Will ensure any email you restore from Recycle Bin will come through marked as good and not marked for delete.
False
200
#FF1A19B3
White
False
False
False
All
Header
Contains
PlainText
Resent-From: "MailWasher? Pro recycle bin" <
Currently set for many non latin languages. You can edit this filter to your own preference.
False
-100
#FFCC0098
White
False
False
All
EntireMessage
Contains
Language
Arabic,Chinese,Cyrillic,Hebrew,Indic,Japanese,Korean,Tamil,Vietnamese
Looks for messages that are not addressed to you on either the To or CC lines. You need to edit this to include all your own email addresses to use.
True
-100
#FFCC0098
White
False
False
All
To
NotContain
PlainText
bob@test.com
To
NotContain
PlainText
bob.builder@test.com
To
NotContain
PlainText
bbuilder@test.com
Hide & Delete
False
0
#FFCC0098
White
False
False
All
From
Contains
PlainText
Domain
Contains
PlainText
Subject
Contains
PlainText
Body
Contains
PlainText
TLD
Contains
PlainText
STREAM,PARTY,DATE,FAITH,BID,XYZ,WIN,MOSCOW,TAB,PRO
Spamcop report replies
False
100
#FF149899
White
False
False
All
Subject
Contains
PlainText
[SpamCop (
Nigerian Scammer
False
-150
#FFCC0098
White
False
False
All
Header
Contains
PlainText
bobby-j0nes@hotmail.com
EntireMessage
Contains
PlainText
Rebecca Schieble
EntireMessage
Contains
PlainText
rebeccaschieble
Header
Contains
PlainText
Mrs Reb
Body
Contains
PlainText
I Have A Mutual Confidential Offer For You
Body
Contains
PlainText
MRS_SCHIEBLE
Images Scam
False
-100
#FFCC0098
White
False
False
All
Body
Contains
PlainText
I was confused, to put it nicely, when I came across my images at your web-site.
Body
Contains
PlainText
It's not legal to use stolen images and it's so mean!
Body
Contains
PlainText
If you don't remove the images mentioned in the document above within the next few days,
Body
Contains
PlainText
you may be pretty damn sure I am going to report and sue you!
DocuSign Scam
True
-100
#FFCC0098
White
False
False
All
From
Contains
PlainText
DocuSign
From
NotContain
RegEx
@docusign\.(com|net)
Subject
Contains
PlainText
DocuSign
Docusign Scam
False
-100
#FFCC0098
White
False
False
All
Subject
Contains
PlainText
You got invoice from DocuSign Electronic Service
Counterfeit Goods
False
-200
#FFCC0098
White
True
False
False
All
From
Contains
PlainText
Ray Ban Outlet
From
Contains
PlainText
Louis Vuitton
From
Contains
PlainText
RAY-BAN
Body
Contains
PlainText
www.zlwrb.com/
Dating Scam
False
-200
#FFCC0098
White
False
False
All
EntireMessage
Contains
PlainText
mydatehub.
EntireMessage
Contains
PlainText
datinghub.
EntireMessage
Contains
PlainText
datesuperhub.
EntireMessage
Contains
PlainText
bestdatehub.
