body __CN_PHISH1_BODY /Confirm your email identity below/i
body __CN_PHISH1_CODE /Warning Code:[a-zA-Z0-9]+/
body __CN_PHISH1_CODE2 /network system with error code [a-zA-Z0-9]+/
-meta CN_PHISH1 (__CN_PHISH1_SUB && __CN_PHISH1_BODY && __CN_PHISH1_CODE && __CN_PHISH1_CODE2)
+meta CN_PHISH1 __CN_PHISH1_SUB && __CN_PHISH1_BODY && __CN_PHISH1_CODE && __CN_PHISH1_CODE2
score CN_PHISH1 10.0
describe CN_PHISH1 CARNet-Debian phish signature 1
body __CN_PHISH2_BODY /account update our account/i
body __CN_PHISH2_BODY2 /authomatically spam free/i
body __CN_PHISH2_CODE /error code [a-zA-Z0-9]+/i
-meta CN_PHISH2 (__CN_PHISH2_SUB && __CN_PHISH2_BODY && __CN_PHISH2_BODY2 && __CN_PHISH2_CODE)
+meta CN_PHISH2 __CN_PHISH2_SUB && __CN_PHISH2_BODY && __CN_PHISH2_BODY2 && __CN_PHISH2_CODE
score CN_PHISH2 10.0
describe CN_PHISH2 CARNet-Debian phish signature 2
+
+header __CN_PHISH3_SUB Subject =~ /^Dear.*Account.*User/i
+body __CN_PHISH3_BODY /Internet Webmail message center/i
+body __CN_PHISH3_BODY2 /You are advice to verify/i
+body __CN_PHISH3_BODY3 /lose his or her account permanently/i
+meta CN_PHISH3 __CN_PHISH3_SUB && __CN_PHISH3_BODY && __CN_PHISH3_BODY2 && __CN_PHISH3_BODY3
+score CN_PHISH3 10.0
+describe CN_PHISH3 CARNet-Debian phish signature 3
+
+header __CN_SPAM4_SUB Received =~ /CommuniGate Pro SMTP/i
+body __CN_SPAM4_CODE /westeur-consult\.com/
+meta CN_SPAM4 __CN_SPAM4_SUB && __CN_SPAM4_CODE
+score CN_SPAM4 10.0
+describe CN_SPAM4 CARNet-Debian spam signature 4