(?:\s*<\/div>)?\s*){10}/i describe AC_DIV_BONANZA Too many divs in a row... spammy template #score AC_DIV_BONANZA 0.001 tflags AC_DIV_BONANZA publish ##} AC_DIV_BONANZA ##{ AC_HTML_NONSENSE_TAGS rawbody AC_HTML_NONSENSE_TAGS /(?:<[A-Za-z0-9]{4,}>\s*){10}/ describe AC_HTML_NONSENSE_TAGS Many consecutive multi-letter HTML tags, likely nonsense/spam #score AC_HTML_NONSENSE_TAGS 2.0 tflags AC_HTML_NONSENSE_TAGS publish ##} AC_HTML_NONSENSE_TAGS ##{ AC_SPAMMY_URI_PATTERNS1 meta AC_SPAMMY_URI_PATTERNS1 (__AC_OUTL_URI && __AC_OUTI_URI) describe AC_SPAMMY_URI_PATTERNS1 link combos match highly spammy template #score AC_SPAMMY_URI_PATTERNS1 4.0 tflags AC_SPAMMY_URI_PATTERNS1 publish ##} AC_SPAMMY_URI_PATTERNS1 ##{ AC_SPAMMY_URI_PATTERNS10 meta AC_SPAMMY_URI_PATTERNS10 __AC_PUNCTNUMS_URI describe AC_SPAMMY_URI_PATTERNS10 link combos match highly spammy template #score AC_SPAMMY_URI_PATTERNS10 4.0 tflags AC_SPAMMY_URI_PATTERNS10 publish ##} AC_SPAMMY_URI_PATTERNS10 ##{ AC_SPAMMY_URI_PATTERNS11 meta AC_SPAMMY_URI_PATTERNS11 __AC_NDOMLONGNASPX_URI describe AC_SPAMMY_URI_PATTERNS11 link combos match highly spammy template #score AC_SPAMMY_URI_PATTERNS11 4.0 tflags AC_SPAMMY_URI_PATTERNS11 publish ##} AC_SPAMMY_URI_PATTERNS11 ##{ AC_SPAMMY_URI_PATTERNS12 meta AC_SPAMMY_URI_PATTERNS12 (__AC_CHDSEQ_URI && __AC_MHDSEQ_URI && __AC_UHDSEQ_URI) describe AC_SPAMMY_URI_PATTERNS12 link combos match highly spammy template #score AC_SPAMMY_URI_PATTERNS12 4.0 tflags AC_SPAMMY_URI_PATTERNS12 publish ##} AC_SPAMMY_URI_PATTERNS12 ##{ AC_SPAMMY_URI_PATTERNS2 meta AC_SPAMMY_URI_PATTERNS2 (__AC_LAND_URI && __AC_UNSUB_URI && __AC_REPORT_URI) describe AC_SPAMMY_URI_PATTERNS2 link combos match highly spammy template #score AC_SPAMMY_URI_PATTERNS2 4.0 tflags AC_SPAMMY_URI_PATTERNS2 publish ##} AC_SPAMMY_URI_PATTERNS2 ##{ AC_SPAMMY_URI_PATTERNS3 meta AC_SPAMMY_URI_PATTERNS3 (__AC_PHPOFFTOP_URI && __AC_PHPOFFSUB_URI) describe AC_SPAMMY_URI_PATTERNS3 link combos match highly spammy template #score AC_SPAMMY_URI_PATTERNS3 4.0 tflags AC_SPAMMY_URI_PATTERNS3 publish ##} AC_SPAMMY_URI_PATTERNS3 ##{ AC_SPAMMY_URI_PATTERNS4 meta AC_SPAMMY_URI_PATTERNS4 __AC_NUMS_URI describe AC_SPAMMY_URI_PATTERNS4 link combos match highly spammy template #score AC_SPAMMY_URI_PATTERNS4 4.0 tflags AC_SPAMMY_URI_PATTERNS4 publish ##} AC_SPAMMY_URI_PATTERNS4 ##{ AC_SPAMMY_URI_PATTERNS8 meta AC_SPAMMY_URI_PATTERNS8 __AC_LONGSEQ_URI describe AC_SPAMMY_URI_PATTERNS8 link combos match highly spammy template #score AC_SPAMMY_URI_PATTERNS8 4.0 tflags AC_SPAMMY_URI_PATTERNS8 publish ##} AC_SPAMMY_URI_PATTERNS8 ##{ AC_SPAMMY_URI_PATTERNS9 meta AC_SPAMMY_URI_PATTERNS9 (__AC_1SEQC_URI && (__AC_1SEQV_URI || __AC_RMOVE_URI)) describe AC_SPAMMY_URI_PATTERNS9 link combos match highly spammy template #score AC_SPAMMY_URI_PATTERNS9 4.0 tflags AC_SPAMMY_URI_PATTERNS9 publish ##} AC_SPAMMY_URI_PATTERNS9 ##{ ADMAIL meta ADMAIL __ADMAIL && !__DKIM_EXISTS && !__COMMENT_EXISTS describe ADMAIL "admail" and variants tflags ADMAIL publish ##} ADMAIL ##{ ADVANCE_FEE_2_NEW_FORM meta ADVANCE_FEE_2_NEW_FORM (__ADVANCE_FEE_2_NEW_FORM && !__ADVANCE_FEE_3_NEW_FORM && !__ADVANCE_FEE_4_NEW_FORM && !__ADVANCE_FEE_5_NEW_FORM) && !__COMMENT_EXISTS && !__THREADED && !__HTML_LINK_IMAGE && !__HDRS_LCASE && !__DOS_HAS_LIST_UNSUB && !__HAS_SENDER && !__HAS_X_LOOP describe ADVANCE_FEE_2_NEW_FORM Advance Fee fraud and a form #score ADVANCE_FEE_2_NEW_FORM 2.000 # limit tflags ADVANCE_FEE_2_NEW_FORM publish ##} ADVANCE_FEE_2_NEW_FORM ##{ ADVANCE_FEE_2_NEW_MONEY meta ADVANCE_FEE_2_NEW_MONEY (__ADVANCE_FEE_2_NEW_MONEY && !__ADVANCE_FEE_3_NEW_MONEY && !__ADVANCE_FEE_4_NEW_MONEY && !__ADVANCE_FEE_5_NEW_MONEY) && !__DOS_HAS_LIST_UNSUB && !__TAG_EXISTS_CENTER && !__LYRIS_EZLM_REMAILER && !__COMMENT_EXISTS && !__UNSUB_LINK && !__VIA_ML && !__HTML_LINK_IMAGE && !__HDRS_LCASE && !__NAME_EQ_EMAIL && !__URI_MAILTO_MANY && !__RP_MATCHES_RCVD && !__THREADED && !__HAS_SENDER && !__HAS_X_LOOP describe ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money #score ADVANCE_FEE_2_NEW_MONEY 2.000 # limit tflags ADVANCE_FEE_2_NEW_MONEY publish ##} ADVANCE_FEE_2_NEW_MONEY ##{ ADVANCE_FEE_3_NEW meta ADVANCE_FEE_3_NEW (__ADVANCE_FEE_3_NEW && !__FILL_THIS_FORM && !LOTS_OF_MONEY && !__ADVANCE_FEE_4_NEW && !__ADVANCE_FEE_5_NEW) && !__HTML_LINK_IMAGE && !__TAG_EXISTS_CENTER && !__COMMENT_EXISTS && !__VIA_ML && !__THREADED && !__UNSUB_LINK && !__UPPERCASE_URI && !__SURVEY && !__HAS_SENDER && !__HAS_X_LOOP && !__TO_YOUR_ORG describe ADVANCE_FEE_3_NEW Appears to be advance fee fraud (Nigerian 419) #score ADVANCE_FEE_3_NEW 3.5 # limit tflags ADVANCE_FEE_3_NEW publish ##} ADVANCE_FEE_3_NEW ##{ ADVANCE_FEE_3_NEW_FORM meta ADVANCE_FEE_3_NEW_FORM (__ADVANCE_FEE_3_NEW_FORM && !__ADVANCE_FEE_4_NEW_FORM && !__ADVANCE_FEE_5_NEW_FORM) && !__HTML_LINK_IMAGE && !__THREADED && !__HAS_SENDER && !__HAS_X_LOOP describe ADVANCE_FEE_3_NEW_FORM Advance Fee fraud and a form tflags ADVANCE_FEE_3_NEW_FORM publish ##} ADVANCE_FEE_3_NEW_FORM ##{ ADVANCE_FEE_3_NEW_FRM_MNY meta ADVANCE_FEE_3_NEW_FRM_MNY (__ADVANCE_FEE_3_NEW_FRM_MNY && !__ADVANCE_FEE_4_NEW_FRM_MNY && !__ADVANCE_FEE_5_NEW_FRM_MNY) && !__HTML_LINK_IMAGE && !__THREADED && !__HAS_SENDER && !__HAS_X_LOOP describe ADVANCE_FEE_3_NEW_FRM_MNY Advance Fee fraud form and lots of money ##} ADVANCE_FEE_3_NEW_FRM_MNY ##{ ADVANCE_FEE_3_NEW_MONEY meta ADVANCE_FEE_3_NEW_MONEY (__ADVANCE_FEE_3_NEW_MONEY && !__ADVANCE_FEE_4_NEW_MONEY && !__ADVANCE_FEE_5_NEW_MONEY) && !__HTML_LINK_IMAGE && !__UPPERCASE_URI && !__UNSUB_LINK && !__VIA_ML && !__THREADED && !__HAS_SENDER && !__HAS_X_LOOP describe ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money tflags ADVANCE_FEE_3_NEW_MONEY publish ##} ADVANCE_FEE_3_NEW_MONEY ##{ ADVANCE_FEE_4_NEW meta ADVANCE_FEE_4_NEW (__ADVANCE_FEE_4_NEW && !__FILL_THIS_FORM && !LOTS_OF_MONEY && !__ADVANCE_FEE_5_NEW) && !__COMMENT_EXISTS && !__TAG_EXISTS_CENTER && !__HAS_ERRORS_TO && !__DOS_HAS_LIST_UNSUB describe ADVANCE_FEE_4_NEW Appears to be advance fee fraud (Nigerian 419) tflags ADVANCE_FEE_4_NEW publish ##} ADVANCE_FEE_4_NEW ##{ ADVANCE_FEE_4_NEW_FRM_MNY meta ADVANCE_FEE_4_NEW_FRM_MNY (__ADVANCE_FEE_4_NEW_FRM_MNY && !__ADVANCE_FEE_5_NEW_FRM_MNY) describe ADVANCE_FEE_4_NEW_FRM_MNY Advance Fee fraud form and lots of money ##} ADVANCE_FEE_4_NEW_FRM_MNY ##{ ADVANCE_FEE_5_NEW meta ADVANCE_FEE_5_NEW (__ADVANCE_FEE_5_NEW && !__FILL_THIS_FORM && !LOTS_OF_MONEY) describe ADVANCE_FEE_5_NEW Appears to be advance fee fraud (Nigerian 419) ##} ADVANCE_FEE_5_NEW ##{ ADVANCE_FEE_5_NEW_FRM_MNY meta ADVANCE_FEE_5_NEW_FRM_MNY __ADVANCE_FEE_5_NEW_FRM_MNY describe ADVANCE_FEE_5_NEW_FRM_MNY Advance Fee fraud form and lots of money ##} ADVANCE_FEE_5_NEW_FRM_MNY ##{ ADVANCE_FEE_5_NEW_MONEY meta ADVANCE_FEE_5_NEW_MONEY __ADVANCE_FEE_5_NEW_MONEY && !__BOUNCE_CTYPE describe ADVANCE_FEE_5_NEW_MONEY Advance Fee fraud and lots of money ##} ADVANCE_FEE_5_NEW_MONEY ##{ AD_PREFS body AD_PREFS /(?:\b|_)(?:ad(?:vert[i1l]s[i1l]ng)?|promo(?:tion)?|marketing)[- _](?:pref(?:s|erences)|settings)(?:\b|_)/i describe AD_PREFS Advertising preferences tflags AD_PREFS publish ##} AD_PREFS ##{ APOSTROPHE_FROM header APOSTROPHE_FROM From:addr =~ /'/ describe APOSTROPHE_FROM From address contains an apostrophe ##} APOSTROPHE_FROM ##{ APP_DEVELOPMENT_FREEM if can(Mail::SpamAssassin::Conf::feature_bug6558_free) if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta APP_DEVELOPMENT_FREEM __APP_DEVELOPMENT_MANY && (__REPTO_CHN_FREEM || __freemail_hdr_replyto) describe APP_DEVELOPMENT_FREEM App development pitch, freemail or CHN replyto # score APP_DEVELOPMENT_FREEM 3.500 # limit tflags APP_DEVELOPMENT_FREEM publish endif ##} APP_DEVELOPMENT_FREEM if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ##{ APP_DEVELOPMENT_NORDNS if can(Mail::SpamAssassin::Conf::feature_bug6558_free) if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta APP_DEVELOPMENT_NORDNS __APP_DEVELOPMENT && __RDNS_NONE describe APP_DEVELOPMENT_NORDNS App development pitch, no rDNS # score APP_DEVELOPMENT_NORDNS 2.000 # limit tflags APP_DEVELOPMENT_NORDNS publish endif ##} APP_DEVELOPMENT_NORDNS if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ##{ BANKING_LAWS body BANKING_LAWS /banking laws/i describe BANKING_LAWS Talks about banking laws ##} BANKING_LAWS ##{ BASE64_LENGTH_78_79 ifplugin Mail::SpamAssassin::Plugin::MIMEEval ifplugin Mail::SpamAssassin::Plugin::MIMEEval body BASE64_LENGTH_78_79 eval:check_base64_length('78','79') endif ##} BASE64_LENGTH_78_79 ifplugin Mail::SpamAssassin::Plugin::MIMEEval ##{ BASE64_LENGTH_79_INF ifplugin Mail::SpamAssassin::Plugin::MIMEEval ifplugin Mail::SpamAssassin::Plugin::MIMEEval describe BASE64_LENGTH_79_INF base64 encoded email part uses line length of 78 or 79 characters body BASE64_LENGTH_79_INF eval:check_base64_length('79') describe BASE64_LENGTH_79_INF base64 encoded email part uses line length greater than 79 characters endif ##} BASE64_LENGTH_79_INF ifplugin Mail::SpamAssassin::Plugin::MIMEEval ##{ BIGNUM_EMAILS meta BIGNUM_EMAILS __BIGNUM_EMAILS && !