# SARE Fraud Ruleset for SpamAssassin 2.4x and older
# Version:  01.00.01 # NOTE: Please update your scripts to pull this file from it's new location http://www.rulesemporium.com/rules/99_sare_fraud_pre25x.cf
# Created:  03/09/2004
# Modified: 04/11/2004
# Changes: Updated ruleset format to follow new SARE guidelines
# License:  Artistic - see http://www.rulesemporium.com/license.txt
# Current Maintainer: Matt Yackley - fraud@rulesemporium.com
# Current Home: http://www.rulesemporium.com/rules/99_sare_fraud_pre25x.cf
# SA 3.0 compliant: Yes
# This set is designed for SpamAssassin versions prior to 2.5x
# If you are using a newer version of SpamAssassin, you should be running sare_fraud_post25x.cf
#
####

body  __SARE_FRAUD_BADTHINGS /(?:ass?ylum|assassinate|(?:auto|boat|car|plane|train).{1,7}(?:crash|accident|wreck)|before they both died|brutal acts|coup attempt|due to the current|\bexile\b|\bfled\b|have been frozen|impeach|\bkilled|land dispute|murder|over-invoice|political crisis|since the demise|\bslay\b)/i
body  __SARE_FRAUD_DPTCOMPNY /(?:amsterdam clearing office|bank (of )?nigeria|charity organization|department of mineral resources and energy|diamond safari|embassy|finance and accounts director of inec|foreign contract tenders committee|holding company|international Bank|mainland investment trust bank|mining corporation|ministry of (?:petroleum and natural resources|urban and rural development)|nigerian national petroleum corporation|securit(?:ies|y) (?:company|firm|storage house)|security & finance firm in amsterdam|sierra leone mining)/i
body  __SARE_FRAUD_INTRO /(?:(?:may i first|to) introduce my ?self|contact address|i am contacting you)/i
body  __SARE_FRAUD_REPLY /(?:my secure email address|reply (?:me only|urgent)|(?:immediate|swift|urgent) (?:assist|reply|response))/i
body  __SARE_FRAUD_LOC /\s(?:abidjan|algeria|angola|benin republic|botswana|c.te .{0,2}ivoire|congo|dubai|gabon|ghana|lagos|liberia|libya|malaysia|nigerian?|phill?ipp?ine.|qatar|republic.du.benin|republic.of.sahara|saharawi|sierra.leone|solomon islands|south.africa|u\.a\.e\.i\.|zimbabwe)\s/i
body  __SARE_FRAUD_MISC /(?:a native of|as the beneficiary|eagerly await|(?:relate|share) my testimony|remains unclaimed|very big risk|you and your company|youre? country)/i
body  __SARE_FRAUD_MONEY /(?:(?:huge|substantial) amount of m[o0]ney|(?:transfer this fund|money transfer|transfer money)|(?:will share the money|your share.{1,10}(?:shall|sum|total|money|funds))|assets have been confiscated|be paid to you|claim a sum of|(?:claim|concerning) (?:the|this) money|family asset|foreign (?:offshore )?(?:bank|account)|how the money will be split|kick.{0,2}back|million usd|offer you a generous compensation|personal bank account|remains unclaimed|secure.{1,10}funds|the total sum|transferring (of|the) funds?|us.{1,9}million|win cash|you are.{0,8}winner|your (?:pr[i1]ze|share shall be))/i
body  __SARE_FRAUD_PAPERWORK /(?:all necessary legal documents|international passport|letter of authority|provide immediately)/i
body  __SARE_FRAUD_VIPS /(?:(?:white|black|zimbabwean) farmers?|auditor general of the federal republic of nigeria|former president of|former.{0,20}minister|head of state|nigerian gov|president of (the )?phillipine|principal advocate and solicitor)/i
body  __SARE_FRAUD_FOREIGN /(?:(?:who was a|as a|an? honest|you being a|to any) foreigner|foreign (?:business partner|customer))/i
body  __SARE_FRAUD_BARRISTER /(?:personal attorney to|adviser to late|solicit[oe]r|barrister)/i
body  __SARE_FRAUD_FAMILY /(?:my late (?:husband|wife|brother|uncle|aunt|father|mother) (?:was|is|had|has)|next of kin|the (?:eldest|oldest|youngest|first) son|the (?:wife|heir) (?:to|of))/i
body  __SARE_FRAUD_RELIGION /(?:almighty god|as a born again christian|as a minister|call a prayer line|calvary greeting|eternity is a long t[io]me|fear of god|g[ai]ve.{1,15}life to christ|glorify god'?s name|god (?:has|have|will) forgiven? me|god gives .{1,10}second chance|god want(?:ed|s)? it|goodday pastor|hear from god|if you\'?re? not saved|in the (?:lord'?s name|name of (?:our|the) lord)|jesus is yours|money.{1,15}give.{1,15}ministry|new christian convert|pray daily|read(?:ing)? (?:the|your) bible|sinful habits|spend (?:.{1,20})in hell|the wish of god|true christian|wealth to god|your ministry)/i
body  __SARE_FRAUD_TINHORN /\s(?:abacha|abubakar|ajobola|anigala|arap moi|aziz|ewaen|gebarel|gezi|guei|gumbeze|ibiam|kabbahs|kabila|kamara|kazeem|margai|massaquoi|mbeki|mobutu|mubune|mugabe|obasanjo|olonga|olumuyiwa|omonigho|rilwanu|savimbi|seko|tarlor|zaid|zwinginna)\s/i
body  __SARE_FRAUD_TRUST /(?:(?:total(?:ly)?|very|strictly|high(?:est|ly)?|utmost) confiden(?:ce|t(?:ai|ia)l)|confidential communications|honest cooperation|keep this matter|mutual understanding|reliable person|secrecy and confidentiality|secretly deposited|smooth transaction|to (?:assure you|redeem)|utmost secrecy|very honest person|your assurance)/i
body  __SARE_FRAUD_AGREE /(?:(?:(?:negotiate|reasonable|acc?or?ding|certain|agg?ree).{1,10}percentage|percentage.{1,10}(?:indicat|previous|involved)|your percentage will)|(?:discuss|agree on) the modalities|acceptable by you)/i
body  __SARE_FRAUD_LOTTERY /(?:(?:international|luckyday|promo) lott(?:o|ery)|lottery coordinator|prize transfer agent|scientific game promo|award notification)/i

