You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2010/04/11 19:40:06 UTC
svn commit: r932948 - in /spamassassin/trunk/rulesrc/sandbox/jhardin:
20_fillform.cf 20_lotsa_money.cf
Author: jhardin
Date: Sun Apr 11 17:40:05 2010
New Revision: 932948
URL: http://svn.apache.org/viewvc?rev=932948&view=rev
Log:
Add some German text to fillform and lotsa_money
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf
spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf?rev=932948&r1=932947&r2=932948&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_fillform.cf Sun Apr 11 17:40:05 2010
@@ -29,16 +29,16 @@ ifplugin Mail::SpamAssassin::Plugin::Rep
replace_tag FF_A2 (?:(?:contact|e-?mail|full|house|home|resident[ia]+l|busines+|mailing|work|of+ice|delivery|ship+ing|post(?:al)?)<ANDOR>?){0,3}\s?(?:ad+res+(?:es)?|location)(?:\sline)?(?:\s[0-9])?
# Name variations
- replace_tag FF_N1 (?:company|first|last|all|busines+|legal|ben[ei]ficiary)?\s?names?(?:<ANDOR>ad+res+)?
+ replace_tag FF_N1 (?:company|first|last|all|busines+|legal|ben[ei]ficiary|vollstaendigen)?\s?name[sn]?(?:<ANDOR>ad+res+)?
# Telephone variations
- replace_tag FF_P1 (?:(?:(?:busines+|contact|fax|voice|cel+(?:ular)?|house|home|mobile|of+ice|tel+e?(?:\s?phone)?|phone)(?:\sphone)?<ANDOR>?){1,3}(?:\s<NUMBER>)?<ANDOR>?){1,3}
+ replace_tag FF_P1 (?:(?:(?:busines+|contact|fax|voice|cel+(?:ular)?|house|home|mobile?|of+ice|tel+e?(?:\s?(?:ph|f)one)?|(?:ph|f)one)(?:\s(?:ph|f)one)?<ANDOR>?){1,3}(?:\s<NUMBER>)?<ANDOR>?){1,3}
# Misc personal data
- replace_tag FF_M1 (?:(?:age|marital\s?statu[se]|sex|gender|male\sor\sfemale|(?:date\sof\s)?birth|religion|nationality|email|next\sof\skin)<ANDOR>?){1,3}
+ replace_tag FF_M1 (?:(?:age|marital\s?statu[se]|sex|gender|male\sor\sfemale|(?:date\sof\s)?birth|religion|nationality|email|next\sof\skin|alter|staatsangehoerigkeit)<ANDOR>?){1,3}
# Loan application details
- replace_tag FF_L1 (?:(?:previous\s)?work(?:ing)\s?experience|employment|position|profes+ion|oc+up[ae]tion(?:\/position)?|(?:monthly|an+ual)?\s?income|an+ual\sturn\s?over|purpose\sof\sl(?:oa|ao)n|l(?:oa|ao)n\sduration|(?:l(?:oa|ao)n\s|the\s)?amount(?:\sneed(ed)?|\sdesired)?(?:\s(?:as|of)\sloan)?)
+ replace_tag FF_L1 (?:(?:previous\s)?work(?:ing)\s?experience|employment|position|profes+ion|oc+up[ae]tion(?:\/position)?|(?:monthly|an+ual)?\s?income|an+ual\sturn\s?over|purpose\sof\sl(?:oa|ao)n|l(?:oa|ao)n\sduration|(?:l(?:oa|ao)n\s|the\s)?amount(?:\sneed(ed)?|\sdesired)?(?:\s(?:as|of)\sloan)?|beruf)
# Financial/ID details (scams and phishing)
replace_tag FF_F1 (?:(?:bank|beneficiary|billing|acc(?:oun)?t|a\/c|rout(?:ing)?|swift|receiver|user)<ANDOR>?){1,3}\s(?:(?:name|ad+res+(?:es)?|location|code|details|<NUMBER>)<ANDOR>?){1,3}
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf?rev=932948&r1=932947&r2=932948&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_lotsa_money.cf Sun Apr 11 17:40:05 2010
@@ -3,8 +3,8 @@ ifplugin Mail::SpamAssassin::Plugin::Rep
replace_tag CURRENCY [\(\[]?(?:\bUS[D\$]{0,2}|\$(?:US)?|usd|GBP|=[Aa][34]|\xa3|&\#16[34];|(?i:pounds\ssterling)|\xa4|EUR|[Ee]uros?|(?i:eur)\sde|CHF)[\]\)]?
