# This SpamAssassin ruleset was auto-generated from signatures provided by
# SaneSecurity <http://www.sanesecurity.com/clamav/>, originally intended
# for use with ClamAV.  As such, it should be considered experimental at
# this stage, and not used in production environments without extensive
# testing first.
# 
# This rule file is quite large, and should only be used in environments
# where the sa-compile utility is available to optimize the large number
# of regular expressions it contains.  Even so, there will be performance
# implications--a larger memory footprint at the very least.
# 
# The script that was used to produce this rule file (ndb2cf.pl) was
# written by Robert LeBlanc <rjl@renaissoft.com>.  Bug reports, comments
# and suggestions should be directed to that address.
# 
# This rule file is provided as-is, without warranty or conditions of any
# kind, either express or implied.  Use of these rules is at your own risk.

# File: 80_SS_Phish.cf
# Auto-generated: 2008-08-08 11:28:03 UTC
# Rule count: 9017

# Html.Phishing.Sanesecurity.TestSig
body     SS_PHISH_TEST /<sanesecurity>dr1aylariadiax!_!lebr_awoewiehi5s1oapro8yl\#chlac7iutoezouqluviud<\/sanesecurity>/i
describe SS_PHISH_TEST SaneSecurity: HTML-based phishing test signature
score    SS_PHISH_TEST 0.001

# Email.Sanesecurity.TestSig_Type4_Hdr
rawbody  SS_TEST4H /Subject:.{0,30}rrg63Uhj2UCyECcruX7D83A4qd5UA5vnlgwJp6b6fmPZpObZJAbftehuhRAXFby/i
describe SS_TEST4H SaneSecurity: Text-based phishing test signature
score    SS_TEST4H 0.001

# Email.Sanesecurity.TestSig_Type4_Bdy
rawbody  SS_TEST4B /body_rrg63Uhj2UCyECcruX7D83A4qd5UA5vnlgwJp6b6fmPZ0ajdjkwjnSSDfsdfsdfnwerd/i
describe SS_TEST4B SaneSecurity: Text-based phishing test signature
score    SS_TEST4B 0.001

# Html.Sanesecurity.TestSig_Type3_Bdy
body     SS_TEST3B /body_rrg63uhj2ucyeccrux7d83a4qd5ua5vnlgwjp6b6fmpzpobzjabftehuhraxfbyzzzzz/i
describe SS_TEST3B SaneSecurity: HTML-based phishing test signature
score    SS_TEST3B 0.001

# Html.Phishing.Rdi.Gen001.Sanesecurity.06030200
body     SS_PHISH_RDI_G001_06030200 /verify your account by logging into.{0,300}http:\/\/google\.com\/url\?sa=p/i
describe SS_PHISH_RDI_G001_06030200 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G001_06030200 0.001

# Html.Phishing.Rdi.Gen002.Sanesecurity.06030201
body     SS_PHISH_RDI_G002_06030201 /update your settings.{0,300}http:\/\/google\.com\/url\?sa=p/i
describe SS_PHISH_RDI_G002_06030201 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G002_06030201 0.001

# Html.Phishing.Rdi.Gen003.Sanesecurity.06030202
body     SS_PHISH_RDI_G003_06030202 /the link below.{0,300}http:\/\/google\.com\/url\?sa=p/i
describe SS_PHISH_RDI_G003_06030202 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G003_06030202 0.001

# Html.Phishing.Rdi.Gen004.Sanesecurity.06031300
body     SS_PHISH_RDI_G004_06031300 /<td align="middle"><a href="http:\/\/rds\.yahoo\.com\/_ylt=.{0,100}target="_blank"><img alt="respond now"/i
describe SS_PHISH_RDI_G004_06031300 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G004_06031300 0.001

# Html.Phishing.Rdi.Gen005.Sanesecurity.06031301
body     SS_PHISH_RDI_G005_06031301 /account active, click here:.{0,50}href="http:\/\/rds\.yahoo\.com\/_ylt/i
describe SS_PHISH_RDI_G005_06031301 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G005_06031301 0.001

# Html.Phishing.Rdi.Gen006.Sanesecurity.06031500
body     SS_PHISH_RDI_G006_06031500 /href="http:\/\/rds\.yahoo\.com\/_ylt=.{0,100}src="http:\/\/pics\.ebaystatic/i
describe SS_PHISH_RDI_G006_06031500 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G006_06031500 0.001

# Html.Phishing.Rdi.Gen007.Sanesecurity.06031501
body     SS_PHISH_RDI_G007_06031501 /click here.{0,50}href="http:\/\/rds\.yahoo\.com\/s=/i
describe SS_PHISH_RDI_G007_06031501 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G007_06031501 0.001

# Html.Phishing.Rdi.Gen008.Sanesecurity.06031502
body     SS_PHISH_RDI_G008_06031502 /your registered name is included to show this message originated from ebay\..{0,50}http:\/\/rds\.yahoo\.com\/_ylt/i
describe SS_PHISH_RDI_G008_06031502 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G008_06031502 0.001

# Html.Phishing.Rdi.Gen009.Sanesecurity.06031503
body     SS_PHISH_RDI_G009_06031503 /following link:.{0,100}href="http:\/\/rds\.yahoo\.com\/_ylt=/i
describe SS_PHISH_RDI_G009_06031503 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G009_06031503 0.001

# Html.Phishing.Rdi.Gen010.Sanesecurity.06032400
body     SS_PHISH_RDI_G010_06032400 /to see your message: <ul><li><a target=3d"_blank" href=3d"http:\/\/rds\.yahoo\.com\/_ylt/i
describe SS_PHISH_RDI_G010_06032400 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G010_06032400 0.001

# Html.Phishing.Rdi.Gen012.Sanesecurity.06032800
body     SS_PHISH_RDI_G012_06032800 /if you don't agree with this e-mail and if you need assistance with your account.{0,500}href="http:\/\/www\.google\.com\/url\?sa=u\&start=4\&q=http:\/\//i
describe SS_PHISH_RDI_G012_06032800 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G012_06032800 0.001

# Html.Phishing.Rdi.Gen013.Sanesecurity.06032801
body     SS_PHISH_RDI_G013_06032801 /<a href="http:\/\/www\.google\.com\/pagead\/iclk\?sa=.{0,200}https:\/\/www\.chase\.com\//i
describe SS_PHISH_RDI_G013_06032801 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G013_06032801 0.001

# Html.Phishing.Rdi.Gen014.Sanesecurity.06032900
body     SS_PHISH_RDI_G014_06032900 /please confirm your identity here: <a href="http:\/\/www\.google\.com\/url\?sa=u\&start=4\&q=/i
describe SS_PHISH_RDI_G014_06032900 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G014_06032900 0.001

# Html.Phishing.Rdi.Gen015.Sanesecurity.06032901
body     SS_PHISH_RDI_G015_06032901 /if you don't agree with this e-mail and if you need assistance with your account <b><a target="_blank" href="http:\/\/www\.google\.com\/url\?sa=u\&start=4\&q=/i
describe SS_PHISH_RDI_G015_06032901 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G015_06032901 0.001

# Html.Phishing.Rdi.Gen016.Sanesecurity.06032300
body     SS_PHISH_RDI_G016_06032300 /br><br>to see your message: <ul><li><a target="_blank" href="http:\/\/rds\.yahoo\.com\/_ylt/i
describe SS_PHISH_RDI_G016_06032300 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G016_06032300 0.001

# Html.Phishing.Rdi.Gen017.Sanesecurity.06033100
body     SS_PHISH_RDI_G017_06033100 /log into your account and follow the instructions\.<\/strong><\/font><\/p><p align=left><br><a href="http:\/\/www\.google\.com\/pagead\/iclk\?sa=/i
describe SS_PHISH_RDI_G017_06033100 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G017_06033100 0.001

# Html.Phishing.Rdi.Gen018.Sanesecurity.06033101
body     SS_PHISH_RDI_G018_06033101 /protect yourself from spoof \(fake\) emails at:<br><a href="http:\/\/rds\.yahoo\.com\/_ylt/i
describe SS_PHISH_RDI_G018_06033101 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G018_06033101 0.001

# Html.Phishing.Rdi.Gen019.Sanesecurity.06040500
body     SS_PHISH_RDI_G019_06040500 /click on the link below to confirm your information.{0,100}<a href="http:\/\/rds\.yahoo\.com\/_ylt=/i
describe SS_PHISH_RDI_G019_06040500 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G019_06040500 0.001

# Html.Phishing.Rdi.Gen020.Sanesecurity.06040700
body     SS_PHISH_RDI_G020_06040700 /<br>login to your <a target="_blank" href="http:\/\/www\.google\.com\/url\?sa=u\&start=4\&q=/i
describe SS_PHISH_RDI_G020_06040700 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G020_06040700 0.001

# Html.Phishing.Rdi.Gen021.Sanesecurity.06041000
body     SS_PHISH_RDI_G021_06041000 /to see your message: <ul><li><a target="_blank" href="http:\/\/rds\.yahoo\.com\/_ylt=/i
describe SS_PHISH_RDI_G021_06041000 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G021_06041000 0.001

# Html.Phishing.Rdi.Gen022.Sanesecurity.06041001
body     SS_PHISH_RDI_G022_06041001 /your account has been<br>\&nbsp\;\&nbsp\; temporarily <a href="http:\/\/www\.google\.com\/url\?q=/i
describe SS_PHISH_RDI_G022_06041001 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G022_06041001 0.001

# Html.Phishing.Rdi.Gen023.Sanesecurity.06042600
body     SS_PHISH_RDI_G023_06042600 /we have<br>\&nbsp\;\&nbsp\; temporarily <a href="http:\/\/www\.google\.com\/url\?q=http:\/\//i
describe SS_PHISH_RDI_G023_06042600 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G023_06042600 0.001

# Html.Phishing.Rdi.Gen024.Sanesecurity.06042601
body     SS_PHISH_RDI_G024_06042601 /online banking please\&nbsp\;<a href="http:\/\/www\.google\.com\/url\?q=/i
describe SS_PHISH_RDI_G024_06042601 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G024_06042601 0.001

# Html.Phishing.Rdi.Gen025.Sanesecurity.06060700
body     SS_PHISH_RDI_G025_06060700 /\/\.-\/redirection\.to\./i
describe SS_PHISH_RDI_G025_06060700 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G025_06060700 0.001

# Html.Phishing.Rdi.Gen026.Sanesecurity.06061200
body     SS_PHISH_RDI_G026_06061200 /<a target="_blank" href="http:\/\/rds\.yahoo\..{0,200}\/www\.citybank\.com/i
describe SS_PHISH_RDI_G026_06061200 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G026_06061200 0.001

# Html.Phishing.Rdi.Gen027.Sanesecurity.06061201
body     SS_PHISH_RDI_G027_06061201 /to confirm your account status please <a href="http:\/\/www\.google\.com\/url\?q=http:\/\//i
describe SS_PHISH_RDI_G027_06061201 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G027_06061201 0.001

# Html.Phishing.Rdi.Gen028.Sanesecurity.06061600
body     SS_PHISH_RDI_G028_06061600 /<a href="http:\/\/.{0,50}redirect-to-signin-ebay-/i
describe SS_PHISH_RDI_G028_06061600 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G028_06061600 0.001

# Html.Phishing.Rdi.Gen029.Sanesecurity.06062300
body     SS_PHISH_RDI_G029_06062300 /verify your account by logging into your paypal account at <a href="http:\/\/www\.google\.com\/pagead\//i
describe SS_PHISH_RDI_G029_06062300 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G029_06062300 0.001

# Html.Phishing.Rdi.Gen030.Sanesecurity.06062301
body     SS_PHISH_RDI_G030_06062301 /respond to this question in my messages.{0,200}<a href="http:\/\/rds\.yahoo\./i
describe SS_PHISH_RDI_G030_06062301 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G030_06062301 0.001

# Html.Phishing.Rdi.Gen031.Sanesecurity.06062400
body     SS_PHISH_RDI_G031_06062400 /your registered name is included to show this message originated from ebay\. <a href="http:\/\/www\.google\.com\/pagead\//i
describe SS_PHISH_RDI_G031_06062400 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G031_06062400 0.001

# Html.Phishing.Rdi.Gen032.Sanesecurity.06062500
body     SS_PHISH_RDI_G032_06062500 /\/redirect\/\.\.\.\/domain=signin\.ebay/i
describe SS_PHISH_RDI_G032_06062500 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G032_06062500 0.001

# Html.Phishing.Rdi.Gen033.Sanesecurity.06062700
body     SS_PHISH_RDI_G033_06062700 /please click on the link bellow:<br><br><br><\/font><a target="_blank" href="http:\/\/rds\.yahoo\./i
describe SS_PHISH_RDI_G033_06062700 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G033_06062700 0.001

# Html.Phishing.Rdi.Gen034.Sanesecurity.06062701
body     SS_PHISH_RDI_G034_06062701 /please click on the link bellow:<br><br><br><\/font><a target="_blank" href="http:\/\/www\.google\./i
describe SS_PHISH_RDI_G034_06062701 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G034_06062701 0.001

# Html.Phishing.Rdi.Gen035.Sanesecurity.06070700
body     SS_PHISH_RDI_G035_06070700 /banking online\.<\/p><p><a style="color: \#0000ff" href="http:\/\/rds\.yahoo\./i
describe SS_PHISH_RDI_G035_06070700 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G035_06070700 0.001

# Html.Phishing.Rdi.Gen036.Sanesecurity.06070701
body     SS_PHISH_RDI_G036_06070701 /href="http:\/\/www\.google\.com\/url.{0,50}loginmember\.do/i
describe SS_PHISH_RDI_G036_06070701 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G036_06070701 0.001

# Html.Phishing.Rdi.Gen037.Sanesecurity.06070900
body     SS_PHISH_RDI_G037_06070900 /this message originated from ebay\. <a href="http:\/\/google\.com\/url\?/i
describe SS_PHISH_RDI_G037_06070900 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G037_06070900 0.001

# Html.Phishing.Rdi.Gen038.Sanesecurity.06070901
body     SS_PHISH_RDI_G038_06070901 /respond to this question in my messages\.<\/b><\/font><\/td><\/tr><tr><td align="center"><a href="http:\/\/google\.com\/url/i
describe SS_PHISH_RDI_G038_06070901 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G038_06070901 0.001

# Html.Phishing.Rdi.Gen039.Sanesecurity.06071100
body     SS_PHISH_RDI_G039_06071100 /verification check\.<br>please <a href="http:\/\/www\.google\.com\/url\?/i
describe SS_PHISH_RDI_G039_06071100 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G039_06071100 0.001

# Html.Phishing.Rdi.Gen040.Sanesecurity.06071200
body     SS_PHISH_RDI_G040_06071200 /records click on the following link: <\/p><p><a href="http:\/\/www\.google\.com\/url\?sa/i
describe SS_PHISH_RDI_G040_06071200 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G040_06071200 0.001

# Html.Phishing.Rdi.Gen041.Sanesecurity.06071400
body     SS_PHISH_RDI_G041_06071400 /"http:\/\/www\.google\.de\/url\?q=.{0,50}ebayisapi/i
describe SS_PHISH_RDI_G041_06071400 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G041_06071400 0.001

# Html.Phishing.Rdi.Gen042.Sanesecurity.06072100
body     SS_PHISH_RDI_G042_06072100 /src="http:\/\/images\.google\.com\/images\?q.{0,150}wamu/i
describe SS_PHISH_RDI_G042_06072100 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G042_06072100 0.001

# Html.Phishing.Rdi.Gen043.Sanesecurity.06072300
body     SS_PHISH_RDI_G043_06072300 /paypal\.com\/en_us\/i\/scr\/pixel\.gif" width="1" height="1" \/><a target="_blank" href="http:\/\/www\.google\.c/i
describe SS_PHISH_RDI_G043_06072300 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G043_06072300 0.001

# Html.Phishing.Rdi.Gen044.Sanesecurity.06072400
body     SS_PHISH_RDI_G044_06072400 /please confirm your identity and <a target="_blank" href="http:\/\/www\.google\.com\/url\?/i
describe SS_PHISH_RDI_G044_06072400 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G044_06072400 0.001

# Html.Phishing.Rdi.Gen045.Sanesecurity.06072401
body     SS_PHISH_RDI_G045_06072401 /click on the link bellow:<br><br><br><\/font><a target="_blank" _ _ _ _ _ _ href="http:\/\/rds\.yahoo\.com\/_/i
describe SS_PHISH_RDI_G045_06072401 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G045_06072401 0.001

# Html.Phishing.Rdi.Gen046.Sanesecurity.06072500
body     SS_PHISH_RDI_G046_06072500 /as a new email address for<br>your paypal account\..{0,500}href="http:\/\/www\.google\.com\/pagead\/iclk/i
describe SS_PHISH_RDI_G046_06072500 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G046_06072500 0.001

# Html.Phishing.Rdi.Gen047.Sanesecurity.06080200
body     SS_PHISH_RDI_G047_06080200 /\/redirect\.to\/www\.bankofamerica/i
describe SS_PHISH_RDI_G047_06080200 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G047_06080200 0.001

# Html.Phishing.Rdi.Gen048.Sanesecurity.06080201
body     SS_PHISH_RDI_G048_06080201 /\/\.redirect\.to\.cgi1\.ebay\.com/i
describe SS_PHISH_RDI_G048_06080201 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G048_06080201 0.001

# Html.Phishing.Rdi.Gen049.Sanesecurity.06080202
body     SS_PHISH_RDI_G049_06080202 /\/redirect\.to\.signin\.ebay/i
describe SS_PHISH_RDI_G049_06080202 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G049_06080202 0.001

# Html.Phishing.Rdi.Gen050.Sanesecurity.06080203
body     SS_PHISH_RDI_G050_06080203 /\/redirect\.to\/www\.paypal/i
describe SS_PHISH_RDI_G050_06080203 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G050_06080203 0.001

# Html.Phishing.Rdi.Gen051.Sanesecurity.06080300
body     SS_PHISH_RDI_G051_06080300 /<label for=bank_routing>routing number<\/label>:.{0,100}src="http:\/\/images\.google\./i
describe SS_PHISH_RDI_G051_06080300 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G051_06080300 0.001

# Html.Phishing.Rdi.Gen052.Sanesecurity.06080400
body     SS_PHISH_RDI_G052_06080400 /href="http:\/\/www\.google\.com\/url\?q.{0,100}\.ebay\./i
describe SS_PHISH_RDI_G052_06080400 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G052_06080400 0.001