__SPOOFED_URL && !__BUGGED_IMG describe BIGNUM_EMAILS Lots of email addresses/leads #score BIGNUM_EMAILS 3.00 # limit ##} BIGNUM_EMAILS ##{ BITCOIN_BOMB meta BITCOIN_BOMB __BITCOIN_ID && __EXPLOSIVE_DEVICE && !BITCOIN_EXTORT_01 describe BITCOIN_BOMB BitCoin + bomb #score BITCOIN_BOMB 3.000 # limit tflags BITCOIN_BOMB publish ##} BITCOIN_BOMB ##{ BITCOIN_DEADLINE meta BITCOIN_DEADLINE __BITCOIN_ID && __HOURS_DEADLINE && !BITCOIN_EXTORT_01 describe BITCOIN_DEADLINE BitCoin with a deadline #score BITCOIN_DEADLINE 3.000 # limit tflags BITCOIN_DEADLINE publish ##} BITCOIN_DEADLINE ##{ BITCOIN_EXTORT_01 meta BITCOIN_EXTORT_01 __BITCOIN_ID && (__MY_MALWARE + __PAY_ME + __MY_VICTIM + __YOUR_WEBCAM + __YOUR_ONAN + __YOUR_PERSONAL + __HOURS_DEADLINE + __YOUR_PASSWORD + LOCALPART_IN_SUBJECT + __DESTROY_ME + __DESTROY_YOU + __EXPLOSIVE_DEVICE) > 2 describe BITCOIN_EXTORT_01 Extortion spam, pay via BitCoin #score BITCOIN_EXTORT_01 5.000 # limit tflags BITCOIN_EXTORT_01 publish ##} BITCOIN_EXTORT_01 ##{ BITCOIN_MALWARE meta BITCOIN_MALWARE __BITCOIN_ID && __MY_MALWARE && !BITCOIN_EXTORT_01 && !__NOT_SPOOFED describe BITCOIN_MALWARE BitCoin + malware #score BITCOIN_MALWARE 3.000 # limit tflags BITCOIN_MALWARE publish ##} BITCOIN_MALWARE ##{ BITCOIN_PAY_ME meta BITCOIN_PAY_ME __BITCOIN_ID && __PAY_ME && !BITCOIN_EXTORT_01 describe BITCOIN_PAY_ME Pay me via BitCoin #score BITCOIN_PAY_ME 3.000 # limit tflags BITCOIN_PAY_ME publish ##} BITCOIN_PAY_ME ##{ BITCOIN_SPAM_01 meta BITCOIN_SPAM_01 __BITCOIN_ID && HTML_MIME_NO_HTML_TAG describe BITCOIN_SPAM_01 BitCoin spam pattern 01 #score BITCOIN_SPAM_01 2.500 # limit tflags BITCOIN_SPAM_01 publish ##} BITCOIN_SPAM_01 ##{ BITCOIN_SPAM_02 meta BITCOIN_SPAM_02 __BITCOIN_ID && __BOTH_INR_AND_REF describe BITCOIN_SPAM_02 BitCoin spam pattern 02 #score BITCOIN_SPAM_02 2.500 # limit tflags BITCOIN_SPAM_02 publish ##} BITCOIN_SPAM_02 ##{ BITCOIN_SPAM_03 meta BITCOIN_SPAM_03 __BITCOIN_ID && __SINGLE_WORD_SUBJ describe BITCOIN_SPAM_03 BitCoin spam pattern 03 #score BITCOIN_SPAM_03 2.500 # limit tflags BITCOIN_SPAM_03 publish ##} BITCOIN_SPAM_03 ##{ BITCOIN_SPAM_04 meta BITCOIN_SPAM_04 __BITCOIN_ID && __freemail_hdr_replyto describe BITCOIN_SPAM_04 BitCoin spam pattern 04 #score BITCOIN_SPAM_04 1.500 # limit tflags BITCOIN_SPAM_04 publish ##} BITCOIN_SPAM_04 ##{ BITCOIN_SPAM_05 meta BITCOIN_SPAM_05 __BITCOIN_ID && __SPOOFED_FREEMAIL describe BITCOIN_SPAM_05 BitCoin spam pattern 05 #score BITCOIN_SPAM_05 2.500 # limit tflags BITCOIN_SPAM_05 publish ##} BITCOIN_SPAM_05 ##{ BITCOIN_SPAM_06 meta BITCOIN_SPAM_06 __BITCOIN_ID && TVD_RCVD_SPACE_BRACKET describe BITCOIN_SPAM_06 BitCoin spam pattern 06 #score BITCOIN_SPAM_06 1.500 # limit tflags BITCOIN_SPAM_06 publish ##} BITCOIN_SPAM_06 ##{ BITCOIN_SPAM_07 meta BITCOIN_SPAM_07 __BITCOIN_ID && __TO_EQ_FROM describe BITCOIN_SPAM_07 BitCoin spam pattern 07 #score BITCOIN_SPAM_07 3.000 # limit tflags BITCOIN_SPAM_07 publish ##} BITCOIN_SPAM_07 ##{ BITCOIN_SPAM_08 meta BITCOIN_SPAM_08 __BITCOIN_ID && __TO_IN_SUBJ describe BITCOIN_SPAM_08 BitCoin spam pattern 08 #score BITCOIN_SPAM_08 2.500 # limit tflags BITCOIN_SPAM_08 publish ##} BITCOIN_SPAM_08 ##{ BITCOIN_SPAM_09 meta BITCOIN_SPAM_09 __BITCOIN_ID && ( __DESTROY_ME || __DESTROY_YOU ) describe BITCOIN_SPAM_09 BitCoin spam pattern 09 #score BITCOIN_SPAM_09 1.500 # limit tflags BITCOIN_SPAM_09 publish ##} BITCOIN_SPAM_09 ##{ BODY_SINGLE_WORD meta BODY_SINGLE_WORD __BODY_SINGLE_WORD && !ALL_TRUSTED && !__HDRS_LCASE_KNOWN && !__FROM_ALL_NUMS && !__RCD_RDNS_SMTP describe BODY_SINGLE_WORD Message body is only one word (no spaces) #score BODY_SINGLE_WORD 2.500 # limit ##} BODY_SINGLE_WORD ##{ BODY_URI_ONLY meta BODY_URI_ONLY __BODY_URI_ONLY && !__NOT_SPOOFED && !__LCL__ENV_AND_HDR_FROM_MATCH && !__TO_EQ_FROM_DOM && !__X_CRON_ENV describe BODY_URI_ONLY Message body is only a URI in one line of text or for an image #score BODY_URI_ONLY 1.000 # limit tflags BODY_URI_ONLY publish ##} BODY_URI_ONLY ##{ BOGUS_MSM_HDRS meta BOGUS_MSM_HDRS __BOGUS_MSM_HDRS describe BOGUS_MSM_HDRS Apparently bogus Microsoft email headers #score BOGUS_MSM_HDRS 3.000 # limit tflags BOGUS_MSM_HDRS publish ##} BOGUS_MSM_HDRS ##{ BOMB_FREEM meta BOMB_FREEM __EXPLOSIVE_DEVICE && __freemail_hdr_replyto describe BOMB_FREEM Bomb + freemail #score BOMB_FREEM 2.000 # limit tflags BOMB_FREEM publish ##} BOMB_FREEM ##{ BOMB_MONEY meta BOMB_MONEY __EXPLOSIVE_DEVICE && ( __ADVANCE_FEE_3_NEW || __ADVANCE_FEE_4_NEW || __ADVANCE_FEE_5_NEW ) describe BOMB_MONEY Bomb + money: bomb threat? #score BOMB_MONEY 2.500 # limit tflags BOMB_MONEY publish ##} BOMB_MONEY ##{ BUG6152_INVALID_DATE_TZ_ABSURD header BUG6152_INVALID_DATE_TZ_ABSURD Date =~ /[-+](?!(?:0\d|1[0-4])(?:[03]0|[14]5))\d{4}/ ##} BUG6152_INVALID_DATE_TZ_ABSURD ##{ CANT_SEE_AD meta CANT_SEE_AD (__CANT_SEE_AD_1 || __CANT_SEE_AD_2) && !__DOS_HAS_LIST_UNSUB describe CANT_SEE_AD You really want to see our spam. #score CANT_SEE_AD 2.500 # limit tflags CANT_SEE_AD publish ##} CANT_SEE_AD ##{ CN_B2B_SPAMMER body CN_B2B_SPAMMER /\bWe are (?:(?:a )?(?:China|Taiwan)[-\s]based|(?:one of (?:the )?best|(?:a )?leading) (?:international|[^\.]{10,90} (?:in|from) (?:\w+, )?(?:China|Taiwan)))\b/i describe CN_B2B_SPAMMER Chinese company introducing itself tflags CN_B2B_SPAMMER publish ##} CN_B2B_SPAMMER ##{ COMMENT_GIBBERISH meta COMMENT_GIBBERISH __COMMENT_GIBBERISH && !__JM_REACTOR_DATE && !__RCD_RDNS_MTA_MESSY && !__SENDER_BOT describe COMMENT_GIBBERISH Nonsense in long HTML comment #score COMMENT_GIBBERISH 1.50 # limit tflags COMMENT_GIBBERISH publish ##} COMMENT_GIBBERISH ##{ CORRUPT_FROM_LINE_IN_HDRS meta CORRUPT_FROM_LINE_IN_HDRS (MISSING_HEADERS && __BODY_STARTS_WITH_FROM_LINE && MISSING_DATE && NO_RELAYS) describe CORRUPT_FROM_LINE_IN_HDRS Informational: message is corrupt, with a From line in its headers tflags CORRUPT_FROM_LINE_IN_HDRS userconf publish #score CORRUPT_FROM_LINE_IN_HDRS 0.001 ##} CORRUPT_FROM_LINE_IN_HDRS ##{ CTYPE_001C_A meta CTYPE_001C_A (0) # obsolete ##} CTYPE_001C_A ##{ CTYPE_001C_B header CTYPE_001C_B Content-Type =~ /multipart.{0,200}boundary=\"----=_NextPart_000_0000_01C[0-9A-F]{5}\.[0-9A-F]{7}0\"/ ##} CTYPE_001C_B ##{ CTYPE_8SPACE_GIF ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader CTYPE_8SPACE_GIF Content-Type:raw =~ /^image\/gif;\n {8}name=\".+?\"$/s describe CTYPE_8SPACE_GIF Stock spam image part 'Content-Type' found (8 spc) endif ##} CTYPE_8SPACE_GIF ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ CTYPE_NULL ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta CTYPE_NULL __CTYPE_NULL describe CTYPE_NULL Malformed Content-Type header endif ##} CTYPE_NULL ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ CURR_PRICE body CURR_PRICE /\bCurrent Price:/ ##} CURR_PRICE ##{ DEAR_BENEFICIARY body DEAR_BENEFICIARY /\b(?:De[ae]r\s|At+(?:ention|n):?\s?)(?:\S+\s)?Ben[ei]ficiary\b/i describe DEAR_BENEFICIARY Dear Beneficiary: ##} DEAR_BENEFICIARY ##{ DEAR_WINNER body DEAR_WINNER /\bdear.{1,20}winner/i describe DEAR_WINNER Spam with generic salutation of "dear winner" ##} DEAR_WINNER ##{ DKIMWL_BL ifplugin Mail::SpamAssassin::Plugin::AskDNS ifplugin Mail::SpamAssassin::Plugin::AskDNS tflags DKIMWL_BL nice net describe DKIMWL_BL DKIMwl.org - Blacklisted sender #score DKIMWL_BL 7.5 endif ##} DKIMWL_BL ifplugin Mail::SpamAssassin::Plugin::AskDNS ##{ DKIMWL_WL_HIGH ifplugin Mail::SpamAssassin::Plugin::AskDNS ifplugin Mail::SpamAssassin::Plugin::AskDNS meta DKIMWL_WL_HIGH __DKIMWL_WL_HI && !(FREEMAIL_FROM || FREEMAIL_REPLYTO || FREEMAIL_FORGED_REPLYTO) tflags DKIMWL_WL_HIGH nice net describe DKIMWL_WL_HIGH DKIMwl.org - Whitelisted High sender #score DKIMWL_WL_HIGH -7.5 endif ##} DKIMWL_WL_HIGH ifplugin Mail::SpamAssassin::Plugin::AskDNS ##{ DKIMWL_WL_MED ifplugin Mail::SpamAssassin::Plugin::AskDNS ifplugin Mail::SpamAssassin::Plugin::AskDNS meta DKIMWL_WL_MED __DKIMWL_WL_MED && !(FREEMAIL_FROM || FREEMAIL_REPLYTO || FREEMAIL_FORGED_REPLYTO) tflags DKIMWL_WL_MED nice net describe DKIMWL_WL_MED DKIMwl.org - Whitelisted Medium sender #score DKIMWL_WL_MED -3.5 endif ##} DKIMWL_WL_MED ifplugin Mail::SpamAssassin::Plugin::AskDNS ##{ DOS_ANAL_SPAM_MAILER header DOS_ANAL_SPAM_MAILER X-mailer =~ /^[A-Z][a-z]{6}e \d\.