# SARE Rolex-Specific Ruleset for SpamAssassin # Version: 00.00.01 # Created: 2005-02-19 # Modified: 2005-02-19 # Changes: 00.00.00 - Published new rule set, beta test mode # License: Artistic - see http://www.rulesemporium.com/license.txt # Current Maintainer: Bob Menschel - spammers@rulesemporium.com # Current Home: http://www.rulesemporium.com/rules/70_sare_specific_rolex.cf # # The 70_sare_specific.cf rule set file is intended to catch the M.O. of # specific spammers and/or specific spam that might otherwise elude more # general-purpose rules. # # One of the recent categories of spam seen and complained about is "Rolex" spam, # claiming to sell actual or replica Rolex and other brand watches. # This file, 70_sare_specific_rolex.cf, is our initial publication to catch these # specific spams. # # This is a beta test release -- these rules have NOT been through a full SARE # mass-check run yet. They have been tested against well over 150,000 emails, # and so should be safe to use, but we do not yet have the confidence behind # these rules that we have for most of our other rule set files. # # IOW: Use at your own risk. # (Well, ALL our rules files are "use at your own risk," but these are more so.) # # Our intent is to roll these rules into the full specific.cf file once these # have been properly validated. The rules will be very likely be renamed at that time. # # Note that some of these rules /do/ hit the very occasional ham. They should not # cause false positives. ######## ###################### ################################################## # #OVERALL SPAM HAM S/O RANK SCORE NAME # 174380 98964 75416 0.568 0.00 0.00 (all messages) # 3330 3329 1 1.000 1.00 1.67 BCS_ROLEX # 2080 2080 0 1.000 0.98 2.22 ROLEX_REPLICA # 1954 1954 0 1.000 0.88 2.22 BCS_WANT_ROLEX # 1873 1873 0 1.000 0.83 2.22 TA_RRW # 1411 1411 0 1.000 0.78 2.22 ROLEX_SELECTION # 1166 1166 0 1.000 0.63 2.22 ORDER_ROLEX # 779 779 0 1.000 0.58 1.67 ITAL_CRAFT_ROLEX # 773 773 0 1.000 0.53 1.67 TA_RRW_MANYKIND # 638 638 0 1.000 0.48 1.67 ROLEX_PRICE # 1199 1198 1 0.999 0.45 1.67 BUY_ROLEX # 81 81 0 1.000 0.23 1.00 CHEAP_ROLEX # 75 75 0 1.000 0.18 1.00 REPLICA_OBFU # 28 28 0 1.000 0.13 0.71 AFFORD_ROLEX # #OVERALL% SPAM% HAM% S/O RANK SCORE NAME # 174380 98964 75416 0.568 0.00 0.00 (all messages) #100.000 56.7519 43.2481 0.568 0.00 0.00 (all messages as %) # 1.910 3.3638 0.0013 1.000 1.00 1.67 BCS_ROLEX # 1.193 2.1018 0.0000 1.000 0.98 2.22 ROLEX_REPLICA # 1.121 1.9745 0.0000 1.000 0.88 2.22 BCS_WANT_ROLEX # 1.074 1.8926 0.0000 1.000 0.83 2.22 TA_RRW # 0.809 1.4258 0.0000 1.000 0.78 2.22 ROLEX_SELECTION # 0.669 1.1782 0.0000 1.000 0.63 2.22 ORDER_ROLEX # 0.447 0.7872 0.0000 1.000 0.58 