From: "eBay"<aw-confirm\@ebay\.com>/i
describe SS_PHISH_CUR_G744_08020502 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G744_08020502 0.001

# Email.Phishing.Cur.Gen745.Sanesecurity.08020503
rawbody  SS_PHISH_CUR_G745_08020503 /From: "eBay"<ebay\@february-offer\.com>/i
describe SS_PHISH_CUR_G745_08020503 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G745_08020503 0.001

# Email.Phishing.Cur.Gen746.Sanesecurity.08020504
rawbody  SS_PHISH_CUR_G746_08020504 /From: "Amazon\.com"<news\@amazon\.com>/i
describe SS_PHISH_CUR_G746_08020504 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G746_08020504 0.001

# Email.Phishing.Cur.Gen747.Sanesecurity.08020505
rawbody  SS_PHISH_CUR_G747_08020505 /From: "Capital One"<customer_service\@capitalone\.com>/i
describe SS_PHISH_CUR_G747_08020505 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G747_08020505 0.001

# Email.Phishing.Cur.Gen748.Sanesecurity.08020506
rawbody  SS_PHISH_CUR_G748_08020506 /From: "Citibank Greece"<service\@citibank\.com>/i
describe SS_PHISH_CUR_G748_08020506 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G748_08020506 0.001

# Email.Phishing.Cur.Gen749.Sanesecurity.08020600
rawbody  SS_PHISH_CUR_G749_08020600 /http:\/\/.{0,100}\.free\.fr.*Activate Now/i
describe SS_PHISH_CUR_G749_08020600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G749_08020600 0.001

# Email.Phishing.Cur.Gen750.Sanesecurity.08020601
rawbody  SS_PHISH_CUR_G750_08020601 /From: "Navy Federal"<UseTheLink\@navyfcu\.org>/i
describe SS_PHISH_CUR_G750_08020601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G750_08020601 0.001

# Email.Phishing.Cur.Gen751.Sanesecurity.08020602
rawbody  SS_PHISH_CUR_G751_08020602 /From: "Downey Savings and Loan Association"<alerts\@downeysavings\.com>/i
describe SS_PHISH_CUR_G751_08020602 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G751_08020602 0.001

# Email.Phishing.Cur.Gen752.Sanesecurity.08020603
rawbody  SS_PHISH_CUR_G752_08020603 /From: "eBay"<message\@eBay\.com>/i
describe SS_PHISH_CUR_G752_08020603 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G752_08020603 0.001

# Email.Phishing.Cur.Gen753.Sanesecurity.08020604
rawbody  SS_PHISH_CUR_G753_08020604 /From: <member\@ebay,\.com>/i
describe SS_PHISH_CUR_G753_08020604 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G753_08020604 0.001

# Email.Phishing.Cur.Gen754.Sanesecurity.08020605
rawbody  SS_PHISH_CUR_G754_08020605 /rom: "Paypal\.com"<suportion\@Paypal\.com>/i
describe SS_PHISH_CUR_G754_08020605 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G754_08020605 0.001

# Email.Phishing.Cur.Gen755.Sanesecurity.08020606
rawbody  SS_PHISH_CUR_G755_08020606 /From: "service\@intl\.paypal\.com"<service\@intl\.paypal\.com>/i
describe SS_PHISH_CUR_G755_08020606 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G755_08020606 0.001

# Email.Phishing.Cur.Gen756.Sanesecurity.08020607
rawbody  SS_PHISH_CUR_G756_08020607 /http:\/\/(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9).{0,50}\/paypal\//i
describe SS_PHISH_CUR_G756_08020607 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G756_08020607 0.001

# Email.Phishing.Cur.Gen757.Sanesecurity.08020800
rawbody  SS_PHISH_CUR_G757_08020800 /From: "Downey Savings and Loan Association"<securealert\@downeysavings\.com>/i
describe SS_PHISH_CUR_G757_08020800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G757_08020800 0.001

# Email.Phishing.Cur.Gen758.Sanesecurity.08020801
rawbody  SS_PHISH_CUR_G758_08020801 /From: "VISA Debit Card"<debit\@visa\.com>/i
describe SS_PHISH_CUR_G758_08020801 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G758_08020801 0.001

# Email.Phishing.Cur.Gen759.Sanesecurity.08020802
rawbody  SS_PHISH_CUR_G759_08020802 /From: "Sterling Bank"<privacy\@banksterling\.com>/i
describe SS_PHISH_CUR_G759_08020802 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G759_08020802 0.001

# Email.Phishing.Cur.Gen760.Sanesecurity.08020900
rawbody  SS_PHISH_CUR_G760_08020900 /<title>New Page.*hsbc\.co\.uk/i
describe SS_PHISH_CUR_G760_08020900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G760_08020900 0.001

# Email.Phishing.Cur.Gen761.Sanesecurity.08020901
rawbody  SS_PHISH_CUR_G761_08020901 /PayPal Password was blocked.*\.static\.tfn\.net\.tw\//i
describe SS_PHISH_CUR_G761_08020901 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G761_08020901 0.001

# Email.Phishing.Cur.Gen762.Sanesecurity.08020902
rawbody  SS_PHISH_CUR_G762_08020902 /http:\/\/citibusinessonline\.citibank\.com\./i
describe SS_PHISH_CUR_G762_08020902 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G762_08020902 0.001

# Email.Phishing.Cur.Gen763.Sanesecurity.08020903
rawbody  SS_PHISH_CUR_G763_08020903 /From: "Alliance \& Leicester Commercial Bank"<online\.buisiness\@alliance-leicester\.co\.uk>/i
describe SS_PHISH_CUR_G763_08020903 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G763_08020903 0.001

# Email.Phishing.Cur.Gen764.Sanesecurity.08020904
rawbody  SS_PHISH_CUR_G764_08020904 /From: "Bank of America"<security\@bankofamerica\.com>/i
describe SS_PHISH_CUR_G764_08020904 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G764_08020904 0.001

# Email.Phishing.Cur.Gen765.Sanesecurity.08020905
rawbody  SS_PHISH_CUR_G765_08020905 /http:\/\/consultnc\.nationalcity\. com\/banking\//i
describe SS_PHISH_CUR_G765_08020905 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G765_08020905 0.001

# Email.Phishing.Cur.Gen766.Sanesecurity.08020906
rawbody  SS_PHISH_CUR_G766_08020906 /\.nationalcity\.com\./i
describe SS_PHISH_CUR_G766_08020906 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G766_08020906 0.001

# Email.Phishing.Cur.Gen767.Sanesecurity.08020907
rawbody  SS_PHISH_CUR_G767_08020907 /From: "Central Bank"<fraud\@centralbank\.net>/i
describe SS_PHISH_CUR_G767_08020907 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G767_08020907 0.001

# Email.Phishing.Cur.Gen768.Sanesecurity.08020908
rawbody  SS_PHISH_CUR_G768_08020908 /From: "Lancaster Insurance Group"<services\@blcnet\.com>/i
describe SS_PHISH_CUR_G768_08020908 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G768_08020908 0.001

# Email.Phishing.Cur.Gen769.Sanesecurity.08020909
rawbody  SS_PHISH_CUR_G769_08020909 /From: "eBay"<notify\@ebay\.us\.com>/i
describe SS_PHISH_CUR_G769_08020909 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G769_08020909 0.001

# Email.Phishing.Cur.Gen770.Sanesecurity.08020910
rawbody  SS_PHISH_CUR_G770_08020910 /From: "Empire Bank"<info\@empirebank\.com>/i
describe SS_PHISH_CUR_G770_08020910 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G770_08020910 0.001

# Email.Phishing.Cur.Gen771.Sanesecurity.08020911
rawbody  SS_PHISH_CUR_G771_08020911 /From: "Chase"<services\@chaseonline\.chases\.com>/i
describe SS_PHISH_CUR_G771_08020911 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G771_08020911 0.001

# Email.Phishing.Cur.Gen772.Sanesecurity.08020912
rawbody  SS_PHISH_CUR_G772_08020912 /From: ".{0,50}"<.*Cardholder,<\/STRONG>.*your online banking profile has been locked due to inactivity/i
describe SS_PHISH_CUR_G772_08020912 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G772_08020912 0.001

# Email.Phishing.Cur.Gen773.Sanesecurity.08020913
rawbody  SS_PHISH_CUR_G773_08020913 /From: ".{0,50}"<.*Security Message Alert!/i
describe SS_PHISH_CUR_G773_08020913 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G773_08020913 0.001

# Email.Phishing.Cur.Gen774.Sanesecurity.08020914
rawbody  SS_PHISH_CUR_G774_08020914 /From: ".{0,50}"<.*constantly working to ensure security by regularly screening/i
describe SS_PHISH_CUR_G774_08020914 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G774_08020914 0.001

# Email.Phishing.Cur.Gen775.Sanesecurity.08020915
rawbody  SS_PHISH_CUR_G775_08020915 /From: "Chase"<service\@chase\.com>/i
describe SS_PHISH_CUR_G775_08020915 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G775_08020915 0.001

# Email.Phishing.Cur.Gen776.Sanesecurity.08020916
rawbody  SS_PHISH_CUR_G776_08020916 /From: "BankFinancial"<info\@BankFinancial\.com>/i
describe SS_PHISH_CUR_G776_08020916 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G776_08020916 0.001

# Email.Phishing.Cur.Gen777.Sanesecurity.08020917
rawbody  SS_PHISH_CUR_G777_08020917 /From: "Visa Debit Card"<debit\@visa\.com>/i
describe SS_PHISH_CUR_G777_08020917 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G777_08020917 0.001

# Email.Phishing.Cur.Gen778.Sanesecurity.08020918
rawbody  SS_PHISH_CUR_G778_08020918 /Your Online PayPal Password was blocked on.*\/\%20\/9pp9\//i
describe SS_PHISH_CUR_G778_08020918 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G778_08020918 0.001

# Email.Phishing.Cur.Gen779.Sanesecurity.08021100
rawbody  SS_PHISH_CUR_G779_08021100 /<title>New Page.*Wellsfargo Bank/i
describe SS_PHISH_CUR_G779_08021100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G779_08021100 0.001

# Email.Phishing.Cur.Gen780.Sanesecurity.08021101
rawbody  SS_PHISH_CUR_G780_08021101 /From: "Central Bank"<customer_service\@centralbank\.net>/i
describe SS_PHISH_CUR_G780_08021101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G780_08021101 0.001

# Email.Phishing.Cur.Gen781.Sanesecurity.08021102
rawbody  SS_PHISH_CUR_G781_08021102 /From: ".{0,50}"<.*You have 1 new ALERT message/i
describe SS_PHISH_CUR_G781_08021102 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G781_08021102 0.001

# Email.Phishing.Cur.Gen782.Sanesecurity.08021103
rawbody  SS_PHISH_CUR_G782_08021103 /From: "eBay Support"<aw-notify\@ebay\.com>/i
describe SS_PHISH_CUR_G782_08021103 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G782_08021103 0.001

# Email.Phishing.Cur.Gen783.Sanesecurity.08021104
rawbody  SS_PHISH_CUR_G783_08021104 /From: ".{0,50}"<.*http:\/\/emailpics\.ebay\.com\//i
describe SS_PHISH_CUR_G783_08021104 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G783_08021104 0.001

# Email.Phishing.Cur.Gen784.Sanesecurity.08021105
rawbody  SS_PHISH_CUR_G784_08021105 /From: ".{0,50}"<.*You have 1 new Message Alert!/i
describe SS_PHISH_CUR_G784_08021105 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G784_08021105 0.001

# Email.Phishing.Cur.Gen785.Sanesecurity.08021106
rawbody  SS_PHISH_CUR_G785_08021106 /From: "Central Bank"<cbcustomerservice\@centralbank\.net>/i
describe SS_PHISH_CUR_G785_08021106 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G785_08021106 0.001

# Email.Phishing.Cur.Gen786.Sanesecurity.08021107
rawbody  SS_PHISH_CUR_G786_08021107 /From: ".{0,50}"<.*As part of our security measures, we regularly screen activity/i
describe SS_PHISH_CUR_G786_08021107 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G786_08021107 0.001

# Email.Phishing.Cur.Gen787.Sanesecurity.08021200
rawbody  SS_PHISH_CUR_G787_08021200 /From: ".{0,50}"<.*You have one new message at/i
describe SS_PHISH_CUR_G787_08021200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G787_08021200 0.001

# Email.Phishing.Cur.Gen788.Sanesecurity.08021201
rawbody  SS_PHISH_CUR_G788_08021201 /From: ".{0,50}"<.*>INBOX \(1\)<\/b> <\/span>/i
describe SS_PHISH_CUR_G788_08021201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G788_08021201 0.001

# Email.Phishing.Cur.Gen789.Sanesecurity.08021202
rawbody  SS_PHISH_CUR_G789_08021202 /From: "Downey Savings and Loan Association"<SecurityAlert\@downeysavings\.onlinebanking\.com>/i
describe SS_PHISH_CUR_G789_08021202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G789_08021202 0.001

# Email.Phishing.Cur.Gen790.Sanesecurity.08021203
rawbody  SS_PHISH_CUR_G790_08021203 /From: ".{0,50}"<.*may also take these actions if we are unable to verify/i
describe SS_PHISH_CUR_G790_08021203 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G790_08021203 0.001

# Email.Phishing.Cur.Gen791.Sanesecurity.08021204
rawbody  SS_PHISH_CUR_G791_08021204 /From: ".{0,50}"<.*you are eligible to receive a tax refund/i
describe SS_PHISH_CUR_G791_08021204 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G791_08021204 0.001

# Email.Phishing.Cur.Gen792.Sanesecurity.08021205
rawbody  SS_PHISH_CUR_G792_08021205 /From: "IRS\.gov"<notice\@irs\.gov>/i
describe SS_PHISH_CUR_G792_08021205 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G792_08021205 0.001

# Email.Phishing.Cur.Gen793.Sanesecurity.08021300
rawbody  SS_PHISH_CUR_G793_08021300 /From: "BLC Bank"<CustomerService\@sterlingfi\.com>/i
describe SS_PHISH_CUR_G793_08021300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G793_08021300 0.001

# Email.Phishing.Cur.Gen794.Sanesecurity.08021301
rawbody  SS_PHISH_CUR_G794_08021301 /From: ".{0,50}"<.*you are eligible to receive a tax refund/i
describe SS_PHISH_CUR_G794_08021301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G794_08021301 0.001

# Email.Phishing.Cur.Gen795.Sanesecurity.08021302
rawbody  SS_PHISH_CUR_G795_08021302 /From: "PayPaI Notice!"<secure\@paypal\.com>/i
describe SS_PHISH_CUR_G795_08021302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G795_08021302 0.001

# Email.Phishing.Cur.Gen796.Sanesecurity.08021400
rawbody  SS_PHISH_CUR_G796_08021400 /\.free\.fr\/.{0,100}www\.rbs\.co\.uk/i
describe SS_PHISH_CUR_G796_08021400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G796_08021400 0.001

# Email.Phishing.Cur.Gen797.Sanesecurity.08021401
rawbody  SS_PHISH_CUR_G797_08021401 /From: "Poste Italiane"<servizio\@poste\.it>/i
describe SS_PHISH_CUR_G797_08021401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G797_08021401 0.001

# Email.Phishing.Cur.Gen798.Sanesecurity.08021402
rawbody  SS_PHISH_CUR_G798_08021402 /From: "Gruppo UBI Banca"<servizio\@bancodibrescia\.it>/i
describe SS_PHISH_CUR_G798_08021402 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G798_08021402 0.001

# Email.Phishing.Cur.Gen799.Sanesecurity.08021403
rawbody  SS_PHISH_CUR_G799_08021403 /From: ".{0,50}"<.*Gentile cliente/i
describe SS_PHISH_CUR_G799_08021403 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G799_08021403 0.001

# Email.Phishing.Cur.Gen800.Sanesecurity.08021404
rawbody  SS_PHISH_CUR_G800_08021404 /From: "Navy Federal"<notice\@navyfcu\.org>/i
describe SS_PHISH_CUR_G800_08021404 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G800_08021404 0.001

# Email.Phishing.Cur.Gen801.Sanesecurity.08021405
rawbody  SS_PHISH_CUR_G801_08021405 /From: ".{0,50}"<.*temporarily suspended your account/i
describe SS_PHISH_CUR_G801_08021405 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G801_08021405 0.001

# Email.Phishing.Cur.Gen802.Sanesecurity.08021500
rawbody  SS_PHISH_CUR_G802_08021500 /From: "Banca di Roma spa"<nonresponde\@bancaroma\.it>/i
describe SS_PHISH_CUR_G802_08021500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G802_08021500 0.001

# Email.Phishing.Cur.Gen803.Sanesecurity.08021501
rawbody  SS_PHISH_CUR_G803_08021501 /From: ".{0,50}"<.*Gentile Cliente/i
describe SS_PHISH_CUR_G803_08021501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G803_08021501 0.001

# Email.Phishing.Cur.Gen804.Sanesecurity.08021502
rawbody  SS_PHISH_CUR_G804_08021502 /From: ".{0,50}"<.*This is your official notification from/i
describe SS_PHISH_CUR_G804_08021502 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G804_08021502 0.001

# Email.Phishing.Cur.Gen805.Sanesecurity.08021503
rawbody  SS_PHISH_CUR_G805_08021503 /From: ".{0,50}"<.*questa verificazione/i
describe SS_PHISH_CUR_G805_08021503 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G805_08021503 0.001

# Email.Phishing.Cur.Gen806.Sanesecurity.08021504
rawbody  SS_PHISH_CUR_G806_08021504 /From: ".{0,50}"<.*IP indirizzo differente/i
describe SS_PHISH_CUR_G806_08021504 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G806_08021504 0.001

# Email.Phishing.Cur.Gen807.Sanesecurity.08021505
rawbody  SS_PHISH_CUR_G807_08021505 /http:\/\/natwest\.com\./i
describe SS_PHISH_CUR_G807_08021505 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G807_08021505 0.001

# Email.Phishing.Cur.Gen808.Sanesecurity.08021506
rawbody  SS_PHISH_CUR_G808_08021506 /http:\/\/img143\.imageshack\.us\/img143\/2972\/ptcu8\.gif/i
describe SS_PHISH_CUR_G808_08021506 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G808_08021506 0.001

# Email.Phishing.Cur.Gen809.Sanesecurity.08021507
rawbody  SS_PHISH_CUR_G809_08021507 /From: "Citibank Greece"<greece\@citibank\.com>/i
describe SS_PHISH_CUR_G809_08021507 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G809_08021507 0.001

# Email.Phishing.Cur.Gen810.Sanesecurity.08021508
rawbody  SS_PHISH_CUR_G810_08021508 /http:\/\/www\.azfcu\.org\./i
describe SS_PHISH_CUR_G810_08021508 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G810_08021508 0.001

# Email.Phishing.Cur.Gen811.Sanesecurity.08021800
rawbody  SS_PHISH_CUR_G811_08021800 /http:\/\/natwest\.co\.uk\./i
describe SS_PHISH_CUR_G811_08021800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G811_08021800 0.001

# Email.Phishing.Cur.Gen812.Sanesecurity.08021801
rawbody  SS_PHISH_CUR_G812_08021801 /<b>Important Security Alert.*http:\/\/.{0,50}\.free\.fr\//i
describe SS_PHISH_CUR_G812_08021801 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G812_08021801 0.001

# Email.Phishing.Cur.Gen813.Sanesecurity.08021802
rawbody  SS_PHISH_CUR_G813_08021802 /<title>We are committed to protecting y<\/title>/i
describe SS_PHISH_CUR_G813_08021802 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G813_08021802 0.001

# Email.Phishing.Cur.Gen814.Sanesecurity.08021803
rawbody  SS_PHISH_CUR_G814_08021803 /From: ".{0,50}"<.*To reactivate your account/i
describe SS_PHISH_CUR_G814_08021803 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G814_08021803 0.001

# Email.Phishing.Cur.Gen815.Sanesecurity.08021804
rawbody  SS_PHISH_CUR_G815_08021804 /From: ".{0,50}"<.*is currently locked due to inactivity\. To avoid losing access to your online banking/i
describe SS_PHISH_CUR_G815_08021804 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G815_08021804 0.001

# Email.Phishing.Cur.Gen816.Sanesecurity.08021805
rawbody  SS_PHISH_CUR_G816_08021805 /From: ".{0,50}"<.*This is your official notification that the service\(s\) listed below/i
describe SS_PHISH_CUR_G816_08021805 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G816_08021805 0.001

# Html.Phishing.Cur.Gen817.Sanesecurity.08021806
body     SS_PHISH_CUR_G817_08021806 /\/redirect\.html">dispute transaction<\/a><\/strong>/i
describe SS_PHISH_CUR_G817_08021806 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G817_08021806 0.001

# Email.Phishing.Cur.Gen818.Sanesecurity.08021807
rawbody  SS_PHISH_CUR_G818_08021807 /From: ".{0,50}"<.*temporaneamente bloccato a causa abbiamo identificato/i
describe SS_PHISH_CUR_G818_08021807 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G818_08021807 0.001

# Email.Phishing.Cur.Gen819.Sanesecurity.08021808
rawbody  SS_PHISH_CUR_G819_08021808 /From: "Banco Poste Italiane"<BPOL\@poste\.it>/i
describe SS_PHISH_CUR_G819_08021808 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G819_08021808 0.001

# Email.Phishing.Cur.Gen820.Sanesecurity.08021809
rawbody  SS_PHISH_CUR_G820_08021809 /\/Abbey-online\/dert\.htm/i
describe SS_PHISH_CUR_G820_08021809 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G820_08021809 0.001

# Email.Phishing.Cur.Gen821.Sanesecurity.08021900
rawbody  SS_PHISH_CUR_G821_08021900 /From: "Sterling Bank"<security\@banksterling\.com>/i
describe SS_PHISH_CUR_G821_08021900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G821_08021900 0.001

# Email.Phishing.Cur.Gen822.Sanesecurity.08021901
rawbody  SS_PHISH_CUR_G822_08021901 /From: ".{0,50}"<.*This is your official notification/i
describe SS_PHISH_CUR_G822_08021901 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G822_08021901 0.001

# Email.Phishing.Cur.Gen823.Sanesecurity.08021902
rawbody  SS_PHISH_CUR_G823_08021902 /From: ".{0,50}"<.*Resolution Center:/i
describe SS_PHISH_CUR_G823_08021902 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G823_08021902 0.001

# Email.Phishing.Cur.Gen824.Sanesecurity.08021903
rawbody  SS_PHISH_CUR_G824_08021903 /From: "service\@navyfcu\.org"<service\@navyfcu\.org>/i
describe SS_PHISH_CUR_G824_08021903 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G824_08021903 0.001

# Email.Phishing.Cur.Gen825.Sanesecurity.08021904
rawbody  SS_PHISH_CUR_G825_08021904 /From: "PayPal"<service\@paypal\.com>/i
describe SS_PHISH_CUR_G825_08021904 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G825_08021904 0.001

# Email.Phishing.Cur.Gen826.Sanesecurity.08021905
rawbody  SS_PHISH_CUR_G826_08021905 /From: "Downey Savings and Loan Association"<SecureAlert\@downeysavings\.onlinebanking\.com>/i
describe SS_PHISH_CUR_G826_08021905 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G826_08021905 0.001

# Email.Phishing.Cur.Gen827.Sanesecurity.08021906
rawbody  SS_PHISH_CUR_G827_08021906 /From: ".{0,50}"<.*terminate your online banking/i
describe SS_PHISH_CUR_G827_08021906 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G827_08021906 0.001

# Email.Phishing.Cur.Gen828.Sanesecurity.08022000
rawbody  SS_PHISH_CUR_G828_08022000 /https:\/\/bancopostaonline\.poste \.it\//i
describe SS_PHISH_CUR_G828_08022000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G828_08022000 0.001

# Email.Phishing.Cur.Gen829.Sanesecurity.08022001
rawbody  SS_PHISH_CUR_G829_08022001 /http:\/\/bibform\.hsbc\.com\./i
describe SS_PHISH_CUR_G829_08022001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G829_08022001 0.001

# Email.Phishing.Cur.Gen830.Sanesecurity.08022100
rawbody  SS_PHISH_CUR_G830_08022100 /From: ".{0,50}"<.*You have 1 unread Security Message/i
describe SS_PHISH_CUR_G830_08022100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G830_08022100 0.001

# Email.Phishing.Cur.Gen831.Sanesecurity.08022101
rawbody  SS_PHISH_CUR_G831_08022101 /From: "CUNA"<antifraud\@cuna\.org>/i
describe SS_PHISH_CUR_G831_08022101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G831_08022101 0.001

# Email.Phishing.Cur.Gen832.Sanesecurity.08022102
rawbody  SS_PHISH_CUR_G832_08022102 /From: ".{0,50}"<.*this is a security measure intended to help/i
describe SS_PHISH_CUR_G832_08022102 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G832_08022102 0.001

# Email.Phishing.Cur.Gen833.Sanesecurity.08022103
rawbody  SS_PHISH_CUR_G833_08022103 /From: "eBay"<member\@ebay\.com\.us>/i
describe SS_PHISH_CUR_G833_08022103 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G833_08022103 0.001

# Email.Phishing.Cur.Gen834.Sanesecurity.08022104
rawbody  SS_PHISH_CUR_G834_08022104 /From: ".{0,50}"<.*http:\/\/pics\.ebaystatic\.com\//i
describe SS_PHISH_CUR_G834_08022104 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G834_08022104 0.001

# Email.Phishing.Cur.Gen835.Sanesecurity.08022200
rawbody  SS_PHISH_CUR_G835_08022200 /\/mambots\/.{0,50}\/online\.lloydstsb\.co\.uk\//i
describe SS_PHISH_CUR_G835_08022200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G835_08022200 0.001

# Email.Phishing.Cur.Gen836.Sanesecurity.08022201
rawbody  SS_PHISH_CUR_G836_08022201 /From: ".{0,50}"<.*Messaggio di Sicurezza/i
describe SS_PHISH_CUR_G836_08022201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G836_08022201 0.001

# Email.Phishing.Cur.Gen837.Sanesecurity.08022202
rawbody  SS_PHISH_CUR_G837_08022202 /http:\/\/membres\.lycos\.fr\/.{0,300}Your new PayPal account makes sending online/i
describe SS_PHISH_CUR_G837_08022202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G837_08022202 0.001

# Email.Phishing.Cur.Gen838.Sanesecurity.08022203
rawbody  SS_PHISH_CUR_G838_08022203 /<title>New Page 1<\/title>.*Wells Fargo Bank<br>/i
describe SS_PHISH_CUR_G838_08022203 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G838_08022203 0.001

# Email.Phishing.Cur.Gen839.Sanesecurity.08022204
rawbody  SS_PHISH_CUR_G839_08022204 /<title>New Page 1<\/title>.*TCF Online Financial Corporation1-800-TCF/i
describe SS_PHISH_CUR_G839_08022204 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G839_08022204 0.001

# Email.Phishing.Cur.Gen840.Sanesecurity.08022500
rawbody  SS_PHISH_CUR_G840_08022500 /From: "Abbey National Plc"<onlineservices\@abbey\.co\.uk>/i
describe SS_PHISH_CUR_G840_08022500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G840_08022500 0.001

# Email.Phishing.Cur.Gen841.Sanesecurity.08022501
rawbody  SS_PHISH_CUR_G841_08022501 /From: ".{0,50}"<.*for your protection we are proactively notifying you of this activity/i
describe SS_PHISH_CUR_G841_08022501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G841_08022501 0.001

# Email.Phishing.Cur.Gen842.Sanesecurity.08022600
rawbody  SS_PHISH_CUR_G842_08022600 /From: "PayPal"<security-center\@PayPal\.com>/i
describe SS_PHISH_CUR_G842_08022600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G842_08022600 0.001

# Email.Phishing.Cur.Gen843.Sanesecurity.08022601
rawbody  SS_PHISH_CUR_G843_08022601 /From: ".{0,50}"<.*identified some unusual activity in your account/i
describe SS_PHISH_CUR_G843_08022601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G843_08022601 0.001

# Email.Phishing.Cur.Gen844.Sanesecurity.08022602
rawbody  SS_PHISH_CUR_G844_08022602 /From: "Capital One"<security\@capitalone\.com>/i
describe SS_PHISH_CUR_G844_08022602 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G844_08022602 0.001

# Email.Phishing.Cur.Gen845.Sanesecurity.08022603
rawbody  SS_PHISH_CUR_G845_08022603 /From: ".{0,50}"<.*You have 1 new message/i
describe SS_PHISH_CUR_G845_08022603 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G845_08022603 0.001

# Email.Phishing.Cur.Gen846.Sanesecurity.08022604
rawbody  SS_PHISH_CUR_G846_08022604 /\/\.https\/cgi-bin\/webscrcmd=_login-run\/webscrcmd/i
describe SS_PHISH_CUR_G846_08022604 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G846_08022604 0.001

# Email.Phishing.Cur.Gen847.Sanesecurity.08022605
rawbody  SS_PHISH_CUR_G847_08022605 /www\.paypal\.com\..{0,30}\.000.{0,30}\.com\/cmd-confirm\/login\.php/i
describe SS_PHISH_CUR_G847_08022605 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G847_08022605 0.001

# Email.Phishing.Cur.Gen848.Sanesecurity.08022606
rawbody  SS_PHISH_CUR_G848_08022606 /http:\/\/.{0,10}\.natwest\.com\./i
describe SS_PHISH_CUR_G848_08022606 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G848_08022606 0.001

# Email.Phishing.Cur.Gen849.Sanesecurity.08022607
rawbody  SS_PHISH_CUR_G849_08022607 /http:\/\/www\.nationwide\.co\.uk\./i
describe SS_PHISH_CUR_G849_08022607 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G849_08022607 0.001

# Email.Phishing.Cur.Gen850.Sanesecurity.08022608
rawbody  SS_PHISH_CUR_G850_08022608 /http:\/\/vr-networld\.de\./i
describe SS_PHISH_CUR_G850_08022608 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G850_08022608 0.001

# Email.Phishing.Cur.Gen851.Sanesecurity.08022609
rawbody  SS_PHISH_CUR_G851_08022609 /http:\/\/online\.westpac\.com\.au\./i
describe SS_PHISH_CUR_G851_08022609 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G851_08022609 0.001

# Email.Phishing.Cur.Gen852.Sanesecurity.08022610
rawbody  SS_PHISH_CUR_G852_08022610 /http:\/\/direct-certs.{1}\.bankofamerica\.com\./i
describe SS_PHISH_CUR_G852_08022610 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G852_08022610 0.001

# Email.Phishing.Cur.Gen853.Sanesecurity.08022611
rawbody  SS_PHISH_CUR_G853_08022611 /http:\/\/commerceconnections\.commercebank\.com\./i
describe SS_PHISH_CUR_G853_08022611 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G853_08022611 0.001

# Email.Phishing.Cur.Gen854.Sanesecurity.08022612
rawbody  SS_PHISH_CUR_G854_08022612 /\.bankofthewest\.com\./i
describe SS_PHISH_CUR_G854_08022612 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G854_08022612 0.001

# Email.Phishing.Cur.Gen855.Sanesecurity.08022613
rawbody  SS_PHISH_CUR_G855_08022613 /\/icons\/small\/ps1\.gif\/signin\.ebay\.com\//i
describe SS_PHISH_CUR_G855_08022613 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G855_08022613 0.001

# Email.Phishing.Cur.Gen856.Sanesecurity.08022614
rawbody  SS_PHISH_CUR_G856_08022614 /\/icons\/small\/ps1\.gif\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G856_08022614 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G856_08022614 0.001

# Email.Phishing.Cur.Gen857.Sanesecurity.08022615
rawbody  SS_PHISH_CUR_G857_08022615 /\/icons\/small\/www\.poste\.it\//i
describe SS_PHISH_CUR_G857_08022615 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G857_08022615 0.001

# Email.Phishing.Cur.Gen858.Sanesecurity.08022700
rawbody  SS_PHISH_CUR_G858_08022700 /http:\/\/www.{1}\.natwest\.co\.uk\./i
describe SS_PHISH_CUR_G858_08022700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G858_08022700 0.001

# Email.Phishing.Cur.Gen859.Sanesecurity.08022701
rawbody  SS_PHISH_CUR_G859_08022701 /From: ".{0,50}"<.*\/connect\.to\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G859_08022701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G859_08022701 0.001

# Email.Phishing.Cur.Gen860.Sanesecurity.08022800
rawbody  SS_PHISH_CUR_G860_08022800 /http:\/\/wc\.wachovia\.ibsIDcmopserver\.cmserver\.access/i
describe SS_PHISH_CUR_G860_08022800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G860_08022800 0.001

# Email.Phishing.Cur.Gen861.Sanesecurity.08022801
rawbody  SS_PHISH_CUR_G861_08022801 /From: "PayPal Team"<security\@paypal\.com>/i
describe SS_PHISH_CUR_G861_08022801 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G861_08022801 0.001

# Email.Phishing.Cur.Gen862.Sanesecurity.08022802
rawbody  SS_PHISH_CUR_G862_08022802 /From: ".{0,50}"<.*Please do not reply to this email\. This mailbox is/i
describe SS_PHISH_CUR_G862_08022802 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G862_08022802 0.001

# Email.Phishing.Cur.Gen863.Sanesecurity.08022900
rawbody  SS_PHISH_CUR_G863_08022900 /From: service\@intl\.paypal\.com<notice\@smtp\.intl\.paypal\.com>/i
describe SS_PHISH_CUR_G863_08022900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G863_08022900 0.001

# Email.Phishing.Cur.Gen864.Sanesecurity.08030300
rawbody  SS_PHISH_CUR_G864_08030300 /From: ".{0,50}"<.*have suspended your account until such time that it can be safely restored/i
describe SS_PHISH_CUR_G864_08030300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G864_08030300 0.001

# Email.Phishing.Cur.Gen865.Sanesecurity.08030301
rawbody  SS_PHISH_CUR_G865_08030301 /\/http\/www\.halifax\.co\.uk\/_mem_bin\/formslogin\.asp\//i
describe SS_PHISH_CUR_G865_08030301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G865_08030301 0.001

# Email.Phishing.Cur.Gen866.Sanesecurity.08030302
rawbody  SS_PHISH_CUR_G866_08030302 /\/http\/www\.usbank\.com\/AuthService\/Login\/usbank\.html/i
describe SS_PHISH_CUR_G866_08030302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G866_08030302 0.001

# Email.Phishing.Cur.Gen867.Sanesecurity.08030303
rawbody  SS_PHISH_CUR_G867_08030303 /From: ".{0,50}"<.*Thank you for using PayPal!/i
describe SS_PHISH_CUR_G867_08030303 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G867_08030303 0.001

# Email.Phishing.Cur.Gen868.Sanesecurity.08030304
rawbody  SS_PHISH_CUR_G868_08030304 /From: The PayPal Security Team<noreply\@paypal\.com>/i
describe SS_PHISH_CUR_G868_08030304 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G868_08030304 0.001

# Email.Phishing.Cur.Gen869.Sanesecurity.08030305
rawbody  SS_PHISH_CUR_G869_08030305 /From: The PayPal Security Team<no-reply\@ paypal\.com>/i
describe SS_PHISH_CUR_G869_08030305 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G869_08030305 0.001

# Email.Phishing.Cur.Gen870.Sanesecurity.08030306
rawbody  SS_PHISH_CUR_G870_08030306 /From: The PayPal Security Team<info\@ paypal\.com>/i
describe SS_PHISH_CUR_G870_08030306 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G870_08030306 0.001

# Email.Phishing.Cur.Gen871.Sanesecurity.08030307
rawbody  SS_PHISH_CUR_G871_08030307 /From: ".{0,50}"<.*with your eBay User ID and password/i
describe SS_PHISH_CUR_G871_08030307 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G871_08030307 0.001

# Email.Phishing.Cur.Gen872.Sanesecurity.08030400
rawbody  SS_PHISH_CUR_G872_08030400 /From: ".{0,50}"<.*Dear eBay member/i
describe SS_PHISH_CUR_G872_08030400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G872_08030400 0.001

# Email.Phishing.Cur.Gen873.Sanesecurity.08030401
rawbody  SS_PHISH_CUR_G873_08030401 /- Internet Banking<\/title>.*http:\/\/email1\.paypal\.com\/1x1\.dyn\?0FED48GvB2L64qzRDh37=0/i
describe SS_PHISH_CUR_G873_08030401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G873_08030401 0.001

# Email.Phishing.Cur.Gen874.Sanesecurity.08030600
rawbody  SS_PHISH_CUR_G874_08030600 /From: ".{0,50}"<.*you or someone had used your account from different locations\. For security/i
describe SS_PHISH_CUR_G874_08030600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G874_08030600 0.001

# Email.Phishing.Cur.Gen875.Sanesecurity.08030700
rawbody  SS_PHISH_CUR_G875_08030700 /\/http\/www\.suntrust\.com\/serverportal\//i
describe SS_PHISH_CUR_G875_08030700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G875_08030700 0.001

# Email.Phishing.Cur.Gen876.Sanesecurity.08030701
rawbody  SS_PHISH_CUR_G876_08030701 /From: ".{0,50}"<.*we are required to open an investigation into this matter/i
describe SS_PHISH_CUR_G876_08030701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G876_08030701 0.001

# Email.Phishing.Cur.Gen877.Sanesecurity.08030702
rawbody  SS_PHISH_CUR_G877_08030702 /From: "PayPal  " <account\@paypal\.com>/i
describe SS_PHISH_CUR_G877_08030702 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G877_08030702 0.001

# Email.Phishing.Cur.Gen878.Sanesecurity.08030800
rawbody  SS_PHISH_CUR_G878_08030800 /http:\/\/www\.commercial\.bnc\.ca\./i
describe SS_PHISH_CUR_G878_08030800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G878_08030800 0.001

# Email.Phishing.Cur.Gen879.Sanesecurity.08031000
rawbody  SS_PHISH_CUR_G879_08031000 /From: ".{0,50}"<.*>Gentile <span class=SpellE>Cliente/i
describe SS_PHISH_CUR_G879_08031000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G879_08031000 0.001

# Email.Phishing.Cur.Gen880.Sanesecurity.08031001
rawbody  SS_PHISH_CUR_G880_08031001 /From: "Banca di Roma"<servizio\@bancaroma\.it>/i
describe SS_PHISH_CUR_G880_08031001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G880_08031001 0.001

# Email.Phishing.Cur.Gen881.Sanesecurity.08031002
rawbody  SS_PHISH_CUR_G881_08031002 /\/images\/nationwide\.co\.uk\/nationwide\.co\.uk\//i
describe SS_PHISH_CUR_G881_08031002 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G881_08031002 0.001

# Email.Phishing.Cur.Gen882.Sanesecurity.08031003
rawbody  SS_PHISH_CUR_G882_08031003 /<p align="left"><b>Unauthorized Attempt Notices !!!!<\/b><\/p>/i
describe SS_PHISH_CUR_G882_08031003 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G882_08031003 0.001

# Email.Phishing.Cur.Gen883.Sanesecurity.08031004
rawbody  SS_PHISH_CUR_G883_08031004 /http:\/\/wcma\.businesscenter\.ml\.network\./i
describe SS_PHISH_CUR_G883_08031004 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G883_08031004 0.001

# Email.Phishing.Cur.Gen884.Sanesecurity.08031005
rawbody  SS_PHISH_CUR_G884_08031005 /From: ".{0,50}"<.*A recent change in your personal information/i
describe SS_PHISH_CUR_G884_08031005 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G884_08031005 0.001

# Email.Phishing.Cur.Gen885.Sanesecurity.08031006
rawbody  SS_PHISH_CUR_G885_08031006 /From: ".{0,50}"<.*we consistently monitor accounts for possible fraudulent activity/i
describe SS_PHISH_CUR_G885_08031006 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G885_08031006 0.001

# Email.Phishing.Cur.Gen886.Sanesecurity.08031007
rawbody  SS_PHISH_CUR_G886_08031007 /From: Virginia Credit Union<contact\@vacu\.com>/i
describe SS_PHISH_CUR_G886_08031007 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G886_08031007 0.001

