# Murty's Phish Block
#
# WARNING: This SpamAssassin rule will AGGRESSIVELY reject phishing emails
# 
# Murty Rompalli
# 6/15/2005

# Search for links that do not begin with https:// AND start with a letter

uri		__MURTY_URI1		/^(?:http:\/\/|ftp:\/\/)?(?:[^\/]+\@)?\s?[a-z][\w\-]*\./i
body		__MURTY_BODY1		/(?<!https:\/\/)\b(?:www|my|secure)[\w\-]*\.[a-z0-9][\w\-]*\.\S+\//i
header		__MURTY_FROM1		From =~ /(?<!https:\/\/)\b(?:www|my|secure)[\w\-]*\.[a-z0-9][\w\-]*\.\S+\//i
header		__MURTY_TOCC1		ToCc =~ /(?<!https:\/\/)\b(?:www|my|secure)[\w\-]*\.[a-z0-9][\w\-]*\.\S+\//i
meta		__MURTY_PHISH		(__MURTY_URI1 || __MURTY_BODY1 || __MURTY_FROM1 || __MURTY_TOCC1)


# Search for links that do not begin with https:// AND start with a number (1 to 3 digits following by dot)
  
uri		__MURTY_URI2		/^(?:http:\/\/|ftp:\/\/)?(?:[^\/]+\@)?\s?\d{1,3}\..+/i
body		__MURTY_BODY1		/(?<!https:\/\/)\b(?:(?:[01]?\d\d|2[0-4]\d|25[0-5])\.){3}(?:[01]?\d\d|2[0-4]\d|25[0-5])\//i
header		__MURTY_FROM2		From =~ /(?<!https:\/\/)\b(?:(?:[01]?\d\d|2[0-4]\d|25[0-5])\.){3}(?:[01]?\d\d|2[0-4]\d|25[0-5])\//i
header		__MURTY_TOCC2		ToCc =~ /(?<!https:\/\/)\b(?:(?:[01]?\d\d|2[0-4]\d|25[0-5])\.){3}(?:[01]?\d\d|2[0-4]\d|25[0-5])\//i
meta		__MURTY_PHISHER		(__MURTY_URI2 || __MURTY_BODY2 || __MURTY_FROM2 || __MURTY_TOCC2)


# Search for links that do not begin with https:// AND start with any other numbers

uri		__MURTY_URI3		/^(?:http:\/\/|ftp:\/\/)?(?:[^\/]+\@)?\s?\d{4,}.+/i
body		__MURTY_BODY3		/(?:http:\/\/|ftp:\/\/)?(?:[^\/]+\@)?\s*\d{4,}\//i
header		__MURTY_FROM3		From =~ /(?:http:\/\/|ftp:\/\/)?(?:[^\/]+\@)?\s*\d{4,}\//i
header		__MURTY_TOCC3		ToCc =~ /(?:http:\/\/|ftp:\/\/)?(?:[^\/]+\@)?\s*\d{4,}\//i
meta		__MURTY_PHISHEST	(__MURTY_URI3 || __MURTY_BODY3 || __MURTY_FROM3 || __MURTY_TOCC3)


# Search for keywords commonly found in phishing emails

body		__MURTY_BANK		/\b(?:bank|banc|banco|ebay|paypal|paypa1|amazon|egold|e\-gold)\b/i
body		__MURTY_FINANCE		/\b(?:FDIC|SIPC|NASD|NASDAQ|NYSE|SEC|OTC|OTCBB|securities|stocks|broker|dealer|FBI|NSA|CERT|whitehouse|IRS)\b/i
body		__MURTY_UNAUTH		/\b(?:fraudulent|unauthorized|unauthorised|suspend|suspended|suspension|notice|activity|advisory|account|terminate|termination|terminated|copyright|verify|verified|verification)\b/i
meta		__MURTY_PHISHWORDS	(__MURTY_BANK || __MURTY_FINANCE || __MURTY_UNAUTH)


# Now, lets score how phishy the email looks

meta		MURTY_PHISHING1		(__MURTY_PHISHWORDS && __MURTY_PHISH)
describe	MURTY_PHISHING1		Phishing attack: Mild
score		MURTY_PHISHING1		3.0

meta		MURTY_PHISHING2		(__MURTY_PHISHWORDS && __MURTY_PHISHER)
describe	MURTY_PHISHING2		Phishing attack: Medium
score		MURTY_PHISHING2		3.5

meta		MURTY_PHISHING3		(__MURTY_PHISHWORDS && __MURTY_PHISHEST)
describe	MURTY_PHISHING3		Phishing attack: Hot
score		MURTY_PHISHING3		4.0