gocr_path	/usr/bin/gocr
pnmtools_path	/usr/bin
ocrtext_dscore	15

ocrtext_words	realtime;alert;actquick;announce;headline;charts;increase;below;rating;takeoff;resource;ready::0.1;profit;news::0.1;wallstreet;free::0;pick::0.1;breaking;explosive;strong;spotlight;watch;symbol;stock;investor;offer;international;company;money::0;million;thousand;loose;buy;price::0.1;trade;worldtrade;target::0.1;higher;banking;service;recommendation;viagra;soma::0.1;cialis::0.1;xanax;valium;meridia::0.1;zanaflex;levitra;herbal::0.1;medicine;doctor;pills;legal;penis::0;erection::0.1;supplement;medication;weightloss;growth;drugs;pharmacy;prescription;click::0.1;here::0;software;kunde;volksbank;sparkasse;master;degree;bachelor;diploma;removal;visit;browser;readmore;type::0.1;cheap;shipping;quality;sideeffects;size::0.1;focused;replica::0.1;sale::0.1;bags::0.1;development;technology;expect;long-term;quick::0.1;afford;tradeout;compensate

ocrtext_pwords	information

body		OCRTEXT			eval:ocrtext_check()
priority	OCRTEXT			100

#
# Validate the GIF/PNG/JPEG pictures
#
body		SPAMPIC_FORGED_CT	eval:ocrtext_eval()
describe        SPAMPIC_FORGED_CT	Forged content-type in mime header
score           SPAMPIC_FORGED_CT	3.000

body            SPAMPIC_SUSPECT         eval:ocrtext_eval()
describe        SPAMPIC_SUSPECT		Suspect image found
score           SPAMPIC_SUSPECT		0.900

body		GIFANIM_SUSPECT		eval:ocrtext_eval()
describe        GIFANIM_SUSPECT		Suspect animated gif found
score           GIFANIM_SUSPECT		2.500

body		SPAMPIC_UNKNOWN		eval:ocrtext_eval()
describe        SPAMPIC_UNKNOWN		Failed to read image header
score           SPAMPIC_UNKNOWN		2.000

body		SPAMPIC_NONSTD		eval:ocrtext_eval()
describe        SPAMPIC_NONSTD		Non standard image header
score           SPAMPIC_NONSTD		0.200

body		SPAMPIC_BROKEN		eval:ocrtext_eval()
describe        SPAMPIC_BROKEN		Contains damaged image
score           SPAMPIC_BROKEN		1.500

body		SPAMPIC_ALPHA_1		eval:ocrtext_eval()
describe	SPAMPIC_ALPHA_1		Image contains many alphanumeric chars
score		SPAMPIC_ALPHA_1		0.500

body		SPAMPIC_ALPHA_2		eval:ocrtext_eval()
describe	SPAMPIC_ALPHA_2		Image contains many alphanumeric chars
score		SPAMPIC_ALPHA_2		1.000

body		SPAMPIC_ALPHA_3		eval:ocrtext_eval()
describe	SPAMPIC_ALPHA_3		Image contains many alphanumeric chars
score		SPAMPIC_ALPHA_3		1.500

body		__SPAMPIC_COUNT_2	eval:ocrtext_eval()
body		__SPAMPIC_COUNT_3	eval:ocrtext_eval()
body		__SPAMPIC_COUNT_4	eval:ocrtext_eval()
body		__SPAMPIC_COUNT_5	eval:ocrtext_eval()
body		__SPAMPIC_COUNT_6	eval:ocrtext_eval()
body		__SPAMPIC_COUNT_7	eval:ocrtext_eval()
rawbody         __HAVE_CID              /src=["']?cid:/i

body		ONE_PICTURE		eval:ocrtext_eval()
describe	ONE_PICTURE		Single picture
score		ONE_PICTURE		0.100

#
# Multiple inline pics without text are very suspicios
#
meta		SPAMPIC_MULTI_1		(__SPAMPIC_COUNT_2 + (HTML_IMAGE_ONLY_04 || HTML_IMAGE_ONLY_08 || HTML_IMAGE_ONLY_12 || HTML_IMAGE_ONLY_16 || HTML_IMAGE_ONLY_20 || HTML_IMAGE_ONLY_24 || HTML_IMAGE_ONLY_28 || HTML_IMAGE_ONLY_32) + __HAVE_CID + (IMPPYZOR_CHECK || SPAMPIC_WORDS_1 || SPAMPIC_ALPHA_1 || SPAMPIC_ALPHA_2 || SPAMPIC_ALPHA_3) == 4)
describe	SPAMPIC_MULTI_1		Contains inline pics (2)
score           SPAMPIC_MULTI_1		1.000