\d{2}$/ describe DOS_ANAL_SPAM_MAILER X-mailer pattern common to anal porn site spam tflags DOS_ANAL_SPAM_MAILER publish ##} DOS_ANAL_SPAM_MAILER ##{ DOS_FIX_MY_URI meta DOS_FIX_MY_URI __MIMEOLE_1106 && __DOS_HAS_ANY_URI && __DOS_SINGLE_EXT_RELAY && __DOS_HI && __DOS_LINK describe DOS_FIX_MY_URI Looks like a "fix my obfu'd URI please" spam ##} DOS_FIX_MY_URI ##{ DOS_HIGH_BAT_TO_MX meta DOS_HIGH_BAT_TO_MX __DOS_DIRECT_TO_MX && __HIGHBITS && __LAST_UNTRUSTED_RELAY_NO_AUTH && __THEBAT_MUA describe DOS_HIGH_BAT_TO_MX The Bat! Direct to MX with High Bits ##} DOS_HIGH_BAT_TO_MX ##{ DOS_LET_GO_JOB meta DOS_LET_GO_JOB __DOS_LET_GO_JOB && __DOS_MY_OLD_JOB && __DOS_I_DRIVE_A && __DOS_TAKING_HOME describe DOS_LET_GO_JOB Let go from their job and now makes lots of dough! ##} DOS_LET_GO_JOB ##{ DOS_OE_TO_MX meta DOS_OE_TO_MX __OE_MUA && __DOS_DIRECT_TO_MX && !DOS_OE_TO_MX_IMAGE describe DOS_OE_TO_MX Delivered direct to MX with OE headers ##} DOS_OE_TO_MX ##{ DOS_OE_TO_MX_IMAGE meta DOS_OE_TO_MX_IMAGE __OE_MUA && __DOS_DIRECT_TO_MX && __ANY_IMAGE_ATTACH describe DOS_OE_TO_MX_IMAGE Direct to MX with OE headers and an image ##} DOS_OE_TO_MX_IMAGE ##{ DOS_OUTLOOK_TO_MX meta DOS_OUTLOOK_TO_MX __ANY_OUTLOOK_MUA && !__OE_MUA && __DOS_DIRECT_TO_MX && !T_DOS_OUTLOOK_TO_MX_IMAGE describe DOS_OUTLOOK_TO_MX Delivered direct to MX with Outlook headers ##} DOS_OUTLOOK_TO_MX ##{ DOS_RCVD_IP_TWICE_C header DOS_RCVD_IP_TWICE_C X-Spam-Relays-External =~ /^\s*\[ ip=(?!127)([\d.]+) [^\[]*\bhelo=(?:![\d.]{7,15}!)? [^\[]*\[ ip=\1 [^\]]*\]\s*$/ describe DOS_RCVD_IP_TWICE_C Received from the same IP twice in a row (only one external relay; empty or IP helo) ##} DOS_RCVD_IP_TWICE_C ##{ DOS_STOCK_BAT meta DOS_STOCK_BAT __THEBAT_MUA && (__DOS_BODY_STOCK || __DOS_BODY_TICKER) && (__DOS_REF_TODAY || __DOS_REF_NEXT_WK_DAY || __DOS_REF_2_WK_DAYS) describe DOS_STOCK_BAT Probable pump and dump stock spam ##} DOS_STOCK_BAT ##{ DOS_STOCK_BAT2 meta DOS_STOCK_BAT2 DOS_STOCK_BAT && (__DOS_FIN_ADVANTAGE + __DOS_STRONG_CF + __DOS_STEADY_COURSE > 2) ##} DOS_STOCK_BAT2 ##{ DOS_URI_ASTERISK uri DOS_URI_ASTERISK m{^[Hh][Tt]{2}[Pp][Ss]?://[^/:]+(?:\*[A-Za-z0-9-]*\.|\*)[A-Za-z]{2,3}(?:\.[A-Za-z]{2})?(?:$|:|/)} describe DOS_URI_ASTERISK Found an asterisk in a URI ##} DOS_URI_ASTERISK ##{ DOS_YOUR_PLACE meta DOS_YOUR_PLACE (__DOS_COMING_TO_YOUR_PLACE && __DOS_MEET_EACH_OTHER && (__DOS_DROP_ME_A_LINE || __DOS_CORRESPOND_EMAIL || __DOS_EMAIL_DIRECTLY || __DOS_I_AM_25 || __DOS_WRITE_ME_AT || __DOS_PERSONAL_EMAIL)) describe DOS_YOUR_PLACE Russian dating spam ##} DOS_YOUR_PLACE ##{ DRUGS_HDIA header DRUGS_HDIA Subject =~ /\bhoodia\b/i describe DRUGS_HDIA Subject mentions "hoodia" ##} DRUGS_HDIA ##{ DRUGS_STOCK_MIMEOLE meta DRUGS_STOCK_MIMEOLE (__MIMEOLE_1106 && __MAILER_OL_5510) describe DRUGS_STOCK_MIMEOLE Stock-spam forged headers found (5510) ##} DRUGS_STOCK_MIMEOLE ##{ DX_TEXT_02 body DX_TEXT_02 /\b(?:change|modif(?:y|ications?)) (?:of|to|(?:yo)?ur) (?:message|sub|comm) stat/i describe DX_TEXT_02 "change your message stat" tflags DX_TEXT_02 publish ##} DX_TEXT_02 ##{ DX_TEXT_03 body DX_TEXT_03 /\b[A-Z]{3} Media (?:Group|Relations)\b/ describe DX_TEXT_03 "XXX Media Group" tflags DX_TEXT_03 publish ##} DX_TEXT_03 ##{ DYN_RDNS_AND_INLINE_IMAGE meta DYN_RDNS_AND_INLINE_IMAGE (RDNS_DYNAMIC && __ANY_IMAGE_ATTACH) describe DYN_RDNS_AND_INLINE_IMAGE Contains image, and was sent by dynamic rDNS ##} DYN_RDNS_AND_INLINE_IMAGE ##{ DYN_RDNS_SHORT_HELO_HTML meta DYN_RDNS_SHORT_HELO_HTML (__HELO_NO_DOMAIN && RDNS_DYNAMIC && HTML_MESSAGE) describe DYN_RDNS_SHORT_HELO_HTML Sent by dynamic rDNS, short HELO, and HTML ##} DYN_RDNS_SHORT_HELO_HTML ##{ DYN_RDNS_SHORT_HELO_IMAGE meta DYN_RDNS_SHORT_HELO_IMAGE (__HELO_NO_DOMAIN && RDNS_DYNAMIC && __ANY_IMAGE_ATTACH) describe DYN_RDNS_SHORT_HELO_IMAGE Short HELO string, dynamic rDNS, inline image ##} DYN_RDNS_SHORT_HELO_IMAGE ##{ ENCRYPTED_MESSAGE meta ENCRYPTED_MESSAGE __CT_ENCRYPTED describe ENCRYPTED_MESSAGE Message is encrypted, not likely to be spam #score ENCRYPTED_MESSAGE -1.000 tflags ENCRYPTED_MESSAGE nice,publish ##} ENCRYPTED_MESSAGE ##{ EXCUSE_24 body EXCUSE_24 /you(?:'ve|'re| have| are)? receiv(?:e|ed|ing) this (?:advertisement|offer|special|recurring|paid).{0,16}\b(?:by either|because)/i describe EXCUSE_24 Claims you wanted this ad ##} EXCUSE_24 ##{ FAKE_REPLY_C meta FAKE_REPLY_C (__SUBJ_RE && __MISSING_REF && __NO_INR_YES_REF) ##} FAKE_REPLY_C ##{ FBI_MONEY meta FBI_MONEY __FBI_SPOOF && LOTS_OF_MONEY describe FBI_MONEY The FBI wants to give you lots of money? #score FBI_MONEY 2.00 # limit tflags FBI_MONEY publish ##} FBI_MONEY ##{ FBI_SPOOF meta FBI_SPOOF __FBI_SPOOF describe FBI_SPOOF Claims to be FBI, but not from FBI domain #score FBI_SPOOF 2.00 # limit tflags FBI_SPOOF publish ##} FBI_SPOOF ##{ FILL_THIS_FORM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta FILL_THIS_FORM __FILL_THIS_FORM && !__THREADED && !__FB_TOUR && !__VIA_ML describe FILL_THIS_FORM Fill in a form with personal information tflags FILL_THIS_FORM publish endif ##} FILL_THIS_FORM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta FILL_THIS_FORM_LOAN __FILL_THIS_FORM_LOAN && !__COMMENT_EXISTS && !__HTML_LINK_IMAGE describe FILL_THIS_FORM_LOAN Answer loan question(s) # score FILL_THIS_FORM_LOAN 2.0 endif ##} FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FORM_FRAUD meta FORM_FRAUD (__FORM_FRAUD && !__FORM_FRAUD_3 && !__FORM_FRAUD_5) && !__DOS_HAS_LIST_UNSUB && !__THREADED && !__HAS_THREAD_INDEX && !__VIA_ML && !__HTML_LINK_IMAGE && !__COMMENT_EXISTS && !__NOT_SPOOFED && !__UPPERCASE_URI && !__UNSUB_LINK describe FORM_FRAUD Fill a form and a fraud phrase #score FORM_FRAUD 1.000 # limit tflags FORM_FRAUD publish ##} FORM_FRAUD ##{ FORM_FRAUD_3 meta FORM_FRAUD_3 (__FORM_FRAUD_3 && !__FORM_FRAUD_5 && !__ADVANCE_FEE_3_NEW_FORM && !__ADVANCE_FEE_3_NEW_FRM_MNY) && !__DOS_HAS_LIST_UNSUB && !__THREADED && !__HAS_THREAD_INDEX && !__VIA_ML && !__HTML_LINK_IMAGE && !__MIME_QP && !__DOS_BODY_FRI && !__UNSUB_LINK && !__BUGGED_IMG && !__NOT_SPOOFED describe FORM_FRAUD_3 Fill a form and several fraud phrases tflags FORM_FRAUD_3 publish ##} FORM_FRAUD_3 ##{ FORM_FRAUD_5 meta FORM_FRAUD_5 (__FORM_FRAUD_5 && !__ADVANCE_FEE_5_NEW_FORM && !__ADVANCE_FEE_5_NEW_FRM_MNY) && !__DOS_HAS_LIST_UNSUB && !__THREADED && !__HAS_THREAD_INDEX && !__VIA_ML && !__BOUNCE_CTYPE describe FORM_FRAUD_5 Fill a form and many fraud phrases tflags FORM_FRAUD_5 publish ##} FORM_FRAUD_5 ##{ FORM_LOW_CONTRAST meta FORM_LOW_CONTRAST __FORM_LOW_CONTRAST && !__BUGGED_IMG && !__HAS_REPLY_TO && !__DKIM_EXISTS && !__DOS_HAS_LIST_UNSUB && !__MSGID_JAVAMAIL describe FORM_LOW_CONTRAST Fill in a form with hidden text #score FORM_LOW_CONTRAST 2.500 # Limit tflags FORM_LOW_CONTRAST publish ##} FORM_LOW_CONTRAST ##{ FOUND_YOU meta FOUND_YOU __FOUND_YOU && !__DKIM_EXISTS && !__SUBJ_RE && !__HAS_X_REF && !__RP_MATCHES_RCVD && !__COMMENT_EXISTS && !__HAS_ERRORS_TO && !__HAS_IN_REPLY_TO #score FOUND_YOU 3.25 # limit describe FOUND_YOU I found you... tflags FOUND_YOU publish ##} FOUND_YOU ##{ FREEMAIL_DISPTO ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::FreeMail meta FREEMAIL_DISPTO ( __freemail_dispto && !__freemail_safe ) describe FREEMAIL_DISPTO Disposition-Notification-To/From or Disposition-Notification-To/body contain different freemails # score FREEMAIL_DISPTO 0.25 endif ##} FREEMAIL_DISPTO ifplugin Mail::SpamAssassin::Plugin::FreeMail ##{ FREEMAIL_FORGED_FROMDOMAIN ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::HeaderEval if (version >= 3.004000) ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::HeaderEval if (version >= 3.004000) meta FREEMAIL_FORGED_FROMDOMAIN FREEMAIL_FROM && HEADER_FROM_DIFFERENT_DOMAINS describe FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom freemail headers are different # score FREEMAIL_FORGED_FROMDOMAIN 0.25 tflags FREEMAIL_FORGED_FROMDOMAIN publish endif endif endif ##} FREEMAIL_FORGED_FROMDOMAIN ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::HeaderEval if (version >= 3.004000) ##{ FREEM_FRNUM_UNICD_EMPTY meta FREEM_FRNUM_UNICD_EMPTY __FREEM_FRNUM_UNICD_EMPTY describe FREEM_FRNUM_UNICD_EMPTY Numeric freemail From address, unicode From name and Subject, empty body #score FREEM_FRNUM_UNICD_EMPTY 3.750 # limit tflags FREEM_FRNUM_UNICD_EMPTY publish ##} FREEM_FRNUM_UNICD_EMPTY ##{ FRNAME_IN_MSG_XPRIO_NO_SUB meta FRNAME_IN_MSG_XPRIO_NO_SUB (__FROM_NAME_IN_MSG && __XPRIO && (__SUBJECT_EMPTY || __SUBJ_SHORT)) && !__DKIM_EXISTS && !__SUBJ_NOT_SHORT && !ALL_TRUSTED describe FRNAME_IN_MSG_XPRIO_NO_SUB From name in message + X-Priority + short or no subject #score FRNAME_IN_MSG_XPRIO_NO_SUB 2.500 # limit tflags FRNAME_IN_MSG_XPRIO_NO_SUB publish ##} FRNAME_IN_MSG_XPRIO_NO_SUB ##{ FROM_ADDR_WS meta FROM_ADDR_WS __FROM_ADDR_WS && !__RCD_RDNS_MTA_MESSY && !ANY_BOUNCE_MESSAGE && !__FROM_ENCODED_QP && !__RCD_RDNS_MAIL describe FROM_ADDR_WS Malformed From address #score FROM_ADDR_WS 3.000 # limit tflags FROM_ADDR_WS publish ##} FROM_ADDR_WS ##{ FROM_IN_TO_AND_SUBJ meta FROM_IN_TO_AND_SUBJ (__TO_EQ_FROM && __SUBJ_HAS_FROM_1) describe FROM_IN_TO_AND_SUBJ From address is in To and Subject tflags FROM_IN_TO_AND_SUBJ publish ##} FROM_IN_TO_AND_SUBJ ##{ FROM_MISSPACED meta FROM_MISSPACED __FROM_MISSPACED && !