# SARE "General Subject" Ruleset for SpamAssassin - File 2 # Version: 01.03.12 # Created: 2004-09-13 # Modified: 2005-12-27 # Usage instructions and documentation are found in 70_sare_genlsubj0.cf #@@# Revision History: Full Revision History stored in 70_sare_genlsubj.log #@@# 01.03.12: Dec 27 2005 #@@# Minor score updates based on additional mass-check #@@# Archived from file 2: SARE_SUB_ADV_DB #@@# Archived from file 2: SARE_SUB_CARD_BILLED #@@# Moved file 0 to file 2: SARE_SUB_LEGAL_ORDIN #@@# Moved file 0 to file 2: SARE_SUB_ORIG_SOFT #@@# Moved file 0 to file 2: SARE_SUB_SEX_EXP_GAP #@@# Moved file 1 to file 2: SARE_HEAD_ORG_ELITEACT #@@# Moved file 1 to file 2: SARE_SUB_FREE_BANG #@@# Moved file 1 to file 2: SARE_SUB_YOUR_WOMAN #@@# Moved file 2 to file 1: SARE_SUB_REPAIR_BILLS ######## ###################### ################################################## # Category: __rules used by primary rules below ######## ###################### ################################################## # Attempt to identify simple subject obfuscation by character insertion header __SARE_SUB_OBFU_ASTER Subject =~ /[a-zA-Z0]\*[a-zA-Z]/ header __SARE_SUB_OBFU_CARAT Subject =~ /[a-zA-Z0]\^[a-zA-Z]/ header __SARE_SUB_OBFU_COLON Subject =~ /[a-zA-Z0]:[a-zA-Z]/ header __SARE_SUB_OBFU_COMMA Subject =~ /[a-zA-Z0],[a-zA-Z]/ header __SARE_SUB_OBFU_SLASH Subject =~ /[a-zA-Z0]\/[a-zA-Z]/ header __SARE_SUB_OBFU_LQUOT Subject =~ /[a-zA-Z0]`[a-zA-Z]/ header __SARE_SUB_OBFU_PERIOD Subject =~ /[a-zA-Z0]\.[a-zA-Z]/ header __SARE_SUB_OBFU_2PER Subject =~ /[a-zA-Z0]\.\.[a-zA-Z]/ header __SARE_SUB_OBFU_PIPE Subject =~ /[a-zA-Z0]\|[a-zA-Z]/ header __SARE_SUB_OBFU_PLUS Subject =~ /[a-zA-Z0]\+[a-zA-Z]/ header __SARE_SUB_OBFU_QUOTE Subject =~ /[a-zA-Z0]"[a-zA-Z]/ header __SARE_SUB_OBFU_SCOLON Subject =~ /[a-zA-Z0];[a-zA-Z]/ header __SARE_SUB_OBFU_USCORE Subject =~ /[a-zA-Z0]_[a-zA-Z]/ header __SARE_SUB_OBFU_HTTP Subject =~ m*http://*i ######## ###################### ################################################## # Rule definitions to avoid --lint errors on archived/moved rules. ######## ###################### ################################################## meta __SARE_SUB_FALSE __FROM_AOL_COM && !__FROM_AOL_COM meta SARE_SUB_CARTRIDGE_OB __SARE_SUB_FALSE meta SARE_SUB_EXCL_OB __SARE_SUB_FALSE meta SARE_SUB_GAPPY_7 __SARE_SUB_FALSE meta SARE_SUB_GAPPY_8 __SARE_SUB_FALSE meta SARE_SUB_PASSION_OB __SARE_SUB_FALSE meta SARE_SUB_PRINTER_OB __SARE_SUB_FALSE meta SARE_SUB_PROVEN_OB __SARE_SUB_FALSE meta SARE_SUB_TONER_OB __SARE_SUB_FALSE meta SARE_SUB_ADV_DB __SARE_SUB_FALSE meta SARE_SUB_CARD_BILLED __SARE_SUB_FALSE ######## ###################### ################################################## # Category: Adult/Porn ######## ###################### ################################################## header SARE_SUB_SEX_EXP_GAP Subject =~ m'sexually - explicit'i describe SARE_SUB_SEX_EXP_GAP CANSPAM variation score SARE_SUB_SEX_EXP_GAP 1.666 #stype SARE_SUB_SEX_EXP_GAP spamg #counts SARE_SUB_SEX_EXP_GAP 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_SEX_EXP_GAP 6s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #counts SARE_SUB_SEX_EXP_GAP 0s/0h of 54902 corpus (17729s/37173h JH-3.01) 03/13/05 #counts SARE_SUB_SEX_EXP_GAP 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #counts SARE_SUB_SEX_EXP_GAP 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Black market items, services, activities, scams, frauds ######## ###################### ################################################## ######## ###################### ################################################## # Category: Credit, debt, lending, mortgage, borrowing, investment, financing ######## ###################### ################################################## header SARE_SUB_VISA_CARD Subject =~ /Visa\W*(?:card\W*easy|approve\W*all)/i describe SARE_SUB_VISA_CARD Spammer subject - credit or money score SARE_SUB_VISA_CARD 0.277 #hist SARE_SUB_VISA_CARD Created by Bob Menschel Mar 30 2004 #counts SARE_SUB_VISA_CARD 0s/0h of 238420 corpus (112480s/125940h RM) 02/28/05 #max SARE_SUB_VISA_CARD 4s/0h of 115478 corpus (94289s/21189h RM) 04/24/04 #counts SARE_SUB_VISA_CARD 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_VISA_CARD 1s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_VISA_CARD 0s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_VISA_CARD 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Insurance ######## ###################### ################################################## ######## ###################### ################################################## # Category: Marketing, Pricing, Selling, Buying ######## ###################### ################################################## header SARE_SUB_FREE_BANG Subject =~ /\bFree\!/i describe SARE_SUB_FREE_BANG Spammer subject - marketing score SARE_SUB_FREE_BANG 0.700 #stype SARE_SUB_FREE_BANG max:1.0 #ham SARE_SUB_FREE_BANG Dell, Visicom Media #counts SARE_SUB_FREE_BANG 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_FREE_BANG 422s/21h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_FREE_BANG 32s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_FREE_BANG 47s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_FREE_BANG 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_FREE_BANG 16s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 #counts SARE_SUB_FREE_BANG 0s/0h of 9833 corpus (4917s/4916h FT) 12/25/05 #max SARE_SUB_FREE_BANG 2s/1h of 7500 corpus (1767s/5733h ft) 09/18/05 #counts SARE_SUB_FREE_BANG 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_FREE_BANG 133s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 header SARE_SUB_HOT_PROFITS Subject =~ /Hot Profits/i describe SARE_SUB_HOT_PROFITS Subject contains apparent spammer phrasing score SARE_SUB_HOT_PROFITS 0.389 #hist SARE_SUB_HOT_PROFITS Created by Bob Menschel May 31 2004 #counts SARE_SUB_HOT_PROFITS 0s/0h of 291031 corpus (121442s/169589h RM) 04/22/05 #max SARE_SUB_HOT_PROFITS 3s/0h of 58648 corpus (33783s/24865h RM) 08/03/04 #counts SARE_SUB_HOT_PROFITS 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_HOT_PROFITS 2s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_HOT_PROFITS 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_HOT_PROFITS 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_HOT_PROFITS 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #max SARE_SUB_HOT_PROFITS 1s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Medical ######## ###################### ################################################## header __SARE_SUB_LOSE_PCT Subject =~ /lose.{1,20}(?:\d+\%.{1,25}weight|weight.{1,40}\d+\%)/i meta SARE_SUB_LOSE_PCT1 __SARE_SUB_LOSE_PCT && !SUBJECT_DIET describe SARE_SUB_LOSE_PCT1 Common spammer subject header -- Medical score SARE_SUB_LOSE_PCT1 1.666 #hist SARE_SUB_LOSE_PCT1 Created by Bob Menschel from suggested by Loren Wilton, July 24 2004 #hist SARE_SUB_LOSE_PCT1 Bugzilla entry 3863, Oct 03 2004 #v300 SARE_SUB_LOSE_PCT1 Strong overlap with 3.0 subject rule SUBJECT_DIET, though SUBJECT_DIET does not test for "%" #counts SARE_SUB_LOSE_PCT1 0s/0h of 115424 corpus (81069s/34355h RM) 01/16/05 #counts SARE_SUB_LOSE_PCT1 0s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_LOSE_PCT1 150s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #alone SARE_SUB_LOSE_PCT1 106s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #counts SARE_SUB_LOSE_PCT1 