+# -*- mode: spamassassin -*-
# Spam dealing with selling stuff, stocks, etc. is matched by these
# rules
# blarson 2004-11-08
body CITIBANK /\bciti.?bank\b/i
describe CITIBANK citibank scam
-score CITIBANK 2
+score CITIBANK 3
# blarson 2005-01-14
body HOMEOWNER /home.?owner/i
describe ANALLE stock spam in german
score ANALLE 3
-# blarson 2007-06-17 2007-09-21 2007-10-20
-body REPWATCH2 /\breplic+a\s*(?:watch|timepiece)/i
+# blarson 2007-06-17 2007-09-21 2007-10-20 2007-11-06
+body REPWATCH2 /\brepl[i1]c+a\s*(?:w[a4]tch|timepiece)/i
describe REPWATCH2 still pushing fake watches
score REPWATCH2 3.5
describe DMXC stock spam
score DMXC 4
-body MONEY /((usd|yen|eur?o?|dollar|\$)\s*[\d\.\, ]+|[\d\.\, ]+\s*(usd|yen|eur?o?|dollar|\$))/i
+body MONEY /((usd|yen|eur?o?|dollar|\$)\s*\d[\d\.\,]+|\d[\d\.\,]+\s*(usd|yen|eur?o?|dollar|\$))/i
describe MONEY Some amount of money in body
-score MONEY 1.5
+score MONEY 0.5
-header SUBJMONEY subject =~ /((usd|yen|eur?o?|dollar|\$)\s*[\d\.\, ]+|[\d\.\, ]+\s*(usd|yen|eur?o?|dollar|\$))/i
+# don 2015-01-11 (tweaking rule slightly; must contain at least one digit to be money
+header SUBJMONEY subject =~ /((usd|yen|eur?o?|dollar|\$)(?:[\d\.\, ]*\d[\d\.\, ]*)|(?:[\d\.\, ]*\d[\d\.\, ]*)(usd|yen|eur?o?|dollar|\$))/i
describe SUBJMONEY Some amount of money in subject
score SUBJMONEY 3
body OPORTUNI /\bOportunidade de Emprego\b/i
describe OPORTUNI Oportunidade de Emprego
score OPORTUNI 3.5
+
+# blarson 2007-12-10
+header WATCHES subject =~ /\b(?:watches|time\s*piece|aRolex|Cartier|Omega)\b/i
+describe WATCHES watches
+score WATCHES 2
+
+# blarson 2007-12-29
+body COUP0N /\bCoup0n\b/i
+describe COUP0N Coup0n
+score COUP0N 3
+
+header SOFTWARERETAIL subject =~ /\bretail/i
+describe SOFTWARERETAIL Adobe RETAIL products
+score SOFTWARERETAIL 3.2
+
+# cord 2008-01-23
+full DEPOSIT /deposit/i
+describe DEPOSIT Deposit
+score DEPOSIT 2
+
+# blarson 2008-07-17
+body PRINCIPALSONLY /\bPrincipals\s+Only\b/i
+describe PRINCIPALSONLY Principals Only
+score PRINCIPALSONLY 3
+
+# don 2008-07-21
+full AMERO /\bamero\b/i
+describe AMERO Amero, whatever the hell it is, it's spam
+score AMERO 3
+
+# blarson 2008-07-27
+header GAGO subject =~ /\bGA\s*G[O0]\b/
+describe GAGO stock scam
+score GAGO 4
+
+# blarson 2008-07-31
+body NYSE /\bNYSE\b/
+describe NYSE stock scam
+score NYSE 2
+
+# cord 2008-11-30
+full LOAN /\bloan\b/
+describe LOAN loan spam
+score LOAN 2
+
+# cord 2008-11-30
+full CREDIT /\[ck]redit\b/
+describe CREDIT credit spam
+score CREDIT 2
+
+# cord 2008-12-05
+full LEASING /\bleasing\b/
+describe LEASING leasing spam
+score LEASING 2
+
+# formorer 2010-01-23
+header LOTTERY from =~ /\blottery\b/i
+describe LOTTERY lottery spam
+score LOTTERY 2
+
+# formorer 2016-08-10
+header SEO subject =~ /\bSEO\b/i
+describe SEO SEO spam
+score SEO 2
+
+