In response to this comment:
# This is the right place to customize your installation of SpamAssassin.
# See 'perldoc Mail::SpamAssassin::Conf' for details of what can be
# tweaked.
#
###########################################################################
#
rewrite_subject 1
fold_headers 0
spam_level_char s
always_add_report 1
use_terse_report 1
skip_rbl_checks 0
dns_available yes
# seanius recommends:
score RCVD_IN_SBL 0
# (SBL_XBL is a superset of SBL)
header SPAMHAUS_SBL_XBL rbleval:check_rbl('spamhaus', 'sbl-xbl.spamhaus.org.')
describe SPAMHAUS_SBL_XBL listed in sbl-xbl.spamhaus.org's blackhole lists
tflags SPAMHAUS_SBL_XBL net
score SPAMHAUS_SBL_XBL 1.5
header MPOP_MUA X-Mailer =~ /\bmPOP Web-Mail\b/
describe MPOP_MUA (False?) useragent used by anti-Bayes spam.
score MPOP_MUA 0.75 0.75 2.50 2.50
header ANTIBAYES_SUBJECT Subject =~ /\bRe: ([A-Z] |%RND_UC_CHAR\[2-8\]),\s \p{IsGraph} \b/
describe ANTIBAYES_SUBJECT Subject matches pattern for anti-Bayes spam.
score ANTIBAYES_SUBJECT 0.75 0.75 2.50 2.50
header ANTIBAYES_MESSAGEID MESSAGEID =~ /\b[A-Z]{7}-[0-9]{13}@\b/
describe ANTIBAYES_MESSAGEID Message-ID matches pattern for anti-Bayes spam.
score ANTIBAYES_MESSAGEID 0.75 0.75 2.50 2.50
header ANTIBAYES_ORIG_IP X-Originating-IP =~ /\[\p{IsAlnum} \.(net|com|org)(\/\p{IsAlnum} )?(IP\])?$/
describe ANTIBAYES_ORIG_IP X-Originating-IP matches pattern for anti-Bayes spam.
score ANTIBAYES_MESSAGEID 0.75 0.75 2.50 2.50
meta ANTIBAYES_SPAM (MPOP_MUA && ANTIBAYES_SUBJECT) || (MPOP_MUA && ANTIBAYES_MESSAGEID) || (MPOP_MUA && ANTIBAYES_ORIG_IP) || (ANTIBAYES_SUBJECT && ANTIBAYES_MESSAGEID) || (ANTIBAYES_SUBJECT && ANTIBAYES_ORIG_IP) || (ANTIBAYES_MESSAGEID && ANTIBAYES_ORIG_IP)
describe ANTIBAYES_SPAM Several indications of anti-Bayes spam.
score ANTIBAYES_SPAM 1.50 1.50 5.00 5.00
body VBOUNCE_UNKNOWN1 /ave detected a virus/
describe VBOUNCE_UNKNOWN1 Generic virus bounce
score VBOUNCE_UNKNOWN1 5
body VBOUNCE_EXIM /a potentially executable attachment /
describe VBOUNCE_EXIM Virus bounce - sf.net
score VBOUNCE_EXIM 5
body VBOUNCE_GUIN /message contains file attachments that are not permitted/
describe VBOUNCE_GUIN Virus bounce - Guinevere
score VBOUNCE_GUIN 5
body VBOUNCE_CISCO /^Found virus \S in file \S /m
describe VBOUNCE_CISCO Virus bounce - Cisco.com
score VBOUNCE_CISCO 5
body VBOUNCE_SMTP /host \S said: 7\d\d\s Error: Message content rejected/
describe VBOUNCE_SMTP Virus bounce - SMTP error via postfix
score VBOUNCE_SMTP 5
body VBOUNCE_AOL /TRANSACTION FAILED - Unrepairable Virus Detected. /
describe VBOUNCE_AOL Virus bounce - AOL
score VBOUNCE_AOL 5
body VBOUNCE_DUTCH /bevatte bijlage besmet welke besmet was met een virus/
describe VBOUNCE_DUTCH Virus bounce - something in Dutch!