Chinese Characters Spam
False
-100
#FFCC0098
White
False
False
All
Header
Contains
PlainText
From: =?utf-8?B?5
From China
False
-100
#FFCC0098
White
False
False
All
Header
Contains
RegEx
@163.com
EntireMessage
Contains
RegEx
X-Mailer:\ Foxmail\ .*\ [cn]
Header
Contains
RegEx
Date:\s.+\s\+0800
Chinese Tee Shirts Spam
False
-100
#FFCC0098
White
False
False
All
Subject
Contains
PlainText
TING's Family
Body
Contains
PlainText
Hello Mr (Mrs) TING,
Body
Contains
PlainText
TING's FAMILY COLLECTION
Body
Contains
PlainText
TING's FAMILY COLLECTION
Body
Contains
PlainText
I'm A Student And I'm Honored To Be Design Tee Shirts For You
Body
Contains
PlainText
I know your very very love
Body
Contains
PlainText
T-Shirts Online
Spamvertised Chinese Domains
False
-100
#FFCC0098
White
False
False
All
EntireMessage
Contains
PlainText
datewithbeauty.cn
EntireMessage
Contains
PlainText
girlsbeauty.cn
Spam from known web hosts
False
-200
#FFCC0098
White
True
False
All
Header
Contains
PlainText
Received: from web.sdwebserver.com
Header
Contains
PlainText
Received: from web.phxwebserver.com
Header
Contains
PlainText
Received: from vpsnode.webhubone.com
Header
Contains
PlainText
Received: from [23.228.
Header
Contains
PlainText
Received: from [93.190.9.
Header
Contains
PlainText
Received: from [104.148.18.
Header
Contains
PlainText
Received: from [104.148.21
Header
Contains
PlainText
Received: from [134.73.
Header
Contains
PlainText
Received: from [192.200.200.
Header
Contains
PlainText
Received: from [193.17.7.
Header
Contains
PlainText
Received: from [193.111.76.
Header
Contains
PlainText
Received: from [194.116.
Header
Contains
PlainText
Received: from [23.247.36.
Header
Contains
PlainText
Received: from [109.236.50.
Sextortion Scam
True
-200
#FFCC0098
White
False
False
All
Body
Contains
PlainText
That's why: Transfer $
Body
Contains
PlainText
in Bitcoin to:
Body
Contains
PlainText
within 48 hours!
Sextortion Scam
False
-100
#FFCC0098
White
False
False
All
Subject
Contains
PlainText
I RECORDED YOU!
Subject
Contains
PlainText
YOUR DEVICE AND EMAIL HAS BEEN COMPROMISED
Body
Contains
PlainText
Unfortunately, there are some bad news for you.
Body
Contains
PlainText
I RECORDED YOU (through your camera) SATISFYING YOURSELF!
Body
Contains
PlainText
unless you prevent this by paying me
Body
Contains
PlainText
to my BTC account within 2 days:
Body
Contains
PlainText
As I got access to this email account, I will know if this email has already been read.
Body
Contains
PlainText
You are given not more than 2 days after you have opened this email.
Body
Contains
PlainText
An advice from me, regularly change all your passwords to your accounts and update your device with newest security patches.
Body
Contains
PlainText
With aid of Trojan Viruses, I managed to gain full access to any PC or other types of devices.
Body
Contains
PlainText
I have collected a video on the left screen where you enjoy wanking
Body
Contains
PlainText
I am also able to gain access to all e-mail correspondence as well as messengers used by you.
Sextortion Scam
False
-150
#FFCC0098
White
False
False
All
Subject
Contains
PlainText
Don't forget to pay the tax within 2 days!
Subject
Contains
PlainText
READ OR GO TO JAIL!
Body
Contains
PlainText
PRONOGRAPHIC
Subject
Contains
PlainText
Pending for a payment.
Body
Contains
PlainText
P0RN0graphic videos
Body
Contains
PlainText
BIT C0lN
Body
Contains
PlainText
Important! The address(CaSe SeNsItIvE) contains spaces so you must to eliminate all the spaces
Body
Contains
PlainText
The Address which is CASE SENSITIVE contains spaces so you have to manually remove all spaces
Body
Contains
PlainText
My malicious application
Body
Contains
PlainText
my bitcoin wallet:
Body
Contains
PlainText
I have gained access to your devices
Body
Contains
PlainText
you masturbate
Body
Contains
PlainText
where you must to send my bribery
Body
Contains
PlainText
you should end this habbit
Body
Contains
PlainText
You need to send that amount to this wallet:
Body
Contains
RegEx
MASTURBBATE
Sextortion Scam
True
-200
#FFCC0098
White
False
False
All
EntireMessage
Contains
PlainText
send that amount to this wallet:
EntireMessage
Contains
RegEx
(0-9a-zA-Z){34}
Sextortion Scam
False
-100
#FFCC0098
White
False
False
All
From
Contains
PlainText
Recorded You
Subject
Contains
PlainText
Video Of You!
