| 1 |
# -*- mode: spamassassin -*-
|
| 2 |
# Spam dealing with selling stuff, stocks, etc. is matched by these
|
| 3 |
# rules
|
| 4 |
|
| 5 |
# Financial/mortage spam --pasc 04/05/12
|
| 6 |
# Added the _L set --pasc 04/05/14
|
| 7 |
body MURPHY_FINANCE1 /m.?(o|\?).?r.?t.?g.?a.?g.?e.?a.?p.?p.?l.?i.?c.?a.?t.?(i|\?).?o.?n/
|
| 8 |
score MURPHY_FINANCE1 0.1
|
| 9 |
|
| 10 |
body MURPHY_FINANCE2 /b.?a.?d.?c.?r.?(e|\?).?d.?i.?t/
|
| 11 |
score MURPHY_FINANCE2 0.1
|
| 12 |
|
| 13 |
body MURPHY_FINANCE3 /lowest fixed rate/
|
| 14 |
score MURPHY_FINANCE3 0.1
|
| 15 |
|
| 16 |
body MURPHY_FINANCE4 /application (is )?accepted/i
|
| 17 |
score MURPHY_FINANCE4 0.1
|
| 18 |
|
| 19 |
body MURPHY_FINANCE5 /loan/i
|
| 20 |
score MURPHY_FINANCE5 0.1
|
| 21 |
|
| 22 |
body MURPHY_FINANCE6 /payment/i
|
| 23 |
score MURPHY_FINANCE6 1.7
|
| 24 |
|
| 25 |
body MURPHY_FINANCE7 /re.?finance/i
|
| 26 |
score MURPHY_FINANCE7 0.1
|
| 27 |
|
| 28 |
body MURPHY_FINANCE8 /interest.?rate/i
|
| 29 |
score MURPHY_FINANCE8 0.1
|
| 30 |
# YEs I know about MURPHY_FINANCE1
|
| 31 |
body MURPHY_FINANCE9 /m.?(o|\?).?r.?t.?g.?a.?g.?e/i
|
| 32 |
score MURPHY_FINANCE9 0.1
|
| 33 |
|
| 34 |
body MURPHY_FINANCE10 /borrow/i
|
| 35 |
score MURPHY_FINANCE10 0.5
|
| 36 |
|
| 37 |
body MURPHY_FINANCE11 /pre.?approved/i
|
| 38 |
score MURPHY_FINANCE11 1.0
|
| 39 |
|
| 40 |
body MURPHY_FINANCE_L1 /app(l|1)y/i
|
| 41 |
score MURPHY_FINANCE_L1 0.0
|
| 42 |
|
| 43 |
body MURPHY_FINANCE_L2 /bil(l|1)/i
|
| 44 |
score MURPHY_FINANCE_L2 0.0
|
| 45 |
|
| 46 |
body MURPHY_FINANCE_L3 /budget/i
|
| 47 |
score MURPHY_FINANCE_L3 0.0
|
| 48 |
|
| 49 |
body MURPHY_FINANCE_L4 /home value/i
|
| 50 |
score MURPHY_FINANCE_L4 0.0
|
| 51 |
|
| 52 |
body MURPHY_FINANCE_L5 /quote/i
|
| 53 |
score MURPHY_FINANCE_L5 0.0
|
| 54 |
|
| 55 |
body MURPHY_FINANCE_L6 /income verification/i
|
| 56 |
score MURPHY_FINANCE_L6 0.0
|
| 57 |
|
| 58 |
|
| 59 |
# meta MURPHY_FINANCE_LOW (MURPHY_FINANCE_L1 + MURPHY_FINANCE_L2 + MURPHY_FINANCE_L3 + MURPHY_FINANCE_L4 + MURPHY_FINANCE_L5 + MURPHY_FINANCE_L6) > 1
|
| 60 |
# score MURPHY_FINANCE_LOW 1.0
|
| 61 |
|
| 62 |
# meta MURPHY_FINANCE_META1 (MURPHY_FINANCE_LOW + MURPHY_FINANCE1 + MURPHY_FINANCE2 + MURPHY_FINANCE3 + MURPHY_FINANCE4 + MURPHY_FINANCE5 + MURPHY_FINANCE6 + MURPHY_FINANCE7 + MURPHY_FINANCE8 + MURPHY_FINANCE9 + MURPHY_FINANCE10 + MURPHY_FINANCE11) > 1
|
| 63 |
# score MURPHY_FINANCE_META1 3.0
|
| 64 |
|
| 65 |
# Try and catch some of this new spam --pasc 06/10/12
|
