home *** CD-ROM | disk | FTP | other *** search
/ ftp.f-secure.com / 2014.06.ftp.f-secure.com.tar / ftp.f-secure.com / support / hotfix / fsis / IS-SpamControl.fsfix / iufssc / rules / 96_fs-mortgage.cf < prev    next >
Text File  |  2006-11-29  |  6KB  |  174 lines
  1. # 96_fs-mortgage.cf -- era Wed Nov 24 10:40:02 2004
  2. # Copyright (C) 2004 F-Secure Corporation
  3. # $Id: 96_fs-mortgage.cf 3056 2006-02-28 13:16:33Z eriker $
  4. #
  5.  
  6. ifplugin FS::MsgStructure
  7.  
  8.  
  9.  
  10. endif
  11.  
  12.  
  13. # rule: URI_MORTGAGE
  14. # added 2005-05-19
  15. # test: spam-2005-05-23/df-2005-05-23-009227.txt
  16.  
  17. uri     URI_MORTGAGE /MORTGAGE|[Mm]ortgage/
  18. describe URI_MORTGAGE URI contains "mortgage"
  19. score     URI_MORTGAGE 2
  20.  
  21.  
  22. # rule: URI_OBFUSCATED_MORTGAGE
  23. # added 2005-05-19
  24. # test: spam-2005-05-19/df-2005-05-19-002118.txt
  25.  
  26. uri URI_OBFUSCATED_MORTGAGE /(?!MORTGAGE|[Mm]ortgage)[Mm].?[Oo0].?[Rr].?[Tt].?[Gg69].?[Aa4].?[Gg69].?[Ee3]/
  27. describe URI_OBFUSCATED_MORTGAGE URI contains "mortgage" in obfuscated form
  28. score URI_OBFUSCATED_MORTGAGE 4
  29.  
  30.  
  31.  
  32. # rule: GAPPY_MORTGAGE
  33. # created 2004-11-18 or thereabouts
  34. # edit 2005-02-12: allow for proper case
  35. # test: spam-2005-02-13/287174879-1108232088.V802I3d656.localhost.localdomain
  36.  
  37. body     GAPPY_MORTGAGE    /(?![Mm]ortgage)[Mm] ?o ?r ?t ?g ?a ?g ?e\b/
  38. describe GAPPY_MORTGAGE    Mortgage spelled with spaces
  39. score      GAPPY_MORTGAGE    3
  40.  
  41.  
  42. # rule: GAPPY_APPROVE
  43. # created 2004-11-18 or thereabouts
  44. ######## TODO: regression test
  45.  
  46. body        GAPPY_APPROVE    /(?:(?!approve)a ?p ?p ?r ?o ?v ?e)/
  47. describe    GAPPY_APPROVE    Approve spelled with spaces
  48. score        GAPPY_APPROVE    3
  49.  
  50.  
  51. # rule: GAPPY_REFINANCE
  52. # created 2004-11-18 or thereabouts
  53. # edit 2005-02-14: allow for proper case; omit redundant parentheses
  54. ######## TODO: regression test
  55.  
  56. body     GAPPY_REFINANCE    /(?![Rr]efinance)[Rr] ?e ?f ?i ?n ?a ?n ?c ?e/
  57. describe GAPPY_REFINANCE    Refinance spelled with spaces
  58. score     GAPPY_REFINANCE    3
  59.  
  60.  
  61. # rule: GAPPY_CREDIT
  62. # added 2005-02-14
  63. # test: spam-2005-02-13/287174879-1108232088.V802I3d656.localhost.localdomain
  64.  
  65. body     GAPPY_CREDIT /\b(?![Cc]red ?it)[Cc] ?r ?e ?d ?i ?t\b/
  66. describe GAPPY_CREDIT Credit spelled with spaces
  67. score     GAPPY_CREDIT 3
  68.  
  69.  
  70. # rule: GAPPY_LOAN
  71. # created 2004-11-18 or thereabouts
  72. # edit 2005-02-14: allow for proper case; omit redundant parentheses
  73. # edit 2005-02-14: disallow "lo an" as it's prone to false positives
  74. ######## TODO: regression test
  75.  
  76. body      GAPPY_LOAN    /\b(?![Ll]oan|[Ll]o an)l ?o ?a ?n\b/
  77. describe GAPPY_LOAN    Loan spelled with spaces
  78. score     GAPPY_LOAN    3
  79.  
  80.  
  81. # rule: GAPPY_RATE
  82. # created 2004-11-18 or thereabouts
  83. # edit 2005-02-14: allow for proper case; omit redundant parentheses
  84. # edit 2005-02-14: disallow "r ate" as it's prone to false positives
  85. ######## TODO: regression test
  86.  
  87. body     GAPPY_RATE    /\b(?![Rr]ate|[Rr] ate)[Rr] ?a ?t ?e\b/
  88. describe GAPPY_RATE    Rate spelled with spaces
  89. score     GAPPY_RATE    3
  90.  
  91.  
  92. # rule: GAPPY_SAVE
  93. # created 2004-11-18 or thereabouts
  94. # edit 2005-02-14: allow for proper case; omit redundant parentheses
  95. # edit 2005-02-14: disallow "s ave" as it's prone to false positives
  96. ######## TODO: regression test
  97.  
