On Tue, 27 Oct 2009, rich...@buzzhost.co.uk wrote:
Anyone else seeing these today? Or seen them recently?
http://pastebin.com/m4e25954f
I get lots like them. I'm working on updating the Advance Fee rules, but
they won't be released until 3.3.1
In my testbed with sandbox rules, that got:
pts rule name description
---- ---------------------- --------------------------------------------------
0.5 LOTTO_AGENT BODY: Claims Agent
1.0 FILL_THIS_FORM_LONG BODY: Fill in a form with personal information
1.0 LOTTO_YOU_WON You won!
0.0 LOTS_OF_MONEY Huge... sums of money
1.0 FILL_THIS_FORM Fill in a form with personal information
0.5 FILL_THIS_FORM_LOAN Answer loan question(s)
1.0 ADVANCE_FEE_2_NEW Appears to be advance fee fraud (Nigerian 419)
3.0 MONEY_FORM Lots of money if you fill out a form
1.0 ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419)
1.5 MONEY_LOTTERY Lots of money from a lottery
0.2 MONEY_FRAUD Lots of money and any of the fraud rules
1.0 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
1.0 ADVANCE_FEE_3_NEW_FORM Advance Fee fraud and a form
1.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
1.0 ADVANCE_FEE_2_NEW_FORM Advance Fee fraud and a form
1.0 ADVANCE_FEE_2_NEW_FRM_MNY Advance Fee fraud and lots of money
1.0 ADVANCE_FEE_3_NEW_FRM_MNY Advance Fee fraud and lots of money
0.2 FORM_FRAUD Fill a form and any of the fraud rules
Yes, there's some overlap; these _are_ testing rules, after all...
Contact me offlist if you want to install the sandbox rules for them, I'll
give you instructions.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...the Fates notice those who buy chainsaws...
-- www.darwinawards.com
-----------------------------------------------------------------------
4 days until Halloween