score VBOUNCE_DUTCH 5
body VBOUNCE_MAILMARSHAL /Mail.?Marshal Rule: Inbound Messages : Block Dangerous Attachments/
describe VBOUNCE_MAILMARSHAL Virus bounce - Mail Marshal ("an automated content monitoring gateway")
score VBOUNCE_MAILMARSHAL 5
header VBOUNCE_NAVFAIL Subject =~ /^Norton Anti.?Virus failed to scan an attachment in a message you sent/
describe VBOUNCE_NAVFAIL Virus bounce - Norton AV failure
score VBOUNCE_NAVFAIL 5
header VBOUNCE_SYMANTEC Subject =~ /Symantec AVF detected/
describe VBOUNCE_SYMANTEC Virus bounce - Symantec AVF
score VBOUNCE_SYMANTEC 5
body VBOUNCE_AMAVIS /VIRUS ALERT/
describe VBOUNCE_AMAVIS Virus bounce - Amavis
score VBOUNCE_AMAVIS 5
body VBOUNCE_AMAVIS2 /Our content checker found/
describe VBOUNCE_AMAVIS2 Virus bounce - Amavis
score VBOUNCE_AMAVIS2 5
header VBOUNCE_INTERSCAN Subject =~ /InterScan NT Alert/
describe VBOUNCE_INTERSCAN Virus bounce - InterScan
score VBOUNCE_INTERSCAN 5
header VBOUNCE_ANTIGEN Subject =~ /Antigen found VIRUS/
describe VBOUNCE_ANTIGEN Virus bounce - Antigen
score VBOUNCE_ANTIGEN 5
body VBOUNCE_MAILENABLE /554 Message Rejected Due To Virus Found In Attachment/
describe VBOUNCE_MAILENABLE Virus bounce - MailEnable Postoffice Connector
score VBOUNCE_MAILENABLE 5
header VBOUNCE_AVFORSMTPGATEWAYS Subject =~ /Email blocked due to content violation/
describe VBOUNCE_AVFORSMTPGATEWAYS Virus bounce - AntiVirus_for_SMTP_Gateways
score VBOUNCE_AVFORSMTPGATEWAYS 5
body VBOUNCE_AVFORSMTPGATEWAYS2 /Content violation found in email message\./
describe VBOUNCE_AVFORSMTPGATEWAYS2 Virus bounce - AntiVirus_for_SMTP_Gateways
score VBOUNCE_AVFORSMTPGATEWAYS2 5
body __TOPSITES_URL /^http:\/\/top--sites.com\//
describe __TOPSITES_URL top--sites.com "renewal" spam; url
body __TOPSITES_WORDS_01 /^We have more than 12 million listings,/
describe __TOPSITES_WORDS_01 top--sites.com "renewal" spam; "We have..."
body __TOPSITES_WORDS_02 /^TopSites is the world's biggest directory./
describe __TOPSITES_WORDS_02 top--sites.com "renewal" spam; "TopSites is..."
header __TOPSITES_SUBJECT Subject =~ /^Please update your expired/
describe __TOPSITES_SUBJECT top--sites.com "renewal" spam; subject
meta TOPSITES_SPAM (__TOPSITES_URL && __TOPSITES_WORDS_01 && __TOPSITES_WORDS_02 && __TOPSITES_SUBJECT)
describe TOPSITES_SPAM TopSites spam.
score TOPSITES_SPAM 5
header __PLEAZER_REPLYTO Reply-To =~ /\@pleazerzoneprod\.com/
describe __PLEAZER_REPLYTO Reply-To pleazerzoneprod.com
body __PLEAZER_URL /^http:\/\/.*pleazerzoneprod.com\/$/
describe __PLEAZER_URL pleazerzoneprod.com spam; url
body __PLEAZER_TEXT_01 /^ Populated by realwomen who want to have encounters with Real men\./
describe __PLEAZER_TEXT_01 pleazerzoneprod.com spam; "Populated by realwomen..."
body __PLEAZER_TEXT_02 /^ To be gone from future promotions/
describe __PLEAZER_TEXT_02 pleazerzoneprod.com spam; "To be gone..."
body __PLEAZER_PHONE_A /nlne.*four.*nine.*two.*one.*four.*five/
describe __PLEAZER_PHONE_A pleazerzoneprod.com 800 number
body __PLEAZER_PHONE_B /nine.*four.*nine.*two.*one.*four.*five/
describe __PLEAZER_PHONE_B pleazerzoneprod.com 800 number
body __PLEAZER_PHONE_C /9.*4.*9.*2.*1.*4.*5/
describe __PLEAZER_PHONE_C pleazerzoneprod.com 800 number
meta PLEAZER_ZONE (__PLEAZER_URL && __PLEAZER_TEXT_01 && __PLEAZER_TEXT_02 && __PLEAZER_REPLYTO && (__PLEAZER_PHONE_A || __PLEAZER_PHONE_B || __PLEAZER_PHONE_C))
describe PLEAZER_ZONE pleazerzoneprod.com spam
score PLEAZER_ZONE 5
header NASDAQ_TIMER Subject =~ /^NASDAQ TIMER - New Trading Range/
describe NASDAQ_TIMER Subject NASDAQ TIMER spam
score NASDAQ_TIMER 3.0
# Doesn't actually work (nor with raw headers either)
#header ALL_CAPS_SUBJECT Subject =~ /SUBJECT/
#describe ALL_CAPS_SUBJECT "SUBJECT:" instead of "Subject:"; some Outlook virus does this
#score ALL_CAPS_SUBJECT 3.5
header BUKKAKE_SUBJECT Subject =~ /^bukkake1.jpg/
describe BUKKAKE_SUBJECT Repetative porn spam.
score BUKKAKE_SUBJECT 1.5
body BUKKAKE_BODY1 /^you won't believe these models:/
describe BUKKAKE_BODY1 Repetative porn spam.
score BUKKAKE_BODY1 1.5
body BUKKAKE_BODY2 /^ClickABOVE or type it into a browser:/
describe BUKKAKE_BODY2 Repetative porn spam.
score BUKKAKE_BODY2 1.5
body BUKKAKE_BODY3 /^If you don't want any more mail from us:/
describe BUKKAKE_BODY3 Repetative porn spam.
score BUKKAKE_BODY3 1.5
header STOCK_ANALYSIS_SUBJECT_01A Subject =~ /stock/i
describe STOCK_ANALYSIS_SUBJECT_01A Stock spam subject; "stock"
score STOCK_ANALYSIS_SUBJECT_01A .5
header STOCK_ANALYSIS_SUBJECT_01B Subject =~ /sector/i
describe STOCK_ANALYSIS_SUBJECT_01B Stock spam subject; "sector"
score STOCK_ANALYSIS_SUBJECT_01B .5
header STOCK_ANALYSIS_SUBJECT_02A Subject =~ /analysis/i
describe STOCK_ANALYSIS_SUBJECT_02A Stock spam subject; "analysis"
score STOCK_ANALYSIS_SUBJECT_02A .5
header STOCK_ANALYSIS_SUBJECT_02B Subject =~ /profile/i
describe STOCK_ANALYSIS_SUBJECT_02B Stock spam subject; "profile"
score STOCK_ANALYSIS_SUBJECT_02B .5
# This spam produces:
#Message-ID: <VFVFTADGUGYNIBPTPSEDKQP@yahoo.com>
#Message-ID: <OAYUCQRKTOSKQKERVHFBKXQ@yahoo.com>
# Real mail from yahoo webmail produces:
#Message-ID: <20040127201700.13096.qmail@web14101.mail.yahoo.com>
# The STOCK-UPTICKER and such uses this message-id too; their
# body content's a bit different...
header STOCK_ANALYSIS_MESSAGEID MESSAGEID =~ /[A-Z]{23}\@yahoo.com/
describe STOCK_ANALYSIS_MESSAGEID Stock spam Message-ID
score STOCK_ANALYSIS_MESSAGEID 3
body STOCK_ANALYSIS_BODY_01 /www.stockta.com/
describe STOCK_ANALYSIS_BODY_01 Stock spam body; URL
score STOCK_ANALYSIS_BODY_01 2.5
body STOCK_ANALYSIS_BODY_02 /^Here is that Stock.* site/i
describe STOCK_ANALYSIS_BODY_02 Stock spam body; "Here is that..."
score STOCK_ANALYSIS_BODY_02 .2
body STOCK_ANALYSIS_BODY_03 /bullish.*bullish.*bullish/im
describe STOCK_ANALYSIS_BODY_03 Stock spam body; Bullish? Bullshit.
