| 1 |
# Spam dealing with selling stuff, stocks, etc. is matched by these
|
| 2 |
# rules
|
| 3 |
|
| 4 |
# Financial/mortage spam --pasc 04/05/12
|
| 5 |
# Added the _L set --pasc 04/05/14
|
| 6 |
body MURPHY_FINANCE1 /m.?(o|\?).?r.?t.?g.?a.?g.?e.?a.?p.?p.?l.?i.?c.?a.?t.?(i|\?).?o.?n/
|
| 7 |
score MURPHY_FINANCE1 0.1
|
| 8 |
|
| 9 |
body MURPHY_FINANCE2 /b.?a.?d.?c.?r.?(e|\?).?d.?i.?t/
|
| 10 |
score MURPHY_FINANCE2 0.1
|
| 11 |
|
| 12 |
body MURPHY_FINANCE3 /lowest fixed rate/
|
| 13 |
score MURPHY_FINANCE3 0.1
|
| 14 |
|
| 15 |
body MURPHY_FINANCE4 /application (is )?accepted/i
|
| 16 |
score MURPHY_FINANCE4 0.1
|
| 17 |
|
| 18 |
body MURPHY_FINANCE5 /loan/i
|
| 19 |
score MURPHY_FINANCE5 0.1
|
| 20 |
|
| 21 |
body MURPHY_FINANCE6 /payment/i
|
| 22 |
score MURPHY_FINANCE6 1.7
|
| 23 |
|
| 24 |
body MURPHY_FINANCE7 /re.?finance/i
|
| 25 |
score MURPHY_FINANCE7 0.1
|
| 26 |
|
| 27 |
body MURPHY_FINANCE8 /interest.?rate/i
|
| 28 |
score MURPHY_FINANCE8 0.1
|
| 29 |
# YEs I know about MURPHY_FINANCE1
|
| 30 |
body MURPHY_FINANCE9 /m.?(o|\?).?r.?t.?g.?a.?g.?e/i
|
| 31 |
score MURPHY_FINANCE9 0.1
|
| 32 |
|
| 33 |
body MURPHY_FINANCE10 /borrow/i
|
| 34 |
score MURPHY_FINANCE10 0.5
|
| 35 |
|
| 36 |
body MURPHY_FINANCE11 /pre.?approved/i
|
| 37 |
score MURPHY_FINANCE11 1.0
|
| 38 |
|
| 39 |
body MURPHY_FINANCE_L1 /app(l|1)y/i
|
| 40 |
score MURPHY_FINANCE_L1 0.0
|
| 41 |
|
| 42 |
body MURPHY_FINANCE_L2 /bil(l|1)/i
|
| 43 |
score MURPHY_FINANCE_L2 0.0
|
| 44 |
|
| 45 |
body MURPHY_FINANCE_L3 /budget/i
|
| 46 |
score MURPHY_FINANCE_L3 0.0
|
| 47 |
|
| 48 |
body MURPHY_FINANCE_L4 /home value/i
|
| 49 |
score MURPHY_FINANCE_L4 0.0
|
| 50 |
|
| 51 |
body MURPHY_FINANCE_L5 /quote/i
|
| 52 |
score MURPHY_FINANCE_L5 0.0
|
| 53 |
|
| 54 |
body MURPHY_FINANCE_L6 /income verification/i
|
| 55 |
score MURPHY_FINANCE_L6 0.0
|
| 56 |
|
| 57 |
|
| 58 |
# meta MURPHY_FINANCE_LOW (MURPHY_FINANCE_L1 + MURPHY_FINANCE_L2 + MURPHY_FINANCE_L3 + MURPHY_FINANCE_L4 + MURPHY_FINANCE_L5 + MURPHY_FINANCE_L6) > 1
|
| 59 |
# score MURPHY_FINANCE_LOW 1.0
|
| 60 |
|
| 61 |
# meta MURPHY_FINANCE_META1 (MURPHY_FINANCE_LOW + MURPHY_FINANCE1 + MURPHY_FINANCE2 + MURPHY_FINANCE3 + MURPHY_FINANCE4 + MURPHY_FINANCE5 + MURPHY_FINANCE6 + MURPHY_FINANCE7 + MURPHY_FINANCE8 + MURPHY_FINANCE9 + MURPHY_FINANCE10 + MURPHY_FINANCE11) > 1
|
| 62 |
# score MURPHY_FINANCE_META1 3.0
|
| 63 |
|
| 64 |
# Try and catch some of this new spam --pasc 06/10/12
|
| 65 |
