]>
Commit | Line | Data |
---|---|---|
b780ea8d SI |
1 | # SpamAssassin rules file: phrase tests |
2 | # | |
3 | # Please don't modify this file as your changes will be overwritten with | |
4 | # the next update. Use /etc/mail/spamassassin/local.cf instead. | |
5 | # See 'perldoc Mail::SpamAssassin::Conf' for details. | |
6 | # | |
7 | # Note: body tests are run with long lines, so be sure to limit the | |
8 | # size of searches; use /.{0,30}/ instead of /.*/ to avoid huge | |
9 | # search times. | |
10 | # | |
11 | # <@LICENSE> | |
12 | # Licensed to the Apache Software Foundation (ASF) under one or more | |
13 | # contributor license agreements. See the NOTICE file distributed with | |
14 | # this work for additional information regarding copyright ownership. | |
15 | # The ASF licenses this file to you under the Apache License, Version 2.0 | |
16 | # (the "License"); you may not use this file except in compliance with | |
17 | # the License. You may obtain a copy of the License at: | |
18 | # | |
19 | # http://www.apache.org/licenses/LICENSE-2.0 | |
20 | # | |
21 | # Unless required by applicable law or agreed to in writing, software | |
22 | # distributed under the License is distributed on an "AS IS" BASIS, | |
23 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
24 | # See the License for the specific language governing permissions and | |
25 | # limitations under the License. | |
26 | # </@LICENSE> | |
27 | # | |
28 | ########################################################################### | |
29 | ||
21dcadbf | 30 | require_version 4.000000 |
b780ea8d SI |
31 | |
32 | ########################################################################### | |
33 | ||
34 | # new way to phrase unsubscribe link | |
35 | body REMOVE_BEFORE_LINK m{(?:no thanks|not interested|unsubscribe here).{0,5}http://}i | |
36 | describe REMOVE_BEFORE_LINK Removal phrase right before a link | |
37 | ||
38 | ########################################################################### | |
39 | # CLICK rules | |
40 | # note HTML_LINK_CLICK* rules in HTML parser section | |
41 | ||
42 | ||
43 | body GUARANTEED_100_PERCENT /100% GUARANTEED/i | |
44 | describe GUARANTEED_100_PERCENT One hundred percent guaranteed | |
45 | body DEAR_FRIEND /^\s*Dear Friend\b/i | |
46 | describe DEAR_FRIEND Dear Friend? That's not very dear! | |
47 | body DEAR_SOMETHING /\bDear (?:IT\W|Internet|candidate|sirs?|madam|investor|travell?er|car shopper|web)\b/i | |
48 | describe DEAR_SOMETHING Contains 'Dear (something)' | |
49 | body BILLION_DOLLARS /[BM]ILLION DOLLAR/ | |
50 | describe BILLION_DOLLARS Talks about lots of money | |
51 | ||
52 | body EXCUSE_4 /To Be Removed,? Please/i | |
53 | describe EXCUSE_4 Claims you can be removed from the list | |
54 | ||
55 | # strange pattern because otherwise it matches the std. majordomo line | |
56 | # pls note the comment above. DO NOT just put "to" in the first group! | |
57 | ||
58 | body EXCUSE_REMOVE /to be removed from.{0,20}(?:mailings|offers)/i | |
59 | describe EXCUSE_REMOVE Talks about how to be removed from mailings | |
60 | ||
61 | body STRONG_BUY /strong buy/i | |
62 | describe STRONG_BUY Tells you about a strong buy | |
