| 1 |
don |
274 |
# -*- mode: spamassassin -*- |
| 2 |
don |
2 |
# Spam dealing with selling stuff, stocks, etc. is matched by these |
| 3 |
|
|
# rules |
| 4 |
|
|
|
| 5 |
|
|
# Financial/mortage spam --pasc 04/05/12 |
| 6 |
|
|
# Added the _L set --pasc 04/05/14 |
| 7 |
|
|
body MURPHY_FINANCE1 /m.?(o|\?).?r.?t.?g.?a.?g.?e.?a.?p.?p.?l.?i.?c.?a.?t.?(i|\?).?o.?n/ |
| 8 |
|
|
score MURPHY_FINANCE1 0.1 |
| 9 |
|
|
|
| 10 |
|
|
body MURPHY_FINANCE2 /b.?a.?d.?c.?r.?(e|\?).?d.?i.?t/ |
| 11 |
|
|
score MURPHY_FINANCE2 0.1 |
| 12 |
|
|
|
| 13 |
|
|
body MURPHY_FINANCE3 /lowest fixed rate/ |
| 14 |
|
|
score MURPHY_FINANCE3 0.1 |
| 15 |
|
|
|
| 16 |
|
|
body MURPHY_FINANCE4 /application (is )?accepted/i |
| 17 |
|
|
score MURPHY_FINANCE4 0.1 |
| 18 |
|
|
|
| 19 |
|
|
body MURPHY_FINANCE5 /loan/i |
| 20 |
|
|
score MURPHY_FINANCE5 0.1 |
| 21 |
|
|
|
| 22 |
|
|
body MURPHY_FINANCE6 /payment/i |
| 23 |
|
|
score MURPHY_FINANCE6 1.7 |
| 24 |
|
|
|
| 25 |
|
|
body MURPHY_FINANCE7 /re.?finance/i |
| 26 |
|
|
score MURPHY_FINANCE7 0.1 |
| 27 |
|
|
|
| 28 |
|
|
body MURPHY_FINANCE8 /interest.?rate/i |
| 29 |
|
|
score MURPHY_FINANCE8 0.1 |
| 30 |
|
|
# YEs I know about MURPHY_FINANCE1 |
| 31 |
|
|
body MURPHY_FINANCE9 /m.?(o|\?).?r.?t.?g.?a.?g.?e/i |
| 32 |
|
|
score MURPHY_FINANCE9 0.1 |
| 33 |
|
|
|
| 34 |
|
|
body MURPHY_FINANCE10 /borrow/i |
| 35 |
|
|
score MURPHY_FINANCE10 0.5 |
| 36 |
|
|
|
| 37 |
|
|
body MURPHY_FINANCE11 /pre.?approved/i |
| 38 |
|
|
score MURPHY_FINANCE11 1.0 |
| 39 |
|
|
|
| 40 |
|
|
body MURPHY_FINANCE_L1 /app(l|1)y/i |
| 41 |
|
|
score MURPHY_FINANCE_L1 0.0 |
| 42 |
|
|
|
| 43 |
|
|
body MURPHY_FINANCE_L2 /bil(l|1)/i |
| 44 |
|
|
score MURPHY_FINANCE_L2 0.0 |
| 45 |
|
|
|
| 46 |
|
|
body MURPHY_FINANCE_L3 /budget/i |
| 47 |
|
|
score MURPHY_FINANCE_L3 0.0 |
| 48 |
|
|
|
| 49 |
|
|
body MURPHY_FINANCE_L4 /home value/i |
| 50 |
|
|
score MURPHY_FINANCE_L4 0.0 |
| 51 |
|
|
|
| 52 |
|
|
body MURPHY_FINANCE_L5 /quote/i |
| 53 |
|
|
score MURPHY_FINANCE_L5 0.0 |
| 54 |
|
|
|
| 55 |
|
|
body MURPHY_FINANCE_L6 /income verification/i |
| 56 |
|
|
score MURPHY_FINANCE_L6 0.0 |
| 57 |
|
|
|
| 58 |
|
|
|
| 59 |
|
|
# meta MURPHY_FINANCE_LOW (MURPHY_FINANCE_L1 + MURPHY_FINANCE_L2 + MURPHY_FINANCE_L3 + MURPHY_FINANCE_L4 + MURPHY_FINANCE_L5 + MURPHY_FINANCE_L6) > 1 |
| 60 |
|
|