| 66 |
body M_CASH1 /(prompt|instant|immediate)(aneous)? (cash|funds|capital|finances)/i
|
| 67 |
score M_CASH1 5
|
| 68 |
|
| 69 |
# Make money fast --pasc 061016
|
| 70 |
body M_CASH2 /(Learn|Find out) how to (make|generate).*k (daily|(a|per) day) from (your )?(home|house)/
|
| 71 |
score M_CASH2 5
|
| 72 |
|
| 73 |
#Stock market scam --pasc 061016
|
| 74 |
body M_CASH3 /this symbol will experience (phenomenal|fantastic|amazing) (growth|increase)/i
|
| 75 |
score M_CASH3 5
|
| 76 |
|
| 77 |
# cjwatson, 2004-01-14
|
| 78 |
header STOCK_MARKET Subject =~ /STOCK MARKET ALERT/
|
| 79 |
describe STOCK_MARKET stock market spam
|
| 80 |
score STOCK_MARKET 4
|
| 81 |
|
| 82 |
# cjwatson, 2004-02-12
|
| 83 |
body GOLDMINE /GOLD MINE SWEEPSTAKES LOTTERY/
|
| 84 |
describe GOLDMINE You have won a prize! Sure.
|
| 85 |
score GOLDMINE 3
|
| 86 |
|
| 87 |
# blarson, 2004-03-18
|
| 88 |
body CASINO /casino/i
|
| 89 |
describe CASINO Casino spam
|
| 90 |
score CASINO 2
|
| 91 |
|
| 92 |
# blarson, 2005-09-21
|
| 93 |
body MORTGAGE /m\s*[o0]\s*r\s*t?\s*g\s*a\s*g+\s*e/i
|
| 94 |
describe MORTGAGE Mortgage spam
|
| 95 |
score MORTGAGE 2
|
| 96 |
|
| 97 |
# blarson 2004-04-27
|
| 98 |
body CORELDRAW /Corel Draw (graphics suite)?11/i
|
| 99 |
describe CORELDRAW Corel sales spam
|
| 100 |
score CORELDRAW 3
|
| 101 |
|
| 102 |
# blarson 2004-04-10
|
| 103 |
body FREESHIPPING /\bf.?r.?e.?e.?\s+s.?h.?[il1].?p.?p.?[il1].?n.?g\b/i
|
| 104 |
describe FREESHIPPING free shipping
|
| 105 |
score FREESHIPPING 3
|
| 106 |
|
| 107 |
# blarson 2004-04-27
|
| 108 |
body STOK /\b(OSSI|AMTK|LETH|QIIIF)\b/
|
| 109 |
describe STOK stock spam
|
| 110 |
score STOK 3
|
| 111 |
|
| 112 |
# blarson 2004-04-18
|
| 113 |
body BANNEDCD /(banned|underground)\s*cd/i
|
| 114 |
describe BANNEDCD banned cd spam
|
| 115 |
score BANNEDCD 3
|
| 116 |
|
| 117 |
# cjwatson, 2003/10/09
|
| 118 |
body TIMESHARE /Would you like to sell or rent your Timeshare for a profit\?/
|
| 119 |
describe TIMESHARE Oddly enough, bugs don't own timeshares
|
| 120 |
score TIMESHARE 4
|
| 121 |
|
| 122 |
# blarson 2004-05-02
|
| 123 |
body AUTOWAR /\b(auto|car)\s*warr?[ae]nt(y|ee|ie)/i
|
| 124 |
describe AUTOWAR auto warrenty spam
|
| 125 |
score AUTOWAR 3
|
| 126 |
|
| 127 |
# blarson 2004-05-02
|
| 128 |
body FORONLY /for\s+only\s+\$/i
|
| 129 |
describe FORONLY sales spam
|
| 130 |
score FORONLY 2
|
| 131 |
|
| 132 |
# blarson 2005-04-15
|
| 133 |
body ROLEX /\br[o0a][l1w][l1]?[ea][xzc]/i
|
| 134 |