63 | ||
64 | ||
65 | body STOCK_ALERT /\bstock alert/i | |
66 | describe STOCK_ALERT Offers a alert about a stock | |
67 | body NOT_ADVISOR /not a registered investment advisor/i | |
68 | describe NOT_ADVISOR Not registered investment advisor | |
69 | ||
70 | ||
71 | body PREST_NON_ACCREDITED /prestigi?ous\b.{0,20}\bnon-accredited\b.{0,20}\buniversities/i | |
72 | describe PREST_NON_ACCREDITED 'Prestigious Non-Accredited Universities' | |
73 | ||
74 | body BODY_ENHANCEMENT /\b(?:enlarge|increase|grow|lengthen|larger\b|bigger\b|longer\b|thicker\b|\binches\b).{0,50}\b(?:penis|male organ|pee[ -]?pee|dick|sc?hlong|wh?anger|breast(?!\s+cancer))/i | |
75 | describe BODY_ENHANCEMENT Information on growing body parts | |
76 | ||
77 | body BODY_ENHANCEMENT2 /\b(?:penis|male organ|pee[ -]?pee|dick|sc?hlong|wh?anger|breast(?!\s+cancer)).{0,50}\b(?:enlarge|increase|grow|lengthen|larger\b|bigger\b|longer\b|thicker\b|\binches\b|size)/i | |
78 | describe BODY_ENHANCEMENT2 Information on getting larger body parts | |
79 | ||
80 | body IMPOTENCE /\b(?:impotence (?:problem|cure|solution)|Premature Ejaculation|erectile dysfunction)/i | |
81 | describe IMPOTENCE Impotence cure | |
82 | ||
83 | ||
84 | ||
85 | #MOVED TO 20_rules_to_sandbox.cf - kmcgrail 2015-05-14 | |
86 | #body NA_DOLLARS /\b(?:\d{1,3})?Million\b.{0,40}\b(?:Canadian Dollar?s?|US\$|U\.? ?S\.? Dollar)/i | |
87 | #describe NA_DOLLARS Talks about a million North American dollars | |
88 | # | |
89 | #body US_DOLLARS_3 /(?:\$|usd).?\d{1,3}[,.]\d{3}[,.]\d{3}(?:[,.]\d\d)?/i | |
90 | #describe US_DOLLARS_3 Mentions millions of $ ($NN,NNN,NNN.NN) | |
91 | # | |
92 | #body MILLION_USD /Million\b.{0,40}\b(?:United States? Dollars?|USD)/i | |
93 | #describe MILLION_USD Talks about millions of dollars | |
94 | ||
95 | ||
96 | ||
97 | body __URG_BIZ /urgent.{0,16}(?:assistance|business|buy|confidential|notice|proposal|reply|request|response)/i | |
98 | meta URG_BIZ __URG_BIZ | |
99 | describe URG_BIZ Contains urgent matter | |
100 | ||
101 | ||
102 | ||
103 | body MONEY_BACK /money back guarantee/i | |
104 | describe MONEY_BACK Money back guarantee | |
105 | ||
106 | ||
107 | ||
108 | body FREE_QUOTE_INSTANT /free.{0,12}(?:(?:instant|express|online|no.?obligation).{0,4})+.{0,32}\bquote/i | |
109 | describe FREE_QUOTE_INSTANT Free express or no-obligation quote | |
110 | ||
151f49fd | 111 | body BAD_CREDIT /\b(?:(?:bad|poor|eliminate|repair|(?:re)?establish|damag).{0,10} (?:credit|debt)|no credit (?:check|histor|need))/i |
b780ea8d SI |
112 | describe BAD_CREDIT Eliminate Bad Credit |
113 | ||
114 | ||
115 | body REFINANCE_YOUR_HOME /\brefinance your(?: current)? (?:home|house)\b/i | |
116 | describe REFINANCE_YOUR_HOME Home refinancing | |
117 | ||
118 | body REFINANCE_NOW /time to refinance|refinanc\w{1,3}\b.{0,16}\bnow\b/i | |
119 | describe REFINANCE_NOW Home refinancing | |
120 | ||
121 | body NO_MEDICAL /\bno medical exam/i | |
122 | describe NO_MEDICAL No Medical Exams | |
123 | ||
124 | ||
125 | # seems like we vastly reduce FPs on this one with a small change or two | |
126 | body DIET_1 /\b(?:(?:without|no) (?:exercis(?:e(?! price)|ing)|dieting)|weight.?loss|(?:extra|lose|lost|losing).{0,10}(?:pounds|weight|inches|lbs)|burn.{1,10}fat)\b/i | |