# score MURPHY_FINANCE_LOW 1.0 |
| 61 |
|
|
|
| 62 |
|
|
# meta MURPHY_FINANCE_META1 (MURPHY_FINANCE_LOW + MURPHY_FINANCE1 + MURPHY_FINANCE2 + MURPHY_FINANCE3 + MURPHY_FINANCE4 + MURPHY_FINANCE5 + MURPHY_FINANCE6 + MURPHY_FINANCE7 + MURPHY_FINANCE8 + MURPHY_FINANCE9 + MURPHY_FINANCE10 + MURPHY_FINANCE11) > 1 |
| 63 |
|
|
# score MURPHY_FINANCE_META1 3.0 |
| 64 |
|
|
|
| 65 |
|
|
# Try and catch some of this new spam --pasc 06/10/12 |
| 66 |
|
|
body M_CASH1 /(prompt|instant|immediate)(aneous)? (cash|funds|capital|finances)/i |
| 67 |
|
|
score M_CASH1 5 |
| 68 |
|
|
|
| 69 |
|
|
# Make money fast --pasc 061016 |
| 70 |
|
|
body M_CASH2 /(Learn|Find out) how to (make|generate).*k (daily|(a|per) day) from (your )?(home|house)/ |
| 71 |
|
|
score M_CASH2 5 |
| 72 |
|
|
|
| 73 |
|
|
#Stock market scam --pasc 061016 |
| 74 |
|
|
body M_CASH3 /this symbol will experience (phenomenal|fantastic|amazing) (growth|increase)/i |
| 75 |
|
|
score M_CASH3 5 |
| 76 |
|
|
|
| 77 |
|
|
# cjwatson, 2004-01-14 |
| 78 |
|
|
header STOCK_MARKET Subject =~ /STOCK MARKET ALERT/ |
| 79 |
|
|
describe STOCK_MARKET stock market spam |
| 80 |
|
|
score STOCK_MARKET 4 |
| 81 |
|
|
|
| 82 |
|
|
# cjwatson, 2004-02-12 |
| 83 |
|
|
body GOLDMINE /GOLD MINE SWEEPSTAKES LOTTERY/ |
| 84 |
|
|
describe GOLDMINE You have won a prize! Sure. |
| 85 |
|
|
score GOLDMINE 3 |
| 86 |
|
|
|
| 87 |
|
|
# blarson, 2004-03-18 |
| 88 |
|
|
body CASINO /casino/i |
| 89 |
|
|
describe CASINO Casino spam |
| 90 |
|
|
score CASINO 2 |
| 91 |
|
|
|
| 92 |
|
|
# blarson, 2005-09-21 |
| 93 |
|
|
body MORTGAGE /m\s*[o0]\s*r\s*t?\s*g\s*a\s*g+\s*e/i |
| 94 |
|
|
describe MORTGAGE Mortgage spam |
| 95 |
|
|
score MORTGAGE 2 |
| 96 |
|
|
|
| 97 |
|
|
# blarson 2004-04-27 |
| 98 |
|
|
body CORELDRAW /Corel Draw (graphics suite)?11/i |
| 99 |
|
|
describe CORELDRAW Corel sales spam |
| 100 |
|
|
score CORELDRAW 3 |
| 101 |
|
|
|
| 102 |
|
|
# blarson 2004-04-10 |
| 103 |
|
|
body FREESHIPPING /\bf.?r.?e.?e.?\s+s.?h.?[il1].?p.?p.?[il1].?n.?g\b/i |
| 104 |
|
|
describe FREESHIPPING free shipping |
| 105 |
|
|
score FREESHIPPING 3 |
| 106 |
|
|
|
| 107 |
|
|
# blarson 2004-04-27 |
| 108 |
|
|
body STOK /\b(OSSI|AMTK|LETH|QIIIF)\b/ |
| 109 |
|
|
describe STOK stock spam |
| 110 |
|
|
score STOK 3 |
| 111 |
|
|
|
| 112 |
|
|
# blarson 2004-04-18 |
| 113 |