describe ROLEX Rolex
|
| 135 |
score ROLEX 3
|
| 136 |
|
| 137 |
# blarson 2005-04-15
|
| 138 |
header HANDCLOCK subject =~ /\bhand\s*-?clock/i
|
| 139 |
describe HANDCLOCK Hand Clock
|
| 140 |
score HANDCLOCK 3
|
| 141 |
|
| 142 |
# blarson 2004-10-29
|
| 143 |
header REPLICAWATCH subject =~ /replica\s*watch/i
|
| 144 |
describe REPLICAWATCH Replica Watch
|
| 145 |
score REPLICAWATCH 2
|
| 146 |
|
| 147 |
# blarson 2004-10-29
|
| 148 |
body HANDBAG /hand\s*-?bag/i
|
| 149 |
describe HANDBAG Handbag
|
| 150 |
score HANDBAG 2
|
| 151 |
|
| 152 |
# blarson 2004-11-11
|
| 153 |
header ECONOBETTER subject =~ /Economy is much better/i
|
| 154 |
describe ECONOBETTER Economy is much better
|
| 155 |
score ECONOBETTER 3
|
| 156 |
|
| 157 |
# blarson 2004-11-11
|
| 158 |
header MRG subject =~ /\bmrg\b/i
|
| 159 |
describe MRG mrg mortgage spammer
|
| 160 |
score MRG 2
|
| 161 |
|
| 162 |
# blarson 2004-11-08
|
| 163 |
body CITIBANK /\bciti.?bank\b/i
|
| 164 |
describe CITIBANK citibank scam
|
| 165 |
score CITIBANK 3
|
| 166 |
|
| 167 |
# blarson 2005-01-14
|
| 168 |
body HOMEOWNER /home.?owner/i
|
| 169 |
describe HOMEOWNER home owner
|
| 170 |
score HOMEOWNER 2
|
| 171 |
|
| 172 |
# blarson 2005-03-09
|
| 173 |
body THOUSANDZ /\bTHOUSANDZ\b/
|
| 174 |
describe THOUSANDZ loan spam
|
| 175 |
score THOUSANDZ 3
|
| 176 |
|
| 177 |
# blarson 2005-04-15
|
| 178 |
header EBAY subject =~ /\bebay\s+account\b/i
|
| 179 |
describe EBAY ebay account
|
| 180 |
score EBAY 3
|
| 181 |
|
| 182 |
# don 2006-10-19
|
| 183 |
body INVESTOR_ALERT /an\s*investor\s*alert/i
|
| 184 |
describe INVESTOR_ALERT stock spam
|
| 185 |
score INVESTOR_ALERT 2
|
| 186 |
|
| 187 |
# don 2006-10-19
|
| 188 |
body STOCK_ALERT /stock.+press\s*release.+stock/i
|
| 189 |
describe STOCK_ALERT stock scam
|
| 190 |
score STOCK_ALERT 2
|
| 191 |
|
| 192 |
# blarson 2006-10-25
|
| 193 |
header NEWSOFTWARE subject =~ /\bNew software uploaded by\b/i
|
| 194 |
describe NEWSOFTWARE new software spam
|
| 195 |
score NEWSOFTWARE 4
|
| 196 |
|
| 197 |
# blarson 2006-11-13
|
| 198 |
body REFI /\bhome re-fi\b/i
|
| 199 |
describe REFI mortgage spam
|
| 200 |
score REFI 3
|
| 201 |
|
| 202 |
# don 2006-11-25
|
| 203 |
full COMPANYSYMBOLPRICE /((company|symbol|price|marke?t|schlusskurs)\:.+){3,}/si
|
| 204 |
describe COMPANYSYMBOLPRICE Stock scam
|
| 205 |
score COMPANYSYMBOLPRICE 3
|
| 206 |
|
| 207 |
full COMPANYSYMBOLPRICE2 /(^(company|symb?o?l?|price|cost|marke?t)\:\s+.+\n){2,}/mi
|
| 208 |
