home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
ftp.f-secure.com
/
2014.06.ftp.f-secure.com.tar
/
ftp.f-secure.com
/
support
/
hotfix
/
fsis
/
IS-SpamControl.fsfix
/
iufssc
/
rules
/
96_fs-mortgage.cf
< prev
next >
Wrap
Text File
|
2006-11-29
|
6KB
|
174 lines
# 96_fs-mortgage.cf -- era Wed Nov 24 10:40:02 2004
# Copyright (C) 2004 F-Secure Corporation
# $Id: 96_fs-mortgage.cf 3056 2006-02-28 13:16:33Z eriker $
#
ifplugin FS::MsgStructure
endif
# rule: URI_MORTGAGE
# added 2005-05-19
# test: spam-2005-05-23/df-2005-05-23-009227.txt
uri URI_MORTGAGE /MORTGAGE|[Mm]ortgage/
describe URI_MORTGAGE URI contains "mortgage"
score URI_MORTGAGE 2
# rule: URI_OBFUSCATED_MORTGAGE
# added 2005-05-19
# test: spam-2005-05-19/df-2005-05-19-002118.txt
uri URI_OBFUSCATED_MORTGAGE /(?!MORTGAGE|[Mm]ortgage)[Mm].?[Oo0].?[Rr].?[Tt].?[Gg69].?[Aa4].?[Gg69].?[Ee3]/
describe URI_OBFUSCATED_MORTGAGE URI contains "mortgage" in obfuscated form
score URI_OBFUSCATED_MORTGAGE 4
# rule: GAPPY_MORTGAGE
# created 2004-11-18 or thereabouts
# edit 2005-02-12: allow for proper case
# test: spam-2005-02-13/287174879-1108232088.V802I3d656.localhost.localdomain
body GAPPY_MORTGAGE /(?![Mm]ortgage)[Mm] ?o ?r ?t ?g ?a ?g ?e\b/
describe GAPPY_MORTGAGE Mortgage spelled with spaces
score GAPPY_MORTGAGE 3
# rule: GAPPY_APPROVE
# created 2004-11-18 or thereabouts
######## TODO: regression test
body GAPPY_APPROVE /(?:(?!approve)a ?p ?p ?r ?o ?v ?e)/
describe GAPPY_APPROVE Approve spelled with spaces
score GAPPY_APPROVE 3
# rule: GAPPY_REFINANCE
# created 2004-11-18 or thereabouts
# edit 2005-02-14: allow for proper case; omit redundant parentheses
######## TODO: regression test
body GAPPY_REFINANCE /(?![Rr]efinance)[Rr] ?e ?f ?i ?n ?a ?n ?c ?e/
describe GAPPY_REFINANCE Refinance spelled with spaces
score GAPPY_REFINANCE 3
# rule: GAPPY_CREDIT
# added 2005-02-14
# test: spam-2005-02-13/287174879-1108232088.V802I3d656.localhost.localdomain
body GAPPY_CREDIT /\b(?![Cc]red ?it)[Cc] ?r ?e ?d ?i ?t\b/
describe GAPPY_CREDIT Credit spelled with spaces
score GAPPY_CREDIT 3
# rule: GAPPY_LOAN
# created 2004-11-18 or thereabouts
# edit 2005-02-14: allow for proper case; omit redundant parentheses
# edit 2005-02-14: disallow "lo an" as it's prone to false positives
######## TODO: regression test
body GAPPY_LOAN /\b(?![Ll]oan|[Ll]o an)l ?o ?a ?n\b/
describe GAPPY_LOAN Loan spelled with spaces
score GAPPY_LOAN 3
# rule: GAPPY_RATE
# created 2004-11-18 or thereabouts
# edit 2005-02-14: allow for proper case; omit redundant parentheses
# edit 2005-02-14: disallow "r ate" as it's prone to false positives
######## TODO: regression test
body GAPPY_RATE /\b(?![Rr]ate|[Rr] ate)[Rr] ?a ?t ?e\b/
describe GAPPY_RATE Rate spelled with spaces
score GAPPY_RATE 3
# rule: GAPPY_SAVE
# created 2004-11-18 or thereabouts
# edit 2005-02-14: allow for proper case; omit redundant parentheses
# edit 2005-02-14: disallow "s ave" as it's prone to false positives
######## TODO: regression test
