| 1 |
# Nigerian-type spam
|
| 2 |
|
| 3 |
body MURPHY_SCAM1 /I am.*(son|daughter|wife)/i
|
| 4 |
describe MURPHY_SCAM1 Family relation
|
| 5 |
score MURPHY_SCAM1 0.1
|
| 6 |
|
| 7 |
body MURPHY_SCAM2 /confidential transaction/i
|
| 8 |
score MURPHY_SCAM2 0.1
|
| 9 |
|
| 10 |
body MURPHY_SCAM3 /may be surprise/i
|
| 11 |
score MURPHY_SCAM3 0.1
|
| 12 |
|
| 13 |
body MURPHY_SCAM4 /(Robert Mugabe|Richard Taylor)/i
|
| 14 |
score MURPHY_SCAM4 0.1
|
| 15 |
|
| 16 |
body MURPHY_SCAM5 /(zimbabwe|nigeria)/i
|
| 17 |
score MURPHY_SCAM5 0.1
|
| 18 |
|
| 19 |
meta MURPHY_SCAM_META1 (MURPHY_SCAM1 + MURPHY_SCAM2 + MURPHY_SCAM3 + MURPHY_SCAM4 + MURPHY_SCAM5) > 1
|
| 20 |
score MURPHY_SCAM_META1 3.0
|
| 21 |
|
| 22 |
header RESPOND Subject =~ /^Respond/
|
| 23 |
describe RESPOND respond 419 scam spam
|
| 24 |
score REPSOND 2
|
| 25 |
|
| 26 |
# cjwatson, 2003/10/18
|
| 27 |
header NIGERIAN_XIAN Subject =~ /^DONATION FOR THE LORD/
|
| 28 |
describe NIGERIAN_XIAN The 419 scam with a Christian twist
|
| 29 |
score NIGERIAN_XIAN 4
|
| 30 |
|
| 31 |
# cjwatson, 2004-02-10
|
| 32 |
header BIZ_PROP Subject =~ /Business Proposition:Respond ASAP/i
|
| 33 |
describe BIZ_PROP 419 variant
|
| 34 |
score BIZ_PROP 4
|
| 35 |
|
| 36 |
# cjwatson, 2004-03-05
|
| 37 |
header NEW_PUB_COMP Subject =~ /NEW PUBLIC COMPNAY ALERT/
|
| 38 |
describe NEW_PUB_COMP Filesharing spam
|
| 39 |
score NEW_PUB_COMP 3
|
| 40 |
|
| 41 |
# don 2008-06-13
|
| 42 |
header ACCOUNTUPDATE subject =~ /^\s*Account\s+Update\s*$/i;
|
| 43 |
describe ACCOUNTUPDATE Yeah, we don't send account updates
|
| 44 |
score ACCOUNTUPDATE 4
|
| 45 |
|
| 46 |
# formorer 2010-01-27
|
| 47 |
header NUVOMESS subject =~ /^Nuovo messaggio$/i;
|
| 48 |
describe NUVOMESS Phishing spam
|
| 49 |
score NUVOMESS 4
|
| 50 |
|
| 51 |
|