__RCD_RDNS_MTA_MESSY && !__CTYPE_MULTIPART_ALT && !__REPTO_QUOTE && !__MIME_QP && !__UNSUB_LINK && !__TO___LOWER && !__BUGGED_IMG && !__DOS_HAS_LIST_UNSUB && !__TO_EQ_FROM_DOM && !__MAIL_LINK && !__MTLANDROID_MUA && !__XEROXWORKCTR_MUA && !__PHP_MUA && !__AMADEUSMS_MUA && !__FLASHMAIL_MUA describe FROM_MISSPACED From: missing whitespace #score FROM_MISSPACED 2.00 ##} FROM_MISSPACED ##{ FROM_MISSP_DYNIP meta FROM_MISSP_DYNIP __FROM_RUNON && RDNS_DYNAMIC describe FROM_MISSP_DYNIP From misspaced + dynamic rDNS ##} FROM_MISSP_DYNIP ##{ FROM_MISSP_EH_MATCH meta FROM_MISSP_EH_MATCH __FROM_MISSP_EH_MATCH && !__RCD_RDNS_MTA_MESSY && !__UNSUB_LINK && !__COMMENT_EXISTS && !__TO___LOWER && !__MIME_QP && !__TO_EQ_FROM_DOM && !__BUGGED_IMG && !__DKIM_EXISTS && !__RCVD_ZIXMAIL && !__MTLANDROID_MUA && !__XEROXWORKCTR_MUA && !__PHP_MUA && !__AMADEUSMS_MUA && !__FLASHMAIL_MUA describe FROM_MISSP_EH_MATCH From misspaced, matches envelope #score FROM_MISSP_EH_MATCH 2.00 # max ##} FROM_MISSP_EH_MATCH ##{ FROM_MISSP_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::FreeMail meta FROM_MISSP_FREEMAIL __FROM_MISSP_FREEMAIL && !__TO_EQ_FROM_DOM && !__MTLANDROID_MUA describe FROM_MISSP_FREEMAIL From misspaced + freemail provider endif ##} FROM_MISSP_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail ##{ FROM_MISSP_MSFT meta FROM_MISSP_MSFT __FROM_RUNON && (__ANY_OUTLOOK_MUA || __MIMEOLE_MS) describe FROM_MISSP_MSFT From misspaced + supposed Microsoft tool ##} FROM_MISSP_MSFT ##{ FROM_MISSP_PHISH meta FROM_MISSP_PHISH __FROM_MISSP_PHISH describe FROM_MISSP_PHISH Malformed, claims to be from financial organization - possible phish #score FROM_MISSP_PHISH 3.500 # limit ##} FROM_MISSP_PHISH ##{ FROM_MISSP_REPLYTO meta FROM_MISSP_REPLYTO __FROM_MISSP_REPLYTO && !__NOT_SPOOFED && !__RCD_RDNS_MTA_MESSY && !__TO___LOWER && !__COMMENT_EXISTS && !__UNSUB_LINK && !__MIME_QP && !__CTYPE_MULTIPART_ALT && !__JM_REACTOR_DATE && !__PLING_QUERY describe FROM_MISSP_REPLYTO From misspaced, has Reply-To #score FROM_MISSP_REPLYTO 2.500 # limit ##} FROM_MISSP_REPLYTO ##{ FROM_MISSP_SPF_FAIL ifplugin Mail::SpamAssassin::Plugin::SPF ifplugin Mail::SpamAssassin::Plugin::SPF meta FROM_MISSP_SPF_FAIL (__FROM_RUNON && SPF_FAIL) tflags FROM_MISSP_SPF_FAIL net # score FROM_MISSP_SPF_FAIL 2.00 # limit endif ##} FROM_MISSP_SPF_FAIL ifplugin Mail::SpamAssassin::Plugin::SPF ##{ FROM_MISSP_USER meta FROM_MISSP_USER (__FROM_RUNON && NSL_RCVD_FROM_USER) describe FROM_MISSP_USER From misspaced, from "User" ##} FROM_MISSP_USER ##{ FROM_MISSP_XPRIO meta FROM_MISSP_XPRIO (__XPRIO && __FROM_MISSPACED) && !__LYRIS_EZLM_REMAILER describe FROM_MISSP_XPRIO Misspaced FROM + X-Priority #score FROM_MISSP_XPRIO 2.500 # limit ##} FROM_MISSP_XPRIO ##{ FROM_WORDY meta FROM_WORDY ((__FROM_WORDY_SONLY || __FROM_WORDY_3) && !__HTML_LENGTH_0000_1024) && !__HAS_TNEF && !__USING_VERP1 && !__HDRS_LCASE_KNOWN describe FROM_WORDY From address looks like a sentence #score FROM_WORDY 2.500 # limit tflags FROM_WORDY publish ##} FROM_WORDY ##{ FROM_WORDY_SHORT meta FROM_WORDY_SHORT ((__FROM_WORDY_SONLY || __FROM_WORDY_3) && __HTML_LENGTH_0000_1024) && !__HAS_TNEF && !__USING_VERP1 describe FROM_WORDY_SHORT From address looks like a sentence + short message #score FROM_WORDY_SHORT 2.500 # limit tflags FROM_WORDY_SHORT publish ##} FROM_WORDY_SHORT ##{ FROM_WSP_LEAD header FROM_WSP_LEAD From:raw =~ /< \s+ [^>\s] [^>]* > [^<>]* \z/xm describe FROM_WSP_LEAD Leading whitespace after '<' in From header field ##} FROM_WSP_LEAD ##{ FROM_WSP_TRAIL header FROM_WSP_TRAIL From:raw =~ /< [^>]* \s > [^<>]* \z/xm describe FROM_WSP_TRAIL Trailing whitespace before '>' in From header field ##} FROM_WSP_TRAIL ##{ FSL_BULK_SIG meta FSL_BULK_SIG (DCC_CHECK || RAZOR2_CHECK || PYZOR_CHECK) && !__FSL_HAS_LIST_UNSUB && !__UNSUB_LINK && !__RCVD_IN_DNSWL && !__DKIMWL_WL_HI && !__JM_REACTOR_DATE && !__RCD_RDNS_SMTP_MESSY describe FSL_BULK_SIG Bulk signature with no Unsubscribe #score FSL_BULK_SIG 3.000 # limit tflags FSL_BULK_SIG net publish ##} FSL_BULK_SIG ##{ FSL_FAKE_HOTMAIL_RVCD header FSL_FAKE_HOTMAIL_RVCD X-Spam-Relays-External =~ /mx[1234]\.hotmail\.com/ ##} FSL_FAKE_HOTMAIL_RVCD ##{ FSL_HELO_BARE_IP_1 meta FSL_HELO_BARE_IP_1 __FSL_HELO_BARE_IP_1 && !ALL_TRUSTED ##} FSL_HELO_BARE_IP_1 ##{ FSL_HELO_DEVICE header FSL_HELO_DEVICE X-Spam-Relays-External =~ /\bhelo=(?:(?:dsl)?device|speedtouch)\.lan\b/i ##} FSL_HELO_DEVICE ##{ FSL_HELO_FAKE header FSL_HELO_FAKE X-Spam-Relays-External =~ /\bhelo=(?:yandex.ru|(?:hotmail|gmail|google|yahoo|msn|microsoft)\.com)\b/i ##} FSL_HELO_FAKE ##{ FSL_HELO_NON_FQDN_1 header FSL_HELO_NON_FQDN_1 X-Spam-Relays-External =~ /^[^\]]+ helo=[a-zA-Z0-9-_]+ /i ##} FSL_HELO_NON_FQDN_1 ##{ FSL_HELO_SETUP header FSL_HELO_SETUP X-Spam-Relays-External =~ /\bhelo=\S+\.setup\b/i ##} FSL_HELO_SETUP ##{ FSL_INTERIA_ABUSE uri FSL_INTERIA_ABUSE /\/\S+\.(?:w|eu|fm)\.interia\.pl/ ##} FSL_INTERIA_ABUSE ##{ FSL_NEW_HELO_USER meta FSL_NEW_HELO_USER (__FSL_HELO_USER_1 || __FSL_HELO_USER_2 || __FSL_HELO_USER_3) describe FSL_NEW_HELO_USER Spam's using Helo and User #score FSL_NEW_HELO_USER 2.0 tflags FSL_NEW_HELO_USER publish ##} FSL_NEW_HELO_USER ##{ FUZZY_ANDROID ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FUZZY_ANDROID /(?!ndroid)/i describe FUZZY_ANDROID Obfuscated "android" tflags FUZZY_ANDROID publish endif ##} FUZZY_ANDROID ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FUZZY_BITCOIN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FUZZY_BITCOIN /(?!itcoin)/i describe FUZZY_BITCOIN Obfuscated "Bitcoin" tflags FUZZY_BITCOIN publish endif ##} FUZZY_BITCOIN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FUZZY_BROWSER ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FUZZY_BROWSER /(?!rowser)/i describe FUZZY_BROWSER Obfuscated "browser" tflags FUZZY_BROWSER publish endif ##} FUZZY_BROWSER ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FUZZY_BTC_WALLET ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta FUZZY_BTC_WALLET FUZZY_BITCOIN && FUZZY_WALLET describe FUZZY_BTC_WALLET Heavily obfuscated "bitcoin wallet" tflags FUZZY_BTC_WALLET publish endif ##} FUZZY_BTC_WALLET ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FUZZY_CLICK_HERE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FUZZY_CLICK_HERE /(?!lick(?:\s| )here)****+***/i describe FUZZY_CLICK_HERE Obfuscated "click here" tflags FUZZY_CLICK_HERE publish endif ##} FUZZY_CLICK_HERE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FUZZY_DR_OZ ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta FUZZY_DR_OZ __FUZZY_DR_OZ && !__VIA_ML && !__DKIM_EXISTS && !__RP_MATCHES_RCVD describe FUZZY_DR_OZ Obfuscated Doctor Oz tflags FUZZY_DR_OZ publish endif ##} FUZZY_DR_OZ ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FUZZY_IMPORTANT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FUZZY_IMPORTANT /(?!mportant)

/i describe FUZZY_IMPORTANT Obfuscated "important" tflags FUZZY_IMPORTANT publish endif ##} FUZZY_IMPORTANT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FUZZY_MERIDIA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FUZZY_MERIDIA /\b(?!meridia)\b/i describe FUZZY_MERIDIA Obfuscation of the word "meridia" endif ##} FUZZY_MERIDIA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FUZZY_PRIVACY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FUZZY_PRIVACY /

(?!rivacy)/i describe FUZZY_PRIVACY Obfuscated "privacy" tflags FUZZY_PRIVACY publish endif ##} FUZZY_PRIVACY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FUZZY_PROMOTION ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FUZZY_PROMOTION /