replace_tag GB_UK \b(?:U\.?K\.?|(?:Great\s)?Brit(?:ain|ish)|G\.?B\.?)\b
- body __LOTSA_MONEY_00 /<CURRENCY>\s?\d[\dO][,\.][\dO]{3}(?:(?!\d)|\b)/
- body __LOTSA_MONEY_01 /(?:(?i:sum\sof\s)[\(\[]?|<CURRENCY>\s?)\s?\d[\d.,\sO]{5,20}[\dO]/
+ body __LOTSA_MONEY_00 /<CURRENCY>[\s\.]?\d[\dO][,\.][\dO]{3}(?:(?!\d)|\b)/
+ body __LOTSA_MONEY_01 /(?:(?i:sum\sof\s)[\(\[]?|<CURRENCY>\s?)[\s\.]?\d[\d.,\sO]{5,20}[\dO]/
body __LOTSA_MONEY_02 /\d[\d.,\sO]{5,20}[\dO][\)\]\(]?\s?(?:<CURRENCY>|Pounds|(?i:dollars?|bucks))\b/
body __LOTSA_MONEY_03 /(?:(?i:sum\sof\s)[\(\[]?|<CURRENCY>\s?)\d(?:[\d.,\sO]{0,5})?[\)\]]?\s?(?i:M(?i:il)?\b|mil+(?i:io|<O>)n|hund?[re]+a?[dt]|thousand|tausend)/
body __LOTSA_MONEY_04 /(?:\d[\d\.]{0,4}M|million(?!s)|mill<O>n|hund?rea?d(?!s)[^\.]{1,25}thousand(?!s)|cents?[^\.]{1,25}mille|hundert[^\.]{1,30}tausend|ientos?[^\.]{1,20}mil)[^\.\$]{0,50}(?:(?:U\.?\s?S\.?\s?(?:A\.?\s?)?|united\s?states?|canad(?:ian|a)\s)?dollars?|bucks|USD|GBP|<GB_UK>\spounds?|(?:<GB_UK>\s)?pounds?\ssterling|pounds(?!\sof)|(?:d'\s?)?euros?|francs?)\b/i
@@ -105,9 +105,11 @@ body __LUCRATIVE /\blucrative\b
body __YOU_ASSIST /\byour\sassistance\b/i
body __OUR_BEHALF /\bon\s(?:my|our)\sbehalf\b/i
body __AGREED_RATIO /\b(?:agreed|sharing)\s(?:ratios?|percent\w+)\b/i
-body __SHARE_IT /\b(?:(?:share|receive|re-?profile)\sth(?:e|is)\s(?:proceeds|funds?|money|balance|account)|partager (?:avec vous|ratio))\b/i
+body __SHARE_IT /\b(?:(?:share|receive|re-?profile|teilen)\s(?:th(?:e|is)|das)\s(?:proceeds|funds?|money|balance|account|geld)|partager (?:avec vous|ratio))\b/i
body __DESTROY_ME /\b(?:destroy|hunt)\sm[ey]\b/i
body __YOUR_PROFIT /\byour?\sprofit/i
+body __FIFTY_FIFTY /\b50\/50\b/
+meta SHARE_50_50 __SHARE_IT && __FIFTY_FIFTY
body EMRCP /\bExcess Maximum Return Capital Profit\b/i
describe EMRCP "Excess Maximum Return Capital Profit" Fidelity scam
@@ -122,9 +124,9 @@ ifplugin Mail::SpamAssassin::Plugin::Rep
replace_rules __PCT_FOR_YOU_1 __PCT_FOR_YOU_2 __PCT_FOR_YOU_3 __PCT_OF_PMTS
- meta __PCT_FOR_YOU __PCT_FOR_YOU_1 || __PCT_FOR_YOU_2 || __PCT_FOR_YOU_3
+ meta __PCT_FOR_YOU __PCT_FOR_YOU_1 || __PCT_FOR_YOU_2 || __PCT_FOR_YOU_3 || SHARE_50_50
- meta MONEY_PERCENT LOTS_OF_MONEY && (__PCT_FOR_YOU || __PCT_OF_PMTS)
+ meta MONEY_PERCENT LOTS_OF_MONEY && (__PCT_FOR_YOU || __PCT_OF_PMTS || __FIFTY_FIFTY)
describe MONEY_PERCENT X% of a lot of money for you
endif
@@ -141,7 +143,7 @@ body __NOT_DEAD_YET /\bwill\sinher
body __AM_DYING /\bam\s(?:\S+\s)?dying\b/i
body __I_WILL_YOU /\bwill(?:ed)?\s(?:[a-z\s]{0,20}\s(?:fortune|money)\s)?to\syou\b/i
body __NEXT_OF_KIN /\bnext[-\s]of[-\s]kin\b/i
-body __EX_CUSTOMER /\b(?:dead|deceased|late|verstorbenen)\s(?:client|customer|account|investor|kunde)/i
+body __EX_CUSTOMER /\b(?:dead|deceased|late|verstorbenen)\s(?:[ck]lient|customer|account|investor|kunde)/i
body __DECEASED /\b(?:the|my|der)\s(?:deceased|late|verstorbenen)\b/i
body __SURVIVORS /\b(?:widow|son|daughter|husband|wife|brother|sister|attorney)\s(?:of|to)\s(?:the\s)?late\s\w+\b/i
body __DEAD_PARENT /\bmy\s(?:deceased|dead)\s(?:father|mother)/i
@@ -175,7 +177,7 @@ body __COURIER /\bcourier\s(?
#describe MONEY_FRAUD_BOX Lots of money in a box, lots of money from a fox
#score MONEY_FRAUD_BOX 1.0
-body __SUM_OF_FUND /\bsum\sof\s(?:amount|fund)/i
+body __SUM_OF_FUND /\b(?:sum|release|freigabe)\s(?:of|der)\s(?:amount|fund|mittel)\b/i
body __BENEFICIARY /\bben[ei]fi(?:c|sh)i?ar(?:y|ies)\b/i
body __DIPLOMATIC /\bdiplomatic\b/i