# Email.Phishing.Cur.Gen887.Sanesecurity.08031008
rawbody  SS_PHISH_CUR_G887_08031008 /From: ".{0,50}"<.*to better safeguard the privacy and security/i
describe SS_PHISH_CUR_G887_08031008 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G887_08031008 0.001

# Email.Phishing.Cur.Gen888.Sanesecurity.08031009
rawbody  SS_PHISH_CUR_G888_08031009 /From: ".{0,50}"<.*account has been deactivated due to inactivity/i
describe SS_PHISH_CUR_G888_08031009 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G888_08031009 0.001

# Email.Phishing.Cur.Gen889.Sanesecurity.08031010
rawbody  SS_PHISH_CUR_G889_08031010 /From: ".{0,50}"<.*we periodically review accounts/i
describe SS_PHISH_CUR_G889_08031010 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G889_08031010 0.001

# Email.Phishing.Cur.Gen890.Sanesecurity.08031011
rawbody  SS_PHISH_CUR_G890_08031011 /From: ".{0,50}"<.*your Message Center has <b>1 new message/i
describe SS_PHISH_CUR_G890_08031011 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G890_08031011 0.001

# Email.Phishing.Cur.Gen891.Sanesecurity.08031012
rawbody  SS_PHISH_CUR_G891_08031012 /From: ".{0,50}"<.*suspended due to the violation of our site policy/i
describe SS_PHISH_CUR_G891_08031012 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G891_08031012 0.001

# Email.Phishing.Cur.Gen892.Sanesecurity.08031013
rawbody  SS_PHISH_CUR_G892_08031013 /From: ".{0,50}"<.*Usted tiene un nuevo mensaje personal de alerta/i
describe SS_PHISH_CUR_G892_08031013 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G892_08031013 0.001

# Email.Phishing.Cur.Gen893.Sanesecurity.08031014
rawbody  SS_PHISH_CUR_G893_08031014 /\/\.www\/halifax-online\//i
describe SS_PHISH_CUR_G893_08031014 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G893_08031014 0.001

# Email.Phishing.Cur.Gen894.Sanesecurity.08031015
rawbody  SS_PHISH_CUR_G894_08031015 /\.dll\?NbankPlaceInfo/i
describe SS_PHISH_CUR_G894_08031015 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G894_08031015 0.001

# Email.Phishing.Cur.Gen895.Sanesecurity.08031016
rawbody  SS_PHISH_CUR_G895_08031016 /<title>New Page.*Lloyds TSB Internet Banking/i
describe SS_PHISH_CUR_G895_08031016 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G895_08031016 0.001

# Email.Phishing.Cur.Gen896.Sanesecurity.08031017
rawbody  SS_PHISH_CUR_G896_08031017 /http:\/\/citibusinessonline\.da-us\.citibank\.comcbusol\./i
describe SS_PHISH_CUR_G896_08031017 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G896_08031017 0.001

# Email.Phishing.Cur.Gen897.Sanesecurity.08031100
rawbody  SS_PHISH_CUR_G897_08031100 /From: ".{0,50}"<.*we have recently introduced additional security measures/i
describe SS_PHISH_CUR_G897_08031100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G897_08031100 0.001

# Email.Phishing.Cur.Gen898.Sanesecurity.08031101
rawbody  SS_PHISH_CUR_G898_08031101 /From: ".{0,50}"<.*BancoPosta/i
describe SS_PHISH_CUR_G898_08031101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G898_08031101 0.001

# Email.Phishing.Cur.Gen899.Sanesecurity.08031102
rawbody  SS_PHISH_CUR_G899_08031102 /From: ".{0,50}"<.*Please kindly update and verify your personal details below/i
describe SS_PHISH_CUR_G899_08031102 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G899_08031102 0.001

# Email.Phishing.Cur.Gen900.Sanesecurity.08031200
rawbody  SS_PHISH_CUR_G900_08031200 /\/images\/www\.rbsdigital\.co\.uk\//i
describe SS_PHISH_CUR_G900_08031200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G900_08031200 0.001

# Email.Phishing.Cur.Gen901.Sanesecurity.08031201
rawbody  SS_PHISH_CUR_G901_08031201 /Dear Value Customer,.*message waiting in your Inbox Folder/i
describe SS_PHISH_CUR_G901_08031201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G901_08031201 0.001

# Email.Phishing.Cur.Gen902.Sanesecurity.08031202
rawbody  SS_PHISH_CUR_G902_08031202 /Subject:.{0,30}Bank Alert : Account Access Notification/i
describe SS_PHISH_CUR_G902_08031202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G902_08031202 0.001

# Email.Phishing.Cur.Gen903.Sanesecurity.08031203
rawbody  SS_PHISH_CUR_G903_08031203 /http:\/\/citibusiness\.citibank\.com\./i
describe SS_PHISH_CUR_G903_08031203 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G903_08031203 0.001

# Email.Phishing.Cur.Gen904.Sanesecurity.08031204
rawbody  SS_PHISH_CUR_G904_08031204 /\/icons\/\%20\/www\.amazon\.com\//i
describe SS_PHISH_CUR_G904_08031204 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G904_08031204 0.001

# Email.Phishing.Cur.Gen905.Sanesecurity.08031205
rawbody  SS_PHISH_CUR_G905_08031205 /\/icons\/\%20\/www\.esfcu\.org\//i
describe SS_PHISH_CUR_G905_08031205 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G905_08031205 0.001

# Email.Phishing.Cur.Gen906.Sanesecurity.08031206
rawbody  SS_PHISH_CUR_G906_08031206 /\/icons\/\%20\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G906_08031206 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G906_08031206 0.001

# Email.Phishing.Cur.Gen907.Sanesecurity.08031207
rawbody  SS_PHISH_CUR_G907_08031207 /\/icons\/\%20\/www\.poste\.it\//i
describe SS_PHISH_CUR_G907_08031207 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G907_08031207 0.001

# Email.Phishing.Cur.Gen908.Sanesecurity.08031208
rawbody  SS_PHISH_CUR_G908_08031208 /\/icons\/\%20\/www\.spiritstlcu\.org\//i
describe SS_PHISH_CUR_G908_08031208 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G908_08031208 0.001

# Email.Phishing.Cur.Gen909.Sanesecurity.08031209
rawbody  SS_PHISH_CUR_G909_08031209 /\/icons\/\%20\/www\.vcu\.com\//i
describe SS_PHISH_CUR_G909_08031209 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G909_08031209 0.001

# Email.Phishing.Cur.Gen910.Sanesecurity.08031210
rawbody  SS_PHISH_CUR_G910_08031210 /http:\/\/wellsoffice\.wellsfargo\.portal\.signon/i
describe SS_PHISH_CUR_G910_08031210 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G910_08031210 0.001

# Email.Phishing.Cur.Gen911.Sanesecurity.08031211
rawbody  SS_PHISH_CUR_G911_08031211 /<title>New Page.*your online account has been accessed from certain blacklisted/i
describe SS_PHISH_CUR_G911_08031211 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G911_08031211 0.001

# Email.Phishing.Cur.Gen912.Sanesecurity.08031700
rawbody  SS_PHISH_CUR_G912_08031700 /http:\/\/www-lloydstsb\.com\./i
describe SS_PHISH_CUR_G912_08031700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G912_08031700 0.001

# Email.Phishing.Cur.Gen913.Sanesecurity.08031701
rawbody  SS_PHISH_CUR_G913_08031701 /\/http\/www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G913_08031701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G913_08031701 0.001

# Email.Phishing.Cur.Gen914.Sanesecurity.08031702
rawbody  SS_PHISH_CUR_G914_08031702 /account Security Update needed.*http:\/\/.{0,50}\.dyndns\.org\//i
describe SS_PHISH_CUR_G914_08031702 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G914_08031702 0.001

# Email.Phishing.Cur.Gen915.Sanesecurity.08031703
rawbody  SS_PHISH_CUR_G915_08031703 /Please update your billing records:.{0,5}http:\/\/(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)/i
describe SS_PHISH_CUR_G915_08031703 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G915_08031703 0.001

# Email.Phishing.Cur.Gen916.Sanesecurity.08031704
rawbody  SS_PHISH_CUR_G916_08031704 /\/online\.wellsfargo\.com\/online\.wellsfargo\.com\//i
describe SS_PHISH_CUR_G916_08031704 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G916_08031704 0.001

# Email.Phishing.Cur.Gen917.Sanesecurity.08031705
rawbody  SS_PHISH_CUR_G917_08031705 /Please update your billing records:.{0,50}\/\.us\/cgi-bin\/index\.php/i
describe SS_PHISH_CUR_G917_08031705 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G917_08031705 0.001

# Email.Phishing.Cur.Gen918.Sanesecurity.08031706
rawbody  SS_PHISH_CUR_G918_08031706 /http:\/\/wachovia\.com\./i
describe SS_PHISH_CUR_G918_08031706 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G918_08031706 0.001

# Email.Phishing.Cur.Gen919.Sanesecurity.08031707
rawbody  SS_PHISH_CUR_G919_08031707 /www\.corpone\.mvrs\.nsfaccounts\.servicelogin\.sitemaps\.onlineservices\.servnetccess\./i
describe SS_PHISH_CUR_G919_08031707 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G919_08031707 0.001

# Email.Phishing.Cur.Gen920.Sanesecurity.08031708
rawbody  SS_PHISH_CUR_G920_08031708 /www\.careerbuilder\.jobposter\.sc_cmp2\.cblibrary\.jslibrary-debug\.session\./i
describe SS_PHISH_CUR_G920_08031708 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G920_08031708 0.001

# Email.Phishing.Cur.Gen921.Sanesecurity.08031709
rawbody  SS_PHISH_CUR_G921_08031709 /access\.jpmorgan\.content\.tssweb\.cmiii\.contentserver\.cts\./i
describe SS_PHISH_CUR_G921_08031709 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G921_08031709 0.001

# Email.Phishing.Cur.Gen922.Sanesecurity.08031710
rawbody  SS_PHISH_CUR_G922_08031710 /wc\.wachovia\.ibsidcmopserver\.cmserver\.access/i
describe SS_PHISH_CUR_G922_08031710 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G922_08031710 0.001

# Email.Phishing.Cur.Gen923.Sanesecurity.08031711
rawbody  SS_PHISH_CUR_G923_08031711 /wcma\.businesscenter\.ml\.network\.bcprivate\.sessionsecure/i
describe SS_PHISH_CUR_G923_08031711 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G923_08031711 0.001

# Email.Phishing.Cur.Gen924.Sanesecurity.08031800
rawbody  SS_PHISH_CUR_G924_08031800 /From: ".{0,50}"<.*Your PayPal account has been limited/i
describe SS_PHISH_CUR_G924_08031800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G924_08031800 0.001

# Email.Phishing.Cur.Gen925.Sanesecurity.08031900
rawbody  SS_PHISH_CUR_G925_08031900 /http:\/\/offshore\.hsbc\.com\./i
describe SS_PHISH_CUR_G925_08031900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G925_08031900 0.001

# Email.Phishing.Cur.Gen926.Sanesecurity.08032500
rawbody  SS_PHISH_CUR_G926_08032500 /http:\/\/onlinebanking\.halifax\.co\.uk\./i
describe SS_PHISH_CUR_G926_08032500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G926_08032500 0.001

# Email.Phishing.Cur.Gen927.Sanesecurity.08032501
rawbody  SS_PHISH_CUR_G927_08032501 /From: "Google AdWords Noreply"adwords-noreply\@google\.com/i
describe SS_PHISH_CUR_G927_08032501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G927_08032501 0.001

# Email.Phishing.Cur.Gen928.Sanesecurity.08032502
rawbody  SS_PHISH_CUR_G928_08032502 /Dear Google AdWords Customer!.*http:\/\/adwords\.google\.com\./i
describe SS_PHISH_CUR_G928_08032502 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G928_08032502 0.001

# Email.Phishing.Cur.Gen929.Sanesecurity.08032600
rawbody  SS_PHISH_CUR_G929_08032600 /http:\/\/business-internet-banking\.hsbc\.com\./i
describe SS_PHISH_CUR_G929_08032600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G929_08032600 0.001

# Email.Phishing.Cur.Gen930.Sanesecurity.08032601
rawbody  SS_PHISH_CUR_G930_08032601 /http:\/\/citibusinessonline\.da-us\.citi\.com\./i
describe SS_PHISH_CUR_G930_08032601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G930_08032601 0.001

# Email.Phishing.Cur.Gen931.Sanesecurity.08032602
rawbody  SS_PHISH_CUR_G931_08032602 /http:\/\/citibusinessonline\.da-us\.citibank\.com\./i
describe SS_PHISH_CUR_G931_08032602 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G931_08032602 0.001

# Email.Phishing.Cur.Gen932.Sanesecurity.08032603
rawbody  SS_PHISH_CUR_G932_08032603 /http:\/\/consultnc\.nationalcity\.com\./i
describe SS_PHISH_CUR_G932_08032603 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G932_08032603 0.001

# Email.Phishing.Cur.Gen933.Sanesecurity.08032604
rawbody  SS_PHISH_CUR_G933_08032604 /http:\/\/contact\.ebay\.co\.uk\./i
describe SS_PHISH_CUR_G933_08032604 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G933_08032604 0.001

# Email.Phishing.Cur.Gen934.Sanesecurity.08032605
rawbody  SS_PHISH_CUR_G934_08032605 /http:\/\/direct-certs\.bankofamerica\.com\./i
describe SS_PHISH_CUR_G934_08032605 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G934_08032605 0.001

# Email.Phishing.Cur.Gen935.Sanesecurity.08032606
rawbody  SS_PHISH_CUR_G935_08032606 /http:\/\/direct-certs.{1}\.bankofamerica\.com\./i
describe SS_PHISH_CUR_G935_08032606 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G935_08032606 0.001

# Email.Phishing.Cur.Gen936.Sanesecurity.08032607
rawbody  SS_PHISH_CUR_G936_08032607 /http:\/\/ibs\.bankwest\.com\.au\./i
describe SS_PHISH_CUR_G936_08032607 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G936_08032607 0.001

# Email.Phishing.Cur.Gen937.Sanesecurity.08032608
rawbody  SS_PHISH_CUR_G937_08032608 /http:\/\/sing-in-on-amazon\./i
describe SS_PHISH_CUR_G937_08032608 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G937_08032608 0.001

# Email.Phishing.Cur.Gen938.Sanesecurity.08032609
rawbody  SS_PHISH_CUR_G938_08032609 /From: ".{0,50}"<.*Our goal is to ensure that your eBay/i
describe SS_PHISH_CUR_G938_08032609 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G938_08032609 0.001

# Email.Phishing.Cur.Gen939.Sanesecurity.08032610
rawbody  SS_PHISH_CUR_G939_08032610 /From: ".{0,50}"<.*www\.halifax-online\.co\.uk/i
describe SS_PHISH_CUR_G939_08032610 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G939_08032610 0.001

# Email.Phishing.Cur.Gen940.Sanesecurity.08032611
rawbody  SS_PHISH_CUR_G940_08032611 /\/http\/www\.suntrust\.com\//i
describe SS_PHISH_CUR_G940_08032611 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G940_08032611 0.001

# Email.Phishing.Cur.Gen941.Sanesecurity.08040300
rawbody  SS_PHISH_CUR_G941_08040300 /http:\/\/www.{1}\.abbey\.co\.uk\./i
describe SS_PHISH_CUR_G941_08040300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G941_08040300 0.001

# Email.Phishing.Cur.Gen942.Sanesecurity.08040301
rawbody  SS_PHISH_CUR_G942_08040301 /\/\.www\.bankfranklin\.com\//i
describe SS_PHISH_CUR_G942_08040301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G942_08040301 0.001

# Email.Phishing.Cur.Gen943.Sanesecurity.08041100
rawbody  SS_PHISH_CUR_G943_08041100 /\/https\/www\.halifax-online\.co\.uk\/_mem_bin\//i
describe SS_PHISH_CUR_G943_08041100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G943_08041100 0.001

# Email.Phishing.Cur.Gen944.Sanesecurity.08041101
rawbody  SS_PHISH_CUR_G944_08041101 /:8081\/www\.bankofamerica\.co/i
describe SS_PHISH_CUR_G944_08041101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G944_08041101 0.001

# Email.Phishing.Cur.Gen945.Sanesecurity.08041102
rawbody  SS_PHISH_CUR_G945_08041102 /From: "Citibank\.com"<alerts\@citibank\.com>/i
describe SS_PHISH_CUR_G945_08041102 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G945_08041102 0.001

# Email.Phishing.Cur.Gen946.Sanesecurity.08041103
rawbody  SS_PHISH_CUR_G946_08041103 /From: "eBay Bid Change"<eBay\.Bid\@eBay\.com>/i
describe SS_PHISH_CUR_G946_08041103 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G946_08041103 0.001

# Email.Phishing.Cur.Gen947.Sanesecurity.08041104
rawbody  SS_PHISH_CUR_G947_08041104 /\/https\/www\.halifax\.co\.uk\/_mem_bin\//i
describe SS_PHISH_CUR_G947_08041104 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G947_08041104 0.001

# Email.Phishing.Cur.Gen948.Sanesecurity.08041105
rawbody  SS_PHISH_CUR_G948_08041105 /From: "Central Bank"<alert\@centralbank\.net>/i
describe SS_PHISH_CUR_G948_08041105 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G948_08041105 0.001

# Email.Phishing.Cur.Gen949.Sanesecurity.08041106
rawbody  SS_PHISH_CUR_G949_08041106 /From: ".{0,50}"<.*We detected irregular activity on your/i
describe SS_PHISH_CUR_G949_08041106 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G949_08041106 0.001

# Email.Phishing.Cur.Gen950.Sanesecurity.08041107
rawbody  SS_PHISH_CUR_G950_08041107 /From: "info\@hsbc\.co\.uk"<info\@hsbc\.co\.uk>/i
describe SS_PHISH_CUR_G950_08041107 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G950_08041107 0.001

# Email.Phishing.Cur.Gen951.Sanesecurity.08041108
rawbody  SS_PHISH_CUR_G951_08041108 /From: ".{0,50}"<.*You can review your current Invoice details and Account Status at any time/i
describe SS_PHISH_CUR_G951_08041108 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G951_08041108 0.001

# Email.Phishing.Cur.Gen952.Sanesecurity.08041109
rawbody  SS_PHISH_CUR_G952_08041109 /From: ".{0,50}"<.*withdrawal larger than the amount you designated has been made to your/i
describe SS_PHISH_CUR_G952_08041109 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G952_08041109 0.001

# Email.Phishing.Cur.Gen953.Sanesecurity.08041110
rawbody  SS_PHISH_CUR_G953_08041110 /http:\/\/commercial\.wachovia\.online(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)(0|1|2|3|4|5|6|7|8|9)/i
describe SS_PHISH_CUR_G953_08041110 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G953_08041110 0.001

# Email.Phishing.Cur.Gen954.Sanesecurity.08041400
rawbody  SS_PHISH_CUR_G954_08041400 /webinfocus\.mandtbank\.com\./i
describe SS_PHISH_CUR_G954_08041400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G954_08041400 0.001

# Email.Phishing.Cur.Gen955.Sanesecurity.08041401
rawbody  SS_PHISH_CUR_G955_08041401 /infoplus\.mandtbank\.com\./i
describe SS_PHISH_CUR_G955_08041401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G955_08041401 0.001

# Email.Phishing.Cur.Gen956.Sanesecurity.08041402
rawbody  SS_PHISH_CUR_G956_08041402 /From: ".{0,50}"<.*Official service renewal notification/i
describe SS_PHISH_CUR_G956_08041402 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G956_08041402 0.001

# Email.Phishing.Cur.Gen957.Sanesecurity.08041500
rawbody  SS_PHISH_CUR_G957_08041500 /http:\/\/secure\.skype\.com\./i
describe SS_PHISH_CUR_G957_08041500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G957_08041500 0.001

# Email.Phishing.Cur.Gen958.Sanesecurity.08041501
rawbody  SS_PHISH_CUR_G958_08041501 /From: ".{0,50}"<.*We recently have discovered that multiple computers have attempted to log into/i
describe SS_PHISH_CUR_G958_08041501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G958_08041501 0.001

# Email.Phishing.Cur.Gen959.Sanesecurity.08041502
rawbody  SS_PHISH_CUR_G959_08041502 /:8081\/www\.citibank\.com\//i
describe SS_PHISH_CUR_G959_08041502 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G959_08041502 0.001

# Email.Phishing.Cur.Gen960.Sanesecurity.08041503
rawbody  SS_PHISH_CUR_G960_08041503 /From: "CitiBank Security"<support\@citibank\.com>/i
describe SS_PHISH_CUR_G960_08041503 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G960_08041503 0.001

# Email.Phishing.Cur.Gen961.Sanesecurity.08041504
rawbody  SS_PHISH_CUR_G961_08041504 /From: "Alerts Wachovia"<alerts\@wachovia\.com>/i
describe SS_PHISH_CUR_G961_08041504 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G961_08041504 0.001

# Email.Phishing.Cur.Gen962.Sanesecurity.08041600
rawbody  SS_PHISH_CUR_G962_08041600 /http:\/\/www.{1}\.abbey\.com\./i
describe SS_PHISH_CUR_G962_08041600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G962_08041600 0.001

# Email.Phishing.Cur.Gen963.Sanesecurity.08042200
rawbody  SS_PHISH_CUR_G963_08042200 /\.cable\.mindspring\.com\/online\.lloydstsb\.co\.uk\//i
describe SS_PHISH_CUR_G963_08042200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G963_08042200 0.001

# Email.Phishing.Cur.Gen964.Sanesecurity.08042201
rawbody  SS_PHISH_CUR_G964_08042201 /\.cable\.mindspring\.com\/onlineid\/cgi-bin\/onlineid\.bankofam/i
describe SS_PHISH_CUR_G964_08042201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G964_08042201 0.001

# Email.Phishing.Cur.Gen965.Sanesecurity.08042202
rawbody  SS_PHISH_CUR_G965_08042202 /\.cable\.mindspring\.com\/halifax-online\.co\.uk\//i
describe SS_PHISH_CUR_G965_08042202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G965_08042202 0.001

# Email.Phishing.Cur.Gen966.Sanesecurity.08042203
rawbody  SS_PHISH_CUR_G966_08042203 /\.unitline\.ru\/halifax-online\.co\.uk\//i
describe SS_PHISH_CUR_G966_08042203 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G966_08042203 0.001

# Email.Phishing.Cur.Gen967.Sanesecurity.08042204
rawbody  SS_PHISH_CUR_G967_08042204 /\.adsl\.green\.ch\/onlineid\/cgi-bin\/onlineid\.bankofamerica/i
describe SS_PHISH_CUR_G967_08042204 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G967_08042204 0.001

# Email.Phishing.Cur.Gen968.Sanesecurity.08042205
rawbody  SS_PHISH_CUR_G968_08042205 /\.central\.biz\.rr\.com\/webview\/files\/\/onlineid\/cgi-bin\/onlinei/i
describe SS_PHISH_CUR_G968_08042205 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G968_08042205 0.001

# Email.Phishing.Cur.Gen969.Sanesecurity.08042400
rawbody  SS_PHISH_CUR_G969_08042400 /From: ".{0,50}"<.*We were unable to contact you by phone during the last audit/i
describe SS_PHISH_CUR_G969_08042400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G969_08042400 0.001

# Email.Phishing.Cur.Gen970.Sanesecurity.08042401
rawbody  SS_PHISH_CUR_G970_08042401 /From: "Wells Fargo"<Service\@wellsfargo\.com>/i
describe SS_PHISH_CUR_G970_08042401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G970_08042401 0.001

# Email.Phishing.Cur.Gen971.Sanesecurity.08042402
rawbody  SS_PHISH_CUR_G971_08042402 /Unfortunately, we were unable to verify the ownership of your account.*action="http:\/\/.{0,50}\.free\.fr\//i
describe SS_PHISH_CUR_G971_08042402 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G971_08042402 0.001

# Email.Phishing.Cur.Gen972.Sanesecurity.08042403
rawbody  SS_PHISH_CUR_G972_08042403 /From: "Wells Fargo Online"<securityservice\@wellsfargo\.com>/i
describe SS_PHISH_CUR_G972_08042403 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G972_08042403 0.001

# Email.Phishing.Cur.Gen973.Sanesecurity.08042404
rawbody  SS_PHISH_CUR_G973_08042404 /From: ".{0,50}"<.*users are required to update their account online/i
describe SS_PHISH_CUR_G973_08042404 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G973_08042404 0.001

# Email.Phishing.Cur.Gen974.Sanesecurity.08042500
rawbody  SS_PHISH_CUR_G974_08042500 /http:\/\/nwolb\.com\./i
describe SS_PHISH_CUR_G974_08042500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G974_08042500 0.001

# Email.Phishing.Cur.Gen975.Sanesecurity.08042501
rawbody  SS_PHISH_CUR_G975_08042501 /From: "Google AdWords"<reactivation\@google\.com>/i
describe SS_PHISH_CUR_G975_08042501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G975_08042501 0.001

# Email.Phishing.Cur.Gen976.Sanesecurity.08042502
rawbody  SS_PHISH_CUR_G976_08042502 /http:\/\/www\.adwords\.google\.com\./i
describe SS_PHISH_CUR_G976_08042502 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G976_08042502 0.001

# Email.Phishing.Cur.Gen977.Sanesecurity.08043000
rawbody  SS_PHISH_CUR_G977_08043000 /your contact information in the Account User Profile\.  At your.*http:\/\/.{0,100}\/mambots\//i
describe SS_PHISH_CUR_G977_08043000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G977_08043000 0.001

# Email.Phishing.Cur.Gen978.Sanesecurity.08043001
rawbody  SS_PHISH_CUR_G978_08043001 /http:\/\/commercial\.wachovia\.com\./i
describe SS_PHISH_CUR_G978_08043001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G978_08043001 0.001

# Email.Phishing.Cur.Gen979.Sanesecurity.08050100
rawbody  SS_PHISH_CUR_G979_08050100 /From: "Warning Center Wachovia"<alertw\@wachovia\.com>/i
describe SS_PHISH_CUR_G979_08050100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G979_08050100 0.001

# Email.Phishing.Cur.Gen980.Sanesecurity.08050101
rawbody  SS_PHISH_CUR_G980_08050101 /From: ".{0,50}"<.*We have to do this for the safety of your account and your/i
describe SS_PHISH_CUR_G980_08050101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G980_08050101 0.001

# Email.Phishing.Cur.Gen981.Sanesecurity.08050102
rawbody  SS_PHISH_CUR_G981_08050102 /From: "Message Citi"<alerts\@citibank\.com>/i
describe SS_PHISH_CUR_G981_08050102 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G981_08050102 0.001

# Email.Phishing.Cur.Gen982.Sanesecurity.08050200
rawbody  SS_PHISH_CUR_G982_08050200 /From: "Alert Center Wachovia"<alertsw\@wachovia\.com>/i
describe SS_PHISH_CUR_G982_08050200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G982_08050200 0.001

# Email.Phishing.Cur.Gen983.Sanesecurity.08050201
rawbody  SS_PHISH_CUR_G983_08050201 /From: "eBay"<aw-support\@ebay\.com>/i
describe SS_PHISH_CUR_G983_08050201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G983_08050201 0.001

# Email.Phishing.Cur.Gen984.Sanesecurity.08050202
rawbody  SS_PHISH_CUR_G984_08050202 /From: "eBay\@info\.com"</i
describe SS_PHISH_CUR_G984_08050202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G984_08050202 0.001

# Email.Phishing.Cur.Gen985.Sanesecurity.08050600
rawbody  SS_PHISH_CUR_G985_08050600 /From: ".{0,50}"<.*is constantly working to increase security for all/i
describe SS_PHISH_CUR_G985_08050600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G985_08050600 0.001

# Email.Phishing.Cur.Gen986.Sanesecurity.08050601
rawbody  SS_PHISH_CUR_G986_08050601 /From: ".{0,50}"<.*INBOX \( 1 \)/i
describe SS_PHISH_CUR_G986_08050601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G986_08050601 0.001

# Email.Phishing.Cur.Gen987.Sanesecurity.08050602
rawbody  SS_PHISH_CUR_G987_08050602 /From: ".{0,50}"<.*account is about to expire due to inactivity\. To avoid losing important/i
describe SS_PHISH_CUR_G987_08050602 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G987_08050602 0.001

# Email.Phishing.Cur.Gen988.Sanesecurity.08050603
rawbody  SS_PHISH_CUR_G988_08050603 /\/images\/http\/www\.hsbc\.co\.uk\//i
describe SS_PHISH_CUR_G988_08050603 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G988_08050603 0.001

# Email.Phishing.Cur.Gen988.Sanesecurity.08050603
rawbody  SS_PHISH_CUR_G988_08050603 /From: ".{0,50}"<.*http:\/\/images\.paypal\.com\/en_US\/i\/scr\/pixel\.gif/i
describe SS_PHISH_CUR_G988_08050603 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G988_08050603 0.001

# Email.Phishing.Cur.Gen989.Sanesecurity.08050604
rawbody  SS_PHISH_CUR_G989_08050604 /From: "Internal Revenue Service"<no-reply\@irs\.gov>/i
describe SS_PHISH_CUR_G989_08050604 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G989_08050604 0.001

# Email.Phishing.Cur.Gen990.Sanesecurity.08050700
rawbody  SS_PHISH_CUR_G990_08050700 /From: "California Credit Union"<members\@californiacu\.org>/i
describe SS_PHISH_CUR_G990_08050700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G990_08050700 0.001

# Email.Phishing.Cur.Gen991.Sanesecurity.08050701
rawbody  SS_PHISH_CUR_G991_08050701 /From: ".{0,50}"<.*announcement that requires your immediate attention/i
describe SS_PHISH_CUR_G991_08050701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G991_08050701 0.001

# Email.Phishing.Cur.Gen992.Sanesecurity.08050702
rawbody  SS_PHISH_CUR_G992_08050702 /:84\/californiacu\.org\//i
describe SS_PHISH_CUR_G992_08050702 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G992_08050702 0.001

# Email.Phishing.Cur.Gen993.Sanesecurity.08050703
rawbody  SS_PHISH_CUR_G993_08050703 /From: "eBay Member: ejohnman"<rmember\@ebay\.com>/i
describe SS_PHISH_CUR_G993_08050703 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G993_08050703 0.001

# Email.Phishing.Cur.Gen994.Sanesecurity.08050704
rawbody  SS_PHISH_CUR_G994_08050704 /<title>New Page 1<\/title>.*You have a new message waiting in your Inbox Folder/i
describe SS_PHISH_CUR_G994_08050704 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G994_08050704 0.001

# Email.Phishing.Cur.Gen995.Sanesecurity.08050705
rawbody  SS_PHISH_CUR_G995_08050705 /From: "Citibank"<alerts\@citibank\.com>/i
describe SS_PHISH_CUR_G995_08050705 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G995_08050705 0.001

# Email.Phishing.Cur.Gen996.Sanesecurity.08050706
rawbody  SS_PHISH_CUR_G996_08050706 /From: ".{0,50}"<.*An important Secure Message has been sent to you/i
describe SS_PHISH_CUR_G996_08050706 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G996_08050706 0.001

# Email.Phishing.Cur.Gen997.Sanesecurity.08050707
rawbody  SS_PHISH_CUR_G997_08050707 /From: "Credit Union National Association"<notification\@cuna\.org>/i
describe SS_PHISH_CUR_G997_08050707 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G997_08050707 0.001

# Email.Phishing.Cur.Gen998.Sanesecurity.08050800
rawbody  SS_PHISH_CUR_G998_08050800 /http:\/\/ww(0|1|2|3|4|5|6|7|8|9)\.rbsdigital\.co\.uk\./i
describe SS_PHISH_CUR_G998_08050800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G998_08050800 0.001

# Email.Phishing.Cur.Gen999.Sanesecurity.08050801
rawbody  SS_PHISH_CUR_G999_08050801 /http:\/\/ww(0|1|2|3|4|5|6|7|8|9)\.rbs\.com\./i
describe SS_PHISH_CUR_G999_08050801 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G999_08050801 0.001

# Email.Phishing.Cur.Gen1000.Sanesecurity.08050802
rawbody  SS_PHISH_CUR_G1000_08050802 /http:\/\/www(0|1|2|3|4|5|6|7|8|9)\.rbsdigital\.co\.uk\./i
describe SS_PHISH_CUR_G1000_08050802 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1000_08050802 0.001

# Email.Phishing.Cur.Gen1001.Sanesecurity.08050803
rawbody  SS_PHISH_CUR_G1001_08050803 /http:\/\/www(0|1|2|3|4|5|6|7|8|9)\.rbs\.com\./i
describe SS_PHISH_CUR_G1001_08050803 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1001_08050803 0.001

# Email.Phishing.Cur.Gen1002.Sanesecurity.08050804
rawbody  SS_PHISH_CUR_G1002_08050804 /http:\/\/ww(0|1|2|3|4|5|6|7|8|9)\.nasza-klasa\.pl\./i
describe SS_PHISH_CUR_G1002_08050804 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1002_08050804 0.001

# Email.Phishing.Cur.Gen1003.Sanesecurity.08050805
rawbody  SS_PHISH_CUR_G1003_08050805 /http:\/\/www(0|1|2|3|4|5|6|7|8|9)\.nasza-klasa\.pl\./i
describe SS_PHISH_CUR_G1003_08050805 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1003_08050805 0.001

# Email.Phishing.Cur.Gen1004.Sanesecurity.08051300
rawbody  SS_PHISH_CUR_G1004_08051300 /From: ".{0,50}"<.*We want to remind you that you have not yet completed the process/i
describe SS_PHISH_CUR_G1004_08051300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1004_08051300 0.001

# Email.Phishing.Cur.Gen1005.Sanesecurity.08051301
rawbody  SS_PHISH_CUR_G1005_08051301 /From: PayPal<center-message\@paypal\.com>/i
describe SS_PHISH_CUR_G1005_08051301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1005_08051301 0.001

# Email.Phishing.Cur.Gen1006.Sanesecurity.08051302
rawbody  SS_PHISH_CUR_G1006_08051302 /From: ".{0,50}"<.*account has not fraudulently used and to combat fraud/i
describe SS_PHISH_CUR_G1006_08051302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1006_08051302 0.001

# Email.Phishing.Cur.Gen1007.Sanesecurity.08051303
rawbody  SS_PHISH_CUR_G1007_08051303 /From: "Ebay Inc\."<service\@ebay\.co\.uk>/i
describe SS_PHISH_CUR_G1007_08051303 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1007_08051303 0.001

# Email.Phishing.Cur.Gen1008.Sanesecurity.08051304
rawbody  SS_PHISH_CUR_G1008_08051304 /From: ".{0,50}"<.*You have 1 message\./i
describe SS_PHISH_CUR_G1008_08051304 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1008_08051304 0.001

# Email.Phishing.Cur.Gen1009.Sanesecurity.08051400
rawbody  SS_PHISH_CUR_G1009_08051400 /\.com\/www\.halifax\.co\.uk\//i
describe SS_PHISH_CUR_G1009_08051400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1009_08051400 0.001

# Email.Phishing.Cur.Gen1010.Sanesecurity.08051500
rawbody  SS_PHISH_CUR_G1010_08051500 /Online Statement Notification.*\.google\.com\/images\?q=tbn/i
describe SS_PHISH_CUR_G1010_08051500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1010_08051500 0.001

# Email.Phishing.Cur.Gen1011.Sanesecurity.08051501
rawbody  SS_PHISH_CUR_G1011_08051501 /"PayPal Inc Security Center"<update\@paypal\.com>/i
describe SS_PHISH_CUR_G1011_08051501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1011_08051501 0.001

# Email.Phishing.Cur.Gen1012.Sanesecurity.08051502
rawbody  SS_PHISH_CUR_G1012_08051502 /From: ".{0,50}"<.*believe that your account has been accessed by a third party/i
describe SS_PHISH_CUR_G1012_08051502 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1012_08051502 0.001

# Email.Phishing.Cur.Gen1013.Sanesecurity.08051503
rawbody  SS_PHISH_CUR_G1013_08051503 /From: "CUNA Organization"<service\@cuna\.org>/i
describe SS_PHISH_CUR_G1013_08051503 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1013_08051503 0.001

# Email.Phishing.Cur.Gen1014.Sanesecurity.08051504
rawbody  SS_PHISH_CUR_G1014_08051504 /From: ".{0,50}"<.*claim your prize you have to validate your/i
describe SS_PHISH_CUR_G1014_08051504 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1014_08051504 0.001

# Email.Phishing.Cur.Gen1015.Sanesecurity.08051600
rawbody  SS_PHISH_CUR_G1015_08051600 /From: "EPPICard"<customerservice\@eppicard\.com>/i
describe SS_PHISH_CUR_G1015_08051600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1015_08051600 0.001

# Email.Phishing.Cur.Gen1016.Sanesecurity.08051601
rawbody  SS_PHISH_CUR_G1016_08051601 /From: "HSBC BANK"<support\@hsbc\.co\.uk>/i
describe SS_PHISH_CUR_G1016_08051601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1016_08051601 0.001

# Email.Phishing.Cur.Gen1017.Sanesecurity.08051602
rawbody  SS_PHISH_CUR_G1017_08051602 /From: ".{0,50}"<.* have limited access to your sensitive account features/i
describe SS_PHISH_CUR_G1017_08051602 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1017_08051602 0.001

# Email.Phishing.Cur.Gen1018.Sanesecurity.08051603
rawbody  SS_PHISH_CUR_G1018_08051603 /From: ".{0,50}"<.*Banking Account is currently locked/i
describe SS_PHISH_CUR_G1018_08051603 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1018_08051603 0.001

# Email.Phishing.Cur.Gen1019.Sanesecurity.08051604
rawbody  SS_PHISH_CUR_G1019_08051604 /From: ".{0,50}"<.*We have placed your account on hold/i
describe SS_PHISH_CUR_G1019_08051604 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1019_08051604 0.001

# Email.Phishing.Cur.Gen1020.Sanesecurity.08051605
rawbody  SS_PHISH_CUR_G1020_08051605 /From: "Scenic Falls Federal Credit Union"<customer_service\@scenicfalls\.org>/i
describe SS_PHISH_CUR_G1020_08051605 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1020_08051605 0.001

# Email.Phishing.Cur.Gen1021.Sanesecurity.08051606
rawbody  SS_PHISH_CUR_G1021_08051606 /From: ".{0,50}"<.*This might be due to either of the following reasons/i
describe SS_PHISH_CUR_G1021_08051606 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1021_08051606 0.001

# Email.Phishing.Cur.Gen1022.Sanesecurity.08051607
rawbody  SS_PHISH_CUR_G1022_08051607 /From: ".{0,50}"<.*Gruppo Poste Italiane/i
describe SS_PHISH_CUR_G1022_08051607 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1022_08051607 0.001

# Email.Phishing.Cur.Gen1023.Sanesecurity.08051608
rawbody  SS_PHISH_CUR_G1023_08051608 /From: ".{0,50}"<.*your insurance needs\. Because we recently adjusted your policy, you now need/i
describe SS_PHISH_CUR_G1023_08051608 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1023_08051608 0.001

# Email.Phishing.Cur.Gen1024.Sanesecurity.08051609
rawbody  SS_PHISH_CUR_G1024_08051609 /From: ".{0,50}"<.*Here's your invitation to participate in our convenient, new and easy survey/i
describe SS_PHISH_CUR_G1024_08051609 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1024_08051609 0.001

# Email.Phishing.Cur.Gen1025.Sanesecurity.08051610
rawbody  SS_PHISH_CUR_G1025_08051610 /From: ".{0,50}"<.*As part of our security measures, we regularly screen activity/i
describe SS_PHISH_CUR_G1025_08051610 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1025_08051610 0.001

# Email.Phishing.Cur.Gen1026.Sanesecurity.08051611
rawbody  SS_PHISH_CUR_G1026_08051611 /From: ".{0,50}"<.*In order to begin receiving your statements electronically/i
describe SS_PHISH_CUR_G1026_08051611 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1026_08051611 0.001