# Html.Phishing.Rdi.Gen053.Sanesecurity.06080401
body     SS_PHISH_RDI_G053_06080401 /href="http:\/\/www\.google\.com\/url\?q.{0,100}\.paypal\./i
describe SS_PHISH_RDI_G053_06080401 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G053_06080401 0.001

# Html.Phishing.Rdi.Gen054.Sanesecurity.06080700
body     SS_PHISH_RDI_G054_06080700 /<a href="http:\/\/www\.google\.com\/url\?.{0,200}take the survey!/i
describe SS_PHISH_RDI_G054_06080700 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G054_06080700 0.001

# Html.Phishing.Rdi.Gen055.Sanesecurity.06080800
body     SS_PHISH_RDI_G055_06080800 /http:\/\/www\.google\.com\/url\?q.{0,100}enrollment procedure/i
describe SS_PHISH_RDI_G055_06080800 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G055_06080800 0.001

# Html.Phishing.Rdi.Gen056.Sanesecurity.06080900
body     SS_PHISH_RDI_G056_06080900 /src="http:\/\/images\.google\.com\/images\?q.{0,4000}verification proccess/i
describe SS_PHISH_RDI_G056_06080900 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G056_06080900 0.001

# Html.Phishing.Rdi.Gen057.Sanesecurity.06081300
body     SS_PHISH_RDI_G057_06081300 /http:\/\/maps\.google\.com\/local_url\?q=http:\/\/.{0,100}paypal/i
describe SS_PHISH_RDI_G057_06081300 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G057_06081300 0.001

# Html.Phishing.Rdi.Gen058.Sanesecurity.06081301
body     SS_PHISH_RDI_G058_06081301 /http:\/\/maps\.google\.com\/local_url\?q=http:\/\/.{0,100}ebay\x0d\x0a/i
describe SS_PHISH_RDI_G058_06081301 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G058_06081301 0.001

# Html.Phishing.Rdi.Gen059.Sanesecurity.06081302
body     SS_PHISH_RDI_G059_06081302 /http:\/\/maps\.google\.com\/local_url\?q=http:\/\/.{0,100}chase\x0d\x0a/i
describe SS_PHISH_RDI_G059_06081302 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G059_06081302 0.001

# Html.Phishing.Rdi.Gen060.Sanesecurity.06081400
body     SS_PHISH_RDI_G060_06081400 /href="http:\/\/rds\.yahoo\.com\/_y.{0,150}\/www\.paypal\.com\//i
describe SS_PHISH_RDI_G060_06081400 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G060_06081400 0.001

# Html.Phishing.Rdi.Gen061.Sanesecurity.06081500
body     SS_PHISH_RDI_G061_06081500 /href="http:\/\/www\.google\.com\/pagead\/iclk.{0,300}\/www\.paypal\./i
describe SS_PHISH_RDI_G061_06081500 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G061_06081500 0.001

# Html.Phishing.Rdi.Gen062.Sanesecurity.06081501
body     SS_PHISH_RDI_G062_06081501 /href="http:\/\/www\.google\.com\/pagead\/iclk.{0,300}\/www\.ebay\./i
describe SS_PHISH_RDI_G062_06081501 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G062_06081501 0.001

# Html.Phishing.Rdi.Gen063.Sanesecurity.06081600
body     SS_PHISH_RDI_G063_06081600 /href="http:\/\/rds\.yahoo\.com\/_y.{0,300}wachovia/i
describe SS_PHISH_RDI_G063_06081600 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G063_06081600 0.001

# Html.Phishing.Rdi.Gen064.Sanesecurity.06082100
body     SS_PHISH_RDI_G064_06082100 /href="http:\/\/rds\.yahoo\.com\/_y.{0,300}paypal/i
describe SS_PHISH_RDI_G064_06082100 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G064_06082100 0.001

# Html.Phishing.Rdi.Gen065.Sanesecurity.06082500
body     SS_PHISH_RDI_G065_06082500 /<a href="http:\/\/www\.google\..{0,100}\/www\.centralmnfcu\.org\//i
describe SS_PHISH_RDI_G065_06082500 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G065_06082500 0.001

# Html.Phishing.Rdi.Gen066.Sanesecurity.06082501
body     SS_PHISH_RDI_G066_06082501 /<a href="http:\/\/www\.google\..{0,100}\/www\.eonlinebank\.com\//i
describe SS_PHISH_RDI_G066_06082501 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G066_06082501 0.001

# Html.Phishing.Rdi.Gen067.Sanesecurity.06082800
body     SS_PHISH_RDI_G067_06082800 /http:\/\/rds\.yahoo\.com\/_ylt=.{0,350}\/www\.amazon\.com\//i
describe SS_PHISH_RDI_G067_06082800 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G067_06082800 0.001

# Html.Phishing.Rdi.Gen068.Sanesecurity.06082801
body     SS_PHISH_RDI_G068_06082801 /http:\/\/www\.google\.com\/url\?q.{0,350}\/www\.amazon\.com\//i
describe SS_PHISH_RDI_G068_06082801 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G068_06082801 0.001

# Html.Phishing.Rdi.Gen069.Sanesecurity.06090600
body     SS_PHISH_RDI_G069_06090600 /href="http:\/\/www\.google\.com\/pagead\/iclk.{0,300}\/webscr/i
describe SS_PHISH_RDI_G069_06090600 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G069_06090600 0.001

# Html.Phishing.Rdi.Gen070.Sanesecurity.06090601
body     SS_PHISH_RDI_G070_06090601 /href="http:\/\/www\.google\.com\/pagead\/iclk.{0,300}paypal/i
describe SS_PHISH_RDI_G070_06090601 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G070_06090601 0.001

# Html.Phishing.Rdi.Gen071.Sanesecurity.06090602
body     SS_PHISH_RDI_G071_06090602 /href="http:\/\/www\.google\.com\/pagead\/iclk.{0,300}ebay/i
describe SS_PHISH_RDI_G071_06090602 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G071_06090602 0.001

# Html.Phishing.Rdi.Gen072.Sanesecurity.06092600
body     SS_PHISH_RDI_G072_06092600 /click the link bellow to continue:<br><a href="http:\/\/www\.google\.com\/url\?sa=u\&start=4\&q=http:\/\//i
describe SS_PHISH_RDI_G072_06092600 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G072_06092600 0.001

# Html.Phishing.Rdi.Gen073.Sanesecurity.06101100
body     SS_PHISH_RDI_G073_06101100 /please enroll in our security upgrade by<\/b><a href="http:\/\/www\.google\.com\//i
describe SS_PHISH_RDI_G073_06101100 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G073_06101100 0.001

# Html.Phishing.Rdi.Gen074.Sanesecurity.06102400
body     SS_PHISH_RDI_G074_06102400 /<a href="http:\/\/www\.aol\.com\/ams\/clickthruredirect.{0,150}moneybookers/i
describe SS_PHISH_RDI_G074_06102400 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G074_06102400 0.001

# Html.Phishing.Rdi.Gen075.Sanesecurity.06102401
body     SS_PHISH_RDI_G075_06102401 /<a href="http:\/\/www\.aol\.com\/ams\/clickthruredirect.{0,150}\.ncua\./i
describe SS_PHISH_RDI_G075_06102401 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G075_06102401 0.001

# Html.Phishing.Rdi.Gen076.Sanesecurity.06102402
body     SS_PHISH_RDI_G076_06102402 /<a href="http:\/\/www\.aol\.com\/ams\/clickthruredirect.{0,150}e-gold/i
describe SS_PHISH_RDI_G076_06102402 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G076_06102402 0.001

# Html.Phishing.Rdi.Gen077.Sanesecurity.06102403
body     SS_PHISH_RDI_G077_06102403 /<a href="http:\/\/www\.aol\.com\/ams\/clickthruredirect.{0,150}\.neteller\./i
describe SS_PHISH_RDI_G077_06102403 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G077_06102403 0.001

# Html.Phishing.Rdi.Gen078.Sanesecurity.06102404
body     SS_PHISH_RDI_G078_06102404 /<a href="http:\/\/www\.aol\.com\/ams\/clickthruredirect.{0,150}www\.paypal\.com/i
describe SS_PHISH_RDI_G078_06102404 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G078_06102404 0.001

# Html.Phishing.Rdi.Gen079.Sanesecurity.06102405
body     SS_PHISH_RDI_G079_06102405 /<a href="http:\/\/www\.aol\.com\/ams\/clickthruredirect.{0,150}\.ebay\./i
describe SS_PHISH_RDI_G079_06102405 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G079_06102405 0.001

# Html.Phishing.Rdi.Gen080.Sanesecurity.06120700
body     SS_PHISH_RDI_G080_06120700 /If you did not authorize this change or if you need assistance.{0,150}<a href="http:\/\/www\.google\.com\/url\?sa=/i
describe SS_PHISH_RDI_G080_06120700 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G080_06120700 0.001

# Html.Phishing.Rdi.Gen081.Sanesecurity.06120800
body     SS_PHISH_RDI_G081_06120800 /href.{0,5}http:\/\/www\.google\.com\/pagead\/iclk\?sa.{0,400}\.ebay\./i
describe SS_PHISH_RDI_G081_06120800 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G081_06120800 0.001

# Html.Phishing.Rdi.Gen082.Sanesecurity.06120801
body     SS_PHISH_RDI_G082_06120801 /href.{0,5}http:\/\/www\.google\.com\/pagead\/iclk\?sa.{0,400}\.paypal\./i
describe SS_PHISH_RDI_G082_06120801 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G082_06120801 0.001

# Html.Phishing.Rdi.Gen083.Sanesecurity.06120802
body     SS_PHISH_RDI_G083_06120802 /href.{0,5}http:\/\/www\.google\.com\/pagead\/iclk\?sa.{0,400}\.chase\.com/i
describe SS_PHISH_RDI_G083_06120802 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G083_06120802 0.001

# Html.Phishing.Rdi.Gen084.Sanesecurity.07011300
body     SS_PHISH_RDI_G084_07011300 /will verify your identity.*http:\/\/maps\.google\.com\/local_url\?q/i
describe SS_PHISH_RDI_G084_07011300 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G084_07011300 0.001

# Html.Phishing.Rdi.Gen085.Sanesecurity.07051800
body     SS_PHISH_RDI_G085_07051800 /http:\/\/rds\.yahoo\.com\/_ylt=.{0,300}ebay/i
describe SS_PHISH_RDI_G085_07051800 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G085_07051800 0.001

# Html.Phishing.Rdi.Gen086.Sanesecurity.07051801
body     SS_PHISH_RDI_G086_07051801 /http:\/\/www\.aol\.com\/redir\.adp\?_url=http:\/\/.{0,300}paypal/i
describe SS_PHISH_RDI_G086_07051801 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G086_07051801 0.001

# Html.Phishing.Rdi.Gen087.Sanesecurity.07052900
body     SS_PHISH_RDI_G087_07052900 /href="http:\/\/us\.ebayobjects\.com\/6k\;h=http:\/\/(0|1|2|3|4|5|6|7|8|9)/i
describe SS_PHISH_RDI_G087_07052900 SaneSecurity: HTML-based redirect
score    SS_PHISH_RDI_G087_07052900 0.001

# Html.Phishing.Jsc.Gen000.Sanesecurity.06030100
rawbody  SS_PHISH_JSC_G000_06030100 /isit our.{0,10}<a href="javascript:ol\('http:\/\/clic/i
describe SS_PHISH_JSC_G000_06030100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_JSC_G000_06030100 0.001

# Html.Phishing.Onf.Gen001.Sanesecurity.06030101
body     SS_PHISH_ONF_G001_06030101 /target=_blank onfiltered="return opennonhelpwindow\(this/i
describe SS_PHISH_ONF_G001_06030101 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_ONF_G001_06030101 0.001

# Html.Phishing.Hex.Gen001.Sanesecurity.06041400
body     SS_PHISH_HEX_G001_06041400 /http:\/\/0x.{0,2}\.0x.{0,2}\.0x/i
describe SS_PHISH_HEX_G001_06041400 SaneSecurity: HTML-based links contain hex
score    SS_PHISH_HEX_G001_06041400 0.001

# Email.Phishing.Hex.Gen002.Sanesecurity.06041401
rawbody  SS_PHISH_HEX_G002_06041401 /http:\/\/0x.{0,2}\.0x.{0,2}\.0x/i
describe SS_PHISH_HEX_G002_06041401 SaneSecurity: Text-based links contain hex
score    SS_PHISH_HEX_G002_06041401 0.001

# Html.Phishing.Hex.Gen003.Sanesecurity.06070700
body     SS_PHISH_HEX_G003_06070700 /<a href="http:\/\/0xd.{0,50}\/chaseonline\.chase\.com/i
describe SS_PHISH_HEX_G003_06070700 SaneSecurity: HTML-based links contain hex
score    SS_PHISH_HEX_G003_06070700 0.001

# Html.Phishing.Hex.Gen004.Sanesecurity.06080700
body     SS_PHISH_HEX_G004_06080700 /to get started, please follow the link below: <b><a target="_blank" href="http:\/\/0x/i
describe SS_PHISH_HEX_G004_06080700 SaneSecurity: HTML-based links contain hex
score    SS_PHISH_HEX_G004_06080700 0.001

# Email.Phishing.Hex.Gen005.Sanesecurity.06122300
rawbody  SS_PHISH_HEX_G005_06122300 /eBay\. <A href="http:\/\/0x/i
describe SS_PHISH_HEX_G005_06122300 SaneSecurity: Text-based links contain hex
score    SS_PHISH_HEX_G005_06122300 0.001

# Html.Phishing.Hex.Gen006.Sanesecurity.06122800
body     SS_PHISH_HEX_G006_06122800 /href=3d"http:\/\/0x.{0,150}ebayisapi/i
describe SS_PHISH_HEX_G006_06122800 SaneSecurity: HTML-based links contain hex
score    SS_PHISH_HEX_G006_06122800 0.001

# Html.Phishing.Hex.Gen007.Sanesecurity.07011000
body     SS_PHISH_HEX_G007_07011000 /registered email address is included to show this message originated from eBay\. <a href="http:\/\/0x/i
describe SS_PHISH_HEX_G007_07011000 SaneSecurity: HTML-based links contain hex
score    SS_PHISH_HEX_G007_07011000 0.001

# Html.Phishing.Hex.Gen008.Sanesecurity.07022300
body     SS_PHISH_HEX_G008_07022300 /<a href="http:\/\/0x.{0,250}online account/i
describe SS_PHISH_HEX_G008_07022300 SaneSecurity: HTML-based links contain hex
score    SS_PHISH_HEX_G008_07022300 0.001

# Html.Phishing.Hex.Gen009.Sanesecurity.07052900
body     SS_PHISH_HEX_G009_07052900 /http:\/\/0x.*http:\/\/pics\.ebaystatic/i
describe SS_PHISH_HEX_G009_07052900 SaneSecurity: HTML-based links contain hex
score    SS_PHISH_HEX_G009_07052900 0.001

# Email.Phishing.Hex.Gen010.Sanesecurity.07122700.pdf
rawbody  SS_PHISH_HEX_G010_07122700_PDF /\%PDF-.*\/A<<\/Type\/Action\/S\/URI\/URI\(http:\/\/0x/i
describe SS_PHISH_HEX_G010_07122700_PDF SaneSecurity: Text-based links contain hex
score    SS_PHISH_HEX_G010_07122700_PDF 0.001

# Html.Phishing.Cur.Gen001.Sanesecurity.06050700
body     SS_PHISH_CUR_G001_06050700 /http:\/\/dsl-.{0,30}prod-empresarial\.com\.mx/i
describe SS_PHISH_CUR_G001_06050700 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G001_06050700 0.001

# Html.Phishing.Cur.Gen002.Sanesecurity.06050701
body     SS_PHISH_CUR_G002_06050701 /http:\/\/dsl-.{0,50}\/paypal\//i
describe SS_PHISH_CUR_G002_06050701 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G002_06050701 0.001

# Html.Phishing.Cur.Gen003.Sanesecurity.06050702
body     SS_PHISH_CUR_G003_06050702 /http:\/\/dsl-.{0,50}\/online\.wamu\.com\//i
describe SS_PHISH_CUR_G003_06050702 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G003_06050702 0.001

# Html.Phishing.Cur.Gen004.Sanesecurity.06050703
body     SS_PHISH_CUR_G004_06050703 /http:\/\/static-.{0,50}\/paypal\//i
describe SS_PHISH_CUR_G004_06050703 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G004_06050703 0.001

# Html.Phishing.Cur.Gen005.Sanesecurity.06051500
body     SS_PHISH_CUR_G005_06051500 /http:\/\/dsl-.{0,50}\/online\.wamu\.com\//i
describe SS_PHISH_CUR_G005_06051500 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G005_06051500 0.001

# Html.Phishing.Cur.Gen006.Sanesecurity.06052000
body     SS_PHISH_CUR_G006_06052000 /http:\/\/.{0,20}\/horde\/.{0,30}webscr/i
describe SS_PHISH_CUR_G006_06052000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G006_06052000 0.001

# Html.Phishing.Cur.Gen007.Sanesecurity.06052001
body     SS_PHISH_CUR_G007_06052001 /http:\/\/.{0,20}\/horde\/.{0,30}ebay/i
describe SS_PHISH_CUR_G007_06052001 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G007_06052001 0.001

# Html.Phishing.Cur.Gen008.Sanesecurity.06052002
body     SS_PHISH_CUR_G008_06052002 /http:\/\/.{0,20}\/horde\/.{0,30}chase/i
describe SS_PHISH_CUR_G008_06052002 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G008_06052002 0.001

# Html.Phishing.Cur.Gen009.Sanesecurity.06052003
body     SS_PHISH_CUR_G009_06052003 /http:\/\/.{0,20}\/horde\/.{0,30}paypal/i
describe SS_PHISH_CUR_G009_06052003 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G009_06052003 0.001

# Html.Phishing.Cur.Gen010.Sanesecurity.06071100
body     SS_PHISH_CUR_G010_06071100 /\.rr\.com2\&puserid=\&siteid=0\&pagetype=\.\.\." target=_blank><font color=\#003399>view the dispute thread to respond/i
describe SS_PHISH_CUR_G010_06071100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G010_06071100 0.001