(?!romotion)/i describe FUZZY_PROMOTION Obfuscated "promotion" tflags FUZZY_PROMOTION publish endif ##} FUZZY_PROMOTION ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FUZZY_SAVINGS ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FUZZY_SAVINGS /(?!avings)/i describe FUZZY_SAVINGS Obfuscated "savings" tflags FUZZY_SAVINGS publish endif ##} FUZZY_SAVINGS ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FUZZY_SECURITY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FUZZY_SECURITY /(?!ecurity)(?!eguridad)(?:|)(?:|)/i describe FUZZY_SECURITY Obfuscated "security" tflags FUZZY_SECURITY publish endif ##} FUZZY_SECURITY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FUZZY_UNSUBSCRIBE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FUZZY_UNSUBSCRIBE /(?!nsubscribe)/i describe FUZZY_UNSUBSCRIBE Obfuscated "unsubscribe" tflags FUZZY_UNSUBSCRIBE publish endif ##} FUZZY_UNSUBSCRIBE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ FUZZY_WALLET ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body FUZZY_WALLET /(?!allet)/i describe FUZZY_WALLET Obfuscated "Wallet" tflags FUZZY_WALLET publish endif ##} FUZZY_WALLET ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ GAPPY_SALES_LEADS_FREEM if can(Mail::SpamAssassin::Conf::feature_bug6558_free) if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta GAPPY_SALES_LEADS_FREEM __GAPPY_SALES_LEADS_MANY && (__REPTO_CHN_FREEM || __freemail_hdr_replyto) describe GAPPY_SALES_LEADS_FREEM Obfuscated marketing text, freemail or CHN replyto # score GAPPY_SALES_LEADS_FREEM 3.500 # limit tflags GAPPY_SALES_LEADS_FREEM publish endif ##} GAPPY_SALES_LEADS_FREEM if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ##{ GEO_QUERY_STRING uri GEO_QUERY_STRING /^http:\/\/(?:\w{2,4}\.)?geocities\.com(?::\d*)?\/.+?\/\?/i ##} GEO_QUERY_STRING ##{ GOOGLE_DOCS_PHISH meta GOOGLE_DOCS_PHISH (__GOOGLE_DOCS_PHISH_1 || __GOOGLE_DOCS_PHISH_2) describe GOOGLE_DOCS_PHISH Possible phishing via a Google Docs form #score GOOGLE_DOCS_PHISH 3.00 # limit tflags GOOGLE_DOCS_PHISH publish ##} GOOGLE_DOCS_PHISH ##{ GOOGLE_DOCS_PHISH_MANY meta GOOGLE_DOCS_PHISH_MANY __URI_GOOGLE_DOC && (__EMAIL_PHISH_MANY || __ACCT_PHISH_MANY) describe GOOGLE_DOCS_PHISH_MANY Phishing via a Google Docs form #score GOOGLE_DOCS_PHISH_MANY 4.00 # limit tflags GOOGLE_DOCS_PHISH_MANY publish ##} GOOGLE_DOCS_PHISH_MANY ##{ GOOG_MALWARE_DNLD meta GOOG_MALWARE_DNLD __GOOG_MALWARE_DNLD describe GOOG_MALWARE_DNLD File download via Google - Malware? #score GOOG_MALWARE_DNLD 5.000 # limit tflags GOOG_MALWARE_DNLD publish ##} GOOG_MALWARE_DNLD ##{ GOOG_REDIR_NORDNS meta GOOG_REDIR_NORDNS __GOOG_REDIR && RDNS_NONE describe GOOG_REDIR_NORDNS Google redirect to obscure spamvertised website + no rDNS ##} GOOG_REDIR_NORDNS ##{ GOOG_REDIR_SHORT meta GOOG_REDIR_SHORT __GOOG_REDIR && __LCL__KAM_BODY_LENGTH_LT_512 describe GOOG_REDIR_SHORT Google redirect to obscure spamvertised website + short message tflags GOOG_REDIR_SHORT publish ##} GOOG_REDIR_SHORT ##{ HDRS_LCASE describe HDRS_LCASE Odd capitalization of message header #score HDRS_LCASE 0.10 # limit ##} HDRS_LCASE ##{ HDRS_LCASE if !plugin(Mail::SpamAssassin::Plugin::FreeMail) if !plugin(Mail::SpamAssassin::Plugin::FreeMail) meta HDRS_LCASE __HDRS_LCASE && !__HDRS_LCASE_KNOWN && !__VIA_ML && !__THREADED && !__UNUSABLE_MSGID && !__DOS_SINGLE_EXT_RELAY && !__DKIM_EXISTS && !__BUGGED_IMG && !__SUBSCRIPTION_INFO && !NO_RELAYS && !__RDNS_NONE && !__MIME_BASE64 && !__SUBJECT_ENCODED_B64 && !__RCD_RDNS_MX_MESSY && !__HTML_LINK_IMAGE && !__RDNS_SHORT && !__TAG_EXISTS_STYLE && !ALL_TRUSTED && !__NOT_SPOOFED && !__RCD_RDNS_SMTP_MESSY && !__NAKED_TO endif ##} HDRS_LCASE if !plugin(Mail::SpamAssassin::Plugin::FreeMail) ##{ HDRS_LCASE ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::FreeMail meta HDRS_LCASE __HDRS_LCASE && !__HDRS_LCASE_KNOWN && !__VIA_ML && !__freemail_safe && !__THREADED && !__UNUSABLE_MSGID && !__DOS_SINGLE_EXT_RELAY && !__DKIM_EXISTS && !__BUGGED_IMG && !__SUBSCRIPTION_INFO && !NO_RELAYS && !__RDNS_NONE && !__MIME_BASE64 && !__SUBJECT_ENCODED_B64 && !__RCD_RDNS_MX_MESSY && !__HTML_LINK_IMAGE && !__RDNS_SHORT && !__TAG_EXISTS_STYLE && !ALL_TRUSTED && !__NOT_SPOOFED && !__RCD_RDNS_SMTP_MESSY && !__NAKED_TO endif ##} HDRS_LCASE ifplugin Mail::SpamAssassin::Plugin::FreeMail ##{ HDRS_LCASE_IMGONLY meta HDRS_LCASE_IMGONLY __HDRS_LCASE && __HTML_IMG_ONLY && !__HDRS_LCASE_KNOWN describe HDRS_LCASE_IMGONLY Odd capitalization of message headers + image-only HTML #score HDRS_LCASE_IMGONLY 0.10 # limit ##} HDRS_LCASE_IMGONLY ##{ HDR_ORDER_FTSDMCXX_001C meta HDR_ORDER_FTSDMCXX_001C (__HDR_ORDER_FTSDMCXXXX && __MID_START_001C) describe HDR_ORDER_FTSDMCXX_001C Header order similar to spam (FTSDMCXX/MID variant) ##} HDR_ORDER_FTSDMCXX_001C ##{ HDR_ORDER_FTSDMCXX_BAT meta HDR_ORDER_FTSDMCXX_BAT (__HDR_ORDER_FTSDMCXXXX && __BAT_BOUNDARY) describe HDR_ORDER_FTSDMCXX_BAT Header order similar to spam (FTSDMCXX/boundary variant) ##} HDR_ORDER_FTSDMCXX_BAT ##{ HDR_ORDER_FTSDMCXX_DIRECT meta HDR_ORDER_FTSDMCXX_DIRECT (__HDR_ORDER_FTSDMCXXXX && __DOS_SINGLE_EXT_RELAY) && !ALL_TRUSTED && !__VIA_ML describe HDR_ORDER_FTSDMCXX_DIRECT Header order similar to spam (FTSDMCXX/boundary variant) + direct-to-MX #score HDR_ORDER_FTSDMCXX_DIRECT 2.000 # limit tflags HDR_ORDER_FTSDMCXX_DIRECT publish ##} HDR_ORDER_FTSDMCXX_DIRECT ##{ HDR_ORDER_FTSDMCXX_NORDNS meta HDR_ORDER_FTSDMCXX_NORDNS (__HDR_ORDER_FTSDMCXXXX && __RDNS_NONE) && !ALL_TRUSTED describe HDR_ORDER_FTSDMCXX_NORDNS Header order similar to spam (FTSDMCXX/boundary variant) + no rDNS #score HDR_ORDER_FTSDMCXX_NORDNS 3.500 # limit tflags HDR_ORDER_FTSDMCXX_NORDNS publish ##} HDR_ORDER_FTSDMCXX_NORDNS ##{ HEADER_COUNT_SUBJECT ifplugin Mail::SpamAssassin::Plugin::HeaderEval ifplugin Mail::SpamAssassin::Plugin::HeaderEval header HEADER_COUNT_SUBJECT eval:check_header_count_range('Subject','2','999') describe HEADER_COUNT_SUBJECT Multiple Subject headers found endif ##} HEADER_COUNT_SUBJECT ifplugin Mail::SpamAssassin::Plugin::HeaderEval ##{ HEADER_FROM_DIFFERENT_DOMAINS ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::HeaderEval if (version >= 3.004000) ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::HeaderEval if (version >= 3.004000) header HEADER_FROM_DIFFERENT_DOMAINS eval:check_equal_from_domains() describe HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different # score HEADER_FROM_DIFFERENT_DOMAINS 0.25 tflags HEADER_FROM_DIFFERENT_DOMAINS publish endif endif endif ##} HEADER_FROM_DIFFERENT_DOMAINS ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::HeaderEval if (version >= 3.004000) ##{ HELO_FRIEND header HELO_FRIEND X-Spam-Relays-External =~ /^[^\]]+ helo=friend /i ##} HELO_FRIEND ##{ HELO_LH_LD header HELO_LH_LD X-Spam-Relays-External =~ /^[^\]]+ helo=localhost\.localdomain /i ##} HELO_LH_LD ##{ HELO_LOCALHOST header HELO_LOCALHOST X-Spam-Relays-External =~ /^[^\]]+ helo=localhost /i ##} HELO_LOCALHOST ##{ HELO_OEM header HELO_OEM X-Spam-Relays-External =~ /^[^\]]+ helo=(?:pc|oem\S*) /i ##} HELO_OEM ##{ HEXHASH_WORD meta HEXHASH_WORD (__HEXHASHWORD_S2EU > 1) && !ALL_TRUSTED && !__DKIM_EXISTS && !__RP_MATCHES_RCVD && !__LCL__ENV_AND_HDR_FROM_MATCH && !__LYRIS_EZLM_REMAILER && !__THREADED && !__HDRS_LCASE && !__MSGID_HEXISH && !__RDNS_SHORT describe HEXHASH_WORD Multiple instances of word + hexadecimal hash #score HEXHASH_WORD 3.000 # limit tflags HEXHASH_WORD publish ##} HEXHASH_WORD ##{ HK_LOTTO meta HK_LOTTO __HK_LOTTO_1 || __HK_LOTTO_2 || __HK_LOTTO_JACKPOT || __HK_LOTTO_STAATS || __HK_LOTTO_BALLOT #score HK_LOTTO 1 ##} HK_LOTTO ##{ HK_NAME_DRUGS header HK_NAME_DRUGS From:name =~ /(viagra|\bcialis|cialis\b)/mi describe HK_NAME_DRUGS From name contains drugs #score HK_NAME_DRUGS 2 ##} HK_NAME_DRUGS ##{ HK_NAME_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail if (version >= 3.004000) ifplugin Mail::SpamAssassin::Plugin::FreeMail if (version >= 3.004000) meta HK_NAME_MR_MRS __HK_NAME_MR_MRS && !FREEMAIL_FROM # score HK_NAME_MR_MRS 1.0 endif endif ##} HK_NAME_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail if (version >= 3.004000) ##{ HK_RANDOM_ENVFROM header HK_RANDOM_ENVFROM EnvelopeFrom =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr|-mailer@)|[^@]{20})[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi describe HK_RANDOM_ENVFROM Envelope sender username looks random #score HK_RANDOM_ENVFROM 1 ##} HK_RANDOM_ENVFROM ##{ HK_SCAM_N2 body HK_SCAM_N2 /\bnext of kin\b/i ##} HK_SCAM_N2 ##{ HK_SCAM_N8 body HK_SCAM_N8 /\byour compensation\b/i ##} HK_SCAM_N8 ##{ HTML_ENTITY_ASCII meta HTML_ENTITY_ASCII __HTML_ENTITY_ASCII_MINFP describe HTML_ENTITY_ASCII Obfuscated ASCII #score HTML_ENTITY_ASCII 3.000 # limit tflags HTML_ENTITY_ASCII publish ##} HTML_ENTITY_ASCII ##{ HTML_ENTITY_ASCII_TINY meta HTML_ENTITY_ASCII_TINY __HTML_ENTITY_ASCII_MINFP && __HTML_FONT_TINY_01 describe HTML_ENTITY_ASCII_TINY Obfuscated ASCII + tiny fonts #score HTML_ENTITY_ASCII_TINY 3.000 # limit tflags HTML_ENTITY_ASCII_TINY publish ##} HTML_ENTITY_ASCII_TINY ##{ HTML_OFF_PAGE meta HTML_OFF_PAGE __HTML_OFF_PAGE && !__RP_MATCHES_RCVD && !__LONGLINE && !__DKIM_EXISTS describe HTML_OFF_PAGE HTML element rendered well off the displayed page #score HTML_OFF_PAGE 3.000 # limit tflags HTML_OFF_PAGE publish ##} HTML_OFF_PAGE ##{ HTML_SHRT_CMNT_OBFU_MANY if can(Mail::SpamAssassin::Conf::feature_bug6558_free) if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta HTML_SHRT_CMNT_OBFU_MANY __HTML_SHRT_CMNT_OBFU_MANY describe HTML_SHRT_CMNT_OBFU_MANY Obfuscation with many short HTML comments # score HTML_SHRT_CMNT_OBFU_MANY 2.500 # limit tflags HTML_SHRT_CMNT_OBFU_MANY publish endif ##} HTML_SHRT_CMNT_OBFU_MANY if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ##{ HTML_SINGLET_MANY meta HTML_SINGLET_MANY __HTML_SINGLET_MANY && !