#LAST UPDATED 09.01.2021 #SKIPIFWEIGHT 25 MINWEIGHTTOFAIL 8 #--------------------------------------------------------------------# # SCAM EXCEPTIONS # #--------------------------------------------------------------------# TESTSFAILED END PCRE (BONDEDSENDER|GOOD-REVDNS|IADB) #--------------------------------------------------------------------# # SCAM TERMINOLOGY # #--------------------------------------------------------------------# BODY 1 PCRE (i:beneficiary) BODY 1 PCRE (i:attention) #BITCOIN ENCODED (PCRE compile failed. Error: character value in \x{...} sequence is too large) #BODY 50 PCRE (?i:(\x{03B2}|\x{0392}).+\x{03C4}.+[\x{03B9}]n) #ATTACHMENT BODY 6 PCRE (?i:(?:urgent|notification|from\b|BUSINESS PROPOSAL).{0,15}\.(doc|pdf)") #--------------------------------------------------------------------# # SCAM EMAILER # #--------------------------------------------------------------------# TESTSFAILED 1 PCRE (?i:ISP-(HOMAIL|YAHOO)) HEADERS 5 PCRE (?i:Undisclosed.?recipients) HEADERS 3 PCRE (?i:Reply-to:.*@(yahoo|hotmail).(cn|tw|hk|ru)) #GENERIC ENVELOPE MAILFROM MAILFROM 1 PCRE (?i:(anonymous|apache|cgi-mailer|hostadmin|httpd|info|nobody|root|web(users)?|www(-data|run)?)@?) BODY 2 PCRE (?i:\@(hotmail|yahoo)\.(fr|it|hk|cn)) #ENTIRE BODY IN CAPS #BODY 5 PCRE (\b([A-Z0-9]|\W){250}\b) #--------------------------------------------------------------------# # SCAM LOCATIONS # #--------------------------------------------------------------------# COUNTRIES 2 PCRE (A[EP]|CI|DK|E[ST]|GH|I[LT]|NG|P[ST]|S[NV]|ZA) BODY 2 PCRE (?i:here in (Abidjan|Cotonou|Nigeria|Muzarabani|Z(aire|imbabwe))) BODY 4 PCRE (?i:COTE D'.{0,2}IVOIRE) BODY 1 PCRE (?i:\blagos\b|Sierra.Leone|Democratic Republic of Congo|Ivory Coast) #BENIN BODY 5 PCRE (?i:\+229) #--------------------------------------------------------------------# # SCAM SUBJECT # #--------------------------------------------------------------------# #SUBJECT IN CAPS < 6 LETTERS SUBJECT 2 PCRE (?m:[A-Z_\W]{6,30}$) SUBJECT 20 PCRE ((YOUR HONESTY|PAYMENT OFFICER) REQUIR?ED) SUBJECT 20 PCRE (ATTENTION.?:.?(Sir|Madam|BENEFICIARY)) SUBJECT 20 PCRE (CONTACT THE SECRETARY) SUBJECT 20 PCRE ((BANK|BENEFICIARY).INHERITANCE) SUBJECT 10 PCRE (?i:Treat as urgent) SUBJECT 10 PCRE (?i:Good day beneficiary) SUBJECT 10 PCRE (BUSINESS (TRANSACTION|INVESTMENT|PURSUIT|ASSIST?ANCE)) SUBJECT 10 PCRE (COMPLIMENTS|NICE TO MEET YOU|REPRESENTATIVE NEEDED) SUBJECT 5 PCRE ((HIGHLY|REPLY).{1,2}(URGENT|ASAP|NEEDED|US)) SUBJECT 5 PCRE (I NEED YOUR (HELP|INTEREST|RESPONSE|URGENT|ASSISTANCE|SINCERE)) SUBJECT 5 PCRE (OUTSTANDING PAYMENT) SUBJECT 5 PCRE (URGENT(LY)? (ASSISTANCE|NEEDED)) SUBJECT 5 PCRE (JOINT VENTURE) SUBJECT 5 PCRE (TRANSFER OF) SUBJECT 5 PCRE (?i:(!\?ISO)([A-Z0-9]*_){2}) SUBJECT 5 PCRE (REQUEST FOR ASSISTAN(CE|T)) SUBJECT 5 PCRE ((SEEKING|MATTER|INVESTMENT).{0,10}ASSISTANCE) SUBJECT 5 PCRE (CONTACT ME (BACK|URGENTLY)) SUBJECT 5 PCRE (?i:Request for business partnership) SUBJECT 5 PCRE (DEAR BELOVED|Dear_Friend) SUBJECT 3 PCRE (HELP ME|AN APPEAL|MY_EMAIL|BE OF HELP) SUBJECT 3 PCRE (PLEASE.(HELP|ASSIST)) SUBJECT 2 PCRE (INQUIRY|COMPLIMENTS|IN GOD WE TRUST) SUBJECT 2 PCRE (RESPOND A.?S.?A.?P) SUBJECT 2 PCRE (PLEASE READ) SUBJECT 2 PCRE (?i:good day\.) SUBJECT 2 PCRE (?i:reply.{0,10}(me|immediately|soon|urgent|now)) SUBJECT 2 PCRE (?i:get back to me) SUBJECT 2 PCRE (?i:will of god|Have a nice day) SUBJECT 1 PCRE (?i:urgent) SUBJECT 1 PCRE (?i:attention) SUBJECT 2 PCRE (?i:Investment (Opportunity|Programme|Help)) SUBJECT 1 CONTAINS A DISPLACED ZIMBABWEAN WIDOW IN NEED. SUBJECT 1 CONTAINS ASSIST ME AND RESPOND SUBJECT 1 CONTAINS AWAITNG FOR YOUR TELEPHONE CALL SUBJECT 1 CONTAINS BE OF HELP SUBJECT 1 CONTAINS BLESS YOU DEAR. SUBJECT 1 CONTAINS BY HIS GRACE SUBJECT 1 CONTAINS CAN WE DO THIS TOGETHER SUBJECT 1 CONTAINS clinton_philips SUBJECT 1 CONTAINS COMMISSIONER SPECIAL FRAUD / CORRUPTION INTELLIGENT SUBJECT 1 CONTAINS Contract Supply. SUBJECT 1 CONTAINS CRY FOR HELP SUBJECT 1 CONTAINS Dear_Friend SUBJECT 1 CONTAINS FAMILY SAGA SUBJECT 1 CONTAINS GREAT FAVOUR SUBJECT 1 CONTAINS Greetings from me and my family SUBJECT 1 CONTAINS Have a nice day SUBJECT 1 CONTAINS I Choose You. SUBJECT 1 CONTAINS I LOOK UP TO YOU SUBJECT 1 CONTAINS I WILL APPRECIATE YOUR QUICK RESPONDS SUBJECT 1 CONTAINS important enquiry SUBJECT 1 CONTAINS IN GOD WE TRUST SUBJECT 1 CONTAINS Kind Regards SUBJECT 1 CONTAINS Estate/ Attention Needed. SUBJECT 1 CONTAINS LETS DO THE WORK OF GOD SUBJECT 1 CONTAINS LETS_COMMENCE SUBJECT 1 CONTAINS LETTER OF INVESTMENT SUBJECT 1 CONTAINS MATTER OF URGENCY FROM KAMARA'S FAMILY SUBJECT 1 CONTAINS Midland Consulting Limited. SUBJECT 1 CONTAINS MUTUAL BUSINESS RELATIONSHIP SUBJECT 1 CONTAINS MY_EMAIL SUBJECT 1 CONTAINS name of almighty god SUBJECT 1 CONTAINS NICE TO MEET YOU SUBJECT 1 CONTAINS please save our soul SUBJECT 1 CONTAINS PLEASE YOUR HELP NEEDED SUBJECT 1 CONTAINS Prime Bank Auditor (Kim Lee) SUBJECT 1 CONTAINS PRIVATE & CONFIDENCIAL SUBJECT 1 CONTAINS Private_Offer SUBJECT 1 CONTAINS READ VERY CAREFULLY AND REPLY IF OKAY SUBJECT 1 CONTAINS REFERRED MAIL SUBJECT 1 CONTAINS REPRESENTATIVE NEEDED SUBJECT 1 CONTAINS TREAT AS URGENT SUBJECT 1 CONTAINS VITAL REQUEST SUBJECT 1 CONTAINS will of god SUBJECT 1 CONTAINS WILLED FUNDS SUBJECT 1 CONTAINS WILLINGNESS AND TRUST SUBJECT 1 IS Transaction SUBJECT 1 IS PRIVATE SUBJECT 1 IS My life SUBJECT 1 IS HELP SUBJECT 1 IS HAPPY NEW YEAR SUBJECT 1 IS greetings SUBJECT 20 IS rgent. SUBJECT 10 STARTSWITH CONTACT ME. SUBJECT 20 CONTAINS SERIOUS MESSAGE TO YOU SUBJECT 10 IS FOR YOU ATTENTION #--------------------------------------------------------------------# # SCAM SALUTATION # #--------------------------------------------------------------------# ANYWHERE 10 PCRE (?:(ATT(N?|ENTION)|DEAR)[:_]?.?(?i:(Sir/Madam|Beneficiary|Friend|Taxpayer))) BODY 5 PCRE (?i:Dear(est)?.(Beneficiary|Friend[,.]|sir|one)) BODY 5 PCRE (?i:attn.