Sun Apr 11 19:35:57 PST 2004 -- masscheck.25.sh -- beginning test of 99_sare_fraud_pre25x.cf Section 1 -- Emails flagged as spam Spam identified as spam by these rules: 685 of 90431 Ham identified as spam by these rules: 0 of 20770 Section 2 -- Rules tested # SARE Fraud Ruleset for SpamAssassin 2.4x and older # License: Artistic - see http://www.yackley.org/sa-rules/license.txt # Created: 03/09/2004 # Version: 1.0 # Modified: 03/15/2004 # Current Maintainer: Matt Yackley - sare@yackley.org # Current Home: http://www.yackley.org/sa-rules/99_sare_fraud_pre25x.cf # This set is designed for SpamAssassin versions prior to 2.5x # If you are using a newer version of SpamAssassin, you should be running sare_fraud_post25x.cf body __SARE_FRAUD_BADTHINGS /(?:ass?ylum|assassinate|(?:auto|boat|car|plane|train).{1,7}(?:crash|accident|wreck)|before they both died|brutal acts|coup attempt|due to the current|exile|fled|have been frozen|impeach|killed|land dispute|murder|over-invoice|political crisis|since the demise|slay)/i body __SARE_FRAUD_DPTCOMPNY /(?:amsterdam clearing office|bank (of )?nigeria|charity organization|department of mineral resources and energy|diamond safari|embassy|finance and accounts director of inec|foreign contract tenders committee|holding company|international Bank|mainland investment trust bank|mining corporation|ministry of (?:petroleum and natural resources|urban and rural development)|nigerian national petroleum corporation|securit(?:ies|y) (?:company|firm|storage house)|security & finance firm in amsterdam|sierra leone mining)/i body __SARE_FRAUD_INTRO /(?:(?:may i first|to) introduce my ?self|contact address|i am contacting you)/i body __SARE_FRAUD_REPLY /(?:my secure email address|reply (?:me only|urgent)|(?:immediate|swift|urgent) (?:assist|reply|response))/i body __SARE_FRAUD_LOC /\s(?:abidjan|algeria|angola|benin republic|botswana|c.te .{0,2}ivoire|congo|dubai|gabon|ghana|lagos|liberia|libya|malaysia|nigerian?|phill?ipp?ine.|qatar|republic.du.benin|republic.of.sahara|saharawi|sierra.leone|solomon islands|south.africa|u\.a\.e\.i\.|zimbabwe)\s/i body __SARE_FRAUD_MISC /(?:a native of|as the beneficiary|eagerly await|(?:relate|share) my testimony|remains unclaimed|very big risk|you and your company|youre? country)/i body __SARE_FRAUD_MONEY /(?:(?:huge|substantial) amount of m[o0]ney|(?:transfer this fund|money transfer|transfer money)|(?:will share the money|your share.{1,10}(?:shall|sum|total|money|funds))|assets have been confiscated|be paid to you|claim a sum of|(?:claim|concerning) (?:the|this) money|family asset|foreign (?:offshore )?(?:bank|account)|how the money will be split|kick.{0,2}back|million usd|offer you a generous compensation|personal bank account|remains unclaimed|secure.{1,10}funds|the total sum|transferring (of|the) funds?|us.{1,9}million|win cash|you are.{0,8}winner|your (?:pr[i1]ze|share shall be))/i body __SARE_FRAUD_PAPERWORK /(?:all necessary legal documents|international passport|letter of authority|provide immediately)/i body __SARE_FRAUD_VIPS /(?:(?:white|black|zimbabwean) farmers?|auditor general of the federal republic of nigeria|former president of|former.