1 # -*- mode: spamassassin -*-
2 # Spam dealing with selling stuff, stocks, etc. is matched by these
5 # Financial/mortage spam --pasc 04/05/12
6 # Added the _L set --pasc 04/05/14
7 body MURPHY_FINANCE1 /m.?(o|\?).?r.?t.?g.?a.?g.?e.?a.?p.?p.?l.?i.?c.?a.?t.?(i|\?).?o.?n/
8 score MURPHY_FINANCE1 0.1
10 body MURPHY_FINANCE2 /b.?a.?d.?c.?r.?(e|\?).?d.?i.?t/
11 score MURPHY_FINANCE2 0.1
13 body MURPHY_FINANCE3 /lowest fixed rate/
14 score MURPHY_FINANCE3 0.1
16 body MURPHY_FINANCE4 /application (is )?accepted/i
17 score MURPHY_FINANCE4 0.1
19 body MURPHY_FINANCE5 /loan/i
20 score MURPHY_FINANCE5 0.1
22 body MURPHY_FINANCE6 /payment/i
23 score MURPHY_FINANCE6 1.7
25 body MURPHY_FINANCE7 /re.?finance/i
26 score MURPHY_FINANCE7 0.1
28 body MURPHY_FINANCE8 /interest.?rate/i
29 score MURPHY_FINANCE8 0.1
30 # YEs I know about MURPHY_FINANCE1
31 body MURPHY_FINANCE9 /m.?(o|\?).?r.?t.?g.?a.?g.?e/i
32 score MURPHY_FINANCE9 0.1
34 body MURPHY_FINANCE10 /borrow/i
35 score MURPHY_FINANCE10 0.5
37 body MURPHY_FINANCE11 /pre.?approved/i
38 score MURPHY_FINANCE11 1.0
40 body MURPHY_FINANCE_L1 /app(l|1)y/i
41 score MURPHY_FINANCE_L1 0.0
43 body MURPHY_FINANCE_L2 /bil(l|1)/i
44 score MURPHY_FINANCE_L2 0.0
46 body MURPHY_FINANCE_L3 /budget/i
47 score MURPHY_FINANCE_L3 0.0
49 body MURPHY_FINANCE_L4 /home value/i
50 score MURPHY_FINANCE_L4 0.0
52 body MURPHY_FINANCE_L5 /quote/i
53 score MURPHY_FINANCE_L5 0.0
55 body MURPHY_FINANCE_L6 /income verification/i
56 score MURPHY_FINANCE_L6 0.0
59 # meta MURPHY_FINANCE_LOW (MURPHY_FINANCE_L1 + MURPHY_FINANCE_L2 + MURPHY_FINANCE_L3 + MURPHY_FINANCE_L4 + MURPHY_FINANCE_L5 + MURPHY_FINANCE_L6) > 1
60 # score MURPHY_FINANCE_LOW 1.0
62 # meta MURPHY_FINANCE_META1 (MURPHY_FINANCE_LOW + MURPHY_FINANCE1 + MURPHY_FINANCE2 + MURPHY_FINANCE3 + MURPHY_FINANCE4 + MURPHY_FINANCE5 + MURPHY_FINANCE6 + MURPHY_FINANCE7 + MURPHY_FINANCE8 + MURPHY_FINANCE9 + MURPHY_FINANCE10 + MURPHY_FINANCE11) > 1
63 # score MURPHY_FINANCE_META1 3.0
65 # Try and catch some of this new spam --pasc 06/10/12
66 body M_CASH1 /(prompt|instant|immediate)(aneous)? (cash|funds|capital|finances)/i
69 # Make money fast --pasc 061016
70 body M_CASH2 /(Learn|Find out) how to (make|generate).*k (daily|(a|per) day) from (your )?(home|house)/
73 #Stock market scam --pasc 061016
74 body M_CASH3 /this symbol will experience (phenomenal|fantastic|amazing) (growth|increase)/i
77 # cjwatson, 2004-01-14
78 header STOCK_MARKET Subject =~ /STOCK MARKET ALERT/
79 describe STOCK_MARKET stock market spam
82 # cjwatson, 2004-02-12
83 body GOLDMINE /GOLD MINE SWEEPSTAKES LOTTERY/
84 describe GOLDMINE You have won a prize! Sure.