127 | describe DIET_1 Lose Weight Spam | |
128 | ||
129 | ||
130 | body FIN_FREE /\bfinancial(?:ly)? (?:free|independen)/i | |
131 | describe FIN_FREE Freedom of a financial nature | |
132 | ||
133 | body FORWARD_LOOKING /\bcontains forward-looking statements\b/i | |
134 | describe FORWARD_LOOKING Stock Disclaimer Statement | |
135 | ||
136 | body ONE_TIME /\bone\W+time (?:charge|investment|offer|promotion)/i | |
137 | describe ONE_TIME One Time Rip Off | |
138 | ||
139 | body JOIN_MILLIONS /\bjoin (?:millions|thousands)\b/i | |
140 | describe JOIN_MILLIONS Join Millions of Americans | |
141 | ||
142 | body MARKETING_PARTNERS /\b(?:marketing|network) partner|\bpartner (?:web)?site/i | |
143 | describe MARKETING_PARTNERS Claims you registered with a partner | |
144 | ||
145 | body LOW_PRICE /\blow.{0,4} (?-i:P)rice/i | |
146 | describe LOW_PRICE Lowest Price | |
147 | ||
148 | body UNCLAIMED_MONEY /\bunclaimed\s(?:assets?|accounts?|mon(?:ey|ies)|balance|funds?|prizes?|rewards?|payments?|deposits?)\b/i | |
149 | describe UNCLAIMED_MONEY People just leave money laying around | |
150 | ||
151 | body OBSCURED_EMAIL /\w+\^\S+\(\w{2,4}\b/ | |
152 | describe OBSCURED_EMAIL Message seems to contain rot13ed address | |
153 | ||
154 | body BANG_OPRAH /\boprah!/i | |
155 | describe BANG_OPRAH Talks about Oprah with an exclamation! | |
156 | ||
157 | #adding boundary checks: https://issues.apache.org/SpamAssassin/show_bug.cgi?id=6870 | |
158 | body ACT_NOW_CAPS /\bA(?i:ct) N(?i:ow)\b/ | |
159 | describe ACT_NOW_CAPS Talks about 'acting now' with capitals | |
160 | ||
161 | body MORE_SEX /increased?.{0,9}(?:sex|stamina)/i | |
162 | describe MORE_SEX Talks about a bigger drive for sex | |
163 | ||
164 | # explicitly capped at 1.0 score because of FP potential | |
165 | body BANG_GUAR /\bguaranteed?\!/i | |
166 | describe BANG_GUAR Something is emphatically guaranteed | |
167 | ||
168 | ||
169 | ||
170 | body __RUDE_HTML_1 /Get a capable html e-mailer/i | |
171 | body __RUDE_HTML_2 /not support the display of HTML. Please view this message in a different/i | |
172 | body __RUDE_HTML_3 /This message contains an HTML formatted message but your email client does/i | |
173 | body __RUDE_HTML_4 /Your mailer do not support HTML messages. Switch to a better mailer/i | |
174 | meta RUDE_HTML __RUDE_HTML_1 || __RUDE_HTML_2 || __RUDE_HTML_3 || __RUDE_HTML_4 | |
175 | describe RUDE_HTML Spammer message says you need an HTML mailer | |
176 | ||
177 | body INVESTMENT_ADVICE /\binvestment advice/i | |
178 | describe INVESTMENT_ADVICE Message mentions investment advice | |
179 | ||
180 | ||
181 | body MALE_ENHANCE /male enhancement/i | |
182 | describe MALE_ENHANCE Message talks about enhancing men | |
183 | ||
184 | body PRICES_ARE_AFFORDABLE /\baffordable .{0,10}prices\b/i | |
185 | describe PRICES_ARE_AFFORDABLE Message says that prices aren't too expensive | |
186 | ||
187 | body REPLICA_WATCH /\breplica.{1,20}rolex/i | |
188 | describe REPLICA_WATCH Message talks about a replica watch | |
189 | ||
190 | body EM_ROLEX /[^\s\w.]rolex/i | |
191 | describe EM_ROLEX Message puts emphasis on the watch manufacturer | |
192 |