common/scam_spam

   1 # Nigerian-type spam
   2
   3 body            MURPHY_SCAM1    /I am.*(son|daughter|wife)/i
   4 describe        MURPHY_SCAM1    Family relation
   5 score           MURPHY_SCAM1    0.1
   6
   7 body            MURPHY_SCAM2    /confidential transaction/i
   8 score           MURPHY_SCAM2    0.1
   9
  10 body            MURPHY_SCAM3    /may be surprise/i
  11 score           MURPHY_SCAM3    0.1
  12
  13 body            MURPHY_SCAM4    /(Robert Mugabe|Richard Taylor)/i
  14 score           MURPHY_SCAM4    0.1
  15
  16 body            MURPHY_SCAM5    /(zimbabwe|nigeria)/i
  17 score           MURPHY_SCAM5    0.1
  18
  19 meta            MURPHY_SCAM_META1       (MURPHY_SCAM1 + MURPHY_SCAM2 + MURPHY_SCAM3 + MURPHY_SCAM4 + MURPHY_SCAM5) > 1
  20 score           MURPHY_SCAM_META1       3.0
  21
  22 header RESPOND          Subject =~ /^Respond/
  23 describe RESPOND        respond 419 scam spam
  24 score REPSOND           2
  25
  26 # cjwatson, 2003/10/18
  27 header NIGERIAN_XIAN    Subject =~ /^DONATION FOR THE LORD/
  28 describe NIGERIAN_XIAN  The 419 scam with a Christian twist
  29 score NIGERIAN_XIAN     4
  30
  31 # cjwatson, 2004-02-10
  32 header BIZ_PROP         Subject =~ /Business Proposition:Respond ASAP/i
  33 describe BIZ_PROP       419 variant
  34 score BIZ_PROP          4
  35
  36 # cjwatson, 2004-03-05
  37 header NEW_PUB_COMP     Subject =~ /NEW PUBLIC COMPNAY ALERT/
  38 describe NEW_PUB_COMP   Filesharing spam
  39 score NEW_PUB_COMP      3
  40