X-Git-Url: https://git.donarmstrong.com/?p=spamassassin_config.git;a=blobdiff_plain;f=common%2Fphrase_spam;h=f3e9e151ab6a9d3f599fc2aaaf87e6d5729b450a;hp=7a3d9ae18b4b37c8e4e0911ddc4be4e7eefcab99;hb=bce21112ab50be6527efdb21d85d94ad64d526a7;hpb=e13a06fa8b981989708c3f45b278c5b57089120a diff --git a/common/phrase_spam b/common/phrase_spam index 7a3d9ae..f3e9e15 100644 --- a/common/phrase_spam +++ b/common/phrase_spam @@ -1,4 +1,5 @@ -# Added some rules from Rule du Jour that I've been testing for a while +# + Added some rules from Rule du Jour that I've been testing for a while #Monotone (from airmax.cf) body MONOTONE_WORDS_2_15 /^([a-z]{2,20}[\s\.]+){15}/ @@ -87,7 +88,7 @@ score FW 3 # blarson 2007-07-13 header REFWD subject =~ /\b(?:RE|FWD)\:\s*$/i describe REFWD re or fwd nothing -score REFWD 3 +score REFWD 3.5 # blarson 2005-11-11 header ONEWORD subject =~ /^(?:Fw:|re:)?\s*\w+\s*$/i @@ -188,8 +189,13 @@ header MESSAGESUB subject =~ /^\s*\(?message\s*(subject)?\)?$/i describe MESSAGESUB really descriptive subject score MESSAGESUB 3 -# blarson 2006-03-16 2007-08-28 -body DEARDIGIT /^(?:well\s+)?(?:Dear|Hey|H[ea]y?ll?.?o|To|Attention|Hi+|Hey+a?|Bonjorno|Yo|(?:g[o0]+d\s*)?(?:d?ay|morning|evening?|afternoon)|what.?i?s\s+up|greetings|Salutations|(Mail|News)\s+to|how.?s?\s*(?:(?:it)?\s*going|have\s+you\s+been|are you).?\s*(?:there|to\s+you)?)\,?\s+(?:Account\s+\#?|\=?3d|)\d{3,}/i +# don 2007-09-20 +header SENTMESSAGE subject =~ /(sent you a( personal|) message|would like to chat)/i +describe SENTMESSAGE Sent you a message (like duh?) +score SENTMESSAGE 2 + +# blarson 2006-03-16 2007-09-18 +body DEARDIGIT /^(?:well\s+)?(?:Dear|Hey|H[ea]y?ll?.?o|To|Attention|Hi+|Hey+a?|Bonjorno|(?:Yo\s*)+|(?:g[o0]+d\s*)?(?:d?ay|morning|evening?|afternoon|night)|what.?i?s\s+up|wa(?:s|z)+up|greetings?|Salutations|(Mail|News)\s+to|how(?:.?s|\s+is)?\s*(?:(?:it)?(?:\s+is)??\s*going|have\s+you\s+been|are you).?\s*(?:there|to\s+you)?|compliments|Regards|Adieu)\,?\s+(?:Account\s+\#?|\=?3d|)(?:bro|there|sir|Mr\.?)\s*?\d{3,}/i describe DEARDIGIT Dear number score DEARDIGIT 3.9 @@ -342,11 +348,19 @@ header ACRO8PR0 subject =~ /\bAcr[0o]bat\s*[78]\s+(?:PR[0O]\b|\$?\d+\$?)/i describe ACRO8PR0 sales spam score ACRO8PR0 4 -# blarson 2007-08-31 -body WBRS /\b(WBRS|FPMC|ADYN|AFML|MISJ|HXPN|WHKA|CBFE|HSBC|PCAI|MPRG|HPRS|AUNI|TGVI|MHII|TAMG|GDKI|ACEN|CDYV|G7Q\.F|mbwc|CHFR|CDPN|DSDI|UTEV|P-S-U-D|GPSI|SGXI|CAON|SREA|ERMX|VPSN|SZSN|PAYI\.OB|LTDI|C\W\W?Y\W\W?T\W\W?V|E\WX\WM\WT|CYTV|VGPM|V\s?G\s?P\s?M(\.PK)?)\b/ +# blarson 2007-10-05 +body WBRS /\b(WBRS|FPMC|ADYN|AFML|MISJ|HXPN|WHKA|CBFE|HSBC|PCAI|MPRG|HPRS|AUNI|TGVI|MHII|TAMG|GDKI|ACEN|CDYV|G7Q\.F|mbwc|CHFR|CDPN|DSDI|UTEV|P-S-U-D|GPSI|SGXI|CAON|SREA|ERMX|VPSN|SZSN|PAYI\.OB|LTDI|C\W\W?Y\W\W?T\W\W?V|E\WX\WM\WT|CYTV|VGPM|V\s?G\s?P\s?M(\.PK)?