1.67 ITAL_CRAFT_ROLEX # 0.443 0.7811 0.0000 1.000 0.53 1.67 TA_RRW_MANYKIND # 0.366 0.6447 0.0000 1.000 0.48 1.67 ROLEX_PRICE # 0.688 1.2105 0.0013 0.999 0.45 1.67 BUY_ROLEX # 0.046 0.0818 0.0000 1.000 0.23 1.00 CHEAP_ROLEX # 0.043 0.0758 0.0000 1.000 0.18 1.00 REPLICA_OBFU # 0.016 0.0283 0.0000 1.000 0.13 0.71 AFFORD_ROLEX # ######## ###################### ################################################## # Rolex and related Spam ######## ###################### ################################################## # from http://kepler.its.bethel.edu/~bjn/spamassassin/rolex.cf # $Id: rolex.cf,v 1.8 2004/11/26 14:01:37 bjn Exp $ # $Revision: 1.8 $ # SpamAssassin Rolex spam header __BCS_ROLEX_SUBJECT Subject =~ /\b(?:r[0o@][1l|][3e]x|[g6]ucc[1l|])/i describe __BCS_ROLEX_SUBJECT Subject: mentions a Rolex/Gucci/etc. #counts __BCS_ROLEX_SUBJECT 2653s/1h of 174318 corpus (98964s/75354h RM) 02/18/05 body __BCS_ROLEX_BODY /\b(?:r[0o@][1l|][3e]x|[g6]ucc[1l|])/i describe __BCS_ROLEX_BODY Body: mentions a Rolex/Gucci/etc. #counts __BCS_ROLEX_BODY 3838s/26h of 174318 corpus (98964s/75354h RM) 02/18/05 header __BCS_WATCH_SUBJECT Subject =~ /\b(?:w[a@]tch|h[a@]ndb[a@][g6])/i describe __BCS_WATCH_SUBJECT Subject: mentions watch/handbag/etc. body __BCS_WATCH_BODY /\b(?:w[a@]tch|h[a@]ndb[a@][g6])/i describe __BCS_WATCH_BODY Body: mentions watch/handbag/etc. meta BCS_ROLEX ( ( __BCS_WATCH_SUBJECT && __BCS_ROLEX_BODY ) || ( __BCS_ROLEX_SUBJECT && __BCS_WATCH_BODY ) || ( __BCS_ROLEX_SUBJECT && __BCS_ROLEX_BODY ) ) describe BCS_ROLEX Rolex watch spam score BCS_ROLEX 1.666 #hist BCS_ROLEX from http://kepler.its.bethel.edu/~bjn/spamassassin/rolex.cf #counts BCS_ROLEX 3329s/1h of 174318 corpus (98964s/75354h RM) 02/18/05 rawbody BCS_WANT_ROLEX /^\s*(?:do\s+)?(?:you\s+)?(?:want|need)\s+(?:a\s+)?(?:cheap\s+)?(Rolex\s+)?watch\s*\?/i describe BCS_WANT_ROLEX Body: asks if we want/need a Rolex score BCS_WANT_ROLEX 2.222 #hist BCS_WANT_ROLEX from http://kepler.its.bethel.edu/~bjn/spamassassin/rolex.cf #counts BCS_WANT_ROLEX 1954s/0h of 174318 corpus (98964s/75354h RM) 02/18/05 ######## ###################### ################################################## # http://www.violetdreams.com/sa/rolex.cf # ninjaz -at- webexpress.com # Robert Brooks # users@spamassassin.apache.org # Friday, February 18, 2005, 4:52:02 AM (18 Feb 2005 12:52:02 -0000) # <1108731122.25130.ezmlm@spamassassin.apache.org> body __ROLEX_REPLICA1 /rolex.{1,30}replica/i body __ROLEX_REPLICA2 /replica.{1,30}rolex/i meta ROLEX_REPLICA (__ROLEX_REPLICA1 || __ROLEX_REPLICA2) describe ROLEX_REPLICA Rolex Replica score ROLEX_REPLICA 2.222 #hist ROLEX_REPLICA Robert Brooks, Feb 18 2005 #counts ROLEX_REPLICA 2080s/0h of 174352 corpus (98963s/75389h RM) 02/18/05 header __ROLEX_SUBJECT Subject =~ /\brole.?x\b/i meta ROLEX_SUBJECT __ROLEX_SUBJECT && !