describe COMPANYSYMBOLPRICE2 Stock scam left column 2
|
| 209 |
score COMPANYSYMBOLPRICE2 3
|
| 210 |
|
| 211 |
# blarson 2007-04-09
|
| 212 |
body PRETTYRUS /\b(pretty|cute) russian (girl|woman)\b/i
|
| 213 |
describe PRETTYRUS pretty russian spam
|
| 214 |
score PRETTYRUS 3.5
|
| 215 |
|
| 216 |
# blarson 2007-04-17
|
| 217 |
header INVESTORS subject =~ /\b(investors?|portfolio|radar)\b/i
|
| 218 |
describe INVESTORS stock spam
|
| 219 |
score INVESTORS 2
|
| 220 |
|
| 221 |
# blarson 2007-04-20
|
| 222 |
body ANALLE /\bAN ALLE FINANZINVESTOREN\b/
|
| 223 |
describe ANALLE stock spam in german
|
| 224 |
score ANALLE 3
|
| 225 |
|
| 226 |
# blarson 2007-06-17 2007-09-21 2007-10-20 2007-11-06
|
| 227 |
body REPWATCH2 /\brepl[i1]c+a\s*(?:w[a4]tch|timepiece)/i
|
| 228 |
describe REPWATCH2 still pushing fake watches
|
| 229 |
score REPWATCH2 3.5
|
| 230 |
|
| 231 |
# blarson 2007-07-19
|
| 232 |
header WEEKLYNEWS subject =~ /\bWeekly (:?Sales? )(Newsletter|Special)\b/i
|
| 233 |
describe WEEKLYNEWS weekly spam
|
| 234 |
score WEEKLYNEWS 3
|
| 235 |
|
| 236 |
# blarson 2007-07-23
|
| 237 |
body COSTWATCH /\b(dollar|costly|valuable|pricey|expensive)\s+watch\b/i
|
| 238 |
describe COSTWATCH watch spam
|
| 239 |
score COSTWATCH 4
|
| 240 |
|
| 241 |
# don 2007-07-26
|
| 242 |
body LEADINGPROVIDER /leading\s+providers?.*consult/i
|
| 243 |
describe LEADINGPROVIDER Leading provider of consulting
|
| 244 |
score LEADINGPROVIDER 2
|
| 245 |
|
| 246 |
# blarson 2007-07-31
|
| 247 |
body REFI /\bRe-Fi\b/i
|
| 248 |
describe REFI mortgage spam
|
| 249 |
score REFI 2
|
| 250 |
|
| 251 |
# don 2007-09-21
|
| 252 |
body BIGMONEY /(b|tr|m|z)[i1][l1]+[i1][0o]n\s+(d[o0][l1]+ar|yen|buck|pound|euro)/i
|
| 253 |
describe BIGMONEY Money money money money!
|
| 254 |
score BIGMONEY 1.5
|
| 255 |
|
| 256 |
# zobel 2007-09-30 (added by Cord)
|
| 257 |
body DMXC /Look at D-M-X-C!/
|
| 258 |
describe DMXC stock spam
|
| 259 |
score DMXC 4
|
| 260 |
|
| 261 |
body MONEY /((usd|yen|eur?o?|dollar|\$)\s*\d[\d\.\,]+|\d[\d\.\,]+\s*(usd|yen|eur?o?|dollar|\$))/i
|
| 262 |
describe MONEY Some amount of money in body
|
| 263 |
score MONEY 0.5
|
| 264 |
|
| 265 |
header SUBJMONEY subject =~ /((usd|yen|eur?o?|dollar|\$)\s*[\d\.\, ]+|[\d\.\, ]+\s*(usd|yen|eur?o?|dollar|\$))/i
|
| 266 |
describe SUBJMONEY Some amount of money in subject
|
| 267 |
score SUBJMONEY 3
|
| 268 |
|
| 269 |
|
| 270 |
body HIDDENCOSTS /hidden\s*(costs|fees)/i
|
| 271 |
describe HIDDENCOSTS Hidden costs or fees?
