On Thu, 11 Mar 2004, Nicholas Venturella wrote:
> This message slipped by with only 0.9 points... maybe it can be used to
> create some more rules?
[419 scam snipped]
Even missing all the headers, this one scored 8.3 on my
system. The keys (watch line-wrap!):
body __CRF_THIRDWORLD /(?"ghana|nigeria|sierra leone|south
africa|c.te .{0,2}ivoire|liberia|lagos|zimbabwe|botswana|abijan|congo)/i
describe __CRF_THIRDWORLD Mentions third world nations well known for
scams
body __CRF_FARMERS /(?:white|black) farmers/i
describe __CRF_FARMERS Talks about white or black farmers
body __CRF_KILLING /(?:murder|kill|slay|assassinate|poison)/i
describe __CRF_KILLING In here we slay spam, not people!
body __CRF_ASYLUM /(?:asylum|flee|fled|escape)/i
describe __CRF_ASYLUM Talks about asylum or fleeing
body __CRF_EXILE /exile/i
describe __CRF_EXILE Send the 419ers into exile, please!
body __CRF_TINHORNS
/(?:mobutu|mugabe|taylor|savimbi|kabila|sese-?seko)/i
describe __CRF_TINHORNS Talks about African tinhorns
meta CRF_419_TINHORNS ((__CRF_THIRDWORLD + __CRF_TINHORNS +
__CRF_ASYLUM + __CRF_EXILE) > 2)
describe CRF_419_TINHORNS 419 fraud featuring African tinhorns
score CRF_419_TINHORNS 2.75
meta CRF_419_FARMERS ((__CRF_THIRDWORLD + __CRF_FARMERS +
__CRF_KILLING) > 2)
describe CRF_419_FARMERS Talks about the plight of third-world "farmers"
score CRF_419_FARMERS 2.75
Please note that those are alpha-quality rules; I'm actively working
on improving their accuracy. More tinhorns need to be added, as do more
nations.
> For one thing, I know that we are matching "Dear (something)", and even
> "Dear Friend" specifically... but it looks like we are even more dear to
> spammers now as they are calling us "Dearest" :-p
Please, oh PLEASE(!), don't key tests on the word "friend" (note
my surname). You have no idea how often I run afoul of rules like
that.
Also, don't damn someone who starts a letter off with "Dear"; it's
not terribly common these days, but some folks still cling to the
obsolete notion that e-mail is equivalent to a "postal" letter.
> Maybe a rule (with a low point value) that triggers if the message contains
> the name of any African country?
I already do that in some instances with a *tiny* default score, but
with a per-user-overridable value. It's proved useful for some folks,
but not for others; it depends on the individual's traffic. Don't score
any nation's name very high; it'll break all sorts of stuff.
Cheers.
+------------------------------------------------+---------------------+
| Carl Richard Friend (UNIX Sysadmin) | West Boylston |
| Minicomputer Collector / Enthusiast | Massachusetts, USA |
| mailto:[EMAIL PROTECTED] +---------------------+
| http://users.rcn.com/crfriend/museum | ICBM: 42:22N 71:47W |
+------------------------------------------------+---------------------+