{1,6}(Sir|Managing Director|president|Dearest|Beneficiary)) BODY 8 PCRE (?i:Dearest,) BODY 3 PCRE (?i:Beloved) #--------------------------------------------------------------------# # SCAM INTRODUCTION # #--------------------------------------------------------------------# ANYWHERE 5 PCRE (FROM THE DESK OF) BODY 3 PCRE (?i:you do not know me personally) BODY 3 PCRE (?i:apologize for my intrusion) BODY 3 PCRE (?i:accept my sincere apologies) BODY 2 PCRE (FROM: MR.) BODY 2 PCRE (?i:My name is) BODY 2 PCRE (?i:i am.(dr|mr|miss|former|prince|soliciting|offering|the above|the heir|chief|lady)) BODY 2 PCRE (?i:I am .{0,20} the (mother|father) to) BODY 2 PCRE (?i:we have not met before) BODY 2 PCRE (?i:personal secretary to) BODY 1 PCRE (?i:(only)?.(daughter|son) of) BODY 1 PCRE (PERMIT ME) BODY 1 PCRE (?i:national of your country) BODY 1 PCRE (?i:introduce myself) #--------------------------------------------------------------------# # SCAM TITLE # #--------------------------------------------------------------------# BODY 1 PCRE (?i:Barrister) #--------------------------------------------------------------------# # SCAM POSITION # #--------------------------------------------------------------------# BODY 5 PCRE (DIRECTOR.{15}AUDIT) BODY 3 PCRE (?i:nigerian.(chief|export|ports).{1,4}(promotion|authority|general)) BODY 3 PCRE (?i:former.{1,15}(president|chairman|head of state|military|regime)) BODY 2 PCRE (?i:government.of.nigeria) BODY 2 PCRE (CHAMBER OF COMMERCE) BODY 2 PCRE (?i:solicitor at law) BODY 2 PCRE (?i:credit officer) BODY 1 PCRE (?i:head of state) BODY 1 PCRE ((?i:(minist(er|ry)|director)\sof\s(?:development|finance|transport|Mining|works))) #--------------------------------------------------------------------# # SCAM BANK # #--------------------------------------------------------------------# BODY 2 PCRE (?i:bank.(of|for).(Egypt|Nigeria|Africa|Ghana)) BODY 2 PCRE (?i:un(?:ion|ited).bank.(of|for).(Egypt|Nigeria|Africa)) BODY 1 PCRE (?i:Central Bank of (Sierra Leone|West African)) BODY 2 PCRE (?i:(Metropolitan|Union|development|eco|trust|Hang Seng|leading|reserve|standard|swiss).?bank) #--------------------------------------------------------------------# # SCAM URGENT & CONFIDENCE # #--------------------------------------------------------------------# ANYWHERE 2 PCRE (?:maximum|strict(ly)?|very|great|absolute|high(est|ly)|utmost).{0,11}(?i:confiden(ce|tial(ity)?)) ANYWHERE 2 PCRE (?i:confidential business (proposition|proposal|relationship)) ANYWHERE 2 PCRE (?i:urgent.{1,10}(assist(?:ance|ant)|reply|message|help|respon(?:d|ce|se)|confiden(?:tiel|tial|cial)|attention|business|proposal|desk|inheritance|letter|contact|notice|request)) ANYWHERE 1 PCRE (CONFIDENTIAL) BODY 5 PCRE (?i:urgent proposal to discuss) BODY 1 PCRE (?i:utmost discretion) BODY 1 PCRE (?i:security.