# Scandinavian/Nordic Anti-Spam by Ole-Henrik Jakobsen
#
# After restarting spamassassin, check new spam if they have actually been scanned by SA.
# Usually some might time out during the restart and hence not scanned with SA.
#
# Remember to run "spamassassin --lint" before restarting the service to check configuration.
#
# Last update 2017.05.05

header SPAM0001		From =~ /^Kontoen utløper/
body SPAM0001		/Bekreft e-post eller opprette en ny konto her/
describe SPAM0001	Phishing
score SPAM0001		5

header SPAM0002		From =~ /^Automatisk overføring/
describe SPAM0002	Phishing
score SPAM0002		5

header SPAM0003		From =~ /^Lån penger her/
body SPAM0003		/Polar Lån/
describe SPAM0003	Phishing/unserious banking
score SPAM003		5

header SPAM0004		From =~ /^Clickfinans/
#body SPAM0004		/Klikk her for (.*){0,8} finne det=(.*)beste l(.*){0,8}net/
describe SPAM0004	Phishing/unserious banking - danish
score SPAM0004		5

header SPAM0005		From =~/^Nyt Kredittkort/
body SPAM0005		/fordeler som drivstoffrabatt, cashback eller andre bonuser, eller du bare/
describe SPAM0005	Phishing/unserious banking - danish
score SPAM0005		5

header SPAM0006		From =~ /^Stay Healthy/
body SPAM0006		/Want to change how you receive these emails/
describe SPAM0006	VitaePro Spam from a 3rd party advertiser (affliate) - URL redirection - URL modified copy of the original newsletter.
score SPAM0006		5

header SPAM0007		From =~ /^Det(.*){0,1}gr(.*){0,8}nne(.*){0,1}casino/
body SPAM0007		/F(.*){0,8} en utmerket start p(.*){0,8} din spennende reise med Mr Green/
describe SPAM0007	3rd party advertiser
score SPAM0007		5

header SPAM0008		From =~ /avdragsfrihet/
body SPAM0008		/Vi bryr oss ikke om hva du bruker pengene til/
describe SPAM0008	3rd party advertiser
score SPAM0008		5

header SPAM0009		From =~ /^Ekspresslevering/
body SPAM0009		/Vi har forsøkt å gi deg den nye iPhone 7, men vi manglet detaljer/
describe SPAM0009	Phishing
score SPAM0009		5

header SPAM0010		Subject =~ /^Garantert effekt ved fettforbrenning og vektnedgang/
describe SPAM0010	Diet spam
score SPAM0010		5

header SPAM0011		Subject =~ /LCBGw6UgZXQgbMOlbiBww6UgMjAwLjAwMCBrciDigJMgc8O4ayBuw6Uh/
body SPAM0011		/Har du behov for litt ekstra penger/
describe SPAM0011	Random From and encoded subject line (don't know if it will detect). General spam sentence for banking.
score SPAM0011		5

header SPAM0012		From =~ /^Omega-3 gratis/
body SPAM0012		/Selolje har flere positive virkninger/
describe SPAM0012	Pills
score SPAM0012		5

header SPAM0013		From =~ /^Nokia Promotions/
describe SPAM0013	Phishing
score SPAM0013		5

body SPAM0014		/vikingzstore.com/
describe SPAM0014	URL appears in a lot of spam mails.
score SPAM0014		5

body SPAM0015		/roliga-timmen.com/
describe SPAM0015	URL appears in a lot of spam mails.
score SPAM0015		5

header SPAM0016		From =~ /^HR-Avdelingen/
body SPAM0016		/Vi har forberedt mer informasjon om tjenesten og firmaet/
describe SPAM0016	False interview mail, probably phishing
score SPAM0016		5

header SPAM0017		From =~ /^Tilbud(.*){0,12}p(.*){0,8} l(.*){0,8}n/
body SPAM0017		/Du kan fritt velge hvilket av tilbudene/
describe SPAM0017	Phishing/unserious banking
score SPAM0017		5

