ifplugin Mail::SpamAssassin::Plugin::ReplaceTags replace_tag CURRENCY [\(\[]?(?:\bUS[D\$]{0,2}|\$(?:US)?|GBP|=[Aa][34]|\xa3|[Pp]ounds\s[Ss]terling|\xa4|EUR|[Ee]uros?|[Ee][Uu][Rr]\sde)[\]\)]? replace_tag GB_UK \b(?:U\.?K\.?|(?:Great\s)?Brit(?:ain|ish)|G\.?B\.?)\b body __LOTSA_MONEY_00 /\s?\d[\dO][,\.][\dO]{3}(?:(?!\d)|\b)/ body __LOTSA_MONEY_01 /(?:[Ss][Uu][Mm]\s[Oo][Ff]\s|\s?)\s?\d[\d.,\sO]{5,20}[\dO]/ body __LOTSA_MONEY_02 /\d[\d.,\sO]{5,20}[\dO]\s?(?:|Pounds)\b/ body __LOTSA_MONEY_03 /(?:[Ss][Uu][Mm]\s[Oo][Ff]\s|\s?)\d(?:[\d.,\sO]{0,5})?(?:[Mm](?:[Ii][Ll])?\b|[Mm][Ii][Ll]+(?:[Ii][Oo]|)[Nn]|[Hh][Uu][Nn][Dd][RrEe]+[DdTt]|[Tt][Hh][Oo][Uu][Ss][Aa][Nn][Dd]|[Tt][Aa][Uu][Ss][Ee][Nn][Dd])/ body __LOTSA_MONEY_04 /(?:million(?!s)|milln|hundred(?!s)[^\.]{1,25}thousand(?!s)|cents?[^\.]{1,25}mille|hundert[^\.]{1,30}tausend|ientos?[^\.]{1,20}mil)[^\.\$]{0,50}(?:(?:U\.?\s?S\.?\s?(?:A\.?\s?)?|united\s?states?|canad(?:ian|a)\s)?dollars?|USD|GBP|\spounds?|(?:\s)?pounds?\ssterling|(?:d'\s?)?euros?)\b/i replace_rules __LOTSA_MONEY_00 __LOTSA_MONEY_01 __LOTSA_MONEY_02 __LOTSA_MONEY_03 __LOTSA_MONEY_04 meta LOTS_OF_MONEY (__LOTSA_MONEY_00 || __LOTSA_MONEY_01 || __LOTSA_MONEY_02 || __LOTSA_MONEY_03 || __LOTSA_MONEY_04) describe LOTS_OF_MONEY Huge... sums of money score LOTS_OF_MONEY 0.01 endif # now combine with other stuff in metas to weed out FPs ifplugin Mail::SpamAssassin::Plugin::FreeMail meta MONEY_FREEMAIL LOTS_OF_MONEY && (FREEMAIL_FROM || FREEMAIL_REPLYTO) describe MONEY_FREEMAIL Lots of money from someone using free email? endif meta MONEY_FROM_MISSP LOTS_OF_MONEY && __FROM_MISSPACED describe MONEY_FROM_MISSP Lots of money and misspaced From meta MONEY_TO_NO_R LOTS_OF_MONEY && __TO_NO_ARROWS_R describe MONEY_TO_NO_R Lots of money and bare, missing or undisclosed To meta MONEY_FORM LOTS_OF_MONEY && (FILL_THIS_FORM_LONG || FILL_THIS_FORM_ML) describe MONEY_FORM Lots of money if you fill out a form meta MONEY_ACCOUNT LOTS_OF_MONEY && __YOUR_ACCOUNT describe MONEY_ACCOUNT Lots of money to your account # Replace __FRAUD_DBI in the ADVANCE_FEE rules (testing) meta MONEY_ADVANCE_FEE_2 (__FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_EZY + __FRAUD_ZFJ + __FRAUD_KDT + __FRAUD_BGP + __FRAUD_FBI + __FRAUD_JBU + __FRAUD_JYG + __FRAUD_XVW + __FRAUD_SNT + __FRAUD_LTX + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_FCW + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_NRG + __FRAUD_RLX + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + LOTS_OF_MONEY + __FRAUD_BEP + __FRAUD_DPR + __FRAUD_QXX + __FRAUD_QFY + __FRAUD_PTS + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IPK + __FRAUD_AON + __FRAUD_WNY + __FRAUD_AUM + __FRAUD_WFC + __FRAUD_YWW + __FRAUD_ULK + __FRAUD_IOU + __FRAUD_JNB + __FRAUD_IRT + __FRAUD_ETX + __FRAUD_WDR + __FRAUD_UUY + __FRAUD_MLY > 2) meta MONEY_ADVANCE_FEE_3 (__FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_EZY + __FRAUD_ZFJ + __FRAUD_KDT + __FRAUD_BGP + __FRAUD_FBI + __FRAUD_JBU + __FRAUD_JYG + __FRAUD_XVW + __FRAUD_SNT + __FRAUD_LTX + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_FCW + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_NRG + __FRAUD_RLX + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + LOTS_OF_MONEY + __FRAUD_BEP + __FRAUD_DPR + __FRAUD_QXX + __FRAUD_QFY + __FRAUD_PTS + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IPK + __FRAUD_AON + __FRAUD_WNY + __FRAUD_AUM + __FRAUD_WFC + __FRAUD_YWW + __FRAUD_ULK + __FRAUD_IOU + __FRAUD_JNB + __FRAUD_IRT + __FRAUD_ETX + __FRAUD_WDR + __FRAUD_UUY + __FRAUD_MLY > 3) meta MONEY_ADVANCE_FEE_4 (__FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_EZY + __FRAUD_ZFJ + __FRAUD_KDT + __FRAUD_BGP + __FRAUD_FBI + __FRAUD_JBU + __FRAUD_JYG + __FRAUD_XVW + __FRAUD_SNT + __FRAUD_LTX + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_FCW + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_NRG + __FRAUD_RLX + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + LOTS_OF_MONEY + __FRAUD_BEP + __FRAUD_DPR + __FRAUD_QXX + __FRAUD_QFY + __FRAUD_PTS + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IPK + __FRAUD_AON + __FRAUD_WNY + __FRAUD_AUM + __FRAUD_WFC + __FRAUD_YWW + __FRAUD_ULK + __FRAUD_IOU + __FRAUD_JNB + __FRAUD_IRT + __FRAUD_ETX + __FRAUD_WDR + __FRAUD_UUY + __FRAUD_MLY > 4) # The existing LOTTO rules should be updated if this works out body LOTTO_WINNINGS /(?:claim|transfer(?:\s\w+)?)\s(?:your|of|the)\s(?:win+ings?|money|(?:cash\s)?prize|award)/i describe LOTTO_WINNINGS Claim your winnings score LOTTO_WINNINGS 0.25 body LOTTO_WIN_01 /\bwin+ing\s(?:prize|number|notification|draw|check|cheque|details|information)/i describe LOTTO_WIN_01 Winning * score LOTTO_WIN_01 0.20 describe LOTTO_YOU_WON_03 You have been Chosen body LOTTO_YOU_WON_03 /\b(?:your?|win+ing|win+ers?|beneficiaries|participants?|individuals?)(?:\s[-a-z\s]{4,30})?\s(?:w(?:ere|as)|ha(?:ve|s) be(?:en)?)\s(?:randomly\s(?:selected|cho+sen|cho+sing|picked)|(?:selected|cho+sen|cho+sing|picked)\s(?:[a-z\s]{2,40}\srandom|randomly|online|lottery|computer\sballot))/i score LOTTO_YOU_WON_03 0.50 describe LOTTO_YOU_WON_04 You won! body __YOU_WON_04A /\byou['\w\s]{1,20}w[io]n(?:ner|ning)?\b/i body __YOU_WON_04B /\bw[io]n\s(?:(?:for|by)\s)?your?\b/i meta LOTTO_YOU_WON_04 __YOU_WON_04A || __YOU_WON_04B score LOTTO_YOU_WON_04 0.10 body LOTTO_AGENT /\b(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|reimbursement|prize\stransfer|(?:international|foreign)\sremittance)\s?(?:agent|manager|officer)/i describe LOTTO_AGENT Claims Agent score LOTTO_AGENT 0.50 body LOTTO_DEPT /\b(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|reimbursement|(?:international|foreign)\sremittance)\s?(?:department|dept|unit|group|committee)/i describe LOTTO_DEPT Claims Department score LOTTO_DEPT 0.50 header LOTTO_AGENT_FM From =~ /(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|dispatch|reimbursement|prize\stransfer|(?:international|foreign)\sremittance)[\s_]?(?:agent|manager|officer)/i describe LOTTO_AGENT_FM Claims Agent score LOTTO_AGENT_FM 0.50 header LOTTO_AGENT_RPLY Reply-To =~ /(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|dispatch|reimbursement|prize\stransfer|(?:international|foreign)\sremittance)[\s_]?(?:agent|manager|officer)/i describe LOTTO_AGENT_RPLY Claims Agent score LOTTO_AGENT_RPLY 0.50 body __LOTTO_ADMITS_1 /\b(?:on-?line|e-?mail|ballot|(?:inter)?national|state|(?:UK|euro)[- ]?(?:mil+ions?|PW)|Canada|Microsoft|MSN|internet|mega|jackpot|this)(?:\s\w+)?\s(?:lot(?:to|tery|erie)|sweepstake)/i body __LOTTO_ADMITS_2 /\b(?:lot(?:to|tery|erie)|sweepstakes)\s(?:inter)?na[tz]ional/i uri __LOTTO_ADMITS_3 /lottery/i meta LOTTO_ADMITS __LOTTO_ADMITS_1 || __LOTTO_ADMITS_2 || __LOTTO_ADMITS_3 describe LOTTO_ADMITS Admits to being a lottery score LOTTO_ADMITS 0.50 body LOTTO_RELATED /\b(?:lott(?:o|ery)|sweepstakes)\s(?:prize|draw(?:s|ing)?|win(?:n?er|n?ing)?|jackpot|award|com+it+e+|com+is+ion|guild|promotion|program|day|online|company|(?:in)?corporat|agent|co-?ordinator|team)/i describe LOTTO_RELATED Talks about lottery score LOTTO_RELATED 0.10 meta MONEY_LOTTERY LOTS_OF_MONEY && (LOTTO_WINNINGS + LOTTO_WIN_01 + LOTTO_YOU_WON_03 + LOTTO_YOU_WON_04 + LOTTO_AGENT + LOTTO_DEPT + LOTTO_AGENT_FM + LOTTO_AGENT_RPLY + LOTTO_ADMITS + LOTTO_RELATED + DEAR_WINNER > 1) describe MONEY_LOTTERY Lots of money from a lottery body __DEAL /\b(?:business|financial|this|the|mutual)\s(?:deal|transaction|proposal|offer)/i body __HUSH_HUSH /\b(?:confidential(?:ity)?|private|secre(?:t|cy)|sensitive|concealed)\b/i body __IS_LEGAL /\b(?:this\s(?:deal|offer|transaction|proposal|exchange|arrangement)|it)?\sis\s(?:(?:guaranteed|completely|absolutely|perfectly|100%|very)\s)?legal\b/i body __NOT_SCAM /\bnot\sa\sscam\b/i body __BACK_SCRATCH /\bmutual+y?\sbenefi(?:t|cial)\b/i body __LUCRATIVE /\blucrative\b/i body __YOU_ASSIST /\byour\sassistance\b/i body __PCT_FOR_YOU_1 /\b(?:\d+|ten|[a-z]+teen|(?:twen|thir|fou?r)ty(?:-?[a-z]+)?)\s?(?:%|percent)[\s)]+(?:for|to|as)\syour?/i body __PCT_FOR_YOU_2 /\b(?:give|offer)\syou\s(?:\d+|en|[a-z]+teen|(?:twen|thir|fou?r)ty(?:-?[a-z]+)?)\s?(?:%|percent)/i body __PCT_FOR_YOU_3 /\byour?