3 body MURPHY_SCAM1 /I am.*(son|daughter|wife)/i
4 describe MURPHY_SCAM1 Family relation
7 body MURPHY_SCAM2 /confidential transaction/i
10 body MURPHY_SCAM3 /may be surprise/i
11 score MURPHY_SCAM3 0.1
13 body MURPHY_SCAM4 /(Robert Mugabe|Richard Taylor)/i
14 score MURPHY_SCAM4 0.1
16 body MURPHY_SCAM5 /(zimbabwe|nigeria)/i
17 score MURPHY_SCAM5 0.1
19 meta MURPHY_SCAM_META1 (MURPHY_SCAM1 + MURPHY_SCAM2 + MURPHY_SCAM3 + MURPHY_SCAM4 + MURPHY_SCAM5) > 1
20 score MURPHY_SCAM_META1 3.0
22 header RESPOND Subject =~ /^Respond/
23 describe RESPOND respond 419 scam spam
26 # cjwatson, 2003/10/18
27 header NIGERIAN_XIAN Subject =~ /^DONATION FOR THE LORD/
28 describe NIGERIAN_XIAN The 419 scam with a Christian twist
31 # cjwatson, 2004-02-10
32 header BIZ_PROP Subject =~ /Business Proposition:Respond ASAP/i
33 describe BIZ_PROP 419 variant
36 # cjwatson, 2004-03-05
37 header NEW_PUB_COMP Subject =~ /NEW PUBLIC COMPNAY ALERT/
38 describe NEW_PUB_COMP Filesharing spam
42 header ACCOUNTUPDATE subject =~ /^\s*Account\s+Update\s*$/i;
43 describe ACCOUNTUPDATE Yeah, we don't send account updates