# COMMERCIAL ADVANCE FEE FRAUD # # Current patterns. # # Updated and verified 4/16/06 # LOCALSCORE='-10' # Check for ALL CAPS SUBJECT LINE. # :0 D * $ ${LOCALSCORE}^0 * H ?? -3^0 ^Subject: [^A-Za-z]+$ * H ?? 3^0 ^Subject: [^a-z]+$ { LOCALSCORE=$= } # Main filters # :0 * $ ${LOCALSCORE}^0 * B ?? -1^1 (^|[^0-9a-z])(b.zz|float|mergers?|operating[^a-z]*$?[^a-z]*income|OTC|OTCBB|press|PR campaign|revenues?|sh[@a]res?|st[*o0]cks?|volumes?)([^0-9a-z]|$) * H ?? 5^0 ^From:.*[^0-9a-z](eresmas\.com)([^0-9a-z.]|$) * H ?? 5^0 ^From:.*@(walla\.com|\ walla\.co\.il) * H ?? 1^0 ^From:.*[^0-9a-z](3xl\.net|\ 3000\.it|\ atlas\.cz|\ Barrister|\ docklands\.co\.uk|\ e-apollo\.lv|\ echina\.com|\ email\.com|\ eramail\.co\.za|\ excite\.[a-z][a-z][a-z]?[a-z]?(\.[a-z][a-z])?|\ expn\.com|\ fastermail\.com|\ free-languages\.com|\ freemail\.et|\ go\.com|\ hotmail\.com|\ idial\.net|\ ignazio\.[a-z][a-z][a-z]?[a-z]?(\.[a-z][a-z])?|\ iol\.com|\ jmail\.co\.za|\ jumpy\.it|\ katamail\.com|\ latinmail\.com|\ lycos\.com|\ manchester\.com|\ msn\.com|\ myfamily\.com|\ netscape\.net|\ ozipilotsonline\.com\.au|\ plasa\.com|\ postino\.it|\ she\.com|\ teenmail\.co\.za|\ terra\.[a-z][a-z][a-z]?[a-z]?(\.[a-z][a-z])?|\ tiscali(net)?\.[a-z][a-z][a-z]?[a-z]?(\.[a-z][a-z])?|\ tsamail\.[a-z][a-z][a-z]?[a-z]?(\.[a-z][a-z])?|\ usermail\.com|\ velocall\.com|\ virgilio\.it|\ web\.de|\ web2mail\.com|\ wz\.zj\.cn|\ yahoo\.[a-z][a-z][a-z]?[a-z]?(\.[a-z][a-z])?|\ zipmail\.com(\.[a-z][a-z])?|\ zwallet\.com)([^0-9a-z.]|$) * H ?? 5^0 ^Subject:.*[^0-9a-z](Re:)?( )?(APPLICATION FOR PARTNERSHIP)([^0-9a-z]|$) * H ?? 2^0 ^Subject:.*[^0-9a-z](Re:)?( )?(ATTENTION|\ .*business.*(assistance|partners?).*|\ capital investment|\ contract( )*payment|\ FIDUCIAL.*AGENT|\ foreign.*(business|partner)|\ international.*order|\ investment.*proposal|\ Letter( )*of( )*Inquiry|\ MARKETING( )+AND( )+DISTRIBUTION|\ Over( )*due( )+Contract( )+Payment|\ PARTNERSHIP|\ PARTTIME WORKER|\ Representatives?( )+(needed|wanted)|\ supply( )*switch|\ urgent( )*order)([^0-9a-z]|$) * H ?? 1^0 ^Subject:.*[^0-9a-z](Re:)?( )?(agent|\ BONSOIR|\ business|\ capital|\ contract|\ distribution|\ fiducial|\ international|\ investment|\ marketing|\ order|\ partner(ship)?|\ part(-)?time|\ payment|\ proposal|\ representatives?|\ supply|\ urgent|\ worker)([^0-9a-z]|$) * B ?? 5^0 ^[^0-9a-z]*FROM THE DESK OF THE EXECUTIVE GOVERNOR[^0-9a-z]*$ * B ?? 5^0 (^|[^0-9a-z])(Brownmij|\ Central[^a-z]*$?[^a-z]*Bank[^a-z]*$?[^a-z]*of[^a-z]*$?[^a-z]*Nigeria|\ China[^a-z]*$?[^a-z]*Metallurgical|\ coingate[^a-z]*$?[^a-z]*(intl|international)|\ diplomatic[^a-z]*$?[^a-z]*corp(oration|s)?|\ Excel[^a-z]*$?[^a-z]*Import[^a-z]*$?[^a-z]*and[^a-z]*$?[^a-z]*Export|\ GUINEA[^a-z]*$?[^a-z]*EQUATORIAL[^a-z]*$?[^a-z]*DE[^a-z]*$?[^a-z]*PETROLEOS|\ MAJORBIZ|\ Merit consulting Int|\ MICH[ae][ae]L( )*AJAYI( )*procurment( )*LTD|\ Nigeria National Petroleum|\ N(\.)?N(\.)?P(\.)?C(\.)?|\ RusDeluxe|\ Seven.*$?.*Man[^a-z]*$?[^a-z]*Presidential[^a-z]*$?[^a-z]*Panel|\ Wen[^a-z]*$?[^a-z]*Zhou[^a-z]*$?[^a-z]*Jing[^a-z]*$?[^a-z]*Tong)([^0-9a-z]|$) * B ?? 5^0 (^|[^0-9a-z])quick[^a-z]*$?