1# CREDIT-DEBT-PATTERNS.RC 2# 3# Last updated: 2/17/2011 4 5LOCALSCORE=0 6 7# Adjust base scores for highly-credit-debt-spam-typical patterns that 8# do not in themselves prove that it's this type of spam. 9 10# From/Reply-To Patterns 11# 12:0 13* ^(From|Reply-To):.*[^0-9a-z]([0-9a-z][-_0-9a-z.])*(Credit([^0-9a-z]*Card)?([^0-9a-z]*Debt)?([^0-9a-z]*Free)?|\ 14 Debt([^0-9a-z]*Free)?|\ 15 (Out[^0-9a-z]*)?(Of[^0-9a-z]*)?Debt)[-_0-9a-z]*@ 16* ! ^(From|Reply-To|Subject):.*[^0-9a-z]([0-9a-z][-_0-9a-z.])*(C[1il����][a������]l[1il����]s|\ 17 V[1il����][a������]gr[a������])([^0-9a-z]|$) 18* ! ^Subject:.*[^0-9a-z]Dear [0-9a-z][0-9a-z]*, your [0-9][0-9]% OFF coupon([^0-9a-z]|$) 19{ 20 SBLOG="C3T-${TESTNAME} (From/Reply-To keywords)" 21 INCLUDERC=${SBDIR}/functions/loglevel.rc 22 23 :0 24 * $ ${LOCALSCORE}^0 25 * 2^0 26 { LOCALSCORE=$= } 27} 28 29# Subject Patterns 30:0 31* ^Subject:.*[^0-9a-z](Credit([^0-9a-z]*Card)?([^0-9a-z]*Debt)?([^0-9a-z]*Free)?|\ 32 Debt([^0-9a-z]*Free)?|\ 33 (Out[^0-9a-z]*)?(Of[^0-9a-z]*)?Debt)([^0-9a-z]|$) 34* ! ^(From|Reply-To|Subject):.*[^0-9a-z]([0-9a-z][-_0-9a-z.])*(C[1il����][a������]l[1il����]s|\ 35 V[1il����][a������]gr[a������])([^0-9a-z]|$) 36* ! ^Subject:.*[^0-9a-z]Dear [0-9a-z][0-9a-z]*, your [0-9][0-9]% OFF coupon([^0-9a-z]|$) 37{ 38 SBLOG="C3T-${TESTNAME} (Subject Header Keywords)" 39 INCLUDERC=${SBDIR}/functions/loglevel.rc 40 41 :0 42 * $ ${LOCALSCORE}^0 43 * 3^0 44 { LOCALSCORE=$= } 45} 46 47# Body keywords 48# 49:0 B 50* LEANTAG ?? ^no$ 51* LT4 ?? ^no$ 52* -1000^0 53* -200^1 ^[:;#>] 54* 600^0 (^|[^0-9a-z])([@*a������]+t+[*0o�����]+r+n+[*3e����]+y+s*|\ 55 c+[*0o�����]+[u����]+n+s+[*3e����]+[*1il����]+|\ 56 [*1il����]+[@*a������]+w+y+[*3e����]+r+s*|\ 57 [*1il����]+[*3e����]+g+[@*a������]+[*1il����]+).*\ 58 [^0-9a-z]m+[*1il����]+s+t+[@*a������]+k+[*3e����]+.*\ 59 [^0-9a-z](b+[@*a������]+n+k+([*1il����]+n+g+)?|\ 60 f+[*1il����]+n+[@*a������]+n+c+([*3e����]+|[*1il����]+[@*a������]+[*1il����]+)|\ 61 [*1il����]+[@*a������]+w+s*|\ 62 [*1il����]+[*3e����]+g+[@*a������]+[*1il����]+|\ 63 s+y+s+t+[*3e����]+m+)([^0-9a-z]|$) 64* 600^0 ^[^0-9a-z]*Contact us at:$[^0-9a-z]*1[-]+[0-9][^0-9a-z]*[0-9][^0-9a-z]*[0-9][^0-9a-z]*[-]+[^0-9a-z]*[0-9][^0-9a-z]*[0-9][^0-9a-z]*[0-9][^0-9a-z]*[-]+[^0-9a-z]*[0-9][^0-9a-z]*[0-9][^0-9a-z]*[0-9][^0-9a-z]*[0-9]$ 65* 1100^0 (^|[^0-9a-z])(totally)?(credit)?(card)?debt(free)?([^0-9a-z]|$) 66* 600^0 (^|[^0-9a-z])eliminat(e|ing).*$?.*with[^0-9a-z]*[o0]ut.*[^0-9a-z]pay(ing)?([^0-9a-z]|$) 67* 600^0 (^|[^0-9a-z])([@*a������]+t+[*0o�����]+r+n+[*3e����]+y+s*|\ 68 c+[*0o�����]+[u����]+n+s+[*3e����]+[*1il����]+|\ 69 [*1il����]+[@*a������]+w+y+[*3e����]+r+s*|\ 70 [*1il����]+[*3e����]+g+[@*a������]+[*1il����]+).*\ 71 [^0-9a-z][*1il����]+[*0o�����]+p+[^0-9a-z]*h+[*0o�����]+[*1il����]+[*3e����]+([^0-9a-z]|$) 72* 600^0 (^|[^0-9a-z])[*1il����]+[*0o�����]+p+[^0-9a-z]*h+[*0o�����]+[*1il����]+[*3e����]+.*\ 73 [^0-9a-z](b+[@*a������]+n+k+([*1il����]+n+g+)?|\ 74 f+[*1il����]+n+[@*a������]+n+c+([*3e����]+|[*1il����]+[@*a������]+[*1il����]+)|\ 75 [*1il����]+[@*a������]+w+s*|\ 76 [*1il����]+[*3e����]+g+[@*a������]+[*1il����]+|\ 77 s+y+s+t+[*3e����]+m+)([^0-9a-z]|$) 78* 1100^0 (^|[^0-9a-z])outofdebt([^0-9a-z]|$) 79* 600^0 (^|[^0-9a-z])pay(ing)?.*$?.*[^0-9a-z](another|one more)[^0-9a-z]*(cent|dime)([^0-9a-z]|$) 80{ 81 SBLOG="C3T-${TESTNAME} (Body Keywords)" 82 INCLUDERC=${SBDIR}/functions/loglevel.rc 83 84 :0 85 * $ ${LOCALSCORE}^0 86 * 5^0 87 { LOCALSCORE=$= } 88} 89 90:0 91* -6^0 92* $ ${LOCALSCORE}^0 93{ 94 TESTNAME="${TESTNAME}" 95 TESTSCORE=${TESTSCORE} 96 LT4=yes 97} 98 99 :0 E 100 * -3^0 101 * $ ${LOCALSCORE}^0 102 { 103 TESTNAME="Probable ${TESTNAME}" 104 TESTSCORE=${TESTSCORE2} 105 LT4=yes 106 } 107