Re: "KAUF-TIPP DER WOCHE" spam getting through

> On Wed, 28 Mar 2007, Panagiotis Christias wrote:
>
> > the last days we get a lot of spam like this:
> >
> > KAUF-TIPP DER WOCHE
>
> I wrote a few of my own rules especially to catch those stocks scams
> together with bayes. If you don't have any people who should write you in
> German you can also use the X-Languages tag to boost the score if the mail
> is written in German.
>
> Here are my current rules, which should also catch the German stocks.
> Maybe there are some false positives in a real stock environment, but for
> me they work fine:
>
> body      __HILO_STOCKS1  /(High|Low|Curr[e3]nt|Cur(r|\r.|r[e3]nt|\.)\
> P(ric[e3])?|Pric[e3]|Last)[\:\ \t]+\$[\d\
> ]+?(.*)(Last|Low|Growth|Grow||High|Sale|Pric[e3]|Vol|[E3]xp)[\:\ \t]+/i
> body      __HILO_STOCKS2  /curr[e3]n[t7](ly)?[\ \t\_]+?\:[\ \t\_\$]+?\d/i
> body      __HILO_STOCKS2  /[e3](x|ks)p[e3]ct[e3]d?[\ \t\_]+?\:[\
> \t\_\$]+?\d/i
> body      __HILO_STOCKS3  /our[\ \t\_]+?(last[\ ]+?)?pick[\:\
> \t\_\;\=\,]/i
> body      __HILO_STOCKS4  /\d[\
> \t\_]+?(c[e3]nt|dollar|[e3]ur|p[e3]nc[e3])/i
> body      __HILO_STOCKS5  /(c[e3]nt|dollar|[e3]ur[o]?|p[e3]nc[e3])[\
> \t\_]+?\d/ibody      __HILO_STOCKS9  /(hot[\
> \t\_]+?list|r[e3]cord|publicity\ |n[e3]ws\
> |invest|incr[e3]as[e3]|[e3]xplosion|high\
> |pr[e3]mium|mark[e3]t|al[e3]rt|sym[b8]ol|the\ rush|your\ radar|g[e3]t\
> [i1]n|schluss\-?stand|prognose|kauf\-?tip)/i
>
> meta      HILO_STOCKS     ( ( __HILO_STOCKS1 || __HILO_STOCKS2 ||
> __HILO_STOCKS3 || __HILO_STOCKS4 || __HILO_STOCKS5 ) && __HILO_STOCKS9 )
> describe  HILO_STOCKS     Looks like stocks scam
> score     HILO_STOCKS     3.0
>
>
>