(finance|purposes|agent|vault|finance)) ANYWHERE 2 PCRE ((CONFIDENTIAL|FINANCIAL).TRANSACTION) BODY 2 PCRE (HIGH LEVEL OF CONFIDENTIALITY) BODY 3 PCRE (?i:secrecy and confidentiality) BODY 3 PCRE (FOR CONFIDENTIAL PURPOSE) #--------------------------------------------------------------------# # DEATH # #--------------------------------------------------------------------# BODY 1 PCRE (?i:Murdered|Killed|Perished|assasinated|poisoned|brief illness|rebel shoot-out) BODY 1 PCRE (?i:(automobile|car|plane|airplane|Air Plane|auto).(accident|wreck|crash)) BODY 1 PCRE (?i:died.{0,30}(with his entire family|liver problems)) BODY 2 PCRE (?i:my late.(father|husband|brother|sister)) BODY 1 PCRE (?i:(wife|son|daughter|widow|child).{0,8}late) BODY 1 PCRE (?i:after the death) ##BODY 1 PCRE (?i:\b(?:ass?ass?inat(?:ed|ion)|murder(?:e?d)?|kill(?:ed|ing)\b[^.]{0,99}+.*\b(?:war veterans|rebels?))\b) BODY 2 PCRE (?i:(assasination|regime.{0,5}overthrown|war.{0,5}against)) #--------------------------------------------------------------------# # INHERITANCE # #--------------------------------------------------------------------# BODY 1 PCRE (?i:(next.of|any).kin\b) BODY 1 PCRE (?i:(sole|without|true|stand as (his|the)|original|end|my family|no.{0,2}(other)?).{0,2}beneficiary) BODY 1 PCRE (?i:entitled to \d\d\%) BODY 1 PCRE (?i:clients extended Relatives) BODY 2 PCRE (?i:(leaving no|without making a|behind no).WILL) BODY 1 PCRE (?i:beneficiary.(died alongside|of this fund|to the bequest)) #--------------------------------------------------------------------# # MONEY # #--------------------------------------------------------------------# BODY 1 PCRE (with a security and finance) BODY 1 PCRE (large amount of funds) BODY 1 PCRE (?i:evacuate the sum of) BODY 1 PCRE (?i:\bunclaimed (?:funds|money|fund|prizes?|rewards?)\b) BODY 8 PCRE (?i:discovered an abandoned sum) BODY 8 PCRE (?i:an abandoned sum of \$) BODY 2 PCRE (?i:Presently, this money is still) BODY 2 PCRE (?i:fund on our behalf) BODY 1 PCRE (?i:operate.{0,3}foreign.{0,6}account) BODY 1 PCRE (?i:(handle|assistance in).this transaction) BODY 1 PCRE (?i:(with|in).a security company) BODY 1 PCRE (?i:my share in your country) BODY 1 PCRE (?i:security company in.{0,30}) BODY 1 PCRE (?i:(secure|invest(ing|ment)?|transfer(ring)?|donate|guardian|claim(ing)?|repatriat(ing|e)).{0,5}(th(is|ese|e) (funds?|money|US))) BODY 1 PCRE (?i:DORMANT ACCOUNT) BODY 1 PCRE (?i:security company deposit) #--------------------------------------------------------------------# # ASSISTANCE # #--------------------------------------------------------------------# ANYWHERE 1 PCRE (?i:(my|business|this).proposal) ANYWHERE 1 PCRE (?i:(proposed|future).investment) ANYWHERE 1 PCRE (?i:(business|noble|investment|mutual|great|reliable|urgent|sincere).{0,15}assistance) BODY 8 PCRE (?i:solicit your attention to recieve money) BODY 5 PCRE (?i:venture in your country) BODY 1 PCRE (?i:solicit your help) BODY 1 PCRE (?i:Blessed is the hand that giveth) BODY 2 PCRE (?i:(solicit|seek|require|humble|need|anticipated).{1,10}(?:assistance|(co).?operation)) BODY 1 PCRE (?i:\d\d\% (for|of|to|will be|would be).