body GAPPY_SAVE /\b(?![Ss]ave|s ave)[Ss] ?a ?v ?e\b/
describe GAPPY_SAVE Save spelled with spaces
score GAPPY_SAVE 3
# rule: REDUPLIC_APPROVE
# created 2005-01-18
# test: spam-2005-01-18/2722717427-1105933254.V802I3c22c.localhost.localdomain
body REDUPLIC_APPROVE /(?![Aa]pprov|APPROV)[Aa4]{1,3}p{1,6}r{1,3}[0oO]{0,4}v{1,3}/
describe REDUPLIC_APPROVE Approve spelled with too many or too few letters
score REDUPLIC_APPROVE 3
# rule: REDUPLIC_MORTGAGE
# created 2005-01-18
# test: spam-2005-01-18/2722717427-1105933254.V802I3c22c.localhost.localdomain
# fail: 20030228_easy_ham_2/easy_ham_2/00991.80ac3c798bb00027efa6d80fdfb00d8e
body REDUPLIC_MORTGAGE /(?![Mm]ortgage|MORTGAGE)[Mm]{1,3}[oO0]{0,2}r{1,3}[tT+]{0,3}g{1,3}ag{1,3}/
describe REDUPLIC_MORTGAGE Mortgage with too many / too few letters
score REDUPLIC_MORTGAGE 3
# rule: REDUPLIC_REFINANCE
# created 2005-01-18
# test: spam-2005-01-18/2722723625-1105951381.V802I3c84e.localhost.localdomain
body REDUPLIC_REFINANCE /(?![Rr]efinanc|REFINANC)[Rr]{1,3}[eE3]{1,3}f{1,3}[iI1]{0,3}n{1,3}an{1,3}[cs]/
describe REDUPLIC_REFINANCE Refinance with too many / too few letters
score REDUPLIC_REFINANCE 3
# rule: OBFUSCATED_INVESTOR
# added 2005-05-11
# edit 2006-01-13: proper case fix
# test: spam-2005-05-11/df-2005-05-11-003820.txt
body OBFUSCATED_INVESTOR /(?![Ii]nvestor|INVESTOR)[Ii1l][Nn][Vv][Ee3][Ss5][Tt+][Oo0][Rr]/
describe OBFUSCATED_INVESTOR Investor with w4r3z spelling
score OBFUSCATED_INVESTOR 2
# rule: OBFUSCATED_OPPORTUNITY
# added 2005-05-11
# edit 2006-01-13: proper case fix
# test: spam-2005-05-11/df-2005-05-11-002515.txt
# fail: hard_ham/00229.0870e13cd0b783d3d0b32826fa06bef3
body OBFUSCATED_OPPORTUNITY /(?![Oo]pportunit|OPPORTUNIT)[Oo0][Pp][Pp][Oo0][Rr][Tt+][UuVv][Nn][Ii1l][Tt+]/
describe OBFUSCATED_OPPORTUNITY Opportunity with w4r3z spelling
score OBFUSCATED_OPPORTUNITY 2
# rule: OBFUSCATED_OUTSTANDING
# added 2005-05-11
# edit 2006-01-13: proper case fix
# test: spam-2005-05-11/df-2005-05-11-003838.txt
body OBFUSCATED_OUTSTANDING /(?![Oo]utstanding|OUTSTANDING)[Oo0][Uu][Tt+][Ss5][Tt+][Aa4][Nn][Dd][Ii1l][Nn][Gg6]/
describe OBFUSCATED_OUTSTANDING Outstanding with w4r3z spelling
score OBFUSCATED_OUTSTANDING 2
# rule: OBFUSCATED_VALUATION
# added 2005-05-11
# edit 2006-01-13: proper case fix
# test: spam-2005-05-11/df-2005-05-11-001230.txt
body OBFUSCATED_VALUATION /(?![Vv]aluation|VALUATION)[VvUu][Aa4][Ll1I][UuVv][Aa4][Tt+][Ii1l][Oo0][Nn]/
describe OBFUSCATED_VALUATION Valuation with w4r3z spelling
score OBFUSCATED_VALUATION 2
# rule: OBFUSCATED_DOLLARS
# added 2005-05-11
# test: spam-2005-05-11/df-2005-05-11-007386.txt
body OBFUSCATED_DOLLARS /\$[1-9][0-9,]{0,15}[Ool]{1,7}[,0-9]{0,15}\b/
describe OBFUSCATED_DOLLARS Dollar amount with embedded obfuscated number
score OBFUSCATED_DOLLARS 1