header SPAM0018		Subject =~ /U2tqw7hubmhldHN0aXBzIC0gU2xpayBmw6VyIGR1IGxlbmdyZSDDuHlldmlwcGVy/
describe SPAM0018	3rd party advertiser
score SPAM0018		5

header SPAM0019		From =~ /Koffert Heathrow/
body SPAM0019		/Bokklubben/
describe SPAM0019	3rd party advertiser
score SPAM0019		5

body SPAM0020		/Vi har sendt denne e-posten til (.*)@(.*).(.*) da har du tidligere har r(.*)egistrert deg p(.*){0,8} v(.*){0,8}rt nyhetsbrev/
describe SPAM0020	Fake subscription line found in a lot of norwegian spam mails.
score SPAM0020		5

body SPAM0021		/Dette kortet gir deg gratis bensin eller diesel i hele 6 måneder./
describe SPAM0021	Free gas and petrol for 6 months, yeah right.
score SPAM0021		5

header SPAM0022		From =~ /kreditt godkjenning/
describe SPAM0022	Bogus name
score SPAM0022		5

body SPAM0023		/Over 10.000 har stumpet røyken ved hjelp av Fortuna e-sigarett./
describe SPAM0023	E-cig. spam
score SPAM0023		5

body SPAM0024		/Fit på 15 min/
describe SPAM0024	Diet spam
score SPAM0024		5

body SPAM0025		/Hvis du ikke lenger vil ha v(.*){0,8}rt nyhetsbrev?/
describe SPAM0025	Weird grammar. Spam.
score SPAM0025		5

header SPAM0026		Subject =~ /^La bankene konkurrere om deg!/
body SPAM0026		/Pengene utbetales til din konto innen 1-3 dager/
describe SPAM0026	Banking
score SPAM0026		5

header SPAM0027		Subject =~ /^(.*){0,1}Gratulerer, du klarte det/
body SPAM0027		/KREV INNGANG HER/
describe SPAM0027	Wierd grammar. Spam.
score SPAM0027		5

header SPAM0028		From =~ /^Forsinket fly/
body SPAM0028		/Flyforsinkelse? F(.*){0,8} opp til 5.500 NOK i kompensasjon/
describe SPAM0028	Bogus From name
score SPAM0028		5

header SPAM0029		From =~ /^Kinohelg/
body SPAM0029		/Oppdag velkomsttilbudet gitt av kun10kroner/
describe SPAM0029	Bogus From name
score SPAM0029		5

header SPAM0030         From =~ /QXV0b21hdGlzayBvdmVyZsO4cmluZw/
body SPAM0030           /Daily Profit (.?) 2017/
describe SPAM0030       Phishing
score SPAM0030          5

header SPAM0031		From =~ /^Lainaa yli 10000 euroa/
describe SPAM0031	Some finish spam.
score SPAM0031		5

header SPAM0032		From =~ /^Sportsfiskemagasin/
body SPAM0032		/Norges eneste rene sportsfiskemagasin/
describe SPAM0032	3rd party spam
score SPAM0032		5

header SPAM0033		From =~ /Cheapio.no/
describe SPAM0033	Spam
score SPAM0033		5

header SPAM0034		From =~ /^KINOGAVEKORT/
describe SPAM0034	Spam
score SPAM0034		5

body SPAM0035		/Wet student-girls do many awesome things in bed/
describe SPAM0035	Spam
score SPAM0035		5

header SPAM0036		From =~ /^Polttoaine tosite/
describe SPAM0036	Some finish spam
score SPAM0036		5

body SPAM0037		/Two students are looking for a wealthy lover/
describe SPAM0037	Spam
score SPAM0037		5

body SPAM0038		/Do you want a double pleasure/
describe SPAM0038	Spam
score SPAM0038		5

header SPAM0039		From =~ /snoring-news.com/
describe SPAM0039	Spam
score SPAM0039		5

body SPAM0040		/Axo Finans/
describe SPAM0040	Block everything from Axo Finans
score SPAM0040		5

header SPAM0041		From =~ /leadtrade.online/
describe SPAM0041	Address known in several spam mail.
score SPAM0041		5

