* Use MONEY and FOURLA to determine stock scams
* Disable WIFE
* Decrease score of FOURLA
git-svn-id: svn+ssh://svn.debian.org/svn/pkg-listmaster/trunk/spamassassin_config@67
0b7a5b0c-1f2c-0410-bd74-
c376f8064c91
describe DMXC stock spam
score DMXC 4
-body MONEY /(\$\s*[\d\.]+|[\d\.]+\s*(usd|yen|euro|dollar|$))/i
+body MONEY /(\$\s*[\d\.]+|[\d\.]+\s*(usd|yen|euro|dollar|\$))/i
describe MONEY Some amount of money
score MONEY 1.5
-header SUBJMONEY subject =~ /(\$\s*[\d\.]+|[\d\.]+\s*(usd|yen|euro|dollar|$))/i
+header SUBJMONEY subject =~ /(\$\s*[\d\.]+|[\d\.]+\s*(usd|yen|euro|dollar|\$))/i
describe SUBJMONEY Some amount of money in subject
score SUBJMONEY 3
-# Added some rules from Rule du Jour that I've been testing for a while
+#
+ Added some rules from Rule du Jour that I've been testing for a while
#Monotone (from airmax.cf)
body MONOTONE_WORDS_2_15 /^([a-z]{2,20}[\s\.]+){15}/
body FOURLA /\b([A-Z]\s?){4}\b/
describe FOURLA Four letter acronym (stock spam?)
-score FOURLA 1
+score FOURLA 0.1
-full WORDMONEY /^\w+\s*:\s*(?:\$\s*[\d\.]+|[\d\.]+\s*USD)/mi
-describe WORDMONEY Word Colon Money
-score WORDMONEY 1
-
-meta STOCKLIKE (FOURLA && WORDMONEY)
+meta STOCKLIKE (FOURLA && (MONEY || SUBJMONEY))
describe STOCKLIKE Four letter acronyms with money; stock scam
score STOCKLIKE 2
describe ADULTDVD adult dvd
score ADULTDVD 3
-# blarson 2005-01-07 2005-01-30 trollwife submits bugs
-body WIFE /(?<!troll)wi[fv]e/i
-describe WIFE wife
-score WIFE 2
+# don 2007-10-13 false positives; commenting out for now
+# # blarson 2005-01-07 2005-01-30 trollwife submits bugs
+# body WIFE /(?<!troll)wi[fv]e/i
+# describe WIFE wife
+# score WIFE 2
# blarson 2005-07-10
header JACKRABBIT subject =~ /Jack Rabbit Vibrator/i