# Email.Phishing.Cur.Gen1027.Sanesecurity.08051612
rawbody  SS_PHISH_CUR_G1027_08051612 /From: ".{0,50}"<.*Enroll your Visa Check Card or Credit Card in Verified by Visa today/i
describe SS_PHISH_CUR_G1027_08051612 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1027_08051612 0.001

# Email.Phishing.Cur.Gen1028.Sanesecurity.08051613
rawbody  SS_PHISH_CUR_G1028_08051613 /We need you to confirm your personal data with our existing database/i
describe SS_PHISH_CUR_G1028_08051613 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1028_08051613 0.001

# Email.Phishing.Cur.Gen1029.Sanesecurity.08051614
rawbody  SS_PHISH_CUR_G1029_08051614 /From: ".{0,50}"<.*Please enter your Social Security Number and a valid Credit/i
describe SS_PHISH_CUR_G1029_08051614 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1029_08051614 0.001

# Email.Phishing.Cur.Gen1030.Sanesecurity.08051615
rawbody  SS_PHISH_CUR_G1030_08051615 /From: ".{0,50}"<.*your refund will be delayed due to the volume of requests/i
describe SS_PHISH_CUR_G1030_08051615 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1030_08051615 0.001

# Email.Phishing.Cur.Gen1031.Sanesecurity.08051616
rawbody  SS_PHISH_CUR_G1031_08051616 /From: "service\@irs\.gov"<service\@irs\.gov>/i
describe SS_PHISH_CUR_G1031_08051616 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1031_08051616 0.001

# Email.Phishing.Cur.Gen1032.Sanesecurity.08051617
rawbody  SS_PHISH_CUR_G1032_08051617 /From: "IRS"<irs\@irs\.com>/i
describe SS_PHISH_CUR_G1032_08051617 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1032_08051617 0.001

# Email.Phishing.Cur.Gen1033.Sanesecurity.08051618
rawbody  SS_PHISH_CUR_G1033_08051618 /From: "notice\@paypal\.com"<notice\@paypaI\.com>/i
describe SS_PHISH_CUR_G1033_08051618 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1033_08051618 0.001

# Email.Phishing.Cur.Gen1034.Sanesecurity.08051619
rawbody  SS_PHISH_CUR_G1034_08051619 /From: ".{0,50}"<.*Your account has been temporarily limited/i
describe SS_PHISH_CUR_G1034_08051619 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1034_08051619 0.001

# Email.Phishing.Cur.Gen1035.Sanesecurity.08051620
rawbody  SS_PHISH_CUR_G1035_08051620 /From: ".{0,50}"<.*de su autenticidad rogamos reactivar su cuenta desde el siguiente/i
describe SS_PHISH_CUR_G1035_08051620 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1035_08051620 0.001

# Email.Phishing.Cur.Gen1036.Sanesecurity.08051621
rawbody  SS_PHISH_CUR_G1036_08051621 /Subject:.{0,30}Extra verification process.*\.imageshack\.us\//i
describe SS_PHISH_CUR_G1036_08051621 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1036_08051621 0.001

# Email.Phishing.Cur.Gen1037.Sanesecurity.08051622
rawbody  SS_PHISH_CUR_G1037_08051622 /From: ".{0,50}"<.*we've now limited access to your accounts due to a miss-match/i
describe SS_PHISH_CUR_G1037_08051622 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1037_08051622 0.001

# Email.Phishing.Cur.Gen1038.Sanesecurity.08051623
rawbody  SS_PHISH_CUR_G1038_08051623 /From: "NAVY FEDERAL"<service\@navyfcu\.org>/i
describe SS_PHISH_CUR_G1038_08051623 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1038_08051623 0.001

# Email.Phishing.Cur.Gen1039.Sanesecurity.08051624
rawbody  SS_PHISH_CUR_G1039_08051624 /\(SSL\), security certificate, as well as other security guarantees.*\/mambots\//i
describe SS_PHISH_CUR_G1039_08051624 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1039_08051624 0.001

# Email.Phishing.Cur.Gen1040.Sanesecurity.08051900
rawbody  SS_PHISH_CUR_G1040_08051900 /in-addr\.btopenworld\.com\/.*your Secure Message Center/i
describe SS_PHISH_CUR_G1040_08051900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1040_08051900 0.001

# Email.Phishing.Cur.Gen1041.Sanesecurity.08051901
rawbody  SS_PHISH_CUR_G1041_08051901 /From: "eBay\.com\.au"<customer\@eBay\.com\.au>/i
describe SS_PHISH_CUR_G1041_08051901 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1041_08051901 0.001

# Email.Phishing.Cur.Gen1042.Sanesecurity.08051902
rawbody  SS_PHISH_CUR_G1042_08051902 /<META HTTP-EQUIV="Content-Type" CONTENT="text\/html\;charset=windows-1251">.*You have 1 new Security Message Alert!/i
describe SS_PHISH_CUR_G1042_08051902 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1042_08051902 0.001

# Email.Phishing.Cur.Gen1043.Sanesecurity.08052000
rawbody  SS_PHISH_CUR_G1043_08052000 /From: "EPPICard"<support\@eppicard\.com>/i
describe SS_PHISH_CUR_G1043_08052000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1043_08052000 0.001

# Email.Phishing.Cur.Gen1044.Sanesecurity.08052001
rawbody  SS_PHISH_CUR_G1044_08052001 /From: ".{0,50}"<.*may be due to changes in your IP address or location/i
describe SS_PHISH_CUR_G1044_08052001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1044_08052001 0.001

# Email.Phishing.Cur.Gen1045.Sanesecurity.08052100
rawbody  SS_PHISH_CUR_G1045_08052100 /From: ".{0,50}"<.*submit the tax refund request and allow/i
describe SS_PHISH_CUR_G1045_08052100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1045_08052100 0.001

# Email.Phishing.Cur.Gen1046.Sanesecurity.08052101
rawbody  SS_PHISH_CUR_G1046_08052101 /From: ".{0,50}"<.*to your account - Just for your time!/i
describe SS_PHISH_CUR_G1046_08052101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1046_08052101 0.001

# Email.Phishing.Cur.Gen1047.Sanesecurity.08052102
rawbody  SS_PHISH_CUR_G1047_08052102 /From: ".{0,50}"<.*confirm or update your account information/i
describe SS_PHISH_CUR_G1047_08052102 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1047_08052102 0.001

# Email.Phishing.Cur.Gen1048.Sanesecurity.08052103
rawbody  SS_PHISH_CUR_G1048_08052103 /From: EPPICard</i
describe SS_PHISH_CUR_G1048_08052103 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1048_08052103 0.001

# Email.Phishing.Cur.Gen1049.Sanesecurity.08052104
rawbody  SS_PHISH_CUR_G1049_08052104 /From: ".{0,50}"<.*Log In into your account to resolve the problem/i
describe SS_PHISH_CUR_G1049_08052104 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1049_08052104 0.001

# Email.Phishing.Cur.Gen1050.Sanesecurity.08052105
rawbody  SS_PHISH_CUR_G1050_08052105 /From: ".{0,50}"<.*your online profile has been deactivated due to inactivity/i
describe SS_PHISH_CUR_G1050_08052105 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1050_08052105 0.001

# Email.Phishing.Cur.Gen1051.Sanesecurity.08052106
rawbody  SS_PHISH_CUR_G1051_08052106 /From: ".{0,50}"<.*Log In into your account and Update to resolve the problem/i
describe SS_PHISH_CUR_G1051_08052106 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1051_08052106 0.001

# Email.Phishing.Cur.Gen1052.Sanesecurity.08052107
rawbody  SS_PHISH_CUR_G1052_08052107 /\/\.www\.bankofamerica\.com/i
describe SS_PHISH_CUR_G1052_08052107 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1052_08052107 0.001

# Email.Phishing.Cur.Gen1053.Sanesecurity.08052108
rawbody  SS_PHISH_CUR_G1053_08052108 /\/\.www\.poste\.it\//i
describe SS_PHISH_CUR_G1053_08052108 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1053_08052108 0.001

# Email.Phishing.Cur.Gen1054.Sanesecurity.08052109
rawbody  SS_PHISH_CUR_G1054_08052109 /From: ".{0,50}"<.*that all our members need to update their account within/i
describe SS_PHISH_CUR_G1054_08052109 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1054_08052109 0.001

# Email.Phishing.Cur.Gen1055.Sanesecurity.08052200
rawbody  SS_PHISH_CUR_G1055_08052200 /\.res\.rr\.com\/www\.eppicard\.com\//i
describe SS_PHISH_CUR_G1055_08052200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1055_08052200 0.001

# Email.Phishing.Cur.Gen1056.Sanesecurity.08052201
rawbody  SS_PHISH_CUR_G1056_08052201 /<HTML><HEAD><TITLE>Dear value customer<\/TITLE>/i
describe SS_PHISH_CUR_G1056_08052201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1056_08052201 0.001

# Email.Phishing.Cur.Gen1057.Sanesecurity.08052202
rawbody  SS_PHISH_CUR_G1057_08052202 /\/http\/www\.citibank\.com\//i
describe SS_PHISH_CUR_G1057_08052202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1057_08052202 0.001

# Email.Phishing.Cur.Gen1058.Sanesecurity.08052203
rawbody  SS_PHISH_CUR_G1058_08052203 /Dear Valued Citi Bank Customer,.*was affected by this Update\. In order to ensure your account \(s\) held/i
describe SS_PHISH_CUR_G1058_08052203 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1058_08052203 0.001

# Email.Phishing.Cur.Gen1059.Sanesecurity.08052204
rawbody  SS_PHISH_CUR_G1059_08052204 /\.sbcglobal\.net\/" target="_blank">https:\/\/www\.eppicard\.com\//i
describe SS_PHISH_CUR_G1059_08052204 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1059_08052204 0.001

# Email.Phishing.Cur.Gen1060.Sanesecurity.08052205
rawbody  SS_PHISH_CUR_G1060_08052205 /From: "EPPICard Online"</i
describe SS_PHISH_CUR_G1060_08052205 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1060_08052205 0.001

# Email.Phishing.Cur.Gen1061.Sanesecurity.08052206
rawbody  SS_PHISH_CUR_G1061_08052206 /<title>New Page 1<\/title>.*have been accessed by an unauthorised third party/i
describe SS_PHISH_CUR_G1061_08052206 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1061_08052206 0.001

# Email.Phishing.Cur.Gen1062.Sanesecurity.08052300
rawbody  SS_PHISH_CUR_G1062_08052300 /\/http\/www\.wachovia\.com\//i
describe SS_PHISH_CUR_G1062_08052300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1062_08052300 0.001

# Email.Phishing.Cur.Gen1063.Sanesecurity.08052301
rawbody  SS_PHISH_CUR_G1063_08052301 /From: "service\@visa\.com"<service\@visa\.com>/i
describe SS_PHISH_CUR_G1063_08052301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1063_08052301 0.001

# Email.Phishing.Cur.Gen1064.Sanesecurity.08052302
rawbody  SS_PHISH_CUR_G1064_08052302 /From: ".{0,50}"<.*recently introduced additional security measures/i
describe SS_PHISH_CUR_G1064_08052302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1064_08052302 0.001

# Email.Phishing.Cur.Gen1065.Sanesecurity.08052303
rawbody  SS_PHISH_CUR_G1065_08052303 /\.comcast\.net\/www\.eppicard\.com\//i
describe SS_PHISH_CUR_G1065_08052303 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1065_08052303 0.001

# Email.Phishing.Cur.Gen1066.Sanesecurity.08052304
rawbody  SS_PHISH_CUR_G1066_08052304 /From: "EPPICard"<EPPICard\@EPPICard\.com>/i
describe SS_PHISH_CUR_G1066_08052304 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1066_08052304 0.001

# Email.Phishing.Cur.Gen1067.Sanesecurity.08052305
rawbody  SS_PHISH_CUR_G1067_08052305 /From: ".{0,50}"<.*recently have determined that different computers have logged/i
describe SS_PHISH_CUR_G1067_08052305 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1067_08052305 0.001

# Email.Phishing.Cur.Gen1068.Sanesecurity.08052306
rawbody  SS_PHISH_CUR_G1068_08052306 /From: "EPPIcard"<customecare\@eppicard\.com>/i
describe SS_PHISH_CUR_G1068_08052306 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1068_08052306 0.001

# Email.Phishing.Cur.Gen1069.Sanesecurity.08052307
rawbody  SS_PHISH_CUR_G1069_08052307 /From: ".{0,50}"<.*account has expired/i
describe SS_PHISH_CUR_G1069_08052307 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1069_08052307 0.001

# Email.Phishing.Cur.Gen1070.Sanesecurity.08052308
rawbody  SS_PHISH_CUR_G1070_08052308 /:8011\/www\.eppi\.com\//i
describe SS_PHISH_CUR_G1070_08052308 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1070_08052308 0.001

# Email.Phishing.Cur.Gen1071.Sanesecurity.08052700
rawbody  SS_PHISH_CUR_G1071_08052700 /From: "EPPIcard Security"</i
describe SS_PHISH_CUR_G1071_08052700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1071_08052700 0.001

# Email.Phishing.Cur.Gen1072.Sanesecurity.08052701
rawbody  SS_PHISH_CUR_G1072_08052701 /\.imageshack\.us\/.*www\.eppicard\.com/i
describe SS_PHISH_CUR_G1072_08052701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1072_08052701 0.001

# Email.Phishing.Cur.Gen1073.Sanesecurity.08052702
rawbody  SS_PHISH_CUR_G1073_08052702 /From: "EPPICard"<online\@eppicard\.com>/i
describe SS_PHISH_CUR_G1073_08052702 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1073_08052702 0.001

# Email.Phishing.Cur.Gen1074.Sanesecurity.08052703
rawbody  SS_PHISH_CUR_G1074_08052703 /http:\/\/ww(0|1|2|3|4|5|6|7|8|9)\.hsbc\.com\./i
describe SS_PHISH_CUR_G1074_08052703 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1074_08052703 0.001

# Email.Phishing.Cur.Gen1075.Sanesecurity.08052800
rawbody  SS_PHISH_CUR_G1075_08052800 /From: "Barclays Bank PLC"<accounts\@email-barclays\.co\.uk>/i
describe SS_PHISH_CUR_G1075_08052800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1075_08052800 0.001

# Email.Phishing.Cur.Gen1076.Sanesecurity.08052801
rawbody  SS_PHISH_CUR_G1076_08052801 /From: ".{0,50}"<.*is carrying out a scheduled software upgrade to improve the quality of services for the bank's customers/i
describe SS_PHISH_CUR_G1076_08052801 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1076_08052801 0.001

# Email.Phishing.Cur.Gen1077.Sanesecurity.08052802
rawbody  SS_PHISH_CUR_G1077_08052802 /static\.qwest\.net\/ibank\.barclays\.co\.uk\//i
describe SS_PHISH_CUR_G1077_08052802 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1077_08052802 0.001

# Email.Phishing.Cur.Gen1078.Sanesecurity.08052803
rawbody  SS_PHISH_CUR_G1078_08052803 /From: "Royal Bank of Scotland"<business\.customer\@rbs\.co\.uk>/i
describe SS_PHISH_CUR_G1078_08052803 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1078_08052803 0.001

# Email.Phishing.Cur.Gen1079.Sanesecurity.08052804
rawbody  SS_PHISH_CUR_G1079_08052804 /From: ".{0,50}"<.*<B>You have 1 new security message<\/B>/i
describe SS_PHISH_CUR_G1079_08052804 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1079_08052804 0.001

# Email.Phishing.Cur.Gen1080.Sanesecurity.08052805
rawbody  SS_PHISH_CUR_G1080_08052805 /From: "PayPal Corp\."<service\@paypaI\.com>/i
describe SS_PHISH_CUR_G1080_08052805 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1080_08052805 0.001

# Email.Phishing.Cur.Gen1081.Sanesecurity.08052806
rawbody  SS_PHISH_CUR_G1081_08052806 /From: ".{0,50}"<.*Your eBay Account is currently locked!/i
describe SS_PHISH_CUR_G1081_08052806 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1081_08052806 0.001

# Email.Phishing.Cur.Gen1082.Sanesecurity.08052807
rawbody  SS_PHISH_CUR_G1082_08052807 /From: "PayPal"<accounts\@paypal\.com>/i
describe SS_PHISH_CUR_G1082_08052807 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1082_08052807 0.001

# Email.Phishing.Cur.Gen1083.Sanesecurity.08052808
rawbody  SS_PHISH_CUR_G1083_08052808 /http:\/\/personal.{0,2}\.hsbc\.com\./i
describe SS_PHISH_CUR_G1083_08052808 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1083_08052808 0.001

# Email.Phishing.Cur.Gen1084.Sanesecurity.08052809
rawbody  SS_PHISH_CUR_G1084_08052809 /http:\/\/commercial\.wachovia\.online\.financial\.business\.cmserver\./i
describe SS_PHISH_CUR_G1084_08052809 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1084_08052809 0.001

# Email.Phishing.Cur.Gen1085.Sanesecurity.08053000
rawbody  SS_PHISH_CUR_G1085_08053000 /http:\/\/ww.{0,2}\.halifax-login\.uk\./i
describe SS_PHISH_CUR_G1085_08053000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1085_08053000 0.001

# Email.Phishing.Cur.Gen1086.Sanesecurity.08053001
rawbody  SS_PHISH_CUR_G1086_08053001 /0\/www\.eppicard\.com\//i
describe SS_PHISH_CUR_G1086_08053001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1086_08053001 0.001

# Email.Phishing.Cur.Gen1087.Sanesecurity.08053002
rawbody  SS_PHISH_CUR_G1087_08053002 /1\/www\.eppicard\.com\//i
describe SS_PHISH_CUR_G1087_08053002 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1087_08053002 0.001

# Email.Phishing.Cur.Gen1088.Sanesecurity.08053003
rawbody  SS_PHISH_CUR_G1088_08053003 /2\/www\.eppicard\.com\//i
describe SS_PHISH_CUR_G1088_08053003 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1088_08053003 0.001

# Email.Phishing.Cur.Gen1089.Sanesecurity.08053004
rawbody  SS_PHISH_CUR_G1089_08053004 /3\/www\.eppicard\.com\//i
describe SS_PHISH_CUR_G1089_08053004 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1089_08053004 0.001

# Email.Phishing.Cur.Gen1090.Sanesecurity.08053005
rawbody  SS_PHISH_CUR_G1090_08053005 /4\/www\.eppicard\.com\//i
describe SS_PHISH_CUR_G1090_08053005 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1090_08053005 0.001

# Email.Phishing.Cur.Gen1091.Sanesecurity.08053006
rawbody  SS_PHISH_CUR_G1091_08053006 /5\/www\.eppicard\.com\//i
describe SS_PHISH_CUR_G1091_08053006 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1091_08053006 0.001

# Email.Phishing.Cur.Gen1092.Sanesecurity.08053007
rawbody  SS_PHISH_CUR_G1092_08053007 /6\/www\.eppicard\.com\//i
describe SS_PHISH_CUR_G1092_08053007 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1092_08053007 0.001

# Email.Phishing.Cur.Gen1093.Sanesecurity.08053008
rawbody  SS_PHISH_CUR_G1093_08053008 /7\/www\.eppicard\.com\//i
describe SS_PHISH_CUR_G1093_08053008 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1093_08053008 0.001

# Email.Phishing.Cur.Gen1094.Sanesecurity.08053009
rawbody  SS_PHISH_CUR_G1094_08053009 /8\/www\.eppicard\.com\//i
describe SS_PHISH_CUR_G1094_08053009 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1094_08053009 0.001

# Email.Phishing.Cur.Gen1095.Sanesecurity.08053010
rawbody  SS_PHISH_CUR_G1095_08053010 /9\/www\.eppicard\.com\//i
describe SS_PHISH_CUR_G1095_08053010 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1095_08053010 0.001

# Email.Phishing.Cur.Gen1096.Sanesecurity.08053011
rawbody  SS_PHISH_CUR_G1096_08053011 /\/pagead\/iclk\?sa=l.*EPPICard/i
describe SS_PHISH_CUR_G1096_08053011 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1096_08053011 0.001

# Email.Phishing.Cur.Gen1097.Sanesecurity.08060200
rawbody  SS_PHISH_CUR_G1097_08060200 /http:\/\/www(0|1|2|3|4|5|6|7|8|9)\.hsbc\.com\./i
describe SS_PHISH_CUR_G1097_08060200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1097_08060200 0.001

# Email.Phishing.Cur.Gen1098.Sanesecurity.08060201
rawbody  SS_PHISH_CUR_G1098_08060201 /From: "EPPICard Bank"<bankingservice\@eppicard\.com>/i
describe SS_PHISH_CUR_G1098_08060201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1098_08060201 0.001

# Email.Phishing.Cur.Gen1099.Sanesecurity.08060202
rawbody  SS_PHISH_CUR_G1099_08060202 /http:\/\/www(0|1|2|3|4|5|6|7|8|9)\.abbeybusiness\./i
describe SS_PHISH_CUR_G1099_08060202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1099_08060202 0.001

# Email.Phishing.Cur.Gen1100.Sanesecurity.08060203
rawbody  SS_PHISH_CUR_G1100_08060203 /http:\/\/membres\.lycos\.fr\/.{0,50}\/paypal\.fr\//i
describe SS_PHISH_CUR_G1100_08060203 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1100_08060203 0.001

# Email.Phishing.Cur.Gen1101.Sanesecurity.08060300
rawbody  SS_PHISH_CUR_G1101_08060300 /\/\.access\.php" target="_blank">https:\/\/www\.eppicard\.com\//i
describe SS_PHISH_CUR_G1101_08060300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1101_08060300 0.001

# Email.Phishing.Cur.Gen1102.Sanesecurity.08060301
rawbody  SS_PHISH_CUR_G1102_08060301 /From: "aw-confirm\@eBay\.co\.uk"<aw-confirm\@eBay\.co\.uk>/i
describe SS_PHISH_CUR_G1102_08060301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1102_08060301 0.001

# Email.Phishing.Cur.Gen1103.Sanesecurity.08060302
rawbody  SS_PHISH_CUR_G1103_08060302 /\/letter\.jpg" alt="EPPICard Customer" \/><\/a>/i
describe SS_PHISH_CUR_G1103_08060302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1103_08060302 0.001

# Email.Phishing.Cur.Gen1104.Sanesecurity.08060303
rawbody  SS_PHISH_CUR_G1104_08060303 /http:\/\/ww.{1}\.halifax-login\.co\.uk\./i
describe SS_PHISH_CUR_G1104_08060303 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1104_08060303 0.001

# Email.Phishing.Cur.Gen1105.Sanesecurity.08060304
rawbody  SS_PHISH_CUR_G1105_08060304 /We are unable to verify your Account Ownership on our Database.*\.club\.fr\/\/.*type="Submit" class="btn1"\/><\/a>/i
describe SS_PHISH_CUR_G1105_08060304 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1105_08060304 0.001

# Email.Phishing.Cur.Gen1106.Sanesecurity.08060400
rawbody  SS_PHISH_CUR_G1106_08060400 /From: ".{0,50}"<.*Your Online PayPal Password was blocked on/i
describe SS_PHISH_CUR_G1106_08060400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1106_08060400 0.001

# Email.Phishing.Cur.Gen1107.Sanesecurity.08060500
rawbody  SS_PHISH_CUR_G1107_08060500 /From: ".{0,50}"<.*Debit Card Expiration Approaching!/i
describe SS_PHISH_CUR_G1107_08060500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1107_08060500 0.001

# Email.Phishing.Cur.Gen1108.Sanesecurity.08060501
rawbody  SS_PHISH_CUR_G1108_08060501 /From: ".{0,50}"<.*Your Account Access Has Been Limited/i
describe SS_PHISH_CUR_G1108_08060501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1108_08060501 0.001

# Email.Phishing.Cur.Gen1109.Sanesecurity.08060502
rawbody  SS_PHISH_CUR_G1109_08060502 /From: ".{0,50}"<.*Your debit card has been deactivated/i
describe SS_PHISH_CUR_G1109_08060502 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1109_08060502 0.001

# Email.Phishing.Cur.Gen1110.Sanesecurity.08060503
rawbody  SS_PHISH_CUR_G1110_08060503 /From: ".{0,50}"<.*you can see your message\(s\) at any time by visiting/i
describe SS_PHISH_CUR_G1110_08060503 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1110_08060503 0.001

# Email.Phishing.Cur.Gen1111.Sanesecurity.08060504
rawbody  SS_PHISH_CUR_G1111_08060504 /http:\/\/www\.nwolb\.platinumnumber\.com\/index\.aspx/i
describe SS_PHISH_CUR_G1111_08060504 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1111_08060504 0.001

# Email.Phishing.Cur.Gen1112.Sanesecurity.08060505
rawbody  SS_PHISH_CUR_G1112_08060505 /http:\/\/www\.nwolb\.tpppipe\.com\/index\.aspx\?/i
describe SS_PHISH_CUR_G1112_08060505 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1112_08060505 0.001

# Email.Phishing.Cur.Gen1113.Sanesecurity.08060506
rawbody  SS_PHISH_CUR_G1113_08060506 /\?validate\.account\/op\.validate\/code\.c16561ce\/ref\.rem\/EMAIL\/validation\.c16561ce\/subref\.r001\/WT\.mc_id=r001_20071228/i
describe SS_PHISH_CUR_G1113_08060506 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1113_08060506 0.001

# Email.Phishing.Cur.Gen1113.Sanesecurity.08060606
rawbody  SS_PHISH_CUR_G1113_08060606 /http:\/\/www\.newegg\.com\.id/i
describe SS_PHISH_CUR_G1113_08060606 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1113_08060606 0.001

# Email.Phishing.Cur.Gen1114.Sanesecurity.08060607
rawbody  SS_PHISH_CUR_G1114_08060607 /recently have discovered that multiple computers have attempted to log/i
describe SS_PHISH_CUR_G1114_08060607 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1114_08060607 0.001

# Email.Phishing.Cur.Gen1115.Sanesecurity.08060608
rawbody  SS_PHISH_CUR_G1115_08060608 /From: "security\@eppicard\.com"<security\@eppicard\.com>/i
describe SS_PHISH_CUR_G1115_08060608 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1115_08060608 0.001

# Email.Phishing.Cur.Gen1116.Sanesecurity.08061000
rawbody  SS_PHISH_CUR_G1116_08061000 /src="http:\/\/tbn0\.google\.com\/images\?q=tbn.*continually strive to offer you not only the convenience of banking online/i
describe SS_PHISH_CUR_G1116_08061000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1116_08061000 0.001

# Email.Phishing.Cur.Gen1117.Sanesecurity.08061001
rawbody  SS_PHISH_CUR_G1117_08061001 /From: "no-reply\@eppicard\.com"<no-reply\@eppicard\.com>/i
describe SS_PHISH_CUR_G1117_08061001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1117_08061001 0.001

# Email.Phishing.Cur.Gen1118.Sanesecurity.08061002
rawbody  SS_PHISH_CUR_G1118_08061002 /From: ".{0,50}"<.*implemented a new security system designed to protect your account/i
describe SS_PHISH_CUR_G1118_08061002 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1118_08061002 0.001

# Email.Phishing.Cur.Gen1119.Sanesecurity.08061003
rawbody  SS_PHISH_CUR_G1119_08061003 /\/\.ws\/ISAPI\/SignIn/i
describe SS_PHISH_CUR_G1119_08061003 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1119_08061003 0.001

# Email.Phishing.Cur.Gen1120.Sanesecurity.08061004
rawbody  SS_PHISH_CUR_G1120_08061004 /http:\/\/onlineaccounts.{1}\.abbeynational\.uk\./i
describe SS_PHISH_CUR_G1120_08061004 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1120_08061004 0.001

# Email.Phishing.Cur.Gen1121.Sanesecurity.08061005
rawbody  SS_PHISH_CUR_G1121_08061005 /\/\.www\.ebay\.it\/index\./i
describe SS_PHISH_CUR_G1121_08061005 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1121_08061005 0.001

# Email.Phishing.Cur.Gen1122.Sanesecurity.08061100
rawbody  SS_PHISH_CUR_G1122_08061100 /From: "Bank Of America Alert"<online\.banking\@alert\.bankofamerica\.com>/i
describe SS_PHISH_CUR_G1122_08061100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1122_08061100 0.001

# Email.Phishing.Cur.Gen1123.Sanesecurity.08061101
rawbody  SS_PHISH_CUR_G1123_08061101 /From: ".{0,50}"<.*your account has been suspended/i
describe SS_PHISH_CUR_G1123_08061101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1123_08061101 0.001

# Email.Phishing.Cur.Gen1124.Sanesecurity.08061102
rawbody  SS_PHISH_CUR_G1124_08061102 /http:\/\/onlinetreasurymanager\.suntrust\.ibswebsuntrust\.cmserver\./i
describe SS_PHISH_CUR_G1124_08061102 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1124_08061102 0.001

# Email.Phishing.Cur.Gen1125.Sanesecurity.08062000
rawbody  SS_PHISH_CUR_G1125_08062000 /http:\/\/connect\.colonialbank\.webbiz\.securitychallenge\./i
describe SS_PHISH_CUR_G1125_08062000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1125_08062000 0.001

# Email.Phishing.Cur.Gen1126.Sanesecurity.08062001
rawbody  SS_PHISH_CUR_G1126_08062001 /From: ".{0,50}"<.*unlock your online account, you must complete an online update/i
describe SS_PHISH_CUR_G1126_08062001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1126_08062001 0.001

# Email.Phishing.Cur.Gen1127.Sanesecurity.08062300
rawbody  SS_PHISH_CUR_G1127_08062300 /bethere\.co\.uk\/secure\.ssl\/halifax-online\.co\.uk\//i
describe SS_PHISH_CUR_G1127_08062300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1127_08062300 0.001

# Email.Phishing.Cur.Gen1128.Sanesecurity.08062301
rawbody  SS_PHISH_CUR_G1128_08062301 /From: "Halifax"<notice\.alert\@halifax-online\.co\.uk>/i
describe SS_PHISH_CUR_G1128_08062301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1128_08062301 0.001

# Email.Phishing.Cur.Gen1129.Sanesecurity.08062302
rawbody  SS_PHISH_CUR_G1129_08062302 /From: ".{0,50}"<.*We're making some changes that will make it even easier to make/i
describe SS_PHISH_CUR_G1129_08062302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1129_08062302 0.001

# Email.Phishing.Cur.Gen1130.Sanesecurity.08062303
rawbody  SS_PHISH_CUR_G1130_08062303 /From: "RBC Royal Bank"<aw-confirm\@royalbank\.com>/i
describe SS_PHISH_CUR_G1130_08062303 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1130_08062303 0.001

# Email.Phishing.Cur.Gen1131.Sanesecurity.08062304
rawbody  SS_PHISH_CUR_G1131_08062304 /From: ".{0,50}"<.*notre tout nouveau programme/i
describe SS_PHISH_CUR_G1131_08062304 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1131_08062304 0.001

# Email.Phishing.Cur.Gen1132.Sanesecurity.08062305
rawbody  SS_PHISH_CUR_G1132_08062305 /From: ".{0,50}"<.*You may no longer be able to use your debit card/i
describe SS_PHISH_CUR_G1132_08062305 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1132_08062305 0.001

# Email.Phishing.Cur.Gen1133.Sanesecurity.08062306
rawbody  SS_PHISH_CUR_G1133_08062306 /Online Banking - Security Measures !.*\.imageshack\.us\//i
describe SS_PHISH_CUR_G1133_08062306 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1133_08062306 0.001

# Email.Phishing.Cur.Gen1134.Sanesecurity.08062307
rawbody  SS_PHISH_CUR_G1134_08062307 /From: ".{0,50}"<.*randomly review accounts\. This is to enable us activate new security/i
describe SS_PHISH_CUR_G1134_08062307 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1134_08062307 0.001

# Email.Phishing.Cur.Gen1135.Sanesecurity.08062308
rawbody  SS_PHISH_CUR_G1135_08062308 /From: ".{0,50}"<.*internet banking account safe and secure/i
describe SS_PHISH_CUR_G1135_08062308 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1135_08062308 0.001

# Email.Phishing.Cur.Gen1136.Sanesecurity.08062309
rawbody  SS_PHISH_CUR_G1136_08062309 /From: ".{0,50}"<.*reactivate your online banking/i
describe SS_PHISH_CUR_G1136_08062309 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1136_08062309 0.001

# Email.Phishing.Cur.Gen1137.Sanesecurity.08062310
rawbody  SS_PHISH_CUR_G1137_08062310 /<title>New Page 1<\/title>.*We implore you to reactivate your profile/i
describe SS_PHISH_CUR_G1137_08062310 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1137_08062310 0.001

# Email.Phishing.Cur.Gen1138.Sanesecurity.08062311
rawbody  SS_PHISH_CUR_G1138_08062311 /From: ".{0,50}"<.*Do not share your password with other users/i
describe SS_PHISH_CUR_G1138_08062311 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1138_08062311 0.001

# Email.Phishing.Cur.Gen1139.Sanesecurity.08062312
rawbody  SS_PHISH_CUR_G1139_08062312 /From: Royal Bank of Scotland<.*You have 1 New Secure Message in your Royal Bank of Scotland online INBOX/i
describe SS_PHISH_CUR_G1139_08062312 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1139_08062312 0.001

# Email.Phishing.Cur.Gen1140.Sanesecurity.08062500
rawbody  SS_PHISH_CUR_G1140_08062500 /From: "PayPaI"<accts\@paypaI\.com>/i
describe SS_PHISH_CUR_G1140_08062500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1140_08062500 0.001

# Email.Phishing.Cur.Gen1141.Sanesecurity.08062501
rawbody  SS_PHISH_CUR_G1141_08062501 /:8011\/web\.da-us\.citibank\.com\//i
describe SS_PHISH_CUR_G1141_08062501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1141_08062501 0.001

# Email.Phishing.Cur.Gen1142.Sanesecurity.08063000
rawbody  SS_PHISH_CUR_G1142_08063000 /From: ".{0,50}"<.*visit the Message Center section in order to read the message/i
describe SS_PHISH_CUR_G1142_08063000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1142_08063000 0.001

# Email.Phishing.Cur.Gen1143.Sanesecurity.08063001
rawbody  SS_PHISH_CUR_G1143_08063001 /From: "Bank of America"<service\@bankofamerica\.com>/i
describe SS_PHISH_CUR_G1143_08063001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1143_08063001 0.001

# Email.Phishing.Cur.Gen1144.Sanesecurity.08063002
rawbody  SS_PHISH_CUR_G1144_08063002 /From: ".{0,50}"<.*We have reasons to believe that your account/i
describe SS_PHISH_CUR_G1144_08063002 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1144_08063002 0.001

# Email.Phishing.Cur.Gen1145.Sanesecurity.08063003
rawbody  SS_PHISH_CUR_G1145_08063003 /From: "Mazuma Credit Union"<info\@mazuma\.org>/i
describe SS_PHISH_CUR_G1145_08063003 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1145_08063003 0.001

# Email.Phishing.Cur.Gen1146.Sanesecurity.08063004
rawbody  SS_PHISH_CUR_G1146_08063004 /\.bethere\.co\.uk\/secure\.ssl\/halifax-online/i
describe SS_PHISH_CUR_G1146_08063004 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1146_08063004 0.001

# Email.Phishing.Cur.Gen1147.Sanesecurity.08063005
rawbody  SS_PHISH_CUR_G1147_08063005 /You have 1 new Alert.*Resolution Center:<\/b> Your account is limited!.*redir\.html/i
describe SS_PHISH_CUR_G1147_08063005 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1147_08063005 0.001

# Email.Phishing.Cur.Gen1148.Sanesecurity.08063006
rawbody  SS_PHISH_CUR_G1148_08063006 /http:\/\/top\.capitalonebank\.compub\.login\.htmlbank/i
describe SS_PHISH_CUR_G1148_08063006 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1148_08063006 0.001

# Email.Phishing.Cur.Gen1149.Sanesecurity.08070200
rawbody  SS_PHISH_CUR_G1149_08070200 /From: "EPPICard" <EppUpdates\@EPPICard\.com\]>/i
describe SS_PHISH_CUR_G1149_08070200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1149_08070200 0.001

# Email.Phishing.Cur.Gen1150.Sanesecurity.08070201
rawbody  SS_PHISH_CUR_G1150_08070201 /From: "Natwest Online Banking"<accountsdep\@nwolb\.com>/i
describe SS_PHISH_CUR_G1150_08070201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1150_08070201 0.001

# Email.Phishing.Cur.Gen1151.Sanesecurity.08070300
rawbody  SS_PHISH_CUR_G1151_08070300 /\.eppicard\.com-IDs-onlineServ-SSL-LOGIN-secure-ID-user\./i
describe SS_PHISH_CUR_G1151_08070300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1151_08070300 0.001

# Email.Phishing.Cur.Gen1152.Sanesecurity.08070301
rawbody  SS_PHISH_CUR_G1152_08070301 /From: "verify\@halifax\.co\.uk"<verify\@halifax\.co\.uk>/i
describe SS_PHISH_CUR_G1152_08070301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1152_08070301 0.001

# Email.Phishing.Cur.Gen1153.Sanesecurity.08070302
rawbody  SS_PHISH_CUR_G1153_08070302 /http:\/\/towernet.{0,2}\.capitalonebank\.com\./i
describe SS_PHISH_CUR_G1153_08070302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1153_08070302 0.001

# Email.Phishing.Cur.Gen1153.Sanesecurity.08070600
rawbody  SS_PHISH_CUR_G1153_08070600 /http:\/\/hiring\.monster\.com\./i
describe SS_PHISH_CUR_G1153_08070600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1153_08070600 0.001

# Email.Phishing.Cur.Gen1154.Sanesecurity.08070700
rawbody  SS_PHISH_CUR_G1154_08070700 /From: "Alliance-Leicester Commercial Bank"<Commercial\.News\@mybusinessbank\.co\.uk>/i
describe SS_PHISH_CUR_G1154_08070700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1154_08070700 0.001

# Email.Phishing.Cur.Gen1155.Sanesecurity.08070701
rawbody  SS_PHISH_CUR_G1155_08070701 /From: ".{0,50}"<.*We have updated the Internet Banking Terms and Conditions/i
describe SS_PHISH_CUR_G1155_08070701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1155_08070701 0.001

# Email.Phishing.Cur.Gen1156.Sanesecurity.08070702
rawbody  SS_PHISH_CUR_G1156_08070702 /X-PHP-Script:.*You have 1 new ALERT/i
describe SS_PHISH_CUR_G1156_08070702 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1156_08070702 0.001

# Email.Phishing.Cur.Gen1157.Sanesecurity.08070703
rawbody  SS_PHISH_CUR_G1157_08070703 /X-PHP-Script:.*To continue to use our online services you must update the security of your/i
describe SS_PHISH_CUR_G1157_08070703 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1157_08070703 0.001

# Email.Phishing.Cur.Gen1158.Sanesecurity.08070704
rawbody  SS_PHISH_CUR_G1158_08070704 /X-PHP-Script:.*ically and randomly review accounts\. <br>This is to enable us activate/i
describe SS_PHISH_CUR_G1158_08070704 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1158_08070704 0.001

# Email.Phishing.Cur.Gen1159.Sanesecurity.08070705
rawbody  SS_PHISH_CUR_G1159_08070705 /X-PHP-Script:.*Due to Various Invalid Attempt to logi/i
describe SS_PHISH_CUR_G1159_08070705 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1159_08070705 0.001

# Email.Phishing.Cur.Gen1160.Sanesecurity.08070706
rawbody  SS_PHISH_CUR_G1160_08070706 /X-PHP-Script:.*Visa International Service Association and/i
describe SS_PHISH_CUR_G1160_08070706 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1160_08070706 0.001

