Mailing List Archive

We're moving up the status quo -- "Dearest Friend"
This message slipped by with only 0.9 points... maybe it can be used to
create some more rules?

For one thing, I know that we are matching "Dear (something)", and even
"Dear Friend" specifically... but it looks like we are even more dear to
spammers now as they are calling us "Dearest" :-p

Maybe a rule (with a low point value) that triggers if the message contains
the name of any African country?



------------------------------------------------------------

X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11)
X-Spam-Level:
X-Spam-Status: No, hits=0.9 required=4.7
tests=FROM_ENDS_IN_NUMS,HTML_MESSAGE autolearn=no version=2.63
Subject: Mrs.Lazu Amed Nkomo


Dearest Friend,

Happy new year to you and your family.

It is my pleasure to write you at this crucial new year.
I found information about you and decided to contact you
for an important assistance. My name is Mrs.Lazu Amed Nkomo
a citizen of Zimbabwe, but I am writing from Accra Ghana.
I am the only wife of Kenneth Nkomo, a wealthy farmer and
senior politician with the opposition political party in my
country, Movement for Democratic Change [MDC]. Our wicked
President murdered my husband, Robert Mugabe and I fled my
country because I have become his next target to eliminate.

My husband was a fighter for Justice and a moving force in
the MDC, a part wanting to end the several years of brutal
dictatorship government of President Robert Mugabe. You
will read more stories about President Mugabe's brutal acts
by visiting this web sites;
http://www.rte.ie/news/2000/0418/zimbabwe.html

My husband was accused of Treason and also assisting the
White farmers in fighting the government. Few weeks after
his arrest, he was reported dead. The government claimed he
died of heart attack and his body was never seen for proper
autopsy, they buried him in the government cemetery. My
husband's associate Mr. Martin Olds a White farmer from
Britain assisted me in fighting my husband's death through
the Court and media; the government saw us as a big treat
to them and decided to eliminate us. Mr. Martin Olds was
attacked and murdered in his house, but fortunately, before
they came looking for me, I received the news and I had to
flee through the border to Accra Ghana to save my life. My
arrival here in Accra Ghana still remains like a miracle to
me.

Here, is my reasons for contacting you, I need to bring my
family and that of Mr. Olds out of Zimbabwe as soon as
possible before any more harm is done on them. I am having
a huge sum of money in the total sum of $25.6Million
presently hidden in a safe place. My husband kept this
money in two trunk boxes in disguise as family treasures
and could not bank them, because of the situation in my
country. My husband's business, farms and banks account was
seized by the government before his arrest and murder.

He told me everything concerning the funds while he was
still in detention and I have made a solid arrangement
concerning the shipment of the boxes out of my country
because we cannot invest it there. I was on
the process when I fled the country. I need your assistance
in securing the funds to your country, so that I can
arrange for my family and that of the Olds to join me in
your country. I am willing to offer you 30% of the
$25.6Million for your kind assistance.

Please, let me know if you can assist me, so that I can
give you more details on how we shall proceed and also to
meet face to face. As I wait for your urgent response,
please treat this information as top secret and send your
telephone number so that I can speak with you. Thank you
and God bless. Also try to read these web site for more
clarifications.

Regards,

Mrs.Lazu Amed Nkomo
Email: mrslazuamed@zwallet.com
233-20-8213660


MORE SITES ABOUT MUGABE'S BRUTAL GOVERNMENT
http://publish.indymedia.org.uk/en/2003/04/64376.html
http://www.telegraph.co.uk/news/main.jhtml?xml=/news/2002/08/13/wzim13.xml
http://www.guardian.co.uk/Archive/Article/0%2C4273%2C4332401%2C00.html
Re: We're moving up the status quo -- "Dearest Friend" [ In reply to ]
On Thu, 11 Mar 2004, Nicholas Venturella wrote:

> This message slipped by with only 0.9 points... maybe it can be used to
> create some more rules?

