# This needs to be true
body __GERM_SCAM_LOC	/\b(?:Nigeria|Senegal|Ruanda|Ghana|Afri[ck]a|Russland)/i

# Some words used by 
body 	__GERM_SCAM_A1	/(?:Sicherheitsfirma|100\% Risiko)/i
body 	__GERM_SCAM_A2	/(?:transferieren|ihr Anteil|Gesamtsumme|(?:ue|ü)berwei[s]{1,2}ung)/i
body 	__GERM_SCAM_A3	/(?:Geheimhaltung|vertraulich|Diskretion)/i
body 	__GERM_SCAM_A4	/(?:Konto|Bankkonto|Zentralbank|\bFond\b)/i
body 	__GERM_SCAM_A5	/(?:US[- ]Dollar|USD\b|USD\$|\$[\t\s ]{0,1}[1-9'`°,]{3,10})/i
body 	__GERM_SCAM_A6	/(?:Unfall|Verstorben|Tod)/i
body 	__GERM_SCAM_A7	/(?:Diamantenhändler|Öl Händler|Munitionbesorgung|Waffen)/i
header 	__GERM_SCAM_A8	Subject =~ /(?:Angebot|Gesch(?:a[e]{0,1}i|ä)ft[s]{0,1}[\t\s ]{0,1}Vorschl{0,1}ag)/i

# mail domains that spammers like ("\.co" patterns match .com, .co.uk and .co.in and possibly more)
header   __NIG_ISP_HDR    ALL =~ /[.@](netscape\.net|hotmail\.com|voila\.fr|telstra\.co|tiscali\.(co|nl)|[a-z][a-z]\.za|zwallet\.com|yahoo\.(co|fr)|bigpond\.co|fsmail\.net|indiatimes\.com|libero\.it|postino\.it|mmail\.com)/i
uri      __NIG_ISP_URI           /[.@](netscape\.net|hotmail\.com|voila\.fr|telstra\.co|tiscali\.(co|nl)|[a-z][a-z]\.za|zwallet\.com|yahoo\.(co|fr)|bigpond\.co|fsmail\.net|indiatimes\.com|libero\.it|postino\.it|mmail\.com)/i

meta     __NIG_ISP  __NIG_ISP_HDR || __NIG_ISP_URI

meta	__GERM_SCAM_BASE_A3	= (__GERM_SCAM_A1 + __GERM_SCAM_A2 + __GERM_SCAM_A3 + __GERM_SCAM_A4 + __GERM_SCAM_A5 + __GERM_SCAM_A6 + __GERM_SCAM_A7 + __GERM_SCAM_A8 == 3)
meta	__GERM_SCAM_BASE_A4	= (__GERM_SCAM_A1 + __GERM_SCAM_A2 + __GERM_SCAM_A3 + __GERM_SCAM_A4 + __GERM_SCAM_A5 + __GERM_SCAM_A6 + __GERM_SCAM_A7 + __GERM_SCAM_A8 == 4)
meta	__GERM_SCAM_BASE_A5	= (__GERM_SCAM_A1 + __GERM_SCAM_A2 + __GERM_SCAM_A3 + __GERM_SCAM_A4 + __GERM_SCAM_A5 + __GERM_SCAM_A6 + __GERM_SCAM_A7 + __GERM_SCAM_A8 >= 5)

meta	GERMAN_NIG_SCAM_A1	= (__GERM_SCAM_LOC + __GERM_SCAM_BASE_A3 == 2)
meta	GERMAN_NIG_SCAM_A2	= (__GERM_SCAM_LOC + __GERM_SCAM_BASE_A4 == 2)
meta	GERMAN_NIG_SCAM_A3	= (__GERM_SCAM_LOC + __GERM_SCAM_BASE_A5 == 2)
meta	GERMAN_NIG_SCAM_A4	= (__GERM_SCAM_LOC + __GERM_SCAM_BASE_A3 + __NIG_ISP == 3)
meta	GERMAN_NIG_SCAM_A5	= (__GERM_SCAM_LOC + __GERM_SCAM_BASE_A4 + __NIG_ISP == 3)
meta	GERMAN_NIG_SCAM_A6	= (__GERM_SCAM_LOC + __GERM_SCAM_BASE_A5 + __NIG_ISP == 3)


describe	GERMAN_NIG_SCAM_A1	Looks like a nigerian 419 scam (3+)
describe	GERMAN_NIG_SCAM_A2	Looks like a nigerian 419 scam (4+)
describe	GERMAN_NIG_SCAM_A3	Looks like a nigerian 419 scam (5+)
describe	GERMAN_NIG_SCAM_A4	Looks like a nigerian 419 scam (6+)
describe	GERMAN_NIG_SCAM_A5	Looks like a nigerian 419 scam (7+)
describe	GERMAN_NIG_SCAM_A6	Looks like a nigerian 419 scam (8+)


score GERMAN_NIG_SCAM_A1		0.700
score GERMAN_NIG_SCAM_A2		1.200
score GERMAN_NIG_SCAM_A3		2.000
score GERMAN_NIG_SCAM_A4		3.500
score GERMAN_NIG_SCAM_A5		5.000
score GERMAN_NIG_SCAM_A6		10.000