body M_CASH1 /(prompt|instant|immediate)(aneous)? (cash|funds|capital|finances)/i
|
| 66 |
score M_CASH1 5
|
| 67 |
|
| 68 |
# Make money fast --pasc 061016
|
| 69 |
body M_CASH2 /(Learn|Find out) how to (make|generate).*k (daily|(a|per) day) from (your )?(home|house)/
|
| 70 |
score M_CASH2 5
|
| 71 |
|
| 72 |
#Stock market scam --pasc 061016
|
| 73 |
body M_CASH3 /this symbol will experience (phenomenal|fantastic|amazing) (growth|increase)/i
|
| 74 |
score M_CASH3 5
|
| 75 |
|
| 76 |
# cjwatson, 2004-01-14
|
| 77 |
header STOCK_MARKET Subject =~ /STOCK MARKET ALERT/
|
| 78 |
describe STOCK_MARKET stock market spam
|
| 79 |
score STOCK_MARKET 4
|
| 80 |
|
| 81 |
# cjwatson, 2004-02-12
|
| 82 |
body GOLDMINE /GOLD MINE SWEEPSTAKES LOTTERY/
|
| 83 |
describe GOLDMINE You have won a prize! Sure.
|
| 84 |
score GOLDMINE 3
|
| 85 |
|
| 86 |
# blarson, 2004-03-18
|
| 87 |
body CASINO /casino/i
|
| 88 |
describe CASINO Casino spam
|
| 89 |
score CASINO 2
|
| 90 |
|
| 91 |
# blarson, 2005-09-21
|
| 92 |
body MORTGAGE /m\s*[o0]\s*r\s*t?\s*g\s*a\s*g+\s*e/i
|
| 93 |
describe MORTGAGE Mortgage spam
|
| 94 |
score MORTGAGE 2
|
| 95 |
|
| 96 |
# blarson 2004-04-27
|
| 97 |
body CORELDRAW /Corel Draw (graphics suite)?11/i
|
| 98 |
describe CORELDRAW Corel sales spam
|
| 99 |
score CORELDRAW 3
|
| 100 |
|
| 101 |
# blarson 2004-04-10
|
| 102 |
body FREESHIPPING /\bf.?r.?e.?e.?\s+s.?h.?[il1].?p.?p.?[il1].?n.?g\b/i
|
| 103 |
describe FREESHIPPING free shipping
|
| 104 |
score FREESHIPPING 3
|
| 105 |
|
| 106 |
# blarson 2004-04-27
|
| 107 |
body STOK /\b(OSSI|AMTK|LETH|QIIIF)\b/
|
| 108 |
describe STOK stock spam
|
| 109 |
score STOK 3
|
| 110 |
|
| 111 |
# blarson 2004-04-18
|
| 112 |
body BANNEDCD /(banned|underground)\s*cd/i
|
| 113 |
describe BANNEDCD banned cd spam
|
| 114 |
score BANNEDCD 3
|
| 115 |
|
| 116 |
# cjwatson, 2003/10/09
|
| 117 |
body TIMESHARE /Would you like to sell or rent your Timeshare for a profit\?/
|
| 118 |
describe TIMESHARE Oddly enough, bugs don't own timeshares
|
| 119 |
score TIMESHARE 4
|
| 120 |
|
| 121 |
# blarson 2004-05-02
|
| 122 |
body AUTOWAR /\b(auto|car)\s*warr?[ae]nt(y|ee|ie)/i
|
| 123 |
describe AUTOWAR auto warrenty spam
|
| 124 |
score AUTOWAR 3
|
| 125 |
|
| 126 |
# blarson 2004-05-02
|
| 127 |
body FORONLY /for\s+only\s+\$/i
|
| 128 |
describe FORONLY sales spam
|
| 129 |
score FORONLY 2
|
| 130 |
|
| 131 |
# blarson 2005-04-15
|
| 132 |
body ROLEX /\br[o0a][l1w][l1]?[ea][xzc]/i
|
| 133 |
describe ROLEX Rolex
|
| 134 |
score ROLEX 3