{0,20}minister|head of state|nigerian gov|president of (the )?phillipine|principal advocate and solicitor)/i body __SARE_FRAUD_FOREIGN /(?:(?:who was a|as a|an? honest|you being a|to any) foreigner|foreign (?:business partner|customer))/i body __SARE_FRAUD_BARRISTER /(?:personal attorney to|adviser to late|solicit[oe]r|barrister)/i body __SARE_FRAUD_FAMILY /(?:my late (?:husband|wife|brother|uncle|aunt|father|mother) (?:was|is|had|has)|next of kin|the (?:eldest|oldest|youngest|first) son|the (?:wife|heir) (?:to|of))/i body __SARE_FRAUD_RELIGION /(?:almighty god|as a born again christian|as a minister|call a prayer line|calvary greeting|eternity is a long t[io]me|fear of god|g[ai]ve.{1,15}life to christ|glorify god'?s name|god (?:has|have|will) forgiven? me|god gives .{1,10}second chance|god want(?:ed|s)? it|goodday pastor|hear from god|if you\'?re? not saved|in the (?:lord'?s name|name of (?:our|the) lord)|jesus is yours|money.{1,15}give.{1,15}ministry|new christian convert|pray daily|read(?:ing)? (?:the|your) bible|sinful habits|spend (?:.{1,20})in hell|the wish of god|true christian|wealth to god|your ministry)/i body __SARE_FRAUD_TINHORN /\s(?:abacha|abubakar|ajobola|anigala|arap moi|aziz|ewaen|gebarel|gezi|guei|gumbeze|ibiam|kabbahs|kabila|kamara|kazeem|margai|massaquoi|mbeki|mobutu|mubune|mugabe|obasanjo|olonga|olumuyiwa|omonigho|rilwanu|savimbi|seko|tarlor|zaid|zwinginna)\s/i body __SARE_FRAUD_TRUST /(?:(?:total(?:ly)?|very|strictly|high(?:est|ly)?|utmost) confiden(?:ce|t(?:ai|ia)l)|confidential communications|honest cooperation|keep this matter|mutual understanding|reliable person|secrecy and confidentiality|secretly deposited|smooth transaction|to (?:assure you|redeem)|utmost secrecy|very honest person|your assurance)/i body __SARE_FRAUD_AGREE /(?:(?:(?:negotiate|reasonable|acc?or?ding|certain|agg?ree).{1,10}percentage|percentage.{1,10}(?:indicat|previous|involved)|your percentage will)|(?:discuss|agree on) the modalities|acceptable by you)/i body __SARE_FRAUD_LOTTERY /(?:(?:international|luckyday|promo) lott(?:o|ery)|lottery coordinator|prize transfer agent|scientific game promo|award notification)/i meta SARE_FRAUD_1 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_DPTCOMPNY) describe SARE_FRAUD_1 Matches 2 phrases commonly used in fraud spam score SARE_FRAUD_1 1.667 meta SARE_FRAUD_2 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_LOC) describe SARE_FRAUD_2 Matches 2 phrases commonly used in fraud spam score SARE_FRAUD_2 1.667 meta SARE_FRAUD_3 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_MONEY) describe SARE_FRAUD_3 Matches 2 phrases commonly used in fraud spam score SARE_FRAUD_3 1.667 meta SARE_FRAUD_4 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_VIPS) describe SARE_FRAUD_4 Matches 2 phrases commonly used in fraud spam score SARE_FRAUD_4 1.667 meta SARE_FRAUD_5 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_MISC) describe SARE_FRAUD_5 Matches 2 phrases commonly used in fraud spam score SARE_FRAUD_5 1.667 meta SARE_FRAUD_6 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_REPLY) describe SARE_FRAUD_6 Matches 2 phrases commonly used in fraud spam score SARE_FRAUD_6 1.667 meta SARE_FRAUD_7 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_TINHORN) describe SARE_FRAUD_7 Matches 2 phrases commonly used in fraud spam score SARE_FRAUD_7 1.667 meta SARE_FRAUD_8 