89 describe CASINO Casino spam
93 body MORTGAGE /m\s*[o0]\s*r\s*t?\s*g\s*a\s*g+\s*e/i
94 describe MORTGAGE Mortgage spam
98 body CORELDRAW /Corel Draw (graphics suite)?11/i
99 describe CORELDRAW Corel sales spam
103 body FREESHIPPING /\bf.?r.?e.?e.?\s+s.?h.?[il1].?p.?p.?[il1].?n.?g\b/i
104 describe FREESHIPPING free shipping
108 body STOK /\b(OSSI|AMTK|LETH|QIIIF)\b/
109 describe STOK stock spam
113 body BANNEDCD /(banned|underground)\s*cd/i
114 describe BANNEDCD banned cd spam
117 # cjwatson, 2003/10/09
118 body TIMESHARE /Would you like to sell or rent your Timeshare for a profit\?/
119 describe TIMESHARE Oddly enough, bugs don't own timeshares
123 body AUTOWAR /\b(auto|car)\s*warr?[ae]nt(y|ee|ie)/i
124 describe AUTOWAR auto warrenty spam
128 body FORONLY /for\s+only\s+\$/i
129 describe FORONLY sales spam
133 body ROLEX /\br[o0a][l1w][l1]?[ea][xzc]/i
138 header HANDCLOCK subject =~ /\bhand\s*-?clock/i
139 describe HANDCLOCK Hand Clock
143 header REPLICAWATCH subject =~ /replica\s*watch/i
144 describe REPLICAWATCH Replica Watch
148 body HANDBAG /hand\s*-?bag/i
149 describe HANDBAG Handbag
153 header ECONOBETTER subject =~ /Economy is much better/i
154 describe ECONOBETTER Economy is much better
158 header MRG subject =~ /\bmrg\b/i
159 describe MRG mrg mortgage spammer
163 body CITIBANK /\bciti.?bank\b/i
164 describe CITIBANK citibank scam
168 body HOMEOWNER /home.?owner/i
169 describe HOMEOWNER home owner
173 body THOUSANDZ /\bTHOUSANDZ\b/
174 describe THOUSANDZ loan spam
178 header EBAY subject =~ /\bebay\s+account\b/i
179 describe EBAY ebay account
183 body INVESTOR_ALERT /an\s*investor\s*alert/i
184 describe INVESTOR_ALERT stock spam
185 score INVESTOR_ALERT 2
188 body STOCK_ALERT /stock.+press\s*release.+stock/i
189 describe STOCK_ALERT stock scam
193 header NEWSOFTWARE subject =~ /\bNew software uploaded by\b/i
194 describe NEWSOFTWARE new software spam
198 body REFI /\bhome re-fi\b/i
199 describe REFI mortgage spam
203 full COMPANYSYMBOLPRICE /((company|symbol|price|marke?t|schlusskurs)\:.+){3,}/si
204 describe COMPANYSYMBOLPRICE Stock scam
205 score COMPANYSYMBOLPRICE 3
207 full COMPANYSYMBOLPRICE2 /(^(company|symb?o?l?|price|cost|marke?t)\:\s+.+\n){2,}/mi
208 describe COMPANYSYMBOLPRICE2 Stock scam left column 2
209 score COMPANYSYMBOLPRICE2 3
212 body PRETTYRUS /\b(pretty|cute) russian (girl|woman)\b/i
213 describe PRETTYRUS pretty russian spam
217 header INVESTORS subject =~ /\b(investors?|portfolio|radar)\b/i
218 describe INVESTORS stock spam
222 body ANALLE /\bAN ALLE FINANZINVESTOREN\b/
223 describe ANALLE stock spam in german
226 # blarson 2007-06-17 2007-09-21 2007-10-20 2007-11-06
227 body REPWATCH2 /\brepl[i1]c+a\s*(?:w[a4]tch|timepiece)/i
228 describe REPWATCH2 still pushing fake watches
232 header WEEKLYNEWS subject =~ /\bWeekly (:?Sales? )(Newsletter|Special)\b/i
233 describe WEEKLYNEWS weekly spam
237 body COSTWATCH /\b(dollar|costly|valuable|pricey|expensive)\s+watch\b/i
238 describe COSTWATCH watch spam
242 body LEADINGPROVIDER /leading\s+providers?.*consult/i
243 describe LEADINGPROVIDER Leading provider of consulting
244 score LEADINGPROVIDER 2
247 body REFI /\bRe-Fi\b/i
248 describe REFI mortgage spam
252 body BIGMONEY /(b|tr|m|z)[i1][l1]+[i1][0o]n\s+(d[o0][l1]+ar|yen|buck|pound|euro)/i
253 describe BIGMONEY Money money money money!
256 # zobel 2007-09-30 (added by Cord)
257 body DMXC /Look at D-M-X-C!/
258 describe DMXC stock spam
261 body MONEY /((usd|yen|eur?o?|dollar|\$)\s*\d[\d\.\,]+|\d[\d\.\,]+\s*(usd|yen|eur?o?|dollar|\$))/i
262 describe MONEY Some amount of money in body
265 header SUBJMONEY subject =~ /((usd|yen|eur?o?|dollar|\$)\s*[\d\.\, ]+|[\d\.\, ]+\s*(usd|yen|eur?o?|dollar|\$))/i
266 describe SUBJMONEY Some amount of money in subject
270 body HIDDENCOSTS /hidden\s*(costs|fees)/i
271 describe HIDDENCOSTS Hidden costs or fees?
272 score HIDDENCOSTS 1.5
274 header EXCHANGEFIN subject =~ /\bE-exchange Finland\b/
275 describe EXCHANGEFIN EXCHANGEFIN E-money
276 score EXCHANGEFIN 4.0
278 body STOCKFRLE /\bFRLE\b/i
279 describe STOCKFRLE FRLE Stock Spam
283 body OPORTUNI /\bOportunidade de Emprego\b/i
284 describe OPORTUNI Oportunidade de Emprego
288 header WATCHES subject =~ /\b(?:watches|time\s*piece|Replica|aRolex|Cartier|Omega)\b/i
289 describe WATCHES watches
293 body COUP0N /\bCoup0n\b/i
294 describe COUP0N Coup0n
297 header SOFTWARERETAIL subject =~ /\bretail/i
298 describe SOFTWARERETAIL Adobe RETAIL products
299 score SOFTWARERETAIL 3.2
302 full DEPOSIT /deposit/i
303 describe DEPOSIT Deposit
307 body PRINCIPALSONLY /\bPrincipals\s+Only\b/i
308 describe PRINCIPALSONLY Principals Only
309 score PRINCIPALSONLY 3
312 full AMERO /\bamero\b/i
313 describe AMERO Amero, whatever the hell it is, it's spam
317 header GAGO subject =~ /\bGA\s*G[O0]\b/
318 describe GAGO stock scam
323 describe NYSE stock scam
328 describe LOAN loan spam
332 full CREDIT /\[ck]redit\b/
333 describe CREDIT credit spam
337 full LEASING /\bleasing\b/
338 describe LEASING leasing spam