score STOCK_ANALYSIS_BODY_03 2.5
meta STOCK_ANALYSIS ((STOCK_ANALYSIS_SUBJECT_01A && STOCK_ANALYSIS_SUBJECT_02A) || (STOCK_ANALYSIS_SUBJECT_01A && STOCK_ANALYSIS_SUBJECT_02B) || (STOCK_ANALYSIS_SUBJECT_01B && STOCK_ANALYSIS_SUBJECT_02A) || (STOCK_ANALYSIS_SUBJECT_01B && STOCK_ANALYSIS_SUBJECT_02B)) && STOCK_ANALYSIS_MESSAGEID && (STOCK_ANALYSIS_BODY_01 || STOCK_ANALYSIS_BODY_02 || STOCK_ANALYSIS_BODY_03)
describe STOCK_ANALYSIS Stock analysis spam.
score STOCK_ANALYSIS 4
# Need to update the Nigerian spam metarules in light of new instances.
# Hopefully I can pull these back out after an upgrade...
# No *clue* how to score these, there isn't enough of a sample yet.
header NIGERIAN_SUBJECT_LOCAL1 Subject =~ /\bCONFIDENTIAL MESSAGE\b/
describe NIGERIAN_SUBJECT_LOCAL1 Subject is indicative of a Nigerian spam
score NIGERIAN_SUBJECT_LOCAL1 .5
header NIGERIAN_SUBJECT_LOCAL2 Subject =~ /\bPRIVATE ESTATE ACQUISITION\b/
describe NIGERIAN_SUBJECT_LOCAL2 Subject is indicative of a Nigerian spam
score NIGERIAN_SUBJECT_LOCAL2 .5
# We're going to use their rules and our own to feed our meta rules,
# which means we need to deactivate their meta rules (to avoid
# double-scoring). Probably not *actually* a problem, but there's a
# Right way to do this.
score NIGERIAN_BODY1 0
score NIGERIAN_BODY2 0
score NIGERIAN_BODY3 0
score NIGERIAN_BODY4 0
meta NIGERIAN_BODY_LOCAL1 ( __NIGERIAN_BODY_1 __NIGERIAN_BODY_2 __NIGERIAN_BODY_3 __NIGERIAN_BODY_5 __NIGERIAN_BODY_6 __NIGERIAN_BODY_7 __NIGERIAN_BODY_8 __NIGERIAN_BODY_9 __NIGERIAN_BODY_10 __NIGERIAN_BODY_11 __NIGERIAN_BODY_12 __NIGERIAN_BODY_13 __NIGERIAN_BODY_14 __NIGERIAN_BODY_15 __NIGERIAN_BODY_16 __NIGERIAN_BODY_17 __NIGERIAN_BODY_18 __NIGERIAN_BODY_19 __NIGERIAN_BODY_20 __NIGERIAN_BODY_21 __NIGERIAN_BODY_22 __NIGERIAN_BODY_25 __NIGERIAN_BODY_26 __NIGERIAN_BODY_27 __NIGERIAN_BODY_28 __NIGERIAN_BODY_29 __NIGERIAN_BODY_30 __NIGERIAN_BODY_31 __NIGERIAN_BODY_32 __NIGERIAN_BODY_33 __NIGERIAN_BODY_34 __NIGERIAN_BODY_35 __NIGERIAN_BODY_36 __NIGERIAN_BODY_37 __NIGERIAN_BODY_38 __NIGERIAN_BODY_39 __NIGERIAN_BODY_40 __NIGERIAN_BODY_41 __NIGERIAN_BODY_42 __NIGERIAN_BODY_43 __NIGERIAN_BODY_44 __NIGERIAN_BODY_45 __NIGERIAN_BODY_46 __NIGERIAN_BODY_LOCAL1 __NIGERIAN_BODY_LOCAL2 __NIGERIAN_BODY_LOCAL3 __NIGERIAN_BODY_LOCAL4 __NIGERIAN_BODY_LOCAL5) > 1