# Html.Phishing.Cur.Gen011.Sanesecurity.06071101
body     SS_PHISH_CUR_G011_06071101 /item \#300005830966<br><br><a href="http:\/\/cpe/i
describe SS_PHISH_CUR_G011_06071101 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G011_06071101 0.001

# Html.Phishing.Cur.Gen012.Sanesecurity.06071300
body     SS_PHISH_CUR_G012_06071300 /<a href="http:\/\/.{0,30}\/sitebuilder\/.{0,30}\.bankofamerica/i
describe SS_PHISH_CUR_G012_06071300 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G012_06071300 0.001

# Html.Phishing.Cur.Gen013.Sanesecurity.06071301
body     SS_PHISH_CUR_G013_06071301 /<a href="http:\/\/.{0,30}\/sitebuilder\/.{0,30}\.chase\.com/i
describe SS_PHISH_CUR_G013_06071301 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G013_06071301 0.001

# Html.Phishing.Cur.Gen014.Sanesecurity.06071302
body     SS_PHISH_CUR_G014_06071302 /http:\/\/.{0,20}\/horde\/.{0,30}bellsouth/i
describe SS_PHISH_CUR_G014_06071302 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G014_06071302 0.001

# Html.Phishing.Cur.Gen015.Sanesecurity.06071303
body     SS_PHISH_CUR_G015_06071303 /http:\/\/.{0,50}\/~.{0,100}\/ebayisapi_dll/i
describe SS_PHISH_CUR_G015_06071303 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G015_06071303 0.001

# Html.Phishing.Cur.Gen016.Sanesecurity.06071304
body     SS_PHISH_CUR_G016_06071304 /<!-- saved from url=\(0080\)https:\/\/www\.paypal\.com\/us\//i
describe SS_PHISH_CUR_G016_06071304 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G016_06071304 0.001

# Html.Phishing.Cur.Gen017.Sanesecurity.06071305
body     SS_PHISH_CUR_G017_06071305 /src="http:\/\/0x.{0,30}paypal/i
describe SS_PHISH_CUR_G017_06071305 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G017_06071305 0.001

# Html.Phishing.Cur.Gen018.Sanesecurity.06071306
body     SS_PHISH_CUR_G018_06071306 /http:\/\/0x.{0,30}chase/i
describe SS_PHISH_CUR_G018_06071306 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G018_06071306 0.001

# Html.Phishing.Cur.Gen019.Sanesecurity.06071307
body     SS_PHISH_CUR_G019_06071307 /http:\/\/0x.{0,30}bank/i
describe SS_PHISH_CUR_G019_06071307 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G019_06071307 0.001

# Html.Phishing.Cur.Gen020.Sanesecurity.06071308
body     SS_PHISH_CUR_G020_06071308 /\.imageshack\.us\/img.{0,300}credit union/i
describe SS_PHISH_CUR_G020_06071308 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G020_06071308 0.001

# Html.Phishing.Cur.Gen020.Sanesecurity.06071308
body     SS_PHISH_CUR_G020_06071308 /\.imageshack\.us\/img.{0,300}paypal/i
describe SS_PHISH_CUR_G020_06071308 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G020_06071308 0.001

# Html.Phishing.Cur.Gen021.Sanesecurity.06071400
body     SS_PHISH_CUR_G021_06071400 /proxad\.net\/\%20\/aw-cgi\/index\.html/i
describe SS_PHISH_CUR_G021_06071400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G021_06071400 0.001

# Html.Phishing.Cur.Gen022.Sanesecurity.06071800
body     SS_PHISH_CUR_G022_06071800 /http:\/.{0,30}\.250free\.com.{0,200}chase\.com/i
describe SS_PHISH_CUR_G022_06071800 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G022_06071800 0.001

# Html.Phishing.Cur.Gen023.Sanesecurity.06071801
body     SS_PHISH_CUR_G023_06071801 /\.cox\.net:81\/update\/"><img src="http:\/\/images\.paypal/i
describe SS_PHISH_CUR_G023_06071801 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G023_06071801 0.001

# Email.Phishing.Cur.Gen024.Sanesecurity.06071802
rawbody  SS_PHISH_CUR_G024_06071802 /\.cox\.net:81\/update\/index\.php/i
describe SS_PHISH_CUR_G024_06071802 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G024_06071802 0.001

# Html.Phishing.Cur.Gen025.Sanesecurity.06071803
body     SS_PHISH_CUR_G025_06071803 /\.cox\.net:81\/update\/index\.php/i
describe SS_PHISH_CUR_G025_06071803 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G025_06071803 0.001

# Html.Phishing.Cur.Gen026.Sanesecurity.06071804
body     SS_PHISH_CUR_G026_06071804 /http:\/\/.{0,30}\/xampp\/.{0,150}ebay/i
describe SS_PHISH_CUR_G026_06071804 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G026_06071804 0.001

# Html.Phishing.Cur.Gen027.Sanesecurity.06071805
body     SS_PHISH_CUR_G027_06071805 /http:\/\/.{0,30}\/xampp\/.{0,150}paypal/i
describe SS_PHISH_CUR_G027_06071805 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G027_06071805 0.001

# Html.Phishing.Cur.Gen028.Sanesecurity.06071806
body     SS_PHISH_CUR_G028_06071806 /http:\/\/.{0,30}\/xampp\/.{0,150}\/webscr\//i
describe SS_PHISH_CUR_G028_06071806 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G028_06071806 0.001

# Html.Phishing.Cur.Gen028.Sanesecurity.06072100
body     SS_PHISH_CUR_G028_06072100 /http:\/\/.{0,30}hinet\.net.{0,150}secure message center/i
describe SS_PHISH_CUR_G028_06072100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G028_06072100 0.001

# Html.Phishing.Cur.Gen029.Sanesecurity.06072101
body     SS_PHISH_CUR_G029_06072101 /\.comcast\.net:81\/update\/"><img src="http:\/\/images\.paypal/i
describe SS_PHISH_CUR_G029_06072101 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G029_06072101 0.001

# Html.Phishing.Cur.Gen030.Sanesecurity.06072300
body     SS_PHISH_CUR_G030_06072300 /\.dynamic\.cndata\.com\/index\.html"><font color=\#003399>log on to pnc online banking\./i
describe SS_PHISH_CUR_G030_06072300 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G030_06072300 0.001

# Html.Phishing.Cur.Gen031.Sanesecurity.06072301
body     SS_PHISH_CUR_G031_06072301 /\/help\/css\/alltimeonline\.sbbt\.com\/enroll\/index\.htm"><font color=\#003399>log on to/i
describe SS_PHISH_CUR_G031_06072301 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G031_06072301 0.001

# Html.Phishing.Cur.Gen032.Sanesecurity.06072302
body     SS_PHISH_CUR_G032_06072302 /\/phpBB2\/images\/login\/bofa\.com/i
describe SS_PHISH_CUR_G032_06072302 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G032_06072302 0.001

# Html.Phishing.Cur.Gen033.Sanesecurity.06072303
body     SS_PHISH_CUR_G033_06072303 /href=http:\/\/www\.53\.com\.wps\.portal\.secure\./i
describe SS_PHISH_CUR_G033_06072303 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G033_06072303 0.001

# Html.Phishing.Cur.Gen034.Sanesecurity.06072304
body     SS_PHISH_CUR_G034_06072304 /\.dynamic\.cndata\.com\/cuna\/www\.cuna\.org\//i
describe SS_PHISH_CUR_G034_06072304 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G034_06072304 0.001

# Html.Phishing.Cur.Gen035.Sanesecurity.06072400
body     SS_PHISH_CUR_G035_06072400 /http:\/\/.{0,30}\/horde\/services\/.{0,60}\.ebay\./i
describe SS_PHISH_CUR_G035_06072400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G035_06072400 0.001

# Html.Phishing.Cur.Gen036.Sanesecurity.06072401
body     SS_PHISH_CUR_G036_06072401 /\.dynamic\.cndata\.com\/index\.html">online banking/i
describe SS_PHISH_CUR_G036_06072401 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G036_06072401 0.001

# Html.Phishing.Cur.Gen037.Sanesecurity.06072402
body     SS_PHISH_CUR_G037_06072402 /\.comcast\.net:31337\/ws\/ebay/i
describe SS_PHISH_CUR_G037_06072402 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G037_06072402 0.001

# Email.Phishing.Cur.Gen038.Sanesecurity.06072600
rawbody  SS_PHISH_CUR_G038_06072600 /"http:\/\/.{0,30}\.rr\.com.{0,60}www\.paypal\.com/i
describe SS_PHISH_CUR_G038_06072600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G038_06072600 0.001

# Html.Phishing.Cur.Gen039.Sanesecurity.06072601
body     SS_PHISH_CUR_G039_06072601 /http:\/\/.{0,30}\.sbcglobal\.net.{0,30}ebay/i
describe SS_PHISH_CUR_G039_06072601 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G039_06072601 0.001

# Html.Phishing.Cur.Gen040.Sanesecurity.06072700
body     SS_PHISH_CUR_G040_06072700 /<!-- saved from url=\(0081\)https:\/\/www\.paypal\.com/i
describe SS_PHISH_CUR_G040_06072700 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G040_06072700 0.001

# Html.Phishing.Cur.Gen041.Sanesecurity.06072701
body     SS_PHISH_CUR_G041_06072701 /http:\/\/.{0,30}\.comcast\.net.{0,50}visit the resolution center/i
describe SS_PHISH_CUR_G041_06072701 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G041_06072701 0.001

# Html.Phishing.Cur.Gen042.Sanesecurity.06072800
body     SS_PHISH_CUR_G042_06072800 /http:\/\/.{0,30}\/horde\/services\/.{0,30}nationalbank/i
describe SS_PHISH_CUR_G042_06072800 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G042_06072800 0.001

# Html.Phishing.Cur.Gen043.Sanesecurity.06072801
body     SS_PHISH_CUR_G043_06072801 /http:\/\/.{0,30}\.charter\.com.{0,30}ebayisapi/i
describe SS_PHISH_CUR_G043_06072801 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G043_06072801 0.001

# Html.Phishing.Cur.Gen044.Sanesecurity.06072802
body     SS_PHISH_CUR_G044_06072802 /http:\/\/.{0,30}\.cox\.net.{0,30}paypal\.com/i
describe SS_PHISH_CUR_G044_06072802 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G044_06072802 0.001

# Html.Phishing.Cur.Gen045.Sanesecurity.06072803
body     SS_PHISH_CUR_G045_06072803 /http:\/\/.{0,30}\.cox\.net.{0,30}ebayisapi/i
describe SS_PHISH_CUR_G045_06072803 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G045_06072803 0.001

# Html.Phishing.Cur.Gen046.Sanesecurity.06072804
body     SS_PHISH_CUR_G046_06072804 /http:\/\/.{0,30}\.charter\.com.{0,30}paypal\.com/i
describe SS_PHISH_CUR_G046_06072804 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G046_06072804 0.001

# Html.Phishing.Cur.Gen047.Sanesecurity.06073000
body     SS_PHISH_CUR_G047_06073000 /http:\/\/.{0,30}\/horde\/services\/.{0,60}netspend/i
describe SS_PHISH_CUR_G047_06073000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G047_06073000 0.001

# Html.Phishing.Cur.Gen048.Sanesecurity.06073001
body     SS_PHISH_CUR_G048_06073001 /http:\/\/.{0,30}\/horde\/services\/.{0,60}bankfranklin/i
describe SS_PHISH_CUR_G048_06073001 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G048_06073001 0.001

# Html.Phishing.Cur.Gen049.Sanesecurity.06073001
body     SS_PHISH_CUR_G049_06073001 /http:\/\/.{0,30}\/horde\/services\/.{0,200}internet banking/i
describe SS_PHISH_CUR_G049_06073001 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G049_06073001 0.001

# Html.Phishing.Cur.Gen050.Sanesecurity.06073100
body     SS_PHISH_CUR_G050_06073100 /http:\/\/.{0,30}\.rr\.com.{0,60}paypal/i
describe SS_PHISH_CUR_G050_06073100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G050_06073100 0.001

# Html.Phishing.Cur.Gen051.Sanesecurity.06073101
body     SS_PHISH_CUR_G051_06073101 /http:\/\/.{0,200}\.comcast\.net.{0,500}\.wamu\.com/i
describe SS_PHISH_CUR_G051_06073101 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G051_06073101 0.001

# Html.Phishing.Cur.Gen052.Sanesecurity.06080200
body     SS_PHISH_CUR_G052_06080200 /complete the verification.{0,200}<a href="http:\/\/static/i
describe SS_PHISH_CUR_G052_06080200 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G052_06080200 0.001

# Html.Phishing.Cur.Gen053.Sanesecurity.06080201
body     SS_PHISH_CUR_G053_06080201 /<a href="http:\/\/adsl.{0,100}citizens/i
describe SS_PHISH_CUR_G053_06080201 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G053_06080201 0.001

# Html.Phishing.Cur.Gen054.Sanesecurity.06080300
body     SS_PHISH_CUR_G054_06080300 /http:\/\/static-.{0,100}verizon\.net.{0,100}\/www\.paypal\./i
describe SS_PHISH_CUR_G054_06080300 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G054_06080300 0.001

# Html.Phishing.Cur.Gen057.Sanesecurity.06080400
body     SS_PHISH_CUR_G057_06080400 /http:\/\/.{0,50}\/horde\/services\/.{0,60}bank/i
describe SS_PHISH_CUR_G057_06080400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G057_06080400 0.001

# Html.Phishing.Cur.Gen059.Sanesecurity.06080402
body     SS_PHISH_CUR_G059_06080402 /http:\/\/pool.{0,100}learn more/i
describe SS_PHISH_CUR_G059_06080402 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G059_06080402 0.001

# Html.Phishing.Cur.Gen060.Sanesecurity.06080403
body     SS_PHISH_CUR_G060_06080403 /\.comcast\.net\/cgi\.ebay\.com\/index\.htm/i
describe SS_PHISH_CUR_G060_06080403 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G060_06080403 0.001

# Html.Phishing.Cur.Gen061.Sanesecurity.06080500
body     SS_PHISH_CUR_G061_06080500 /href="http:\/\/.{0,50}\/~.{0,100}halifax/i
describe SS_PHISH_CUR_G061_06080500 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G061_06080500 0.001

# Html.Phishing.Cur.Gen062.Sanesecurity.06080501
body     SS_PHISH_CUR_G062_06080501 /http:\/\/static-.{0,30}\.broadviewnet\.net.{0,50}bankofamerica/i
describe SS_PHISH_CUR_G062_06080501 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G062_06080501 0.001

# Html.Phishing.Cur.Gen063.Sanesecurity.06080600
body     SS_PHISH_CUR_G063_06080600 /src="file:\/\/d:\/documents\%20and\%20settings\/safe\%20house\%20-\%201\//i
describe SS_PHISH_CUR_G063_06080600 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G063_06080600 0.001

# Html.Phishing.Cur.Gen064.Sanesecurity.06080601
body     SS_PHISH_CUR_G064_06080601 /\.mail333\.com\/index\.html/i
describe SS_PHISH_CUR_G064_06080601 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G064_06080601 0.001

# Html.Phishing.Cur.Gen065.Sanesecurity.06080602
body     SS_PHISH_CUR_G065_06080602 /http:\/\/adsl.{0,500}online bank account/i
describe SS_PHISH_CUR_G065_06080602 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G065_06080602 0.001

# Html.Phishing.Cur.Gen066.Sanesecurity.06080603
body     SS_PHISH_CUR_G066_06080603 /http:\/\/.{0,50}\/horde\/.{0,150}amazon/i
describe SS_PHISH_CUR_G066_06080603 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G066_06080603 0.001

# Html.Phishing.Cur.Gen067.Sanesecurity.06080604
body     SS_PHISH_CUR_G067_06080604 /http:\/\/.{0,50}\/horde\/.{0,150}paypal/i
describe SS_PHISH_CUR_G067_06080604 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G067_06080604 0.001

# Html.Phishing.Cur.Gen068.Sanesecurity.06080605
body     SS_PHISH_CUR_G068_06080605 /http:\/\/.{0,50}\/horde\/.{0,150}ebay/i
describe SS_PHISH_CUR_G068_06080605 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G068_06080605 0.001

# Html.Phishing.Cur.Gen069.Sanesecurity.06080607
body     SS_PHISH_CUR_G069_06080607 /http:\/\/.{0,50}\/horde\/.{0,150}alaskausa/i
describe SS_PHISH_CUR_G069_06080607 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G069_06080607 0.001

# Html.Phishing.Cur.Gen070.Sanesecurity.06080608
body     SS_PHISH_CUR_G070_06080608 /http:\/\/.{0,50}\/horde\/.{0,150}chase/i
describe SS_PHISH_CUR_G070_06080608 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G070_06080608 0.001

# Html.Phishing.Cur.Gen071.Sanesecurity.06080701
body     SS_PHISH_CUR_G071_06080701 /visit\.gif\?us1142376053" alt="setstats" border="0" width="1" heigh t="1"><\/noscript><img src="http:\/\/geo\.yahoo\.com\/serv\?s=76001524\&t=1142376053/i
describe SS_PHISH_CUR_G071_06080701 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G071_06080701 0.001

# Html.Phishing.Cur.Gen073.Sanesecurity.06080801
body     SS_PHISH_CUR_G073_06080801 /paypal email id pp468<\/span><\/td><\/tr><script type="text\/javascript">document\.write\('\\u/i
describe SS_PHISH_CUR_G073_06080801 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G073_06080801 0.001

# Html.Phishing.Cur.Gen074.Sanesecurity.06080900
body     SS_PHISH_CUR_G074_06080900 /http:\/\/adsl-.{0,150}westernunion/i
describe SS_PHISH_CUR_G074_06080900 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G074_06080900 0.001

# Html.Phishing.Cur.Gen075.Sanesecurity.06080901
body     SS_PHISH_CUR_G075_06080901 /http:\/\/membres\.lycos\..{0,100}\.paypal\.com/i
describe SS_PHISH_CUR_G075_06080901 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G075_06080901 0.001

# Html.Phishing.Cur.Gen076.Sanesecurity.06081000
body     SS_PHISH_CUR_G076_06081000 /http:\/\/.{0,50}\/~.{0,100}isapidll/i
describe SS_PHISH_CUR_G076_06081000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G076_06081000 0.001