  98. body     GAPPY_SAVE    /\b(?![Ss]ave|s ave)[Ss] ?a ?v ?e\b/
  99. describe GAPPY_SAVE    Save spelled with spaces
  100. score     GAPPY_SAVE    3
  101.  
  102.  
  103. # rule: REDUPLIC_APPROVE
  104. # created 2005-01-18
  105. # test: spam-2005-01-18/2722717427-1105933254.V802I3c22c.localhost.localdomain
  106.  
  107. body REDUPLIC_APPROVE /(?![Aa]pprov|APPROV)[Aa4]{1,3}p{1,6}r{1,3}[0oO]{0,4}v{1,3}/
  108. describe REDUPLIC_APPROVE Approve spelled with too many or too few letters
  109. score REDUPLIC_APPROVE 3
  110.  
  111. # rule: REDUPLIC_MORTGAGE
  112. # created 2005-01-18
  113. # test: spam-2005-01-18/2722717427-1105933254.V802I3c22c.localhost.localdomain
  114. # fail: 20030228_easy_ham_2/easy_ham_2/00991.80ac3c798bb00027efa6d80fdfb00d8e
  115.  
  116. body REDUPLIC_MORTGAGE /(?![Mm]ortgage|MORTGAGE)[Mm]{1,3}[oO0]{0,2}r{1,3}[tT+]{0,3}g{1,3}ag{1,3}/
  117. describe REDUPLIC_MORTGAGE Mortgage with too many / too few letters
  118. score REDUPLIC_MORTGAGE 3
  119.  
  120. # rule: REDUPLIC_REFINANCE
  121. # created 2005-01-18
  122. # test: spam-2005-01-18/2722723625-1105951381.V802I3c84e.localhost.localdomain
  123.  
  124. body REDUPLIC_REFINANCE /(?![Rr]efinanc|REFINANC)[Rr]{1,3}[eE3]{1,3}f{1,3}[iI1]{0,3}n{1,3}an{1,3}[cs]/
  125. describe REDUPLIC_REFINANCE Refinance with too many / too few letters
  126. score REDUPLIC_REFINANCE 3
  127.  
  128.  
  129. # rule: OBFUSCATED_INVESTOR
  130. # added 2005-05-11
  131. # edit 2006-01-13: proper case fix
  132. # test: spam-2005-05-11/df-2005-05-11-003820.txt
  133.  
  134. body     OBFUSCATED_INVESTOR /(?![Ii]nvestor|INVESTOR)[Ii1l][Nn][Vv][Ee3][Ss5][Tt+][Oo0][Rr]/
  135. describe OBFUSCATED_INVESTOR Investor with w4r3z spelling
  136. score     OBFUSCATED_INVESTOR 2
  137.  
  138. # rule: OBFUSCATED_OPPORTUNITY
  139. # added 2005-05-11
  140. # edit 2006-01-13: proper case fix
  141. # test: spam-2005-05-11/df-2005-05-11-002515.txt
  142. # fail: hard_ham/00229.0870e13cd0b783d3d0b32826fa06bef3
  143.  
  144. body     OBFUSCATED_OPPORTUNITY /(?![Oo]pportunit|OPPORTUNIT)[Oo0][Pp][Pp][Oo0][Rr][Tt+][UuVv][Nn][Ii1l][Tt+]/
  145. describe OBFUSCATED_OPPORTUNITY Opportunity with w4r3z spelling
  146. score     OBFUSCATED_OPPORTUNITY 2
  147.  
  148. # rule: OBFUSCATED_OUTSTANDING
  149. # added 2005-05-11
  150. # edit 2006-01-13: proper case fix
  151. # test: spam-2005-05-11/df-2005-05-11-003838.txt
  152.  
  153. body     OBFUSCATED_OUTSTANDING /(?![Oo]utstanding|OUTSTANDING)[Oo0][Uu][Tt+][Ss5][Tt+][Aa4][Nn][Dd][Ii1l][Nn][Gg6]/
  154. describe OBFUSCATED_OUTSTANDING Outstanding with w4r3z spelling
  155. score     OBFUSCATED_OUTSTANDING 2
  156.  
  157. # rule: OBFUSCATED_VALUATION
  158. # added 2005-05-11
  159. # edit 2006-01-13: proper case fix
  160. # test: spam-2005-05-11/df-2005-05-11-001230.txt
  161.  
  162. body     OBFUSCATED_VALUATION /(?![Vv]aluation|VALUATION)[VvUu][Aa4][Ll1I][UuVv][Aa4][Tt+][Ii1l][Oo0][Nn]/
  163. describe OBFUSCATED_VALUATION Valuation with w4r3z spelling
  164. score     OBFUSCATED_VALUATION 2
  165.  
  166.  
  167. # rule: OBFUSCATED_DOLLARS
  168. # added 2005-05-11
  169. # test: spam-2005-05-11/df-2005-05-11-007386.txt
  170.  
  171. body     OBFUSCATED_DOLLARS /\$[1-9][0-9,]{0,15}[Ool]{1,7}[,0-9]{0,15}\b/
  172. describe OBFUSCATED_DOLLARS Dollar amount with embedded obfuscated number
  173. score     OBFUSCATED_DOLLARS 1
  174.