Body
Contains
PlainText
Hey, today I got some bad news for you.
Body
Contains
PlainText
To stop me, pay
Body
Contains
PlainText
//paxful.om/buy-bitcoin
Bitcoin Wallet
False
-100
#FFCC0098
White
False
False
All
Body
Contains
RegEx
Bitcoin\ .*Wallet\ address\ is\x20
Body
Contains
RegEx
My\s{1,2} bitcoin .* (wallet|address) .*: [0-9|a-z|A-Z]{34,42}
Body
Contains
RegEx
bitcoin\ wallet.*:\ [0-9|a-z|A-Z]{34}
Body
Contains
PlainText
Below is bitcoin address (BTC Wallet)
Body
Contains
PlainText
Bitcoin wallet
Body
Contains
PlainText
My Bitcoin (BTC) address is:
T.co Spam
True
-150
#FFCC0098
White
False
False
All
Body
Contains
PlainText
Head on over to cloudcone.com
Body
Contains
PlainText
Dear Lucky customer
Body
Contains
PlainText
t.co/
Security protocol update exploit link
True
-200
#FFCC0098
White
False
False
All
Header
Contains
PlainText
.pw>
Subject
Contains
PlainText
Security protocol update
Body
Contains
PlainText
Update Emails
.pw spam
False
-100
#FFCC0098
White
False
False
All
Header
Contains
PlainText
.pw>
Header
Contains
RegEx
Received: from ns\d\.[a-z0-9]+\.pw\s
.sbs domain spam
True
-100
#FFCC0098
White
False
False
All
From
Contains
PlainText
.sbs>
Body
Contains
PlainText
.sbs/
Viagra Spam
False
-200
#FFCC0098
White
False
False
All
Subject
Contains
PlainText
Viagra/Cialis/Levitra
Subject
Contains
PlainText
Buy Vaigra
Subject
Contains
PlainText
Always be ready.
Subject
Contains
PlainText
impotenc
Subject
Contains
PlainText
se>.<
Subject
Contains
PlainText
dysfunction
Subject
Contains
PlainText
$_e'xual
Subject
Contains
RegEx
(blue|love).?pills?\b
Subject
Is
PlainText
Be ready.
Subject
Contains
RegEx
\b(ciali[a-z]|levitra|viagra|VIGARA|Viigaaraa|Vi@gra|Pfizer|^Pending\ delivery)\b|(?-i)C[i1]al[i1]s|Kamagra
Subject
Contains
RegEx
(?-i)ED[_\s]dysfunction|\sED\.|[Aa]nti-ED
Subject
Contains
RegEx
(?-i)Online\ V[a-z1]{1,4}A\ Store
Subject
Contains
RegEx
^user\ .+brand\ \d\d%\ Off\ Sale
Subject
Contains
PlainText
success stories about V
Subject
Contains
RegEx
personal\ \d\d%\ dis[cs]ount
Subject
Contains
RegEx
V I A G R A
Header
Contains
RegEx
Last Longer
Viagra Spam
False
-200
#FFCC0098
White
False
False
All
Header
Contains
PlainText
underhillzz.com
Erectile Dysfunction Sapm
False
-200
#FFCC0098
White
False
False
All
EntireMessage
Contains
PlainText
Erectile Dysfunction
False
-100
#FFCC0098
White
False
False
All
Body
Contains
PlainText
.digitaloceanspaces.com/
Jinkmail
True
-100
#FFCC0098
White
True
False
All
Subject
Contains
PlainText
Wiz, welcome to your new Pixel
From
Contains
PlainText
googlepixel-noreply@google.com
X-Mailer: PHPMailer
False
0
#FF434343
White
False
False
All
Header
Contains
PlainText
X-Mailer: PHPMailer
Russian X-Mailer Tool
False
-200
#FFCC0098
White
False
False
All
Header
Contains
PlainText