# Html.Phishing.Cur.Gen077.Sanesecurity.06081001
body     SS_PHISH_CUR_G077_06081001 /\.optonline\.net\/www\.ebay\.com\//i
describe SS_PHISH_CUR_G077_06081001 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G077_06081001 0.001

# Html.Phishing.Cur.Gen078.Sanesecurity.06081100
body     SS_PHISH_CUR_G078_06081100 /http:\/\/.{0,50}\/horde\/.{0,150}enrollment procedure/i
describe SS_PHISH_CUR_G078_06081100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G078_06081100 0.001

# Html.Phishing.Cur.Gen079.Sanesecurity.06081101
body     SS_PHISH_CUR_G079_06081101 /http:\/\/.{0,50}\/horde\/.{0,150}banking/i
describe SS_PHISH_CUR_G079_06081101 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G079_06081101 0.001

# Html.Phishing.Cur.Gen080.Sanesecurity.06081102
body     SS_PHISH_CUR_G080_06081102 /http:\/\/adsl.{0,150}ebay/i
describe SS_PHISH_CUR_G080_06081102 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G080_06081102 0.001

# Html.Phishing.Cur.Gen081.Sanesecurity.06081103
body     SS_PHISH_CUR_G081_06081103 /http:\/\/adsl.{0,150}paypal/i
describe SS_PHISH_CUR_G081_06081103 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G081_06081103 0.001

# Email.Phishing.Cur.Gen083.Sanesecurity.06081300
rawbody  SS_PHISH_CUR_G083_06081300 /<!-- saved from url=\(0114\)ftp:\/\/sotdgdbj:hammer1\@ftp\.sotdgilde\.de\/www\.sotdgilde\.de\/Barclays-UK\/Barclays-UK\/ibank\.barclays\.co\.uk\/barmail\.html/i
describe SS_PHISH_CUR_G083_06081300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G083_06081300 0.001

# Html.Phishing.Cur.Gen084.Sanesecurity.06081301
body     SS_PHISH_CUR_G084_06081301 /http:\/\/rds\.yahoo\.com\/_https:\/\/ibank\.barclays\.co\.uk\//i
describe SS_PHISH_CUR_G084_06081301 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G084_06081301 0.001

# Html.Phishing.Cur.Gen085.Sanesecurity.06081302
body     SS_PHISH_CUR_G085_06081302 /http:\/\/www\.paypal\.com\.cgi-bin\.us-webscr\.php-cmd\.login-run\./i
describe SS_PHISH_CUR_G085_06081302 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G085_06081302 0.001

# Html.Phishing.Cur.Gen086.Sanesecurity.06081303
body     SS_PHISH_CUR_G086_06081303 /\/\%20\/https:\/www\.halifax-online\.co\.uk\//i
describe SS_PHISH_CUR_G086_06081303 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G086_06081303 0.001

# Html.Phishing.Cur.Gen087.Sanesecurity.06081304
body     SS_PHISH_CUR_G087_06081304 /\/\.\%20\/module\.dll\.php\?customerid/i
describe SS_PHISH_CUR_G087_06081304 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G087_06081304 0.001

# Html.Phishing.Cur.Gen088.Sanesecurity.06081400
body     SS_PHISH_CUR_G088_06081400 /http:\/\/adsl.{0,150}\/www\.cfefcu\.com\//i
describe SS_PHISH_CUR_G088_06081400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G088_06081400 0.001

# Html.Phishing.Cur.Gen089.Sanesecurity.06081500
body     SS_PHISH_CUR_G089_06081500 /http:\/\/.{0,30}singin.{0,5}ebay/i
describe SS_PHISH_CUR_G089_06081500 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G089_06081500 0.001

# Html.Phishing.Cur.Gen091.Sanesecurity.06081800
body     SS_PHISH_CUR_G091_06081800 /http:\/\/ip.{0,30}\.cox\.net.{0,150}ebay/i
describe SS_PHISH_CUR_G091_06081800 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G091_06081800 0.001

# Html.Phishing.Cur.Gen092.Sanesecurity.06081801
body     SS_PHISH_CUR_G092_06081801 /http:\/\/ip.{0,30}\.cox\.net.{0,150}paypal/i
describe SS_PHISH_CUR_G092_06081801 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G092_06081801 0.001

# Html.Phishing.Cur.Gen093.Sanesecurity.06081802
body     SS_PHISH_CUR_G093_06081802 /http:\/\/ip.{0,30}\.cox\.net.{0,150}chase/i
describe SS_PHISH_CUR_G093_06081802 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G093_06081802 0.001

# Html.Phishing.Cur.Gen094.Sanesecurity.06082000
body     SS_PHISH_CUR_G094_06082000 /\/singinviewitemnumber\.ebay\.html" target=/i
describe SS_PHISH_CUR_G094_06082000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G094_06082000 0.001

# Html.Phishing.Cur.Gen095.Sanesecurity.06082100
body     SS_PHISH_CUR_G095_06082100 /http:\/\/.{0,30}\.cableone\.net.{0,150}ebay/i
describe SS_PHISH_CUR_G095_06082100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G095_06082100 0.001

# Html.Phishing.Cur.Gen096.Sanesecurity.06082101
body     SS_PHISH_CUR_G096_06082101 /http:\/\/.{0,30}\.cableone\.net.{0,150}paypal/i
describe SS_PHISH_CUR_G096_06082101 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G096_06082101 0.001

# Html.Phishing.Cur.Gen097.Sanesecurity.06082102
body     SS_PHISH_CUR_G097_06082102 /http:\/\/.{0,30}\.cableone\.net.{0,150}chase/i
describe SS_PHISH_CUR_G097_06082102 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G097_06082102 0.001

# Html.Phishing.Cur.Gen098.Sanesecurity.06082100
body     SS_PHISH_CUR_G098_06082100 /http:\/\/.{0,20}\/horde\/.{0,30}creditunion/i
describe SS_PHISH_CUR_G098_06082100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G098_06082100 0.001

# Html.Phishing.Cur.Gen099.Sanesecurity.06082300
body     SS_PHISH_CUR_G099_06082300 /\/\.login\/index2\.html>www\.ebay\.com/i
describe SS_PHISH_CUR_G099_06082300 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G099_06082300 0.001

# Html.Phishing.Cur.Gen100.Sanesecurity.06082301
body     SS_PHISH_CUR_G100_06082301 /\/\.login\/index2\.html><strong>https:\/\/signin\.ebay\.com\//i
describe SS_PHISH_CUR_G100_06082301 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G100_06082301 0.001

# Html.Phishing.Cur.Gen101.Sanesecurity.06082400
body     SS_PHISH_CUR_G101_06082400 /<a href="http:\/\/.{0,50}\/~.{0,150}\/amazon\//i
describe SS_PHISH_CUR_G101_06082400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G101_06082400 0.001

# Html.Phishing.Cur.Gen102.Sanesecurity.06082401
body     SS_PHISH_CUR_G102_06082401 /<a target="_blank" href="http:\/\/cpe-.{0,150}www\.cuna\.org/i
describe SS_PHISH_CUR_G102_06082401 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G102_06082401 0.001

# Html.Phishing.Cur.Gen103.Sanesecurity.06082800
body     SS_PHISH_CUR_G103_06082800 /visit\.gif\?us1154771428" alt="setstats" border="0" width="1" height="1"><\/noscript><img src="http:\/\/geo\.yahoo\.com\/serv\?s=76001061\&t=1154771428/i
describe SS_PHISH_CUR_G103_06082800 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G103_06082800 0.001

# Html.Phishing.Cur.Gen104.Sanesecurity.06082900
body     SS_PHISH_CUR_G104_06082900 /\/forum\/phpbb2\/.{0,500}online banking/i
describe SS_PHISH_CUR_G104_06082900 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G104_06082900 0.001

# Html.Phishing.Cur.Gen105.Sanesecurity.06090100
body     SS_PHISH_CUR_G105_06090100 /\.dsl\.speakeasy\.net\/bancanetempresarial\.banamex\.com\.mx\//i
describe SS_PHISH_CUR_G105_06090100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G105_06090100 0.001

# Html.Phishing.Cur.Gen106.Sanesecurity.06090200
body     SS_PHISH_CUR_G106_06090200 /http:\/\/www\.yourscamurl\.com\/webscr\/login_submit/i
describe SS_PHISH_CUR_G106_06090200 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G106_06090200 0.001

# Html.Phishing.Cur.Gen107.Sanesecurity.06090300
body     SS_PHISH_CUR_G107_06090300 /<a href="http:\/\/adsl.{0,150}bank/i
describe SS_PHISH_CUR_G107_06090300 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G107_06090300 0.001

# Html.Phishing.Cur.Gen108.Sanesecurity.06090301
body     SS_PHISH_CUR_G108_06090301 /<a href="http:\/\/.{0,150}\.shawcable\.net.{0,150}mfcisapi/i
describe SS_PHISH_CUR_G108_06090301 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G108_06090301 0.001

# Html.Phishing.Cur.Gen109.Sanesecurity.06090302
body     SS_PHISH_CUR_G109_06090302 /<a href="http:\/\/.{0,150}\.shawcable\.net.{0,150}ebay/i
describe SS_PHISH_CUR_G109_06090302 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G109_06090302 0.001

# Html.Phishing.Cur.Gen110.Sanesecurity.06090303
body     SS_PHISH_CUR_G110_06090303 /<a href="http:\/\/.{0,150}\.shawcable\.net.{0,150}paypa/i
describe SS_PHISH_CUR_G110_06090303 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G110_06090303 0.001

# Html.Phishing.Cur.Gen111.Sanesecurity.06090304
body     SS_PHISH_CUR_G111_06090304 /<a href="http:\/\/.{0,150}\.shawcable\.net.{0,150}chase/i
describe SS_PHISH_CUR_G111_06090304 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G111_06090304 0.001

# Email.Phishing.Cur.Gen112.Sanesecurity.06090305
rawbody  SS_PHISH_CUR_G112_06090305 /rid=3Dlouisss00112233\&amp\;reporteduserid=3Dfomocoace\&amp\;emaildate=3D2005/i
describe SS_PHISH_CUR_G112_06090305 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G112_06090305 0.001

# Html.Phishing.Cur.Gen113.Sanesecurity.06090306
body     SS_PHISH_CUR_G113_06090306 /\.adsl-dhcp\.tele\.dk.{0,50}ebay/i
describe SS_PHISH_CUR_G113_06090306 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G113_06090306 0.001

# Html.Phishing.Cur.Gen114.Sanesecurity.06090307
body     SS_PHISH_CUR_G114_06090307 /\.adsl-dhcp\.tele\.dk.{0,50}paypal/i
describe SS_PHISH_CUR_G114_06090307 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G114_06090307 0.001

# Html.Phishing.Cur.Gen115.Sanesecurity.06090500
body     SS_PHISH_CUR_G115_06090500 /<a href="ftp:\/.{0,150}\/signin\.ebay\.com/i
describe SS_PHISH_CUR_G115_06090500 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G115_06090500 0.001

# Html.Phishing.Cur.Gen116.Sanesecurity.06090700
body     SS_PHISH_CUR_G116_06090700 /\/https:\/\/\/www\.paypal\.com\/\//i
describe SS_PHISH_CUR_G116_06090700 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G116_06090700 0.001

# Html.Phishing.Cur.Gen117.Sanesecurity.06090701
body     SS_PHISH_CUR_G117_06090701 /target=_blank rel=nofollow _><font color=\#003399 size=3>150024091558<\/font><\/a>/i
describe SS_PHISH_CUR_G117_06090701 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G117_06090701 0.001

# Email.Phishing.Cur.Gen118.Sanesecurity.06090700
rawbody  SS_PHISH_CUR_G118_06090700 /url=\(0151\)https:\/\/onlineeast\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G118_06090700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G118_06090700 0.001

# Email.Phishing.Cur.Gen119.Sanesecurity.06091000
rawbody  SS_PHISH_CUR_G119_06091000 /<!-- saved from url=3D\(0040\)http:\/\/perkal\.co\.za\/pdf\/chase\//i
describe SS_PHISH_CUR_G119_06091000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G119_06091000 0.001

# Html.Phishing.Cur.Gen121.Sanesecurity.06091200
body     SS_PHISH_CUR_G121_06091200 /\.mail333\.com\/ebayisapi_dll/i
describe SS_PHISH_CUR_G121_06091200 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G121_06091200 0.001

# Email.Phishing.Cur.Gen122.Sanesecurity.06091300
rawbody  SS_PHISH_CUR_G122_06091300 /<!-- saved from url=\(0035\)http:\/\/www\.crdunion\.info\/letter\.htm/i
describe SS_PHISH_CUR_G122_06091300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G122_06091300 0.001

# Email.Phishing.Cur.Gen123.Sanesecurity.06091301
rawbody  SS_PHISH_CUR_G123_06091301 /<!-- saved from url=\(0034\)http:\/\/purplehosting\.com\/chase\.txt/i
describe SS_PHISH_CUR_G123_06091301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G123_06091301 0.001

# Html.Phishing.Cur.Gen124.Sanesecurity.06091302
body     SS_PHISH_CUR_G124_06091302 /\/www\/contactebymemberr\/ebayisapidll/i
describe SS_PHISH_CUR_G124_06091302 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G124_06091302 0.001

# Html.Phishing.Cur.Gen125.Sanesecurity.06091400
body     SS_PHISH_CUR_G125_06091400 /height="1"><img src="sanya_files\/s\.htm" height="1"><\/td><\/tr><tr><td height="50"><img src="http:\/\/www\./i
describe SS_PHISH_CUR_G125_06091400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G125_06091400 0.001

# Html.Phishing.Cur.Gen126.Sanesecurity.06091401
body     SS_PHISH_CUR_G126_06091401 /><font color="bloe"/i
describe SS_PHISH_CUR_G126_06091401 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G126_06091401 0.001

# Html.Phishing.Cur.Gen127.Sanesecurity.06091402
body     SS_PHISH_CUR_G127_06091402 /<a href="http:\/\/ebay-singin-html\./i
describe SS_PHISH_CUR_G127_06091402 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G127_06091402 0.001

# Html.Phishing.Cur.Gen128.Sanesecurity.06091500
body     SS_PHISH_CUR_G128_06091500 /color:\#666666">dear customer \(\$to\)/i
describe SS_PHISH_CUR_G128_06091500 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G128_06091500 0.001

# Html.Phishing.Cur.Gen129.Sanesecurity.06091501
body     SS_PHISH_CUR_G129_06091501 /\/index\.html ">http:\/\/www \.nationwide\.co\.uk\/secure\/update\/ssl\.cfm<\/a>/i
describe SS_PHISH_CUR_G129_06091501 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G129_06091501 0.001

# Html.Phishing.Cur.Gen130.Sanesecurity.06091502
body     SS_PHISH_CUR_G130_06091502 /\/trust-update-paymnet-account-/i
describe SS_PHISH_CUR_G130_06091502 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G130_06091502 0.001

# Html.Phishing.Cur.Gen131.Sanesecurity.06092100
body     SS_PHISH_CUR_G131_06092100 /just follow this link <br><br><br><a onmouseover="a\("https:\/\/https:\/\/www\.paypal\.com\/cgi-bin\/webscr\?cmd=_login-run"\)\;return true" onmouseout=b\(\)/i
describe SS_PHISH_CUR_G131_06092100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G131_06092100 0.001

# Email.Phishing.Cur.Gen132.Sanesecurity.06092300
rawbody  SS_PHISH_CUR_G132_06092300 /<!-- saved from url=3D\(0080\)https:\/\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G132_06092300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G132_06092300 0.001

# Html.Phishing.Cur.Gen133.Sanesecurity.06092301
body     SS_PHISH_CUR_G133_06092301 /providianintroflagcard, date: feb\. 3, 2005 11:36:15 pst\; country: us/i
describe SS_PHISH_CUR_G133_06092301 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G133_06092301 0.001

# Html.Phishing.Cur.Gen134.Sanesecurity.06102000
body     SS_PHISH_CUR_G134_06102000 /\.cz\/www\/singino\/ws2\/co\/partnerid\//i
describe SS_PHISH_CUR_G134_06102000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G134_06102000 0.001

# Html.Phishing.Cur.Gen135.Sanesecurity.06100500
rawbody  SS_PHISH_CUR_G135_06100500 /\/\.\%20\/\.cgi-bin\//i
describe SS_PHISH_CUR_G135_06100500 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G135_06100500 0.001

# Html.Phishing.Cur.Gen136.Sanesecurity.06100600
body     SS_PHISH_CUR_G136_06100600 /\/customerid8972347\/secureidxjskid893oe99280-2oeujdywhhhek\/index\.htm/i
describe SS_PHISH_CUR_G136_06100600 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G136_06100600 0.001

# Html.Phishing.Cur.Gen137.Sanesecurity.06101600
body     SS_PHISH_CUR_G137_06101600 /<!-- saved from url=\(0073\)https:\/\/olb2\.nationet\.com\//i
describe SS_PHISH_CUR_G137_06101600 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G137_06101600 0.001

# Html.Phishing.Cur.Gen138.Sanesecurity.06102200
body     SS_PHISH_CUR_G138_06102200 /<a href="http:\/\/www3\.netbank\.commbank\.com\.au\./i
describe SS_PHISH_CUR_G138_06102200 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G138_06102200 0.001

# Email.Phishing.Cur.Gen139.Sanesecurity.06103000
rawbody  SS_PHISH_CUR_G139_06103000 /<!-- saved from url=\(0053\)https:\/\/www3\.netbank\.commbank\.com/i
describe SS_PHISH_CUR_G139_06103000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G139_06103000 0.001

# Html.Phishing.Cur.Gen140.Sanesecurity.06110700
body     SS_PHISH_CUR_G140_06110700 /<a href="http:\/\/.{0,50}\/~.{0,100}\/ws\/ebayisapi/i
describe SS_PHISH_CUR_G140_06110700 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G140_06110700 0.001

# Html.Phishing.Cur.Gen141.Sanesecurity.06110701
body     SS_PHISH_CUR_G141_06110701 /\/\.secure\/www\.sears\.com\//i
describe SS_PHISH_CUR_G141_06110701 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G141_06110701 0.001

# Html.Phishing.Cur.Gen142.Sanesecurity.06110702
body     SS_PHISH_CUR_G142_06110702 /\/\.connect\.to\.paypal\//i
describe SS_PHISH_CUR_G142_06110702 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G142_06110702 0.001