__STY_INVIS_MANY && !__RCD_RDNS_MTA_MESSY && !__NOT_SPOOFED && !__FEES && !ALL_TRUSTED describe HTML_SINGLET_MANY Many single-letter HTML format blocks #score HTML_SINGLET_MANY 2.500 # limit tflags HTML_SINGLET_MANY publish ##} HTML_SINGLET_MANY ##{ HTML_TEXT_INVISIBLE_FONT if can(Mail::SpamAssassin::Conf::feature_bug6558_free) if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta HTML_TEXT_INVISIBLE_FONT __FONT_INVIS_MANY describe HTML_TEXT_INVISIBLE_FONT HTML hidden text # score HTML_TEXT_INVISIBLE_FONT 3.000 # limit tflags HTML_TEXT_INVISIBLE_FONT publish endif ##} HTML_TEXT_INVISIBLE_FONT if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ##{ HTML_TEXT_INVISIBLE_STYLE if can(Mail::SpamAssassin::Conf::feature_bug6558_free) if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta HTML_TEXT_INVISIBLE_STYLE __STY_INVIS_MANY && (__RDNS_NONE || __HDRS_LCASE || __UNSUB_EMAIL || __ADMITS_SPAM || __FROM_DOM_INFO || __HTML_TAG_BALANCE_CENTER || __MSGID_RANDY ) && !__RDNS_LONG && !__RCD_RDNS_MTA describe HTML_TEXT_INVISIBLE_STYLE HTML hidden text + other spam signs # score HTML_TEXT_INVISIBLE_STYLE 3.500 # limit tflags HTML_TEXT_INVISIBLE_STYLE publish endif ##} HTML_TEXT_INVISIBLE_STYLE if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ##{ HTTPS_HTTP_MISMATCH ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch body HTTPS_HTTP_MISMATCH eval:check_https_http_mismatch('1','10') endif ##} HTTPS_HTTP_MISMATCH ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch ##{ IMG_ONLY_FM_DOM_INFO meta IMG_ONLY_FM_DOM_INFO __HTML_IMG_ONLY && __FROM_DOM_INFO describe IMG_ONLY_FM_DOM_INFO HTML image-only message from .info domain #score IMG_ONLY_FM_DOM_INFO 2.500 # limit tflags IMG_ONLY_FM_DOM_INFO publish ##} IMG_ONLY_FM_DOM_INFO ##{ JM_I_FEEL_LUCKY uri JM_I_FEEL_LUCKY /(?:\&|\?)btnI=ec(?:$|\&)/ tflags JM_I_FEEL_LUCKY publish # low hitrate, but always a good sign ##} JM_I_FEEL_LUCKY ##{ JM_RCVD_QMAILV1 header JM_RCVD_QMAILV1 Received =~ /by \S+ \(Qmailv1\) with ESMTP/ ##} JM_RCVD_QMAILV1 ##{ JM_TORA_XM meta JM_TORA_XM (__MAILER_OL_6626 && __MOLE_2962 && __NAKED_TO) ##} JM_TORA_XM ##{ KB_CTYPE_SPACE header KB_CTYPE_SPACE Content-Type =~ /charset="ISO / # " emacs ##} KB_CTYPE_SPACE ##{ KB_CTYPE_SP_MOZ meta KB_CTYPE_SP_MOZ ( KB_CTYPE_SPACE && __KB_UA_MOZ ) describe KB_CTYPE_SP_MOZ Mozilla does not do that, I hope ##} KB_CTYPE_SP_MOZ ##{ KB_DATE_CONTAINS_TAB meta KB_DATE_CONTAINS_TAB __KB_DATE_CONTAINS_TAB && !__ML_TURNS_SP_TO_TAB #score KB_DATE_CONTAINS_TAB 0.5 ##} KB_DATE_CONTAINS_TAB ##{ KB_FAKED_THE_BAT meta KB_FAKED_THE_BAT (__THEBAT_MUA && KB_DATE_CONTAINS_TAB) ##} KB_FAKED_THE_BAT ##{ KB_FORGED_MOZ4 header KB_FORGED_MOZ4 User-Agent =~ /\bMozilla 4/ describe KB_FORGED_MOZ4 Mozilla 4 uses X-Mailer ##} KB_FORGED_MOZ4 ##{ KB_RATWARE_BOUNDARY meta KB_RATWARE_BOUNDARY __RATWARE_BOUND_A || __RATWARE_BOUND_B ##} KB_RATWARE_BOUNDARY ##{ KB_RATWARE_MSGID meta KB_RATWARE_MSGID (__KB_MSGID_OUTLOOK_888 && __ANY_OUTLOOK_MUA) ##} KB_RATWARE_MSGID ##{ KB_RATWARE_OUTLOOK_08 header KB_RATWARE_OUTLOOK_08 ALL =~ /^Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{100,400}boundary="----=_NextPart_000_...._\1\./msi # " ##} KB_RATWARE_OUTLOOK_08 ##{ KB_RATWARE_OUTLOOK_12 header KB_RATWARE_OUTLOOK_12 ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{4})[0-9a-f]{4}\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi # " ##} KB_RATWARE_OUTLOOK_12 ##{ KB_RATWARE_OUTLOOK_16 header KB_RATWARE_OUTLOOK_16 ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi # " ##} KB_RATWARE_OUTLOOK_16 ##{ KB_RATWARE_OUTLOOK_MID header KB_RATWARE_OUTLOOK_MID ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$[0-9a-f]{8}\@.{100,400}boundary="----=_NextPart_000_...._\1\.\2"/msi ##} KB_RATWARE_OUTLOOK_MID ##{ KHOP_DYNAMIC meta KHOP_DYNAMIC __LAST_EXTERNAL_RELAY_NO_AUTH && !ALL_TRUSTED && (__5_SUBDOM || __RDNS_HEX || __S25R_4 || __S25R_6 || __RCD_RDNS_DYN_MESSY || __RCD_RDNS_PPP_MESSY || __RCD_RDNS_PPOE_MESSY) && !__RCD_RDNS_MAIL_MESSY describe KHOP_DYNAMIC Relay looks like a dynamic address #score KHOP_DYNAMIC 2.0 ##} KHOP_DYNAMIC ##{ LIST_PARTIAL_SHORT_MSG meta LIST_PARTIAL_SHORT_MSG __LIST_PARTIAL_SHORT_MSG && !__DKIM_EXISTS describe LIST_PARTIAL_SHORT_MSG Incomplete mailing list headers + short message #score LIST_PARTIAL_SHORT_MSG 2.500 # limit ##} LIST_PARTIAL_SHORT_MSG ##{ LIST_PRTL_PUMPDUMP meta LIST_PRTL_PUMPDUMP __LIST_PRTL_PUMPDUMP && !__DKIM_EXISTS describe LIST_PRTL_PUMPDUMP Incomplete List-* headers and stock pump-and-dump #score LIST_PRTL_PUMPDUMP 2.000 # limit tflags LIST_PRTL_PUMPDUMP publish ##} LIST_PRTL_PUMPDUMP ##{ LIST_PRTL_SAME_USER meta LIST_PRTL_SAME_USER __LIST_PRTL_SAME_USER && !__BUGGED_IMG && !__DKIM_EXISTS && !__RP_MATCHES_RCVD && !__HAS_ERRORS_TO describe LIST_PRTL_SAME_USER Incomplete List-* headers and from+to user the same #score LIST_PRTL_SAME_USER 3.000 # limit tflags LIST_PRTL_SAME_USER publish ##} LIST_PRTL_SAME_USER ##{ LIVEFILESTORE uri LIVEFILESTORE m~livefilestore.com/~ ##} LIVEFILESTORE ##{ LONG_HEX_URI meta LONG_HEX_URI __128_HEX_URI && !__LCL__KAM_BODY_LENGTH_LT_1024 describe LONG_HEX_URI Very long purely hexadecimal URI #score LONG_HEX_URI 3.000 # limit tflags LONG_HEX_URI publish ##} LONG_HEX_URI ##{ LONG_IMG_URI meta LONG_IMG_URI __45_ALNUM_IMG && !ALL_TRUSTED && !__HAS_ERRORS_TO describe LONG_IMG_URI Image URI with very long path component - web bug? #score LONG_IMG_URI 3.000 # limit tflags LONG_IMG_URI publish ##} LONG_IMG_URI ##{ LONG_TERM_PRICE body LONG_TERM_PRICE /long\W+term\W+(target|projected)(\W+price)?/i ##} LONG_TERM_PRICE ##{ LOOPHOLE_1 body LOOPHOLE_1 /loop-?hole in the banking/i describe LOOPHOLE_1 A loop hole in the banking laws? ##} LOOPHOLE_1 ##{ LOTS_OF_MONEY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta LOTS_OF_MONEY (__LOTSA_MONEY_00 || __LOTSA_MONEY_01 || __LOTSA_MONEY_02 || __LOTSA_MONEY_03 || __LOTSA_MONEY_04 || __LOTSA_MONEY_05) && !__TRAVEL_ITINERARY describe LOTS_OF_MONEY Huge... sums of money # score LOTS_OF_MONEY 0.01 tflags LOTS_OF_MONEY publish endif ##} LOTS_OF_MONEY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ LOTTERY_1 meta LOTTERY_1 (__DBLCLAIM && __CASHPRZ) ##} LOTTERY_1 ##{ LOTTERY_PH_004470 meta LOTTERY_PH_004470 (__AFF_004470_NUMBER && __AFF_LOTTERY) ##} LOTTERY_PH_004470 ##{ LOTTO_AGENT meta LOTTO_AGENT __LOTTO_AGENT && !__HAS_IN_REPLY_TO && !__THREADED && !__TO_YOUR_ORG && !__DKIM_EXISTS && !__TRAVEL_ITINERARY && !__AUTO_ACCIDENT && !__HAS_ERRORS_TO && !__RP_MATCHES_RCVD describe LOTTO_AGENT Claims Agent #score LOTTO_AGENT 1.50 # limit ##} LOTTO_AGENT ##{ LUCRATIVE meta LUCRATIVE __LUCRATIVE && !ALL_TRUSTED && !__ANY_TEXT_ATTACH && !__REPLYTO_EXISTS && !__LCL__ENV_AND_HDR_FROM_MATCH describe LUCRATIVE Make lots of money! #score LUCRATIVE 2.00 # limit tflags LUCRATIVE publish ##} LUCRATIVE ##{ L_8BIT_MISMATCH meta L_8BIT_MISMATCH (__CT_TEXT_PLAIN && (!__CTE || __L_CTE_7BIT) && __L_BODY_8BITS) describe L_8BIT_MISMATCH Header says 7bits but body disagrees #score L_8BIT_MISMATCH 0.01 ##} L_8BIT_MISMATCH ##{ L_SPAM_TOOL_13 header L_SPAM_TOOL_13 Date =~ /\s[+-]\d(?![2358]45)\d[124-9]\d$/ ##} L_SPAM_TOOL_13 ##{ MALFORMED_FREEMAIL meta MALFORMED_FREEMAIL (MISSING_HEADERS||__HDRS_LCASE) && FREEMAIL_FROM describe MALFORMED_FREEMAIL Bad headers on message from free email service ##} MALFORMED_FREEMAIL ##{ MALF_HTML_B64 meta MALF_HTML_B64 MIME_BASE64_TEXT && HTML_MIME_NO_HTML_TAG describe MALF_HTML_B64 Malformatted base64-encoded HTML content #score MALF_HTML_B64 3.500 # limit tflags MALF_HTML_B64 publish ##} MALF_HTML_B64 ##{ MANY_SPAN_IN_TEXT meta MANY_SPAN_IN_TEXT __MANY_SPAN_IN_TEXT && !__VIA_ML describe MANY_SPAN_IN_TEXT Many tags embedded within text tflags MANY_SPAN_IN_TEXT publish ##} MANY_SPAN_IN_TEXT ##{ MID_DEGREES header MID_DEGREES Message-ID =~ /^<\d{14}\.[A-F0-9]{10}\@[A-Z0-9]+>$/ ##} MID_DEGREES ##{ MILLION_USD body MILLION_USD /Million\b.{0,40}\b(?:United States? Dollars?|USD)/i describe MILLION_USD Talks about millions of dollars #score MILLION_USD 2 ##} MILLION_USD ##{ MIMEOLE_DIRECT_TO_MX meta MIMEOLE_DIRECT_TO_MX __MIMEOLE_DIRECT_TO_MX && !__ANY_IMAGE_ATTACH && !__DKIM_EXISTS describe MIMEOLE_DIRECT_TO_MX MIMEOLE + direct-to-MX #score MIMEOLE_DIRECT_TO_MX 2.000 # limit tflags MIMEOLE_DIRECT_TO_MX publish ##} MIMEOLE_DIRECT_TO_MX ##{ MIME_BOUND_EQ_REL header MIME_BOUND_EQ_REL Content-Type =~ /boundary="=====================_\d+==\.REL"/s ##} MIME_BOUND_EQ_REL ##{ MIME_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta MIME_NO_TEXT __MIME_NO_TEXT && !__BOUNCE_CTYPE && !__CT_ENCRYPTED && !ALL_TRUSTED && !__MSGID_APPLEMAIL && !__USER_AGENT_APPLEMAIL && !__HAS_IN_REPLY_TO && !__HAS_X_REF && !__HS_SUBJ_RE_FW && !