|
|
body BANNEDCD /(banned|underground)\s*cd/i |
| 114 |
|
|
describe BANNEDCD banned cd spam |
| 115 |
|
|
score BANNEDCD 3 |
| 116 |
|
|
|
| 117 |
|
|
# cjwatson, 2003/10/09 |
| 118 |
|
|
body TIMESHARE /Would you like to sell or rent your Timeshare for a profit\?/ |
| 119 |
|
|
describe TIMESHARE Oddly enough, bugs don't own timeshares |
| 120 |
|
|
score TIMESHARE 4 |
| 121 |
|
|
|
| 122 |
|
|
# blarson 2004-05-02 |
| 123 |
|
|
body AUTOWAR /\b(auto|car)\s*warr?[ae]nt(y|ee|ie)/i |
| 124 |
|
|
describe AUTOWAR auto warrenty spam |
| 125 |
|
|
score AUTOWAR 3 |
| 126 |
|
|
|
| 127 |
|
|
# blarson 2004-05-02 |
| 128 |
|
|
body FORONLY /for\s+only\s+\$/i |
| 129 |
|
|
describe FORONLY sales spam |
| 130 |
|
|
score FORONLY 2 |
| 131 |
|
|
|
| 132 |
|
|
# blarson 2005-04-15 |
| 133 |
|
|
body ROLEX /\br[o0a][l1w][l1]?[ea][xzc]/i |
| 134 |
|
|
describe ROLEX Rolex |
| 135 |
|
|
score ROLEX 3 |
| 136 |
|
|
|
| 137 |
|
|
# blarson 2005-04-15 |
| 138 |
|
|
header HANDCLOCK subject =~ /\bhand\s*-?clock/i |
| 139 |
|
|
describe HANDCLOCK Hand Clock |
| 140 |
|
|
score HANDCLOCK 3 |
| 141 |
|
|
|
| 142 |
|
|
# blarson 2004-10-29 |
| 143 |
|
|
header REPLICAWATCH subject =~ /replica\s*watch/i |
| 144 |
|
|
describe REPLICAWATCH Replica Watch |
| 145 |
|
|
score REPLICAWATCH 2 |
| 146 |
|
|
|
| 147 |
|
|
# blarson 2004-10-29 |
| 148 |
|
|
body HANDBAG /hand\s*-?bag/i |
| 149 |
|
|
describe HANDBAG Handbag |
| 150 |
|
|
score HANDBAG 2 |
| 151 |
|
|
|
| 152 |
|
|
# blarson 2004-11-11 |
| 153 |
|
|
header ECONOBETTER subject =~ /Economy is much better/i |
| 154 |
|
|
describe ECONOBETTER Economy is much better |
| 155 |
|
|
score ECONOBETTER 3 |
| 156 |
|
|
|
| 157 |
|
|
# blarson 2004-11-11 |
| 158 |
|
|
header MRG subject =~ /\bmrg\b/i |
| 159 |
|
|
describe MRG mrg mortgage spammer |
| 160 |
|
|
score MRG 2 |
| 161 |
|
|
|
| 162 |
|
|
# blarson 2004-11-08 |
| 163 |
|
|
body CITIBANK /\bciti.?bank\b/i |
| 164 |
|
|
describe CITIBANK citibank scam |
| 165 |
cord |
250 |
score CITIBANK 3 |
| 166 |
don |
2 |
|
| 167 |
|
|
# blarson 2005-01-14 |
| 168 |
|
|
body HOMEOWNER /home.?owner/i |
| 169 |
|
|
describe HOMEOWNER home owner |
| 170 |
|
|
score HOMEOWNER 2 |
| 171 |
|
|
|
| 172 |
|
|
# blarson 2005-03-09 |
| 173 |
|
|
body THOUSANDZ /\bTHOUSANDZ\b/ |
| 174 |
|
|
describe THOUSANDZ loan spam |