[^a-z]*and[^a-z]*$?[^a-z]*direct[^a-z]*$?[^a-z]*to[^a-z]*$?[^a-z]*the[^a-z]*$?[^a-z]*point([^0-9a-z]|$) * B ?? 5^0 (^|[^0-9a-z])establish[^a-z]*$?[^a-z]*a[^a-z]*$?[^a-z]*medium.*$?.*(of|from|customers)([^0-9a-z]|$) * B ?? 5^0 (^|[^0-9a-z])((anticipated|crediting)[^a-z]*$?[^a-z]*agent|honorable[^a-z]*$?[^a-z]*partnership)([^0-9a-z]|$) * B ?? 5^0 (^|[^0-9a-z])our[^a-z]*$?[^a-z]*representative.*$?.*payment[^a-z]*$?[^a-z]*agent([^0-9a-z]|$) * B ?? 5^0 (^|[^0-9a-z])earn[^a-z]*$?[^a-z]*[0-9]+%.*$?.*every[^a-z]*$?[^a-z]*payment[^a-z]*$?[^a-z]*made([^0-9a-z]|$) * B ?? 5^0 (^|[^0-9a-z])I[^a-z]*$?[^a-z]*am.*$?.*\ business[^a-z]*$?[^a-z]*development|\ (by[^a-z]*$?[^a-z]*name)([^0-9a-z]|$) * B ?? 5^0 (^|[^0-9a-z])(make[^a-z]*$?[^a-z]*payments.*$?.*payment[^a-z]*$?[^a-z]*officer)([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])celebrate.*$?.*opportunity.*$?.*reach[^a-z]*$?[^a-z]*you([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])(making[^a-z]*$?[^a-z]*payments.*$?.*through.*$?.*representatives?.*$?.*us)([^0-9a-z]|$) * B ?? 3^0 ^[^0-9a-z]*ATTN:( )*(Honorable Contractor)?[^0-9a-z]*$ * B ?? 3^0 ^[^0-9a-z]*Dear Prospect[^0-9a-z]*$ * B ?? 3^0 (^|[^0-9a-z])ALLOCAT(E|ION).*$?.*(LLPO|LPFO)([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])(business|investment|opportunity).*$?.*(America|U(\.)?S(\.)?A(\.)?|your[^a-z]*$?[^a-z]*country)([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])contract[^a-z]*$?[^a-z]*awards([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])(huge|millions?).*$?.*(dollars?|euros?|funds?|money|monies|securities)([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])foreign[^a-z]*$?[^a-z]*partners?([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])(clients?|customers?|representatives?).*$?.*(honest|reliable|reputable|trustworthy)([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])(any[^a-z]*$?[^a-z]*business.*$?.*your[^a-z]*$?[^a-z]*choice|\ (buying|selling).*$?.*(diamonds?|gold|minerals|precious[^a-z]*$?[^a-z]*stones)|\ cocoa.*$?.*exporter|\ experts.*$?.*sale.*$?.*raw[^a-z]*$?[^a-z]*materials|\ (export|market).*$?.*(polymer|raw[^a-z]*$?[^a-z]*materials|world[^a-z]*$?[^a-z]*(market|trade))|\ import/export.*$?.*industrialized[^a-z]*$?[^a-z]*goods|\ (high|world-class)[^a-z]*$?[^a-z]*manufacturing|\ leading[^a-z]*$?[^a-z]*manufacturer.*$?.*wall[^a-z]*$?[^a-z]*switches|\ spot[^a-z]*$?[^a-z]*lifting|\ supply.*$?.*raw[^a-z]*$?[^a-z]*materials|\ raw[^a-z]*$?[^a-z]*materials.*$?.*(exportation|importation|world[^a-z]*$?[^a-z]*trade))([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])item.*$?.*I[^a-z]*$?[^a-z]*(need|needed)([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])retire.*$?.*saved?.*$?.*money.*$?.*public[^a-z]*$?[^a-z]*service([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])invest.*$?.*business.*$?.*(you[^a-z]*$?[^a-z]*advi[cs]e|your[^a-z]*$?[^a-z]*country)([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])power[^a-z]*$?[^a-z]*of[^a-z]*$?[^a-z]*attorney.*$?.*manager?([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])shipping[^a-z]*$?