[419 scam snipped]

Even missing all the headers, this one scored 8.3 on my
system. The keys (watch line-wrap!):

body __CRF_THIRDWORLD /(?"ghana|nigeria|sierra leone|south africa|c.te .{0,2}ivoire|liberia|lagos|zimbabwe|botswana|abijan|congo)/i
describe __CRF_THIRDWORLD Mentions third world nations well known for scams

body __CRF_FARMERS /(?:white|black) farmers/i
describe __CRF_FARMERS Talks about white or black farmers

body __CRF_KILLING /(?:murder|kill|slay|assassinate|poison)/i
describe __CRF_KILLING In here we slay spam, not people!

body __CRF_ASYLUM /(?:asylum|flee|fled|escape)/i
describe __CRF_ASYLUM Talks about asylum or fleeing

body __CRF_EXILE /exile/i
describe __CRF_EXILE Send the 419ers into exile, please!

body __CRF_TINHORNS /(?:mobutu|mugabe|taylor|savimbi|kabila|sese-?seko)/i
describe __CRF_TINHORNS Talks about African tinhorns

meta CRF_419_TINHORNS ((__CRF_THIRDWORLD + __CRF_TINHORNS + __CRF_ASYLUM + __CRF_EXILE) > 2)
describe CRF_419_TINHORNS 419 fraud featuring African tinhorns
score CRF_419_TINHORNS 2.75

meta CRF_419_FARMERS ((__CRF_THIRDWORLD + __CRF_FARMERS + __CRF_KILLING) > 2)
describe CRF_419_FARMERS Talks about the plight of third-world "farmers"
score CRF_419_FARMERS 2.75

Please note that those are alpha-quality rules; I'm actively working
on improving their accuracy. More tinhorns need to be added, as do more
nations.

> For one thing, I know that we are matching "Dear (something)", and even
> "Dear Friend" specifically... but it looks like we are even more dear to
> spammers now as they are calling us "Dearest" :-p

Please, oh PLEASE(!), don't key tests on the word "friend" (note
my surname). You have no idea how often I run afoul of rules like
that.

Also, don't damn someone who starts a letter off with "Dear"; it's
not terribly common these days, but some folks still cling to the
obsolete notion that e-mail is equivalent to a "postal" letter.

> Maybe a rule (with a low point value) that triggers if the message contains
> the name of any African country?

I already do that in some instances with a *tiny* default score, but
with a per-user-overridable value. It's proved useful for some folks,
but not for others; it depends on the individual's traffic. Don't score
any nation's name very high; it'll break all sorts of stuff.

Cheers.

+------------------------------------------------+---------------------+
| Carl Richard Friend (UNIX Sysadmin) | West Boylston |
| Minicomputer Collector / Enthusiast | Massachusetts, USA |
| mailto:crfriend@rcn.com +---------------------+
| http://users.rcn.com/crfriend/museum | ICBM: 42:22N 71:47W |
+------------------------------------------------+---------------------+
Re: We're moving up the status quo -- "Dearest Friend" [ In reply to ]
Carl R. Friend wrote:

> body __CRF_THIRDWORLD /(?"ghana|nigeria|sierra leone| [...]

As the sequence ?" is not recognized by the regex compiler, I assume
you want ?: instead, as in the other alternation patterns?

--
Mit freundlichen Grüßen / Yours sincerely
Dipl. Inform. Ralph Seichter

HORUS-IT
Ahornweg 10
D-57635 Oberirsen
Tel +49 2686 987880
Fax +49 2686 987889
http://horus-it.de/
Re: We're moving up the status quo -- "Dearest Friend" [ In reply to ]
On Sat, 13 Mar 2004, Ralph Seichter wrote:

> Carl R. Friend wrote:
>
> > body __CRF_THIRDWORLD /(?"ghana|nigeria|sierra leone| [...]
>
> As the sequence ?" is not recognized by the regex compiler, I assume
> you want ?: instead, as in the other alternation patterns?

Yes, it should be "?:". I fluffed that when I manually added
it during a cut-and-paste session on an original that didn't have
it. Fat fingers.

+------------------------------------------------+---------------------+
| Carl Richard Friend (UNIX Sysadmin) | West Boylston |
| Minicomputer Collector / Enthusiast | Massachusetts, USA |
| mailto:crfriend@rcn.com +---------------------+
| http://users.rcn.com/crfriend/museum | ICBM: 42:22N 71:47W |
+------------------------------------------------+---------------------+