meta NIGERIAN_BODY_LOCAL2 ( __NIGERIAN_BODY_1 __NIGERIAN_BODY_2 __NIGERIAN_BODY_3 __NIGERIAN_BODY_5 __NIGERIAN_BODY_6 __NIGERIAN_BODY_7 __NIGERIAN_BODY_8 __NIGERIAN_BODY_9 __NIGERIAN_BODY_10 __NIGERIAN_BODY_11 __NIGERIAN_BODY_12 __NIGERIAN_BODY_13 __NIGERIAN_BODY_14 __NIGERIAN_BODY_15 __NIGERIAN_BODY_16 __NIGERIAN_BODY_17 __NIGERIAN_BODY_18 __NIGERIAN_BODY_19 __NIGERIAN_BODY_20 __NIGERIAN_BODY_21 __NIGERIAN_BODY_22 __NIGERIAN_BODY_25 __NIGERIAN_BODY_26 __NIGERIAN_BODY_27 __NIGERIAN_BODY_28 __NIGERIAN_BODY_29 __NIGERIAN_BODY_30 __NIGERIAN_BODY_31 __NIGERIAN_BODY_32 __NIGERIAN_BODY_33 __NIGERIAN_BODY_34 __NIGERIAN_BODY_35 __NIGERIAN_BODY_36 __NIGERIAN_BODY_37 __NIGERIAN_BODY_38 __NIGERIAN_BODY_39 __NIGERIAN_BODY_40 __NIGERIAN_BODY_41 __NIGERIAN_BODY_42 __NIGERIAN_BODY_43 __NIGERIAN_BODY_44 __NIGERIAN_BODY_45 __NIGERIAN_BODY_46 __NIGERIAN_BODY_LOCAL1 __NIGERIAN_BODY_LOCAL2 __NIGERIAN_BODY_LOCAL3 __NIGERIAN_BODY_LOCAL4 __NIGERIAN_BODY_LOCAL5) > 2
meta NIGERIAN_BODY_LOCAL3 ( __NIGERIAN_BODY_1 __NIGERIAN_BODY_2 __NIGERIAN_BODY_3 __NIGERIAN_BODY_5 __NIGERIAN_BODY_6 __NIGERIAN_BODY_7 __NIGERIAN_BODY_8 __NIGERIAN_BODY_9 __NIGERIAN_BODY_10 __NIGERIAN_BODY_11 __NIGERIAN_BODY_12 __NIGERIAN_BODY_13 __NIGERIAN_BODY_14 __NIGERIAN_BODY_15 __NIGERIAN_BODY_16 __NIGERIAN_BODY_17 __NIGERIAN_BODY_18 __NIGERIAN_BODY_19 __NIGERIAN_BODY_20 __NIGERIAN_BODY_21 __NIGERIAN_BODY_22 __NIGERIAN_BODY_25 __NIGERIAN_BODY_26 __NIGERIAN_BODY_27 __NIGERIAN_BODY_28 __NIGERIAN_BODY_29 __NIGERIAN_BODY_30 __NIGERIAN_BODY_31 __NIGERIAN_BODY_32 __NIGERIAN_BODY_33 __NIGERIAN_BODY_34 __NIGERIAN_BODY_35 __NIGERIAN_BODY_36 __NIGERIAN_BODY_37 __NIGERIAN_BODY_38 __NIGERIAN_BODY_39 __NIGERIAN_BODY_40 __NIGERIAN_BODY_41 __NIGERIAN_BODY_42 __NIGERIAN_BODY_43 __NIGERIAN_BODY_44 __NIGERIAN_BODY_45 __NIGERIAN_BODY_46 __NIGERIAN_BODY_LOCAL1 __NIGERIAN_BODY_LOCAL2 __NIGERIAN_BODY_LOCAL3 __NIGERIAN_BODY_LOCAL4 __NIGERIAN_BODY_LOCAL5) > 3
meta NIGERIAN_BODY_LOCAL4 ( __NIGERIAN_BODY_1 __NIGERIAN_BODY_2 __NIGERIAN_BODY_3 __NIGERIAN_BODY_5 __NIGERIAN_BODY_6 __NIGERIAN_BODY_7 __NIGERIAN_BODY_8 __NIGERIAN_BODY_9 __NIGERIAN_BODY_10 __NIGERIAN_BODY_11 __NIGERIAN_BODY_12 __NIGERIAN_BODY_13 __NIGERIAN_BODY_14 __NIGERIAN_BODY_15 __NIGERIAN_BODY_16 __NIGERIAN_BODY_17 __NIGERIAN_BODY_18 __NIGERIAN_BODY_19 __NIGERIAN_BODY_20 __NIGERIAN_BODY_21 __NIGERIAN_BODY_22 __NIGERIAN_BODY_25 __NIGERIAN_BODY_26 __NIGERIAN_BODY_27 __NIGERIAN_BODY_28 __NIGERIAN_BODY_29 __NIGERIAN_BODY_30 __NIGERIAN_BODY_31 __NIGERIAN_BODY_32 __NIGERIAN_BODY_33 __NIGERIAN_BODY_34 __NIGERIAN_BODY_35 __NIGERIAN_BODY_36 __NIGERIAN_BODY_37 __NIGERIAN_BODY_38 __NIGERIAN_BODY_39 __NIGERIAN_BODY_40 __NIGERIAN_BODY_41 __NIGERIAN_BODY_42 __NIGERIAN_BODY_43 __NIGERIAN_BODY_44 __NIGERIAN_BODY_45 __NIGERIAN_BODY_46 __NIGERIAN_BODY_LOCAL1 __NIGERIAN_BODY_LOCAL2 __NIGERIAN_BODY_LOCAL3 __NIGERIAN_BODY_LOCAL4 __NIGERIAN_BODY_LOCAL5) > 4