Php_libMail_v_2.11(webi.ru)
Header
Contains
PlainText
X-Mailer: Php_libMail
Amazon Scam
True
-100
#FFFFE500
Black
False
False
All
From
Contains
PlainText
@amazon.com
ReturnPath
NotContain
RegEx
@(bounces\.)?amazon.com
Not A Scam
True
200
#FF149899
White
False
False
False
All
From
Contains
RegEx
(service|paypal)@paypal.com
Header
Contains
RegEx
Received:\ from\ (mx\d\.(phx|slc)\.paypal\.com|\(?\[173.0.84.\d{1,3}\]|helo=mx\d{0,3}\.slc\.paypal\.com|.+\.paypalcorp\.com|mail\d{1,4}.\.paypal.mkt2944.com)
Header
Contains
RegEx
DKIM-Signature:\s.+\sd=paypal.com;
Not A Scam
True
100
#FF149899
White
False
False
All
From
Contains
PlainText
noreply@mail.paypal.com
Header
Contains
RegEx
domain\ of\ bounce@mail\.paypal\.com\ designates\ 142\.54\.244\.\d{1,3}\ as\ permitted\ sender
Header
Contains
PlainText
Return-Path: <bounce@mail.paypal.com>
PayPal Phishing Scam
True
-100
#FFCC0098
White
False
False
All
Header
NotContain
RegEx
Received:\ from\ ([a-z0-9.-]+\.(epsl1|paypal)\.com\s|\[(\d{1,3}\.){3}\d{1,3}\]\ \((port=\d{4,5}\s)?helo=mx\d\..{3}\.paypal\.com\)\s?\n|helo=outbound\.na\.e\.paypal\.com\)\n
Header
NotContain
RegEx
^Received:\ from\ \[[0-9.]+\]\ \(port=\d{4,5}\ helo=mail2550.paypal.mkt2944.com\)\s?\n
Header
NotContain
RegEx
^Received:\ from\ ccg\d\dmail\d\.ccg\d\d\.slc\.paypalinc\.com
From
Contains
RegEx
.+@(intl|www[-\.])?paypal(-us)?.com|^PayPa[l1I]|paypai\.com
PayPal Phishing Scam
True
-100
#FFCC0098
White
False
False
All
Body
Contains
RegEx
^Dear\ PayPal\ (User|Member|Customer)|Your\ paypal\ access\ has\ been\ limited
Header
NotContain
PlainText
nix.paypal.com
PayPal Scam
True
-200
#FFCC0098
White
False
False
All
From
Contains
PlainText
service@paypal.com
Header
NotContain
RegEx
Received:\ from\ (mx\d\.slc\.paypal\.com|\(?\[173.0.84.\d{1,3}\]|helo=mx\d{0,3}\.slc\.paypal\.com|ccg\d\dmail\d\.ccg\d\d\.slc\.paypalinc\.com)
XLSM Attachment/Stream
False
-150
#FFFFE500
Black
False
False
All
EntireMessage
Contains
RegEx
Content-Disposition:\ attachment;\ filename=".+\.xlsm"
EntireMessage
Contains
RegEx
Content-Type:\ application/octet-stream;\ name=".+\.xlsm"
Likely Sextortion Scam
True
-100
#FFCC0098
White
False
False
All
Body
Contains
PlainText
Send
Body
Contains
PlainText
video
Body
Contains
RegEx
Bitcoin|bitcoin
Body
Contains
RegEx
address|wallet
Body
Contains
RegEx
(1|3|bc)(\d|\w){32,34}(=)?\s
Googleapis Spam
False
-150
#FFCC0098
White
False
False
All
Body
Contains
RegEx
https://storage.googleapis.com/.+
Body
Contains
RegEx
<title>\nfacebook.com\ngoogle.com\namazon.com\nebay.com\ntwitter.com\nfacebook.com\ngoogle.com\namazon.com\nebay.com\nfacebook.com\ntwitter.com\n
xn--p1ai or ru Russian Domain
False
-100
#FFCC0098
White
False
False
All
From
Contains
RegEx
@.+\.ru>
EntireMessage
Contains
PlainText
xn--p1ai
Body
Contains
PlainText
.ru?