# Email.Phishing.Cur.Gen1161.Sanesecurity.08070707
rawbody  SS_PHISH_CUR_G1161_08070707 /X-PHP-Script:.*Evening Phone, If you did not make this request to change your Account User Profile/i
describe SS_PHISH_CUR_G1161_08070707 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1161_08070707 0.001

# Email.Phishing.Cur.Gen1162.Sanesecurity.08070708
rawbody  SS_PHISH_CUR_G1162_08070708 /X-PHP-Script:.*These measures include technical and procedural steps to protect your/i
describe SS_PHISH_CUR_G1162_08070708 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1162_08070708 0.001

# Email.Phishing.Cur.Gen1163.Sanesecurity.08070709
rawbody  SS_PHISH_CUR_G1163_08070709 /http:\/\/tbn0\.google\.com\/images\?q.*it's customers, is hereby anouncing it's Monthly account/i
describe SS_PHISH_CUR_G1163_08070709 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1163_08070709 0.001

# Email.Phishing.Cur.Gen1164.Sanesecurity.08070710
rawbody  SS_PHISH_CUR_G1164_08070710 /X-PHP-Script:.*security so, for your protection we are proactively notifying you of this activity/i
describe SS_PHISH_CUR_G1164_08070710 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1164_08070710 0.001

# Email.Phishing.Cur.Gen1165.Sanesecurity.08070711
rawbody  SS_PHISH_CUR_G1165_08070711 /X-PHP-Script:.*As our new updated security We will never contact you via email or the internet to request sensitive account details and<br>staff will never have a need to/i
describe SS_PHISH_CUR_G1165_08070711 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1165_08070711 0.001

# Email.Phishing.Cur.Gen1166.Sanesecurity.08070712
rawbody  SS_PHISH_CUR_G1166_08070712 /X-PHP-Script:.*Access to your account online has been restricted due to the more than the allowed login attempt made from another ip other than your own/i
describe SS_PHISH_CUR_G1166_08070712 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1166_08070712 0.001

# Email.Phishing.Cur.Gen1167.Sanesecurity.08071000
rawbody  SS_PHISH_CUR_G1167_08071000 /http:\/\/www\.ybonline\.co\.uk\./i
describe SS_PHISH_CUR_G1167_08071000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1167_08071000 0.001

# Email.Phishing.Cur.Gen1168.Sanesecurity.08071700
rawbody  SS_PHISH_CUR_G1168_08071700 /From: "Poste Italiane"</i
describe SS_PHISH_CUR_G1168_08071700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1168_08071700 0.001

# Email.Phishing.Cur.Gen1169.Sanesecurity.08071800
rawbody  SS_PHISH_CUR_G1169_08071800 /Subject:.{0,100}\%CURRENTDATE.*, 0x, 0x/i
describe SS_PHISH_CUR_G1169_08071800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1169_08071800 0.001

# Email.Phishing.Cur.Gen1170.Sanesecurity.08071801
rawbody  SS_PHISH_CUR_G1170_08071801 /Subject:.{0,100}\%MID.*, 0x, 0x/i
describe SS_PHISH_CUR_G1170_08071801 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1170_08071801 0.001

# Email.Phishing.Cur.Gen1171.Sanesecurity.08072100
rawbody  SS_PHISH_CUR_G1171_08072100 /From: "Royal Bank of Scotland"<rbs\.update\@rbs\.co\.uk>/i
describe SS_PHISH_CUR_G1171_08072100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1171_08072100 0.001

# Email.Phishing.Cur.Gen1172.Sanesecurity.08072101
rawbody  SS_PHISH_CUR_G1172_08072101 /From: ".{0,50}"<.*Due to the high number of fraud attempts and phishing scams/i
describe SS_PHISH_CUR_G1172_08072101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1172_08072101 0.001

# Email.Phishing.Cur.Gen1173.Sanesecurity.08072200
rawbody  SS_PHISH_CUR_G1173_08072200 /\.tdbanknorth\.com\./i
describe SS_PHISH_CUR_G1173_08072200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1173_08072200 0.001

# Email.Phishing.Cur.Gen1174.Sanesecurity.08072700
rawbody  SS_PHISH_CUR_G1174_08072700 /From: "Internal Revenue Service"<urgent\@irs\.gov>/i
describe SS_PHISH_CUR_G1174_08072700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1174_08072700 0.001

# Email.Phishing.Cur.Gen1175.Sanesecurity.08072701
rawbody  SS_PHISH_CUR_G1175_08072701 /From: ".{0,50}"<.*Our records indicate that you are qualified to receive/i
describe SS_PHISH_CUR_G1175_08072701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1175_08072701 0.001

# Email.Phishing.Cur.Gen1176.Sanesecurity.08072800
rawbody  SS_PHISH_CUR_G1176_08072800 /From: "Bank Of America"<admin\@bankofasmerica\.com>/i
describe SS_PHISH_CUR_G1176_08072800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1176_08072800 0.001

# Email.Phishing.Cur.Gen1177.Sanesecurity.08072801
rawbody  SS_PHISH_CUR_G1177_08072801 /From: ".{0,50}"<.*fill out the survey\. For your effort and your time/i
describe SS_PHISH_CUR_G1177_08072801 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1177_08072801 0.001

# Email.Phishing.Cur.Gen1178.Sanesecurity.08072900
rawbody  SS_PHISH_CUR_G1178_08072900 /\.abbeynational\.uk\./i
describe SS_PHISH_CUR_G1178_08072900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1178_08072900 0.001

# Email.Phishing.Cur.Gen1179.Sanesecurity.08080400
rawbody  SS_PHISH_CUR_G1179_08080400 /From: "Hsbc Bank Plc"<onlineservice\@hsbc\.co\.uk>/i
describe SS_PHISH_CUR_G1179_08080400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1179_08080400 0.001

# Email.Phishing.Cur.Gen1180.Sanesecurity.08080401
rawbody  SS_PHISH_CUR_G1180_08080401 /X-PHP-Script:.*http:\/\/www\.LloydsTSB\.co\.uk\/_/i
describe SS_PHISH_CUR_G1180_08080401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1180_08080401 0.001

# Email.Phishing.Cur.Gen1181.Sanesecurity.08080402
rawbody  SS_PHISH_CUR_G1181_08080402 /\.lloydstsb\.co\.uk\./i
describe SS_PHISH_CUR_G1181_08080402 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1181_08080402 0.001

# Email.Phishing.Cur.Gen1182.Sanesecurity.08080500
rawbody  SS_PHISH_CUR_G1182_08080500 /\.lloydstsb\.com\./i
describe SS_PHISH_CUR_G1182_08080500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1182_08080500 0.001

# Email.Phishing.Cur.Gen1183.Sanesecurity.08080501
rawbody  SS_PHISH_CUR_G1183_08080501 /\.da-us\.citibank\.com\./i
describe SS_PHISH_CUR_G1183_08080501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1183_08080501 0.001

# Email.Phishing.Cur.Gen1184.Sanesecurity.08080600
rawbody  SS_PHISH_CUR_G1184_08080600 /From: "Lloyds Online Banking"<service\@lloydstsb\.co\.uk>/i
describe SS_PHISH_CUR_G1184_08080600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1184_08080600 0.001

# Email.Phishing.Cur.Gen1185.Sanesecurity.08080601
rawbody  SS_PHISH_CUR_G1185_08080601 /From: ".{0,50}"<.*Faster Payments is an industry-wide initiative that means when you send money/i
describe SS_PHISH_CUR_G1185_08080601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1185_08080601 0.001

# Email.Phishing.Cur.Gen1186.Sanesecurity.08080602
rawbody  SS_PHISH_CUR_G1186_08080602 /http:\/\/www\.paypal\.com\.poypaI\./i
describe SS_PHISH_CUR_G1186_08080602 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G1186_08080602 0.001

# Email.Phishing.Url.Sanesecurity.07021300
rawbody  SS_PHISH_URL_07021300 /http:\/\/203\.190\.146\.205\/service\.capitalone\.com\/index\.htm/i
describe SS_PHISH_URL_07021300 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07021300 0.001

# Email.Phishing.Url.Sanesecurity.07021301
rawbody  SS_PHISH_URL_07021301 /http:\/\/national-au\.biz\//i
describe SS_PHISH_URL_07021301 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07021301 0.001

# Email.Phishing.Url.Sanesecurity.07022200
rawbody  SS_PHISH_URL_07022200 /http:\/\/anatomische-gesellschaft\.de\/picture\/update\/virgin\/index\.htm/i
describe SS_PHISH_URL_07022200 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07022200 0.001

# Email.Phishing.Url.Sanesecurity.07030100
rawbody  SS_PHISH_URL_07030100 /http:\/\/www\.geocities\.com\/linux\.2007\/hdr_seccenterhmpg_589x151\.jpg/i
describe SS_PHISH_URL_07030100 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07030100 0.001

# Email.Phishing.Url.Sanesecurity.07030400
rawbody  SS_PHISH_URL_07030400 /http:\/\/81\.191\.129\.52\/pp\//i
describe SS_PHISH_URL_07030400 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07030400 0.001

# Email.Phishing.Url.Sanesecurity.07032200
rawbody  SS_PHISH_URL_07032200 /http:\/\/www\.dell\.idv\.tw\/DellLogin\/GA\/Login\/index\.html/i
describe SS_PHISH_URL_07032200 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07032200 0.001

# Email.Phishing.Url.Sanesecurity.07032700
rawbody  SS_PHISH_URL_07032700 /http:\/\/www\.gjosefsberg\.com\/Blog\/gallery\/bancoposta\.online\.it\//i
describe SS_PHISH_URL_07032700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07032700 0.001

# Email.Phishing.Url.Sanesecurity.07040100
rawbody  SS_PHISH_URL_07040100 /http:\/\/select4u\.net\/ece2e574cd\/p0st3\/cartepr\/formslogin\.htm/i
describe SS_PHISH_URL_07040100 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07040100 0.001

# Email.Phishing.Url.Sanesecurity.07040300
rawbody  SS_PHISH_URL_07040300 /http:\/\/sitekey3\.bankofamerica\.com\.cableadtv\.com\//i
describe SS_PHISH_URL_07040300 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07040300 0.001

# Email.Phishing.Url.Sanesecurity.07041700
rawbody  SS_PHISH_URL_07041700 /http:\/\/www\.banesto\.tk\/particulares\//i
describe SS_PHISH_URL_07041700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07041700 0.001

# Email.Phishing.Url.Sanesecurity.07041701
rawbody  SS_PHISH_URL_07041701 /http:\/\/www\.myfirst01\.com\/login\.htm/i
describe SS_PHISH_URL_07041701 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07041701 0.001

# Email.Phishing.Url.Sanesecurity.07041900
rawbody  SS_PHISH_URL_07041900 /http:\/\/www\.funlux\.be\/paypl\.html/i
describe SS_PHISH_URL_07041900 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07041900 0.001

# Email.Phishing.Url.Sanesecurity.07042600
rawbody  SS_PHISH_URL_07042600 /http:\/\/www\.cpdwise\.com\/claroline\/upload\//i
describe SS_PHISH_URL_07042600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07042600 0.001

# Email.Phishing.Url.Sanesecurity.07042601
rawbody  SS_PHISH_URL_07042601 /http:\/\/www\.a77web\.it\/aggiornamenti\/lotteria\/posteit\.jpg/i
describe SS_PHISH_URL_07042601 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07042601 0.001

# Email.Phishing.Url.Sanesecurity.07042602
rawbody  SS_PHISH_URL_07042602 /http:\/\/www\.balkanartshop\.com\/editor\//i
describe SS_PHISH_URL_07042602 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07042602 0.001

# Email.Phishing.Url.Sanesecurity.07042603
rawbody  SS_PHISH_URL_07042603 /http:\/\/xxx\.thestories\.org\/tmp\//i
describe SS_PHISH_URL_07042603 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07042603 0.001

# Email.Phishing.Url.Sanesecurity.07042604
rawbody  SS_PHISH_URL_07042604 /http:\/\/travelkat\.net\/whoarewe_files\//i
describe SS_PHISH_URL_07042604 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07042604 0.001

# Email.Phishing.Url.Sanesecurity.07042604
rawbody  SS_PHISH_URL_07042604 /www\.igrejacasadeoracao\.org\.br\/components\//i
describe SS_PHISH_URL_07042604 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07042604 0.001

# Email.Phishing.Url.Sanesecurity.07042605
rawbody  SS_PHISH_URL_07042605 /http:\/\/www\.ppayldil\.com\/on\/index\.htm/i
describe SS_PHISH_URL_07042605 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07042605 0.001

# Email.Phishing.Url.Sanesecurity.07043000
rawbody  SS_PHISH_URL_07043000 /http:\/\/spensa\.mindsweep\.ca\/mrtg\/cm\.html/i
describe SS_PHISH_URL_07043000 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07043000 0.001

# Email.Phishing.Url.Sanesecurity.07043001
rawbody  SS_PHISH_URL_07043001 /http:\/\/carpeaurum\.com\/arethor\/1\.gif/i
describe SS_PHISH_URL_07043001 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07043001 0.001

# Email.Phishing.Url.Sanesecurity.07043002
rawbody  SS_PHISH_URL_07043002 /http:\/\/www\.arribadasrxbay\.com\//i
describe SS_PHISH_URL_07043002 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07043002 0.001

# Email.Phishing.Url.Sanesecurity.07043003
rawbody  SS_PHISH_URL_07043003 /270099970719<\/A>\)<\/FONT>/i
describe SS_PHISH_URL_07043003 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07043003 0.001

# Email.Phishing.Url.Sanesecurity.07043004
rawbody  SS_PHISH_URL_07043004 /http:\/\/teamwetworks\.com\/n2\/modules\//i
describe SS_PHISH_URL_07043004 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07043004 0.001

# Email.Phishing.Url.Sanesecurity.07050100
rawbody  SS_PHISH_URL_07050100 /http:\/\/youtubeis\.in\/backup\/secured\/bancoposta\.online\.it\//i
describe SS_PHISH_URL_07050100 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050100 0.001

# Email.Phishing.Url.Sanesecurity.07050101
rawbody  SS_PHISH_URL_07050101 /http:\/\/210\.97\.229\.34\/bbs\/icon\//i
describe SS_PHISH_URL_07050101 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050101 0.001

# Email.Phishing.Url.Sanesecurity.07050102
rawbody  SS_PHISH_URL_07050102 /http:\/\/signin\.ebay\.com\.tecmon\.com\//i
describe SS_PHISH_URL_07050102 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050102 0.001

# Email.Phishing.Url.Sanesecurity.07050200
rawbody  SS_PHISH_URL_07050200 /http:\/\/ourworld\.cs\.com\/GoodIntr\/images\/aint\.gif/i
describe SS_PHISH_URL_07050200 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050200 0.001

# Email.Phishing.Url.Sanesecurity.07050201
rawbody  SS_PHISH_URL_07050201 /http:\/\/hometown\.aol\.com\/Signcopartner\/signin\.ebay\.com\./i
describe SS_PHISH_URL_07050201 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050201 0.001

# Email.Phishing.Url.Sanesecurity.07050300
rawbody  SS_PHISH_URL_07050300 /http:\/\/196\.44\.250\.218\/www\.anz\.com\.au/i
describe SS_PHISH_URL_07050300 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050300 0.001

# Email.Phishing.Url.Sanesecurity.07050301
rawbody  SS_PHISH_URL_07050301 /http:\/\/payment-resspons\.com\/tmp/i
describe SS_PHISH_URL_07050301 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050301 0.001

# Email.Phishing.Url.Sanesecurity.07050302
rawbody  SS_PHISH_URL_07050302 /http:\/\/peyment-resposse\.com\/tmp/i
describe SS_PHISH_URL_07050302 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050302 0.001

# Email.Phishing.Url.Sanesecurity.07050302
rawbody  SS_PHISH_URL_07050302 /http:\/\/paymant-response\.com\/tmp/i
describe SS_PHISH_URL_07050302 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050302 0.001

# Email.Phishing.Url.Sanesecurity.07050400
rawbody  SS_PHISH_URL_07050400 /http:\/\/www\.techwearusa\.com\/pp\//i
describe SS_PHISH_URL_07050400 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050400 0.001

# Email.Phishing.Url.Sanesecurity.07050401
rawbody  SS_PHISH_URL_07050401 /http:\/\/www\.traffics\.co\.jp\/images\/www\.paypal\.com\//i
describe SS_PHISH_URL_07050401 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050401 0.001

# Email.Phishing.Url.Sanesecurity.07050402
rawbody  SS_PHISH_URL_07050402 /http:\/\/e-b-a-y\.by\.ru\/EB\//i
describe SS_PHISH_URL_07050402 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050402 0.001

# Email.Phishing.Url.Sanesecurity.07050403
rawbody  SS_PHISH_URL_07050403 /http:\/\/chhe\.biz\/webstats\/poste\.it\//i
describe SS_PHISH_URL_07050403 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050403 0.001

# Email.Phishing.Url.Sanesecurity.07050500
rawbody  SS_PHISH_URL_07050500 /http:\/\/www\.ffw-saltendorf\.de\/kalender\/usage\/us\/cgi-bin\/index\.php/i
describe SS_PHISH_URL_07050500 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050500 0.001

# Email.Phishing.Url.Sanesecurity.07050800
rawbody  SS_PHISH_URL_07050800 /src='http:\/\/cpe-203-45-131-227\.qld\.bigpond\.net\.au\//i
describe SS_PHISH_URL_07050800 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050800 0.001

# Html.Phishing.Url.Sanesecurity.07050403
body     SS_PHISH_URL_07050403 /<\/head><body><a href=http:\/\/.{0,50}\/\?vacancy><img src="cid:/i
describe SS_PHISH_URL_07050403 SaneSecurity: HTML-based file with phishing URL
score    SS_PHISH_URL_07050403 0.001

# Email.Phishing.Url.Sanesecurity.07050700
rawbody  SS_PHISH_URL_07050700 /http:\/\/ourworld\.cs\.com\/PMandrak3\//i
describe SS_PHISH_URL_07050700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050700 0.001

# Email.Phishing.Url.Sanesecurity.07050800
rawbody  SS_PHISH_URL_07050800 /http:\/\/celebrate-signin\.com\/ws\/indexx\.php/i
describe SS_PHISH_URL_07050800 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050800 0.001

# Email.Phishing.Url.Sanesecurity.07050801
rawbody  SS_PHISH_URL_07050801 /<img src="http:\/\/breastbox\.com\/tt\/cc\.gif/i
describe SS_PHISH_URL_07050801 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050801 0.001

# Email.Phishing.Url.Sanesecurity.07050802
rawbody  SS_PHISH_URL_07050802 /http:\/\/berodata\.de\/jax\/admin\/actualizacion\//i
describe SS_PHISH_URL_07050802 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07050802 0.001

# Email.Phishing.Url.Sanesecurity.07051000
rawbody  SS_PHISH_URL_07051000 /http:\/\/www\.zik\.ro\/free-sms\/sso-red\.htm/i
describe SS_PHISH_URL_07051000 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051000 0.001

# Email.Phishing.Url.Sanesecurity.07051100
rawbody  SS_PHISH_URL_07051100 /http:\/\/www\.schornstein\.com\.br\/www\/bar\/ics\//i
describe SS_PHISH_URL_07051100 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051100 0.001

# Email.Phishing.Url.Sanesecurity.07051101
rawbody  SS_PHISH_URL_07051101 /http:\/\/www\.arribadaccuser\.biz\/signin\.ebay\.com\//i
describe SS_PHISH_URL_07051101 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051101 0.001

# Email.Phishing.Url.Sanesecurity.07051102
rawbody  SS_PHISH_URL_07051102 /http:\/\/203\.154\.87\.136\/manual\/www\.ebay\.com\//i
describe SS_PHISH_URL_07051102 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051102 0.001

# Email.Phishing.Url.Sanesecurity.07051103.b64
rawbody  SS_PHISH_URL_07051103_B64 /aHR0cDovL3d3dy5tZW0tYml6LmNvbS9iYW5jb3Bvc3Rhb25saW5laXQv/i
describe SS_PHISH_URL_07051103_B64 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051103_B64 0.001

# Email.Phishing.Url.Sanesecurity.07051204
rawbody  SS_PHISH_URL_07051204 /http:\/\/193\.95\.228\.200\/uros\/signin\.ebay/i
describe SS_PHISH_URL_07051204 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051204 0.001

# Email.Phishing.Url.Sanesecurity.07051400
rawbody  SS_PHISH_URL_07051400 /http:\/\/www\.paypaltm\.com\/us\/cgi-bin\/webscr\.php\?cmd=_login-run/i
describe SS_PHISH_URL_07051400 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051400 0.001

# Email.Phishing.Url.Sanesecurity.07051401
rawbody  SS_PHISH_URL_07051401 /http:\/\/www\.paypah\.com\//i
describe SS_PHISH_URL_07051401 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051401 0.001

# Email.Phishing.Url.Sanesecurity.07051402.b64
rawbody  SS_PHISH_URL_07051402_B64 /OnBheXBhbC5sZWdhbEBlbWFpbGFjY291bnQuY29tIj5wYXlwYWwubGVnYWxAZW1haWxhY2NvdW50/i
describe SS_PHISH_URL_07051402_B64 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051402_B64 0.001

# Html.Phishing.Url.Sanesecurity.07051500
body     SS_PHISH_URL_07051500 /http:\/\/claimsagent\.net\/ws-cgi\/index\.htm/i
describe SS_PHISH_URL_07051500 SaneSecurity: HTML-based file with phishing URL
score    SS_PHISH_URL_07051500 0.001

# Email.Phishing.Url.Sanesecurity.07051501
rawbody  SS_PHISH_URL_07051501 /http:\/\/paypat-cdm\.com\//i
describe SS_PHISH_URL_07051501 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051501 0.001

# Html.Phishing.Url.Sanesecurity.07051502
body     SS_PHISH_URL_07051502 /http:\/\/thepenalcolony\.com\/ws\/index\.htm/i
describe SS_PHISH_URL_07051502 SaneSecurity: HTML-based file with phishing URL
score    SS_PHISH_URL_07051502 0.001

# Email.Phishing.Url.Sanesecurity.07051503
rawbody  SS_PHISH_URL_07051503 /http:\/\/www\.baysapiissl\.com\/eBay/i
describe SS_PHISH_URL_07051503 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051503 0.001

# Email.Phishing.Url.Sanesecurity.07051504
rawbody  SS_PHISH_URL_07051504 /http:\/\/www\.enjoint\.net\/modules\/Reviews\/secure\/verificazione1\//i
describe SS_PHISH_URL_07051504 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051504 0.001

# Email.Phishing.Url.Sanesecurity.07051505
rawbody  SS_PHISH_URL_07051505 /\.static\.apol\.com\.tw\/~test\/bpol\.poste\.www\.poste\.it\.html/i
describe SS_PHISH_URL_07051505 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051505 0.001

# Email.Phishing.Url.Sanesecurity.07051600
rawbody  SS_PHISH_URL_07051600 /http:\/\/signin-ws\.front\.ru\//i
describe SS_PHISH_URL_07051600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051600 0.001

# Html.Phishing.Url.Sanesecurity.07051601
body     SS_PHISH_URL_07051601 /http:\/\/brannenhomes\.com\/ws\/index\.htm/i
describe SS_PHISH_URL_07051601 SaneSecurity: HTML-based file with phishing URL
score    SS_PHISH_URL_07051601 0.001

# Email.Phishing.Url.Sanesecurity.07051700
rawbody  SS_PHISH_URL_07051700 /\/thevillagechurch\.net\/signin\.ebay\.com\//i
describe SS_PHISH_URL_07051700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051700 0.001

# Email.Phishing.Url.Sanesecurity.07051701
rawbody  SS_PHISH_URL_07051701 /http:\/\/www\.j5photographic\.org\/loogin\.php/i
describe SS_PHISH_URL_07051701 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051701 0.001

# Email.Phishing.Url.Sanesecurity.07051702
rawbody  SS_PHISH_URL_07051702 /http:\/\/147\.202\.42\.249/i
describe SS_PHISH_URL_07051702 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051702 0.001

# Email.Phishing.Url.Sanesecurity.07051703
rawbody  SS_PHISH_URL_07051703 /http:\/\/207\.159\.81\.40\/exchweb\/img\/redir\.htm/i
describe SS_PHISH_URL_07051703 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051703 0.001

# Email.Phishing.Url.Sanesecurity.07051704
rawbody  SS_PHISH_URL_07051704 /http:\/\/free-ftp\.org\/ladosi\/redir\.htm/i
describe SS_PHISH_URL_07051704 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051704 0.001

# Email.Phishing.Url.Sanesecurity.07051705
rawbody  SS_PHISH_URL_07051705 /http:\/\/avecezar\.ovh\.org\/\%20\/rep\.html/i
describe SS_PHISH_URL_07051705 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051705 0.001

# Email.Phishing.Url.Sanesecurity.07051706
rawbody  SS_PHISH_URL_07051706 /http:\/\/www\.tt-personaltraining\.de\/3232\.jpg/i
describe SS_PHISH_URL_07051706 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051706 0.001

# Email.Phishing.Url.Sanesecurity.07051800
rawbody  SS_PHISH_URL_07051800 /http:\/\/www\.j5photographic\.org\/photos\/measures\.php/i
describe SS_PHISH_URL_07051800 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07051800 0.001

# Email.Phishing.Url.Sanesecurity.07052100
rawbody  SS_PHISH_URL_07052100 /http:\/\/124\.42\.45\.157\/www\.paypal\.com\//i
describe SS_PHISH_URL_07052100 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052100 0.001

# Email.Phishing.Url.Sanesecurity.07052101
rawbody  SS_PHISH_URL_07052101 /http:\/\/www\.isapiiimybaycg\.com\//i
describe SS_PHISH_URL_07052101 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052101 0.001

# Email.Phishing.Url.Sanesecurity.07052102
rawbody  SS_PHISH_URL_07052102 /http:\/\/awconfirmsingin\.ja-nee\.de\//i
describe SS_PHISH_URL_07052102 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052102 0.001

# Email.Phishing.Url.Sanesecurity.07052103
rawbody  SS_PHISH_URL_07052103 /http:\/\/xoomer\.alice\.it\/requestitem\/loginmyeBay/i
describe SS_PHISH_URL_07052103 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052103 0.001

# Email.Phishing.Url.Sanesecurity.07052104
rawbody  SS_PHISH_URL_07052104 /http:\/\/mail\.apertoinformatics\.com""/i
describe SS_PHISH_URL_07052104 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052104 0.001

# Email.Phishing.Url.Sanesecurity.07052300
rawbody  SS_PHISH_URL_07052300 /http:\/\/www\.physiosupport\.org\/downeysavingsonlinebanking\.com\//i
describe SS_PHISH_URL_07052300 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052300 0.001

# Email.Phishing.Url.Sanesecurity.07052301
rawbody  SS_PHISH_URL_07052301 /http:\/\/mywebinfoportal\.com\//i
describe SS_PHISH_URL_07052301 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052301 0.001

# Email.Phishing.Url.Sanesecurity.07052302
rawbody  SS_PHISH_URL_07052302 /http:\/\/www\.wojtowa\.pl\/cgi-bin\/ws\/ISAPIdll/i
describe SS_PHISH_URL_07052302 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052302 0.001

# Email.Phishing.Url.Sanesecurity.07052400
rawbody  SS_PHISH_URL_07052400 /http:\/\/www\.mycarfs\.com\/media\/arfs\/index\.html/i
describe SS_PHISH_URL_07052400 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052400 0.001

# Email.Phishing.Url.Sanesecurity.07052500
rawbody  SS_PHISH_URL_07052500 /http:\/\/www\.expansionjoints4u\.com\/sunshop\/admin\/backup\/user\/SingInUssing/i
describe SS_PHISH_URL_07052500 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052500 0.001

# Email.Phishing.Url.Sanesecurity.07052501
rawbody  SS_PHISH_URL_07052501 /http:\/\/wittipower\.de\/admin\/update\.htm/i
describe SS_PHISH_URL_07052501 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052501 0.001

# Email.Phishing.Url.Sanesecurity.07052700
rawbody  SS_PHISH_URL_07052700 /http:\/\/wittipower\.de\/admin\/data\/update\.htm/i
describe SS_PHISH_URL_07052700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052700 0.001

# Email.Phishing.Url.Sanesecurity.07052900
rawbody  SS_PHISH_URL_07052900 /http:\/\/paypel-cmd\.com\//i
describe SS_PHISH_URL_07052900 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052900 0.001

# Email.Phishing.Url.Sanesecurity.07052901
rawbody  SS_PHISH_URL_07052901 /http:\/\/ns1\.srbpoly\.ac\.th\/counter\//i
describe SS_PHISH_URL_07052901 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052901 0.001

# Email.Phishing.Url.Sanesecurity.07052902
rawbody  SS_PHISH_URL_07052902 /http:\/\/mybay-signin\.lydo\.org/i
describe SS_PHISH_URL_07052902 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052902 0.001

# Email.Phishing.Url.Sanesecurity.07052903
rawbody  SS_PHISH_URL_07052903 /http:\/\/www\.idemasales\.com\/ima/i
describe SS_PHISH_URL_07052903 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052903 0.001

# Email.Phishing.Url.Sanesecurity.07052904
rawbody  SS_PHISH_URL_07052904 /http:\/\/palgorpoly\.com/i
describe SS_PHISH_URL_07052904 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052904 0.001

# Email.Phishing.Url.Sanesecurity.07052905
rawbody  SS_PHISH_URL_07052905 /http:\/\/125\.46\.11\.180\/www\.paypal\.com\//i
describe SS_PHISH_URL_07052905 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07052905 0.001

# Email.Phishing.Url.Sanesecurity.07053000
rawbody  SS_PHISH_URL_07053000 /http:\/\/www\.roskaknights\.org\/themes\/file\.php/i
describe SS_PHISH_URL_07053000 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07053000 0.001

# Email.Phishing.Url.Sanesecurity.07053001
rawbody  SS_PHISH_URL_07053001 /http:\/\/helpdesk\.rfms\.com\/kb\/crons\/x\.htm/i
describe SS_PHISH_URL_07053001 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07053001 0.001

# Email.Phishing.Url.Sanesecurity.07053100
rawbody  SS_PHISH_URL_07053100 /open3\.rm04\.net\/open\/log\/598128\//i
describe SS_PHISH_URL_07053100 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07053100 0.001

# Email.Phishing.Url.Sanesecurity.07060100
rawbody  SS_PHISH_URL_07060100 /http:\/\/dutedreaq\.pochta\.ru\/dain/i
describe SS_PHISH_URL_07060100 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07060100 0.001

# Email.Phishing.Url.Sanesecurity.07060400
rawbody  SS_PHISH_URL_07060400 /http:\/\/212\.85\.4\.254\/login\.html/i
describe SS_PHISH_URL_07060400 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07060400 0.001

# Email.Phishing.Url.Sanesecurity.07060401
rawbody  SS_PHISH_URL_07060401 /http:\/\/pupj\.net\/shoutpro\/sesion\/bancoposta\.online\.it/i
describe SS_PHISH_URL_07060401 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07060401 0.001

# Email.Phishing.Url.Sanesecurity.07060500
rawbody  SS_PHISH_URL_07060500 /http:\/\/www\.zik\.ro\/free-sms\/rescenter\.htm/i
describe SS_PHISH_URL_07060500 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07060500 0.001

# Email.Phishing.Url.Sanesecurity.07060501
rawbody  SS_PHISH_URL_07060501 /http:\/\/zlotnikiopolskie\.pl\/components\//i
describe SS_PHISH_URL_07060501 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07060501 0.001

# Email.Phishing.Url.Sanesecurity.07060502
rawbody  SS_PHISH_URL_07060502 /http:\/\/solvaybanksurvey\.by\.ru/i
describe SS_PHISH_URL_07060502 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07060502 0.001

# Email.Phishing.Url.Sanesecurity.07060600
rawbody  SS_PHISH_URL_07060600 /http:\/\/www\.minerva-schulen\.ch\/html\/phpXplorer\//i
describe SS_PHISH_URL_07060600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07060600 0.001

# Email.Phishing.Url.Sanesecurity.07060601
rawbody  SS_PHISH_URL_07060601 /http:\/\/www\.mybaydllconfirm\.2itb\.com/i
describe SS_PHISH_URL_07060601 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07060601 0.001

# Email.Phishing.Url.Sanesecurity.07060602
rawbody  SS_PHISH_URL_07060602 /http:\/\/securesigninddll\.by\.ru/i
describe SS_PHISH_URL_07060602 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07060602 0.001

# Email.Phishing.Url.Sanesecurity.07060700
rawbody  SS_PHISH_URL_07060700 /http:\/\/www\.paypolpal\.com/i
describe SS_PHISH_URL_07060700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07060700 0.001

# Email.Phishing.Url.Sanesecurity.07060701
rawbody  SS_PHISH_URL_07060701 /http:\/\/www\.paypulll\.com/i
describe SS_PHISH_URL_07060701 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07060701 0.001

# Email.Phishing.Url.Sanesecurity.07060702
rawbody  SS_PHISH_URL_07060702 /http:\/\/mail\.shingtak\.net\/vacu\/index\.html/i
describe SS_PHISH_URL_07060702 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07060702 0.001

# Email.Phishing.Url.Sanesecurity.07060703
rawbody  SS_PHISH_URL_07060703 /http:\/\/www\.ilmargutta\.it\/Bancanet-personal\.htm/i
describe SS_PHISH_URL_07060703 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07060703 0.001

# Email.Phishing.Url.Sanesecurity.07060704
rawbody  SS_PHISH_URL_07060704 /http:\/\/www\.matrixsolutionsinc\.com\/shop\/images\/pp\//i
describe SS_PHISH_URL_07060704 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07060704 0.001

# Email.Phishing.Url.Sanesecurity.07060800
rawbody  SS_PHISH_URL_07060800 /http:\/\/wschooy\.homeip\.net\/guestbook\//i
describe SS_PHISH_URL_07060800 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07060800 0.001

# Email.Phishing.Url.Sanesecurity.07060801
rawbody  SS_PHISH_URL_07060801 /http:\/\/mailgate\.byromstreet\.com\/redirect/i
describe SS_PHISH_URL_07060801 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07060801 0.001

# Email.Phishing.Url.Sanesecurity.07061000
rawbody  SS_PHISH_URL_07061000 /http:\/\/www\.virginia-credit-union\.com\/applications\/index\.html/i
describe SS_PHISH_URL_07061000 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061000 0.001

# Email.Phishing.Url.Sanesecurity.07061001
rawbody  SS_PHISH_URL_07061001 /http:\/\/www\.spaziovideo\.altervista\.org\/poste1\//i
describe SS_PHISH_URL_07061001 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061001 0.001

# Email.Phishing.Url.Sanesecurity.07061002
rawbody  SS_PHISH_URL_07061002 /http:\/\/recit\.cadre\.qc\.ca\/blogues\/media\/privati\.internetbanking\.bancaintesa\.it/i
describe SS_PHISH_URL_07061002 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061002 0.001

# Email.Phishing.Url.Sanesecurity.07061003
rawbody  SS_PHISH_URL_07061003 /http:\/\/61\.12\.116\.51\/ads\/onlineserv\//i
describe SS_PHISH_URL_07061003 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061003 0.001

# Email.Phishing.Url.Sanesecurity.07061100
rawbody  SS_PHISH_URL_07061100 /http:\/\/www\.illinoislawyerfinder\.com\/images\/rescenter\.htm/i
describe SS_PHISH_URL_07061100 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061100 0.001

# Email.Phishing.Url.Sanesecurity.07061101
rawbody  SS_PHISH_URL_07061101 /http:\/\/www\.arizonastreet\.com\/ssl\/Arizona-Central/i
describe SS_PHISH_URL_07061101 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061101 0.001

# Email.Phishing.Url.Sanesecurity.07061102
rawbody  SS_PHISH_URL_07061102 /http:\/\/microlender\.co\.za\/Mambo\/cache\/view\.php/i
describe SS_PHISH_URL_07061102 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061102 0.001

# Email.Phishing.Url.Sanesecurity.07061200
rawbody  SS_PHISH_URL_07061200 /http:\/\/www1\.midatlanticdata\.com/i
describe SS_PHISH_URL_07061200 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061200 0.001

# Email.Phishing.Url.Sanesecurity.07061201
rawbody  SS_PHISH_URL_07061201 /http:\/\/delivered-home\.com\//i
describe SS_PHISH_URL_07061201 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061201 0.001

# Email.Phishing.Url.Sanesecurity.07061300
rawbody  SS_PHISH_URL_07061300 /http:\/\/signin-myebay\.com\//i
describe SS_PHISH_URL_07061300 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061300 0.001

# Email.Phishing.Url.Sanesecurity.07061301
rawbody  SS_PHISH_URL_07061301 /http:\/\/miel\.ifastnet\.com\/acx\//i
describe SS_PHISH_URL_07061301 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061301 0.001

# Email.Phishing.Url.Sanesecurity.07061302
rawbody  SS_PHISH_URL_07061302 /http:\/\/helpdesk\.rfms\.com\/project2\/fckeditor\/editor\/css\/a\.htm/i
describe SS_PHISH_URL_07061302 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061302 0.001

# Email.Phishing.Url.Sanesecurity.07061303
rawbody  SS_PHISH_URL_07061303 /http:\/\/mycgl-sapii\.com\//i
describe SS_PHISH_URL_07061303 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061303 0.001

# Email.Phishing.Url.Sanesecurity.07061400
rawbody  SS_PHISH_URL_07061400 /http:\/\/payplada-us\.com\//i
describe SS_PHISH_URL_07061400 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061400 0.001

# Email.Phishing.Url.Sanesecurity.07061401
rawbody  SS_PHISH_URL_07061401 /http:\/\/skc\.ch\/skc\/album_mod\/upload\/cache\//i
describe SS_PHISH_URL_07061401 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061401 0.001

# Email.Phishing.Url.Sanesecurity.07061500
rawbody  SS_PHISH_URL_07061500 /http:\/\/amanda\.fox\.com\.br\/www\./i
describe SS_PHISH_URL_07061500 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061500 0.001

# Email.Phishing.Url.Sanesecurity.07061501
rawbody  SS_PHISH_URL_07061501 /http:\/\/www\.christmasalabama\.com\/privati\.internetbanking\.bancaintesa\.it\//i
describe SS_PHISH_URL_07061501 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061501 0.001

# Email.Phishing.Url.Sanesecurity.07061502
rawbody  SS_PHISH_URL_07061502 /http:\/\/onnidan1\.com\/imanager\/privati\.internetbanking\.bancaintesa\.it\//i
describe SS_PHISH_URL_07061502 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061502 0.001

# Email.Phishing.Url.Sanesecurity.07061503
rawbody  SS_PHISH_URL_07061503 /http:\/\/nikyo-car\.net\/webapps\/index\.html/i
describe SS_PHISH_URL_07061503 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061503 0.001

# Email.Phishing.Url.Sanesecurity.07061700
rawbody  SS_PHISH_URL_07061700 /http:\/\/onlinebanking\.az-central-cu\.org\//i
describe SS_PHISH_URL_07061700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061700 0.001

# Email.Phishing.Url.Sanesecurity.07061900
rawbody  SS_PHISH_URL_07061900 /http:\/\/signin\.ebay-sp\.com\/ws\/\?eBayISAPI\.dll/i
describe SS_PHISH_URL_07061900 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061900 0.001

# Email.Phishing.Url.Sanesecurity.07061901
rawbody  SS_PHISH_URL_07061901 /http:\/\/www\.elintegral\.com\.mx\/components\/com_extcalendar\/include\/update/i
describe SS_PHISH_URL_07061901 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07061901 0.001

# Email.Phishing.Url.Sanesecurity.07062000
rawbody  SS_PHISH_URL_07062000 /http:\/\/newtrier66\.com\/gallery2\/install\/locale\//i
describe SS_PHISH_URL_07062000 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062000 0.001

# Email.Phishing.Url.Sanesecurity.07062001
rawbody  SS_PHISH_URL_07062001 /http:\/\/163\.14\.134\.52\/wt1\/www\.bancaintesa\.it\//i
describe SS_PHISH_URL_07062001 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062001 0.001