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_LOSE_PCT1 24s/0h of 16895 corpus (14482s/2413h MY) 07/26/04 #counts SARE_SUB_LOSE_PCT1 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 meta SARE_SUB_LOSE_PCT2 __SARE_SUB_LOSE_PCT && SUBJECT_DIET describe SARE_SUB_LOSE_PCT2 Common spammer subject header -- Medical score SARE_SUB_LOSE_PCT2 0.311 0.943 1.607 1.400 #adds to SARE_SUB_LOSE_PCT2 score SUBJECT_DIET 1.355 0.723 0.059 0.266 to result in 1.666 #hist SARE_SUB_LOSE_PCT2 Created by Bob Menschel to avoid over-scoring overlap with new 3.0 rule #v300 SARE_SUB_LOSE_PCT2 Strong overlap with 3.0 subject rule SUBJECT_DIET, though SUBJECT_DIET does not test for "%" #counts SARE_SUB_LOSE_PCT2 0s/0h of 280564 corpus (109285s/171279h RM) 05/03/05 #alone SARE_SUB_LOSE_PCT2 1679s/0h of 115424 corpus (81069s/34355h RM) 01/16/05 #counts SARE_SUB_LOSE_PCT2 114s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #counts SARE_SUB_LOSE_PCT2 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_LOSE_PCT2 51s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_LOSE_PCT2 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Religious, including religious scams ######## ###################### ################################################## header SARE_SUB_LEGAL_ORDIN Subject =~ /(?:(?:LEGAL|online)\W*ORDINATION|proceed\W*with.{1,30}ordination)/i describe SARE_SUB_LEGAL_ORDIN Spammer subject - religion score SARE_SUB_LEGAL_ORDIN 0.700 #counts SARE_SUB_LEGAL_ORDIN 0s/0h of 280564 corpus (109285s/171279h RM) 05/03/05 #max SARE_SUB_LEGAL_ORDIN 15s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_LEGAL_ORDIN 0s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_LEGAL_ORDIN 2s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_LEGAL_ORDIN 0s/0h of 40676 corpus (35385s/5291h MY) 12/25/05 #max SARE_SUB_LEGAL_ORDIN 9s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_LEGAL_ORDIN 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Software ######## ###################### ################################################## header SARE_SUB_ORIG_SOFT Subject =~ /\boriginal softwares?\b/i describe SARE_SUB_ORIG_SOFT subject has a spammer subject - Software score SARE_SUB_ORIG_SOFT 1.078 #hist SARE_SUB_ORIG_SOFT Created by Bob Menschel Jul 31 2004 #hist SARE_SUB_ORIG_SOFT Bound \b Jan 27 2005 to avoid overlap with SARE_SUB_ORIG_SOFT_OB #counts SARE_SUB_ORIG_SOFT 0s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #max SARE_SUB_ORIG_SOFT 65s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_ORIG_SOFT 14s/0h of 55803 corpus (18630s/37173h JH-3.01) 06/10/05 #max SARE_SUB_ORIG_SOFT 19s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_ORIG_SOFT 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_ORIG_SOFT 10s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_ORIG_SOFT 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_SW_ON_CD Subject =~ /software\W*(?:on\W*)CD/i describe SARE_SUB_SW_ON_CD Spammer subject - software score SARE_SUB_SW_ON_CD 0.628 #hist SARE_SUB_SW_ON_CD Created by Bob Menschel Apr 09 2004 #counts SARE_SUB_SW_ON_CD 0s/0h of 196665 corpus (96196s/100469h RM) 02/21/05 #max SARE_SUB_SW_ON_CD 7s/0h of 92315 corpus (67942s/24373h RM) 07/24/04 #counts SARE_SUB_SW_ON_CD 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_SW_ON_CD 3s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_SW_ON_CD 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_SW_ON_CD 3s/0h of 38389 corpus (14908s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_SW_ON_CD 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_WP_OFFICE Subject =~ /(?:\%|Sav(?:e|ing)).{1,30}(?:Corel|WordPerfect).