Body
Contains
PlainText
http://rhettacarolynn
Invisible Text
False
-100
#FFCC0098
White
False
False
All
Body
Contains
RegEx
(<|<)font.+color.+#f3f3f3.+(>|>)[0-9A-Za-z]+
Body
Contains
RegEx
(<|<)span\ (=\n)?style=3D("|")\s?color:\s?(=\n)?#F.F.F.("|")(>|>)( |\s)?[A-Za-z0-9]{1,}
Body
Contains
RegEx
(<|<)span\ style=(3D=)?.*\n?"LINE-HEIGHT:\ 0px;\ DISPLAY:\ inline;.+\n?.*OVERFLOW:\ hidden.*(>|>)[a-zA-Z0-9]*
Body
Contains
RegEx
(<|<)(div|span)\ (=\n)?style=3D(=\n)?("|")\s?color:\s?(=\n)?#F.F.F.;?(\s?font-size:[0-8]p.)?("|")(>|>)( |\s)?[A-Za-z0-9]{1,}
HTML Entity in Domain Name
False
-100
#FFCC0098
White
False
False
All
Body
Contains
PlainText
。
Character Code Viagra Spam
True
-100
#FFCC0098
White
False
False
All
Body
Contains
PlainText
Ɣ
Body
Contains
PlainText
i
Body
Contains
PlainText
Ľ
Body
Contains
PlainText
Body
Contains
PlainText
<br>
Body
Contains
PlainText
&nbs=
Fake Pharmacy
False
-100
#FFCC0098
White
False
False
All
EntireMessage
Contains
PlainText
Canadian Pharmacy
Subject
Contains
RegEx
([CS]ertified|Best) Pharmacy
Canadian Pharmacy Spam 2021/22
True
-100
#FFCC0098
White
False
False
All
Body
Contains
PlainText
<td><span style=3D"color: #1E817F">CA</span>
Body
Contains
PlainText
<td><span style=3D"color: #1E817F">NA</span>
Body
Contains
PlainText
<td><span style=3D"color: #1E817F">DI</span>
Body
Contains
PlainText
<td><span style=3D"color: #1E817F">AN</span>
Webmail Verification Scam
True
-200
#FFCC0098
White
False
False
All
Subject
Is
PlainText
Verification of your email account
Body
Contains
PlainText
You have 1 technical message regarding your mail security.
Body
Contains
PlainText
has
Body
Contains
PlainText
been
Body
Contains
PlainText
BLACKLISTED
Body
Contains
PlainText
webmail network service
Body
Contains
PlainText
due to
Body
Contains
PlainText
subsequent verification
Body
Contains
PlainText
failure
Body
Contains
PlainText
your
Body
Contains
PlainText
Account.
