gr ([info]grumpy_sysadmin) wrote,
2004-05-25 14:46:00
  • Previous
  • Memorize
  • Share
  • Next

All Hail Nigeria!

[Posting by email/PGP seems to be broken again. Great.]

This typo makes me giggle: "this massage is not intended to cause an embarrasment to your personality". If you've spent any time dealing with the Nigerian scam spam, that probably sounds like a familiar writing style.

There are some newer versions of this ancient scam that slipped through SpamAssassin 2.63's rules for this stuff, so I added a few of my own Nigeria-detecting rules. Doing that required switching off the default meta rules for this stuff and putting my own in place (while still using their rules). Here's all of what's in my local.cf for Nigeria now:

# Need to update the Nigerian spam metarules in light of new instances.
# Hopefully I can pull these back out after an upgrade...

# No *clue* how to score these, there isn't enough of a sample yet.
header NIGERIAN_SUBJECT_LOCAL1  Subject =~ /\bCONFIDENTIAL MESSAGE\b/
describe NIGERIAN_SUBJECT_LOCAL1 Subject is indicative of a Nigerian spam
score NIGERIAN_SUBJECT_LOCAL1 .5
header NIGERIAN_SUBJECT_LOCAL2  Subject =~ /\bPRIVATE ESTATE ACQUISITION\b/
describe NIGERIAN_SUBJECT_LOCAL2 Subject is indicative of a Nigerian spam
score NIGERIAN_SUBJECT_LOCAL2 .5

# We're going to use their rules and our own to feed our meta rules,
# which means we need to deactivate their meta rules (to avoid
# double-scoring). Probably not *actually* a problem, but there's a
# Right way to do this.

score NIGERIAN_BODY1 0
score NIGERIAN_BODY2 0
score NIGERIAN_BODY3 0
score NIGERIAN_BODY4 0

meta NIGERIAN_BODY_LOCAL1       ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 + __NIGERIAN_BODY_LOCAL1 + __NIGERIAN_BODY_LOCAL2 + __NIGERIAN_BODY_LOCAL3 + __NIGERIAN_BODY_LOCAL4 + __NIGERIAN_BODY_LOCAL5) > 1
meta NIGERIAN_BODY_LOCAL2       ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 + __NIGERIAN_BODY_LOCAL1 + __NIGERIAN_BODY_LOCAL2 + __NIGERIAN_BODY_LOCAL3 + __NIGERIAN_BODY_LOCAL4 + __NIGERIAN_BODY_LOCAL5) > 2
meta NIGERIAN_BODY_LOCAL3       ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 + __NIGERIAN_BODY_LOCAL1 + __NIGERIAN_BODY_LOCAL2 + __NIGERIAN_BODY_LOCAL3 + __NIGERIAN_BODY_LOCAL4 + __NIGERIAN_BODY_LOCAL5) > 3
meta NIGERIAN_BODY_LOCAL4       ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 + __NIGERIAN_BODY_LOCAL1 + __NIGERIAN_BODY_LOCAL2 + __NIGERIAN_BODY_LOCAL3 + __NIGERIAN_BODY_LOCAL4 + __NIGERIAN_BODY_LOCAL5) > 4
meta NIGERIAN_BODY_LOCAL5       ( __NIGERIAN_BODY_1 + __NIGERIAN_BODY_2 + __NIGERIAN_BODY_3 + __NIGERIAN_BODY_5 + __NIGERIAN_BODY_6 + __NIGERIAN_BODY_7 + __NIGERIAN_BODY_8 + __NIGERIAN_BODY_9 + __NIGERIAN_BODY_10 + __NIGERIAN_BODY_11 + __NIGERIAN_BODY_12 + __NIGERIAN_BODY_13 + __NIGERIAN_BODY_14 + __NIGERIAN_BODY_15 + __NIGERIAN_BODY_16 + __NIGERIAN_BODY_17 + __NIGERIAN_BODY_18 + __NIGERIAN_BODY_19 + __NIGERIAN_BODY_20 + __NIGERIAN_BODY_21 + __NIGERIAN_BODY_22 + __NIGERIAN_BODY_25 + __NIGERIAN_BODY_26 + __NIGERIAN_BODY_27 + __NIGERIAN_BODY_28 + __NIGERIAN_BODY_29 + __NIGERIAN_BODY_30 + __NIGERIAN_BODY_31 + __NIGERIAN_BODY_32 + __NIGERIAN_BODY_33 + __NIGERIAN_BODY_34 + __NIGERIAN_BODY_35 + __NIGERIAN_BODY_36 + __NIGERIAN_BODY_37 + __NIGERIAN_BODY_38 + __NIGERIAN_BODY_39 + __NIGERIAN_BODY_40 + __NIGERIAN_BODY_41 + __NIGERIAN_BODY_42 + __NIGERIAN_BODY_43 + __NIGERIAN_BODY_44 + __NIGERIAN_BODY_45 + __NIGERIAN_BODY_46 + __NIGERIAN_BODY_LOCAL1 + __NIGERIAN_BODY_LOCAL2 + __NIGERIAN_BODY_LOCAL3 + __NIGERIAN_BODY_LOCAL4 + __NIGERIAN_BODY_LOCAL5) > 5

