On Fri, Jun 06, 2003 at 04:53:04PM -0500, David W. Tamkin wrote:
The volume of 419 spam I'm getting has suddenly skyrocketed, and I'm
sick of deleting it manually. Does anyone have a good way for procmail
to spot it? Wordings vary, and some versions are rife with misspellings.
I've got a 419 section in http://www.it.ca/software/procmail-spamtrap
which appears to do a fairly good job, but I find that most of my 419
crap gets caught by recipes that look for forged mail from free
providers. For list posterity, my 419 recipe is:
## Nigerian hoo-hah (419 scam)
:0 fhw
* ! ^Subject:.*(spam|fraud|complaint)
* -10^0
* 3^0 ^Subject:.*(BUSINESS PROPOSAL|URGENT AND CONFIDENTIAL)
* 7^0 B ?? ()(Nigeria|West[^a-z]+African|Sierra[^a-z]+Leonean|Zimbabwe)
* 1^1 B ??
(million|dollar|confidential|government|bank[^a-z]+(transfer|account)|(exchange|request).*assistance)
* 2^1 B ?? ()(Western +Sahara +Sahara|\
popular black farmer from|\
since you do not know me personally|\
(husband|wife|brother|sister|son|daughter) of the late |\
Governor +Saliq +Hama|\
General +Sann?i +Abacha|\
(Mrs\.?|chief) +(Monica|Kate|Tanko) +Dalu|diamond +farm\.|\
President +(Olusegun +Obasanjo|(Robert +)?Mugabe|Samuel Doe)|\
MALIKA +OZUBU|KALU OBINA|SUNDAY IKECHUKWU|Kc Ugo|Emmanuel Achi|\
(sani|mohammed) abacha|Mohaed Keffas|Richard Obule|jinja kawara|\
Andrew Nwankwo|cisse coudere|innocent salisi|adamu lar|ike dada|\
(Joseph|President) Mobutu Sese-Seko|Marian Lugane|Laurent Kabilla|\
Mr\.? Dr\.? Lobo|\
(Union Bank|supreme court) of (nigeria|Zimbabwe)|\
Zenith (international|Comm.+) Bank|Central Bank Of|\
Military Regimes|imbabwean war veterans|\
IBA.+Ouagadougou.+Burkina-faso.+West Africa|\
Nigerian National Petroleum Corporation|\
Senate Committee on Foreign Contract Payment|\
r.u.f.+liberation movement|\
as the Liberian President|\
(Thirty|Fourty|fifty)-Five Million|\
(hundred thousand|Million) (US|United States) Dollars|\
am seeking political asylum|\
funds which are (now|currently|presently) trapped|\
(utmost|absolute) secrecy.*transaction|\
future.*your hands)
* 2^1 B ?? account.+14-[1-9][0-9][0-9]-2[0-9][0-9][0-9])
* 2^1 B ?? ()\<(01[^0-9]*775[^0-9]*458[^0-9]*0407|\
229[^0-9]*98[^0-9]*60[^0-9]*75|\
225[^0-9]*07909305|\
234[^0-9]*(\
80[^0-9]*(334(19348|77384|72229)|330(30534|23284))|\
0?1[^0-9]*(759[^0-9]*(3100|0198|3311|2631|6668|9940)|774[^0-9]*2619|776[^0-9]*0618)))
* 1^0 $ ^(From|Return-Path):.+$FREEMAIL
| formail -A "$ST_MARKER nigernian hoo-hah"
Note the $FREEMAIL reference.
--
Paul Chvostek
<paul(_at_)it(_dot_)ca>
Operations / Abuse / Whatever
it.canada, hosting and development http://www.it.ca/
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail