sa-updates/20_phrases.cf

   1 # SpamAssassin rules file: phrase tests
   2 #
   3 # Please don't modify this file as your changes will be overwritten with
   4 # the next update. Use /etc/mail/spamassassin/local.cf instead.
   5 # See 'perldoc Mail::SpamAssassin::Conf' for details.
   6 #
   7 # Note: body tests are run with long lines, so be sure to limit the
   8 # size of searches; use /.{0,30}/ instead of /.*/ to avoid huge
   9 # search times.
  10 #
  11 # <@LICENSE>
  12 # Licensed to the Apache Software Foundation (ASF) under one or more
  13 # contributor license agreements.  See the NOTICE file distributed with
  14 # this work for additional information regarding copyright ownership.
  15 # The ASF licenses this file to you under the Apache License, Version 2.0
  16 # (the "License"); you may not use this file except in compliance with
  17 # the License.  You may obtain a copy of the License at:
  18 #
  19 #     http://www.apache.org/licenses/LICENSE-2.0
  20 #
  21 # Unless required by applicable law or agreed to in writing, software
  22 # distributed under the License is distributed on an "AS IS" BASIS,
  23 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  24 # See the License for the specific language governing permissions and
  25 # limitations under the License.
  26 # </@LICENSE>
  27 #
  28 ###########################################################################
  29
  30 require_version 4.000000
  31
  32 ###########################################################################
  33
  34 # new way to phrase unsubscribe link
  35 body REMOVE_BEFORE_LINK         m{(?:no thanks|not interested|unsubscribe here).{0,5}http://}i
  36 describe REMOVE_BEFORE_LINK     Removal phrase right before a link
  37
  38 ###########################################################################
  39 # CLICK rules
  40 # note HTML_LINK_CLICK* rules in HTML parser section
  41
  42
  43 body GUARANTEED_100_PERCENT     /100% GUARANTEED/i
  44 describe GUARANTEED_100_PERCENT One hundred percent guaranteed
  45 body DEAR_FRIEND                /^\s*Dear Friend\b/i
  46 describe DEAR_FRIEND            Dear Friend? That's not very dear!
  47 body DEAR_SOMETHING             /\bDear (?:IT\W|Internet|candidate|sirs?|madam|investor|travell?er|car shopper|web)\b/i
  48 describe DEAR_SOMETHING         Contains 'Dear (something)'
  49 body BILLION_DOLLARS            /[BM]ILLION DOLLAR/
  50 describe BILLION_DOLLARS        Talks about lots of money
  51
  52 body EXCUSE_4                   /To Be Removed,? Please/i
  53 describe EXCUSE_4               Claims you can be removed from the list
  54
  55 # strange pattern because otherwise it matches the std. majordomo line
  56 # pls note the comment above. DO NOT just put "to" in the first group!
  57
  58 body EXCUSE_REMOVE              /to be removed from.{0,20}(?:mailings|offers)/i
  59 describe EXCUSE_REMOVE          Talks about how to be removed from mailings
  60
  61 body STRONG_BUY                 /strong buy/i
  62 describe STRONG_BUY             Tells you about a strong buy
  63
  64
  65 body STOCK_ALERT                /\bstock alert/i
  66 describe STOCK_ALERT            Offers a alert about a stock
  67 body NOT_ADVISOR                /not a registered investment advisor/i
  68 describe NOT_ADVISOR            Not registered investment advisor
  69
  70
  71 body PREST_NON_ACCREDITED       /prestigi?ous\b.{0,20}\bnon-accredited\b.{0,20}\buniversities/i
  72 describe PREST_NON_ACCREDITED   'Prestigious Non-Accredited Universities'
  73
  74 body BODY_ENHANCEMENT           /\b(?:enlarge|increase|grow|lengthen|larger\b|bigger\b|longer\b|thicker\b|\binches\b).{0,50}\b(?:penis|male organ|pee[ -]?pee|dick|sc?hlong|wh?anger|breast(?!\s+cancer))/i
  75 describe BODY_ENHANCEMENT       Information on growing body parts
  76
  77 body BODY_ENHANCEMENT2          /\b(?:penis|male organ|pee[ -]?pee|dick|sc?hlong|wh?anger|breast(?!\s+cancer)).{0,50}\b(?:enlarge|increase|grow|lengthen|larger\b|bigger\b|longer\b|thicker\b|\binches\b|size)/i
  78 describe BODY_ENHANCEMENT2      Information on getting larger body parts
  79
  80 body     IMPOTENCE              /\b(?:impotence (?:problem|cure|solution)|Premature Ejaculation|erectile dysfunction)/i
  81 describe IMPOTENCE              Impotence cure
  82
  83
  84
  85 #MOVED TO 20_rules_to_sandbox.cf - kmcgrail 2015-05-14
  86 #body NA_DOLLARS                        /\b(?:\d{1,3})?Million\b.{0,40}\b(?:Canadian Dollar?s?|US\$|U\.? ?S\.? Dollar)/i
  87 #describe NA_DOLLARS            Talks about a million North American dollars
  88 #
  89 #body US_DOLLARS_3               /(?:\$|usd).?\d{1,3}[,.]\d{3}[,.]\d{3}(?:[,.]\d\d)?/i
  90 #describe US_DOLLARS_3           Mentions millions of $ ($NN,NNN,NNN.NN)
  91 #
  92 #body MILLION_USD               /Million\b.{0,40}\b(?:United States? Dollars?|USD)/i
  93 #describe MILLION_USD           Talks about millions of dollars
  94
  95
  96
  97 body     __URG_BIZ              /urgent.{0,16}(?:assistance|business|buy|confidential|notice|proposal|reply|request|response)/i
  98 meta     URG_BIZ                __URG_BIZ
  99 describe URG_BIZ                Contains urgent matter
 100
 101
 102
 103 body     MONEY_BACK             /money back guarantee/i
 104 describe MONEY_BACK             Money back guarantee
 105
 106
 107
 108 body FREE_QUOTE_INSTANT         /free.{0,12}(?:(?:instant|express|online|no.?obligation).{0,4})+.{0,32}\bquote/i
 109 describe FREE_QUOTE_INSTANT     Free express or no-obligation quote
 110
 111 body BAD_CREDIT                 /\b(?:(?:bad|poor|eliminate|repair|(?:re)?establish|damag).{0,10} (?:credit|debt)|no credit (?:check|histor|need))/i
 112 describe BAD_CREDIT             Eliminate Bad Credit
 113
 114
 115 body REFINANCE_YOUR_HOME        /\brefinance your(?: current)? (?:home|house)\b/i
 116 describe REFINANCE_YOUR_HOME    Home refinancing
 117
 118 body REFINANCE_NOW              /time to refinance|refinanc\w{1,3}\b.{0,16}\bnow\b/i
 119 describe REFINANCE_NOW          Home refinancing
 120
 121 body NO_MEDICAL                 /\bno medical exam/i
 122 describe NO_MEDICAL             No Medical Exams
 123
 124
 125 # seems like we vastly reduce FPs on this one with a small change or two
 126 body DIET_1             /\b(?:(?:without|no) (?:exercis(?:e(?! price)|ing)|dieting)|weight.?loss|(?:extra|lose|lost|losing).{0,10}(?:pounds|weight|inches|lbs)|burn.{1,10}fat)\b/i
 127 describe DIET_1         Lose Weight Spam
 128
 129
 130 body FIN_FREE                   /\bfinancial(?:ly)? (?:free|independen)/i
 131 describe FIN_FREE               Freedom of a financial nature
 132
 133 body FORWARD_LOOKING            /\bcontains forward-looking statements\b/i
 134 describe FORWARD_LOOKING        Stock Disclaimer Statement
 135
 136 body ONE_TIME                   /\bone\W+time (?:charge|investment|offer|promotion)/i
 137 describe ONE_TIME               One Time Rip Off
 138
 139 body JOIN_MILLIONS              /\bjoin (?:millions|thousands)\b/i
 140 describe JOIN_MILLIONS          Join Millions of Americans
 141
 142 body MARKETING_PARTNERS         /\b(?:marketing|network) partner|\bpartner (?:web)?site/i
 143 describe MARKETING_PARTNERS     Claims you registered with a partner
 144
 145 body LOW_PRICE                  /\blow.{0,4} (?-i:P)rice/i
 146 describe LOW_PRICE              Lowest Price
 147
 148 body UNCLAIMED_MONEY            /\bunclaimed\s(?:assets?|accounts?|mon(?:ey|ies)|balance|funds?|prizes?|rewards?|payments?|deposits?)\b/i
 149 describe UNCLAIMED_MONEY        People just leave money laying around
 150
 151 body OBSCURED_EMAIL             /\w+\^\S+\(\w{2,4}\b/
 152 describe OBSCURED_EMAIL         Message seems to contain rot13ed address
 153
 154 body BANG_OPRAH                 /\boprah!/i
 155 describe BANG_OPRAH             Talks about Oprah with an exclamation!
 156
 157 #adding boundary checks: https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6870
 158 body ACT_NOW_CAPS               /\bA(?i:ct) N(?i:ow)\b/
 159 describe ACT_NOW_CAPS           Talks about 'acting now' with capitals
 160
 161 body MORE_SEX               /increased?.{0,9}(?:sex|stamina)/i
 162 describe MORE_SEX               Talks about a bigger drive for sex
 163
 164 # explicitly capped at 1.0 score because of FP potential
 165 body BANG_GUAR                  /\bguaranteed?\!/i
 166 describe BANG_GUAR              Something is emphatically guaranteed
 167
 168
 169
 170 body __RUDE_HTML_1      /Get a capable html e-mailer/i
 171 body __RUDE_HTML_2      /not support the display of HTML. Please view this message in a different/i
 172 body __RUDE_HTML_3      /This message contains an HTML formatted message but your email client does/i
 173 body __RUDE_HTML_4      /Your mailer do not support HTML messages. Switch to a better mailer/i
 174 meta RUDE_HTML          __RUDE_HTML_1 || __RUDE_HTML_2 || __RUDE_HTML_3 || __RUDE_HTML_4
 175 describe RUDE_HTML      Spammer message says you need an HTML mailer
 176
 177 body INVESTMENT_ADVICE          /\binvestment advice/i
 178 describe INVESTMENT_ADVICE      Message mentions investment advice
 179
 180
 181 body MALE_ENHANCE       /male enhancement/i
 182 describe MALE_ENHANCE   Message talks about enhancing men
 183
 184 body PRICES_ARE_AFFORDABLE      /\baffordable .{0,10}prices\b/i
 185 describe PRICES_ARE_AFFORDABLE  Message says that prices aren't too expensive
 186
 187 body REPLICA_WATCH /\breplica.{1,20}rolex/i
 188 describe REPLICA_WATCH  Message talks about a replica watch
 189
 190 body EM_ROLEX /[^\s\w.]rolex/i
 191 describe EM_ROLEX       Message puts emphasis on the watch manufacturer
 192