__LCL__ENV_AND_HDR_FROM_MATCH # score MIME_NO_TEXT 2.00 # limit describe MIME_NO_TEXT No (properly identified) text body parts tflags MIME_NO_TEXT publish endif ##} MIME_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ MIME_PHP_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta MIME_PHP_NO_TEXT (MIME_NO_TEXT && __PHP_MUA) describe MIME_PHP_NO_TEXT No text body parts, X-Mailer: PHP endif ##} MIME_PHP_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ MIXED_ES if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ifplugin Mail::SpamAssassin::Plugin::ReplaceTags if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ifplugin Mail::SpamAssassin::Plugin::ReplaceTags meta MIXED_ES ( ! HTML_IMAGE_ONLY_16 ) && ( __LOWER_E > 20 ) && ( __E_LIKE_LETTER > ( (__LOWER_E * 14 ) / 10) ) && ( __E_LIKE_LETTER < ( 10 * __LOWER_E ) ) describe MIXED_ES Too many es are not es tflags MIXED_ES publish endif endif ##} MIXED_ES if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ifplugin Mail::SpamAssassin::Plugin::ReplaceTags ##{ MONEY_ATM_CARD meta MONEY_ATM_CARD __MONEY_ATM_CARD && !__COMMENT_EXISTS && !__TAG_EXISTS_STYLE describe MONEY_ATM_CARD Lots of money on an ATM card ##} MONEY_ATM_CARD ##{ MONEY_BARRISTER meta MONEY_BARRISTER __BARRISTER && LOTS_OF_MONEY describe MONEY_BARRISTER Lots of money from a UK lawyer #score MONEY_BARRISTER 1.000 # limit ##} MONEY_BARRISTER ##{ MONEY_FORM meta MONEY_FORM __MONEY_FORM && !__FB_TOUR && !__FM_MY_PRICE && !__FR_SPACING_8 && !__COMMENT_EXISTS && !__CAN_HELP describe MONEY_FORM Lots of money if you fill out a form ##} MONEY_FORM ##{ MONEY_FORM_SHORT meta MONEY_FORM_SHORT __MONEY_FORM_SHORT && !__DOS_HAS_LIST_UNSUB && !__VIA_ML && !__HTML_LINK_IMAGE && !__UPPERCASE_URI && !__THREADED && !__COMMENT_EXISTS && !__TAG_EXISTS_CENTER && !__THREAD_INDEX_GOOD describe MONEY_FORM_SHORT Lots of money if you fill out a short form #score MONEY_FORM_SHORT 2.500 # limit ##} MONEY_FORM_SHORT ##{ MONEY_FRAUD_3 meta MONEY_FRAUD_3 (__MONEY_FRAUD_3 && !__MONEY_FRAUD_5 && !__MONEY_FRAUD_8 && !__ADVANCE_FEE_3_NEW_MONEY) && !__COMMENT_EXISTS && !__TAG_EXISTS_CENTER && !__IS_EXCH && !__VIA_ML && !__HAS_THREAD_INDEX && !__UNSUB_LINK && !__DOS_HAS_LIST_UNSUB && !__HTML_LINK_IMAGE && !__THREADED && !__DOS_BODY_THU && !__URL_SHORTENER && !__TAG_EXISTS_STYLE describe MONEY_FRAUD_3 Lots of money and several fraud phrases tflags MONEY_FRAUD_3 publish ##} MONEY_FRAUD_3 ##{ MONEY_FRAUD_5 meta MONEY_FRAUD_5 (__MONEY_FRAUD_5 && !__MONEY_FRAUD_8 && !__ADVANCE_FEE_5_NEW_MONEY) && !__VIA_ML && !__HAS_THREAD_INDEX && !__COMMENT_EXISTS && !__UNSUB_LINK && !__TAG_EXISTS_CENTER && !__URL_SHORTENER && !__TAG_EXISTS_STYLE describe MONEY_FRAUD_5 Lots of money and many fraud phrases tflags MONEY_FRAUD_5 publish ##} MONEY_FRAUD_5 ##{ MONEY_FRAUD_8 meta MONEY_FRAUD_8 __MONEY_FRAUD_8 && !__VIA_ML && !__HAS_THREAD_INDEX && !__BUGGED_IMG describe MONEY_FRAUD_8 Lots of money and very many fraud phrases tflags MONEY_FRAUD_8 publish ##} MONEY_FRAUD_8 ##{ MONEY_FROM_MISSP meta MONEY_FROM_MISSP LOTS_OF_MONEY && __FROM_MISSPACED && !__MIME_QP describe MONEY_FROM_MISSP Lots of money and misspaced From #score MONEY_FROM_MISSP 2.000 # limit ##} MONEY_FROM_MISSP ##{ MSGID_MULTIPLE_AT header MSGID_MULTIPLE_AT MESSAGEID =~ /<[^>]*\@[^>]*\@/ describe MSGID_MULTIPLE_AT Message-ID contains multiple '@' characters #score MSGID_MULTIPLE_AT 0.001 ##} MSGID_MULTIPLE_AT ##{ MSM_PRIO_REPTO meta MSM_PRIO_REPTO __MSM_PRIO_REPTO && !__ENV_AND_HDR_FROM_MATCH describe MSM_PRIO_REPTO MSMail priority header + Reply-to + short subject #score MSM_PRIO_REPTO 2.500 # limit tflags MSM_PRIO_REPTO publish ##} MSM_PRIO_REPTO ##{ MSOE_MID_WRONG_CASE meta MSOE_MID_WRONG_CASE (__XM_OUTLOOK_EXPRESS && __MSOE_MID_WRONG_CASE && !__MIMEOLE_1106) ##} MSOE_MID_WRONG_CASE ##{ NORDNS_LOW_CONTRAST meta NORDNS_LOW_CONTRAST (__HTML_FONT_LOW_CONTRAST_MINFP && __RDNS_NONE) && !ALL_TRUSTED && !__HAS_CID describe NORDNS_LOW_CONTRAST No rDNS + hidden text #score NORDNS_LOW_CONTRAST 2.500 # limit ##} NORDNS_LOW_CONTRAST ##{ NO_FM_NAME_IP_HOSTN meta NO_FM_NAME_IP_HOSTN (__KHOP_NO_FULL_NAME && __IP_IN_RELAY) && !__DOS_RELAYED_EXT describe NO_FM_NAME_IP_HOSTN No From name + hostname using IP address #score NO_FM_NAME_IP_HOSTN 2.500 # limit tflags NO_FM_NAME_IP_HOSTN publish ##} NO_FM_NAME_IP_HOSTN ##{ NSL_RCVD_FROM_USER header NSL_RCVD_FROM_USER Received =~ /from User [\[\(]/ describe NSL_RCVD_FROM_USER Received from User ##} NSL_RCVD_FROM_USER ##{ NSL_RCVD_HELO_USER header NSL_RCVD_HELO_USER Received =~ /helo[= ]user\)/i describe NSL_RCVD_HELO_USER Received from HELO User ##} NSL_RCVD_HELO_USER ##{ NULL_IN_BODY full NULL_IN_BODY /\x00/ describe NULL_IN_BODY Message has NUL (ASCII 0) byte in message ##} NULL_IN_BODY ##{ OBFU_BITCOIN meta OBFU_BITCOIN __OBFU_BITCOIN describe OBFU_BITCOIN Obfuscated BitCoin references #score OBFU_BITCOIN 3.000 # limit tflags OBFU_BITCOIN publish ##} OBFU_BITCOIN ##{ OBFU_JVSCR_ESC rawbody OBFU_JVSCR_ESC /document\.write\(unescape\("(?:%[0-9a-f]{2}){10}/i describe OBFU_JVSCR_ESC Injects content using obfuscated javascript tflags OBFU_JVSCR_ESC publish ##} OBFU_JVSCR_ESC ##{ OBFU_TEXT_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader OBFU_TEXT_ATTACH Content-Type =~ m,\bapplication/octet-stream\b.+\.txt\b,i describe OBFU_TEXT_ATTACH Text attachment with non-text MIME type tflags OBFU_TEXT_ATTACH publish endif ##} OBFU_TEXT_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ PART_CID_STOCK ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta PART_CID_STOCK (__ANY_IMAGE_ATTACH&&__PART_STOCK_CID&&!__PART_STOCK_CL&&!__PART_STOCK_CD_F) describe PART_CID_STOCK Has a spammy image attachment (by Content-ID) endif ##} PART_CID_STOCK ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ PART_CID_STOCK_LESS ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta PART_CID_STOCK_LESS (__ANY_IMAGE_ATTACH&&__PART_CID_STOCK_LESS) describe PART_CID_STOCK_LESS Has a spammy image attachment (by Content-ID, more specific) endif ##} PART_CID_STOCK_LESS ifplugin Mail::SpamAssassin::Plugin::MIMEHeader ##{ PHOTO_EDITING_DIRECT if can(Mail::SpamAssassin::Conf::feature_bug6558_free) if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta PHOTO_EDITING_DIRECT (__PHOTO_RETOUCHING && __DOS_DIRECT_TO_MX) && !ALL_TRUSTED && !__HAS_HREF describe PHOTO_EDITING_DIRECT Image editing service, direct to MX # score PHOTO_EDITING_DIRECT 3.000 # limit endif ##} PHOTO_EDITING_DIRECT if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ##{ PHOTO_EDITING_FREEM if can(Mail::SpamAssassin::Conf::feature_bug6558_free) if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta PHOTO_EDITING_FREEM __PHOTO_RETOUCHING > 4 && (__REPTO_CHN_FREEM || __freemail_hdr_replyto) describe PHOTO_EDITING_FREEM Image editing service, freemail or CHN replyto # score PHOTO_EDITING_FREEM 3.750 # limit endif ##} PHOTO_EDITING_FREEM if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ##{ PHP_NOVER_MUA describe PHP_NOVER_MUA Mail from PHP with no version number #score PHP_NOVER_MUA 3.000 # limit tflags PHP_NOVER_MUA publish ##} PHP_NOVER_MUA ##{ PHP_NOVER_MUA if !plugin(Mail::SpamAssassin::Plugin::DKIM) if !plugin(Mail::SpamAssassin::Plugin::DKIM) meta PHP_NOVER_MUA __PHP_NOVER_MUA && !__TO_NO_BRKTS_HTML_ONLY && !__MSGID_OK_DIGITS && !__UPPERCASE_25_50 && !__RP_MATCHES_RCVD && !__GIF_ATTACH endif ##} PHP_NOVER_MUA if !plugin(Mail::SpamAssassin::Plugin::DKIM) ##{ PHP_NOVER_MUA ifplugin Mail::SpamAssassin::Plugin::DKIM ifplugin Mail::SpamAssassin::Plugin::DKIM meta PHP_NOVER_MUA __PHP_NOVER_MUA && !__DKIM_DEPENDABLE && !__TO_NO_BRKTS_HTML_ONLY && !__MSGID_OK_DIGITS && !__UPPERCASE_25_50 && !__RP_MATCHES_RCVD && !__GIF_ATTACH endif ##} PHP_NOVER_MUA ifplugin Mail::SpamAssassin::Plugin::DKIM ##{ PHP_ORIG_SCRIPT meta PHP_ORIG_SCRIPT __PHP_ORIG_SCRIPT_SONLY && !ALL_TRUSTED && !