# Html.Phishing.Cur.Gen143.Sanesecurity.06110703
body     SS_PHISH_CUR_G143_06110703 /:82\/signin\.ebay\.com\//i
describe SS_PHISH_CUR_G143_06110703 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G143_06110703 0.001

# Html.Phishing.Cur.Gen144.Sanesecurity.06110704
body     SS_PHISH_CUR_G144_06110704 /http:\/\/online\.wellsfargo\.com-/i
describe SS_PHISH_CUR_G144_06110704 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G144_06110704 0.001

# Html.Phishing.Cur.Gen145.Sanesecurity.06110705
body     SS_PHISH_CUR_G145_06110705 /http:\/\/www\.53\.com\.portal/i
describe SS_PHISH_CUR_G145_06110705 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G145_06110705 0.001

# Html.Phishing.Cur.Gen146.Sanesecurity.06110706
body     SS_PHISH_CUR_G146_06110706 /:2121\/webscrr\//i
describe SS_PHISH_CUR_G146_06110706 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G146_06110706 0.001

# Html.Phishing.Cur.Gen147.Sanesecurity.06110707
body     SS_PHISH_CUR_G147_06110707 /:84\/ws\/ebayisapi/i
describe SS_PHISH_CUR_G147_06110707 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G147_06110707 0.001

# Html.Phishing.Cur.Gen148.Sanesecurity.06110708
body     SS_PHISH_CUR_G148_06110708 /\/icons\/\.ws\/ebayisapi/i
describe SS_PHISH_CUR_G148_06110708 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G148_06110708 0.001

# Html.Phishing.Cur.Gen149.Sanesecurity.06110709
body     SS_PHISH_CUR_G149_06110709 /\/\.www\.wachovia\.com/i
describe SS_PHISH_CUR_G149_06110709 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G149_06110709 0.001

# Html.Phishing.Cur.Gen150.Sanesecurity.06110710
body     SS_PHISH_CUR_G150_06110710 /\/\%20\/\/ebay\.htm\?cmd/i
describe SS_PHISH_CUR_G150_06110710 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G150_06110710 0.001

# Html.Phishing.Cur.Gen151.Sanesecurity.06110711
body     SS_PHISH_CUR_G151_06110711 /:8080\/signin\.ebay\.com\//i
describe SS_PHISH_CUR_G151_06110711 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G151_06110711 0.001

# Html.Phishing.Cur.Gen152.Sanesecurity.06110712
body     SS_PHISH_CUR_G152_06110712 /\/\%20\%20\/amazon\/exec/i
describe SS_PHISH_CUR_G152_06110712 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G152_06110712 0.001

# Html.Phishing.Cur.Gen153.Sanesecurity.06110713
body     SS_PHISH_CUR_G153_06110713 /\.\.\.\/sc\/ws\/ebayisapi/i
describe SS_PHISH_CUR_G153_06110713 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G153_06110713 0.001

# Html.Phishing.Cur.Gen154.Sanesecurity.06110714
body     SS_PHISH_CUR_G154_06110714 /\/\.www\.fairwinds\.org\//i
describe SS_PHISH_CUR_G154_06110714 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G154_06110714 0.001

# Html.Phishing.Cur.Gen155.Sanesecurity.06110715
body     SS_PHISH_CUR_G155_06110715 /\/\%20\/usa\.visa\.com\//i
describe SS_PHISH_CUR_G155_06110715 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G155_06110715 0.001

# Html.Phishing.Cur.Gen156.Sanesecurity.06111100
body     SS_PHISH_CUR_G156_06111100 /\.shawcable\.net\/update_paypal\//i
describe SS_PHISH_CUR_G156_06111100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G156_06111100 0.001

# Html.Phishing.Cur.Gen157.Sanesecurity.06111101
body     SS_PHISH_CUR_G157_06111101 /href="http:\/\/.{0,50}\/~.{0,150}\.paypal\.co/i
describe SS_PHISH_CUR_G157_06111101 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G157_06111101 0.001

# Html.Phishing.Cur.Gen158.Sanesecurity.06111102
body     SS_PHISH_CUR_G158_06111102 /href="http:\/\/.{0,50}\/~.{0,150}\.ebay\.co/i
describe SS_PHISH_CUR_G158_06111102 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G158_06111102 0.001

# Email.Phishing.Cur.Gen159.Sanesecurity.06111103
rawbody  SS_PHISH_CUR_G159_06111103 /:9070\/vk\/volksbank\.de\/DesktopDefault\.aspx\/tabid=43\&tabindex=-1\//i
describe SS_PHISH_CUR_G159_06111103 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G159_06111103 0.001

# Html.Phishing.Cur.Gen160.Sanesecurity.06111104
body     SS_PHISH_CUR_G160_06111104 /:9070\/vk\/volksbank\.de\/desktopdefault\.aspx\/tabid=43\&tabindex=-1\//i
describe SS_PHISH_CUR_G160_06111104 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G160_06111104 0.001

# Html.Phishing.Cur.Gen161.Sanesecurity.06111105
body     SS_PHISH_CUR_G161_06111105 /\/horde\/services\/images\/signin\.ebay\.com\//i
describe SS_PHISH_CUR_G161_06111105 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G161_06111105 0.001

# Html.Phishing.Cur.Gen162.Sanesecurity.06111106
body     SS_PHISH_CUR_G162_06111106 /sys_cpanel\/images\/ws\/signin\.ebay\/ebayisapi\.dl\/signin/i
describe SS_PHISH_CUR_G162_06111106 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G162_06111106 0.001

# Html.Phishing.Cur.Gen163.Sanesecurity.06111107
body     SS_PHISH_CUR_G163_06111107 /http:\/\/mujweb\.cz\/.{0,150}ebay/i
describe SS_PHISH_CUR_G163_06111107 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G163_06111107 0.001

# Html.Phishing.Cur.Gen164.Sanesecurity.06111108
body     SS_PHISH_CUR_G164_06111108 /http:\/\/mujweb\.cz\/.{0,150}signin/i
describe SS_PHISH_CUR_G164_06111108 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G164_06111108 0.001

# Html.Phishing.Cur.Gen165.Sanesecurity.06111109
body     SS_PHISH_CUR_G165_06111109 /http:\/\/signin\.ebay\.com\..{0,30}\.com\/.{0,30}ebayisapi/i
describe SS_PHISH_CUR_G165_06111109 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G165_06111109 0.001

# Html.Phishing.Cur.Gen167.Sanesecurity.06111400
body     SS_PHISH_CUR_G167_06111400 /\/www\.ebay\.comsigninregisterignin/i
describe SS_PHISH_CUR_G167_06111400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G167_06111400 0.001

# Html.Phishing.Cur.Gen168.Sanesecurity.06111600
body     SS_PHISH_CUR_G168_06111600 /\/\.secure\/\.webscr/i
describe SS_PHISH_CUR_G168_06111600 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G168_06111600 0.001

# Html.Phishing.Cur.Gen169.Sanesecurity.06111601
body     SS_PHISH_CUR_G169_06111601 /\/\.cancel\/\.webscr/i
describe SS_PHISH_CUR_G169_06111601 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G169_06111601 0.001

# Html.Phishing.Cur.Gen170.Sanesecurity.06111602
body     SS_PHISH_CUR_G170_06111602 /\/\.us\/paypal\.com\//i
describe SS_PHISH_CUR_G170_06111602 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G170_06111602 0.001

# Html.Phishing.Cur.Gen171.Sanesecurity.06111603
body     SS_PHISH_CUR_G171_06111603 /\/~www\.paypal\.com\//i
describe SS_PHISH_CUR_G171_06111603 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G171_06111603 0.001

# Html.Phishing.Cur.Gen172.Sanesecurity.06111604
body     SS_PHISH_CUR_G172_06111604 /\/~webscr\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G172_06111604 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G172_06111604 0.001

# Html.Phishing.Cur.Gen173.Sanesecurity.06111605
body     SS_PHISH_CUR_G173_06111605 /\/icons\/\.cgi\/paypal/i
describe SS_PHISH_CUR_G173_06111605 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G173_06111605 0.001

# Html.Phishing.Cur.Gen174.Sanesecurity.06111606
body     SS_PHISH_CUR_G174_06111606 /\/\.login\.ebay\.com\./i
describe SS_PHISH_CUR_G174_06111606 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G174_06111606 0.001

# Html.Phishing.Cur.Gen175.Sanesecurity.06111607
body     SS_PHISH_CUR_G175_06111607 /\/paypal\.com\.cgi-bin\./i
describe SS_PHISH_CUR_G175_06111607 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G175_06111607 0.001

# Html.Phishing.Cur.Gen176.Sanesecurity.06111608
body     SS_PHISH_CUR_G176_06111608 /:8081\/signin\.ebay\.com\/ws\/ebayisapi/i
describe SS_PHISH_CUR_G176_06111608 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G176_06111608 0.001

# Html.Phishing.Cur.Gen177.Sanesecurity.06111609
body     SS_PHISH_CUR_G177_06111609 /\/https:\/signin\.ebay\.com\//i
describe SS_PHISH_CUR_G177_06111609 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G177_06111609 0.001

# Html.Phishing.Cur.Gen178.Sanesecurity.06111610
body     SS_PHISH_CUR_G178_06111610 /http:\/\/www\.paypal\.com\.user/i
describe SS_PHISH_CUR_G178_06111610 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G178_06111610 0.001

# Html.Phishing.Cur.Gen179.Sanesecurity.06111611
body     SS_PHISH_CUR_G179_06111611 /http:\/\/www\.ljk-sang\.com\/refund\/\?code/i
describe SS_PHISH_CUR_G179_06111611 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G179_06111611 0.001

# Html.Phishing.Cur.Gen180.Sanesecurity.06111612
body     SS_PHISH_CUR_G180_06111612 /\/\%20\/www\.chase\.com\//i
describe SS_PHISH_CUR_G180_06111612 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G180_06111612 0.001

# Html.Phishing.Cur.Gen181.Sanesecurity.06111613
body     SS_PHISH_CUR_G181_06111613 /\/\.citicards\.com\//i
describe SS_PHISH_CUR_G181_06111613 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G181_06111613 0.001

# Html.Phishing.Cur.Gen182.Sanesecurity.06111614
body     SS_PHISH_CUR_G182_06111614 /\/albums\/userpics\/.{0,150}www\.amazon\.com/i
describe SS_PHISH_CUR_G182_06111614 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G182_06111614 0.001

# Html.Phishing.Cur.Gen183.Sanesecurity.06111615
body     SS_PHISH_CUR_G183_06111615 /\/albums\/userpics\/.{0,150}www\.paypal\.com/i
describe SS_PHISH_CUR_G183_06111615 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G183_06111615 0.001

# Html.Phishing.Cur.Gen184.Sanesecurity.06111616
body     SS_PHISH_CUR_G184_06111616 /\/albums\/userpics\/.{0,150}ebay/i
describe SS_PHISH_CUR_G184_06111616 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G184_06111616 0.001

# Html.Phishing.Cur.Gen185.Sanesecurity.06111617
body     SS_PHISH_CUR_G185_06111617 /\/albums\/userpics\/.{0,150}signin/i
describe SS_PHISH_CUR_G185_06111617 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G185_06111617 0.001

# Html.Phishing.Cur.Gen186.Sanesecurity.06111700
body     SS_PHISH_CUR_G186_06111700 /<a href="http:\/\/host.{0,100}\.signin\.ebay\.com/i
describe SS_PHISH_CUR_G186_06111700 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G186_06111700 0.001

# Html.Phishing.Cur.Gen187.Sanesecurity.06112000
body     SS_PHISH_CUR_G187_06112000 /\/\.www\.citibank\.com\//i
describe SS_PHISH_CUR_G187_06112000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G187_06112000 0.001

# Html.Phishing.Cur.Gen188.Sanesecurity.06112001
body     SS_PHISH_CUR_G188_06112001 /\/\.www\.citibank\.com\//i
describe SS_PHISH_CUR_G188_06112001 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G188_06112001 0.001

# Html.Phishing.Cur.Gen189.Sanesecurity.06112002
body     SS_PHISH_CUR_G189_06112002 /\/\.www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G189_06112002 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G189_06112002 0.001

# Html.Phishing.Cur.Gen190.Sanesecurity.06112003
body     SS_PHISH_CUR_G190_06112003 /\/\.us\/paypal\/index/i
describe SS_PHISH_CUR_G190_06112003 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G190_06112003 0.001

# Html.Phishing.Cur.Gen191.Sanesecurity.06112004
body     SS_PHISH_CUR_G191_06112004 /\/\.secure\/cgi-bin\/webscr\//i
describe SS_PHISH_CUR_G191_06112004 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G191_06112004 0.001

# Html.Phishing.Cur.Gen192.Sanesecurity.06112000
body     SS_PHISH_CUR_G192_06112000 /http:\/\/.{0,50}\/~.{0,100}\/chaseonline\.chase\.com/i
describe SS_PHISH_CUR_G192_06112000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G192_06112000 0.001

# Html.Phishing.Cur.Gen193.Sanesecurity.06112001
body     SS_PHISH_CUR_G193_06112001 /http:\/\/.{0,50}\/~.{0,100}\/ebayisapi/i
describe SS_PHISH_CUR_G193_06112001 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G193_06112001 0.001

# Html.Phishing.Cur.Gen194.Sanesecurity.06112100
body     SS_PHISH_CUR_G194_06112100 /\/\.account\/paypal\/login/i
describe SS_PHISH_CUR_G194_06112100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G194_06112100 0.001

# Html.Phishing.Cur.Gen195.Sanesecurity.06112200
body     SS_PHISH_CUR_G195_06112200 /\/\.www\.ebay\.com\./i
describe SS_PHISH_CUR_G195_06112200 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G195_06112200 0.001

# Email.Phishing.Cur.Gen196.Sanesecurity.06112300
rawbody  SS_PHISH_CUR_G196_06112300 /<!-- saved from url=\(0071\)http:\/\/www\.rbs\.co\.uk\/Personal_Finances\/Bank_Online\//i
describe SS_PHISH_CUR_G196_06112300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G196_06112300 0.001

# Html.Phishing.Cur.Gen197.Sanesecurity.06112301
body     SS_PHISH_CUR_G197_06112301 /\/images\/www\.paypal\.com\/index\.html"><u>https:\/\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G197_06112301 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G197_06112301 0.001

# Html.Phishing.Cur.Gen198.Sanesecurity.06112302
body     SS_PHISH_CUR_G198_06112302 /:82\/httpsiginin\.ebay\.com\//i
describe SS_PHISH_CUR_G198_06112302 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G198_06112302 0.001

# Html.Phishing.Cur.Gen199.Sanesecurity.06112400
body     SS_PHISH_CUR_G199_06112400 /src="\.\.\/\.\.\/safe\%20house\%20-\%201\/ebay_files\/x\.gif/i
describe SS_PHISH_CUR_G199_06112400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G199_06112400 0.001

# Html.Phishing.Cur.Gen200.Sanesecurity.06112401
body     SS_PHISH_CUR_G200_06112401 /\/\%20\/cgi-bin\/webscr/i
describe SS_PHISH_CUR_G200_06112401 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G200_06112401 0.001

# Html.Phishing.Cur.Gen201.Sanesecurity.06112600
body     SS_PHISH_CUR_G201_06112600 /\/\.subscription\//i
describe SS_PHISH_CUR_G201_06112600 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G201_06112600 0.001

# Html.Phishing.Cur.Gen202.Sanesecurity.06112900
body     SS_PHISH_CUR_G202_06112900 /\/\.web\/online\%20services\//i
describe SS_PHISH_CUR_G202_06112900 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G202_06112900 0.001

# Html.Phishing.Cur.Gen203.Sanesecurity.06112901
body     SS_PHISH_CUR_G203_06112901 /\/\.online\//i
describe SS_PHISH_CUR_G203_06112901 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G203_06112901 0.001

# Html.Phishing.Cur.Gen204.Sanesecurity.06112902
body     SS_PHISH_CUR_G204_06112902 /http:\/\/ftp:\/\/.{0,150}signin\.ebay\.com/i
describe SS_PHISH_CUR_G204_06112902 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G204_06112902 0.001

# Html.Phishing.Cur.Gen205.Sanesecurity.06112903
body     SS_PHISH_CUR_G205_06112903 /\%20\%20\/www\.wellsfargo\.com\//i
describe SS_PHISH_CUR_G205_06112903 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G205_06112903 0.001

# Html.Phishing.Cur.Gen206.Sanesecurity.06112904
body     SS_PHISH_CUR_G206_06112904 /\/\%20\/fairwindsonline\.org\//i
describe SS_PHISH_CUR_G206_06112904 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G206_06112904 0.001

# Html.Phishing.Cur.Gen207.Sanesecurity.06112905
body     SS_PHISH_CUR_G207_06112905 /\/\%20\/etimebanker\.bankofthewest\.com\//i
describe SS_PHISH_CUR_G207_06112905 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G207_06112905 0.001

# Html.Phishing.Cur.Gen208.Sanesecurity.06112906
body     SS_PHISH_CUR_G208_06112906 /:84\/www\.royalbank\.com\//i
describe SS_PHISH_CUR_G208_06112906 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G208_06112906 0.001

# Html.Phishing.Cur.Gen209.Sanesecurity.06120300
body     SS_PHISH_CUR_G209_06120300 /\/aw\/pics\/\/email\/btnRespond\.gif"/i
describe SS_PHISH_CUR_G209_06120300 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G209_06120300 0.001

# Html.Phishing.Cur.Gen210.Sanesecurity.06120800
body     SS_PHISH_CUR_G210_06120800 /:82\/redirect\.paypal\.com\//i
describe SS_PHISH_CUR_G210_06120800 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G210_06120800 0.001

# Email.Phishing.Cur.Gen211.Sanesecurity.06120801
rawbody  SS_PHISH_CUR_G211_06120801 /\/\%20\/www\.eBay\.com\//i
describe SS_PHISH_CUR_G211_06120801 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G211_06120801 0.001

# Html.Phishing.Cur.Gen212.Sanesecurity.06120802
body     SS_PHISH_CUR_G212_06120802 /\/\.e\/cgi\.ebay\.com\/ws\//i
describe SS_PHISH_CUR_G212_06120802 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G212_06120802 0.001