{0,6}\b(you|me|us|assisting|expense|fund|money)) BODY 1 PCRE (?i:co-operation in this transaction) BODY 1 PCRE (?i:assistance (to|in).(invest|front|transfer)) BODY 1 PCRE (?i:Kindest attention) BODY 1 PCRE (?i:I offer my friendship) BODY 1 PCRE (?i:assist (me|us)) #--------------------------------------------------------------------# # REQUIREMENTS # #--------------------------------------------------------------------# BODY 5 PCRE (?i:FOREIGNER WITH A FOREIGN ACCOUNT) BODY 1 PCRE (?i:(trust(worthy|ed)|reputable).(?:foreigner|individual|partner|person|bank)) BODY 1 PCRE (?i:\breliable.{0,2}(overseas|foreign)?.{0,2}(partner|person)) BODY 2 PCRE (?i:((for(ei|ie)gn).(business|trusted)?).?(associate|partner|personality)) BODY 2 PCRE (?i:honest.(co.?operation|assistance)) BODY 1 PCRE (?i:letter of (authori(ty|zation))) BODY 1 PCRE (?i:invest in your country) BODY 2 PCRE (?i:\boperat(?:e|ing)\b[^.]{0,99}\b(?:for[ie]{2}gn|off-? ?shore|over-? ?seas?) (?:bank )?accounts?\b) BODY 2 PCRE (?i:Interest is Genuine) BODY 2 PCRE (?i:suspen[cs]e account) BODY 1 PCRE (?i:plans to invest) BODY 1 PCRE (?i:named person from) BODY 1 PCRE (?i:off.?shore account) ANYWHERE 2 PCRE (?i:business.(proposal|engagment)) ANYWHERE 2 PCRE (?i:regarding a transfer) #--------------------------------------------------------------------# # POSITION # #--------------------------------------------------------------------# BODY 1 PCRE ((?i:minist(er|ry)\s(of|for)\s(?:development|finance|transport|Mining|works))) BODY 1 PCRE (?i:(\boil|diamond|cocoa)\s(merchant|explorer|minister)) BODY 1 PCRE (?i:(sports|cabinet).minister) #--------------------------------------------------------------------# # INDUSTRY # #--------------------------------------------------------------------# BODY 3 PCRE (?i:Yukos oil) BODY 1 PCRE (?i:diamond.(shop|mining|securities)) BODY 1 PCRE (?i:Sierra.Leone mining) BODY 1 PCRE (?i:Department of Minerals and Energy) BODY 1 PCRE (?i:National Petroleum Corporation) #--------------------------------------------------------------------# # INFORMATION NEEDED # #--------------------------------------------------------------------# BODY 1 PCRE (?i:provide me with your full) BODY 1 PCRE (?i:full name) BODY 1 PCRE (?i:direct phone) BODY 1 PCRE (?i:fax numbers) BODY 2 PCRE (?i:confidential telephone number) BODY 1 PCRE (?i:indicating your bank name) BODY 1 PCRE (?i:mutual benefits) BODY 1 PCRE (?i:i will provide the necessary information) #--------------------------------------------------------------------# # COMPENSATION # #--------------------------------------------------------------------# BODY 3 PCRE ((getting|pay|remuneration).{1,50}\d\d\% of the total) BODY 1 PCRE (concede \d\d\% of the) BODY 1 PCRE (?i:funds into your account) BODY 1 PCRE ((give|offer|compensate).you.{0,6}\d\d\%) BODY 1 PCRE (?i:\% of the total) BODY 1 PCRE (?i:\b\d\d\% (for|to|will be|would).