| 175 |
|
|
score THOUSANDZ 3 |
| 176 |
|
|
|
| 177 |
|
|
# blarson 2005-04-15 |
| 178 |
|
|
header EBAY subject =~ /\bebay\s+account\b/i |
| 179 |
|
|
describe EBAY ebay account |
| 180 |
|
|
score EBAY 3 |
| 181 |
|
|
|
| 182 |
|
|
# don 2006-10-19 |
| 183 |
|
|
body INVESTOR_ALERT /an\s*investor\s*alert/i |
| 184 |
|
|
describe INVESTOR_ALERT stock spam |
| 185 |
|
|
score INVESTOR_ALERT 2 |
| 186 |
|
|
|
| 187 |
|
|
# don 2006-10-19 |
| 188 |
|
|
body STOCK_ALERT /stock.+press\s*release.+stock/i |
| 189 |
|
|
describe STOCK_ALERT stock scam |
| 190 |
|
|
score STOCK_ALERT 2 |
| 191 |
|
|
|
| 192 |
|
|
# blarson 2006-10-25 |
| 193 |
|
|
header NEWSOFTWARE subject =~ /\bNew software uploaded by\b/i |
| 194 |
|
|
describe NEWSOFTWARE new software spam |
| 195 |
|
|
score NEWSOFTWARE 4 |
| 196 |
|
|
|
| 197 |
|
|
# blarson 2006-11-13 |
| 198 |
|
|
body REFI /\bhome re-fi\b/i |
| 199 |
|
|
describe REFI mortgage spam |
| 200 |
|
|
score REFI 3 |
| 201 |
|
|
|
| 202 |
|
|
# don 2006-11-25 |
| 203 |
|
|
full COMPANYSYMBOLPRICE /((company|symbol|price|marke?t|schlusskurs)\:.+){3,}/si |
| 204 |
|
|
describe COMPANYSYMBOLPRICE Stock scam |
| 205 |
|
|
score COMPANYSYMBOLPRICE 3 |
| 206 |
|
|
|
| 207 |
don |
16 |
full COMPANYSYMBOLPRICE2 /(^(company|symb?o?l?|price|cost|marke?t)\:\s+.+\n){2,}/mi |
| 208 |
|
|
describe COMPANYSYMBOLPRICE2 Stock scam left column 2 |
| 209 |
|
|
score COMPANYSYMBOLPRICE2 3 |
| 210 |
|
|
|
| 211 |
don |
2 |
# blarson 2007-04-09 |
| 212 |
|
|
body PRETTYRUS /\b(pretty|cute) russian (girl|woman)\b/i |
| 213 |
|
|
describe PRETTYRUS pretty russian spam |
| 214 |
|
|
score PRETTYRUS 3.5 |
| 215 |
|
|
|
| 216 |
|
|
# blarson 2007-04-17 |
| 217 |
|
|
header INVESTORS subject =~ /\b(investors?|portfolio|radar)\b/i |
| 218 |
|
|
describe INVESTORS stock spam |
| 219 |
|
|
score INVESTORS 2 |
| 220 |
|
|
|
| 221 |
|
|
# blarson 2007-04-20 |
| 222 |
|
|
body ANALLE /\bAN ALLE FINANZINVESTOREN\b/ |
| 223 |
|
|
describe ANALLE stock spam in german |
| 224 |
|
|
score ANALLE 3 |
| 225 |
|
|
|
| 226 |
don |
91 |
# blarson 2007-06-17 2007-09-21 2007-10-20 2007-11-06 |
| 227 |
|
|
body REPWATCH2 /\brepl[i1]c+a\s*(?:w[a4]tch|timepiece)/i |
| 228 |
don |
8 |
describe REPWATCH2 still pushing fake watches |
| 229 |
don |
13 |
score REPWATCH2 3.5 |
| 230 |
don |
2 |
|
| 231 |
|
|