# Email.Phishing.Url.Sanesecurity.07062200
rawbody  SS_PHISH_URL_07062200 /http:\/\/account-online-paypal\.com\//i
describe SS_PHISH_URL_07062200 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062200 0.001

# Email.Phishing.Url.Sanesecurity.07062201
rawbody  SS_PHISH_URL_07062201 /http:\/\/paypal-user-account\.com/i
describe SS_PHISH_URL_07062201 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062201 0.001

# Email.Phishing.Url.Sanesecurity.07062202
rawbody  SS_PHISH_URL_07062202 /http:\/\/paypal-security\.com/i
describe SS_PHISH_URL_07062202 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062202 0.001

# Email.Phishing.Url.Sanesecurity.07062203
rawbody  SS_PHISH_URL_07062203 /http:\/\/www\.effektiv-net\.dk\/modules\/cjaycontent\//i
describe SS_PHISH_URL_07062203 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062203 0.001

# Email.Phishing.Url.Sanesecurity.07062500
rawbody  SS_PHISH_URL_07062500 /http:\/\/webscr-upd-restart\.com\/us\/cgi-bin\/ppl/i
describe SS_PHISH_URL_07062500 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062500 0.001

# Email.Phishing.Url.Sanesecurity.07062501
rawbody  SS_PHISH_URL_07062501 /http:\/\/www\.versaway\.com\/onlineservices\.wachovia\.com\//i
describe SS_PHISH_URL_07062501 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062501 0.001

# Email.Phishing.Url.Sanesecurity.07062502
rawbody  SS_PHISH_URL_07062502 /http:\/\/www\.boveda-bancanet\.addr\.com\//i
describe SS_PHISH_URL_07062502 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062502 0.001

# Email.Phishing.Url.Sanesecurity.07062600
rawbody  SS_PHISH_URL_07062600 /http:\/\/darfish\.oriontv\.net\/modules\/AvantGo\/service\.htm/i
describe SS_PHISH_URL_07062600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062600 0.001

# Email.Phishing.Url.Sanesecurity.07062601
rawbody  SS_PHISH_URL_07062601 /http:\/\/mysite\.verizon\.net\/kendra406\/eBay\//i
describe SS_PHISH_URL_07062601 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062601 0.001

# Email.Phishing.Url.Sanesecurity.07062602
rawbody  SS_PHISH_URL_07062602 /http:\/\/www\.muryouform\.com\/pdf\/3a86b530bd3a0aa72cbe7a3c82b0ab7a\.pdf\//i
describe SS_PHISH_URL_07062602 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062602 0.001

# Email.Phishing.Url.Sanesecurity.07062700
rawbody  SS_PHISH_URL_07062700 /http:\/\/updt-paypai-forms\.com\/us\/cgi-bin/i
describe SS_PHISH_URL_07062700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062700 0.001

# Email.Phishing.Url.Sanesecurity.07062701
rawbody  SS_PHISH_URL_07062701 /https:\/\/webmail\.fcmortgageloans\.com\/ws\//i
describe SS_PHISH_URL_07062701 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062701 0.001

# Email.Phishing.Url.Sanesecurity.07062702
rawbody  SS_PHISH_URL_07062702 /\/admin\/gfx\/posteitalianebancoaccedi\/login-privati1\.html/i
describe SS_PHISH_URL_07062702 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062702 0.001

# Email.Phishing.Url.Sanesecurity.07062800
rawbody  SS_PHISH_URL_07062800 /http:\/\/www\.sosmetals\.com\/menu\.php\?action=login/i
describe SS_PHISH_URL_07062800 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062800 0.001

# Email.Phishing.Url.Sanesecurity.07062900
rawbody  SS_PHISH_URL_07062900 /https:\/\/ads\.poolexpert\.com\/amazon\//i
describe SS_PHISH_URL_07062900 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062900 0.001

# Email.Phishing.Url.Sanesecurity.07062901
rawbody  SS_PHISH_URL_07062901 /http:\/\/www\.musicmaker\.net\.ru\/clxsd\/obi\.html/i
describe SS_PHISH_URL_07062901 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062901 0.001

# Email.Phishing.Url.Sanesecurity.07062902
rawbody  SS_PHISH_URL_07062902 /http:\/\/z220\.com\/www\.myisland\.com\/island\/personal\//i
describe SS_PHISH_URL_07062902 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062902 0.001

# Email.Phishing.Url.Sanesecurity.07062903
rawbody  SS_PHISH_URL_07062903 /http:\/\/ipx-40-244-112-212\.ipxserver\.de\/awstats\/css\//i
describe SS_PHISH_URL_07062903 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07062903 0.001

# Email.Phishing.Url.Sanesecurity.07070200
rawbody  SS_PHISH_URL_07070200 /http:\/\/portal\.bruecken\.de\/redaxo\/include\/addons\/import_export\/pages/i
describe SS_PHISH_URL_07070200 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070200 0.001

# Email.Phishing.Url.Sanesecurity.07070201
rawbody  SS_PHISH_URL_07070201 /http:\/\/www\.s3x\.sex7x\.net/i
describe SS_PHISH_URL_07070201 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070201 0.001

# Email.Phishing.Url.Sanesecurity.07070202
rawbody  SS_PHISH_URL_07070202 /http:\/\/mks-city\.net\/gold\//i
describe SS_PHISH_URL_07070202 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070202 0.001

# Email.Phishing.Url.Sanesecurity.07070203
rawbody  SS_PHISH_URL_07070203 /http:\/\/jaguar\.cd\/pfingsten\/pages\/us\/cgi-bin\/webscrcmd/i
describe SS_PHISH_URL_07070203 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070203 0.001

# Email.Phishing.Url.Sanesecurity.07070300
rawbody  SS_PHISH_URL_07070300 /http:\/\/www\.applewoodheights\.org\/import\/index\.php/i
describe SS_PHISH_URL_07070300 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070300 0.001

# Email.Phishing.Url.Sanesecurity.07070301
rawbody  SS_PHISH_URL_07070301 /http:\/\/www\.dadsdivorceanddebt\.com\/main\/language\/index\.php/i
describe SS_PHISH_URL_07070301 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070301 0.001

# Email.Phishing.Url.Sanesecurity.07070302
rawbody  SS_PHISH_URL_07070302 /http:\/\/www\.expensereportwizard\.com\/Portals\/3\/paypal_logo\.gif/i
describe SS_PHISH_URL_07070302 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070302 0.001

# Email.Phishing.Url.Sanesecurity.07070303
rawbody  SS_PHISH_URL_07070303 /http:\/\/www\.paypollpal\.com/i
describe SS_PHISH_URL_07070303 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070303 0.001

# Email.Phishing.Url.Sanesecurity.07070304
rawbody  SS_PHISH_URL_07070304 /http:\/\/site\.access-your-account\.com\//i
describe SS_PHISH_URL_07070304 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070304 0.001

# Email.Phishing.Url.Sanesecurity.07070305
rawbody  SS_PHISH_URL_07070305 /http:\/\/www\.dadsdivorceanddebt\.com\/main\/language\/index/i
describe SS_PHISH_URL_07070305 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070305 0.001

# Email.Phishing.Url.Sanesecurity.07070400
rawbody  SS_PHISH_URL_07070400 /http:\/\/www\.bkofam-mil\.com/i
describe SS_PHISH_URL_07070400 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070400 0.001

# Email.Phishing.Url.Sanesecurity.07070401
rawbody  SS_PHISH_URL_07070401 /http:\/\/musicwebsitebonus\.com\/_vti_cgi\//i
describe SS_PHISH_URL_07070401 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070401 0.001

# Email.Phishing.Url.Sanesecurity.07070500
rawbody  SS_PHISH_URL_07070500 /http:\/\/bubblyfunk\.co\.uk\/pub\/online\//i
describe SS_PHISH_URL_07070500 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070500 0.001

# Email.Phishing.Url.Sanesecurity.07070900
rawbody  SS_PHISH_URL_07070900 /http:\/\/www\.romanianmonasteries\.org\/images\/_notes\/index\.html\?signin\.ebay/i
describe SS_PHISH_URL_07070900 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070900 0.001

# Email.Phishing.Url.Sanesecurity.07070901
rawbody  SS_PHISH_URL_07070901 /http:\/\/deshdoc\.com\/_vti_cgi\/rbc\.com\//i
describe SS_PHISH_URL_07070901 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070901 0.001

# Email.Phishing.Url.Sanesecurity.07070902
rawbody  SS_PHISH_URL_07070902 /http:\/\/196\.32\.200\.12\/manual\/www\.myisland\.com\/island\/personal\/index\.php/i
describe SS_PHISH_URL_07070902 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070902 0.001

# Email.Phishing.Url.Sanesecurity.07070903
rawbody  SS_PHISH_URL_07070903 /http:\/\/68\.113\.72\.188\/ws\//i
describe SS_PHISH_URL_07070903 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07070903 0.001

# Email.Phishing.Url.Sanesecurity.07071200
rawbody  SS_PHISH_URL_07071200 /http:\/\/www\.pipos\.com\.mx\/sendcard\/music\/cgi\.ebay\.com/i
describe SS_PHISH_URL_07071200 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071200 0.001

# Email.Phishing.Url.Sanesecurity.07071201
rawbody  SS_PHISH_URL_07071201 /http:\/\/grupoarroba04\.iespana\.es\/recadastra664\.php/i
describe SS_PHISH_URL_07071201 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071201 0.001

# Email.Phishing.Url.Sanesecurity.07071202
rawbody  SS_PHISH_URL_07071202 /http:\/\/us\.etrade\.e-tuser\.com\/login\/challange\/2b593cba\/logon\.htm/i
describe SS_PHISH_URL_07071202 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071202 0.001

# Email.Phishing.Url.Sanesecurity.07071203
rawbody  SS_PHISH_URL_07071203 /http:\/\/www\.ncua\.gov\.arapro\.com\/Survey\/RewardSurvey\.html\?ssl=1/i
describe SS_PHISH_URL_07071203 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071203 0.001

# Email.Phishing.Url.Sanesecurity.07071600
rawbody  SS_PHISH_URL_07071600 /http:\/\/91\.7bccdfac4\.com\/pp\.php/i
describe SS_PHISH_URL_07071600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071600 0.001

# Email.Phishing.Url.Sanesecurity.07071601
rawbody  SS_PHISH_URL_07071601 /http:\/\/album\.cattys\.be\/ecurie\/themes\/eyeball\/images\/index\.php/i
describe SS_PHISH_URL_07071601 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071601 0.001

# Email.Phishing.Url.Sanesecurity.07071602
rawbody  SS_PHISH_URL_07071602 /http:\/\/redirectforthehomeoage\.com\/us/i
describe SS_PHISH_URL_07071602 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071602 0.001

# Email.Phishing.Url.Sanesecurity.07071603
rawbody  SS_PHISH_URL_07071603 /http:\/\/onjllppred\.com\/htaccess\//i
describe SS_PHISH_URL_07071603 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071603 0.001

# Email.Phishing.Url.Sanesecurity.07071604
rawbody  SS_PHISH_URL_07071604 /http:\/\/www-flagged-account-message\.com\/us/i
describe SS_PHISH_URL_07071604 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071604 0.001

# Email.Phishing.Url.Sanesecurity.07071605
rawbody  SS_PHISH_URL_07071605 /http:\/\/album\.cattys\.be\/ecurie\/themes\/eyeball\/images\/index\.php/i
describe SS_PHISH_URL_07071605 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071605 0.001

# Email.Phishing.Url.Sanesecurity.07071606
rawbody  SS_PHISH_URL_07071606 /http:\/\/www\.hsbc\.co\.uk\.1-2-personal\.hk\/1\/2\/personal\//i
describe SS_PHISH_URL_07071606 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071606 0.001

# Email.Phishing.Url.Sanesecurity.07071800
rawbody  SS_PHISH_URL_07071800 /http:\/\/www\.countryluau\.com\/images\/redirect\.php/i
describe SS_PHISH_URL_07071800 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071800 0.001

# Email.Phishing.Url.Sanesecurity.07071900
rawbody  SS_PHISH_URL_07071900 /http:\/\/75\.60\.8\.162\/index/i
describe SS_PHISH_URL_07071900 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071900 0.001

# Email.Phishing.Url.Sanesecurity.07071901
rawbody  SS_PHISH_URL_07071901 /http:\/\/216\.17\.172\.14\/rbc\//i
describe SS_PHISH_URL_07071901 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071901 0.001

# Email.Phishing.Url.Sanesecurity.07071902
rawbody  SS_PHISH_URL_07071902 /http:\/\/www\.bidoun\.com\/users\/info\/on\/eBay\//i
describe SS_PHISH_URL_07071902 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071902 0.001

# Email.Phishing.Url.Sanesecurity.07071903
rawbody  SS_PHISH_URL_07071903 /http:\/\/wumt-westenion\.com/i
describe SS_PHISH_URL_07071903 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071903 0.001

# Email.Phishing.Url.Sanesecurity.07071904
rawbody  SS_PHISH_URL_07071904 /http:\/\/lanteriny\.com\/wsc\.html/i
describe SS_PHISH_URL_07071904 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071904 0.001

# Email.Phishing.Url.Sanesecurity.07071905
rawbody  SS_PHISH_URL_07071905 /http:\/\/perstypel-id\.com\//i
describe SS_PHISH_URL_07071905 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07071905 0.001

# Email.Phishing.Url.Sanesecurity.07072000
rawbody  SS_PHISH_URL_07072000 /http:\/\/domain-webmaster\.net\/cgi-bin\/iPodBLACKB\.jpg/i
describe SS_PHISH_URL_07072000 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07072000 0.001

# Email.Phishing.Url.Sanesecurity.07072300
rawbody  SS_PHISH_URL_07072300 /http:\/\/smtp\.cableunion\.com\.co\/usa\/visa\/personal\/vbv\/index\.html/i
describe SS_PHISH_URL_07072300 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07072300 0.001

# Email.Phishing.Url.Sanesecurity.07072301
rawbody  SS_PHISH_URL_07072301 /http:\/\/payplolsuis\.com/i
describe SS_PHISH_URL_07072301 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07072301 0.001

# Email.Phishing.Url.Sanesecurity.07072302
rawbody  SS_PHISH_URL_07072302 /http:\/\/johnandrewforpets\.com\/users\/admin\/SignIn/i
describe SS_PHISH_URL_07072302 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07072302 0.001

# Email.Phishing.Url.Sanesecurity.07072303
rawbody  SS_PHISH_URL_07072303 /http:\/\/mysite\.verizon\.net\/signin\.ebay\.com\//i
describe SS_PHISH_URL_07072303 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07072303 0.001

# Email.Phishing.Url.Sanesecurity.07072304
rawbody  SS_PHISH_URL_07072304 /http:\/\/smtp\.cableunion\.com\.co\/usa\/visa\//i
describe SS_PHISH_URL_07072304 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07072304 0.001

# Email.Phishing.Url.Sanesecurity.07072500
rawbody  SS_PHISH_URL_07072500 /http:\/\/www\.centreapt\.com\/users\/info\/pp\/webscrcmd_login\.php/i
describe SS_PHISH_URL_07072500 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07072500 0.001

# Email.Phishing.Url.Sanesecurity.07072600
rawbody  SS_PHISH_URL_07072600 /http:\/\/75\.60\.8\.161\/services/i
describe SS_PHISH_URL_07072600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07072600 0.001

# Email.Phishing.Url.Sanesecurity.07072601
rawbody  SS_PHISH_URL_07072601 /http:\/\/mysticado\.de\/www\.secure\.ebay\.com\/ws\//i
describe SS_PHISH_URL_07072601 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07072601 0.001

# Email.Phishing.Url.Sanesecurity.07072700
rawbody  SS_PHISH_URL_07072700 /http:\/\/www\.beachbilliards\.com\/follow\.html/i
describe SS_PHISH_URL_07072700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07072700 0.001

# Email.Phishing.Url.Sanesecurity.07072701
rawbody  SS_PHISH_URL_07072701 /http:\/\/64\.12\.155\.70\/data\/pictures\//i
describe SS_PHISH_URL_07072701 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07072701 0.001

# Email.Phishing.Url.Sanesecurity.07072702
rawbody  SS_PHISH_URL_07072702 /http:\/\/creante\.pochta\.ru\/ISAPIdllSignIn/i
describe SS_PHISH_URL_07072702 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07072702 0.001

# Email.Phishing.Url.Sanesecurity.07072703
rawbody  SS_PHISH_URL_07072703 /http:\/\/webmail\.nnmc\.edu\/www\.vacu\.org\/index\.html/i
describe SS_PHISH_URL_07072703 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07072703 0.001

# Email.Phishing.Url.Sanesecurity.07072704
rawbody  SS_PHISH_URL_07072704 /http:\/\/200\.228\.66\.4\/srv\//i
describe SS_PHISH_URL_07072704 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07072704 0.001

# Email.Phishing.Url.Sanesecurity.07072900
rawbody  SS_PHISH_URL_07072900 /http:\/\/www\.camfloconstruction\.ca\/users\/test\/pp\//i
describe SS_PHISH_URL_07072900 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07072900 0.001

# Email.Phishing.Url.Sanesecurity.07073000
rawbody  SS_PHISH_URL_07073000 /http:\/\/powersellers\.confirmbay\.user\.signinusingssl\.co-partner\.2itb\.com\//i
describe SS_PHISH_URL_07073000 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07073000 0.001

# Email.Phishing.Url.Sanesecurity.07073001
rawbody  SS_PHISH_URL_07073001 /http:\/\/s3mrb\.xhost\.ro\/iPodBLACK/i
describe SS_PHISH_URL_07073001 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07073001 0.001

# Email.Phishing.Url.Sanesecurity.07073002
rawbody  SS_PHISH_URL_07073002 /http:\/\/cl-col-200-30-74-150\.orbitel\.net\.co\/srv\//i
describe SS_PHISH_URL_07073002 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07073002 0.001

# Email.Phishing.Url.Sanesecurity.07073003
rawbody  SS_PHISH_URL_07073003 /http:\/\/webmail\.nnmc\.edu\/vacu\.php/i
describe SS_PHISH_URL_07073003 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07073003 0.001

# Email.Phishing.Url.Sanesecurity.07073004
rawbody  SS_PHISH_URL_07073004 /http:\/\/www\.knc-c\.com\/cms\/data\/data1\//i
describe SS_PHISH_URL_07073004 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07073004 0.001

# Email.Phishing.Url.Sanesecurity.07073005
rawbody  SS_PHISH_URL_07073005 /http:\/\/www\.entrancetosystem\.net\/fcms\/control\/modules\/E\*TRADE\/login\.htm/i
describe SS_PHISH_URL_07073005 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07073005 0.001

# Email.Phishing.Url.Sanesecurity.07073100
rawbody  SS_PHISH_URL_07073100 /http:\/\/mail\.sryp\.net\/default\/capitalone\.htm/i
describe SS_PHISH_URL_07073100 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07073100 0.001

# Email.Phishing.Url.Sanesecurity.07073101
rawbody  SS_PHISH_URL_07073101 /http:\/\/www\.creative-web-designers\.com\/~jr\/pp\.htm/i
describe SS_PHISH_URL_07073101 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07073101 0.001

# Email.Phishing.Url.Sanesecurity.07073102
rawbody  SS_PHISH_URL_07073102 /http:\/\/www\.jyopla\.jp\/~homepage\/kain\/suedakensetu\/us\/webscr\/cgi-bin\//i
describe SS_PHISH_URL_07073102 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07073102 0.001

# Email.Phishing.Url.Sanesecurity.07073103
rawbody  SS_PHISH_URL_07073103 /http:\/\/isbn-13\.info\/index\.htm/i
describe SS_PHISH_URL_07073103 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07073103 0.001

# Email.Phishing.Url.Sanesecurity.07073104
rawbody  SS_PHISH_URL_07073104 /http:\/\/www\.real-spam\.com\/branch2\.jpg/i
describe SS_PHISH_URL_07073104 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07073104 0.001

# Email.Phishing.Url.Sanesecurity.07080200
rawbody  SS_PHISH_URL_07080200 /http:\/\/palpal\.izihost\.org\/update\/update\.htm/i
describe SS_PHISH_URL_07080200 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07080200 0.001

# Email.Phishing.Url.Sanesecurity.07080201
rawbody  SS_PHISH_URL_07080201 /http:\/\/www\.choosepp\.com\/on\/index\.htm/i
describe SS_PHISH_URL_07080201 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07080201 0.001

# Email.Phishing.Url.Sanesecurity.07080202
rawbody  SS_PHISH_URL_07080202 /http:\/\/mail\.sryp\.net\/default\/capitalone1\.htm/i
describe SS_PHISH_URL_07080202 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07080202 0.001

# Email.Phishing.Url.Sanesecurity.07080600
rawbody  SS_PHISH_URL_07080600 /"http:\/\/www\.tko\.ro\/signin\.ebay\.com\/ws\/eBaylSAPl\.dll/i
describe SS_PHISH_URL_07080600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07080600 0.001

# Email.Phishing.Url.Sanesecurity.07080601
rawbody  SS_PHISH_URL_07080601 /http:\/\/www\.online-messer-shop\.com\/e\.htm/i
describe SS_PHISH_URL_07080601 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07080601 0.001

# Email.Phishing.Url.Sanesecurity.07080602
rawbody  SS_PHISH_URL_07080602 /http:\/\/www\.nato-online-shop\.com\/d\.htm/i
describe SS_PHISH_URL_07080602 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07080602 0.001

# Email.Phishing.Url.Sanesecurity.07080700
rawbody  SS_PHISH_URL_07080700 /http:\/\/sicilianmafia\.nl\/paypal\/pp\.jpg/i
describe SS_PHISH_URL_07080700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07080700 0.001

# Email.Phishing.Url.Sanesecurity.07080701
rawbody  SS_PHISH_URL_07080701 /http:\/\/www\.rco-mi-lk\.de\/dmdocuments\/bankofamerica\.html/i
describe SS_PHISH_URL_07080701 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07080701 0.001

# Email.Phishing.Url.Sanesecurity.07080702
rawbody  SS_PHISH_URL_07080702 /http:\/\/www\.mamexshop\.com\/campus\/index\.html/i
describe SS_PHISH_URL_07080702 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07080702 0.001

# Email.Phishing.Url.Sanesecurity.07080900
rawbody  SS_PHISH_URL_07080900 /http:\/\/www\.philwebhosting\.com\/forum_lock_me\/images\/smiles\/excelbankmo\.com\//i
describe SS_PHISH_URL_07080900 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07080900 0.001

# Email.Phishing.Url.Sanesecurity.07080901
rawbody  SS_PHISH_URL_07080901 /http:\/\/qibby\.com\/secure\/paypal\.com/i
describe SS_PHISH_URL_07080901 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07080901 0.001

# Email.Phishing.Url.Sanesecurity.07080902
rawbody  SS_PHISH_URL_07080902 /http:\/\/www\.sportfmpatras\.gr\/console\/ebay/i
describe SS_PHISH_URL_07080902 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07080902 0.001

# Email.Phishing.Url.Sanesecurity.07080903
rawbody  SS_PHISH_URL_07080903 /http:\/\/www\.alanssari\.com\/filemanager\/saad\/Paypal-update\//i
describe SS_PHISH_URL_07080903 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07080903 0.001

# Email.Phishing.Url.Sanesecurity.07081000
rawbody  SS_PHISH_URL_07081000 /http:\/\/www\.cauquenes\.cl\/albums\/wa\.htm/i
describe SS_PHISH_URL_07081000 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07081000 0.001

# Email.Phishing.Url.Sanesecurity.07081001
rawbody  SS_PHISH_URL_07081001 /http:\/\/usee\.cn\/pc\/lloyd\.htm/i
describe SS_PHISH_URL_07081001 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07081001 0.001

# Email.Phishing.Url.Sanesecurity.07081500
rawbody  SS_PHISH_URL_07081500 /http:\/\/www\.celticwrath\.de\/icons\//i
describe SS_PHISH_URL_07081500 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07081500 0.001

# Email.Phishing.Url.Sanesecurity.07081700
rawbody  SS_PHISH_URL_07081700 /http:\/\/www\.leeuwsebc\.be\/components\/com_extcalendar\/upload\/index\.html/i
describe SS_PHISH_URL_07081700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07081700 0.001

# Email.Phishing.Url.Sanesecurity.07081900
rawbody  SS_PHISH_URL_07081900 /http:\/\/E210233002131\.ec-userreverse\.dion\.ne\.jp\/cgi-bin\//i
describe SS_PHISH_URL_07081900 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07081900 0.001

# Email.Phishing.Url.Sanesecurity.07081901
rawbody  SS_PHISH_URL_07081901 /http:\/\/dns\.iwasita\.co\.jp\/image\/2005\/Online-flagstar\.htm/i
describe SS_PHISH_URL_07081901 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07081901 0.001

# Email.Phishing.Url.Sanesecurity.07082100
rawbody  SS_PHISH_URL_07082100 /http:\/\/www\.itzacatepec\.edu\.mx\/secure\/www\.bancadiroma\.it\//i
describe SS_PHISH_URL_07082100 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082100 0.001

# Email.Phishing.Url.Sanesecurity.07082200
rawbody  SS_PHISH_URL_07082200 /http:\/\/fr\.ebayobjects\.com\/6k\%3Bh=http:\/\/ssllogin\.front\.ru\//i
describe SS_PHISH_URL_07082200 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082200 0.001

# Email.Phishing.Url.Sanesecurity.07082201
rawbody  SS_PHISH_URL_07082201 /http:\/\/www\.isoqol\.org\/ppt101006\/Plenary\.html/i
describe SS_PHISH_URL_07082201 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082201 0.001

# Email.Phishing.Url.Sanesecurity.07082400
rawbody  SS_PHISH_URL_07082400 /http:\/\/mail\.govital\.net\/~heidi\/\%20\%20\//i
describe SS_PHISH_URL_07082400 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082400 0.001

# Email.Phishing.Url.Sanesecurity.07082401
rawbody  SS_PHISH_URL_07082401 /http:\/\/www\.amtechinvests\.com\/images\/investments_files\/easy2win\//i
describe SS_PHISH_URL_07082401 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082401 0.001

# Email.Phishing.Url.Sanesecurity.07082500
rawbody  SS_PHISH_URL_07082500 /http:\/\/saferecycle\.org\/backup\/customer\.htm/i
describe SS_PHISH_URL_07082500 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082500 0.001

# Email.Phishing.Url.Sanesecurity.07082800
rawbody  SS_PHISH_URL_07082800 /http:\/\/updatemee\.siteburg\.com\/lloyds\/services\//i
describe SS_PHISH_URL_07082800 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082800 0.001

# Email.Phishing.Url.Sanesecurity.07082801
rawbody  SS_PHISH_URL_07082801 /http:\/\/www\.sardena\.it\/\%20\.\/index\.php/i
describe SS_PHISH_URL_07082801 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082801 0.001

# Email.Phishing.Url.Sanesecurity.07082802
rawbody  SS_PHISH_URL_07082802 /http:\/\/showtimeclicks\.com\/data\/emails\/easy2win\/eBayISAPI\.dll\.htm/i
describe SS_PHISH_URL_07082802 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082802 0.001

# Email.Phishing.Url.Sanesecurity.07082900
rawbody  SS_PHISH_URL_07082900 /http:\/\/www\.kuriersparer\.de\/n\.htm/i
describe SS_PHISH_URL_07082900 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082900 0.001

# Email.Phishing.Url.Sanesecurity.07082901
rawbody  SS_PHISH_URL_07082901 /http:\/\/www\.toronto\.webhop\.biz\/pp\//i
describe SS_PHISH_URL_07082901 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082901 0.001

# Email.Phishing.Url.Sanesecurity.07082902
rawbody  SS_PHISH_URL_07082902 /http:\/\/www\.filofacts\.de\/m\.htm/i
describe SS_PHISH_URL_07082902 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082902 0.001

# Email.Phishing.Url.Sanesecurity.07082903
rawbody  SS_PHISH_URL_07082903 /http:\/\/mail\.staffordfitness\.net\/exchweb\/help\/etrade\//i
describe SS_PHISH_URL_07082903 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082903 0.001

# Email.Phishing.Url.Sanesecurity.07082904
rawbody  SS_PHISH_URL_07082904 /http:\/\/www\.etradecheck1\.com/i
describe SS_PHISH_URL_07082904 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082904 0.001

# Email.Phishing.Url.Sanesecurity.07082905
rawbody  SS_PHISH_URL_07082905 /http:\/\/etradego\.com\//i
describe SS_PHISH_URL_07082905 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082905 0.001

# Email.Phishing.Url.Sanesecurity.07082906
rawbody  SS_PHISH_URL_07082906 /http:\/\/zelkee\.com\/zoom\/signin\.html/i
describe SS_PHISH_URL_07082906 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082906 0.001

# Email.Phishing.Url.Sanesecurity.07082907
rawbody  SS_PHISH_URL_07082907 /http:\/\/55\.6ad1a94b3f\.com\/pp\.php/i
describe SS_PHISH_URL_07082907 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082907 0.001

# Email.Phishing.Url.Sanesecurity.07082908
rawbody  SS_PHISH_URL_07082908 /http:\/\/mail\.springgroup\.net\/temp\/etrade\//i
describe SS_PHISH_URL_07082908 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082908 0.001

# Email.Phishing.Url.Sanesecurity.07082909
rawbody  SS_PHISH_URL_07082909 /https:\/\/mail\.staffordfitness\.net\/exchweb\/help\/etrade\//i
describe SS_PHISH_URL_07082909 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082909 0.001

# Email.Phishing.Url.Sanesecurity.07082910
rawbody  SS_PHISH_URL_07082910 /http:\/\/mail\.computer-geeks\.us\/exchweb\/help\/etrade\//i
describe SS_PHISH_URL_07082910 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082910 0.001

# Email.Phishing.Url.Sanesecurity.07082911
rawbody  SS_PHISH_URL_07082911 /http:\/\/home\.graffiti\.net\/moobiler\/a\.html/i
describe SS_PHISH_URL_07082911 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082911 0.001

# Email.Phishing.Url.Sanesecurity.07082912
rawbody  SS_PHISH_URL_07082912 /http:\/\/midamerica-banl\.com\/info\.htm/i
describe SS_PHISH_URL_07082912 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082912 0.001

# Email.Phishing.Url.Sanesecurity.07082913
rawbody  SS_PHISH_URL_07082913 /http:\/\/portal\.me\.hk\/gallery2\//i
describe SS_PHISH_URL_07082913 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07082913 0.001

# Email.Phishing.Url.Sanesecurity.07083000
rawbody  SS_PHISH_URL_07083000 /http:\/\/mail\.elitefoodservice\.com\/exadmin\/etrade\//i
describe SS_PHISH_URL_07083000 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07083000 0.001

# Email.Phishing.Url.Sanesecurity.07090200
rawbody  SS_PHISH_URL_07090200 /http:\/\/www\.ucpsb\.deuce4hosting\.com\/hotmail\//i
describe SS_PHISH_URL_07090200 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090200 0.001

# Email.Phishing.Url.Sanesecurity.07090201
rawbody  SS_PHISH_URL_07090201 /http:\/\/219067146138\.cidr\.odn\.ne\.jp\/tsweb\/island\//i
describe SS_PHISH_URL_07090201 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090201 0.001

# Email.Phishing.Url.Sanesecurity.07090300
rawbody  SS_PHISH_URL_07090300 /http:\/\/peypel\.c0m\.cgi-binwebscr/i
describe SS_PHISH_URL_07090300 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090300 0.001

# Email.Phishing.Url.Sanesecurity.07090400
rawbody  SS_PHISH_URL_07090400 /http:\/\/www\.trillium-automation\.com\/users\/info\/www\.bankofamerica\.com\//i
describe SS_PHISH_URL_07090400 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090400 0.001

# Email.Phishing.Url.Sanesecurity.07090401
rawbody  SS_PHISH_URL_07090401 /http:\/\/www\.capitalome-update\.com/i
describe SS_PHISH_URL_07090401 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090401 0.001

# Email.Phishing.Url.Sanesecurity.07090500
rawbody  SS_PHISH_URL_07090500 /http:\/\/www\.widescreen\.pt\/idn\/images\/stories\/ws\/eBayISAPI/i
describe SS_PHISH_URL_07090500 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090500 0.001

# Email.Phishing.Url.Sanesecurity.07090501
rawbody  SS_PHISH_URL_07090501 /"http:\/\/216\.40\.213\.84\/~administrator\/online\/index\.htm/i
describe SS_PHISH_URL_07090501 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090501 0.001

# Email.Phishing.Url.Sanesecurity.07090502
rawbody  SS_PHISH_URL_07090502 /http:\/\/paypalcom-au\.1-r\.us\//i
describe SS_PHISH_URL_07090502 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090502 0.001

# Email.Phishing.Url.Sanesecurity.07090503
rawbody  SS_PHISH_URL_07090503 /http:\/\/www\.adsuch\.it\/refundonline32874\/index\.php/i
describe SS_PHISH_URL_07090503 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090503 0.001

# Email.Phishing.Url.Sanesecurity.07090504
rawbody  SS_PHISH_URL_07090504 /http:\/\/www\.oberleitner\.biz\/cache\/ws\/eBay_com_Verify_your_eBay_account_files\//i
describe SS_PHISH_URL_07090504 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090504 0.001

# Email.Phishing.Url.Sanesecurity.07090505
rawbody  SS_PHISH_URL_07090505 /http:\/\/www\.elisha-world\.com\/tmp\/idnex1\.htm\?/i
describe SS_PHISH_URL_07090505 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090505 0.001

# Email.Phishing.Url.Sanesecurity.07090506
rawbody  SS_PHISH_URL_07090506 /http:\/\/trizviet\.com\.vn\/components\/com_extcalendar\/languages\/english\/Login\.html/i
describe SS_PHISH_URL_07090506 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090506 0.001

# Email.Phishing.Url.Sanesecurity.07090600
rawbody  SS_PHISH_URL_07090600 /http:\/\/www\.boaaccountinformationupdate\.com/i
describe SS_PHISH_URL_07090600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090600 0.001

# Email.Phishing.Url.Sanesecurity.07090700
rawbody  SS_PHISH_URL_07090700 /http:\/\/www\.claspthecarerscentre\.org\.uk\/scripts\/1100\/uploads\/index\.html/i
describe SS_PHISH_URL_07090700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090700 0.001

# Email.Phishing.Url.Sanesecurity.07090701
rawbody  SS_PHISH_URL_07090701 /http:\/\/minusconscience\.com\/users\/temp\/bankofamerica\.com\//i
describe SS_PHISH_URL_07090701 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090701 0.001

# Email.Phishing.Url.Sanesecurity.07090702
rawbody  SS_PHISH_URL_07090702 /http:\/\/66\.49\.203\.17\/users\/test\/www\.bankofamerica\.com\//i
describe SS_PHISH_URL_07090702 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090702 0.001

# Email.Phishing.Url.Sanesecurity.07090703
rawbody  SS_PHISH_URL_07090703 /http:\/\/throwbackbitch\.com\/ads\/cache\/z\/www\.wellsfargo\.com\//i
describe SS_PHISH_URL_07090703 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090703 0.001

# Email.Phishing.Url.Sanesecurity.07090900
rawbody  SS_PHISH_URL_07090900 /http:\/\/accountmanage-neroll\.com\/wells-fargo\/signon\.htm/i
describe SS_PHISH_URL_07090900 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090900 0.001

# Email.Phishing.Url.Sanesecurity.07090901
rawbody  SS_PHISH_URL_07090901 /http:\/\/www\.handball\.cl\/components\/access\/nat\/Login\.php/i
describe SS_PHISH_URL_07090901 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090901 0.001

# Email.Phishing.Url.Sanesecurity.07090902
rawbody  SS_PHISH_URL_07090902 /http:\/\/home\.graffiti\.net\/bankof\/america\/iopago\.htm/i
describe SS_PHISH_URL_07090902 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090902 0.001

# Email.Phishing.Url.Sanesecurity.07090903
rawbody  SS_PHISH_URL_07090903 /http:\/\/www\.erasinfo\.com\/bbs\/\.\/zipcode\/forv\.html/i
describe SS_PHISH_URL_07090903 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07090903 0.001

# Email.Phishing.Url.Sanesecurity.07091000
rawbody  SS_PHISH_URL_07091000 /http:\/\/fusion-net\.com\/users\/test\//i
describe SS_PHISH_URL_07091000 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091000 0.001

# Email.Phishing.Url.Sanesecurity.07091001
rawbody  SS_PHISH_URL_07091001 /http:\/\/onlineaccount-updateenroll\.com\/online\/bankofamerica\//i
describe SS_PHISH_URL_07091001 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091001 0.001

# Email.Phishing.Url.Sanesecurity.07091002
rawbody  SS_PHISH_URL_07091002 /http:\/\/www\.etradegb\.com/i
describe SS_PHISH_URL_07091002 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091002 0.001

# Email.Phishing.Url.Sanesecurity.07091003
rawbody  SS_PHISH_URL_07091003 /http:\/\/www\.hotscams\.com\/content_images\/bankamerica\.jpg/i
describe SS_PHISH_URL_07091003 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091003 0.001

# Email.Phishing.Url.Sanesecurity.07091200
rawbody  SS_PHISH_URL_07091200 /http:\/\/66\.49\.244\.212\/users\/andrea\/uploadunix\//i
describe SS_PHISH_URL_07091200 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091200 0.001

# Email.Phishing.Url.Sanesecurity.07091201
rawbody  SS_PHISH_URL_07091201 /http:\/\/mnl1961blue\.com\/htaccess\/l\.html/i
describe SS_PHISH_URL_07091201 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091201 0.001

# Email.Phishing.Url.Sanesecurity.07091202
rawbody  SS_PHISH_URL_07091202 /http:\/\/66\.49\.240\.160\/users\//i
describe SS_PHISH_URL_07091202 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091202 0.001

# Email.Phishing.Url.Sanesecurity.07091203
rawbody  SS_PHISH_URL_07091203 /http:\/\/hticketing\.com\/www\.bankofamerica\.com\//i
describe SS_PHISH_URL_07091203 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091203 0.001

# Email.Phishing.Url.Sanesecurity.07091204
rawbody  SS_PHISH_URL_07091204 /http:\/\/paypalcom-au\.bydl\.com\//i
describe SS_PHISH_URL_07091204 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091204 0.001

# Email.Phishing.Url.Sanesecurity.07091205
rawbody  SS_PHISH_URL_07091205 /http:\/\/npamail\.svpnpa\.gov\.in\/online\//i
describe SS_PHISH_URL_07091205 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091205 0.001

# Email.Phishing.Url.Sanesecurity.07091206
rawbody  SS_PHISH_URL_07091206 /"http:\/\/thegioifilm\.tv\/movies\/sitekey\/online\/sslencrypt218bit\//i
describe SS_PHISH_URL_07091206 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091206 0.001

# Email.Phishing.Url.Sanesecurity.07091207
rawbody  SS_PHISH_URL_07091207 /http:\/\/sorylove\.com\/zboard\/data\/ETRADEcustomers\/index\.html/i
describe SS_PHISH_URL_07091207 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091207 0.001

# Email.Phishing.Url.Sanesecurity.07091208
rawbody  SS_PHISH_URL_07091208 /http:\/\/www\.updatingonline-BoA\.com\//i
describe SS_PHISH_URL_07091208 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091208 0.001

# Email.Phishing.Url.Sanesecurity.07091300
rawbody  SS_PHISH_URL_07091300 /http:\/\/its-group\.jp\/~kato\//i
describe SS_PHISH_URL_07091300 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091300 0.001

# Email.Phishing.Url.Sanesecurity.07091301
rawbody  SS_PHISH_URL_07091301 /http:\/\/www\.boa-onlineupdate\.com\//i
describe SS_PHISH_URL_07091301 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091301 0.001

# Email.Phishing.Url.Sanesecurity.07091400
rawbody  SS_PHISH_URL_07091400 /http:\/\/www-ppaccountinform\.com\/ssl_upInforms\//i
describe SS_PHISH_URL_07091400 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091400 0.001