# Html.Phishing.Cur.Gen213.Sanesecurity.06120803
body     SS_PHISH_CUR_G213_06120803 /\/\%20\/bankofamerica\//i
describe SS_PHISH_CUR_G213_06120803 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G213_06120803 0.001

# Html.Phishing.Cur.Gen214.Sanesecurity.06120900
body     SS_PHISH_CUR_G214_06120900 /\/\%20\/tyndallfcu\//i
describe SS_PHISH_CUR_G214_06120900 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G214_06120900 0.001

# Html.Phishing.Cur.Gen215.Sanesecurity.06121100
body     SS_PHISH_CUR_G215_06121100 /\/\%20\/www\.ebay\.com\//i
describe SS_PHISH_CUR_G215_06121100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G215_06121100 0.001

# Html.Phishing.Cur.Gen216.Sanesecurity.06121101
body     SS_PHISH_CUR_G216_06121101 /:82\/redirect\.nafcu\//i
describe SS_PHISH_CUR_G216_06121101 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G216_06121101 0.001

# Email.Phishing.Cur.Gen217.Sanesecurity.06121200
rawbody  SS_PHISH_CUR_G217_06121200 / <!--reviewLink:0060558121:ARNU07N2YIKP1 --><\/a><\/b></i
describe SS_PHISH_CUR_G217_06121200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G217_06121200 0.001

# Html.Phishing.Cur.Gen218.Sanesecurity.06121201
body     SS_PHISH_CUR_G218_06121201 /\/\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G218_06121201 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G218_06121201 0.001

# Email.Phishing.Cur.Gen219.Sanesecurity.06121202
rawbody  SS_PHISH_CUR_G219_06121202 /<img src=3D"http:\/\/.{0,20}\.imageshack\.us\/.{0,2150}bankofamerica/i
describe SS_PHISH_CUR_G219_06121202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G219_06121202 0.001

# Html.Phishing.Cur.Gen220.Sanesecurity.06121300
body     SS_PHISH_CUR_G220_06121300 /http:\/\/.{0,50}\/~.{0,100}alltimeonline\.sbbt\.com/i
describe SS_PHISH_CUR_G220_06121300 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G220_06121300 0.001

# Html.Phishing.Cur.Gen221.Sanesecurity.06121301
body     SS_PHISH_CUR_G221_06121301 /http:\/\/.{0,50}\/~.{0,100}bankofamerica/i
describe SS_PHISH_CUR_G221_06121301 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G221_06121301 0.001

# Html.Phishing.Cur.Gen222.Sanesecurity.06121302
body     SS_PHISH_CUR_G222_06121302 /http:\/\/.{0,50}\/~.{0,100}barclay\.co\.uk/i
describe SS_PHISH_CUR_G222_06121302 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G222_06121302 0.001

# Email.Phishing.Cur.Gen224.Sanesecurity.06121305
rawbody  SS_PHISH_CUR_G224_06121305 /http:\/\/.{0,50}\/~.{0,50}\.ebay\./i
describe SS_PHISH_CUR_G224_06121305 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G224_06121305 0.001

# Html.Phishing.Cur.Gen225.Sanesecurity.06121306
body     SS_PHISH_CUR_G225_06121306 /http:\/\/.{0,50}\/~.{0,100}\.wellsfargo\.com/i
describe SS_PHISH_CUR_G225_06121306 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G225_06121306 0.001

# Html.Phishing.Cur.Gen226.Sanesecurity.06121307
body     SS_PHISH_CUR_G226_06121307 /<img src="http:\/\/upload\.wikimedia\.org\/wikipedia\/fr\/thumb\/9\/92\/logo_bank_america\.jpg\/250px-logo_bank_america\.jpg".*account/i
describe SS_PHISH_CUR_G226_06121307 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G226_06121307 0.001

# Html.Phishing.Cur.Gen227.Sanesecurity.06122000
body     SS_PHISH_CUR_G227_06122000 /\/\.ebay\.com\./i
describe SS_PHISH_CUR_G227_06122000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G227_06122000 0.001

# Html.Phishing.Cur.Gen228.Sanesecurity.06122001
body     SS_PHISH_CUR_G228_06122001 /\/\.comdirect\.de\//i
describe SS_PHISH_CUR_G228_06122001 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G228_06122001 0.001

# Html.Phishing.Cur.Gen229.Sanesecurity.06122100
body     SS_PHISH_CUR_G229_06122100 /\/\.hsbc\.co\.uk\//i
describe SS_PHISH_CUR_G229_06122100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G229_06122100 0.001

# Html.Phishing.Cur.Gen230.Sanesecurity.06122200
body     SS_PHISH_CUR_G230_06122200 /\/\.onlinebanking\//i
describe SS_PHISH_CUR_G230_06122200 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G230_06122200 0.001

# Html.Phishing.Cur.Gen231.Sanesecurity.06122400
body     SS_PHISH_CUR_G231_06122400 /\/\.\.\.\/www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G231_06122400 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G231_06122400 0.001

# Html.Phishing.Cur.Gen232.Sanesecurity.06122401
body     SS_PHISH_CUR_G232_06122401 /http:\/\/.{0,15}:7640\/.{0,100}citibank\.de/i
describe SS_PHISH_CUR_G232_06122401 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G232_06122401 0.001

# Html.Phishing.Cur.Gen233.Sanesecurity.06122402
body     SS_PHISH_CUR_G233_06122402 /http:\/\/.{0,15}:7640\/.{0,100}online-identifikation/i
describe SS_PHISH_CUR_G233_06122402 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G233_06122402 0.001

# Email.Phishing.Cur.Gen234.Sanesecurity.06122800
rawbody  SS_PHISH_CUR_G234_06122800 /http:\/\/mujweb\.cz\/www\/.{0,100}eBayISAPIdll/i
describe SS_PHISH_CUR_G234_06122800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G234_06122800 0.001

# Html.Phishing.Cur.Gen235.Sanesecurity.06122801
body     SS_PHISH_CUR_G235_06122801 /\/icons\/\.x\/signin/i
describe SS_PHISH_CUR_G235_06122801 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G235_06122801 0.001

# Html.Phishing.Cur.Gen236.Sanesecurity.06123000
body     SS_PHISH_CUR_G236_06123000 /online banking alert"=20 src=3d"file:\/\/\/c:\/documents\%20and\%20settings\//i
describe SS_PHISH_CUR_G236_06123000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G236_06123000 0.001

# Html.Phishing.Cur.Gen237.Sanesecurity.06123001
body     SS_PHISH_CUR_G237_06123001 /http:\/\/.{0,30}\/xampp\/.{0,150}www\.wellsfargo\.com/i
describe SS_PHISH_CUR_G237_06123001 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G237_06123001 0.001

# Html.Phishing.Cur.Gen238.Sanesecurity.07010900
body     SS_PHISH_CUR_G238_07010900 /\/\.www\.wellsfargo\.com/i
describe SS_PHISH_CUR_G238_07010900 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G238_07010900 0.001

# Html.Phishing.Cur.Gen239.Sanesecurity.07010901
body     SS_PHISH_CUR_G239_07010901 /\/\.www\.citizensbank\.com\//i
describe SS_PHISH_CUR_G239_07010901 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G239_07010901 0.001

# Html.Phishing.Cur.Gen240.Sanesecurity.07011000
body     SS_PHISH_CUR_G240_07011000 /\/\.verification\/www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G240_07011000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G240_07011000 0.001

# Email.Phishing.Cur.Gen241.Sanesecurity.07012000
rawbody  SS_PHISH_CUR_G241_07012000 /signin\.ebay\.comwseBayISAPI\.dllSignIn\&co_partnerId=2\&pUserId/i
describe SS_PHISH_CUR_G241_07012000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G241_07012000 0.001

# Html.Phishing.Cur.Gen242.Sanesecurity.07015000
body     SS_PHISH_CUR_G242_07015000 /http:\/\/.{0,50}\/~.*safeharbor/i
describe SS_PHISH_CUR_G242_07015000 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G242_07015000 0.001

# Email.Phishing.Cur.Gen243.Sanesecurity.07012200
rawbody  SS_PHISH_CUR_G243_07012200 /<!-- saved from url=\(0104\)https:\/\/online\.westpac\.com\.au\//i
describe SS_PHISH_CUR_G243_07012200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G243_07012200 0.001

# Email.Phishing.Cur.Gen244.Sanesecurity.07012300
rawbody  SS_PHISH_CUR_G244_07012300 /http:\/\/www\.paypaI\./i
describe SS_PHISH_CUR_G244_07012300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G244_07012300 0.001

# Email.Phishing.Cur.Gen245.Sanesecurity.07012400
rawbody  SS_PHISH_CUR_G245_07012400 /\/\.ssl\/www\.wellsfargo\.com/i
describe SS_PHISH_CUR_G245_07012400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G245_07012400 0.001

# Email.Phishing.Cur.Gen246.Sanesecurity.07012401
rawbody  SS_PHISH_CUR_G246_07012401 /<a href='http:\/\/.{0,15}\/~.{0,100}php\?usrtr=/i
describe SS_PHISH_CUR_G246_07012401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G246_07012401 0.001

# Email.Phishing.Cur.Gen247.Sanesecurity.07012800
rawbody  SS_PHISH_CUR_G247_07012800 /\/\.isapi\.dl\.signin\.co\./i
describe SS_PHISH_CUR_G247_07012800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G247_07012800 0.001

# Email.Phishing.Cur.Gen248.Sanesecurity.07020400
rawbody  SS_PHISH_CUR_G248_07020400 /\/\.ws1\/www\.desjardins\.com\//i
describe SS_PHISH_CUR_G248_07020400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G248_07020400 0.001

# Email.Phishing.Cur.Gen249.Sanesecurity.07020401
rawbody  SS_PHISH_CUR_G249_07020401 /\/\.ws1\/rbaccess\//i
describe SS_PHISH_CUR_G249_07020401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G249_07020401 0.001

# Email.Phishing.Cur.Gen250.Sanesecurity.07022100
rawbody  SS_PHISH_CUR_G250_07022100 /<!-- saved from url=\(0063\)http:\/\/0120\.0067\.0123\.0036\//i
describe SS_PHISH_CUR_G250_07022100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G250_07022100 0.001

# Email.Phishing.Cur.Gen251.Sanesecurity.07030400
rawbody  SS_PHISH_CUR_G251_07030400 /src="http:\/\/\.\.\/Desktop\/Bank\+of\+America\+\+Online\+Banking/i
describe SS_PHISH_CUR_G251_07030400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G251_07030400 0.001

# Email.Phishing.Cur.Gen252.Sanesecurity.07030500
rawbody  SS_PHISH_CUR_G252_07030500 /\/\.amazon\.com\/index\.htm/i
describe SS_PHISH_CUR_G252_07030500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G252_07030500 0.001

# Email.Phishing.Cur.Gen253.Sanesecurity.07030800
rawbody  SS_PHISH_CUR_G253_07030800 /<a href="http:\/\/.{0,50}\/~.*barclays/i
describe SS_PHISH_CUR_G253_07030800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G253_07030800 0.001

# Email.Phishing.Cur.Gen254.Sanesecurity.07030800
rawbody  SS_PHISH_CUR_G254_07030800 /<a href="http:\/\/.{0,50}\/~.*www\.hsbc\.co\.uk/i
describe SS_PHISH_CUR_G254_07030800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G254_07030800 0.001

# Email.Phishing.Cur.Gen255.Sanesecurity.07031100
rawbody  SS_PHISH_CUR_G255_07031100 /\/signin\.ebay\.com\.ebayasap\.dll\.htm/i
describe SS_PHISH_CUR_G255_07031100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G255_07031100 0.001

# Email.Phishing.Cur.Gen256.Sanesecurity.07032700
rawbody  SS_PHISH_CUR_G256_07032700 /\/\.www\.natwest\.com\//i
describe SS_PHISH_CUR_G256_07032700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G256_07032700 0.001

# Email.Phishing.Cur.Gen257.Sanesecurity.07040600
rawbody  SS_PHISH_CUR_G257_07040600 /You have added <\/FONT><A href="http:\/\/.{0,30}\/~.{0,500}as a new e-mail address for/i
describe SS_PHISH_CUR_G257_07040600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G257_07040600 0.001

# Email.Phishing.Cur.Gen258.Sanesecurity.07040601
rawbody  SS_PHISH_CUR_G258_07040601 /\/phpMyAdmin\/libraries\/export\/\.ssh\.html">Go To Home Banking/i
describe SS_PHISH_CUR_G258_07040601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G258_07040601 0.001

# Email.Phishing.Cur.Gen259.Sanesecurity.07040602
rawbody  SS_PHISH_CUR_G259_07040602 /\/\.\%20\/www\.paypal\.fr\/"><img border="0"/i
describe SS_PHISH_CUR_G259_07040602 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G259_07040602 0.001

# Email.Phishing.Cur.Gen260.Sanesecurity.07040603
rawbody  SS_PHISH_CUR_G260_07040603 /<A href="http:\/\/ip-.*<IMG alt="" src="https:\/\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G260_07040603 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G260_07040603 0.001

# Email.Phishing.Cur.Gen261.Sanesecurity.07041200
rawbody  SS_PHISH_CUR_G261_07041200 /\.biz\.rr\.com\/www\.amazon\.com\/gp\/yourstore\//i
describe SS_PHISH_CUR_G261_07041200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G261_07041200 0.001

# Email.Phishing.Cur.Gen262.Sanesecurity.07041201
rawbody  SS_PHISH_CUR_G262_07041201 /http:\/\/app\.nordea\.se\.cprocedure_id.{0,100}\/widecarea\.aspx\//i
describe SS_PHISH_CUR_G262_07041201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G262_07041201 0.001

# Email.Phishing.Cur.Gen263.Sanesecurity.07041202
rawbody  SS_PHISH_CUR_G263_07041202 /http:\/\/bancopostaonline\.poste\.it\./i
describe SS_PHISH_CUR_G263_07041202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G263_07041202 0.001

# Email.Phishing.Cur.Gen264.Sanesecurity.07041500
rawbody  SS_PHISH_CUR_G264_07041500 /\/icons\/\.paypal\.com\//i
describe SS_PHISH_CUR_G264_07041500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G264_07041500 0.001

# Email.Phishing.Cur.Gen265.Sanesecurity.07041700
rawbody  SS_PHISH_CUR_G265_07041700 /From: "eBay-Mitglied /i
describe SS_PHISH_CUR_G265_07041700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G265_07041700 0.001

# Email.Phishing.Cur.Gen266.Sanesecurity.07041701
rawbody  SS_PHISH_CUR_G266_07041701 /\/eBayISAPI\.dll\.ssh128bitssecureconectionws32/i
describe SS_PHISH_CUR_G266_07041701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G266_07041701 0.001

# Email.Phishing.Cur.Gen267.Sanesecurity.07041900
rawbody  SS_PHISH_CUR_G267_07041900 /\/icons\/cgi\/www\.flagstar\.com\//i
describe SS_PHISH_CUR_G267_07041900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G267_07041900 0.001

# Email.Phishing.Cur.Gen268.Sanesecurity.07042300
rawbody  SS_PHISH_CUR_G268_07042300 /http:\/\/.{0,50}\/~.{0,100}\/www\.e-gold\.com/i
describe SS_PHISH_CUR_G268_07042300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G268_07042300 0.001

# Email.Phishing.Cur.Gen269.Sanesecurity.07042700
rawbody  SS_PHISH_CUR_G269_07042700 /\/\.a\/paypl\.html"/i
describe SS_PHISH_CUR_G269_07042700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G269_07042700 0.001

# Email.Phishing.Cur.Gen270.Sanesecurity.07042701
rawbody  SS_PHISH_CUR_G270_07042701 /http:\/\/vms\.gjwebs\.com\/manual\/cgi-bin\//i
describe SS_PHISH_CUR_G270_07042701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G270_07042701 0.001

# Email.Phishing.Cur.Gen271.Sanesecurity.07043000
rawbody  SS_PHISH_CUR_G271_07043000 /http:\/\/pages2\.ebay\.com\.ws\./i
describe SS_PHISH_CUR_G271_07043000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G271_07043000 0.001

# Email.Phishing.Cur.Gen272.Sanesecurity.07043001
rawbody  SS_PHISH_CUR_G272_07043001 /\.ru\/modules\/Update\/update\.php><INPUT type=submit/i
describe SS_PHISH_CUR_G272_07043001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G272_07043001 0.001

# Html.Phishing.Cur.Gen273.Sanesecurity.07043002
body     SS_PHISH_CUR_G273_07043002 /<a href="http:\/\/tinyurl\.com\/.{0,300}src="http:\/\/pics\.ebaystatic\.com/i
describe SS_PHISH_CUR_G273_07043002 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G273_07043002 0.001

# Email.Phishing.Cur.Gen274.Sanesecurity.07043003
rawbody  SS_PHISH_CUR_G274_07043003 /\.land\.ru\/SignIn26co_partnerId/i
describe SS_PHISH_CUR_G274_07043003 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G274_07043003 0.001

# Html.Phishing.Cur.Gen275.Sanesecurity.07050100
body     SS_PHISH_CUR_G275_07050100 /\/\.ws\/scgi\/ebayisapi\.dll/i
describe SS_PHISH_CUR_G275_07050100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G275_07050100 0.001

# Email.Phishing.Cur.Gen274.Sanesecurity.07050101
rawbody  SS_PHISH_CUR_G274_07050101 /From: eBay <suspesion\@ebay\.com>/i
describe SS_PHISH_CUR_G274_07050101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G274_07050101 0.001

# Email.Phishing.Cur.Gen275.Sanesecurity.07050102
rawbody  SS_PHISH_CUR_G275_07050102 /\/\.secure\/signon\.html">PayPal Security Center/i
describe SS_PHISH_CUR_G275_07050102 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G275_07050102 0.001

# Email.Phishing.Cur.Gen276.Sanesecurity.07050103
rawbody  SS_PHISH_CUR_G276_07050103 /\/ebay\.com\/eBayISAPI\/index\.htm">Click here<\/a> \. <\/p>/i
describe SS_PHISH_CUR_G276_07050103 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G276_07050103 0.001

# Email.Phishing.Cur.Gen277.Sanesecurity.07050300
rawbody  SS_PHISH_CUR_G277_07050300 /\/\.us\/cgi-bin\/webscrcmd/i
describe SS_PHISH_CUR_G277_07050300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G277_07050300 0.001