|
| 135 |
|
| 136 |
# blarson 2005-04-15
|
| 137 |
header HANDCLOCK subject =~ /\bhand\s*-?clock/i
|
| 138 |
describe HANDCLOCK Hand Clock
|
| 139 |
score HANDCLOCK 3
|
| 140 |
|
| 141 |
# blarson 2004-10-29
|
| 142 |
header REPLICAWATCH subject =~ /replica\s*watch/i
|
| 143 |
describe REPLICAWATCH Replica Watch
|
| 144 |
score REPLICAWATCH 2
|
| 145 |
|
| 146 |
# blarson 2004-10-29
|
| 147 |
body HANDBAG /hand\s*-?bag/i
|
| 148 |
describe HANDBAG Handbag
|
| 149 |
score HANDBAG 2
|
| 150 |
|
| 151 |
# blarson 2004-11-11
|
| 152 |
header ECONOBETTER subject =~ /Economy is much better/i
|
| 153 |
describe ECONOBETTER Economy is much better
|
| 154 |
score ECONOBETTER 3
|
| 155 |
|
| 156 |
# blarson 2004-11-11
|
| 157 |
header MRG subject =~ /\bmrg\b/i
|
| 158 |
describe MRG mrg mortgage spammer
|
| 159 |
score MRG 2
|
| 160 |
|
| 161 |
# blarson 2004-11-08
|
| 162 |
body CITIBANK /\bciti.?bank\b/i
|
| 163 |
describe CITIBANK citibank scam
|
| 164 |
score CITIBANK 2
|
| 165 |
|
| 166 |
# blarson 2005-01-14
|
| 167 |
body HOMEOWNER /home.?owner/i
|
| 168 |
describe HOMEOWNER home owner
|
| 169 |
score HOMEOWNER 2
|
| 170 |
|
| 171 |
# blarson 2005-03-09
|
| 172 |
body THOUSANDZ /\bTHOUSANDZ\b/
|
| 173 |
describe THOUSANDZ loan spam
|
| 174 |
score THOUSANDZ 3
|
| 175 |
|
| 176 |
# blarson 2005-04-15
|
| 177 |
header EBAY subject =~ /\bebay\s+account\b/i
|
| 178 |
describe EBAY ebay account
|
| 179 |
score EBAY 3
|
| 180 |
|
| 181 |
# don 2006-10-19
|
| 182 |
body INVESTOR_ALERT /an\s*investor\s*alert/i
|
| 183 |
describe INVESTOR_ALERT stock spam
|
| 184 |
score INVESTOR_ALERT 2
|
| 185 |
|
| 186 |
# don 2006-10-19
|
| 187 |
body STOCK_ALERT /stock.+press\s*release.+stock/i
|
| 188 |
describe STOCK_ALERT stock scam
|
| 189 |
score STOCK_ALERT 2
|
| 190 |
|
| 191 |
# blarson 2006-10-25
|
| 192 |
header NEWSOFTWARE subject =~ /\bNew software uploaded by\b/i
|
| 193 |
describe NEWSOFTWARE new software spam
|
| 194 |
score NEWSOFTWARE 4
|
| 195 |
|
| 196 |
# blarson 2006-11-13
|
| 197 |
body REFI /\bhome re-fi\b/i
|
| 198 |
describe REFI mortgage spam
|
| 199 |
score REFI 3
|
| 200 |
|
| 201 |
# don 2006-11-25
|
| 202 |
full COMPANYSYMBOLPRICE /((company|symbol|price|marke?t|schlusskurs)\:.+){3,}/si
|
| 203 |
describe COMPANYSYMBOLPRICE Stock scam
|
| 204 |
score COMPANYSYMBOLPRICE 3
|
| 205 |
|
| 206 |
full COMPANYSYMBOLPRICE2 /(^(company|symb?o?l?|price|cost|marke?t)\:\s+.+\n){2,}/mi
|
| 207 |
describe COMPANYSYMBOLPRICE2 Stock scam left column 2
