# CREDIT-DEBT-PATTERNS.RC # # Last updated: 2/17/2011 LOCALSCORE=0 # Adjust base scores for highly-credit-debt-spam-typical patterns that # do not in themselves prove that it's this type of spam. # From/Reply-To Patterns # :0 * ^(From|Reply-To):.*[^0-9a-z]([0-9a-z][-_0-9a-z.])*(Credit([^0-9a-z]*Card)?([^0-9a-z]*Debt)?([^0-9a-z]*Free)?|\ Debt([^0-9a-z]*Free)?|\ (Out[^0-9a-z]*)?(Of[^0-9a-z]*)?Debt)[-_0-9a-z]*@ * ! ^(From|Reply-To|Subject):.*[^0-9a-z]([0-9a-z][-_0-9a-z.])*(C[1ilмноп][aабвгде]l[1ilмноп]s|\ V[1ilмноп][aабвгде]gr[aабвгде])([^0-9a-z]|$) * ! ^Subject:.*[^0-9a-z]Dear [0-9a-z][0-9a-z]*, your [0-9][0-9]% OFF coupon([^0-9a-z]|$) { SBLOG="C3T-${TESTNAME} (From/Reply-To keywords)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${LOCALSCORE}^0 * 2^0 { LOCALSCORE=$= } } # Subject Patterns :0 * ^Subject:.*[^0-9a-z](Credit([^0-9a-z]*Card)?([^0-9a-z]*Debt)?([^0-9a-z]*Free)?|\ Debt([^0-9a-z]*Free)?|\ (Out[^0-9a-z]*)?(Of[^0-9a-z]*)?Debt)([^0-9a-z]|$) * ! ^(From|Reply-To|Subject):.*[^0-9a-z]([0-9a-z][-_0-9a-z.])*(C[1ilмноп][aабвгде]l[1ilмноп]s|\ V[1ilмноп][aабвгде]gr[aабвгде])([^0-9a-z]|$) * ! ^Subject:.*[^0-9a-z]Dear [0-9a-z][0-9a-z]*, your [0-9][0-9]% OFF coupon([^0-9a-z]|$) { SBLOG="C3T-${TESTNAME} (Subject Header Keywords)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${LOCALSCORE}^0 * 3^0 { LOCALSCORE=$= } } # Body keywords # :0 B * LEANTAG ?? ^no$ * LT4 ?? ^no$ * -1000^0 * -200^1 ^[:;#>] * 600^0 (^|[^0-9a-z])([@*aабвгде]+t+[*0oтуфхц]+r+n+[*3eийкл]+y+s*|\ c+[*0oтуфхц]+[uщъыь]+n+s+[*3eийкл]+[*1ilмноп]+|\ [*1ilмноп]+[@*aабвгде]+w+y+[*3eийкл]+r+s*|\ [*1ilмноп]+[*3eийкл]+g+[@*aабвгде]+[*1ilмноп]+).*\ [^0-9a-z]m+[*1ilмноп]+s+t+[@*aабвгде]+k+[*3eийкл]+.*\ [^0-9a-z](b+[@*aабвгде]+n+k+([*1ilмноп]+n+g+)?|\ f+[*1ilмноп]+n+[@*aабвгде]+n+c+([*3eийкл]+|[*1ilмноп]+[@*aабвгде]+[*1ilмноп]+)|\ [*1ilмноп]+[@*aабвгде]+w+s*|\ [*1ilмноп]+[*3eийкл]+g+[@*aабвгде]+[*1ilмноп]+|\ s+y+s+t+[*3eийкл]+m+)([^0-9a-z]|$) * 600^0 ^[^0-9a-z]*Contact us at:$[^0-9a-z]*1[-]+[0-9][^0-9a-z]*[0-9][^0-9a-z]*[0-9][^0-9a-z]*[-]+[^0-9a-z]*[0-9][^0-9a-z]*[0-9][^0-9a-z]*[0-9][^0-9a-z]*[-]+[^0-9a-z]*[0-9][^0-9a-z]*[0-9][^0-9a-z]*[0-9][^0-9a-z]*[0-9]$ * 1100^0 (^|[^0-9a-z])(totally)?(credit)?(card)?debt(free)?([^0-9a-z]|$) * 600^0 (^|[^0-9a-z])eliminat(e|ing).*$?.*with[^0-9a-z]*[o0]ut.*[^0-9a-z]pay(ing)?([^0-9a-z]|$) * 600^0 (^|[^0-9a-z])([@*aабвгде]+t+[*0oтуфхц]+r+n+[*3eийкл]+y+s*|\ c+[*0oтуфхц]+[uщъыь]+n+s+[*3eийкл]+[*1ilмноп]+|\ [*1ilмноп]+[@*aабвгде]+w+y+[*3eийкл]+r+s*|\ [*1ilмноп]+[*3eийкл]+g+[@*aабвгде]+[*1ilмноп]+).*\ [^0-9a-z][*1ilмноп]+[*0oтуфхц]+p+[^0-9a-z]*h+[*0oтуфхц]+[*1ilмноп]+[*3eийкл]+([^0-9a-z]|$) * 600^0 (^|[^0-9a-z])[*1ilмноп]+[*0oтуфхц]+p+[^0-9a-z]*h+[*0oтуфхц]+[*1ilмноп]+[*3eийкл]+.*\ [^0-9a-z](b+[@*aабвгде]+n+k+([*1ilмноп]+n+g+)?|\ f+[*1ilмноп]+n+[@*aабвгде]+n+c+([*3eийкл]+|[*1ilмноп]+[@*aабвгде]+[*1ilмноп]+)|\ [*1ilмноп]+[@*aабвгде]+w+s*|\ [*1ilмноп]+[*3eийкл]+g+[@*aабвгде]+[*1ilмноп]+|\ s+y+s+t+[*3eийкл]+m+)([^0-9a-z]|$) * 1100^0 (^|[^0-9a-z])outofdebt([^0-9a-z]|$) * 600^0 (^|[^0-9a-z])pay(ing)?.*$?.*[^0-9a-z](another|one more)[^0-9a-z]*(cent|dime)([^0-9a-z]|$) { SBLOG="C3T-${TESTNAME} (Body Keywords)" INCLUDERC=${SBDIR}/functions/loglevel.rc :0 * $ ${LOCALSCORE}^0 * 5^0 { LOCALSCORE=$= } } :0 * -6^0 * $ ${LOCALSCORE}^0 { TESTNAME="${TESTNAME}" TESTSCORE=${TESTSCORE} LT4=yes } :0 E * -3^0 * $ ${LOCALSCORE}^0 { TESTNAME="Probable ${TESTNAME}" TESTSCORE=${TESTSCORE2} LT4=yes }