# Email.Phishing.Cur.Gen278.Sanesecurity.07050301
rawbody  SS_PHISH_CUR_G278_07050301 /http:\/\/wvw-ebaiy-com\./i
describe SS_PHISH_CUR_G278_07050301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G278_07050301 0.001

# Email.Phishing.Cur.Gen279.Sanesecurity.07050302
rawbody  SS_PHISH_CUR_G279_07050302 /http:\/\/www\.53\.com-New/i
describe SS_PHISH_CUR_G279_07050302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G279_07050302 0.001

# Email.Phishing.Cur.Gen280.Sanesecurity.07050303
rawbody  SS_PHISH_CUR_G280_07050303 /http:\/\/cgi\.ebay\.com\/ws\/eBayISAPI\.dll\?ViewItem\&amp\;item=199106424190/i
describe SS_PHISH_CUR_G280_07050303 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G280_07050303 0.001

# Email.Phishing.Cur.Gen281.Sanesecurity.07050400
rawbody  SS_PHISH_CUR_G281_07050400 /sign-in\.paypl\./i
describe SS_PHISH_CUR_G281_07050400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G281_07050400 0.001

# Email.Phishing.Cur.Gen282.Sanesecurity.07050401
rawbody  SS_PHISH_CUR_G282_07050401 /http:\/\/.{0,50}\/~.{0,100}www\.co-operativebank\.co\.uk/i
describe SS_PHISH_CUR_G282_07050401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G282_07050401 0.001

# Email.Phishing.Cur.Gen283.Sanesecurity.07050500
rawbody  SS_PHISH_CUR_G283_07050500 /\/\.\.signin\.ebay\.com\//i
describe SS_PHISH_CUR_G283_07050500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G283_07050500 0.001

# Email.Phishing.Cur.Gen284.Sanesecurity.07050501
rawbody  SS_PHISH_CUR_G284_07050501 /\/\.html\/bancoposta\//i
describe SS_PHISH_CUR_G284_07050501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G284_07050501 0.001

# Email.Phishing.Cur.Gen285.Sanesecurity.07050500
rawbody  SS_PHISH_CUR_G285_07050500 /as a new e-mail address.*http:\/\/.{0,50}\/~/i
describe SS_PHISH_CUR_G285_07050500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G285_07050500 0.001

# Email.Phishing.Cur.Gen286.Sanesecurity.07050501
rawbody  SS_PHISH_CUR_G286_07050501 /\/bbs\/ws\/scgi\/eBayISAPI\.dll\//i
describe SS_PHISH_CUR_G286_07050501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G286_07050501 0.001

# Email.Phishing.Cur.Gen287.Sanesecurity.07050600
rawbody  SS_PHISH_CUR_G287_07050600 /\.verizon\.net\/www\.poste\.it\//i
describe SS_PHISH_CUR_G287_07050600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G287_07050600 0.001

# Email.Phishing.Cur.Gen288.Sanesecurity.07050601
rawbody  SS_PHISH_CUR_G288_07050601 /\/\.ws\/eBayISAPI\.dll/i
describe SS_PHISH_CUR_G288_07050601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G288_07050601 0.001

# Email.Phishing.Cur.Gen289.Sanesecurity.07050602
rawbody  SS_PHISH_CUR_G289_07050602 /\/\%20\/cgi\/unlock\/decrypted\/index\.php/i
describe SS_PHISH_CUR_G289_07050602 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G289_07050602 0.001

# Email.Phishing.Cur.Gen290.Sanesecurity.07050603
rawbody  SS_PHISH_CUR_G290_07050603 /\/\.online\.wellsfargo\.com\//i
describe SS_PHISH_CUR_G290_07050603 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G290_07050603 0.001

# Email.Phishing.Cur.Gen291.Sanesecurity.07050800
rawbody  SS_PHISH_CUR_G291_07050800 /From: "aw-confirm\@ebay\.com"<aw-confirm\@e-bay\.com>/i
describe SS_PHISH_CUR_G291_07050800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G291_07050800 0.001

# Email.Phishing.Cur.Gen292.Sanesecurity.07050802
rawbody  SS_PHISH_CUR_G292_07050802 /http:\/\/.{0,50}\/~.{0,100}www\.cahoot\.com/i
describe SS_PHISH_CUR_G292_07050802 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G292_07050802 0.001

# Email.Phishing.Cur.Gen293.Sanesecurity.07050803
rawbody  SS_PHISH_CUR_G293_07050803 /target="_blank" href="http:\/\/.{0,30}\.free\.fr\/.*www\.paypal\.com\//i
describe SS_PHISH_CUR_G293_07050803 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G293_07050803 0.001

# Email.Phishing.Cur.Gen294.Sanesecurity.07050804
rawbody  SS_PHISH_CUR_G294_07050804 /\/\.paypal\/cgi-bin\//i
describe SS_PHISH_CUR_G294_07050804 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G294_07050804 0.001

# Email.Phishing.Cur.Gen295.Sanesecurity.07050805
rawbody  SS_PHISH_CUR_G295_07050805 /http:\/\/.{0,50}\/~.{0,100}www\.Cahoot\.com/i
describe SS_PHISH_CUR_G295_07050805 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G295_07050805 0.001

# Email.Phishing.Cur.Gen296.Sanesecurity.07050900
rawbody  SS_PHISH_CUR_G296_07050900 /\/\.bancopostaonline\.poste\.it\//i
describe SS_PHISH_CUR_G296_07050900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G296_07050900 0.001

# Email.Phishing.Cur.Gen297.Sanesecurity.07051000
rawbody  SS_PHISH_CUR_G297_07051000 /\/Home_files\/signin\.php\?email_from=3Dauctions/i
describe SS_PHISH_CUR_G297_07051000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G297_07051000 0.001

# Email.Phishing.Cur.Gen298.Sanesecurity.07051001
rawbody  SS_PHISH_CUR_G298_07051001 /\.kr\/mail\/halifax-online\.co\.uk\//i
describe SS_PHISH_CUR_G298_07051001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G298_07051001 0.001

# Email.Phishing.Cur.Gen299.Sanesecurity.07051002
rawbody  SS_PHISH_CUR_G299_07051002 /\.webshots\.com\/image\/.*http:\/\/www\.poste\.it\//i
describe SS_PHISH_CUR_G299_07051002 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G299_07051002 0.001

# Html.Phishing.Cur.Gen300.Sanesecurity.07051100
body     SS_PHISH_CUR_G300_07051100 /<strong>ebay unpaid item dispute \#.*<a href="http:\/\/singin/i
describe SS_PHISH_CUR_G300_07051100 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G300_07051100 0.001

# Email.Phishing.Cur.Gen301.Sanesecurity.07051001
rawbody  SS_PHISH_CUR_G301_07051001 /\/\.arizona\.php">http:\/\/www\.azfcu\.com\//i
describe SS_PHISH_CUR_G301_07051001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G301_07051001 0.001

# Email.Phishing.Cur.Gen302.Sanesecurity.07051002
rawbody  SS_PHISH_CUR_G302_07051002 /\.verizon\.net\/redirect_boa\.html"><span id="lw_1178618015_2">www\.bankofamerica\.com/i
describe SS_PHISH_CUR_G302_07051002 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G302_07051002 0.001

# Html.Phishing.Cur.Gen303.Sanesecurity.07051200
body     SS_PHISH_CUR_G303_07051200 /ebay sent this message to.*http:\/\/uk\.f262\.mail\.yahoo\.com\/ym\/compose\?to/i
describe SS_PHISH_CUR_G303_07051200 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G303_07051200 0.001

# Email.Phishing.Cur.Gen304.Sanesecurity.07051300
rawbody  SS_PHISH_CUR_G304_07051300 /\/SIG=148vsd1jp\/EXP=1138544186\//i
describe SS_PHISH_CUR_G304_07051300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G304_07051300 0.001

# Email.Phishing.Cur.Gen305.Sanesecurity.07051301
rawbody  SS_PHISH_CUR_G305_07051301 /\/SIG=12cpokol2\/EXP=1155942076\//i
describe SS_PHISH_CUR_G305_07051301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G305_07051301 0.001

# Email.Phishing.Cur.Gen306.Sanesecurity.07051302
rawbody  SS_PHISH_CUR_G306_07051302 /\/\%20\/www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G306_07051302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G306_07051302 0.001

# Email.Phishing.Cur.Gen307.Sanesecurity.07051303
rawbody  SS_PHISH_CUR_G307_07051303 /http:\/\/signin\.cgi\.com\.wsisapii\.dll\.usingssl\.mybay\.co-partnerid\.sapii/i
describe SS_PHISH_CUR_G307_07051303 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G307_07051303 0.001

# Email.Phishing.Cur.Gen308.Sanesecurity.07051304
rawbody  SS_PHISH_CUR_G308_07051304 /http:\/\/singin.{0,150}ebay/i
describe SS_PHISH_CUR_G308_07051304 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G308_07051304 0.001

# Email.Phishing.Cur.Gen309.Sanesecurity.07051305
rawbody  SS_PHISH_CUR_G309_07051305 /http:\/\/singin.{0,150}eBay/i
describe SS_PHISH_CUR_G309_07051305 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G309_07051305 0.001

# Email.Phishing.Cur.Gen310.Sanesecurity.07051306
rawbody  SS_PHISH_CUR_G310_07051306 /\/\.account\/www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G310_07051306 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G310_07051306 0.001

# Email.Phishing.Cur.Gen311.Sanesecurity.07051307
rawbody  SS_PHISH_CUR_G311_07051307 /\/\.secure-red\//i
describe SS_PHISH_CUR_G311_07051307 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G311_07051307 0.001

# Email.Phishing.Cur.Gen312.Sanesecurity.07051308
rawbody  SS_PHISH_CUR_G312_07051308 /ftp:\/\/.{0,150}\.ebay\./i
describe SS_PHISH_CUR_G312_07051308 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G312_07051308 0.001

# Email.Phishing.Cur.Gen313.Sanesecurity.07051308
rawbody  SS_PHISH_CUR_G313_07051308 /http:\/\/adsl.{0,150}\/www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G313_07051308 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G313_07051308 0.001

# Email.Phishing.Cur.Gen314.Sanesecurity.07051309
rawbody  SS_PHISH_CUR_G314_07051309 /http:\/\/www\.postbank\.de\.-snm-/i
describe SS_PHISH_CUR_G314_07051309 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G314_07051309 0.001

# Email.Phishing.Cur.Gen315.Sanesecurity.07051310
rawbody  SS_PHISH_CUR_G315_07051310 /http:\/\/www\.nordea\.com\.sitemod\.session/i
describe SS_PHISH_CUR_G315_07051310 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G315_07051310 0.001

# Email.Phishing.Cur.Gen316.Sanesecurity.07051311
rawbody  SS_PHISH_CUR_G316_07051311 /http:\/\/online\.bbt\.com\.onlineservlet_id/i
describe SS_PHISH_CUR_G316_07051311 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G316_07051311 0.001

# Email.Phishing.Cur.Gen317.Sanesecurity.07051400
rawbody  SS_PHISH_CUR_G317_07051400 /\/\.wumt\/asp\/westernunion\.com\//i
describe SS_PHISH_CUR_G317_07051400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G317_07051400 0.001

# Email.Phishing.Cur.Gen318.Sanesecurity.07051401
rawbody  SS_PHISH_CUR_G318_07051401 /\/\%20\/arizona-security\/index/i
describe SS_PHISH_CUR_G318_07051401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G318_07051401 0.001

# Email.Phishing.Cur.Gen319.Sanesecurity.07051402
rawbody  SS_PHISH_CUR_G319_07051402 /\.bravehost\.com\/PlaceYourCreditCard\.aspx/i
describe SS_PHISH_CUR_G319_07051402 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G319_07051402 0.001

# Email.Phishing.Cur.Gen320.Sanesecurity.07051500
rawbody  SS_PHISH_CUR_G320_07051500 /\/\%20\%20\/bancopostaonline\.poste\.it/i
describe SS_PHISH_CUR_G320_07051500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G320_07051500 0.001

# Email.Phishing.Cur.Gen321.Sanesecurity.07051501
rawbody  SS_PHISH_CUR_G321_07051501 /<a href="http:\/\/0x.{0,30}\/bancopostaon-line\.poste\.it\//i
describe SS_PHISH_CUR_G321_07051501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G321_07051501 0.001

# Email.Phishing.Cur.Gen322.Sanesecurity.07051502
rawbody  SS_PHISH_CUR_G322_07051502 /You have 1 New Secure Message!.*<A href="http:\/\/search\.aol\.com\/aolcom\/redir\?src=websearch\&requestId=/i
describe SS_PHISH_CUR_G322_07051502 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G322_07051502 0.001

# Email.Phishing.Cur.Gen323.Sanesecurity.07051503
rawbody  SS_PHISH_CUR_G323_07051503 /From:.{0,50}\@paypal\.com>.*http:\/\/ourworld\.cs\.com\/.*rect" coords=/i
describe SS_PHISH_CUR_G323_07051503 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G323_07051503 0.001

# Email.Phishing.Cur.Gen324.Sanesecurity.07051600
rawbody  SS_PHISH_CUR_G324_07051600 /\/\.https\/signin\.ebay\.com\//i
describe SS_PHISH_CUR_G324_07051600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G324_07051600 0.001

# Email.Phishing.Cur.Gen325.Sanesecurity.07051601
rawbody  SS_PHISH_CUR_G325_07051601 /\/formlogin\.txt" target="_blank"><img src="http:\/\/www\.poste\.it\//i
describe SS_PHISH_CUR_G325_07051601 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G325_07051601 0.001

# Email.Phishing.Cur.Gen326.Sanesecurity.07051700
rawbody  SS_PHISH_CUR_G326_07051700 /http:\/\/signin\.ebay\.com\.ws\./i
describe SS_PHISH_CUR_G326_07051700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G326_07051700 0.001

# Email.Phishing.Cur.Gen327.Sanesecurity.07051701
rawbody  SS_PHISH_CUR_G327_07051701 /http:\/\/www\.saake\.de\/mediac\/400_0\/media\/ebay_logo_sm\.gif/i
describe SS_PHISH_CUR_G327_07051701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G327_07051701 0.001

# Email.Phishing.Cur.Gen328.Sanesecurity.07051702
rawbody  SS_PHISH_CUR_G328_07051702 /\/cache\/signin\.ebay\.com\/ws\/eBayISAPI\.dll/i
describe SS_PHISH_CUR_G328_07051702 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G328_07051702 0.001

# Email.Phishing.Cur.Gen329.Sanesecurity.07051703
rawbody  SS_PHISH_CUR_G329_07051703 /\/http\.www\.bankofamerica\.com\.deposits\.checksave\.index/i
describe SS_PHISH_CUR_G329_07051703 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G329_07051703 0.001

# Email.Phishing.Cur.Gen330.Sanesecurity.07051704
rawbody  SS_PHISH_CUR_G330_07051704 /\/\.ibank\.postaonline\.poste\.it\//i
describe SS_PHISH_CUR_G330_07051704 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G330_07051704 0.001

# Email.Phishing.Cur.Gen331.Sanesecurity.07052000
rawbody  SS_PHISH_CUR_G331_07052000 /\/\.\%20\/Poste\/bancopostaonline\.poste\.it\//i
describe SS_PHISH_CUR_G331_07052000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G331_07052000 0.001

# Email.Phishing.Cur.Gen332.Sanesecurity.07052100
rawbody  SS_PHISH_CUR_G332_07052100 /PosteItaliane.*\.imageshack\.us\/img/i
describe SS_PHISH_CUR_G332_07052100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G332_07052100 0.001

# Email.Phishing.Cur.Gen333.Sanesecurity.07052101
rawbody  SS_PHISH_CUR_G333_07052101 /poste\.it.*\.webshots\.com\/image\//i
describe SS_PHISH_CUR_G333_07052101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G333_07052101 0.001

# Email.Phishing.Cur.Gen334.Sanesecurity.07052200
rawbody  SS_PHISH_CUR_G334_07052200 /\/\.flagstar\.com\//i
describe SS_PHISH_CUR_G334_07052200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G334_07052200 0.001

# Email.Phishing.Cur.Gen335.Sanesecurity.07052201
rawbody  SS_PHISH_CUR_G335_07052201 /www\.geocities\.com.*http:\/\/www\.poste\.it\//i
describe SS_PHISH_CUR_G335_07052201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G335_07052201 0.001

# Email.Phishing.Cur.Gen336.Sanesecurity.07052202
rawbody  SS_PHISH_CUR_G336_07052202 /http:\/\/www\.poste\.it\/.*http:\/\/cpe-.{0,100}\.rr\.com\//i
describe SS_PHISH_CUR_G336_07052202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G336_07052202 0.001

# Email.Phishing.Cur.Gen337.Sanesecurity.07052300
rawbody  SS_PHISH_CUR_G337_07052300 /\/\.wumt\.westernunion\.com\//i
describe SS_PHISH_CUR_G337_07052300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G337_07052300 0.001

# Email.Phishing.Cur.Gen338.Sanesecurity.07052400
rawbody  SS_PHISH_CUR_G338_07052400 /:82\/www\.ebay\.com\//i
describe SS_PHISH_CUR_G338_07052400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G338_07052400 0.001

# Email.Phishing.Cur.Gen339.Sanesecurity.07052500
rawbody  SS_PHISH_CUR_G339_07052500 /\/user\/SingInUssingISSAPI/i
describe SS_PHISH_CUR_G339_07052500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G339_07052500 0.001

# Email.Phishing.Cur.Gen340.Sanesecurity.07052501
rawbody  SS_PHISH_CUR_G340_07052501 /www\.paypal\.compaypalcgi/i
describe SS_PHISH_CUR_G340_07052501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G340_07052501 0.001

# Email.Phishing.Cur.Gen341.Sanesecurity.07052700
rawbody  SS_PHISH_CUR_G341_07052700 /http:\/\/signin\.ebay\.com\.ebay/i
describe SS_PHISH_CUR_G341_07052700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G341_07052700 0.001

# Email.Phishing.Cur.Gen342.Sanesecurity.07052900
rawbody  SS_PHISH_CUR_G342_07052900 /\/\.paypal\.com\//i
describe SS_PHISH_CUR_G342_07052900 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G342_07052900 0.001