meta     SARE_FRAUD_1 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_DPTCOMPNY)
describe SARE_FRAUD_1 Matches 2 phrases commonly used in fraud spam
score    SARE_FRAUD_1 1.667

meta     SARE_FRAUD_2 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_LOC)
describe SARE_FRAUD_2 Matches 2 phrases commonly used in fraud spam
score    SARE_FRAUD_2 1.667

meta     SARE_FRAUD_3 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_MONEY)
describe SARE_FRAUD_3 Matches 2 phrases commonly used in fraud spam
score    SARE_FRAUD_3 1.667

meta     SARE_FRAUD_4 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_VIPS)
describe SARE_FRAUD_4 Matches 2 phrases commonly used in fraud spam
score    SARE_FRAUD_4 1.667

meta     SARE_FRAUD_5 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_MISC)
describe SARE_FRAUD_5 Matches 2 phrases commonly used in fraud spam
score    SARE_FRAUD_5 1.667

meta     SARE_FRAUD_6 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_REPLY)
describe SARE_FRAUD_6 Matches 2 phrases commonly used in fraud spam
score    SARE_FRAUD_6 1.667

meta     SARE_FRAUD_7 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_TINHORN)
describe SARE_FRAUD_7 Matches 2 phrases commonly used in fraud spam
score    SARE_FRAUD_7 1.667

meta     SARE_FRAUD_8 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_BARRISTER)
describe SARE_FRAUD_8 Matches 2 phrases commonly used in fraud spam
score    SARE_FRAUD_8 1.667
 
meta     SARE_FRAUD_9 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_BADTHINGS)
describe SARE_FRAUD_9 Matches 2 phrases commonly used in fraud spam
score    SARE_FRAUD_9 0.926

meta     SARE_FRAUD_10 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && (__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION))
describe SARE_FRAUD_10 Matches 2 phrases commonly used in fraud spam
score    SARE_FRAUD_10 1.667

# EOF