|wwng|WWNG|F\WD\WE\WG|FDEG|UTYW|M\s*I\s*H\s*I|O\W?N\W?C\W?O|P\W?P\W?Y\W?H|S\W?R\W?E\W?A|A\W?C\W?G\W?U|S\W?C\W?Y\W?F|C\W?H\W?V\W?C|D\W?M\W?X\W?C|F\W?R\W?L\W?E|M\W?A\W?K\W?U|C\W?W\W?T\W?E|F\W?R\W?L\W?E|M\W?X\W?X\W?R|P\W?R\W?T\W?H|A\W?L\W?L\W?U)\b/ describe WBRS stock spam score WBRS 4 +body FOURLA /\b([A-Z]\s?){4}\b/ +describe FOURLA Four letter acronym (stock spam?) +score FOURLA 0.1 + +meta STOCKLIKE (FOURLA && (MONEY || SUBJMONEY)) +describe STOCKLIKE Four letter acronyms with money; stock scam +score STOCKLIKE 2 + # blarson 2007-01-26 header ACROBAT8 subject =~ /\badobe acr[o0]bat 8\b/i describe ACROBAT8 more sales spam @@ -412,3 +426,97 @@ body DELAFT /Please delete your private message after reading/ describe DELAFT more pdf spam score DELAFT 3 +# blarson 2007-09-13 +header OFF1CE subject =~ /\b[O0Q]f+[1i7l|]ce\s*\W?2[O0Qk]+7\b/i +describe OFF1CE off1ce spam +score OFF1CE 4 + +# blarson 2007-09-13 +header SOFTSALE subject =~ /\bsoftware sales\b/i +describe SOFTSALE software spam +score SOFTSALE 3 + +# blarson 2007-09-18 +body SUPERMACHO /\bBe a supermacho/i +describe SUPERMACHO supermacho +score SUPERMACHO 4 + +# blarson 2007-09-19 +body BIGINTER /\bBig international commercial organization\b/i +describe BIGINTER job spam +score BIGINTER 4 + +# blarson 2007-09-20 +header HASSENT subject =~ /\b(?:sent you a (?:personal|confidential)?\s*(?:message|note)|would like to chat)\b/i +describe HASSENT sent a message +score HASSENT 4 + +# blarson 2007-09-20 +header ORDERNUM subject =~ /\b(?:Order|Recipet)\s*.?\d{3,}/i +describe ORDERNUM order number +score ORDERNUM 3 + +# don 2007-09-20 +header DICTIONARYSEQ subject =~ /\b(\w{3})\w*(?:\s+\1\w*){2}/i +describe DICTIONARYSEQ Ventricular Vents Venting Ventures +score DICTIONARYSEQ 3.5 + +# blarson 2007-09-21 +header NOLET subject =~ /^\W{4,}$/ +describe NOLET swearing subject +score NOLET 2 + +# blarson 2007-09-21 +body SSIST /^ssistant Manager/ +describe SSIST ssistant Manager +score SSIST 4 + +# blarson 2007-09-21 +body GRADUATEUNDER /\bgraduate in under\b/i +describe GRADUATEUNDER graduate in under +score GRADUATEUNDER 3 + +# blarson 2007-09-24 +header NOINVEST subject =~ /\b(?:no investment|high.paid)\b/i +describe NOINVEST no investment +score NOINVEST 4 + +# blarson 2007-09-25 +header INTEXP subject =~ /\b[I|]nternet Exp[l|]orer\b/i +describe INTEXP |nternet Exp|orer +score INTEXP 2 + +# don 2007-09-29 +header WORKATHOME subject =~ /work\Wat\Whome/i +describe WORKATHOME Work at home +score WORKATHOME 4 + +# don 2007-10-01 +body PHONENUMBER /\b1[\-\.\s]?8[07]+[\-\.\s]?\d+/ +describe PHONENUMBER Toll free phone number +score PHONENUMBER 1.5 + +# don 2007-10-02 +body GERMANSPAM /Zerix Intern/i +describe GERMANSPAM Um... no clue what that is. +score GERMANSPAM 3 + +body URBANNEWS /UrbaNNews\.ro/ +describe URBANNEWS URBANNEWS Newsletter +score URBANNEWS 3 + +# blarson 2007-10-05 +header JOBS subject =~ /\b(?:job|Employ(?:ers|ment|ee))s?\b/i +describe JOBS job spam +score JOBS 1 + +# don 2007-10-09 +header FREEPASSWORD subject =~ /your\s*free\s*password/i +describe FREEPASSWORD We don't need free password +score FREEPASSWORD 3 + +# don 2007-10-11 +header AFRICABYBIKE subject =~ /africa\s*by\s*bike/i +describe AFRICABYBIKE We don't care about africa by bike or car or bus or train +score AFRICABYBIKE 4 +