| 1 |
don |
2 |
# Nigerian-type spam |
| 2 |
|
|
|
| 3 |
|
|
body MURPHY_SCAM1 /I am.*(son|daughter|wife)/i |
| 4 |
|
|
describe MURPHY_SCAM1 Family relation |
| 5 |
|
|
score MURPHY_SCAM1 0.1 |
| 6 |
|
|
|
| 7 |
|
|
body MURPHY_SCAM2 /confidential transaction/i |
| 8 |
|
|
score MURPHY_SCAM2 0.1 |
| 9 |
|
|
|
| 10 |
|
|
body MURPHY_SCAM3 /may be surprise/i |
| 11 |
|
|
score MURPHY_SCAM3 0.1 |
| 12 |
|
|
|
| 13 |
|
|
body MURPHY_SCAM4 /(Robert Mugabe|Richard Taylor)/i |
| 14 |
|
|
score MURPHY_SCAM4 0.1 |
| 15 |
|
|
|
| 16 |
|
|
body MURPHY_SCAM5 /(zimbabwe|nigeria)/i |
| 17 |
|
|
score MURPHY_SCAM5 0.1 |
| 18 |
|
|
|
| 19 |
|
|
meta MURPHY_SCAM_META1 (MURPHY_SCAM1 + MURPHY_SCAM2 + MURPHY_SCAM3 + MURPHY_SCAM4 + MURPHY_SCAM5) > 1 |
| 20 |
|
|
score MURPHY_SCAM_META1 3.0 |
| 21 |
|
|
|
| 22 |
|
|
header RESPOND Subject =~ /^Respond/ |
| 23 |
|
|
describe RESPOND respond 419 scam spam |
| 24 |
|
|
score REPSOND 2 |
| 25 |
|
|
|
| 26 |
|
|
# cjwatson, 2003/10/18 |
| 27 |
|
|
header NIGERIAN_XIAN Subject =~ /^DONATION FOR THE LORD/ |
| 28 |
|
|
describe NIGERIAN_XIAN The 419 scam with a Christian twist |
| 29 |
|
|
score NIGERIAN_XIAN 4 |
| 30 |
|
|
|
| 31 |
|
|
# cjwatson, 2004-02-10 |
| 32 |
|
|
header BIZ_PROP Subject =~ /Business Proposition:Respond ASAP/i |
| 33 |
|
|
describe BIZ_PROP 419 variant |
| 34 |
|
|
score BIZ_PROP 4 |
| 35 |
|
|
|
| 36 |
|
|
# cjwatson, 2004-03-05 |
| 37 |
|
|
header NEW_PUB_COMP Subject =~ /NEW PUBLIC COMPNAY ALERT/ |
| 38 |
|
|
describe NEW_PUB_COMP Filesharing spam |
| 39 |
|
|
score NEW_PUB_COMP 3 |
| 40 |
|
|
|
| 41 |
don |
222 |
# don 2008-06-13 |
| 42 |
|
|
header ACCOUNTUPDATE subject =~ /^\s*Account\s+Update\s*$/i; |
| 43 |
|
|
describe ACCOUNTUPDATE Yeah, we don't send account updates |
| 44 |
|
|
score ACCOUNTUPDATE 4 |
| 45 |
|
|
|
| 46 |
|
|
|