meta		SPAMPIC_MULTI_2		(__SPAMPIC_COUNT_3 + (HTML_IMAGE_ONLY_04 || HTML_IMAGE_ONLY_08 || HTML_IMAGE_ONLY_12 || HTML_IMAGE_ONLY_16 || HTML_IMAGE_ONLY_20 || HTML_IMAGE_ONLY_24 || HTML_IMAGE_ONLY_28 || HTML_IMAGE_ONLY_32) + __HAVE_CID + (IMPPYZOR_CHECK || SPAMPIC_WORDS_1 || SPAMPIC_ALPHA_1 || SPAMPIC_ALPHA_2 || SPAMPIC_ALPHA_3) == 4)
describe        SPAMPIC_MULTI_2		Contains inline pics (3)
score           SPAMPIC_MULTI_2		2.000

meta		SPAMPIC_MULTI_3		(__SPAMPIC_COUNT_4 + (HTML_IMAGE_ONLY_04 || HTML_IMAGE_ONLY_08 || HTML_IMAGE_ONLY_12 || HTML_IMAGE_ONLY_16 || HTML_IMAGE_ONLY_20 || HTML_IMAGE_ONLY_24 || HTML_IMAGE_ONLY_28 || HTML_IMAGE_ONLY_32) + __HAVE_CID + (IMPPYZOR_CHECK || SPAMPIC_WORDS_1 || SPAMPIC_ALPHA_1 || SPAMPIC_ALPHA_2 || SPAMPIC_ALPHA_3) == 4)
describe        SPAMPIC_MULTI_3		Contains inline pics (4)
score           SPAMPIC_MULTI_3		2.500

meta		SPAMPIC_MULTI_4		(__SPAMPIC_COUNT_5 + (HTML_IMAGE_ONLY_04 || HTML_IMAGE_ONLY_08 || HTML_IMAGE_ONLY_12 || HTML_IMAGE_ONLY_16 || HTML_IMAGE_ONLY_20 || HTML_IMAGE_ONLY_24 || HTML_IMAGE_ONLY_28 || HTML_IMAGE_ONLY_32) + __HAVE_CID + (IMPPYZOR_CHECK || SPAMPIC_WORDS_1 || SPAMPIC_ALPHA_1 || SPAMPIC_ALPHA_2 || SPAMPIC_ALPHA_3) == 4)
describe        SPAMPIC_MULTI_4		Contains inline pics (5)
score           SPAMPIC_MULTI_4		3.000

meta		SPAMPIC_MULTI_5		(__SPAMPIC_COUNT_6 + (HTML_IMAGE_ONLY_04 || HTML_IMAGE_ONLY_08 || HTML_IMAGE_ONLY_12 || HTML_IMAGE_ONLY_16 || HTML_IMAGE_ONLY_20 || HTML_IMAGE_ONLY_24 || HTML_IMAGE_ONLY_28 || HTML_IMAGE_ONLY_32) + __HAVE_CID + (IMPPYZOR_CHECK || SPAMPIC_WORDS_1 || SPAMPIC_ALPHA_1 || SPAMPIC_ALPHA_2 || SPAMPIC_ALPHA_3) == 4)
describe        SPAMPIC_MULTI_5		Contains inline pics (6)
score           SPAMPIC_MULTI_5		4.000

meta		SPAMPIC_MULTI_6		(__SPAMPIC_COUNT_7 + (HTML_IMAGE_ONLY_04 || HTML_IMAGE_ONLY_08 || HTML_IMAGE_ONLY_12 || HTML_IMAGE_ONLY_16 || HTML_IMAGE_ONLY_20 || HTML_IMAGE_ONLY_24 || HTML_IMAGE_ONLY_28 || HTML_IMAGE_ONLY_32) + __HAVE_CID + (IMPPYZOR_CHECK || SPAMPIC_WORDS_1 || SPAMPIC_ALPHA_1 || SPAMPIC_ALPHA_2 || SPAMPIC_ALPHA_3) == 4)
describe        SPAMPIC_MULTI_6		Contains inline pics (7+)
score           SPAMPIC_MULTI_6		5.000



#
# Summarize the OCR scan results
#
body		SPAMPIC_WORDS_1		eval:ocrtext_eval()
describe        SPAMPIC_WORDS_1		Contains inline spam picture (1)
score           SPAMPIC_WORDS_1		1.500

body		SPAMPIC_WORDS_2	eval:ocrtext_eval()
describe        SPAMPIC_WORDS_2		Contains inline spam picture (2)
score           SPAMPIC_WORDS_2		4.000

body		SPAMPIC_WORDS_3	eval:ocrtext_eval()
describe        SPAMPIC_WORDS_3		Contains inline spam picture (3)
score           SPAMPIC_WORDS_3		6.000

body		SPAMPIC_WORDS_4	eval:ocrtext_eval()
describe        SPAMPIC_WORDS_4		Contains inline spam picture (4)
score           SPAMPIC_WORDS_4		9.000

body		SPAMPIC_WORDS_5	eval:ocrtext_eval()
describe        SPAMPIC_WORDS_5		Contains inline spam picture (5+)
score           SPAMPIC_WORDS_5		12.000