meta NIGERIAN_BODY_LOCAL5 ( __NIGERIAN_BODY_1 __NIGERIAN_BODY_2 __NIGERIAN_BODY_3 __NIGERIAN_BODY_5 __NIGERIAN_BODY_6 __NIGERIAN_BODY_7 __NIGERIAN_BODY_8 __NIGERIAN_BODY_9 __NIGERIAN_BODY_10 __NIGERIAN_BODY_11 __NIGERIAN_BODY_12 __NIGERIAN_BODY_13 __NIGERIAN_BODY_14 __NIGERIAN_BODY_15 __NIGERIAN_BODY_16 __NIGERIAN_BODY_17 __NIGERIAN_BODY_18 __NIGERIAN_BODY_19 __NIGERIAN_BODY_20 __NIGERIAN_BODY_21 __NIGERIAN_BODY_22 __NIGERIAN_BODY_25 __NIGERIAN_BODY_26 __NIGERIAN_BODY_27 __NIGERIAN_BODY_28 __NIGERIAN_BODY_29 __NIGERIAN_BODY_30 __NIGERIAN_BODY_31 __NIGERIAN_BODY_32 __NIGERIAN_BODY_33 __NIGERIAN_BODY_34 __NIGERIAN_BODY_35 __NIGERIAN_BODY_36 __NIGERIAN_BODY_37 __NIGERIAN_BODY_38 __NIGERIAN_BODY_39 __NIGERIAN_BODY_40 __NIGERIAN_BODY_41 __NIGERIAN_BODY_42 __NIGERIAN_BODY_43 __NIGERIAN_BODY_44 __NIGERIAN_BODY_45 __NIGERIAN_BODY_46 __NIGERIAN_BODY_LOCAL1 __NIGERIAN_BODY_LOCAL2 __NIGERIAN_BODY_LOCAL3 __NIGERIAN_BODY_LOCAL4 __NIGERIAN_BODY_LOCAL5) > 5
describe NIGERIAN_BODY_LOCAL1 Message body looks like a Nigerian spam message 1
describe NIGERIAN_BODY_LOCAL2 Message body looks like a Nigerian spam message 2
describe NIGERIAN_BODY_LOCAL3 Message body looks like a Nigerian spam message 3
describe NIGERIAN_BODY_LOCAL4 Message body looks like a Nigerian spam message 4
describe NIGERIAN_BODY_LOCAL5 Message body looks like a Nigerian spam message 5
score NIGERIAN_BODY_LOCAL1 3.009 1.563 2.696 2.018
score NIGERIAN_BODY_LOCAL2 0.700 0.717 0.858 0.700
score NIGERIAN_BODY_LOCAL3 0.700 1.006 0.972 0.738
score NIGERIAN_BODY_LOCAL4 0.701 0.724 0.700 0.701
score NIGERIAN_BODY_LOCAL5 0.70 0.75 0.70 0.70
body __NIGERIAN_BODY_LOCAL_1 /\b[fF]ederal.*Nigeria\.\S \b/
# Weird one, but both of the ones that slipped through recently had it.
body __NIGERIAN_BODY_LOCAL_2 /\bvery strategic and influential position\b/
body __NIGERIAN_BODY_LOCAL_3 /\b(vital|convenient) bank account\b/
body __NIGERIAN_BODY_LOCAL_4 /\bwe\s need\s your\s assistance\s (in|to)\s transfer(ring)?\s (some of)?\s the\s (money|funds)\s (in)?to\s your\s (vital)?\s (bank)?\s (account|country)\b/
# "... vital bank account", "... country"
body __NIGERIAN_BODY_LOCAL_5 /\bhttp(s?):\/\/\W \/africa/
# One reference to http://news.bbc.co.uk/1/hi/world/africa/468903.stm
Post a Comment