[^a-z]*(charges?|costs?).*$?.*(Nigeria|West[^a-z]*$?[^a-z]*Africa)([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])want.*$?.*(buy|purchase).*$?.*from[^a-z]*$?[^a-z]*your?.*$?.*(l[a@]g[o0*]s|n[i1l]ger[i1l][a@]|west[^a-z]*$?[^a-z]*afric[a@])([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])(l[a@]g[o0*]s|n[i1l]ger[i1l][a@]|west[^a-z]*$?[^a-z]*afric[a@]).*$?.*\ cred[i1l]t( )*c[a@]rd([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])s+h+[i1l]+p+[^a-z]*$?[^a-z]*to.*$?.*(n[i1l]ger[i1l][a@]|west[^a-z]*$?[^a-z]*afric[a@])([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])(employees?.*$?.*bank[^a-z]*$?[^a-z]*transactions?|\ representatives?.*(funds|medium|monies|payments?).*(U.S.A.|Canada|Europe|the[^a-z]*$?[^a-z]*States))([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])(letter[^a-z]*$?[^a-z]*of[^a-z]*$?[^a-z]*intent|\ must[^a-z]*$?[^a-z]*have.*$?.*account.*$?.*\ (U(\.)?S(\.)?(A(\.)?)?|\ United[^a-z]*$?[^a-z]*(Kingdom|States)|\ U(\.)?K(\.)?))([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])reconfirm[^a-z]*$?[^a-z]*banking[^a-z]*$?[^a-z]*(details|information)([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])your[^a-z]*$?[^a-z]*representatives?.*$?.*power[^a-z]*$?[^a-z]*of[^a-z]*$?[^a-z]*attorney([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])outstanding[^a-z]*$?[^a-z]*contractors?.*$?.*not[^a-z]*$?[^a-z]*received.*$?.*payment([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])pay(ment)?.*$?.*(%|made|pct|percent).*$?.*(transaction)([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])(employees?.*$?.*accomplishing.*$?.*(bank|transactions?)|\ proper[^a-z]*$?[^a-z]*record.*$?.*transactions?|\ receive.*$?.*payments?.*$?.*customers?|\ representatives?.*$?.*customers?.*$?.*payments?)([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])representative.*$?.*receive.*$?.*(%|pct|percent)([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])representative.*$?.*(Canada|the states|U(\.)?S(\.)?A(\.)?).*$?.*(part?(-)?time|working[^a-z]*$?[^a-z]*for[^a-z]*$?[^a-z]*me)([^0-9a-z]|$) * B ?? 3^0 (^|[^0-9a-z])will[^a-z]*$?[^a-z]*like[^a-z]*$?[^a-z]*to[^a-z]*$?[^a-z]*order([^0-9a-z]|$) * B ?? 2^0 (^|[^0-9a-z])expected.*$?.*lifted.*$?.*allocation([^0-9a-z]|$) * B ?? 2^0 (^|[^0-9a-z])failure.*$?.*comply.*$?.*null?ify.*$?.*offer([^0-9a-z]|$) * B ?? 2^0 (^|[^0-9a-z])items?.*$?.*shipped.*$?.*international(ly)?([^0-9a-z]|$) * B ?? 2^0 (^|[^0-9a-z])oil[^a-z]*$?[^a-z]*and[^a-z]*$?[^a-z]*gas[^a-z]*$?[^a-z]*industry([^0-9a-z]|$) * B ?? 2^0 (^|[^0-9a-z])pay.*$?.*company[^a-z]*$?[^a-z]*credit[^a-z]*$?[^a-z]*card([^0-9a-z]|$) * B ?? 2^0 (^|[^0-9a-z])payment.*$?.*credit[^a-z]*$?[^a-z]*card([^0-9a-z]|$) * B ?? 2^0 (^|[^0-9a-z])(reply|respond).*$?.*(contact|details|number|particulars|phone|web[^a-z]*$?[^a-z]*site)([^0-9a-z]|$) * B ?? 1^0 (^|[^0-9a-z])(Benin|\ Equatorial[^a-z]*$?[^a-z]*Guinea|\ Lagos|\ Nigeria)([^0-9a-z]|$) * B ?? 1^0 (^|[^0-9a-z])(confidential(ity)?|professional(ism)?)([^0-9a-z]|$) { LT3=yes SBLOG="C3R-${TESTNAME} (Pattern Match)" INCLUDERC=${SBDIR}/functions/loglevel.rc }