[\w\s]{6,30}(?:\d+|en|[a-z]+teen|(?:twen|thir|fou?r)ty(?:-?[a-z]+)?)\s?(?:%|percent)/i meta PCT_FOR_YOU __PCT_FOR_YOU_1 || __PCT_FOR_YOU_2 || __PCT_FOR_YOU_3 describe PCT_FOR_YOU X% for you meta MONEY_DEAL LOTS_OF_MONEY && (__DEAL + __HUSH_HUSH + PCT_FOR_YOU + __FRAUD_IOU + __FRAUD_JYG + __IS_LEGAL + __NOT_SCAM + __BACK_SCRATCH + __LUCRATIVE + __YOU_ASSIST > 2) describe MONEY_DEAL Lots of money in a suspicious deal body __ATM_CARD /\b(?:your|the)\satm\scard/i meta MONEY_ATM LOTS_OF_MONEY && __ATM_CARD describe MONEY_ATM Lots of money on an ATM card score MONEY_ATM 0.5 body __YOU_INHERIT /\byour\s[a-z\s]{0,30}inheritance\b/i body __I_INHERIT /\bI\s[a-z\s]{0,30}inherited\b/i body __THEY_INHERIT /\binherit\sth(?:e|is)\smoney\b/i body __I_WILL_YOU /\bwill(?:ed)?\s(?:[a-z\s]{0,20}\s(?:fortune|money)\s)?to\syou\b/i body __NEXT_OF_KIN /\bnext[-\s]of[-\s]kin\b/i body __DECEASED /\b(?:deceased|late)\s(?:client|customer)/i body __DEAD_PARENT /\bmy\s(?:deceased|dead)\s(?:father|mother)/i body __DORMANT_ACCT /\b(?:dormant|abandoned)\saccount/i body __WILL_LEGAL /\b(?:codicil|last\stestament|probate|executor)\b/i body __EARLY_DEMISE /\buntimely\sdeath\b/i meta MONEY_INHERIT LOTS_OF_MONEY && (__YOU_INHERIT || __I_INHERIT || __THEY_INHERIT || __I_WILL_YOU || __NEXT_OF_KIN || __DECEASED || __DEAD_PARENT || __DORMANT_ACCT || __WILL_LEGAL || __EARLY_DEMISE) describe MONEY_INHERIT Lots of money from a dead guy score MONEY_INHERIT 0.2 body __WIRE_XFR /\b(?:wire|telegraph(?:ic)?)\stransfer/i body __TRUSTED_CHECK /\b(?:cashier'?s?|certified)\sche(?:ck|que)/i body __BANK_DRAFT /\bbank\sdraft/i meta MONEY_XFER LOTS_OF_MONEY && (__WIRE_XFR || __TRUSTED_CHECK || __BANK_DRAFT) describe MONEY_XFER Lots of money being transferred score MONEY_XFER 0.1 body __INTL_BANK_EN /\binternational\s(?:\w+\s)?bank\b/i body __INTL_BANK_FR /\bBanque\sInternationale\b/i meta MONEY_INTL_BK LOTS_OF_MONEY && (__INTL_BANK_EN || __INTL_BANK_FR) describe MONEY_INTL_BK Lots of money from an International Bank score MONEY_INTL_BK 0.1 body __BARRISTER /\bbarrister/i meta MONEY_BARRISTER LOTS_OF_MONEY && __BARRISTER describe MONEY_BARRISTER Lots of money from a British lawyer score MONEY_BARRISTER 0.2 body __SCAM /\bscam\b/i body __UN /\bunited\snations?\b/i body __AFR_UNION /\bafrican\sunion\b/i body __COMPENSATION /\bcompensation\b/i body __FRAUD /\bfraud/i meta MONEY_FRAUD_COMP LOTS_OF_MONEY && __BARRISTER && (__SCAM || __FRAUD) && (__UN || __AFR_UNION) && __COMPENSATION describe MONEY_FRAUD_COMP Lots of money from a fraud compensation score MONEY_FRAUD_COMP 1.0 body SUM_OF_FUND /\bsum\sof\s(?:amount|fund)/i describe SUM_OF_FUND Money by any other name smells of greed score SUM_OF_FUND 1.0