# blarson 2007-07-19 |
| 232 |
|
|
header WEEKLYNEWS subject =~ /\bWeekly (:?Sales? )(Newsletter|Special)\b/i |
| 233 |
|
|
describe WEEKLYNEWS weekly spam |
| 234 |
|
|
score WEEKLYNEWS 3 |
| 235 |
|
|
|
| 236 |
|
|
# blarson 2007-07-23 |
| 237 |
|
|
body COSTWATCH /\b(dollar|costly|valuable|pricey|expensive)\s+watch\b/i |
| 238 |
|
|
describe COSTWATCH watch spam |
| 239 |
|
|
score COSTWATCH 4 |
| 240 |
|
|
|
| 241 |
|
|
# don 2007-07-26 |
| 242 |
|
|
body LEADINGPROVIDER /leading\s+providers?.*consult/i |
| 243 |
|
|
describe LEADINGPROVIDER Leading provider of consulting |
| 244 |
|
|
score LEADINGPROVIDER 2 |
| 245 |
|
|
|
| 246 |
|
|
# blarson 2007-07-31 |
| 247 |
|
|
body REFI /\bRe-Fi\b/i |
| 248 |
|
|
describe REFI mortgage spam |
| 249 |
|
|
score REFI 2 |
| 250 |
|
|
|
| 251 |
don |
16 |
# don 2007-09-21 |
| 252 |
|
|
body BIGMONEY /(b|tr|m|z)[i1][l1]+[i1][0o]n\s+(d[o0][l1]+ar|yen|buck|pound|euro)/i |
| 253 |
|
|
describe BIGMONEY Money money money money! |
| 254 |
|
|
score BIGMONEY 1.5 |
| 255 |
|
|
|
| 256 |
cord |
28 |
# zobel 2007-09-30 (added by Cord) |
| 257 |
|
|
body DMXC /Look at D-M-X-C!/ |
| 258 |
|
|
describe DMXC stock spam |
| 259 |
|
|
score DMXC 4 |
| 260 |
don |
34 |
|
| 261 |
don |
129 |
body MONEY /((usd|yen|eur?o?|dollar|\$)\s*\d[\d\.\,]+|\d[\d\.\,]+\s*(usd|yen|eur?o?|dollar|\$))/i |
| 262 |
don |
88 |
describe MONEY Some amount of money in body |
| 263 |
don |
129 |
score MONEY 0.5 |
| 264 |
don |
34 |
|
| 265 |
don |
88 |
header SUBJMONEY subject =~ /((usd|yen|eur?o?|dollar|\$)\s*[\d\.\, ]+|[\d\.\, ]+\s*(usd|yen|eur?o?|dollar|\$))/i |
| 266 |
don |
66 |
describe SUBJMONEY Some amount of money in subject |
| 267 |
|
|
score SUBJMONEY 3 |
| 268 |
|
|
|
| 269 |
|
|
|
| 270 |
don |
34 |
body HIDDENCOSTS /hidden\s*(costs|fees)/i |
| 271 |
|
|
describe HIDDENCOSTS Hidden costs or fees? |
| 272 |
|
|
score HIDDENCOSTS 1.5 |
| 273 |
zobel |
51 |
|
| 274 |
|
|
header EXCHANGEFIN subject =~ /\bE-exchange Finland\b/ |
| 275 |
|
|
describe EXCHANGEFIN EXCHANGEFIN E-money |
| 276 |
|
|
score EXCHANGEFIN 4.0 |
| 277 |
zobel |
52 |
|
| 278 |
|
|
body STOCKFRLE /\bFRLE\b/i |
| 279 |
|
|
describe STOCKFRLE FRLE Stock Spam |
| 280 |
|
|
score STOCKFRLE 3.4 |
| 281 |
don |
74 |
|
| 282 |
|
|
# blarson 2007-10-16 |
| 283 |
|
|
body OPORTUNI /\bOportunidade de Emprego\b/i |