body SPAM0042		/Kilpailuttamalla edullinen korko(.*)Lainaa/
describe SPAM0042	Finish spam
score SPAM0042		5

header SPAM0043		From =~ /^servisepakke/
describe SPAM0043	Spam
score SPAM0043		5

header SPAM0044		From =~ /snoringpal.com/
describe SPAM0044	Spam
score SPAM0044		5

body SPAM0045		/dette produktet vil du bli kvitt snorkingen/
describe SPAM0045	Spam
score SPAM0045		5

body SPAM0046		/Du har gjennom vårt system tjent en stor sum penger/
describe SPAM0046	Spam
score SPAM0046		5

body SPAM0047		/(.*)penger(.*)konto(.*)fyll ut/i
describe SPAM0047	Spam
score SPAM0047		5

body SPAM0048		/Følg linken(.*)skjema/i
describe SPAM0048	Spam
score SPAM0048		5

header SPAM0049		From =~ /Finansiell/
describe SPAM0049	Spam
score SPAM0049		5

body SPAM0050		/akkurat deg(.*)l(.*){0,8}net/i
describe SPAM0050	Spam
score SPAM0050		5

body SPAM0051		/Daily Profit (.?) 2017/
describe SPAM0051	Spam
score SPAM0051		5

body SPAM0052		/Glad to see u(.*)This is your code/
describe SPAM0052	Spam
score SPAM0052		5

body SPAM0053		/alt i ett kort(.*)Unsubscribe me/
describe SPAM0053	Spam. Mix of languages.
score SPAM0053		5

header SPAM0054		From =~ /cheapio.dk/
describe SPAM0054	Spam
score SPAM0054		5

header SPAM0055		From =~ /off_is_a_big_hit/
describe SPAM0055	Spam
score SPAM0055		5

body SPAM0056		/Centum Finans/
describe SPAM0056	Spam
score SPAM0056		5

body SPAM0057		/Bekreft din gavekort/i
describe SPAM0057	Weird language
score SPAM0057		5

body SPAM0058           /Aros Finans/
describe SPAM0058       Spam
score SPAM0058          5

body SPAM0059		/Umiddelbar godkjenning(.*)utbetaling/i
describe SPAM0059	Spam
score SPAM0059		5

header SPAM0060		From =~ /DAGSTILBUD/
describe SPAM0060	Spam
score SPAM0060		5

body SPAM0061		/lån(.*)romslig økonomi/
describe SPAM0061	Spam
score SPAM0061		5

header SPAM0062		From =~ /Vindertips/
describe SPAM0062	Spam
score SPAM0062		5

header SPAM0063		Subject =~ /Lei av avslag hos bankene/i
describe SPAM0063	Spam
score SPAM0063		5

header SPAM0064		Subject =~ /HR(.*)rekruttering/
body SPAM0064		/Vi fant din profil/
describe SPAM0064	Spam
score SPAM0064		5

header SPAM0065		From =~ /Utvendige Markiser/
describe SPAM0065	Spam
score SPAM0065		5

body SPAM0066		/visit website(.*)tjene(.*)millioner/i
describe SPAM0066	Spam
score SPAM0066		5

body SPAM0067		/møteside(.*)betal aldri(.*)datingsiden/
describe SPAM0067	Spam
score SPAM0067		5

body SPAM0068           /bit.ly\/neclub/
describe SPAM0068       Spam
score SPAM0068          5

header SPAM0069         From =~ /Test og Hold/
describe SPAM0069       Spam
score SPAM0069          5

body SPAM0070		/Apple Norge tester/
describe SPAM0070	Spam
score SPAM0070		5

header SPAM0071         From =~ /Det_gr(.*)nne_casino/
describe SPAM0071       Spam
score SPAM0071          5

header SPAM0072		Subject =~ /Velg deg det beste tilbudet og spar tusenvis av Krone - helt gratis/
describe SPAM0072	Spam
score SPAM0072		5

body SPAM0073           /legg til denne e-postadressen i din mottakerliste/
describe SPAM0073       Spam
score SPAM0073          5