{1,10}(you|me|us|assisting|expense|money|fund)) BODY 1 PCRE (?i:Telegraphic Transfer) BODY 1 PCRE (?i:sharing ratio) BODY 1 PCRE (?i:Your commission will be) BODY 1 PCRE (?i:\bgive\s+you .{0,15}(?:fund|money|total|sum|contact|percent)\b) BODY 1 PCRE (?i:(move|receive) this money) BODY 1 PCRE (?i:Send your payment through Money Gram) #--------------------------------------------------------------------# # RISK # #--------------------------------------------------------------------# BODY 3 PCRE (?i:(hitch|risk)(.?|\s|\s.)free) BODY 2 PCRE (?i:diplomatic.(courier|coverage)) BODY 2 PCRE (?i:no risk involved) BODY 2 PCRE (?i:100\% foolproof) BODY 1 PCRE (?i:completely safe and secure) BODY 1 PCRE (?i:breach of the law) #--------------------------------------------------------------------# # MILLIONS # #--------------------------------------------------------------------# BODY 5 PCRE (?i:total.sum.{1,15}([0-9]{1,3}[,.][0-9]00[,.][0-9]{3}([,.][0-9]{2})?)) BODY 2 PCRE (?i:(\$|us[d$]?|£).?(\d{1,3}[,.]){2}\d\d.?(us[d$])?) BODY 2 PCRE (?i:Million\b.{0,40}\b(?:United States? Dollars?|USD?)) BODY 3 PCRE (?i:\b(?:\d{1,3})?Million\b.{0,40}\b(?:Canadian Dollar?s?|US\$|U\.? ?S\.? Dollar|Euro)) BODY 2 PCRE (?i:US\$\s\d\d\.\d.million dollars) BODY 5 PCRE (?i:(\$|us[$d]?|£).?(\d{1,3}[,.]){3}(\((?m:(One|T(wo|hree)|F(our|ive)|S(ix|even)|Eight|Nine).million.{0,10}hundred.{0,3}thousand.{0,3}dollars?)\))) BODY 6 PCRE (?i:(\$|usd|£).?\d{1,3}[,.]\d{1,3}[,.]\d{1,3}.{0,7}(\((?m:.{0,20}million.{0,20}hundred.{0,20}thousand.{0,20}dollar(?:s)?\)))) BODY 4 PCRE (?i:(\$|usd|£).?(\d{1,3}[,.]){3}.{0,7}(?m:.{0,20}million.{0,20}hundred.{0,20}thousand.{0,20}.(British.*Pounds|dollar(?:s)?)\))) BODY 7 PCRE (?i:(\$|us[d$]?|£).?(\d{1,3}[,.]){3}\d\d.?\(.*million.*?\)) BODY 7 PCRE (?i:0Million) BODY 1 PCRE (?i:million.{0,2}united.{0,2}state(?:s)?.{0,2}dollar) BODY 1 PCRE (?i:thousand.{0,2}((U.{0,2}S).{0,3}(dollar)|Eruo)) BODY 1 PCRE (?i:sum of U.?S.?) BODY 1 PCRE (?i:huge (amount|sum) of money) BODY 3 PCRE (?i:millions? left behind) BODY 2 PCRE (?i:Million\s+United\s+States\s+Dollars) #--------------------------------------------------------------------# # CONTACT # #--------------------------------------------------------------------# BODY 5 PCRE (?i:\btransaction\b.{1,30}\b(?:magnitude|diplomatic|strict|absolute|secret|confiden(?:tial|ce)|guarantee)) BODY 3 PCRE (?i:private e.?mail) BODY 2 PCRE (?i:\b(?:contact (?:details|information)|private (?:e?[- ]?mail|telephone|tel|phone|fax))\b) #--------------------------------------------------------------------# # SIGNATURE # #--------------------------------------------------------------------# BODY 2 PCRE (GOD BLESS YOU) BODY 1 PCRE (Your Trust and Honesty) BODY 5 PCRE (YOURS?.(IN CHRIST|TRULY AND CONFIDANT|SINCERE)) BODY 1 PCRE (?i:grace of God) BODY 1 PCRE (?i:God Bless You richly) #--------------------------------------------------------------------# # OTHER # #--------------------------------------------------------------------# BODY 5 PCRE (?i:modalities) BODY 5 PCRE (?i:discreet investigation)