# Email.Phishing.Cur.Gen343.Sanesecurity.07052901
rawbody  SS_PHISH_CUR_G343_07052901 /<a href="http:\/\/.{0,50}\/www\.paypal\.com\/.*<img src="http:\/\/.{0,50}\.imageshack\.us\//i
describe SS_PHISH_CUR_G343_07052901 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G343_07052901 0.001

# Email.Phishing.Cur.Gen344.Sanesecurity.07052902
rawbody  SS_PHISH_CUR_G344_07052902 /\/\.cgi\/www\.flagstar\.com\//i
describe SS_PHISH_CUR_G344_07052902 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G344_07052902 0.001

# Email.Phishing.Cur.Gen345.Sanesecurity.07060100
rawbody  SS_PHISH_CUR_G345_07060100 /:82\/eBayISAPI\.dll/i
describe SS_PHISH_CUR_G345_07060100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G345_07060100 0.001

# Email.Phishing.Cur.Gen346.Sanesecurity.07060400
rawbody  SS_PHISH_CUR_G346_07060400 /phpBB2\/includes\/Wellsfargo/i
describe SS_PHISH_CUR_G346_07060400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G346_07060400 0.001

# Email.Phishing.Cur.Gen347.Sanesecurity.07060401
rawbody  SS_PHISH_CUR_G347_07060401 /http:\/\/signin\.ebay\.com\.(0|1|2|3|4|5|6|7|8|9)/i
describe SS_PHISH_CUR_G347_07060401 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G347_07060401 0.001

# Email.Phishing.Cur.Gen348.Sanesecurity.07060402
rawbody  SS_PHISH_CUR_G348_07060402 /\.ws43\.com\/eBayISAPI/i
describe SS_PHISH_CUR_G348_07060402 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G348_07060402 0.001

# Email.Phishing.Cur.Gen349.Sanesecurity.07060403
rawbody  SS_PHISH_CUR_G349_07060403 /\/\.~\/ws\/eBayISAPI/i
describe SS_PHISH_CUR_G349_07060403 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G349_07060403 0.001

# Email.Phishing.Cur.Gen350.Sanesecurity.07060404
rawbody  SS_PHISH_CUR_G350_07060404 /amp\;item=130025826611\&amp\;sspagename/i
describe SS_PHISH_CUR_G350_07060404 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G350_07060404 0.001

# Email.Phishing.Cur.Gen351.Sanesecurity.07060405
rawbody  SS_PHISH_CUR_G351_07060405 /\/ws\.signin\.ebay\.com\.www\.ebay\.com\.eBayISAPI/i
describe SS_PHISH_CUR_G351_07060405 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G351_07060405 0.001

# Email.Phishing.Cur.Gen352.Sanesecurity.07060406
rawbody  SS_PHISH_CUR_G352_07060406 /\/~mysql\/index\.html" target="_blank"><img src="http:\/\/www\.compassbank/i
describe SS_PHISH_CUR_G352_07060406 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G352_07060406 0.001

# Email.Phishing.Cur.Gen353.Sanesecurity.07060407
rawbody  SS_PHISH_CUR_G353_07060407 /\/\.\%20\.\%20\%20\/index\.html">https:\/\//i
describe SS_PHISH_CUR_G353_07060407 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G353_07060407 0.001

# Email.Phishing.Cur.Gen354.Sanesecurity.07060500
rawbody  SS_PHISH_CUR_G354_07060500 /<!-- saved from url=\(0074\)https:\/\/www\.halifax-online\.co\.uk\//i
describe SS_PHISH_CUR_G354_07060500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G354_07060500 0.001

# Email.Phishing.Cur.Gen355.Sanesecurity.07060600
rawbody  SS_PHISH_CUR_G355_07060600 /\.2itb\.com" rel=nofollow><FONT face=arial color=\#003399 size=2>http:\/\/www\.ebay\.co/i
describe SS_PHISH_CUR_G355_07060600 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G355_07060600 0.001

# Email.Phishing.Cur.Gen356.Sanesecurity.07060700
rawbody  SS_PHISH_CUR_G356_07060700 /\/~www\/online\.compassweb\.com\//i
describe SS_PHISH_CUR_G356_07060700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G356_07060700 0.001

# Email.Phishing.Cur.Gen357.Sanesecurity.07060701
rawbody  SS_PHISH_CUR_G357_07060701 /\/www\.paypal\.com\/\.us\/cgi-bin\//i
describe SS_PHISH_CUR_G357_07060701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G357_07060701 0.001

# Email.Phishing.Cur.Gen358.Sanesecurity.07060800
rawbody  SS_PHISH_CUR_G358_07060800 /alt="royal bank login\.\.\." src="http:\/\/new\.egg\.com/i
describe SS_PHISH_CUR_G358_07060800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G358_07060800 0.001

# Email.Phishing.Cur.Gen359.Sanesecurity.07061000
rawbody  SS_PHISH_CUR_G359_07061000 /<IMG src="file:\/\/\/D:\/12-14-04_VISA_email\.jpg">/i
describe SS_PHISH_CUR_G359_07061000 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G359_07061000 0.001

# Email.Phishing.Cur.Gen360.Sanesecurity.07061001
rawbody  SS_PHISH_CUR_G360_07061001 /sessionid=0000ysubPS5QGj4H1ydcBhrNbn\/index\.htm"/i
describe SS_PHISH_CUR_G360_07061001 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G360_07061001 0.001

# Email.Phishing.Cur.Gen361.Sanesecurity.07061002
rawbody  SS_PHISH_CUR_G361_07061002 /\/\.poste\//i
describe SS_PHISH_CUR_G361_07061002 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G361_07061002 0.001

# Email.Phishing.Cur.Gen362.Sanesecurity.07061003
rawbody  SS_PHISH_CUR_G362_07061003 /\.com\.mx\/rra\/vacu\/index\.html"><i>click here<\/i>/i
describe SS_PHISH_CUR_G362_07061003 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G362_07061003 0.001

# Email.Phishing.Cur.Gen363.Sanesecurity.07061004
rawbody  SS_PHISH_CUR_G363_07061004 /\.imageshack\.us\/.*www\.poste\.it/i
describe SS_PHISH_CUR_G363_07061004 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G363_07061004 0.001

# Email.Phishing.Cur.Gen364.Sanesecurity.07061005
rawbody  SS_PHISH_CUR_G364_07061005 /\/\.paypalsecure\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G364_07061005 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G364_07061005 0.001

# Email.Phishing.Cur.Gen365.Sanesecurity.07061100
rawbody  SS_PHISH_CUR_G365_07061100 /\/\.sitekey\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G365_07061100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G365_07061100 0.001

# Email.Phishing.Cur.Gen366.Sanesecurity.07061101
rawbody  SS_PHISH_CUR_G366_07061101 /From:Flagstar Bank<update\@flagstar\.org>/i
describe SS_PHISH_CUR_G366_07061101 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G366_07061101 0.001

# Email.Phishing.Cur.Gen367.Sanesecurity.07061102
rawbody  SS_PHISH_CUR_G367_07061102 /hostingprod\.com\/\@yourflagstarbanking/i
describe SS_PHISH_CUR_G367_07061102 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G367_07061102 0.001

# Email.Phishing.Cur.Gen368.Sanesecurity.07061200
rawbody  SS_PHISH_CUR_G368_07061200 /:82\/powersellers\/ebay\.com\//i
describe SS_PHISH_CUR_G368_07061200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G368_07061200 0.001

# Email.Phishing.Cur.Gen369.Sanesecurity.07061201
rawbody  SS_PHISH_CUR_G369_07061201 /From: "Bank Of America"<online\@bankofamerica\.com>/i
describe SS_PHISH_CUR_G369_07061201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G369_07061201 0.001

# Email.Phishing.Cur.Gen370.Sanesecurity.07061300
rawbody  SS_PHISH_CUR_G370_07061300 /:82\/cgi-eBayISAPI\.dll\//i
describe SS_PHISH_CUR_G370_07061300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G370_07061300 0.001

# Email.Phishing.Cur.Gen371.Sanesecurity.07061301
rawbody  SS_PHISH_CUR_G371_07061301 /Dear ebay Member,/i
describe SS_PHISH_CUR_G371_07061301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G371_07061301 0.001

# Email.Phishing.Cur.Gen372.Sanesecurity.07061302
rawbody  SS_PHISH_CUR_G372_07061302 /From: "eBay"<SNPDNOTICE\@eBay\.com>/i
describe SS_PHISH_CUR_G372_07061302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G372_07061302 0.001

# Email.Phishing.Cur.Gen373.Sanesecurity.07061303
rawbody  SS_PHISH_CUR_G373_07061303 /\.narod\.ru\/httppayypal11/i
describe SS_PHISH_CUR_G373_07061303 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G373_07061303 0.001

# Email.Phishing.Cur.Gen374.Sanesecurity.07061304
rawbody  SS_PHISH_CUR_G374_07061304 /pixel\.gif" width=1 border=0>58M63536JS494714B<\/TD><\/TR><\/TBODY><\/TABLE><BR>/i
describe SS_PHISH_CUR_G374_07061304 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G374_07061304 0.001

# Email.Phishing.Cur.Gen375.Sanesecurity.07061500
rawbody  SS_PHISH_CUR_G375_07061500 /http:\/\/.{0,50}\/~.{0,100}www\.wachovia\.com/i
describe SS_PHISH_CUR_G375_07061500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G375_07061500 0.001

# Email.Phishing.Cur.Gen376.Sanesecurity.07061501
rawbody  SS_PHISH_CUR_G376_07061501 /- eCommerce Davison/i
describe SS_PHISH_CUR_G376_07061501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G376_07061501 0.001

# Email.Phishing.Cur.Gen377.Sanesecurity.07061700
rawbody  SS_PHISH_CUR_G377_07061700 /http:\/\/.{0,50}\.by\.ru\/.*http:\/\/pics\.ebaystatic\.com\//i
describe SS_PHISH_CUR_G377_07061700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G377_07061700 0.001

# Email.Phishing.Cur.Gen378.Sanesecurity.07061701
rawbody  SS_PHISH_CUR_G378_07061701 /\.com\/www\.paypal\.com\//i
describe SS_PHISH_CUR_G378_07061701 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G378_07061701 0.001

# Email.Phishing.Cur.Gen379.Sanesecurity.07061702
rawbody  SS_PHISH_CUR_G379_07061702 /\/https\/ebay\.com\/eBayISAPIdll/i
describe SS_PHISH_CUR_G379_07061702 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G379_07061702 0.001

# Email.Phishing.Cur.Gen380.Sanesecurity.07061703
rawbody  SS_PHISH_CUR_G380_07061703 /Online Banking at <a target="_blank" href="http:\/\/host/i
describe SS_PHISH_CUR_G380_07061703 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G380_07061703 0.001

# Email.Phishing.Cur.Gen381.Sanesecurity.07061800
rawbody  SS_PHISH_CUR_G381_07061800 /redirect_boa\.html"><span id=3D"lw_1178618015_7">www\.bankofamerica/i
describe SS_PHISH_CUR_G381_07061800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G381_07061800 0.001

# Email.Phishing.Cur.Gen382.Sanesecurity.07061801
rawbody  SS_PHISH_CUR_G382_07061801 /\.land\.ru\/eb\.html\?ws\/eBayISAPI\.dll/i
describe SS_PHISH_CUR_G382_07061801 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G382_07061801 0.001

# Email.Phishing.Cur.Gen383.Sanesecurity.07061802
rawbody  SS_PHISH_CUR_G383_07061802 /http:\/\/cable-.*http:\/\/pics\.ebaystatic\.com\//i
describe SS_PHISH_CUR_G383_07061802 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G383_07061802 0.001

# Html.Phishing.Cur.Gen384.Sanesecurity.07061900
body     SS_PHISH_CUR_G384_07061900 /href="http:\/\/host.{0,150}sign in to bank of america online banking/i
describe SS_PHISH_CUR_G384_07061900 SaneSecurity: HTML-based phishing attempt
score    SS_PHISH_CUR_G384_07061900 0.001

# Email.Phishing.Cur.Gen385.Sanesecurity.07062100
rawbody  SS_PHISH_CUR_G385_07062100 /From: "Paypal"<support\@paypal\.com>/i
describe SS_PHISH_CUR_G385_07062100 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G385_07062100 0.001

# Email.Phishing.Cur.Gen386.Sanesecurity.07062200
rawbody  SS_PHISH_CUR_G386_07062200 /http:\/\/adsl-.{0,100}\/www\.midamericabank\.com\//i
describe SS_PHISH_CUR_G386_07062200 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G386_07062200 0.001

# Email.Phishing.Cur.Gen387.Sanesecurity.07062201
rawbody  SS_PHISH_CUR_G387_07062201 /\/\.x\/index\.htm" target=_blank>/i
describe SS_PHISH_CUR_G387_07062201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G387_07062201 0.001

# Email.Phishing.Cur.Gen388.Sanesecurity.07062202
rawbody  SS_PHISH_CUR_G388_07062202 /\/\.https:\/www\.amazon\.com\//i
describe SS_PHISH_CUR_G388_07062202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G388_07062202 0.001

# Email.Phishing.Cur.Gen389.Sanesecurity.07062203
rawbody  SS_PHISH_CUR_G389_07062203 /\/anylogin\/SingInUssingISSAPIfromeBayVerifyaccount/i
describe SS_PHISH_CUR_G389_07062203 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G389_07062203 0.001

# Email.Phishing.Cur.Gen390.Sanesecurity.07062204
rawbody  SS_PHISH_CUR_G390_07062204 /\/\.wb\/">message CLICK HERE TO CONTINUE<\/a>/i
describe SS_PHISH_CUR_G390_07062204 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G390_07062204 0.001

# Email.Phishing.Cur.Gen391.Sanesecurity.07062205
rawbody  SS_PHISH_CUR_G391_07062205 /\.land\.ru\/.*http:\/\/www\.poste\.it\//i
describe SS_PHISH_CUR_G391_07062205 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G391_07062205 0.001

# Email.Phishing.Cur.Gen392.Sanesecurity.07062206
rawbody  SS_PHISH_CUR_G392_07062206 /\.pop3\.ru\/.*http:\/\/www\.poste\.it\//i
describe SS_PHISH_CUR_G392_07062206 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G392_07062206 0.001

# Email.Phishing.Cur.Gen393.Sanesecurity.07062207
rawbody  SS_PHISH_CUR_G393_07062207 /\/\.ssl\/azcentralcu\.org\//i
describe SS_PHISH_CUR_G393_07062207 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G393_07062207 0.001

# Email.Phishing.Cur.Gen394.Sanesecurity.07062500
rawbody  SS_PHISH_CUR_G394_07062500 /\/\.www\.ebay\.com\/eBayISAPI/i
describe SS_PHISH_CUR_G394_07062500 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G394_07062500 0.001

# Email.Phishing.Cur.Gen395.Sanesecurity.07062501
rawbody  SS_PHISH_CUR_G395_07062501 /\.free\.fr\/http\/www\.bankofamerica\.com\//i
describe SS_PHISH_CUR_G395_07062501 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G395_07062501 0.001

# Email.Phishing.Cur.Gen396.Sanesecurity.07062700
rawbody  SS_PHISH_CUR_G396_07062700 /target="_blank" href="http:\/\/adsl-.*Please visit Online Banking at/i
describe SS_PHISH_CUR_G396_07062700 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G396_07062700 0.001

# Email.Phishing.Cur.Gen397.Sanesecurity.07062800
rawbody  SS_PHISH_CUR_G397_07062800 /\.onlinehome-server\.info\/sitekey\.bankofamerica/i
describe SS_PHISH_CUR_G397_07062800 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G397_07062800 0.001

# Email.Phishing.Cur.Gen398.Sanesecurity.07070200.doc
rawbody  SS_PHISH_CUR_G398_07070200_DOC /AAAAR2VvAAAAAAAAAAAAHgAAAAEAAAAAAAAAHgAAAAEAAAAAAAAAHgAAAAEA.{0,3}AAAAAAAAHgAAAAQAAABHZW8AAAAAAAAAAAAeAAAAAgAAADEAAABAAAAAAAAA/i
describe SS_PHISH_CUR_G398_07070200_DOC SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G398_07070200_DOC 0.001

# Email.Phishing.Cur.Gen399.Sanesecurity.07070201
rawbody  SS_PHISH_CUR_G399_07070201 /http:\/\/xoomer\.alice\.it\/.*eBay/i
describe SS_PHISH_CUR_G399_07070201 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G399_07070201 0.001

# Email.Phishing.Cur.Gen400.Sanesecurity.07070202
rawbody  SS_PHISH_CUR_G400_07070202 /http:\/\/www\.paypal\.com\.cgi\.bin\./i
describe SS_PHISH_CUR_G400_07070202 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G400_07070202 0.001

# Email.Phishing.Cur.Gen401.Sanesecurity.07070203
rawbody  SS_PHISH_CUR_G401_07070203 /http:\/\/www\.rbs\.co\.uk\./i
describe SS_PHISH_CUR_G401_07070203 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G401_07070203 0.001

# Email.Phishing.Cur.Gen402.Sanesecurity.07070300
rawbody  SS_PHISH_CUR_G402_07070300 /\/robots\.txt\?signin\.ebay\.com\/ws\//i
describe SS_PHISH_CUR_G402_07070300 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G402_07070300 0.001

# Email.Phishing.Cur.Gen403.Sanesecurity.07070301
rawbody  SS_PHISH_CUR_G403_07070301 /From: "eBay"<unpaiditem\@ebay\.com>/i
describe SS_PHISH_CUR_G403_07070301 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G403_07070301 0.001

# Email.Phishing.Cur.Gen404.Sanesecurity.07070302
rawbody  SS_PHISH_CUR_G404_07070302 /\.cox\.net\/images\/flagstar\.anti-fraud\/index\.html/i
describe SS_PHISH_CUR_G404_07070302 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G404_07070302 0.001

# Email.Phishing.Cur.Gen405.Sanesecurity.07070400
rawbody  SS_PHISH_CUR_G405_07070400 /\/\.x\/webscr\/cmd=_login-run\.html/i
describe SS_PHISH_CUR_G405_07070400 SaneSecurity: Text-based phishing attempt
score    SS_PHISH_CUR_G405_07070400 0.001

# Email.Phishing.Cur.Gen406.Sanesecurity.07070401
rawbody  SS_PHISH_CUR_G406_07070401 /http:\/\/.{0,30}paypai\.com\//i
describe SS_PHISH_CUR_G406_07070401