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_BARRISTER) describe SARE_FRAUD_8 Matches 2 phrases commonly used in fraud spam score SARE_FRAUD_8 1.667 meta SARE_FRAUD_9 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && __SARE_FRAUD_BADTHINGS) describe SARE_FRAUD_9 Matches 2 phrases commonly used in fraud spam score SARE_FRAUD_9 0.926 meta SARE_FRAUD_10 ((__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION) && (__SARE_FRAUD_TRUST || __SARE_FRAUD_FAMILY || __SARE_FRAUD_INTRO || __SARE_FRAUD_FOREIGN || __SARE_FRAUD_AGREE || __SARE_FRAUD_PAPERWORK || __SARE_FRAUD_LOTTERY || __SARE_FRAUD_RELIGION)) describe SARE_FRAUD_10 Matches 2 phrases commonly used in fraud spam score SARE_FRAUD_10 1.667 Section 3 -- Frequencies Log (First numeric frequencies, followed by percentage frequencies) OVERALL SPAM HAM S/O SCORE NAME 111201 90431 20770 0.813 0.00 0.00 (all messages) 670 670 0 1.000 1.00 1.67 SARE_FRAUD_2 565 565 0 1.000 1.00 1.67 SARE_FRAUD_3 426 426 0 1.000 1.00 1.67 SARE_FRAUD_1 395 395 0 1.000 1.00 1.67 SARE_FRAUD_5 195 195 0 1.000 1.00 1.67 SARE_FRAUD_6 141 141 0 1.000 1.00 1.67 SARE_FRAUD_4 92 92 0 1.000 1.00 1.67 SARE_FRAUD_7 56 56 0 1.000 1.00 1.67 SARE_FRAUD_8 365 360 5 0.943 0.76 0.93 SARE_FRAUD_9 1135 1028 107 0.688 0.00 1.67 SARE_FRAUD_10 OVERALL% SPAM% HAM% S/O RANK SCORE NAME 111201 90431 20770 0.813 0.00 0.00 (all messages) 100.000 81.3221 18.6779 0.813 0.00 0.00 (all messages as %) 0.603 0.7409 0.0000 1.000 1.00 1.67 SARE_FRAUD_2 0.508 0.6248 0.0000 1.000 1.00 1.67 SARE_FRAUD_3 0.383 0.4711 0.0000 1.000 1.00 1.67 SARE_FRAUD_1 0.355 0.4368 0.0000 1.000 1.00 1.67 SARE_FRAUD_5 0.175 0.2156 0.0000 1.000 1.00 1.67 SARE_FRAUD_6 0.127 0.1559 0.0000 1.000 1.00 1.67 SARE_FRAUD_4 0.083 0.1017 0.0000 1.000 1.00 1.67 SARE_FRAUD_7 0.050 0.0619 0.0000 1.000 1.00 1.67 SARE_FRAUD_8 0.328 0.3981 0.0241 0.943 0.76 0.93 SARE_FRAUD_9 1.021 1.1368 0.5152 0.688 0.00 1.67 SARE_FRAUD_10 Section 4 -- Recommended Scores and Hit Log Required Hits = 5 #counts SARE_FRAUD_1 426s/0h of 111201 corpus (90431s/20770h) 04/11/04 SARE_FRAUD_1 -- suggested score: 1.666 (of 5) #counts SARE_FRAUD_2 670s/0h of 111201 corpus (90431s/20770h) 04/11/04 SARE_FRAUD_2 -- suggested score: 1.666 (of 5) #counts SARE_FRAUD_3 565s/0h of 111201 corpus (90431s/20770h) 04/11/04 SARE_FRAUD_3 -- suggested score: 1.666 (of 5) #counts SARE_FRAUD_4 141s/0h of 111201 corpus (90431s/20770h) 04/11/04 SARE_FRAUD_4 -- suggested score: 1.338 (of 5) #counts SARE_FRAUD_5 395s/0h of 111201 corpus (90431s/20770h) 04/11/04 SARE_FRAUD_5 -- suggested score: 1.666 (of 5) #counts SARE_FRAUD_6 195s/0h of 111201 corpus (90431s/20770h) 04/11/04 SARE_FRAUD_6 -- suggested score: 1.638 (of 5) #counts SARE_FRAUD_7 92s/0h of 111201 corpus (90431s/20770h) 04/11/04 SARE_FRAUD_7 -- suggested score: 1.066 (of 5) #counts SARE_FRAUD_8 56s/0h of 111201 corpus (90431s/20770h) 04/11/04 SARE_FRAUD_8 -- suggested score: 0.866 (of 5) #counts SARE_FRAUD_9 360s/5h of 111201 corpus (90431s/20770h) 04/11/04 SARE_FRAUD_9 -- suggested score: 0.888 (of 5) Ham Matches: #counts SARE_FRAUD_10 1028s/107h of 111201 corpus (90431s/20770h) 04/11/04 SARE_FRAUD_10 -- suggested score: 0.608 (of 5) Ham Matches: Sun Apr 11 21:24:45 PST 2004 -- masscheck.25.sh -- completed test of 99_sare_fraud_pre25x.cf