__BCS_ROLEX_SUBJECT describe ROLEX_SUBJECT Rolex Subject score ROLEX_SUBJECT 1.666 #hist ROLEX_REPLICA Robert Brooks, Feb 18 2005 #counts ROLEX_SUBJECT 2706s/1h of 174352 corpus (98963s/75389h RM) 02/18/05 (did not include the BCS exclude) body ROLEX_SELECTION /\bselection\b.{1,5}\bof\b.{1,30}\brolex/i describe ROLEX_SELECTION Large selection of Rolex score ROLEX_SELECTION 2.222 #hist ROLEX_SELECTION Robert Brooks, Feb 18 2005 #counts ROLEX_SELECTION 1411s/0h of 174352 corpus (98963s/75389h RM) 02/18/05 body ORDER_ROLEX /\border\b.{1,30}\brolex/i describe ORDER_ROLEX Order rolex score ORDER_ROLEX 1.666 #hist ORDER_ROLEX Robert Brooks, Feb 18 2005 #counts ORDER_ROLEX 1166s/0h of 174352 corpus (98963s/75389h RM) 02/18/05 body ITAL_CRAFT_ROLEX /\bitalian\b.{1,30}\bcrafted\b.{1,30}\brolex/i describe ITAL_CRAFT_ROLEX Italian Crafted Rolex score ITAL_CRAFT_ROLEX 1.666 #hist ITAL_CRAFT_ROLEX Robert Brooks, Feb 18 2005 #counts ITAL_CRAFT_ROLEX 779s/0h of 174352 corpus (98963s/75389h RM) 02/18/05 body ROLEX_PRICE /role.?x.{1,30}\bfrom\b.{1,30}\$\d+/i describe ROLEX_PRICE Rolex for only... score ROLEX_PRICE 1.666 #hist ROLEX_PRICE Robert Brooks, Feb 18 2005 #counts ROLEX_PRICE 638s/0h of 174352 corpus (98963s/75389h RM) 02/18/05 body BUY_ROLEX /\bbuy\b.{1,30}\brolex/i describe BUY_ROLEX Buy rolex score BUY_ROLEX 1.666 #hist BUY_ROLEX Robert Brooks, Feb 18 2005 #counts BUY_ROLEX 1198s/1h of 174352 corpus (98963s/75389h RM) 02/18/05 body __GENUINE_REP /\bgenuine\b.{1,30}\breplica/i meta GENUINE_REP_ROLEX ( __GENUINE_REP && BCS_ROLEX ) describe GENUINE_REP_ROLEX Genuine Replica Rolex! score GENUINE_REP_ROLEX 1.666 #hist GENUINE_REP_ROLEX Robert Brooks, Feb 18 2005 #counts GENUINE_REP_ROLEX 234s/0h of 174352 corpus (98963s/75389h RM) 02/18/05 body CHEAP_ROLEX /cheap.{1,30}role.?x/i describe CHEAP_ROLEX Cheap Rolex! score CHEAP_ROLEX 1.005 #hist CHEAP_ROLEX Robert Brooks, Feb 18 2005 #counts CHEAP_ROLEX 81s/0h of 174380 corpus (98964s/75416h RM) 02/19/05 body REPLICA_OBFU /\brep\|ica\b/i describe REPLICA_OBFU Rolex with obfuscated replica score REPLICA_OBFU 1.111 #stype REPLICA_OBFU obfu #hist REPLICA_OBFU Robert Brooks, Feb 18 2005 #counts REPLICA_OBFU 75s/0h of 174352 corpus (98963s/75389h RM) 02/18/05 header AFFORD_ROLEX Subject =~ /\bafford\b.{1,30}\brolex\b/i describe AFFORD_ROLEX Can you afford a rolex? score AFFORD_ROLEX 0.711 #hist AFFORD_ROLEX Robert Brooks, Feb 18 2005 #counts AFFORD_ROLEX 28s/0h of 174352 corpus (98963s/75389h RM) 02/18/05 ######## ###################### ################################################## # EOF