[Exim] Exim Spam Filter Example

OK - beginning to get this regular expression stuff figured out evough
to do a spam filter. Here's what I have so far. it's crude - but it
catches a lot of spam. I'm in the process of adding to it and cleaning
it up.

I'm posting this for ideas and I encourage all of you to give me spam
word phrases and combinations to catch as spam.

Who wants to help?

# Exim Filter

# Never Filter Exim Related Messages (or this filter would be filtereed)

if $h_subject contains "exim"
then
finish
endif

# Viruses and Executable Atachments

if $h_subject: contains "Seven Dwarfs"
or $message_body matches
"(?:Content-(?:Type:\\\\s*[\\\\w-]+/[\\\\w-]+|Disposition:\\\\s*attachment);\\\\s*(?:file)?name=|begin\\\\s+[0-7]{3,4}\\\\s+)(\"[^\"]+\\\\.(?:vbs|vbe|wsh|wsf|js|jse|exe|com|bat)\"|[\\\\w.-]+\\\\.(?:vbs|vbe|wsh|wsf|js|jse|exe|com|bat))[\\\\s;]"

then
save /var/mail/viruses
finish
endif

# Spam

if $h_subject: contains "Retire Beanie Babies"
or $h_subject: contains "Million Dollars"

or $h_subject: matches "^ADV[: ]"
or "$h_subject: $message_body:" contains "[ADV]"
or $h_subject: matches "septic .*(expert|system)"
or "$h_subject: $message_body:" matches "(accept.*credit cards|unsecured
.*(master card|visa|credit))"
or "$h_subject: $message_body:" matches "bulk .*hosting"
or "$h_subject: $message_body:" matches "herbal .*viagra"
or "$h_subject: $message_body:" matches "attract.*opposite sex"
or "$h_subject: $message_body:" matches "celebrity .*(sex|videos?)"
or "$h_subject: $message_body:" matches "submit .*search engines"
or "$h_subject: $message_body:" matches "free (cell
phone|preview|vacation|debt|bargains?|website)"
or "$h_subject: $message_body:" matches "credit card .*(offer|debt)"
or "$h_subject: $message_body:" matches "earn .*(offshore|debt)"
or "$h_subject: $message_body:" matches "increas.*sexual .*performance"
or "$h_subject: $message_body:" matches "e-?mail .*(leads|market)"
or "$h_subject: $message_body:" matches "market.*solutions?"
or "$h_subject: $message_body:" matches "limited time .*offer"
or "$h_subject: $message_body:" matches "(re)?establish .*credit"
or "$h_subject: $message_body:" matches "this .*one time mail.*"
or "$h_subject: $message_body:" matches "youngest .*girls"
or "$h_subject: $message_body:" matches "money .*making .*programs"
or "$h_subject: $message_body:" matches "not .*chain letter"

or "$h_subject: $message_body:" matches "(Spam Free e-?mails?|luxury
car|financial freedom|targeted leads|cash bonus)"


or "$h_subject: $message_body:" matches "(vacation|weight loss) .*offer"

or "$h_subject: $message_body:" matches "(order|perscription)
.*medications .*online"


or "$h_subject: $message_body:" contains "Lowest Mortgage Rates"
or "$h_subject: $message_body:" contains "Free Pics"
or "$h_subject: $message_body:" contains "Increase Your Sales"
or "$h_subject: $message_body:" matches "Saving.* Life Insurance"


or "$h_subject: $message_body:" contains "Earn Millions"
or "$h_subject: $message_body:" contains "Need Cash"


or "$h_subject: $message_body:" contains "No Spending Limits"
or "$h_subject: $message_body:" contains "Future Millionaire"

or "$h_subject: $message_body:" contains "Sex Pill"
or "$h_subject: $message_body:" matches "LIVE ?SHOWS"
or "$h_subject: $message_body:" contains "(Unlimited|per minute) .*Long
Distance"

or "$h_subject: $message_body:" contains "bad girls"
or "$h_subject: $message_body:" contains "penis enlargement"
or "$h_subject: $message_body:" contains "off inkjet cartridges"
or "$h_subject: $message_body:" contains "never before seen"
or "$h_subject: $message_body:" matches "dish (network|offer)"

or "$h_subject: $message_body:" matches "money .*guaranteed!"
or "$h_subject: $message_body:" contains "email marketing"
or "$h_subject: $message_body:" contains "earn additional income"
or "$h_subject: $message_body:" matches "seen.* national tv"
or "$h_subject: $message_body:" contains "fastest way to earn"
or "$h_subject: $message_body:" contains "premium vacation package"
or "$h_subject: $message_body:" contains "special offer"
or "$h_subject: $message_body:" contains "live sex"
or "$h_subject: $message_body:" matches "stock .*strong buy"
or "$h_subject: $message_body:" contains "financial freedom"

or "$h_subject: $message_body:" contains "additional rebate"

or "$h_subject: $message_body:" contains "site ranking"
or "$h_subject: $message_body:" contains "Skyrocket Sales"
or "$h_subject: $message_body:" contains "Explode profits"
or "$h_subject: $message_body:" contains "porn tryout"
or "$h_subject: $message_body:" contains "spam friendly offshore
website"
or "$h_subject: $message_body:" contains "Premium Cigarettes"
or "$h_subject: $message_body:" contains "Register to Win"

or "$h_subject: $message_body:" matches "dear friends?,"
or "$h_subject: $message_body:" contains "work from home"
or "$h_subject: $message_body:" contains "voyeur cams"
or "$h_subject: $message_body:" contains "cable converter"
or "$h_subject: $message_body:" matches "unlimited .*long distance"

or "$h_subject: $message_body:" contains "Section 301 Paragraph"
or "$h_subject: $message_body:" contains "Spending cash"

or "$h_subject: $message_body:" contains "instant access"
or "$h_subject: $message_body:" contains "dear candidate"


or ($h_subject: contains "email" and $h_subject: contains "million")

then
save /var/mail/spam
finish
endif