|
| 208 |
score COMPANYSYMBOLPRICE2 3
|
| 209 |
|
| 210 |
# blarson 2007-04-09
|
| 211 |
body PRETTYRUS /\b(pretty|cute) russian (girl|woman)\b/i
|
| 212 |
describe PRETTYRUS pretty russian spam
|
| 213 |
score PRETTYRUS 3.5
|
| 214 |
|
| 215 |
# blarson 2007-04-17
|
| 216 |
header INVESTORS subject =~ /\b(investors?|portfolio|radar)\b/i
|
| 217 |
describe INVESTORS stock spam
|
| 218 |
score INVESTORS 2
|
| 219 |
|
| 220 |
# blarson 2007-04-20
|
| 221 |
body ANALLE /\bAN ALLE FINANZINVESTOREN\b/
|
| 222 |
describe ANALLE stock spam in german
|
| 223 |
score ANALLE 3
|
| 224 |
|
| 225 |
# blarson 2007-06-17 2007-09-21
|
| 226 |
body REPWATCH2 /\breplica (?:watch|timepiece)/i
|
| 227 |
describe REPWATCH2 still pushing fake watches
|
| 228 |
score REPWATCH2 3.5
|
| 229 |
|
| 230 |
# blarson 2007-07-19
|
| 231 |
header WEEKLYNEWS subject =~ /\bWeekly (:?Sales? )(Newsletter|Special)\b/i
|
| 232 |
describe WEEKLYNEWS weekly spam
|
| 233 |
score WEEKLYNEWS 3
|
| 234 |
|
| 235 |
# blarson 2007-07-23
|
| 236 |
body COSTWATCH /\b(dollar|costly|valuable|pricey|expensive)\s+watch\b/i
|
| 237 |
describe COSTWATCH watch spam
|
| 238 |
score COSTWATCH 4
|
| 239 |
|
| 240 |
# don 2007-07-26
|
| 241 |
body LEADINGPROVIDER /leading\s+providers?.*consult/i
|
| 242 |
describe LEADINGPROVIDER Leading provider of consulting
|
| 243 |
score LEADINGPROVIDER 2
|
| 244 |
|
| 245 |
# blarson 2007-07-31
|
| 246 |
body REFI /\bRe-Fi\b/i
|
| 247 |
describe REFI mortgage spam
|
| 248 |
score REFI 2
|
| 249 |
|
| 250 |
# don 2007-09-21
|
| 251 |
body BIGMONEY /(b|tr|m|z)[i1][l1]+[i1][0o]n\s+(d[o0][l1]+ar|yen|buck|pound|euro)/i
|
| 252 |
describe BIGMONEY Money money money money!
|
| 253 |
score BIGMONEY 1.5
|
| 254 |
|
| 255 |
# zobel 2007-09-30 (added by Cord)
|
| 256 |
body DMXC /Look at D-M-X-C!/
|
| 257 |
describe DMXC stock spam
|
| 258 |
score DMXC 4
|
| 259 |
|
| 260 |
body MONEY /(\$\s*[\d\.]+|[\d\.]+\s*(usd|yen|euro|dollar))/
|
| 261 |
describe MONEY Some amount of money
|
| 262 |
score MONEY 1.5
|
| 263 |
|
| 264 |
body HIDDENCOSTS /hidden\s*(costs|fees)/i
|
| 265 |
describe HIDDENCOSTS Hidden costs or fees?
|
| 266 |
score HIDDENCOSTS 1.5
|
| 267 |
|
| 268 |
header EXCHANGEFIN subject =~ /\bE-exchange Finland\b/
|
| 269 |
describe EXCHANGEFIN EXCHANGEFIN E-money
|
| 270 |
score EXCHANGEFIN 4.0
|
| 271 |
|
| 272 |
body STOCKFRLE /\bFRLE\b/i
|
| 273 |
describe STOCKFRLE FRLE Stock Spam
|
| 274 |
score STOCKFRLE 3.4
|
Parent Directory
| 
Revision Log