|
| 272 |
score HIDDENCOSTS 1.5
|
| 273 |
|
| 274 |
header EXCHANGEFIN subject =~ /\bE-exchange Finland\b/
|
| 275 |
describe EXCHANGEFIN EXCHANGEFIN E-money
|
| 276 |
score EXCHANGEFIN 4.0
|
| 277 |
|
| 278 |
body STOCKFRLE /\bFRLE\b/i
|
| 279 |
describe STOCKFRLE FRLE Stock Spam
|
| 280 |
score STOCKFRLE 3.4
|
| 281 |
|
| 282 |
# blarson 2007-10-16
|
| 283 |
body OPORTUNI /\bOportunidade de Emprego\b/i
|
| 284 |
describe OPORTUNI Oportunidade de Emprego
|
| 285 |
score OPORTUNI 3.5
|
| 286 |
|
| 287 |
# blarson 2007-12-10
|
| 288 |
header WATCHES subject =~ /\b(?:watches|time\s*piece|Replica|aRolex|Cartier|Omega)\b/i
|
| 289 |
describe WATCHES watches
|
| 290 |
score WATCHES 2
|
| 291 |
|
| 292 |
# blarson 2007-12-29
|
| 293 |
body COUP0N /\bCoup0n\b/i
|
| 294 |
describe COUP0N Coup0n
|
| 295 |
score COUP0N 3
|
| 296 |
|
| 297 |
header SOFTWARERETAIL subject =~ /\bretail/i
|
| 298 |
describe SOFTWARERETAIL Adobe RETAIL products
|
| 299 |
score SOFTWARERETAIL 3.2
|
| 300 |
|
| 301 |
# cord 2008-01-23
|
| 302 |
full DEPOSIT /deposit/i
|
| 303 |
describe DEPOSIT Deposit
|
| 304 |
score DEPOSIT 2
|
| 305 |
|
| 306 |
# blarson 2008-07-17
|
| 307 |
body PRINCIPALSONLY /\bPrincipals\s+Only\b/i
|
| 308 |
describe PRINCIPALSONLY Principals Only
|
| 309 |
score PRINCIPALSONLY 3
|
| 310 |
|
| 311 |
# don 2008-07-21
|
| 312 |
full AMERO /\bamero\b/i
|
| 313 |
describe AMERO Amero, whatever the hell it is, it's spam
|
| 314 |
score AMERO 3
|
| 315 |
|
| 316 |
# blarson 2008-07-27
|
| 317 |
header GAGO subject =~ /\bGA\s*G[O0]\b/
|
| 318 |
describe GAGO stock scam
|
| 319 |
score GAGO 4
|
| 320 |
|
| 321 |
# blarson 2008-07-31
|
| 322 |
body NYSE /\bNYSE\b/
|
| 323 |
describe NYSE stock scam
|
| 324 |
score NYSE 2
|
| 325 |
|
| 326 |
# cord 2008-11-30
|
| 327 |
full LOAN /\bloan\b/
|
| 328 |
describe LOAN loan spam
|
| 329 |
score LOAN 2
|
| 330 |
|
| 331 |
# cord 2008-11-30
|
| 332 |
full CREDIT /\[ck]redit\b/
|
| 333 |
describe CREDIT credit spam
|
| 334 |
score CREDIT 2
|
| 335 |
|
| 336 |
# cord 2008-12-05
|
| 337 |
full LEASING /\bleasing\b/
|
| 338 |
describe LEASING leasing spam
|
| 339 |
score LEASING 2
|
| 340 |
|
| 341 |
# formorer 2010-01-23
|
| 342 |
header LOTTERY from =~ /\blottery\b/i
|
| 343 |
describe LOTTERY lottery spam
|
| 344 |
score LOTTERY 2
|
| 345 |
|
| 346 |
|
Parent Directory
| 
Revision Log