Subscription Renewal Scam
False
-100
#FFCC0098
White
False
False
All
Body
Contains
PlainText
ORPHANS: 2; WIDOWS: 2;
Body
Contains
PlainText
+1 888 - 499 - 2280
Body
Contains
PlainText
our previous subscription plan is expired today, so we have renew
Body
Contains
PlainText
Should you have any query OR you wish to draw the charges
Body
Contains
PlainText
Please reach out to our Administration Dept. # +1 [888]-
Phishing Scam
False
-100
#FFCC0098
White
False
False
All
Subject
Contains
PlainText
EMAIL SERVER UPDATE
Body
Contains
PlainText
use the below link to update your email quota
Business4today.com spam
False
-100
#FFCC0098
White
False
False
All
EntireMessage
Contains
PlainText
Business4today.com
EntireMessage
Contains
PlainText
@business4today.com
From India
False
-100
#FFCC0098
White
False
False
All
Header
Contains
RegEx
Date:\s.+\s\+0530
From Pakistan +0500
False
-200
#FFCC0098
White
False
False
All
Header
Contains
RegEx
Date:\s.+\s\+0500
HTML Spam Template Code
False
-150
#FFCC0098
White
False
False
All
Body
Contains
PlainText
unstyle-auto-detected-links">
Ace Hardware Scam
False
-150
#FFCC0098
White
False
False
All
Subject
Contains
PlainText
Congratulations Ace Customer, You
renewal-by-andersen
False
-150
#FFCC0098
White
False
False
All
From
Contains
PlainText
renewal-by-andersen
Body
Contains
PlainText
<img alt="Renewal By Andersen Window Replacement"
Huusk Knives
False
-150
#FFCC0098
White
False
False
All
EntireMessage
Contains
PlainText
Huusk
Wallet Guru Spam
False
-200
#FFCC0098
White
True
False
False
All
Header
Contains
PlainText
wallet_guru
Header
Contains
PlainText
Wallet Guru
seniorperks
False
-200
#FFCC0098
White
False
False
All
Header
Contains
PlainText
seniorperks
Header
Contains
PlainText
SeniorPerks
Header
Contains
PlainText
senior_perks
Header
Contains
PlainText
Senior Perks
Header
Contains
PlainText
senior_savings
Header
Contains
PlainText
Senior Savings
galacticspinner
False
-200
#FFCC0098
White
False
False
All
Header
Contains
PlainText
galacticspinner
Header
Contains
PlainText
GalacticSpinner
bathroom-remodeler
False
-200
#FFCC0098
White
False
False
All
Header
Contains
PlainText
bathroom-remodeler
Header
Contains
PlainText
Bathroom Remodeler
Header
Contains
PlainText
bathroom_remodel
Header
Contains
PlainText
Bathroom Remodel
easy-canvas
False
-200
#FFCC0098
White
False
False
All
Header
Contains
PlainText
easy-canvas
Header
Contains
PlainText
Easy Canvas
Header
Contains
PlainText
canvas.prints
Header
Contains
PlainText
Canvas Prints
Header
Contains
PlainText
canvasprints
Header
Contains
PlainText
CanvasPrints
curious.finds
False
-200
#FFCC0098
White
False
False
All
Header
Contains
PlainText
curious.finds
Header
Contains
PlainText
Curious Finds
Header
Contains
PlainText
curious_finds
Known Scammer
False
-150
#FFCC0098
White
False
False
All
From
Contains
PlainText
Aaron Jimenezz
From
Contains
PlainText
G E E K S Q
Ad Restriction Scam
True
-100
#FFCC0098
White
False
False
All
From
Contains
PlainText
Meta
From
Contains
PlainText
Business
Header
Contains
PlainText
salesforce.com
Header
Contains
PlainText
X-Sender: postmaster@salesforce.com
Subject
Contains
PlainText
Your ad
Body
Contains
PlainText
Meta Team
SPF Fail
True
0
#FF434343
White
False
False
All
Header
Contains
PlainText
X-SPF-Check:
Header
Contains
PlainText
is not allowed to send mail from
Award Program Scam
False
-100
#FFCC0098
White
False
False
All
EntireMessage
Contains
PlainText
Burton Award Program
EntireMessage
Contains
PlainText
Best of Burton Award
EntireMessage
Contains
PlainText
Luci Edwards
EntireMessage
Contains
PlainText
businessawardlocal.com