{1,30}Office/i describe SARE_SUB_WP_OFFICE Spammer subject - software score SARE_SUB_WP_OFFICE 0.777 #counts SARE_SUB_WP_OFFICE 0s/0h of 280564 corpus (109285s/171279h RM) 05/03/05 #max SARE_SUB_WP_OFFICE 22s/0h of 114218 corpus (81068s/33150h RM) 01/15/05 #counts SARE_SUB_WP_OFFICE 0s/0h of 36108 corpus (12627s/23481h JH) 08/14/04 TM2 SA3.0-pre2 #counts SARE_SUB_WP_OFFICE 0s/0h of 27726 corpus (24280s/3446h MY) 02/27/05 #max SARE_SUB_WP_OFFICE 18s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_WP_OFFICE 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Spamming and Spammers ######## ###################### ################################################## header SARE_HEAD_ORG_ELITEACT Organization =~ /Elite Activity/i describe SARE_HEAD_ORG_ELITEACT Spam sign in Organization header score SARE_HEAD_ORG_ELITEACT 0.111 #hist SARE_HEAD_ORG_ELITEACT Bob Menschel, Feb 27 2005 #counts SARE_HEAD_ORG_ELITEACT 0s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #max SARE_HEAD_ORG_ELITEACT 2s/0h of 400644 corpus (178197s/222447h RM) 04/02/05 #counts SARE_HEAD_ORG_ELITEACT 0s/0h of 10824 corpus (6376s/4448h CT) 05/04/05 #counts SARE_HEAD_ORG_ELITEACT 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 ######## ###################### ################################################## # Category: Generic words and phrases ######## ###################### ################################################## header SARE_SUB_PERS_KNOW Subject =~ /Person you know/i describe SARE_SUB_PERS_KNOW common spammer phrasing score SARE_SUB_PERS_KNOW 0.711 #hist SARE_SUB_PERS_KNOW Created by Bob Menschel Oct 25 2004 #counts SARE_SUB_PERS_KNOW 0s/0h of 297244 corpus (135824s/161420h RM) 06/12/05 #max SARE_SUB_PERS_KNOW 20s/0h of 196667 corpus (96194s/100473h RM) 02/21/05 #counts SARE_SUB_PERS_KNOW 4s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_PERS_KNOW 0s/0h of 49034 corpus (44877s/4157h MY) 06/11/05 #max SARE_SUB_PERS_KNOW 2s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_PERS_KNOW 0s/0h of 10629 corpus (5847s/4782h CT) 09/18/05 #max SARE_SUB_PERS_KNOW 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_YOUR_LISTING Subject =~ /^\s*your listing (?:at|on) /i describe SARE_SUB_YOUR_LISTING subject has a spammer subject - Listings score SARE_SUB_YOUR_LISTING 0.617 #hist SARE_SUB_YOUR_LISTING Created by Bob Menschel Jul 31 2004 #counts SARE_SUB_YOUR_LISTING 0s/0h of 238420 corpus (112480s/125940h RM) 02/28/05 #max SARE_SUB_YOUR_LISTING 10s/0h of 114228 corpus (81069s/33159h RM) 01/15/05 #counts SARE_SUB_YOUR_LISTING 0s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #max SARE_SUB_YOUR_LISTING 1s/0h of 54154 corpus (16979s/37175h JH-3.01) 02/01/05 #counts SARE_SUB_YOUR_LISTING 0s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_YOUR_LISTING 0s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 header SARE_SUB_YOUR_WOMAN Subject =~ /Your woman/i describe SARE_SUB_YOUR_WOMAN subject has likely spammer phrase or word score SARE_SUB_YOUR_WOMAN 1.666 #ham SARE_SUB_YOUR_WOMAN verified (1) #counts SARE_SUB_YOUR_WOMAN 0s/0h of 428457 corpus (182181s/246276h RM) 12/24/05 #max SARE_SUB_YOUR_WOMAN 194s/0h of 689155 corpus (348140s/341015h RM) 09/18/05 #counts SARE_SUB_YOUR_WOMAN 0s/0h of 43961 corpus (40110s/3851h MY) 05/04/05 #max SARE_SUB_YOUR_WOMAN 5s/0h of 32844 corpus (32843s/3308h MY) 01/16/05 #counts SARE_SUB_YOUR_WOMAN 3s/0h of 54018 corpus (16845s/37173h JH-3.01) 06/11/05 #counts SARE_SUB_YOUR_WOMAN 0s/0h of 11553 corpus (6185s/5368h CT) 12/25/05 #max SARE_SUB_YOUR_WOMAN 2s/0h of 11030 corpus (6598s/4432h CT) 03/10/05 ######## ###################### ################################################## # Category: Technical rules ######## ###################### ################################################## # EOF