describe NIGERIAN_BODY_LOCAL1   Message body looks like a Nigerian spam message 1+
describe NIGERIAN_BODY_LOCAL2   Message body looks like a Nigerian spam message 2+
describe NIGERIAN_BODY_LOCAL3   Message body looks like a Nigerian spam message 3+
describe NIGERIAN_BODY_LOCAL4   Message body looks like a Nigerian spam message 4+
describe NIGERIAN_BODY_LOCAL5   Message body looks like a Nigerian spam message 5+

score NIGERIAN_BODY_LOCAL1 3.009 1.563 2.696 2.018
score NIGERIAN_BODY_LOCAL2 0.700 0.717 0.858 0.700
score NIGERIAN_BODY_LOCAL3 0.700 1.006 0.972 0.738
score NIGERIAN_BODY_LOCAL4 0.701 0.724 0.700 0.701
score NIGERIAN_BODY_LOCAL5 0.70 0.75 0.70 0.70

body __NIGERIAN_BODY_LOCAL_1 /\b[fF]ederal.*Nigeria\.\S+\b/
# Weird one, but both of the ones that slipped through recently had it.
body __NIGERIAN_BODY_LOCAL_2 /\bvery strategic and influential position\b/
body __NIGERIAN_BODY_LOCAL_3 /\b(vital|convenient) bank account\b/
body __NIGERIAN_BODY_LOCAL_4 /\bwe\s+need\s+your\s+assistance\s+(in|to)\s+transfer(ring)?\s+(some of)?\s+the\s+(money|funds)\s+(in)?to\s+your\s+(vital)?\s+(bank)?\s+(account|country)\b/
# "... vital bank account", "... country"
body __NIGERIAN_BODY_LOCAL_5 /\bhttp(s?):\/\/\W+\/africa/
# One reference to http://news.bbc.co.uk/1/hi/world/africa/468903.stm

  • Post a new comment

    Error

    switch

    Your IP address will be recorded 

     
    Help
  • 9 comments

[info]dingodonkey

May 25 2004, 12:34:56 UTC 8 years ago

This is useful stuff.

Every time I see somebody referencing the awesome Nigerian spam, I crack up. And I have no idea why.

[info]grumpy_sysadmin

May 25 2004, 12:39:49 UTC 8 years ago

The English in this stuff is pretty amusing. At first I thought that they were trying to affect the sound of some dumb African who wants to impress white folks. That is, that the poor wordsmithing was a conscious part of the scam. But I'm not so sure it is... that is, I think that the folks who right this stuff may actually think they sound distinguished, and really think that might sucker people in.

It's one of those "funny but actually depressing" things.

[info]grumpy_sysadmin

May 25 2004, 12:40:18 UTC 8 years ago

Ahem.

"write".

[info]travisd

May 25 2004, 12:51:12 UTC 8 years ago

Did you see the article on the use of the TDD Relay services by the scammers? From the sounds of it, the scammers truly do speak/write this way. May also apparently use computer based translation systems to write some of this as well.

[info]grumpy_sysadmin

May 25 2004, 13:04:56 UTC 8 years ago

Yeah, I did see that.

I still sort of want to believe that this is an affectation, but...

[info]lullysing

May 25 2004, 13:42:43 UTC 8 years ago

The $orkplace is having me evaluate possible new spamassasin rules....You got any other rules i could possibly propose to them?

[info]grumpy_sysadmin

May 25 2004, 13:47:27 UTC 8 years ago

Yeah. Skim back (if not here, then in [info]unixadmin--don't recall where I posted them) for my rules to catch spam that's desgined to poison Bayes DBs.

I'll repost that along with some other stuff I've got (meta rules in sort of in the style of the Nigerian things, only but I purposely built logic expressions rather than just doing occurence counts) when I get a chance, but I'd rather be able to do it through the email-post route (which seems to be horked at the moment). Formatting that shit in a web browser is a pain, especially when I'm at work.

If you're in a hurry, mail me (@livejournal.com forwards to the right place for me).

[info]grumpy_sysadmin

May 25 2004, 22:41:57 UTC 8 years ago

Posted now.

[info]irrationalrobot

May 25 2004, 15:29:53 UTC 8 years ago

I got another one yesterday, and the specific name of the contact guy showed up all over google, which I found kind of funny.

Humor on this topic: http://www.frontalot.com/lyrics/messageno419.html
Create an Account
Forgot your login or password?
Facebook Twitter More login options
English • Español • Deutsch • Русский…