# Email.Phishing.Url.Sanesecurity.07091401
rawbody  SS_PHISH_URL_07091401 /http:\/\/www\.mzk\.nl\/baz\/site\/lw\.htm/i
describe SS_PHISH_URL_07091401 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091401 0.001

# Email.Phishing.Url.Sanesecurity.07091402
rawbody  SS_PHISH_URL_07091402 /http:\/\/bzy155\.internetdsl\.tpnet\.pl\/~andrzej\//i
describe SS_PHISH_URL_07091402 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091402 0.001

# Email.Phishing.Url.Sanesecurity.07091403
rawbody  SS_PHISH_URL_07091403 /http:\/\/www\.etradepn\.com/i
describe SS_PHISH_URL_07091403 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091403 0.001

# Email.Phishing.Url.Sanesecurity.07091600
rawbody  SS_PHISH_URL_07091600 /http:\/\/www\.gelucracana\.ro\/imgarticole\/web\.da-us\.citibank\.com\//i
describe SS_PHISH_URL_07091600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091600 0.001

# Email.Phishing.Url.Sanesecurity.07091700
rawbody  SS_PHISH_URL_07091700 /http:\/\/www\.zarakol\.com\.tr\/\.ws2/i
describe SS_PHISH_URL_07091700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091700 0.001

# Email.Phishing.Url.Sanesecurity.07091701
rawbody  SS_PHISH_URL_07091701 /formula1home\.com\/cpg1410\/include\/g\.php/i
describe SS_PHISH_URL_07091701 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091701 0.001

# Email.Phishing.Url.Sanesecurity.07091800
rawbody  SS_PHISH_URL_07091800 /http:\/\/66\.49\.249\.102\/users\/test\/on-line\/UpdateAccount\//i
describe SS_PHISH_URL_07091800 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091800 0.001

# Email.Phishing.Url.Sanesecurity.07091801
rawbody  SS_PHISH_URL_07091801 /http:\/\/www\.team811\.com\/profile\/step1\.htm/i
describe SS_PHISH_URL_07091801 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091801 0.001

# Email.Phishing.Url.Sanesecurity.07091802
rawbody  SS_PHISH_URL_07091802 /http:\/\/http-pai-pol\.com\/us\/cgi-bin/i
describe SS_PHISH_URL_07091802 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091802 0.001

# Email.Phishing.Url.Sanesecurity.07091803
rawbody  SS_PHISH_URL_07091803 /http:\/\/dalmar\.org\/gallery\/include\/r5\.php/i
describe SS_PHISH_URL_07091803 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091803 0.001

# Email.Phishing.Url.Sanesecurity.07091804
rawbody  SS_PHISH_URL_07091804 /http:\/\/www\.coronaustralis\.cl\/web\/mambots\/bankofamerica\.html/i
describe SS_PHISH_URL_07091804 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091804 0.001

# Email.Phishing.Url.Sanesecurity.07091805
rawbody  SS_PHISH_URL_07091805 /http:\/\/www-etradeb\.com\//i
describe SS_PHISH_URL_07091805 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091805 0.001

# Email.Phishing.Url.Sanesecurity.07091806
rawbody  SS_PHISH_URL_07091806 /"http:\/\/aqualak\.lh\.pl\/public_html\/cache\/online-services\/index\.html/i
describe SS_PHISH_URL_07091806 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091806 0.001

# Email.Phishing.Url.Sanesecurity.07091807
rawbody  SS_PHISH_URL_07091807 /http:\/\/www\.coronaustralis\.cl\/web\/components\//i
describe SS_PHISH_URL_07091807 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091807 0.001

# Email.Phishing.Url.Sanesecurity.07091900
rawbody  SS_PHISH_URL_07091900 /http:\/\/www\.bankofamerica\.com\.rdt49\.com\/login\/messages\//i
describe SS_PHISH_URL_07091900 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07091900 0.001

# Email.Phishing.Url.Sanesecurity.07092000
rawbody  SS_PHISH_URL_07092000 /http:\/\/www\.ilpolifilo\.it\/OLDXX\/9pp9full\/9pp9full\//i
describe SS_PHISH_URL_07092000 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092000 0.001

# Email.Phishing.Url.Sanesecurity.07092001
rawbody  SS_PHISH_URL_07092001 /http:\/\/viborg-sygeplejeskole\.dk\/images\/SignIn\.html/i
describe SS_PHISH_URL_07092001 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092001 0.001

# Email.Phishing.Url.Sanesecurity.07092400
rawbody  SS_PHISH_URL_07092400 /services, against any fraudulent actives\. Due to recent upgrade,/i
describe SS_PHISH_URL_07092400 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092400 0.001

# Email.Phishing.Url.Sanesecurity.07092401
rawbody  SS_PHISH_URL_07092401 /http:\/\/81\.215\.206\.51\/secureinfo\/index\.htm/i
describe SS_PHISH_URL_07092401 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092401 0.001

# Email.Phishing.Url.Sanesecurity.07092500
rawbody  SS_PHISH_URL_07092500 /http:\/\/citibanlonl\.com\//i
describe SS_PHISH_URL_07092500 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092500 0.001

# Email.Phishing.Url.Sanesecurity.07092501
rawbody  SS_PHISH_URL_07092501 /http:\/\/www\.update-measures\.com\//i
describe SS_PHISH_URL_07092501 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092501 0.001

# Email.Phishing.Url.Sanesecurity.07092502
rawbody  SS_PHISH_URL_07092502 /http:\/\/payluslpal\.com/i
describe SS_PHISH_URL_07092502 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092502 0.001

# Email.Phishing.Url.Sanesecurity.07092503
rawbody  SS_PHISH_URL_07092503 /http:\/\/www\.renew-online-info\.com/i
describe SS_PHISH_URL_07092503 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092503 0.001

# Email.Phishing.Url.Sanesecurity.07092504
rawbody  SS_PHISH_URL_07092504 /http:\/\/www\.updating-boa\.com/i
describe SS_PHISH_URL_07092504 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092504 0.001

# Email.Phishing.Url.Sanesecurity.07092505
rawbody  SS_PHISH_URL_07092505 /http:\/\/www\.bamkofamerica-online\.com/i
describe SS_PHISH_URL_07092505 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092505 0.001

# Email.Phishing.Url.Sanesecurity.07092506
rawbody  SS_PHISH_URL_07092506 /http:\/\/mail\.jerrylawyer\.com\/exchweb\/help\/usa\/ie5\/basics\/e\//i
describe SS_PHISH_URL_07092506 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092506 0.001

# Email.Phishing.Url.Sanesecurity.07092507
rawbody  SS_PHISH_URL_07092507 /http:\/\/www\.cgi27\.info\/pp\//i
describe SS_PHISH_URL_07092507 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092507 0.001

# Email.Phishing.Url.Sanesecurity.07092508
rawbody  SS_PHISH_URL_07092508 /http:\/\/www\.hotchat\.com\.ar\/chat\/appdata\/www\.halifax\.co\//i
describe SS_PHISH_URL_07092508 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092508 0.001

# Email.Phishing.Url.Sanesecurity.07092509
rawbody  SS_PHISH_URL_07092509 /http:\/\/mathx\.kaist\.ac\.kr\/zboard\/icon\/usbank\.html/i
describe SS_PHISH_URL_07092509 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092509 0.001

# Email.Phishing.Url.Sanesecurity.07092510
rawbody  SS_PHISH_URL_07092510 /http:\/\/www\.cnmd\.org\/bbs\/33\.swf\/militarybankonline\./i
describe SS_PHISH_URL_07092510 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092510 0.001

# Email.Phishing.Url.Sanesecurity.07092600
rawbody  SS_PHISH_URL_07092600 /http:\/\/allabouttennis\.net\/media\/secure\/letterApril2007\.php/i
describe SS_PHISH_URL_07092600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092600 0.001

# Email.Phishing.Url.Sanesecurity.07092601
rawbody  SS_PHISH_URL_07092601 /http:\/\/payispal\.com/i
describe SS_PHISH_URL_07092601 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092601 0.001

# Email.Phishing.Url.Sanesecurity.07092700
rawbody  SS_PHISH_URL_07092700 /http:\/\/bamkofamerlca0nllne\.com\/signon\.htm/i
describe SS_PHISH_URL_07092700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092700 0.001

# Email.Phishing.Url.Sanesecurity.07092701
rawbody  SS_PHISH_URL_07092701 /http:\/\/www\.myspacelay0uts\.com\/nationwide\.co\.uk\/login\.html/i
describe SS_PHISH_URL_07092701 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092701 0.001

# Email.Phishing.Url.Sanesecurity.07092702
rawbody  SS_PHISH_URL_07092702 /http:\/\/yana2012\.ru\/www\.paypal\.com\/secure\//i
describe SS_PHISH_URL_07092702 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092702 0.001

# Email.Phishing.Url.Sanesecurity.07092703
rawbody  SS_PHISH_URL_07092703 /http:\/\/vr-networld\.ibankid\.cn\/DEGCB\/JPS\/default/i
describe SS_PHISH_URL_07092703 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092703 0.001

# Email.Phishing.Url.Sanesecurity.07092704
rawbody  SS_PHISH_URL_07092704 /http:\/\/www\.airsealand-group\.com\.ar\/en\/images\/bankofamerica3\//i
describe SS_PHISH_URL_07092704 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092704 0.001

# Email.Phishing.Url.Sanesecurity.07092705
rawbody  SS_PHISH_URL_07092705 /http:\/\/www\.okbl\.com\/index\/web\.da-us\.citibank\.com\//i
describe SS_PHISH_URL_07092705 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092705 0.001

# Email.Phishing.Url.Sanesecurity.07092706
rawbody  SS_PHISH_URL_07092706 /http:\/\/www\.sastreydesastre\.com\.ar\/albums\/fotos2\/feedback\.php/i
describe SS_PHISH_URL_07092706 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092706 0.001

# Email.Phishing.Url.Sanesecurity.07092800
rawbody  SS_PHISH_URL_07092800 /http:\/\/www\.etradesc\.com/i
describe SS_PHISH_URL_07092800 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092800 0.001

# Email.Phishing.Url.Sanesecurity.07092801
rawbody  SS_PHISH_URL_07092801 /http:\/\/fjorden-rundt\.dk\/site\/images\/gallery\/thumbs\/det\.htm/i
describe SS_PHISH_URL_07092801 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07092801 0.001

# Email.Phishing.Url.Sanesecurity.07100100
rawbody  SS_PHISH_URL_07100100 /http:\/\/vesyegonsk\.ru\/modules\/rp5\/xml\/up\.ht/i
describe SS_PHISH_URL_07100100 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07100100 0.001

# Email.Phishing.Url.Sanesecurity.07100101
rawbody  SS_PHISH_URL_07100101 /http:\/\/kolo256\.com\/nationwide\.co\./i
describe SS_PHISH_URL_07100101 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07100101 0.001

# Email.Phishing.Url.Sanesecurity.07100102
rawbody  SS_PHISH_URL_07100102 /http:\/\/www\.eventzentrum\.com\/administrator\/components\/com_mamboxplorer\/_img\/data\//i
describe SS_PHISH_URL_07100102 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07100102 0.001

# Email.Phishing.Url.Sanesecurity.07100103
rawbody  SS_PHISH_URL_07100103 /http:\/\/www\.bikesportsimplon\.ch\/98_mambo\/cache\/index\.html/i
describe SS_PHISH_URL_07100103 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07100103 0.001

# Email.Phishing.Url.Sanesecurity.07100104
rawbody  SS_PHISH_URL_07100104 /http:\/\/paydpol\.com/i
describe SS_PHISH_URL_07100104 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07100104 0.001

# Email.Phishing.Url.Sanesecurity.07100105
rawbody  SS_PHISH_URL_07100105 /http:\/\/student\.lkpfc\.com\/news\/active\.html/i
describe SS_PHISH_URL_07100105 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07100105 0.001

# Email.Phishing.Url.Sanesecurity.07100106
rawbody  SS_PHISH_URL_07100106 /\/www\.makethebank\.com\//i
describe SS_PHISH_URL_07100106 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07100106 0.001

# Email.Phishing.Url.Sanesecurity.07100200
rawbody  SS_PHISH_URL_07100200 /http:\/\/paylaupal\.com/i
describe SS_PHISH_URL_07100200 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07100200 0.001

# Email.Phishing.Url.Sanesecurity.07100201
rawbody  SS_PHISH_URL_07100201 /http:\/\/bank-security\.com\/bankofamerica\/signon\.htm/i
describe SS_PHISH_URL_07100201 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07100201 0.001

# Email.Phishing.Url.Sanesecurity.07100202
rawbody  SS_PHISH_URL_07100202 /http:\/\/www\.wachqvia-as-443\.com\//i
describe SS_PHISH_URL_07100202 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07100202 0.001

# Email.Phishing.Url.Sanesecurity.07100500
rawbody  SS_PHISH_URL_07100500 /http:\/\/www\.security-paypal\.net\//i
describe SS_PHISH_URL_07100500 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07100500 0.001

# Email.Phishing.Url.Sanesecurity.07101000
rawbody  SS_PHISH_URL_07101000 /http:\/\/www\.langenachtderhotelbars\.ch\/html\/pubonline\/w\//i
describe SS_PHISH_URL_07101000 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07101000 0.001

# Email.Phishing.Url.Sanesecurity.07101001
rawbody  SS_PHISH_URL_07101001 /http:\/\/www\.etradedg\.com/i
describe SS_PHISH_URL_07101001 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07101001 0.001

# Email.Phishing.Url.Sanesecurity.07101002
rawbody  SS_PHISH_URL_07101002 /http:\/\/www\.andujar\.com\/cache\/online\.htm/i
describe SS_PHISH_URL_07101002 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07101002 0.001

# Email.Phishing.Url.Sanesecurity.07101600
rawbody  SS_PHISH_URL_07101600 /http:\/\/edmm\.ca\/images\/stories\/events\/be4\/PayPal\/index\.htm/i
describe SS_PHISH_URL_07101600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07101600 0.001

# Email.Phishing.Url.Sanesecurity.07101700
rawbody  SS_PHISH_URL_07101700 /http:\/\/abbeynational\.volksa\.cn\/cashman\/banking/i
describe SS_PHISH_URL_07101700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07101700 0.001

# Email.Phishing.Url.Sanesecurity.07102500
rawbody  SS_PHISH_URL_07102500 /http:\/\/www\.dangjinpa\.or\.kr\/bbs\/simba\/online\/wamu\/Logon\.html/i
describe SS_PHISH_URL_07102500 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07102500 0.001

# Email.Phishing.Url.Sanesecurity.07102501
rawbody  SS_PHISH_URL_07102501 /http:\/\/www\.acornglobal-eks\.com\/up\.htm/i
describe SS_PHISH_URL_07102501 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07102501 0.001

# Email.Phishing.Url.Sanesecurity.07102502
rawbody  SS_PHISH_URL_07102502 /http:\/\/210\.118\.80\.41\/citibank\/onlinebanking\/login\.htm/i
describe SS_PHISH_URL_07102502 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07102502 0.001

# Email.Phishing.Url.Sanesecurity.07102503
rawbody  SS_PHISH_URL_07102503 /http:\/\/210\.123\.142\.134\/citibank\/onlinebanking\//i
describe SS_PHISH_URL_07102503 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07102503 0.001

# Email.Phishing.Url.Sanesecurity.07102504
rawbody  SS_PHISH_URL_07102504 /http:\/\/d4ok\.normandie\.free\.fr\/modules\/coppermine\/themes\/default\/Login\.html/i
describe SS_PHISH_URL_07102504 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07102504 0.001

# Email.Phishing.Url.Sanesecurity.07102505
rawbody  SS_PHISH_URL_07102505 /http:\/\/www\.alester\.se\/help\/online\.php/i
describe SS_PHISH_URL_07102505 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07102505 0.001

# Email.Phishing.Url.Sanesecurity.07102506
rawbody  SS_PHISH_URL_07102506 /http:\/\/frogking2\.free\.fr\/components\/com_joomlalib\/index\.html/i
describe SS_PHISH_URL_07102506 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07102506 0.001

# Email.Phishing.Url.Sanesecurity.07102507
rawbody  SS_PHISH_URL_07102507 /http:\/\/d10668495\.u107\.surftown\.com\/app\/login\.php/i
describe SS_PHISH_URL_07102507 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07102507 0.001

# Email.Phishing.Url.Sanesecurity.07102508
rawbody  SS_PHISH_URL_07102508 /http:\/\/lycreative\.dardasha\.ps\/login\/www1\.paypal\.com\//i
describe SS_PHISH_URL_07102508 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07102508 0.001

# Email.Phishing.Url.Sanesecurity.07102600
rawbody  SS_PHISH_URL_07102600 /http:\/\/session03094009-natwest\.co\.uk\./i
describe SS_PHISH_URL_07102600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07102600 0.001

# Email.Phishing.Url.Sanesecurity.07102601
rawbody  SS_PHISH_URL_07102601 /http:\/\/www\.lloydstsb\.diy6\.info\/index\.html/i
describe SS_PHISH_URL_07102601 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07102601 0.001

# Email.Phishing.Url.Sanesecurity.07102602
rawbody  SS_PHISH_URL_07102602 /http:\/\/www\.pastrugni\.com\/online\/\.x\/paypall\/cmd=_remove-limitations\.html/i
describe SS_PHISH_URL_07102602 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07102602 0.001

# Email.Phishing.Url.Sanesecurity.07102603
rawbody  SS_PHISH_URL_07102603 /http:\/\/www\.i-ncua-admnistraton-logn\.com\.p12\.hostingprod\.com\//i
describe SS_PHISH_URL_07102603 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07102603 0.001

# Email.Phishing.Url.Sanesecurity.07102700
rawbody  SS_PHISH_URL_07102700 /http:\/\/217\.56\.89\.229/i
describe SS_PHISH_URL_07102700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07102700 0.001

# Email.Phishing.Url.Sanesecurity.07102800
rawbody  SS_PHISH_URL_07102800 /http:\/\/www\.axiome-informatique\.fr\/images\/banners\/\.server\/\.redirect\.to\/index\.php/i
describe SS_PHISH_URL_07102800 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07102800 0.001

# Email.Phishing.Url.Sanesecurity.07103000
rawbody  SS_PHISH_URL_07103000 /http:\/\/www\.tcum\.org\/staff\/email\/inc\/irs\/index\.html/i
describe SS_PHISH_URL_07103000 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07103000 0.001

# Email.Phishing.Url.Sanesecurity.07103001
rawbody  SS_PHISH_URL_07103001 /http:\/\/www\.kiogle\.com\/cscu\.org\/index\.php/i
describe SS_PHISH_URL_07103001 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07103001 0.001

# Email.Phishing.Url.Sanesecurity.07110200
rawbody  SS_PHISH_URL_07110200 /http:\/\/home\.graffiti\.net\/backpackplace\/aboutus\.html/i
describe SS_PHISH_URL_07110200 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07110200 0.001

# Email.Phishing.Url.Sanesecurity.07112200
rawbody  SS_PHISH_URL_07112200 /http:\/\/www\.paypal\.com\.cmd-login\.com\/cgi-bin\//i
describe SS_PHISH_URL_07112200 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07112200 0.001

# Email.Phishing.Url.Sanesecurity.07112600
rawbody  SS_PHISH_URL_07112600 /http:\/\/capitaloneonline-signin\.com/i
describe SS_PHISH_URL_07112600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07112600 0.001

# Email.Phishing.Url.Sanesecurity.07112800
rawbody  SS_PHISH_URL_07112800 /http:\/\/amsalarm\.com\/users\/test\/www\.paypal\.com\//i
describe SS_PHISH_URL_07112800 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07112800 0.001

# Email.Phishing.Url.Sanesecurity.07122800
rawbody  SS_PHISH_URL_07122800 /http:\/\/75\.182\.9\.26/i
describe SS_PHISH_URL_07122800 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_07122800 0.001

# Email.Phishing.Url.Sanesecurity.08010200
rawbody  SS_PHISH_URL_08010200 /http:\/\/61\.245\.85\.209\.er\.eaccess\.ne\.jp\/\.\%20\/redir\.php/i
describe SS_PHISH_URL_08010200 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08010200 0.001

# Email.Phishing.Url.Sanesecurity.08010201
rawbody  SS_PHISH_URL_08010201 /http:\/\/nfu\.fr\/https:\/\/oi\.cajamadrid\.es\//i
describe SS_PHISH_URL_08010201 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08010201 0.001

# Email.Phishing.Url.Sanesecurity.08010202
rawbody  SS_PHISH_URL_08010202 /http:\/\/58\.151\.22\.250:180\/www2\.bancadiroma\.it\//i
describe SS_PHISH_URL_08010202 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08010202 0.001

# Email.Phishing.Url.Sanesecurity.08010800
rawbody  SS_PHISH_URL_08010800 /\/\.-\/newdir59\/us\/cgi-bin\/webscr\.htm/i
describe SS_PHISH_URL_08010800 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08010800 0.001

# Email.Phishing.Url.Sanesecurity.08010800
rawbody  SS_PHISH_URL_08010800 /http:\/\/www\.minored\.com\/\/cubopublico\/inc\/ebay\/SignIn\.html/i
describe SS_PHISH_URL_08010800 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08010800 0.001

# Email.Phishing.Url.Sanesecurity.08012400
rawbody  SS_PHISH_URL_08012400 /http:\/\/www\.dnp\.go\.th\/train\/classes\/adodbt\/news\.htm/i
describe SS_PHISH_URL_08012400 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08012400 0.001

# Email.Phishing.Url.Sanesecurity.08012500
rawbody  SS_PHISH_URL_08012500 /\/67\.15\.124\.224\/~test123\/9pp9\/index\.html/i
describe SS_PHISH_URL_08012500 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08012500 0.001

# Email.Phishing.Url.Sanesecurity.08020600
rawbody  SS_PHISH_URL_08020600 /http:\/\/202\.67\.230\.199\/citifi\/scripts\/login2\/index\.html/i
describe SS_PHISH_URL_08020600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08020600 0.001

# Email.Phishing.Url.Sanesecurity.08021800
rawbody  SS_PHISH_URL_08021800 /http:\/\/202\.38\.57\.121\/citibank\.com\/login\.htm\?ID=3D098327YGFUBWN/i
describe SS_PHISH_URL_08021800 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08021800 0.001

# Email.Phishing.Url.Sanesecurity.08022900
rawbody  SS_PHISH_URL_08022900 /\/icons\/online\.banca\.di\.roma\//i
describe SS_PHISH_URL_08022900 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08022900 0.001

# Email.Phishing.Url.Sanesecurity.08031700
rawbody  SS_PHISH_URL_08031700 /http:\/\/halifax-onlines\.com\/secure-account\//i
describe SS_PHISH_URL_08031700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08031700 0.001

# Email.Phishing.Url.Sanesecurity.08032500
rawbody  SS_PHISH_URL_08032500 /http:\/\/business\.hsbc\.com\./i
describe SS_PHISH_URL_08032500 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08032500 0.001

# Email.Phishing.Url.Sanesecurity.08032600
rawbody  SS_PHISH_URL_08032600 /http:\/\/gentsproductions\.com\.au\/web\.da-us\.citibank\.com\//i
describe SS_PHISH_URL_08032600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08032600 0.001

# Email.Phishing.Url.Sanesecurity.08041400
rawbody  SS_PHISH_URL_08041400 /http:\/\/78\.153\.252\.30\/~webscrcm\/images\/1\/2\/personal\/internet-banking/i
describe SS_PHISH_URL_08041400 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08041400 0.001

# Email.Phishing.Url.Sanesecurity.08041600
rawbody  SS_PHISH_URL_08041600 /http:\/\/halifax-onlines\.com\/halifax/i
describe SS_PHISH_URL_08041600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08041600 0.001

# Email.Phishing.Url.Sanesecurity.08041601
rawbody  SS_PHISH_URL_08041601 /http:\/\/giant\.suanet\.ac\.tz\/www\.ebay\.com\//i
describe SS_PHISH_URL_08041601 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08041601 0.001

# Email.Phishing.Url.Sanesecurity.08042200
rawbody  SS_PHISH_URL_08042200 /http:\/\/connect\.colonialbank\.webbizCompany\./i
describe SS_PHISH_URL_08042200 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08042200 0.001

# Email.Phishing.Url.Sanesecurity.08051600
rawbody  SS_PHISH_URL_08051600 /http:\/\/srvanti\.must\.edu\.tw:10010\//i
describe SS_PHISH_URL_08051600 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08051600 0.001

# Email.Phishing.Url.Sanesecurity.08052700
rawbody  SS_PHISH_URL_08052700 /http:\/\/bruno\.amann\.club\.fr\/ba\/1\.3\.x\/classes\/Login\.html/i
describe SS_PHISH_URL_08052700 SaneSecurity: Text-based file with phishing URL
score    SS_PHISH_URL_08052700 0.001

# Html.Phishing.Dca.Gen001.Sanesecurity.06052900
body     SS_PHISH_DCA_G001_06052900 /http:\/\/ad\.doubleclick\.net\/clk.{0,30}http:\/\/www\.paypal\.com\./i
describe SS_PHISH_DCA_G001_06052900 SaneSecurity: HTML-based DoubleClick revenue link
score    SS_PHISH_DCA_G001_06052900 0.001

# Email.Phishing.Dca.Gen002.Sanesecurity.06052901
rawbody  SS_PHISH_DCA_G002_06052901 /http:\/\/ad\.doubleclick\.net\/clk.{0,30}http:\/\/www=\x0d\x0apaypal\.com\./i
describe SS_PHISH_DCA_G002_06052901 SaneSecurity: Text-based DoubleClick revenue link
score    SS_PHISH_DCA_G002_06052901 0.001

# Html.Phishing.Nam.Gen001.Sanesecurity.06061300
body     SS_PHISH_NAM_G001_06061300 /\/js\/pp_main\.js"><\/script><meta name="generator" content="namo webeditor v5\.0\(trial\)/i
describe SS_PHISH_NAM_G001_06061300 SaneSecurity: HTML-based common fake HTML editor
score    SS_PHISH_NAM_G001_06061300 0.001

# Html.Phishing.Nam.Gen002.Sanesecurity.06061301
body     SS_PHISH_NAM_G002_06061301 /ibank\.css"><meta name="generator" content="namo webeditor v6\.0\(trial\)/i
describe SS_PHISH_NAM_G002_06061301 SaneSecurity: HTML-based common fake HTML editor
score    SS_PHISH_NAM_G002_06061301 0.001

# Html.Phishing.Nam.Gen003.Sanesecurity.06061302
body     SS_PHISH_NAM_G003_06061302 /verification<\/title><meta name="generator" content="namo webeditor v5\.0\(trial\)/i
describe SS_PHISH_NAM_G003_06061302 SaneSecurity: HTML-based common fake HTML editor
score    SS_PHISH_NAM_G003_06061302 0.001

# Html.Phishing.Wrd.Gen001.Sanesecurity.06082300
body     SS_PHISH_WRD_G001_06082300 /<meta name=generator content="microsoft word 11 \(filtered\)"><title>activate with paypal mobile - you could be a winner<\/title>/i
describe SS_PHISH_WRD_G001_06082300 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_WRD_G001_06082300 0.001

# Html.Phishing.Auction.Gen001.Sanesecurity.06012900
rawbody  SS_PHISH_AUCT_G001_06012900 /Dear ebay member,/i
describe SS_PHISH_AUCT_G001_06012900 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G001_06012900 0.001

# Html.Phishing.Auction.Gen002.Sanesecurity.06012901
rawbody  SS_PHISH_AUCT_G002_06012901 /<br>Dear eBay User,/i
describe SS_PHISH_AUCT_G002_06012901 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G002_06012901 0.001

# Html.Phishing.Auction.Gen003.Sanesecurity.06012902
rawbody  SS_PHISH_AUCT_G003_06012902 /Dear eBay Valued Customer/i
describe SS_PHISH_AUCT_G003_06012902 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G003_06012902 0.001

# Email.Phishing.Auction.Gen004.Sanesecurity.06012903
rawbody  SS_PHISH_AUCT_G004_06012903 />Dear eBay member,/i
describe SS_PHISH_AUCT_G004_06012903 SaneSecurity: Text-based eBay phish
score    SS_PHISH_AUCT_G004_06012903 0.001

# Html.Phishing.Auction.Gen005.Sanesecurity.06012904
rawbody  SS_PHISH_AUCT_G005_06012904 /Dear eBay User/i
describe SS_PHISH_AUCT_G005_06012904 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G005_06012904 0.001

# Html.Phishing.Auction.Gen006.Sanesecurity.06013100
body     SS_PHISH_AUCT_G006_06013100 />ebay sent this message to an ebay valued member/i
describe SS_PHISH_AUCT_G006_06013100 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G006_06013100 0.001

# Html.Phishing.Auction.Gen007.Sanesecurity.06013101
rawbody  SS_PHISH_AUCT_G007_06013101 /size=1><B>eBay sent this message to you<\/B><BR>Your registered name is included/i
describe SS_PHISH_AUCT_G007_06013101 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G007_06013101 0.001

# Html.Phishing.Auction.Gen008.Sanesecurity.06020101
rawbody  SS_PHISH_AUCT_G008_06020101 /ize=2>Dear eBay user, <\/FONT>/i
describe SS_PHISH_AUCT_G008_06020101 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G008_06020101 0.001

# Html.Phishing.Auction.Gen010.Sanesecurity.06020102
body     SS_PHISH_AUCT_G010_06020102 /ebay sent this messageo ebay/i
describe SS_PHISH_AUCT_G010_06020102 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G010_06020102 0.001

# Html.Phishing.Auction.Gen011.Sanesecurity.06020103
body     SS_PHISH_AUCT_G011_06020103 /ebay sent this message to ebay/i
describe SS_PHISH_AUCT_G011_06020103 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G011_06020103 0.001

# Html.Phishing.Auction.Gen012.Sanesecurity.06020104
body     SS_PHISH_AUCT_G012_06020104 /ebay sent this message to you/i
describe SS_PHISH_AUCT_G012_06020104 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G012_06020104 0.001

# Html.Phishing.Auction.Gen013.Sanesecurity.06020105
body     SS_PHISH_AUCT_G013_06020105 /ebay sent this message an ebay/i
describe SS_PHISH_AUCT_G013_06020105 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G013_06020105 0.001

# Html.Phishing.Auction.Gen014.Sanesecurity.06020106
body     SS_PHISH_AUCT_G014_06020106 /ebay sent this message member of/i
describe SS_PHISH_AUCT_G014_06020106 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G014_06020106 0.001

# Html.Phishing.Auction.Gen015.Sanesecurity.06020107
body     SS_PHISH_AUCT_G015_06020107 /ebay sent this!/i
describe SS_PHISH_AUCT_G015_06020107 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G015_06020107 0.001

# Html.Phishing.Auction.Gen016.Sanesecurity.06020503
body     SS_PHISH_AUCT_G016_06020503 /<b>ebay sent this message from/i
describe SS_PHISH_AUCT_G016_06020503 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G016_06020503 0.001

# Html.Phishing.Auction.Gen017.Sanesecurity.06020800
body     SS_PHISH_AUCT_G017_06020800 /hello valued ebay member/i
describe SS_PHISH_AUCT_G017_06020800 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G017_06020800 0.001

# Html.Phishing.Auction.Gen018.Sanesecurity.06020801
body     SS_PHISH_AUCT_G018_06020801 /logon with your ebay user id and password/i
describe SS_PHISH_AUCT_G018_06020801 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G018_06020801 0.001

# Html.Phishing.Auction.Gen019.Sanesecurity.06021300
rawbody  SS_PHISH_AUCT_G019_06021300 /X-Account-Key: account.{0,50}Return-Path:.{0,50}ebay\.com/i
describe SS_PHISH_AUCT_G019_06021300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G019_06021300 0.001

# Html.Phishing.Auction.Gen020.Sanesecurity.06022200
rawbody  SS_PHISH_AUCT_G020_06022200 /\&\#117\;\&\#110\;\&\#116\; \&\#108\;\&\#105\;\&\#109\;.{0,60}\&\#105\;\&\#116\;\&\#97\;\&\#116\;\&\#105\;\&\#111\;\&\#110\;\&\#115\; \&\#115\;.{0,60}\&\#110\;\&\#105\;\&\#110\; \&\#97\;\&\#110\;\&\#100\; \&\#99\;\&\#111\;/i
describe SS_PHISH_AUCT_G020_06022200 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G020_06022200 0.001

# Html.Phishing.Auction.Gen021.Sanesecurity.06022200
body     SS_PHISH_AUCT_G021_06022200 /<strong>dear ebay member,<\/strong>/i
describe SS_PHISH_AUCT_G021_06022200 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G021_06022200 0.001

# Html.Phishing.Auction.Gen022.Sanesecurity.06022600
body     SS_PHISH_AUCT_G022_06022600 /dear ebay member ,/i
describe SS_PHISH_AUCT_G022_06022600 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G022_06022600 0.001

# Html.Phishing.Auction.Gen023.Sanesecurity.06022601
rawbody  SS_PHISH_AUCT_G023_06022601 /<strong>Dear eBay member , you have received an Unpaid Item/i
describe SS_PHISH_AUCT_G023_06022601 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G023_06022601 0.001

# Html.Phishing.Auction.Gen024.Sanesecurity.06022700
body     SS_PHISH_AUCT_G024_06022700 />dear ebay customer ,/i
describe SS_PHISH_AUCT_G024_06022700 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G024_06022700 0.001

# Html.Phishing.Auction.Gen025.Sanesecurity.06022701
body     SS_PHISH_AUCT_G025_06022701 /this ebay notice was sent to kvnmtchll200\@aol\.com on behalf of another ebay member/i
describe SS_PHISH_AUCT_G025_06022701 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G025_06022701 0.001

# Html.Phishing.Auction.Gen026.Sanesecurity.06022800
rawbody  SS_PHISH_AUCT_G026_06022800 />Dear <STRONG>e<VECTOR>B<VECTOR>a<VECTOR>y<VECTOR> Cu<VECTOR>st<VECTOR>om<VECTOR>er<VECTOR> <\/STRONG>,\x0d\x0a/i
describe SS_PHISH_AUCT_G026_06022800 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G026_06022800 0.001

# Html.Phishing.Auction.Gen027.Sanesecurity.06022801
body     SS_PHISH_AUCT_G027_06022801 /ebay sent this message to jo you/i
describe SS_PHISH_AUCT_G027_06022801 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G027_06022801 0.001

# Html.Phishing.Auction.Gen028.Sanesecurity.06030100
rawbody  SS_PHISH_AUCT_G028_06030100 /<P>Enter the numbers shown below for security purposes:<BR><STRONG><IMG height=25 src="http:\/\/images\.google\.com\/images\?q=/i
describe SS_PHISH_AUCT_G028_06030100 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G028_06030100 0.001

# Html.Phishing.Auction.Gen029.Sanesecurity.06030200
body     SS_PHISH_AUCT_G029_06030200 /please respond by.{0,15}so ebay knows whether you have agreed\./i
describe SS_PHISH_AUCT_G029_06030200 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G029_06030200 0.001

# Html.Phishing.Auction.Gen030.Sanesecurity.06030500
body     SS_PHISH_AUCT_G030_06030500 /dear ebay bember:/i
describe SS_PHISH_AUCT_G030_06030500 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G030_06030500 0.001

# Html.Phishing.Auction.Gen032.Sanesecurity.06030502
body     SS_PHISH_AUCT_G032_06030502 /img alt="respond to this notification" src/i
describe SS_PHISH_AUCT_G032_06030502 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G032_06030502 0.001

# Html.Phishing.Auction.Gen034.Sanesecurity.06030803
body     SS_PHISH_AUCT_G034_06030803 /result in account termination, cancelation of service, terms of service/i
describe SS_PHISH_AUCT_G034_06030803 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G034_06030803 0.001

# Html.Phishing.Auction.Gen035.Sanesecurity.06030804
body     SS_PHISH_AUCT_G035_06030804 /minutes out of your online experience/i
describe SS_PHISH_AUCT_G035_06030804 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G035_06030804 0.001

# Html.Phishing.Auction.Gen036.Sanesecurity.06030805
body     SS_PHISH_AUCT_G036_06030805 /ebay sent this message\.<\/b><br>your registered name/i
describe SS_PHISH_AUCT_G036_06030805 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G036_06030805 0.001

# Html.Phishing.Auction.Gen037.Sanesecurity.06030806
body     SS_PHISH_AUCT_G037_06030806 /dear <strong>ebay member<\/strong>/i
describe SS_PHISH_AUCT_G037_06030806 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G037_06030806 0.001

# Html.Phishing.Auction.Gen038.Sanesecurity.06030807
body     SS_PHISH_AUCT_G038_06030807 />dear <strong>ebay<\/strong>,/i
describe SS_PHISH_AUCT_G038_06030807 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G038_06030807 0.001

# Html.Phishing.Auction.Gen039.Sanesecurity.06030808
body     SS_PHISH_AUCT_G039_06030808 /dear <strong>e<vector>b<vector>a<vector>y<vector>/i
describe SS_PHISH_AUCT_G039_06030808 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G039_06030808 0.001

# Html.Phishing.Auction.Gen040.Sanesecurity.06030809
body     SS_PHISH_AUCT_G040_06030809 /dear <strong>ebay\.com<\/strong> member/i
describe SS_PHISH_AUCT_G040_06030809 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G040_06030809 0.001

# Html.Phishing.Auction.Gen041.Sanesecurity.06030810
rawbody  SS_PHISH_AUCT_G041_06030810 /<p align="left"><font face="Verdana" size="2">Dear <strong>eBay\.com<\/strong> Member ,/i
describe SS_PHISH_AUCT_G041_06030810 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G041_06030810 0.001

# Html.Phishing.Auction.Gen042.Sanesecurity.06030811
rawbody  SS_PHISH_AUCT_G042_06030811 />Dear <STRONG>e<VECTOR>B<VECTOR>a<VECTOR>y<VECTOR> Cu<VECTOR>st<VECTOR>om<VECTOR>er<VECTOR> <\/STRONG>,/i
describe SS_PHISH_AUCT_G042_06030811 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G042_06030811 0.001

# Html.Phishing.Auction.Gen043.Sanesecurity.06030812
body     SS_PHISH_AUCT_G043_06030812 /you have received this email because you or someone else had used your/i
describe SS_PHISH_AUCT_G043_06030812 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G043_06030812 0.001

# Html.Phishing.Auction.Gen044.Sanesecurity.06030813
body     SS_PHISH_AUCT_G044_06030813 /dear ebay member,<br>/i
describe SS_PHISH_AUCT_G044_06030813 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G044_06030813 0.001

# Html.Phishing.Auction.Gen045.Sanesecurity.06030814
body     SS_PHISH_AUCT_G045_06030814 /account could be suspended if you don't resolve your problems/i
describe SS_PHISH_AUCT_G045_06030814 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G045_06030814 0.001

# Html.Phishing.Auction.Gen046.Sanesecurity.06030815
body     SS_PHISH_AUCT_G046_06030815 /due to recent activity, including possible unauthorized listings, we have temporarily suspended/i
describe SS_PHISH_AUCT_G046_06030815 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G046_06030815 0.001

# Html.Phishing.Auction.Gen047.Sanesecurity.06030816
body     SS_PHISH_AUCT_G047_06030816 /<table cellspacing=0 cellpadding=2 width="100\%" border=0><tbody><tr><td><font face="verdana, sans-serif" color=\#666666 size=1>your registered name is included to show this message originated from ebay\. /i
describe SS_PHISH_AUCT_G047_06030816 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G047_06030816 0.001

# Html.Phishing.Auction.Gen048.Sanesecurity.06030817
body     SS_PHISH_AUCT_G048_06030817 /could be suspended if you don't re-update your account information/i
describe SS_PHISH_AUCT_G048_06030817 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G048_06030817 0.001

# Html.Phishing.Auction.Gen049.Sanesecurity.06030900
body     SS_PHISH_AUCT_G049_06030900 /<div>dear ebay member:.{0,20}<div>please be advised that your ebay fees of/i
describe SS_PHISH_AUCT_G049_06030900 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G049_06030900 0.001