| 284 |
|
|
describe OPORTUNI Oportunidade de Emprego |
| 285 |
|
|
score OPORTUNI 3.5 |
| 286 |
don |
125 |
|
| 287 |
|
|
# blarson 2007-12-10 |
| 288 |
don |
155 |
header WATCHES subject =~ /\b(?:watches|time\s*piece|Replica|aRolex|Cartier|Omega)\b/i |
| 289 |
don |
125 |
describe WATCHES watches |
| 290 |
|
|
score WATCHES 2 |
| 291 |
|
|
|
| 292 |
|
|
# blarson 2007-12-29 |
| 293 |
|
|
body COUP0N /\bCoup0n\b/i |
| 294 |
|
|
describe COUP0N Coup0n |
| 295 |
|
|
score COUP0N 3 |
| 296 |
zobel |
130 |
|
| 297 |
|
|
header SOFTWARERETAIL subject =~ /\bretail/i |
| 298 |
|
|
describe SOFTWARERETAIL Adobe RETAIL products |
| 299 |
|
|
score SOFTWARERETAIL 3.2 |
| 300 |
cord |
132 |
|
| 301 |
|
|
# cord 2008-01-23 |
| 302 |
|
|
full DEPOSIT /deposit/i |
| 303 |
|
|
describe DEPOSIT Deposit |
| 304 |
don |
230 |
score DEPOSIT 2 |
| 305 |
|
|
|
| 306 |
don |
231 |
# blarson 2008-07-17 |
| 307 |
|
|
body PRINCIPALSONLY /\bPrincipals\s+Only\b/i |
| 308 |
|
|
describe PRINCIPALSONLY Principals Only |
| 309 |
|
|
score PRINCIPALSONLY 3 |
| 310 |
|
|
|
| 311 |
don |
230 |
# don 2008-07-21 |
| 312 |
|
|
full AMERO /\bamero\b/i |
| 313 |
|
|
describe AMERO Amero, whatever the hell it is, it's spam |
| 314 |
|
|
score AMERO 3 |
| 315 |
|
|
|
| 316 |
don |
232 |
# blarson 2008-07-27 |
| 317 |
|
|
header GAGO subject =~ /\bGA\s*G[O0]\b/ |
| 318 |
|
|
describe GAGO stock scam |
| 319 |
|
|
score GAGO 4 |
| 320 |
don |
236 |
|
| 321 |
|
|
# blarson 2008-07-31 |
| 322 |
|
|
body NYSE /\bNYSE\b/ |
| 323 |
|
|
describe NYSE stock scam |
| 324 |
cord |
250 |
score NYSE 2 |
| 325 |
|
|
|
| 326 |
|
|
# cord 2008-11-30 |
| 327 |
|
|
full LOAN /\bloan\b/ |
| 328 |
|
|
describe LOAN loan spam |
| 329 |
|
|
score LOAN 2 |
| 330 |
|
|
|
| 331 |
|
|
# cord 2008-11-30 |
| 332 |
|
|
full CREDIT /\[ck]redit\b/ |
| 333 |
|
|
describe CREDIT credit spam |
| 334 |
|
|
score CREDIT 2 |
| 335 |
|
|
|
| 336 |
cord |
253 |
# cord 2008-12-05 |
| 337 |
|
|
full LEASING /\bleasing\b/ |
| 338 |
don |
264 |
describe LEASING leasing spam |
| 339 |
cord |
253 |
score LEASING 2 |
| 340 |
formorer |
330 |
|
| 341 |
|
|
# formorer 2010-01-23 |
| 342 |
|
|
header LOTTERY from =~ /\blottery\b/i |
| 343 |
|
|
describe LOTTERY lottery spam |
| 344 |
|
|
score LOTTERY 2 |
| 345 |
|
|
|
| 346 |
|
|
|
Parent Directory
| 
Revision Log