# Html.Phishing.Auction.Gen050.Sanesecurity.06030901
body     SS_PHISH_AUCT_G050_06030901 /\/><strong>your registered email address is included to show this message originated from ebay/i
describe SS_PHISH_AUCT_G050_06030901 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G050_06030901 0.001

# Html.Phishing.Auction.Gen051.Sanesecurity.06030902
body     SS_PHISH_AUCT_G051_06030902 /dear <strong>ebay <\/strong>member/i
describe SS_PHISH_AUCT_G051_06030902 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G051_06030902 0.001

# Html.Phishing.Auction.Gen052.Sanesecurity.06030903
body     SS_PHISH_AUCT_G052_06030903 /your credit card will normally be charged 5 to 7 days after you receive your invoice\. enter and submit the required information\. your account may be suspended/i
describe SS_PHISH_AUCT_G052_06030903 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G052_06030903 0.001

# Html.Phishing.Auction.Gen053.Sanesecurity.06031000
body     SS_PHISH_AUCT_G053_06031000 /ebay notice was sent from member\@ebay\.com/i
describe SS_PHISH_AUCT_G053_06031000 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G053_06031000 0.001

# Html.Phishing.Auction.Gen054.Sanesecurity.06031001
body     SS_PHISH_AUCT_G054_06031001 /message originated from ebay\. <a href="http:\/\/rds\.yahoo\.com\/_/i
describe SS_PHISH_AUCT_G054_06031001 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G054_06031001 0.001

# Html.Phishing.Auction.Gen055.Sanesecurity.06031002
body     SS_PHISH_AUCT_G055_06031002 /account active, click here.{0,30}http:\/\/rds\.yahoo\.com\/_/i
describe SS_PHISH_AUCT_G055_06031002 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G055_06031002 0.001

# Html.Phishing.Auction.Gen056.Sanesecurity.06031300
body     SS_PHISH_AUCT_G056_06031300 /is constantly working to ensure security by regularly screening the accounts in our system\. we recently reviewed your account, and we need more information/i
describe SS_PHISH_AUCT_G056_06031300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G056_06031300 0.001

# Html.Phishing.Auction.Gen057.Sanesecurity.06031400
body     SS_PHISH_AUCT_G057_06031400 /dear ebay customer!/i
describe SS_PHISH_AUCT_G057_06031400 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G057_06031400 0.001

# Html.Phishing.Auction.Gen058.Sanesecurity.06031401
body     SS_PHISH_AUCT_G058_06031401 /required to open an investigation into this matter\.to help speed up this process, please access the following form to complete the verification of your/i
describe SS_PHISH_AUCT_G058_06031401 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G058_06031401 0.001

# Html.Phishing.Auction.Gen059.Sanesecurity.06031500
body     SS_PHISH_AUCT_G059_06031500 /confirm my account information and continue beeing a member of the a/i
describe SS_PHISH_AUCT_G059_06031500 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G059_06031500 0.001

# Html.Phishing.Auction.Gen060.Sanesecurity.06031501
body     SS_PHISH_AUCT_G060_06031501 /password bruteforcing attems were performed on your /i
describe SS_PHISH_AUCT_G060_06031501 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G060_06031501 0.001

# Html.Phishing.Auction.Gen061.Sanesecurity.06031502
body     SS_PHISH_AUCT_G061_06031502 /reviewed your account, and we need more information to help us provide you with secure service/i
describe SS_PHISH_AUCT_G061_06031502 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G061_06031502 0.001

# Html.Phishing.Auction.Gen062.Sanesecurity.06031503
body     SS_PHISH_AUCT_G062_06031503 /http:\/\/signin\.ebay\.com\..{0,20}\.tk\/signin\.php/i
describe SS_PHISH_AUCT_G062_06031503 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G062_06031503 0.001

# Html.Phishing.Auction.Gen063.Sanesecurity.06031700
body     SS_PHISH_AUCT_G063_06031700 />dear ebay memeber/i
describe SS_PHISH_AUCT_G063_06031700 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G063_06031700 0.001

# Html.Phishing.Auction.Gen064.Sanesecurity.06031800
body     SS_PHISH_AUCT_G064_06031800 />\*\*\*this is an automatically generated email\. please do not reply\.\*\*\*<br><br><br>we regret to inform you that your ebay account has been suspended due <br>/i
describe SS_PHISH_AUCT_G064_06031800 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G064_06031800 0.001

# Html.Phishing.Auction.Gen065.Sanesecurity.06031900
body     SS_PHISH_AUCT_G065_06031900 /to help speed up this process, please access the following form to complete the verification of your ebay account registration informations/i
describe SS_PHISH_AUCT_G065_06031900 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G065_06031900 0.001

# Html.Phishing.Auction.Gen066.Sanesecurity.06031901
body     SS_PHISH_AUCT_G066_06031901 /you have recieved this email because you or someone had used your account/i
describe SS_PHISH_AUCT_G066_06031901 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G066_06031901 0.001

# Html.Phishing.Auction.Gen068.Sanesecurity.06031903
body     SS_PHISH_AUCT_G068_06031903 /<strong>ebay sent this message to\&nbsp\;you<\/strong>/i
describe SS_PHISH_AUCT_G068_06031903 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G068_06031903 0.001

# Html.Phishing.Auction.Gen069.Sanesecurity.06031903
body     SS_PHISH_AUCT_G069_06031903 /<html><body><center><a href="http:\/\/.{300,310}\.gif" border="0" alt=""><\/a><\/center><\/body><\/html>/i
describe SS_PHISH_AUCT_G069_06031903 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G069_06031903 0.001

# Html.Phishing.Auction.Gen070.Sanesecurity.06032300
body     SS_PHISH_AUCT_G070_06032300 /if your account information.{0,80}then we will assume this account is fraudulent and will be suspended/i
describe SS_PHISH_AUCT_G070_06032300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G070_06032300 0.001

# Html.Phishing.Auction.Gen071.Sanesecurity.06032301
body     SS_PHISH_AUCT_G071_06032301 />if your account informations are not updated within the next 72 hours, then we will assume this account is fraudulent/i
describe SS_PHISH_AUCT_G071_06032301 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G071_06032301 0.001

# Html.Phishing.Auction.Gen072.Sanesecurity.06032302
body     SS_PHISH_AUCT_G072_06032302 /> if your account informations are not updated within the next 72 hours, then we will assume this account is fraudulent/i
describe SS_PHISH_AUCT_G072_06032302 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G072_06032302 0.001

# Html.Phishing.Auction.Gen073.Sanesecurity.06032303
body     SS_PHISH_AUCT_G073_06032303 /> if your account informations is not updated within the next 72 hours, then we will assume this account is fraudulent/i
describe SS_PHISH_AUCT_G073_06032303 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G073_06032303 0.001

# Html.Phishing.Auction.Gen074.Sanesecurity.06032304
body     SS_PHISH_AUCT_G074_06032304 />if your account informations is not updated within the next 72 hours, then we will assume this account is fraudulent/i
describe SS_PHISH_AUCT_G074_06032304 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G074_06032304 0.001

# Html.Phishing.Auction.Gen075.Sanesecurity.06032400
body     SS_PHISH_AUCT_G075_06032400 /<br>to confirm your identity with us click here:<br>/i
describe SS_PHISH_AUCT_G075_06032400 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G075_06032400 0.001

# Html.Phishing.Auction.Gen076.Sanesecurity.06032401
body     SS_PHISH_AUCT_G076_06032401 /to speed up this process, you are required to verify your personal information<br>against the account registration data we have on file by following the link below\.<br>/i
describe SS_PHISH_AUCT_G076_06032401 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G076_06032401 0.001

# Html.Phishing.Auction.Gen077.Sanesecurity.06032402
body     SS_PHISH_AUCT_G077_06032402 />dear ebay user:<br><br><br>we regret to inform you that your ebay account has been suspended due<br>to concerns we have for the safety and integrity of the ebay community\./i
describe SS_PHISH_AUCT_G077_06032402 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G077_06032402 0.001

# Email.Phishing.Auction.Gen078.Sanesecurity.06032600
rawbody  SS_PHISH_AUCT_G078_06032600 /Clinck on the following link/i
describe SS_PHISH_AUCT_G078_06032600 SaneSecurity: Text-based eBay phish
score    SS_PHISH_AUCT_G078_06032600 0.001

# Email.Phishing.Auction.Gen079.Sanesecurity.06032601
rawbody  SS_PHISH_AUCT_G079_06032601 /Hello eBay member,/i
describe SS_PHISH_AUCT_G079_06032601 SaneSecurity: Text-based eBay phish
score    SS_PHISH_AUCT_G079_06032601 0.001

# Html.Phishing.Auction.Gen080.Sanesecurity.06032700
body     SS_PHISH_AUCT_G080_06032700 /ebay sent this message for the following reason/i
describe SS_PHISH_AUCT_G080_06032700 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G080_06032700 0.001

# Html.Phishing.Auction.Gen081.Sanesecurity.06032701
body     SS_PHISH_AUCT_G081_06032701 />to update your record please click here:/i
describe SS_PHISH_AUCT_G081_06032701 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G081_06032701 0.001

# Html.Phishing.Auction.Gen082.Sanesecurity.06032800
body     SS_PHISH_AUCT_G082_06032800 /most unpaid item disputes can be resolved through direct communicatio! n between the buyer and seller/i
describe SS_PHISH_AUCT_G082_06032800 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G082_06032800 0.001

# Html.Phishing.Auction.Gen083.Sanesecurity.06032801
body     SS_PHISH_AUCT_G083_06032801 /the billing information of your account\. we would appreciate it if you<br>would visit our ebay billing center and fill out the proper<br>information that we are needing to keep you as an ebay member/i
describe SS_PHISH_AUCT_G083_06032801 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G083_06032801 0.001

# Html.Phishing.Auction.Gen084.Sanesecurity.06032802
body     SS_PHISH_AUCT_G084_06032802 /<a href="http:\/\/www\.ebay\.com\/"><table><tr><td><!-- modify the link here --><a href="http:\/\//i
describe SS_PHISH_AUCT_G084_06032802 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G084_06032802 0.001

# Html.Phishing.Auction.Gen085.Sanesecurity.06032900
body     SS_PHISH_AUCT_G085_06032900 /it has come to our attention that your ebay billing updates are out of order\. if you could please take/i
describe SS_PHISH_AUCT_G085_06032900 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G085_06032900 0.001

# Html.Phishing.Auction.Gen086.Sanesecurity.06033000
body     SS_PHISH_AUCT_G086_06033000 /<b>ebay sent this message to member of ebay <\/b><br>your registered name/i
describe SS_PHISH_AUCT_G086_06033000 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G086_06033000 0.001

# Html.Phishing.Auction.Gen087u.Sanesecurity.06033001
body     SS_PHISH_AUCT_G087U_06033001 /\/\.signin\.ebay\.com\//i
describe SS_PHISH_AUCT_G087U_06033001 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G087U_06033001 0.001

# Html.Phishing.Auction.Gen088u.Sanesecurity.06033002
body     SS_PHISH_AUCT_G088U_06033002 /\/\.\.\.\/signin\.ebay\.com\//i
describe SS_PHISH_AUCT_G088U_06033002 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G088U_06033002 0.001

# Html.Phishing.Auction.Gen089u.Sanesecurity.06033003
body     SS_PHISH_AUCT_G089U_06033003 /\/\.www\.ebay\.com\//i
describe SS_PHISH_AUCT_G089U_06033003 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G089U_06033003 0.001

# Html.Phishing.Auction.Gen090.Sanesecurity.06040203
body     SS_PHISH_AUCT_G090_06040203 /this email was sent automatically by the ebay server because your ebay account can be deactivated/i
describe SS_PHISH_AUCT_G090_06040203 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G090_06040203 0.001

# Html.Phishing.Auction.Gen091u.Sanesecurity.06040204
body     SS_PHISH_AUCT_G091U_06040204 /"\/\.dll\/index"/i
describe SS_PHISH_AUCT_G091U_06040204 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G091U_06040204 0.001

# Html.Phishing.Auction.Gen092.Sanesecurity.06040300
body     SS_PHISH_AUCT_G092_06040300 /in order to restore your account access please click on the link below to verify your infromations/i
describe SS_PHISH_AUCT_G092_06040300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G092_06040300 0.001

# Html.Phishing.Auction.Gen093.Sanesecurity.06040301
body     SS_PHISH_AUCT_G093_06040301 /12\.100\.64\.10<br>isp host : cyberspace\.net\.ng <br>location : nigeria<br><br>2\. ip address : 64\.224\.12\.26/i
describe SS_PHISH_AUCT_G093_06040301 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G093_06040301 0.001

# Html.Phishing.Auction.Gen094.Sanesecurity.06040400
body     SS_PHISH_AUCT_G094_06040400 /has developed a security program against the fraudulend attempts/i
describe SS_PHISH_AUCT_G094_06040400 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G094_06040400 0.001

# Html.Phishing.Auction.Gen095.Sanesecurity.06040500
body     SS_PHISH_AUCT_G095_06040500 /in order to win a gift certificate of 100\$ you have to stay signed in on ebay more than/i
describe SS_PHISH_AUCT_G095_06040500 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G095_06040500 0.001

# Html.Phishing.Auction.Gen096u.Sanesecurity.06040501
body     SS_PHISH_AUCT_G096U_06040501 /\/\.secure\/ebay\//i
describe SS_PHISH_AUCT_G096U_06040501 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G096U_06040501 0.001

# Html.Phishing.Auction.Gen097.Sanesecurity.06040502
body     SS_PHISH_AUCT_G097_06040502 />this ebay notice was sent to an ebay valued member on behalf of another ebay member through the ebay platform/i
describe SS_PHISH_AUCT_G097_06040502 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G097_06040502 0.001

# Html.Phishing.Auction.Gen098.Sanesecurity.06040503
body     SS_PHISH_AUCT_G098_06040503 />remove the unpaid item strike now\.<\/a><\/b><\/span><b><span style/i
describe SS_PHISH_AUCT_G098_06040503 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G098_06040503 0.001

# Html.Phishing.Auction.Gen099.Sanesecurity.06040900
body     SS_PHISH_AUCT_G099_06040900 />ebay member power\$seller has left you a\&nbsp\;urgent message<\/p><p><br><font color=\#c00000>respond now<\/font><a title=http:\/\//i
describe SS_PHISH_AUCT_G099_06040900 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G099_06040900 0.001

# Html.Phishing.Auction.Gen100.Sanesecurity.06041000
body     SS_PHISH_AUCT_G100_06041000 /size=1><b>ebay sent this message!<\/b><br>your registered name is included/i
describe SS_PHISH_AUCT_G100_06041000 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G100_06041000 0.001

# Html.Phishing.Auction.Gen101.Sanesecurity.06041100
body     SS_PHISH_AUCT_G101_06041100 /src="http:\/\/pics\.ebaystatic\.com\/aw\/pics\/spacer\.gif" width=1><\/td><\/tr><tr><td valign=top><form action=http:\/\/mail\.yahoo\.com\/config\/login\?\/--webbot-self/i
describe SS_PHISH_AUCT_G101_06041100 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G101_06041100 0.001

# Html.Phishing.Auction.Gen102.Sanesecurity.06041101
body     SS_PHISH_AUCT_G102_06041101 /to resolve this problems please/i
describe SS_PHISH_AUCT_G102_06041101 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G102_06041101 0.001

# Html.Phishing.Auction.Gen103.Sanesecurity.06041102
body     SS_PHISH_AUCT_G103_06041102 /and re-enter your account information\. if your problems could not be resolved your account will be suspended/i
describe SS_PHISH_AUCT_G103_06041102 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G103_06041102 0.001

# Html.Phishing.Auction.Gen104.Sanesecurity.06041200
body     SS_PHISH_AUCT_G104_06041200 /color=\#003399 size=4>update your ebay membership<\/font><\/a><\/span><\/td><\/tr>/i
describe SS_PHISH_AUCT_G104_06041200 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G104_06041200 0.001

# Html.Phishing.Auction.Gen105.Sanesecurity.06041201
body     SS_PHISH_AUCT_G105_06041201 />dear user,<\/font><\/p><p align=justify><font size=3>your account was compromised, the contact information on your account may have been changed without your/i
describe SS_PHISH_AUCT_G105_06041201 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G105_06041201 0.001

# Html.Phishing.Auction.Gen106.Sanesecurity.06041300
body     SS_PHISH_AUCT_G106_06041300 />become an ebay power seller <\/a>within 24 hours<\/p><p><strong>very important!<br><\/strong>the registration is active/i
describe SS_PHISH_AUCT_G106_06041300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G106_06041300 0.001

# Html.Phishing.Auction.Gen107u.Sanesecurity.06041900
body     SS_PHISH_AUCT_G107U_06041900 /\/redirect\.to\.signin\.ebay\.com\/aw-cgi\/ebay/i
describe SS_PHISH_AUCT_G107U_06041900 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G107U_06041900 0.001

# Html.Phishing.Auction.Gen108u.Sanesecurity.06042100
body     SS_PHISH_AUCT_G108U_06042100 /\/www\/isapi\/ebay\/dll\//i
describe SS_PHISH_AUCT_G108U_06042100 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G108U_06042100 0.001

# Html.Phishing.Auction.Gen109u.Sanesecurity.06042500
body     SS_PHISH_AUCT_G109U_06042500 /:82\/ebay\.com\//i
describe SS_PHISH_AUCT_G109U_06042500 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G109U_06042500 0.001

# Html.Phishing.Auction.Gen110u.Sanesecurity.06042501
body     SS_PHISH_AUCT_G110U_06042501 /:8081\/ebay/i
describe SS_PHISH_AUCT_G110U_06042501 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G110U_06042501 0.001

# Html.Phishing.Auction.Gen111.Sanesecurity.06050100
body     SS_PHISH_AUCT_G111_06050100 /if your account information is not update, your ability to sell or bid on ebay will become restricted/i
describe SS_PHISH_AUCT_G111_06050100 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G111_06050100 0.001

# Html.Phishing.Auction.Gen112.Sanesecurity.06050300
body     SS_PHISH_AUCT_G112_06050300 />your monthly ebay invoice is now available for online viewing\.<br \/>invoice date: /i
describe SS_PHISH_AUCT_G112_06050300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G112_06050300 0.001

# Html.Phishing.Auction.Gen113u.Sanesecurity.06050400
body     SS_PHISH_AUCT_G113U_06050400 /index\.htm\?gotohttp:\/\/signin\.ebay\.com\//i
describe SS_PHISH_AUCT_G113U_06050400 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G113U_06050400 0.001

# Html.Phishing.Auction.Gen114u.Sanesecurity.06050401
body     SS_PHISH_AUCT_G114U_06050401 /<a href="http:\/\/.{0,20}\/~.{0,20}\/signin\.ebay\.com\//i
describe SS_PHISH_AUCT_G114U_06050401 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G114U_06050401 0.001

# Html.Phishing.Auction.Gen115.Sanesecurity.06050500
body     SS_PHISH_AUCT_G115_06050500 /<br>we recently noticed one or more attempts to log in to your ebay account from a foreign ip address/i
describe SS_PHISH_AUCT_G115_06050500 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G115_06050500 0.001

# Html.Phishing.Auction.Gen116u.Sanesecurity.06050800
body     SS_PHISH_AUCT_G116U_06050800 /\/\.fees\//i
describe SS_PHISH_AUCT_G116U_06050800 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G116U_06050800 0.001

# Html.Phishing.Auction.Gen117u.Sanesecurity.06050801
rawbody  SS_PHISH_AUCT_G117U_06050801 /\/\.fees\//i
describe SS_PHISH_AUCT_G117U_06050801 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G117U_06050801 0.001

# Html.Phishing.Auction.Gen118u.Sanesecurity.06050802
body     SS_PHISH_AUCT_G118U_06050802 /\/\.ws\/ebay/i
describe SS_PHISH_AUCT_G118U_06050802 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G118U_06050802 0.001

# Html.Phishing.Auction.Gen119u.Sanesecurity.06050900
body     SS_PHISH_AUCT_G119U_06050900 /\.com\/signin\.ebay\.com\//i
describe SS_PHISH_AUCT_G119U_06050900 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G119U_06050900 0.001

# Html.Phishing.Auction.Gen120u.Sanesecurity.06050901
body     SS_PHISH_AUCT_G120U_06050901 /\.net\/pages\.ebay\.com\/signin\//i
describe SS_PHISH_AUCT_G120U_06050901 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G120U_06050901 0.001

# Html.Phishing.Auction.Gen121.Sanesecurity.06050902
body     SS_PHISH_AUCT_G121_06050902 />ebay unpaid item reminder: \#7557660205<\/font>/i
describe SS_PHISH_AUCT_G121_06050902 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G121_06050902 0.001

# Html.Phishing.Auction.Gen122.Sanesecurity.06050903
body     SS_PHISH_AUCT_G122_06050903 /<title>ebay unpaid item reminder: \#8769766925<\/title/i
describe SS_PHISH_AUCT_G122_06050903 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G122_06050903 0.001

# Html.Phishing.Auction.Gen123.Sanesecurity.06050904
body     SS_PHISH_AUCT_G123_06050904 /confirm your details to unsuspend\/unlock your profile/i
describe SS_PHISH_AUCT_G123_06050904 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G123_06050904 0.001

# Html.Phishing.Auction.Gen124u.Sanesecurity.06050905
body     SS_PHISH_AUCT_G124U_06050905 /\/secure\/signin\.ebay\.com\.ws\.ebay/i
describe SS_PHISH_AUCT_G124U_06050905 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G124U_06050905 0.001

# Html.Phishing.Auction.Gen125.Sanesecurity.06050906
body     SS_PHISH_AUCT_G125_06050906 /our records indicate that your account is associated with the following suspended account/i
describe SS_PHISH_AUCT_G125_06050906 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G125_06050906 0.001

# Html.Phishing.Auction.Gen126.Sanesecurity.06051200
body     SS_PHISH_AUCT_G126_06051200 /\/">review the submitted details regarding the payment\.<\/a><\/p><p>regards, <br><br>ebay <\/p><p>\&nbsp\;<\/p><\/html>/i
describe SS_PHISH_AUCT_G126_06051200 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G126_06051200 0.001

# Html.Phishing.Auction.Gen127u.Sanesecurity.06051700
body     SS_PHISH_AUCT_G127U_06051700 /\.\.\.\/ebay/i
describe SS_PHISH_AUCT_G127U_06051700 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G127U_06051700 0.001

# Html.Phishing.Auction.Gen128.Sanesecurity.06051800
body     SS_PHISH_AUCT_G128_06051800 /because our records indicate your account was involved in activities that violate our policy governing seller non-performance/i
describe SS_PHISH_AUCT_G128_06051800 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G128_06051800 0.001

# Html.Phishing.Auction.Gen129u.Sanesecurity.06051900
body     SS_PHISH_AUCT_G129U_06051900 /\/\.sign\/ebay/i
describe SS_PHISH_AUCT_G129U_06051900 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G129U_06051900 0.001

# Html.Phishing.Auction.Gen130u.Sanesecurity.06051901
body     SS_PHISH_AUCT_G130U_06051901 /\/\.dll\/index\./i
describe SS_PHISH_AUCT_G130U_06051901 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G130U_06051901 0.001

# Html.Phishing.Auction.Gen131.Sanesecurity.06052000
body     SS_PHISH_AUCT_G131_06052000 /to be considered for reinstatement of this account, sign in to your <br>account and provide us additional information/i
describe SS_PHISH_AUCT_G131_06052000 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G131_06052000 0.001

# Html.Phishing.Auction.Gen132.Sanesecurity.06052001
body     SS_PHISH_AUCT_G132_06052001 /size=2><br>restore account using link below: <br>/i
describe SS_PHISH_AUCT_G132_06052001 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G132_06052001 0.001

# Html.Phishing.Auction.Gen133.Sanesecurity.06052002
body     SS_PHISH_AUCT_G133_06052002 /\(including use of fax <br>machines pager numbers, modems or disconnected numbers\)\.<br><br>/i
describe SS_PHISH_AUCT_G133_06052002 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G133_06052002 0.001

# Html.Phishing.Auction.Gen134u.Sanesecurity.06052003
body     SS_PHISH_AUCT_G134U_06052003 /\/\.verify/i
describe SS_PHISH_AUCT_G134U_06052003 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G134U_06052003 0.001

# Html.Phishing.Auction.Gen135.Sanesecurity.06052004
body     SS_PHISH_AUCT_G135_06052004 /please update information in your ebay account now by clicking the link below/i
describe SS_PHISH_AUCT_G135_06052004 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G135_06052004 0.001

# Html.Phishing.Auction.Gen136.Sanesecurity.06052005
body     SS_PHISH_AUCT_G136_06052005 /we offer you a chance to update your billing information/i
describe SS_PHISH_AUCT_G136_06052005 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G136_06052005 0.001

# Email.Phishing.Auction.Gen137.Sanesecurity.06052800
rawbody  SS_PHISH_AUCT_G137_06052800 /To be considered for reinstatement of this account, sign in to your\x0d\x0aaccount and provide us additional information/i
describe SS_PHISH_AUCT_G137_06052800 SaneSecurity: Text-based eBay phish
score    SS_PHISH_AUCT_G137_06052800 0.001

# Html.Phishing.Auction.Gen138.Sanesecurity.06052900
body     SS_PHISH_AUCT_G138_06052900 />dear ebay member!<br><br>as part of our security measures,/i
describe SS_PHISH_AUCT_G138_06052900 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G138_06052900 0.001

# Html.Phishing.Auction.Gen139u.Sanesecurity.06052901
body     SS_PHISH_AUCT_G139U_06052901 /:81\/ebay\./i
describe SS_PHISH_AUCT_G139U_06052901 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G139U_06052901 0.001

# Html.Phishing.Auction.Gen140u.Sanesecurity.06052902
body     SS_PHISH_AUCT_G140U_06052902 /\/\.singin\.ebay\.com\//i
describe SS_PHISH_AUCT_G140U_06052902 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G140U_06052902 0.001

# Html.Phishing.Auction.Gen141u.Sanesecurity.06052903
body     SS_PHISH_AUCT_G141U_06052903 /\/\.aw-confirm\//i
describe SS_PHISH_AUCT_G141U_06052903 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G141U_06052903 0.001

# Html.Phishing.Auction.Gen142.Sanesecurity.06052904.fr
body     SS_PHISH_AUCT_G142_06052904_FR /cliquez ici affin de vous prot\xe9ger des activit\xe9s frauduleuses en ligne/i
describe SS_PHISH_AUCT_G142_06052904_FR SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G142_06052904_FR 0.001

# Html.Phishing.Auction.Gen143.Sanesecurity.06052905.fr
body     SS_PHISH_AUCT_G143_06052905_FR /der a votre compte et v\&eacute\;rifier vos activit\&eacute\;s, cliquez sur le lien/i
describe SS_PHISH_AUCT_G143_06052905_FR SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G143_06052905_FR 0.001

# Html.Phishing.Auction.Gen144.Sanesecurity.06053000
body     SS_PHISH_AUCT_G144_06053000 /you\&nbsp\;<\/td><td width="0">are\&nbsp\;<\/td><td width="0">re<\/td><td width="0">quired\&nbsp\;<\/td><td width="0">to\&nbsp\;<\/td><td width="0">ver<\/td><td width="0">ify\&nbsp\;<\/td>/i
describe SS_PHISH_AUCT_G144_06053000 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G144_06053000 0.001

# Html.Phishing.Auction.Gen145.Sanesecurity.06060100
body     SS_PHISH_AUCT_G145_06060100 /color=\#666666 size=1><b>ebay sent this message\.<\/b><br>your registered name/i
describe SS_PHISH_AUCT_G145_06060100 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G145_06060100 0.001

# Html.Phishing.Auction.Gen146u.Sanesecurity.06060400
body     SS_PHISH_AUCT_G146U_06060400 /:84\/update-account/i
describe SS_PHISH_AUCT_G146U_06060400 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G146U_06060400 0.001

# Html.Phishing.Auction.Gen147u.Sanesecurity.06060500
body     SS_PHISH_AUCT_G147U_06060500 /\/\.powersellerpages/i
describe SS_PHISH_AUCT_G147U_06060500 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G147U_06060500 0.001

# Html.Phishing.Auction.Gen148.Sanesecurity.06060600
body     SS_PHISH_AUCT_G148_06060600 /existing database\. as soon as our database will be updated we need/i
describe SS_PHISH_AUCT_G148_06060600 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G148_06060600 0.001

# Html.Phishing.Auction.Gen149.Sanesecurity.06060601
body     SS_PHISH_AUCT_G149_06060601 /--- generated by selida 08-14-2005 ---/i
describe SS_PHISH_AUCT_G149_06060601 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G149_06060601 0.001

# Html.Phishing.Auction.Gen150.Sanesecurity.06060700
body     SS_PHISH_AUCT_G150_06060700 /to avoide this suspension please login into you account and follow the instructions/i
describe SS_PHISH_AUCT_G150_06060700 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G150_06060700 0.001

# Html.Phishing.Auction.Gen151.Sanesecurity.06060701
body     SS_PHISH_AUCT_G151_06060701 /this message to you from stanley muller \(alimotawww\)/i
describe SS_PHISH_AUCT_G151_06060701 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G151_06060701 0.001

# Html.Phishing.Auction.Gen152.Sanesecurity.06060702
body     SS_PHISH_AUCT_G152_06060702 /this message to you from stanley muller \(welshdruid\)/i
describe SS_PHISH_AUCT_G152_06060702 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G152_06060702 0.001

# Html.Phishing.Auction.Gen153u.Sanesecurity.06060800
body     SS_PHISH_AUCT_G153U_06060800 /\/www\/ibuynew\/member\.htm\?ebayisapi/i
describe SS_PHISH_AUCT_G153U_06060800 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G153U_06060800 0.001

# Html.Phishing.Auction.Gen154.Sanesecurity.06060801
body     SS_PHISH_AUCT_G154_06060801 /foreign ip address :capitol\.guatemala-203-pc\.in \( ip address located/i
describe SS_PHISH_AUCT_G154_06060801 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G154_06060801 0.001

# Html.Phishing.Auction.Gen155u.Sanesecurity.06060802
body     SS_PHISH_AUCT_G155U_06060802 /\.com\/\.\.\.\/">https:\/\/signin\.ebay\.com\//i
describe SS_PHISH_AUCT_G155U_06060802 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G155U_06060802 0.001

# Html.Phishing.Auction.Gen156u.Sanesecurity.06060803
body     SS_PHISH_AUCT_G156U_06060803 /\.com\/https:\/signin\.ebay\.com\//i
describe SS_PHISH_AUCT_G156U_06060803 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G156U_06060803 0.001

# Html.Phishing.Auction.Gen157.Sanesecurity.06060804
body     SS_PHISH_AUCT_G157_06060804 /form or else your account will be marked as fraudulent , and will/i
describe SS_PHISH_AUCT_G157_06060804 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G157_06060804 0.001

# Html.Phishing.Auction.Gen158.Sanesecurity.06060900
body     SS_PHISH_AUCT_G158_06060900 /to speed up this process, you are required to\&nbsp\;unlock your ebay account\&nbsp\; following the link below/i
describe SS_PHISH_AUCT_G158_06060900 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G158_06060900 0.001

# Html.Phishing.Auction.Gen159.Sanesecurity.06061200
body     SS_PHISH_AUCT_G159_06061200 /if you are not aware of this item being sold on your ebay account, please <br>goto the link below and reactivate your account status/i
describe SS_PHISH_AUCT_G159_06061200 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G159_06061200 0.001

# Html.Phishing.Auction.Gen160.Sanesecurity.06061201
body     SS_PHISH_AUCT_G160_06061201 /<input type=hidden value=http:\/\/cgi\.ebay\.com\/ws\/ebayisapi\.dll\?viewitem\&rd=1\&item=2070651641/i
describe SS_PHISH_AUCT_G160_06061201 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G160_06061201 0.001

# Html.Phishing.Auction.Gen161.Sanesecurity.06061300
body     SS_PHISH_AUCT_G161_06061300 /\/https:\/\/signin\.ebay\.com\//i
describe SS_PHISH_AUCT_G161_06061300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G161_06061300 0.001

# Html.Phishing.Auction.Gen162.Sanesecurity.06061400
body     SS_PHISH_AUCT_G162_06061400 /if you do not update your billing information's your access on/i
describe SS_PHISH_AUCT_G162_06061400 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G162_06061400 0.001

# Html.Phishing.Auction.Gen163.Sanesecurity.06061401
body     SS_PHISH_AUCT_G163_06061401 /<span class=sectiontitle>question from nukem21/i
describe SS_PHISH_AUCT_G163_06061401 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G163_06061401 0.001

# Html.Phishing.Auction.Gen164u.Sanesecurity.06061500
body     SS_PHISH_AUCT_G164U_06061500 /\/https:\/contact\.ebay\.com\//i
describe SS_PHISH_AUCT_G164U_06061500 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G164U_06061500 0.001

# Html.Phishing.Auction.Gen165u.Sanesecurity.06061501
body     SS_PHISH_AUCT_G165U_06061501 /\/\.sign\/secure/i
describe SS_PHISH_AUCT_G165U_06061501 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G165U_06061501 0.001

# Html.Phishing.Auction.Gen166u.Sanesecurity.06061600
body     SS_PHISH_AUCT_G166U_06061600 /\/e8ayISAPI\./i
describe SS_PHISH_AUCT_G166U_06061600 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G166U_06061600 0.001

# Html.Phishing.Auction.Gen167u.Sanesecurity.06062000
body     SS_PHISH_AUCT_G167U_06062000 /serveftp\.com\/ebay\.signin\.ebay/i
describe SS_PHISH_AUCT_G167U_06062000 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G167U_06062000 0.001

# Html.Phishing.Auction.Gen168u.Sanesecurity.06062001
body     SS_PHISH_AUCT_G168U_06062001 /ebay\.signin\.ebay\.comwsebayisapi/i
describe SS_PHISH_AUCT_G168U_06062001 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G168U_06062001 0.001

# Html.Phishing.Auction.Gen169.Sanesecurity.06062100
body     SS_PHISH_AUCT_G169_06062100 /please click the link below<\/font><\/div><br><a href="http:\/\/signin\.ebay\.com\./i
describe SS_PHISH_AUCT_G169_06062100 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G169_06062100 0.001

# Html.Phishing.Auction.Gen170.Sanesecurity.06062500
body     SS_PHISH_AUCT_G170_06062500 /are proud to recognize their contributionsto the success of the ebay commu/i
describe SS_PHISH_AUCT_G170_06062500 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G170_06062500 0.001

# Html.Phishing.Auction.Gen172u.Sanesecurity.06062701
body     SS_PHISH_AUCT_G172U_06062701 /\.name\/isapi\/redirect\.html" target="_blank">www\.ebay\.com<\/a>/i
describe SS_PHISH_AUCT_G172U_06062701 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G172U_06062701 0.001

# Html.Phishing.Auction.Gen173u.Sanesecurity.06062702
body     SS_PHISH_AUCT_G173U_06062702 /src="http:\/\/img216\.imageshack\.us\/img216\/6803\/logoebay150x704zn\.gif"/i
describe SS_PHISH_AUCT_G173U_06062702 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G173U_06062702 0.001

# Html.Phishing.Auction.Gen174.Sanesecurity.06062703
body     SS_PHISH_AUCT_G174_06062703 /log in<\/a>on our site\.<br>if this problem will not be resolved in/i
describe SS_PHISH_AUCT_G174_06062703 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G174_06062703 0.001

# Html.Phishing.Auction.Gen175u.Sanesecurity.06062800
body     SS_PHISH_AUCT_G175U_06062800 /:6080\/signin\.ebay\.com\//i
describe SS_PHISH_AUCT_G175U_06062800 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G175U_06062800 0.001

# Html.Phishing.Auction.Gen176.Sanesecurity.06062900
body     SS_PHISH_AUCT_G176_06062900 /<font color=\#666666 size=1>please note that this is a system generated email\. please do not reply to this email\. <br><br>/i
describe SS_PHISH_AUCT_G176_06062900 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G176_06062900 0.001

# Html.Phishing.Auction.Gen177u.Sanesecurity.06070900
body     SS_PHISH_AUCT_G177U_06070900 /:82\/signin\.ebay\./i
describe SS_PHISH_AUCT_G177U_06070900 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G177U_06070900 0.001

# Html.Phishing.Auction.Gen178.Sanesecurity.06070901
body     SS_PHISH_AUCT_G178_06070901 /<br>if you choose to ignore our request, you leave us no choise but to temporaly suspend or deleted your account/i
describe SS_PHISH_AUCT_G178_06070901 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G178_06070901 0.001

# Html.Phishing.Auction.Gen179u.Sanesecurity.06070902
body     SS_PHISH_AUCT_G179U_06070902 /\/~signin\.ebay\.com/i
describe SS_PHISH_AUCT_G179U_06070902 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G179U_06070902 0.001

# Html.Phishing.Auction.Gen180u.Sanesecurity.06070903
body     SS_PHISH_AUCT_G180U_06070903 /:\/\/signin\.ebay\.com-/i
describe SS_PHISH_AUCT_G180U_06070903 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G180U_06070903 0.001

# Html.Phishing.Auction.Gen181.Sanesecurity.06070904
body     SS_PHISH_AUCT_G181_06070904 /we have suspended your account until such time that it can be safely restored to you\. we have taken this action because your password may have been compromised\. sometimes this happens when/i
describe SS_PHISH_AUCT_G181_06070904 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G181_06070904 0.001

# Html.Phishing.Auction.Gen182.Sanesecurity.06071100
body     SS_PHISH_AUCT_G182_06071100 /dear ebay member! hereby we would like to inform you that we provided the constant examination of your billing information/i
describe SS_PHISH_AUCT_G182_06071100 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G182_06071100 0.001

# Html.Phishing.Auction.Gen183.Sanesecurity.06071101
body     SS_PHISH_AUCT_G183_06071101 /please go to enter the page of confirmation/i
describe SS_PHISH_AUCT_G183_06071101 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G183_06071101 0.001

# Html.Phishing.Auction.Gen184.Sanesecurity.06071200
body     SS_PHISH_AUCT_G184_06071200 /<p>dear ebay customer, <p>there is a problem with the card you used while bidding at one of our auctions\.<br>a communication problem with the bank server might have caused that problem too/i
describe SS_PHISH_AUCT_G184_06071200 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G184_06071200 0.001

# Html.Phishing.Auction.Gen185u.Sanesecurity.06071201
body     SS_PHISH_AUCT_G185U_06071201 /:81\/www\.ebay\.com/i
describe SS_PHISH_AUCT_G185U_06071201 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G185U_06071201 0.001

# Html.Phishing.Auction.Gen186.Sanesecurity.06071300
body     SS_PHISH_AUCT_G186_06071300 /has left you a message regarding item \#140003025985<br><br><a href="http:\/\//i
describe SS_PHISH_AUCT_G186_06071300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G186_06071300 0.001

# Html.Phishing.Auction.Gen187u.Sanesecurity.06071301
body     SS_PHISH_AUCT_G187U_06071301 /\/\.ws\/ebayisapi/i
describe SS_PHISH_AUCT_G187U_06071301 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G187U_06071301 0.001

# Html.Phishing.Auction.Gen188u.Sanesecurity.06071400
body     SS_PHISH_AUCT_G188U_06071400 /\/www\/sssiiggnionebaynow\/ebayisapidll/i
describe SS_PHISH_AUCT_G188U_06071400 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G188U_06071400 0.001

# Html.Phishing.Auction.Gen189u.Sanesecurity.06071401
body     SS_PHISH_AUCT_G189U_06071401 /:81\/signin1\.ebay\.com/i
describe SS_PHISH_AUCT_G189U_06071401 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G189U_06071401 0.001

# Html.Phishing.Auction.Gen191.Sanesecurity.06071600
body     SS_PHISH_AUCT_G191_06071600 / billing information is out of date\. the update process is a very simple and fast one and it must be completed immediately in order to avoid any future issues/i
describe SS_PHISH_AUCT_G191_06071600 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G191_06071600 0.001

# Html.Phishing.Auction.Gen192.Sanesecurity.06071700
body     SS_PHISH_AUCT_G192_06071700 /currently, the service is only available to all residents of the united states and all over the world/i
describe SS_PHISH_AUCT_G192_06071700 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G192_06071700 0.001

# Html.Phishing.Auction.Gen193.Sanesecurity.06071701
body     SS_PHISH_AUCT_G193_06071701 /there is a problem with the card you used while bidding at one of our auctions\.<br>a communication problem with the bank server might have caused that problem too<br>but we are unable to collect our commission\./i
describe SS_PHISH_AUCT_G193_06071701 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G193_06071701 0.001

# Html.Phishing.Auction.Gen194.Sanesecurity.06071702
body     SS_PHISH_AUCT_G194_06071702 /<br>looking forward to a good co-operation\. <p>regards,<br>/i
describe SS_PHISH_AUCT_G194_06071702 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G194_06071702 0.001

# Html.Phishing.Auction.Gen195u.Sanesecurity.06071800
body     SS_PHISH_AUCT_G195U_06071800 /\/\.\%20\/ebayisapi/i
describe SS_PHISH_AUCT_G195U_06071800 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G195U_06071800 0.001

# Html.Phishing.Auction.Gen196.Sanesecurity.06071900
body     SS_PHISH_AUCT_G196_06071900 /has left you a message regarding item \#160006233575/i
describe SS_PHISH_AUCT_G196_06071900 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G196_06071900 0.001

# Html.Phishing.Auction.Gen197u.Sanesecurity.06072100
body     SS_PHISH_AUCT_G197U_06072100 /:8081\/signin1\.ebay\./i
describe SS_PHISH_AUCT_G197U_06072100 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G197U_06072100 0.001

# Html.Phishing.Auction.Gen198.Sanesecurity.06072101
body     SS_PHISH_AUCT_G198_06072101 / color="\#666666"><b><b>eba<\/b><\/font><\/td><td><font face="verdana, sans-serif" size="1" color="\#666666"><b>y s<\/b><\/font><\/td><td><font face="verdana, sans-serif" size="1" color="\#666666"><b>ent thi/i
describe SS_PHISH_AUCT_G198_06072101 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G198_06072101 0.001

# Html.Phishing.Auction.Gen199u.Sanesecurity.06072300
body     SS_PHISH_AUCT_G199U_06072300 /\/sign-in-ebya-consumr-ssl-protection/i
describe SS_PHISH_AUCT_G199U_06072300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G199U_06072300 0.001

# Html.Phishing.Auction.Gen200u.Sanesecurity.06072400
body     SS_PHISH_AUCT_G200U_06072400 /:9070\/ebayisapi/i
describe SS_PHISH_AUCT_G200U_06072400 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G200U_06072400 0.001

# Html.Phishing.Auction.Gen201.Sanesecurity.06072401
body     SS_PHISH_AUCT_G201_06072401 /has indicated that they already paid for item \#8910734717/i
describe SS_PHISH_AUCT_G201_06072401 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G201_06072401 0.001

# Html.Phishing.Auction.Gen202.Sanesecurity.06072402
body     SS_PHISH_AUCT_G202_06072402 /\#666666 size=1><b>ebay sent this message to you\.<\/b><br>your registered name/i
describe SS_PHISH_AUCT_G202_06072402 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G202_06072402 0.001

# Html.Phishing.Auction.Gen203u.Sanesecurity.06072403
body     SS_PHISH_AUCT_G203U_06072403 /if you agree with this rank please <a href="ftp:\/\//i
describe SS_PHISH_AUCT_G203U_06072403 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G203U_06072403 0.001

# Html.Phishing.Auction.Gen204u.Sanesecurity.06072404
body     SS_PHISH_AUCT_G204U_06072404 /\/horde\/ebay\/index\.htm/i
describe SS_PHISH_AUCT_G204U_06072404 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G204U_06072404 0.001

# Html.Phishing.Auction.Gen205u.Sanesecurity.06072405
body     SS_PHISH_AUCT_G205U_06072405 /\/https\/isapiebay/i
describe SS_PHISH_AUCT_G205U_06072405 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G205U_06072405 0.001

# Html.Phishing.Auction.Gen206.Sanesecurity.06072406
body     SS_PHISH_AUCT_G206_06072406 /to review your account and some or all of the information that.{0,150}used to make its decision to limit your account access, please visit the resolution centre/i
describe SS_PHISH_AUCT_G206_06072406 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G206_06072406 0.001

# Html.Phishing.Auction.Gen207.Sanesecurity.06072407
body     SS_PHISH_AUCT_G207_06072407 /63583492189<\/a><br>has been retracted or cancelled\.<br>/i
describe SS_PHISH_AUCT_G207_06072407 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G207_06072407 0.001

# Html.Phishing.Auction.Gen208.Sanesecurity.06072500
body     SS_PHISH_AUCT_G208_06072500 /color=\#666666 size=1><b>ebay sent this message to kurt\&nbsp\;eldridge\&nbsp\;\(kpe1964\)\.<\/b><br>your/i
describe SS_PHISH_AUCT_G208_06072500 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G208_06072500 0.001

# Html.Phishing.Auction.Gen209.Sanesecurity.06072501
body     SS_PHISH_AUCT_G209_06072501 /<\/td><td><font face=arial size=4>ebay.{0,100} -- response required<\/font><\/td><td valign.{0,600}<tbody><tr><td><br><br>dear member, <br><br><\/td><\/tr><tr><td>ebay member/i
describe SS_PHISH_AUCT_G209_06072501 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G209_06072501 0.001

# Html.Phishing.Auction.Gen210.Sanesecurity.06072502
body     SS_PHISH_AUCT_G210_06072502 /color="\#666666"><b>ebay sent this message to your email\.<\/b><br>your registered name is included/i
describe SS_PHISH_AUCT_G210_06072502 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G210_06072502 0.001

# Html.Phishing.Auction.Gen211u.Sanesecurity.06072600
body     SS_PHISH_AUCT_G211U_06072600 /onabort_filtered="_on_rsz\(\)\;"><\/td><td><a href="http:\/\/mail\.yahoo\.com\/config\/login\?\/_javascript:dl\("http:\/\/www\.ebay\./i
describe SS_PHISH_AUCT_G211U_06072600 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G211U_06072600 0.001

# Html.Phishing.Auction.Gen212.Sanesecurity.06072700
body     SS_PHISH_AUCT_G212_06072700 /<font face="verdana, sans-serif" color=\#666666 size=1><strong><\/strong><br>your registered name is included to show this message originated from ebay\./i
describe SS_PHISH_AUCT_G212_06072700 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G212_06072700 0.001

# Html.Phishing.Auction.Gen213u.Sanesecurity.06072701
body     SS_PHISH_AUCT_G213U_06072701 /:81\/us\/ws\/ebayisapi/i
describe SS_PHISH_AUCT_G213U_06072701 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G213U_06072701 0.001

# Html.Phishing.Auction.Gen214u.Sanesecurity.06073100
body     SS_PHISH_AUCT_G214U_06073100 /\/transactionid147259qz\?secure\.php/i
describe SS_PHISH_AUCT_G214U_06073100 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G214U_06073100 0.001

# Html.Phishing.Auction.Gen215.Sanesecurity.06073101
body     SS_PHISH_AUCT_G215_06073101 /dear ebay community member,<\/b><p><p>your acccount will be closed in the next 3 days because an illegal transaction has been made by you or someone else/i
describe SS_PHISH_AUCT_G215_06073101 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G215_06073101 0.001

# Html.Phishing.Auction.Gen216.Sanesecurity.06073102
body     SS_PHISH_AUCT_G216_06073102 /in this case we will ask you to follow the link below to confirm that you are the real account owner\./i
describe SS_PHISH_AUCT_G216_06073102 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G216_06073102 0.001

# Html.Phishing.Auction.Gen217u.Sanesecurity.06073103
body     SS_PHISH_AUCT_G217U_06073103 /\/redirect_to_\/cgi\.ebay\.com\/index\.html/i
describe SS_PHISH_AUCT_G217U_06073103 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G217U_06073103 0.001

# Html.Phishing.Auction.Gen218.Sanesecurity.06073104
body     SS_PHISH_AUCT_G218_06073104 /<font size="4"><b>ebay my messages -- 1 alert message<\/b>.{0,2000}these message contain important information about your account and require your immediate attention\. alerts can't be deleted/i
describe SS_PHISH_AUCT_G218_06073104 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G218_06073104 0.001

# Html.Phishing.Auction.Gen219.Sanesecurity.06073105
body     SS_PHISH_AUCT_G219_06073105 /<font color="\#666666" face="verdana, sans-serif" size="1"><b>ebay sent this message<\/b><\/font><\/td>/i
describe SS_PHISH_AUCT_G219_06073105 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G219_06073105 0.001

# Html.Phishing.Auction.Gen220u.Sanesecurity.06080100
body     SS_PHISH_AUCT_G220U_06080100 /redirect\.php\/\.\.\.\/domain=signin\.ebay/i
describe SS_PHISH_AUCT_G220U_06080100 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G220U_06080100 0.001

# Html.Phishing.Auction.Gen221.Sanesecurity.06080101
body     SS_PHISH_AUCT_G221_06080101 /http\%3a\%2f\%2ffeedback\.ebay\.com\%3a80\%2fws\%2febayisapi\.dll\%3fresolvedispute\%26disputeid\%3d78730534/i
describe SS_PHISH_AUCT_G221_06080101 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G221_06080101 0.001

# Html.Phishing.Auction.Gen222.Sanesecurity.06080200
body     SS_PHISH_AUCT_G222_06080200 /><br \/><div id="comment_help">80 characters left\.<\/div>/i
describe SS_PHISH_AUCT_G222_06080200 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G222_06080200 0.001

# Html.Phishing.Auction.Gen223.Sanesecurity.06080201
body     SS_PHISH_AUCT_G223_06080201 />dear\&nbsp\;<\/td><td width="0">ebay\&nbsp\;<\/td><td width="0">user, <\/td><td width="0">\&nbsp\;<\/td><\/tr><\/table>/i
describe SS_PHISH_AUCT_G223_06080201 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G223_06080201 0.001

# Html.Phishing.Auction.Gen224.Sanesecurity.06080300
body     SS_PHISH_AUCT_G224_06080300 /<b>respond to this question in my messages\.<\/b><\/font><\/td><\/tr><tr><td align="center"><a href="http:\/\/www\.google/i
describe SS_PHISH_AUCT_G224_06080300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G224_06080300 0.001

# Html.Phishing.Auction.Gen225.Sanesecurity.06080301
body     SS_PHISH_AUCT_G225_06080301 /<title>re: question for item \#8812386909/i
describe SS_PHISH_AUCT_G225_06080301 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G225_06080301 0.001

# Html.Phishing.Auction.Gen226.Sanesecurity.06080500
body     SS_PHISH_AUCT_G226_06080500 /we are writing to alert you that your balance is not paid, because your<br>credit\/dibit card company declined/i
describe SS_PHISH_AUCT_G226_06080500 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G226_06080500 0.001

# Html.Phishing.Auction.Gen227.Sanesecurity.06080501
body     SS_PHISH_AUCT_G227_06080501 /to speed up this process, you are required to place other credir\/debit<br>against the account registration data we have on file/i
describe SS_PHISH_AUCT_G227_06080501 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G227_06080501 0.001

# Html.Phishing.Auction.Gen228.Sanesecurity.06080600
body     SS_PHISH_AUCT_G228_06080600 /color=\#666666 size=1><b>ebay sent this message to: you\.<\/b><br>/i
describe SS_PHISH_AUCT_G228_06080600 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G228_06080600 0.001

# Html.Phishing.Auction.Gen229u.Sanesecurity.06080601
body     SS_PHISH_AUCT_G229U_06080601 /\/sign_in_ebay_com\//i
describe SS_PHISH_AUCT_G229U_06080601 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G229U_06080601 0.001

# Html.Phishing.Auction.Gen230u.Sanesecurity.06080602
body     SS_PHISH_AUCT_G230U_06080602 /\/sign\.in\.ebay\.com\//i
describe SS_PHISH_AUCT_G230U_06080602 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G230U_06080602 0.001

# Html.Phishing.Auction.Gen231u.Sanesecurity.06080603
body     SS_PHISH_AUCT_G231U_06080603 /\/\%20\/signin\.ebay/i
describe SS_PHISH_AUCT_G231U_06080603 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G231U_06080603 0.001

# Html.Phishing.Auction.Gen233u.Sanesecurity.06080700
body     SS_PHISH_AUCT_G233U_06080700 /:84\/www\.ebay\.com\//i
describe SS_PHISH_AUCT_G233U_06080700 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G233U_06080700 0.001

# Html.Phishing.Auction.Gen234.Sanesecurity.06080900
body     SS_PHISH_AUCT_G234_06080900 /we regret to inform you that your ebay account will be suspended due to concerns that we have for the safety and integrity of the ebay community/i
describe SS_PHISH_AUCT_G234_06080900 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G234_06080900 0.001

# Html.Phishing.Auction.Gen235.Sanesecurity.06080901
body     SS_PHISH_AUCT_G235_06080901 /therefore, as a preventative measure, we have temporarily limited access to sensitive ebay account features\. click the link below in order to regain access to your account/i
describe SS_PHISH_AUCT_G235_06080901 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G235_06080901 0.001

# Html.Phishing.Auction.Gen236.Sanesecurity.06080902
body     SS_PHISH_AUCT_G236_06080902 /dear costumer,<br><br><br>we regret to inform you that your/i
describe SS_PHISH_AUCT_G236_06080902 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G236_06080902 0.001

# Html.Phishing.Auction.Gen237.Sanesecurity.06080903
body     SS_PHISH_AUCT_G237_06080903 /our records show the card you use buying goods though <b>ebay<\/b> service<br>/i
describe SS_PHISH_AUCT_G237_06080903 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G237_06080903 0.001

# Html.Phishing.Auction.Gen238u.Sanesecurity.06081000
body     SS_PHISH_AUCT_G238U_06081000 /:8080\/ebay\//i
describe SS_PHISH_AUCT_G238U_06081000 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G238U_06081000 0.001

# Html.Phishing.Auction.Gen239.Sanesecurity.06081300
body     SS_PHISH_AUCT_G239_06081300 /we appreciate your support and understating, as we work together to keep/i
describe SS_PHISH_AUCT_G239_06081300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G239_06081300 0.001

# Html.Phishing.Auction.Gen240u.Sanesecurity.06081400
body     SS_PHISH_AUCT_G240U_06081400 /\/\%20\/ws\/ebayisapi/i
describe SS_PHISH_AUCT_G240U_06081400 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G240U_06081400 0.001

# Html.Phishing.Auction.Gen241u.Sanesecurity.06081500
body     SS_PHISH_AUCT_G241U_06081500 /\.mail333\.com\/ws\/ebayisapi\.dll/i
describe SS_PHISH_AUCT_G241U_06081500 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G241U_06081500 0.001

# Html.Phishing.Auction.Gen242u.Sanesecurity.06081501
body     SS_PHISH_AUCT_G242U_06081501 /:13\/www\.ebay\.com\/index/i
describe SS_PHISH_AUCT_G242U_06081501 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G242U_06081501 0.001

# Html.Phishing.Auction.Gen243u.Sanesecurity.06081502
body     SS_PHISH_AUCT_G243U_06081502 /\/\.ws\/ebayisapi\//i
describe SS_PHISH_AUCT_G243U_06081502 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G243U_06081502 0.001

# Html.Phishing.Auction.Gen244u.Sanesecurity.06081800
body     SS_PHISH_AUCT_G244U_06081800 /:85\/">http:\/\/pages\.ebay\.com\//i
describe SS_PHISH_AUCT_G244U_06081800 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G244U_06081800 0.001

# Html.Phishing.Auction.Gen246.Sanesecurity.06082100
body     SS_PHISH_AUCT_G246_06082100 /><td width=3d"0">a comm<\/td><td width=3d"0">unication pro<\/td><td width=3d"0">blem with the ba<\/td><td width=3d"0">nk server mi<\/td><td width=3d"0">ght have cau<\/td><td width=3d"0">sed that pro<\/td><td width=3d"0">blem too/i
describe SS_PHISH_AUCT_G246_06082100 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G246_06082100 0.001

# Html.Phishing.Auction.Gen247.Sanesecurity.06082101
body     SS_PHISH_AUCT_G247_06082101 /<p>according to our site policy you will have to confirm that you are the real owner of the ebay account by completing the following/i
describe SS_PHISH_AUCT_G247_06082101 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G247_06082101 0.001

# Html.Phishing.Auction.Gen248u.Sanesecurity.06082200
body     SS_PHISH_AUCT_G248U_06082200 /\/singinviewitemnumber\/ebay\.html/i
describe SS_PHISH_AUCT_G248U_06082200 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G248U_06082200 0.001

# Html.Phishing.Auction.Gen249.Sanesecurity.06082201
body     SS_PHISH_AUCT_G249_06082201 /color=\#666666 size=1><b>ebay member sent this message to you<\/b><br>your registered name/i
describe SS_PHISH_AUCT_G249_06082201 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G249_06082201 0.001

# Html.Phishing.Auction.Gen250.Sanesecurity.06082202
body     SS_PHISH_AUCT_G250_06082202 /we recently contacted you after noticing an issue on your account\.we request informations from you for the following reason/i
describe SS_PHISH_AUCT_G250_06082202 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G250_06082202 0.001

# Html.Phishing.Auction.Gen251.Sanesecurity.06082203
body     SS_PHISH_AUCT_G251_06082203 /we need to verify your account integrity , after some frauds made on our network of electronic money transfer/i
describe SS_PHISH_AUCT_G251_06082203 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G251_06082203 0.001

# Html.Phishing.Auction.Gen252.Sanesecurity.06082400
body     SS_PHISH_AUCT_G252_06082400 /size="1" color="\#666666"><b>ebay international ag sent this message\.<\/b>/i
describe SS_PHISH_AUCT_G252_06082400 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G252_06082400 0.001

# Html.Phishing.Auction.Gen253.Sanesecurity.06082401
body     SS_PHISH_AUCT_G253_06082401 /size="4"><b>sb notice: ebay registration suspension - shill bidding<\/b><\/font>/i
describe SS_PHISH_AUCT_G253_06082401 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G253_06082401 0.001

# Html.Phishing.Auction.Gen254.Sanesecurity.06082700
body     SS_PHISH_AUCT_G254_06082700 /<strong>\[frontpage save results component\]<\/strong><p><textarea name="s1" rows="17" cols="28">enter your message here<\/textarea><font color="\#0000ff" face="arial" size="2">\&nbsp\;\&nbsp\;\&nbsp\;\&nbsp\;\&nbsp\; \&nbsp\; <\/font><\/p><\/form>/i
describe SS_PHISH_AUCT_G254_06082700 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G254_06082700 0.001

# Html.Phishing.Auction.Gen255.Sanesecurity.06082701
body     SS_PHISH_AUCT_G255_06082701 /i have been waiting for quite a long time for you to reply , whith the payment details \.for the reason i will be forced to report you to ebay as , an unpayed item strike , and as a result your ebay user will be suspended/i
describe SS_PHISH_AUCT_G255_06082701 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G255_06082701 0.001

# Html.Phishing.Auction.Gen256u.Sanesecurity.06082900
body     SS_PHISH_AUCT_G256U_06082900 /\/ssingiin\/ws\/ebayisapidll/i
describe SS_PHISH_AUCT_G256U_06082900 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G256U_06082900 0.001

# Html.Phishing.Auction.Gen257u.Sanesecurity.06082901
body     SS_PHISH_AUCT_G257U_06082901 /ebay\.com\/ws\/ebayisapi<wbr>\.dll\?viewitem\&amp\;item=5784504408/i
describe SS_PHISH_AUCT_G257U_06082901 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G257U_06082901 0.001

# Html.Phishing.Auction.Gen258u.Sanesecurity.06083100
body     SS_PHISH_AUCT_G258U_06083100 /<a href="http:\/\/signin-ebay-member-uk\./i
describe SS_PHISH_AUCT_G258U_06083100 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G258U_06083100 0.001

# Html.Phishing.Auction.Gen259u.Sanesecurity.06090100
body     SS_PHISH_AUCT_G259U_06090100 /\/\.change\/index/i
describe SS_PHISH_AUCT_G259U_06090100 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G259U_06090100 0.001

# Html.Phishing.Auction.Gen260.Sanesecurity.06090101
body     SS_PHISH_AUCT_G260_06090101 /dear member.{0,50}would like to offer you the opportunity to participate in our survey and, as a reward, you will get.{0,50}seller account, so that your future listings will automatically appear on/i
describe SS_PHISH_AUCT_G260_06090101 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G260_06090101 0.001

# Html.Phishing.Auction.Gen261.Sanesecurity.06090102
body     SS_PHISH_AUCT_G261_06090102 /answering these questions is all it takes to make your voice heard\. to participate, click on the link below/i
describe SS_PHISH_AUCT_G261_06090102 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G261_06090102 0.001

# Html.Phishing.Auction.Gen262.Sanesecurity.06090400
body     SS_PHISH_AUCT_G262_06090400 /size="1" color="\#666666">your registered name is included to show this message originated from ebay/i
describe SS_PHISH_AUCT_G262_06090400 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G262_06090400 0.001

# Html.Phishing.Auction.Gen263u.Sanesecurity.06090800
body     SS_PHISH_AUCT_G263U_06090800 /\/www\/sigininebaycom\/sigin\.in\.ebay\.com\//i
describe SS_PHISH_AUCT_G263U_06090800 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G263U_06090800 0.001

# Html.Phishing.Auction.Gen264.Sanesecurity.06091100
body     SS_PHISH_AUCT_G264_06091100 /change of email has been requested from 66\.219\.66\.31/i
describe SS_PHISH_AUCT_G264_06091100 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G264_06091100 0.001

# Html.Phishing.Auction.Gen265.Sanesecurity.06091101
body     SS_PHISH_AUCT_G265_06091101 /dear ebay member! thank you for your choice of ebay\. by this message we report you that our support service has found an error in your account data\. we apologize for possible inconveniences but you can use your card only for identification/i
describe SS_PHISH_AUCT_G265_06091101 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G265_06091101 0.001

# Html.Phishing.Auction.Gen266u.Sanesecurity.06091200
body     SS_PHISH_AUCT_G266U_06091200 /:81\/ws\/ebayisapi/i
describe SS_PHISH_AUCT_G266U_06091200 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G266U_06091200 0.001

# Html.Phishing.Auction.Gen267u.Sanesecurity.06091201
body     SS_PHISH_AUCT_G267U_06091201 /\/\.secure\/ws23\/www\.ebay\.com\//i
describe SS_PHISH_AUCT_G267U_06091201 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G267U_06091201 0.001

# Html.Phishing.Auction.Gen268u.Sanesecurity.06091202
body     SS_PHISH_AUCT_G268U_06091202 /is host: cache-154\.proxyes\.aol\.com/i
describe SS_PHISH_AUCT_G268U_06091202 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G268U_06091202 0.001

# Html.Phishing.Auction.Gen269u.Sanesecurity.06091203
body     SS_PHISH_AUCT_G269U_06091203 /ip address: 154\.106\.12\.15/i
describe SS_PHISH_AUCT_G269U_06091203 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G269U_06091203 0.001

# Html.Phishing.Auction.Gen270.Sanesecurity.06091204
body     SS_PHISH_AUCT_G270_06091204 /\.100free\.com" border=0><\/span><span style="text-decoration:none\;text-underline:none"><img border=0.{0,50}http:\/\/pics\.ebaystatic\.com/i
describe SS_PHISH_AUCT_G270_06091204 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G270_06091204 0.001

# Html.Phishing.Auction.Gen271.Sanesecurity.06091205
body     SS_PHISH_AUCT_G271_06091205 /<p class=msonormal><b><span style="font-family:arial">details for item number: 300024048051<\/span><\/b><\/p><\/td><\/tr><tr style="mso-yfti-irow:1/i
describe SS_PHISH_AUCT_G271_06091205 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G271_06091205 0.001

# Html.Phishing.Auction.Gen272u.Sanesecurity.06091206
body     SS_PHISH_AUCT_G272U_06091206 /\/www\.ebay\.comsinginebayisapidll/i
describe SS_PHISH_AUCT_G272U_06091206 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G272U_06091206 0.001

# Html.Phishing.Auction.Gen273u.Sanesecurity.06091500
body     SS_PHISH_AUCT_G273U_06091500 /\/\.online\/ebayisapi/i
describe SS_PHISH_AUCT_G273U_06091500 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G273U_06091500 0.001

# Html.Phishing.Auction.Gen274u.Sanesecurity.06091501
body     SS_PHISH_AUCT_G274U_06091501 /\/\%20\/sign\/ebay\//i
describe SS_PHISH_AUCT_G274U_06091501 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G274U_06091501 0.001

# Email.Phishing.Auction.Gen275.Sanesecurity.06091502
rawbody  SS_PHISH_AUCT_G275_06091502 /size=3D"1"><b>Bay sent this message to you\.<\/b><br>Yo=\x0d\x0aur registered name is included/i
describe SS_PHISH_AUCT_G275_06091502 SaneSecurity: Text-based eBay phish
score    SS_PHISH_AUCT_G275_06091502 0.001

# Html.Phishing.Auction.Gen276.Sanesecurity.06091503
body     SS_PHISH_AUCT_G276_06091503 /we are delighted to invite you to join our bronze powerseller\/powerbuyer program\. as a powerseller\/powerbuyer,\&nbsp\; you will receive additional support/i
describe SS_PHISH_AUCT_G276_06091503 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G276_06091503 0.001

# Email.Phishing.Auction.Gen277.Sanesecurity.06091504
rawbody  SS_PHISH_AUCT_G277_06091504 /we are delighted to invite you to join our Bronze=20\x0d\x0a            PowerSeller\/PowerBuyer Program\. As a PowerSeller\/PowerBuyer,\&nbsp\; you=20\x0d\x0a            will receive additional support/i
describe SS_PHISH_AUCT_G277_06091504 SaneSecurity: Text-based eBay phish
score    SS_PHISH_AUCT_G277_06091504 0.001

# Email.Phishing.Auction.Gen278u.Sanesecurity.06091505
rawbody  SS_PHISH_AUCT_G278U_06091505 /\/www\/ebay-safeharbour\/signin\.html/i
describe SS_PHISH_AUCT_G278U_06091505 SaneSecurity: Text-based eBay phish
score    SS_PHISH_AUCT_G278U_06091505 0.001

# Html.Phishing.Auction.Gen277.Sanesecurity.06091506
body     SS_PHISH_AUCT_G277_06091506 /<b>ebay sent this message to ebay sent this message to/i
describe SS_PHISH_AUCT_G277_06091506 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G277_06091506 0.001

# Html.Phishing.Auction.Gen278u.Sanesecurity.06091507
body     SS_PHISH_AUCT_G278U_06091507 /\/www\/cgi-sign-in\/viewintemnumbersigni\.html\?compose/i
describe SS_PHISH_AUCT_G278U_06091507 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G278U_06091507 0.001

# Html.Phishing.Auction.Gen279u.Sanesecurity.06091508
body     SS_PHISH_AUCT_G279U_06091508 /\/www\/cgi-sign-in\/viewintemnumbersigni\.html/i
describe SS_PHISH_AUCT_G279U_06091508 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G279U_06091508 0.001

# Html.Phishing.Auction.Gen280.Sanesecurity.06091509
body     SS_PHISH_AUCT_G280_06091509 /size=1><b>ebay international ag sent this message from/i
describe SS_PHISH_AUCT_G280_06091509 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G280_06091509 0.001

# Email.Phishing.Auction.Gen281.Sanesecurity.06091510
rawbody  SS_PHISH_AUCT_G281_06091510 /Message from eBay Member Regarding Item \#150024091558/i
describe SS_PHISH_AUCT_G281_06091510 SaneSecurity: Text-based eBay phish
score    SS_PHISH_AUCT_G281_06091510 0.001

# Html.Phishing.Auction.Gen282u.Sanesecurity.06091511
body     SS_PHISH_AUCT_G282U_06091511 /\/ \/cgi-bin\/webscr_cmd=_login-run\//i
describe SS_PHISH_AUCT_G282U_06091511 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G282U_06091511 0.001

# Email.Phishing.Auction.Gen279.Sanesecurity.06091512
rawbody  SS_PHISH_AUCT_G279_06091512 /Question for your eBay item \#120910443403/i
describe SS_PHISH_AUCT_G279_06091512 SaneSecurity: Text-based eBay phish
score    SS_PHISH_AUCT_G279_06091512 0.001

# Html.Phishing.Auction.Gen280u.Sanesecurity.06091700
body     SS_PHISH_AUCT_G280U_06091700 /\/\.ws\/isapidll\//i
describe SS_PHISH_AUCT_G280U_06091700 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G280U_06091700 0.001

# Html.Phishing.Auction.Gen281u.Sanesecurity.06092300
body     SS_PHISH_AUCT_G281U_06092300 /\/\.wsb\/signin\.ebay\.com/i
describe SS_PHISH_AUCT_G281U_06092300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G281U_06092300 0.001

# Html.Phishing.Auction.Gen282u.Sanesecurity.06092300
body     SS_PHISH_AUCT_G282U_06092300 /\/signin\.ebay\.com\.ws\.ebayisapi\.dllsignin/i
describe SS_PHISH_AUCT_G282U_06092300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G282U_06092300 0.001

# Html.Phishing.Auction.Gen283.Sanesecurity.06100200.ger
body     SS_PHISH_AUCT_G283_06100200_GER /informationen aus der reihenfolge sind, weil wir k\xfcrzlich bestimmt haben, dass verschiedene computer bei ihrem ebay konto sich angemeldet haben, und mehrfache kennw\xf6rterausf\xe4lle waren anwesend vor den anmeldungen\. wir brauchen jetzt sie, ihre konteninformationen zu uns zu best\xe4tigen erneut\. wenn dies von/i
describe SS_PHISH_AUCT_G283_06100200_GER SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G283_06100200_GER 0.001

# Html.Phishing.Auction.Gen284u.Sanesecurity.06100300
body     SS_PHISH_AUCT_G284U_06100300 /\/\%20\.\.\%20\/ebayisapi\.dllsignin/i
describe SS_PHISH_AUCT_G284U_06100300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G284U_06100300 0.001

# Html.Phishing.Auction.Gen285.Sanesecurity.06100301
body     SS_PHISH_AUCT_G285_06100301 /dear customer,<\/b><br><br>ebay company, commitment to the security and confidentiality of your information extends to transactions conducted through the internet\.<br>as a financial institution, we know that your trust in us is most important\. in an effort to keep you aware of how ebay protects your account information/i
describe SS_PHISH_AUCT_G285_06100301 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G285_06100301 0.001

# Html.Phishing.Auction.Gen286.Sanesecurity.06100302
body     SS_PHISH_AUCT_G286_06100302 /size="1"><b>ebay international ag sent this message to you\.<\/b><br>your registered name is included/i
describe SS_PHISH_AUCT_G286_06100302 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G286_06100302 0.001

# Html.Phishing.Auction.Gen287u.Sanesecurity.06100303
body     SS_PHISH_AUCT_G287U_06100303 /\/www\/ebyreplyquestionfrommember\/ebayisapidllsignin/i
describe SS_PHISH_AUCT_G287U_06100303 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G287U_06100303 0.001

# Html.Phishing.Auction.Gen288u.Sanesecurity.06100500
body     SS_PHISH_AUCT_G288U_06100500 /:82\/https\.signin\.ebay\.com\//i
describe SS_PHISH_AUCT_G288U_06100500 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G288U_06100500 0.001

# Html.Phishing.Auction.Gen289.Sanesecurity.06100800
body     SS_PHISH_AUCT_G289_06100800 /due to the last changes apperead on ebay platform we need your assistance one more time for your security/i
describe SS_PHISH_AUCT_G289_06100800 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G289_06100800 0.001

# Html.Phishing.Auction.Gen290.Sanesecurity.06100801
body     SS_PHISH_AUCT_G290_06100801 /also there are inactive users wich doesn't use their ebay accounts anymore and we need an active marketplace/i
describe SS_PHISH_AUCT_G290_06100801 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G290_06100801 0.001

# Html.Phishing.Auction.Gen291.Sanesecurity.06101000
body     SS_PHISH_AUCT_G291_06101000 /size=2>dear member:<\/font><p><font face=arial size=2>you are late in paying your ebay fees of/i
describe SS_PHISH_AUCT_G291_06101000 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G291_06101000 0.001

# Html.Phishing.Auction.Gen292.Sanesecurity.06101300
body     SS_PHISH_AUCT_G292_06101300 /ebay sent this message to ebay member\. your registered name is included/i
describe SS_PHISH_AUCT_G292_06101300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G292_06101300 0.001

# Html.Phishing.Auction.Gen293u.Sanesecurity.06101600
body     SS_PHISH_AUCT_G293U_06101600 /\/wiki\/maps\/ebayisapidllviewitem/i
describe SS_PHISH_AUCT_G293U_06101600 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G293U_06101600 0.001

# Html.Phishing.Auction.Gen294u.Sanesecurity.06101700
body     SS_PHISH_AUCT_G294U_06101700 /\/\.ws1\/core1c4\.ebay\.com\//i
describe SS_PHISH_AUCT_G294U_06101700 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G294U_06101700 0.001

# Html.Phishing.Auction.Gen295.Sanesecurity.06102300
body     SS_PHISH_AUCT_G295_06102300 /<hr size="1"><br>\&nbsp\; hello,<br><br>\&nbsp\; hello , what happened with that item\?\. please respond i'm desperate!\. thank you,.{390,400}\/ebay\/login/i
describe SS_PHISH_AUCT_G295_06102300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G295_06102300 0.001

# Html.Phishing.Auction.Gen296.Sanesecurity.06102301
body     SS_PHISH_AUCT_G296_06102301 /alt="feedback score is 25,000 to 49,999".{800,900}\/ebay\/login/i
describe SS_PHISH_AUCT_G296_06102301 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G296_06102301 0.001

# Html.Phishing.Auction.Gen297.Sanesecurity.06102302
body     SS_PHISH_AUCT_G297_06102302 /we have suspended your account until such time that it can be safely restored to you\.we have taken this action because your account may have been hacked by a third party without your authorization\./i
describe SS_PHISH_AUCT_G297_06102302 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G297_06102302 0.001

# Email.Phishing.Auction.Gen298.Sanesecurity.06102303
rawbody  SS_PHISH_AUCT_G298_06102303 / has left you a message regarding item \#200034089155\x0d\x0a\x0d\x0aView the dispute thread to respond\.\x0d\x0ahttp:\/\//i
describe SS_PHISH_AUCT_G298_06102303 SaneSecurity: Text-based eBay phish
score    SS_PHISH_AUCT_G298_06102303 0.001

# Html.Phishing.Auction.Gen299.Sanesecurity.06102700
body     SS_PHISH_AUCT_G299_06102700 /did you recently change your bank, phone number or credit card\?\.<br>to ensure that your service is not interrupted, please update your billing information today/i
describe SS_PHISH_AUCT_G299_06102700 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G299_06102700 0.001

# Html.Phishing.Auction.Gen300.Sanesecurity.06102800
body     SS_PHISH_AUCT_G300_06102800 /<br><br>dear member,<br><br><\/td><\/tr><tr><td>ebay member <strong>.{450,550}stores\.ebay\.com\/pointingmouse-money-saving-store.{200,300}<\/a>has indicated that they already paid for item/i
describe SS_PHISH_AUCT_G300_06102800 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G300_06102800 0.001

# Html.Phishing.Auction.Gen301.Sanesecurity.06102801
body     SS_PHISH_AUCT_G301_06102801 /6666"><b>ebay sent this message\.<\/b><br>your registered name is/i
describe SS_PHISH_AUCT_G301_06102801 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G301_06102801 0.001

# Html.Phishing.Auction.Gen302.Sanesecurity.06103000
body     SS_PHISH_AUCT_G302_06103000 / color="\#666666" size="0"><b>ebay sent this message to all sellers with payments due\.<\/b><br>your ebay account has fees due and requires you action/i
describe SS_PHISH_AUCT_G302_06103000 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G302_06103000 0.001

# Html.Phishing.Auction.Gen303.Sanesecurity.06103001
body     SS_PHISH_AUCT_G303_06103001 /your ebay account has fees due and requires you action\./i
describe SS_PHISH_AUCT_G303_06103001 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G303_06103001 0.001

# Html.Phishing.Auction.Gen304.Sanesecurity.06103002
body     SS_PHISH_AUCT_G304_06103002 /dear ebay community member, <p>you \(or someone else\) has attempted to log in with your ebay id and 5 diffrent wrong passwords/i
describe SS_PHISH_AUCT_G304_06103002 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G304_06103002 0.001

# Html.Phishing.Auction.Gen305u.Sanesecurity.06110200
body     SS_PHISH_AUCT_G305U_06110200 /:84\/ws-us\/ebayisapi/i
describe SS_PHISH_AUCT_G305U_06110200 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G305U_06110200 0.001

# Html.Phishing.Auction.Gen306.Sanesecurity.06110201
body     SS_PHISH_AUCT_G306_06110201 /color=\#666666 size=1><b>ebay sent this message to member\.<\/b><br>your registered/i
describe SS_PHISH_AUCT_G306_06110201 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G306_06110201 0.001

# Html.Phishing.Auction.Gen307.Sanesecurity.06110300
body     SS_PHISH_AUCT_G307_06110300 /color=\#666666 size=1><b>ebay sent this message to you<\/b><br>your registered name/i
describe SS_PHISH_AUCT_G307_06110300 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G307_06110300 0.001

# Html.Phishing.Auction.Gen308.Sanesecurity.06110400
body     SS_PHISH_AUCT_G308_06110400 /size=2>dear <strong>user<\/strong>,.{0,150}last time when you visited our website you \( or a browser error \) forgot to <strong>sign out<\/strong>\./i
describe SS_PHISH_AUCT_G308_06110400 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G308_06110400 0.001

# Html.Phishing.Auction.Gen309.Sanesecurity.06110700
body     SS_PHISH_AUCT_G309_06110700 /<b>\&nbsp\;congratulations! you won ebay gift<\/b>/i
describe SS_PHISH_AUCT_G309_06110700 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G309_06110700 0.001

# Html.Phishing.Auction.Gen310.Sanesecurity.06110701
body     SS_PHISH_AUCT_G310_06110701 /ebay inc\. ramdomly extract another group of\&nbsp\;winners on /i
describe SS_PHISH_AUCT_G310_06110701 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G310_06110701 0.001

# Html.Phishing.Auction.Gen311.Sanesecurity.06110702
body     SS_PHISH_AUCT_G311_06110702 /will anounce the winners via e-mail on the same day with extraction/i
describe SS_PHISH_AUCT_G311_06110702 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G311_06110702 0.001

# Html.Phishing.Auction.Gen312.Sanesecurity.06110703
body     SS_PHISH_AUCT_G312_06110703 /color=\#666666 size=1><b>ebay sent this message to\&nbsp\;your registered email address\.<\/b><br>your registered name/i
describe SS_PHISH_AUCT_G312_06110703 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G312_06110703 0.001

# Html.Phishing.Auction.Gen313.Sanesecurity.06110704
body     SS_PHISH_AUCT_G313_06110704 /<strong>ebay = international ag sent this message to you\.<br><\/strong>your registered name/i
describe SS_PHISH_AUCT_G313_06110704 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G313_06110704 0.001

# Html.Phishing.Auction.Gen314.Sanesecurity.06110800
body     SS_PHISH_AUCT_G314_06110800 /due to our new ebay card agreement, you are required to confirm your identity/i
describe SS_PHISH_AUCT_G314_06110800 SaneSecurity: HTML-based eBay phish
score    SS_PHISH_AUCT_G314_06110800 0.001

# Html.Phishing.Auction.Gen3