__SUBSCRIPTION_INFO describe PHP_ORIG_SCRIPT Sent by bot & other signs #score PHP_ORIG_SCRIPT 2.500 # limit tflags PHP_ORIG_SCRIPT publish ##} PHP_ORIG_SCRIPT ##{ PHP_SCRIPT_MUA meta PHP_SCRIPT_MUA __HAS_PHP_SCRIPT && __PHP_NOVER_MUA describe PHP_SCRIPT_MUA Sent by PHP script, no version number #score PHP_SCRIPT_MUA 2.000 # limit tflags PHP_SCRIPT_MUA publish ##} PHP_SCRIPT_MUA ##{ PP_MIME_FAKE_ASCII_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEEval if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_for_ascii_text_illegal) ifplugin Mail::SpamAssassin::Plugin::MIMEEval if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_for_ascii_text_illegal) body PP_MIME_FAKE_ASCII_TEXT eval:check_for_ascii_text_illegal() describe PP_MIME_FAKE_ASCII_TEXT MIME text/plain claims to be ASCII but isn't # score PP_MIME_FAKE_ASCII_TEXT 1.0 tflags PP_MIME_FAKE_ASCII_TEXT publish endif endif ##} PP_MIME_FAKE_ASCII_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEEval if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_for_ascii_text_illegal) ##{ PP_TOO_MUCH_UNICODE02 ifplugin Mail::SpamAssassin::Plugin::MIMEEval if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_abundant_unicode_ratio) ifplugin Mail::SpamAssassin::Plugin::MIMEEval if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_abundant_unicode_ratio) body PP_TOO_MUCH_UNICODE02 eval:check_abundant_unicode_ratio(0.02) describe PP_TOO_MUCH_UNICODE02 Is text/plain but has many unicode escapes # score PP_TOO_MUCH_UNICODE02 0.5 tflags PP_TOO_MUCH_UNICODE02 publish endif endif ##} PP_TOO_MUCH_UNICODE02 ifplugin Mail::SpamAssassin::Plugin::MIMEEval if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_abundant_unicode_ratio) ##{ PP_TOO_MUCH_UNICODE05 ifplugin Mail::SpamAssassin::Plugin::MIMEEval if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_abundant_unicode_ratio) ifplugin Mail::SpamAssassin::Plugin::MIMEEval if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_abundant_unicode_ratio) body PP_TOO_MUCH_UNICODE05 eval:check_abundant_unicode_ratio(0.05) describe PP_TOO_MUCH_UNICODE05 Is text/plain but has many unicode escapes # score PP_TOO_MUCH_UNICODE05 1.0 tflags PP_TOO_MUCH_UNICODE05 publish endif endif ##} PP_TOO_MUCH_UNICODE05 ifplugin Mail::SpamAssassin::Plugin::MIMEEval if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_abundant_unicode_ratio) ##{ PUMPDUMP meta PUMPDUMP (__PUMPDUMP_01 || __PUMPDUMP_02 || __PUMPDUMP_03 || __PUMPDUMP_04 || __PUMPDUMP_05 || __PUMPDUMP_06 || __PUMPDUMP_07 || __PUMPDUMP_08 || __PUMPDUMP_09 || __PUMPDUMP_10) && !PUMPDUMP_MULTI describe PUMPDUMP Pump-and-dump stock scam phrase #score PUMPDUMP 1.000 # limit tflags PUMPDUMP publish ##} PUMPDUMP ##{ PUMPDUMP_MULTI meta PUMPDUMP_MULTI (__PUMPDUMP_01+__PUMPDUMP_02+__PUMPDUMP_03+__PUMPDUMP_04+__PUMPDUMP_05+__PUMPDUMP_06+__PUMPDUMP_07+__PUMPDUMP_08+__PUMPDUMP_09+__PUMPDUMP_10) > 1 describe PUMPDUMP_MULTI Pump-and-dump stock scam phrases #score PUMPDUMP_MULTI 3.500 # limit tflags PUMPDUMP_MULTI publish ##} PUMPDUMP_MULTI ##{ PUMPDUMP_TIP meta PUMPDUMP_TIP __PD_CNT_1 && __STOCK_TIP describe PUMPDUMP_TIP Pump-and-dump stock tip tflags PUMPDUMP_TIP publish ##} PUMPDUMP_TIP ##{ RAND_HEADER_MANY meta RAND_HEADER_MANY __RAND_HEADER > 3 describe RAND_HEADER_MANY Many random gibberish message headers #score RAND_HEADER_MANY 3.000 # limit tflags RAND_HEADER_MANY publish ##} RAND_HEADER_MANY ##{ RATWARE_NO_RDNS meta RATWARE_NO_RDNS __RATWARE_BOUND_A && __RDNS_NONE && __MIME_HTML && __MISSING_REF describe RATWARE_NO_RDNS Suspicious MsgID and MIME boundary + no rDNS #score RATWARE_NO_RDNS 3.000 # limit ##} RATWARE_NO_RDNS ##{ RCVD_BAD_ID header RCVD_BAD_ID Received =~ /\bid\s+[a-zA-Z0-9_+\/\\,-]+(?:[!"\#\$\%&'()*<=>?\@\[\]^\`{|}~]|;\S)/ describe RCVD_BAD_ID Received header contains id field with bad characters ##} RCVD_BAD_ID ##{ RCVD_DBL_DQ header RCVD_DBL_DQ Received =~ /(?:\[\d+\.\d+\.\d+\.\d+\]){2}/ describe RCVD_DBL_DQ Malformatted message header tflags RCVD_DBL_DQ publish ##} RCVD_DBL_DQ ##{ RCVD_FORGED_WROTE header RCVD_FORGED_WROTE Received =~ / by \S+ with esmtp \([^a-z ]{6,} [^a-z ]{3,}\) id/ describe RCVD_FORGED_WROTE Forged 'Received' header found ('wrote:' spam) ##} RCVD_FORGED_WROTE ##{ RCVD_FORGED_WROTE2 header RCVD_FORGED_WROTE2 Received =~ /from [0-9.]+ \(HELO \S+[A-Za-z]+\) by (\S+) with esmtp \(\S+\s\S+\) id \S{6}-\S{6}-\S\S for \S+@\1;/s ##} RCVD_FORGED_WROTE2 ##{ RCVD_IN_IADB_DK ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_DK eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.3') describe RCVD_IN_IADB_DK IADB: Sender publishes Domain Keys record tflags RCVD_IN_IADB_DK net nice endif ##} RCVD_IN_IADB_DK ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_DOPTIN eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.10') describe RCVD_IN_IADB_DOPTIN IADB: All mailing list mail is confirmed opt-in tflags RCVD_IN_IADB_DOPTIN net nice endif ##} RCVD_IN_IADB_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_DOPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_DOPTIN_GT50 eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.9') describe RCVD_IN_IADB_DOPTIN_GT50 IADB: Confirmed opt-in used more than 50% of the time tflags RCVD_IN_IADB_DOPTIN_GT50 net nice endif ##} RCVD_IN_IADB_DOPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_DOPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_DOPTIN_LT50 eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.8') describe RCVD_IN_IADB_DOPTIN_LT50 IADB: Confirmed opt-in used less than 50% of the time tflags RCVD_IN_IADB_DOPTIN_LT50 net nice endif ##} RCVD_IN_IADB_DOPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_EDDB ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_EDDB eval:check_rbl_sub('iadb-firsttrusted', '127.0.2.1') describe RCVD_IN_IADB_EDDB IADB: Participates in Email Deliverability Database tflags RCVD_IN_IADB_EDDB net nice endif ##} RCVD_IN_IADB_EDDB ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_EPIA ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_EPIA eval:check_rbl_sub('iadb-firsttrusted', '127.0.2.2') describe RCVD_IN_IADB_EPIA IADB: Member of Email Processing Industry Alliance tflags RCVD_IN_IADB_EPIA net nice endif ##} RCVD_IN_IADB_EPIA ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_GOODMAIL ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_GOODMAIL eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.103') describe RCVD_IN_IADB_GOODMAIL IADB: Sender has been certified by GoodMail tflags RCVD_IN_IADB_GOODMAIL net nice endif ##} RCVD_IN_IADB_GOODMAIL ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_LISTED ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_LISTED eval:check_rbl_sub('iadb-firsttrusted', '^127\.0\.0\.[12]$') describe RCVD_IN_IADB_LISTED Participates in the IADB system tflags RCVD_IN_IADB_LISTED net nice endif ##} RCVD_IN_IADB_LISTED ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_LOOSE ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_LOOSE eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.4') describe RCVD_IN_IADB_LOOSE IADB: Adds relationship addrs w/out opt-in tflags RCVD_IN_IADB_LOOSE net nice endif ##} RCVD_IN_IADB_LOOSE ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_MI_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_MI_CPEAR eval:check_rbl_sub('iadb-firsttrusted', '127.101.1.10') describe RCVD_IN_IADB_MI_CPEAR IADB: Complies with Michigan's CPEAR law tflags RCVD_IN_IADB_MI_CPEAR net nice endif ##} RCVD_IN_IADB_MI_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_MI_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_MI_CPR_30 eval:check_rbl_sub('iadb-firsttrusted', '127.101.101.10') describe RCVD_IN_IADB_MI_CPR_30 IADB: Checked lists against Michigan's CPR within 30 days tflags RCVD_IN_IADB_MI_CPR_30 net nice endif ##} RCVD_IN_IADB_MI_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_MI_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_MI_CPR_MAT eval:check_rbl_sub('iadb-firsttrusted', '127.101.201.10') describe RCVD_IN_IADB_MI_CPR_MAT IADB: Sends no material under Michigan's CPR tflags RCVD_IN_IADB_MI_CPR_MAT net nice endif ##} RCVD_IN_IADB_MI_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_ML_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_ML_DOPTIN eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.100') describe RCVD_IN_IADB_ML_DOPTIN IADB: Mailing list email only, confirmed opt-in tflags RCVD_IN_IADB_ML_DOPTIN net nice endif ##} RCVD_IN_IADB_ML_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_NOCONTROL ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_NOCONTROL eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.0') describe RCVD_IN_IADB_NOCONTROL IADB: Has absolutely no mailing controls in place tflags RCVD_IN_IADB_NOCONTROL net nice endif ##} RCVD_IN_IADB_NOCONTROL ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_OOO ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_OOO eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.200') describe RCVD_IN_IADB_OOO IADB: One-to-one/transactional email only tflags RCVD_IN_IADB_OOO net nice endif ##} RCVD_IN_IADB_OOO ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_OPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_OPTIN eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.7') describe RCVD_IN_IADB_OPTIN IADB: All mailing list mail is opt-in tflags RCVD_IN_IADB_OPTIN net nice endif ##} RCVD_IN_IADB_OPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_OPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_OPTIN_GT50 eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.6') describe RCVD_IN_IADB_OPTIN_GT50 IADB: Opt-in used more than 50% of the time tflags RCVD_IN_IADB_OPTIN_GT50 net nice endif ##} RCVD_IN_IADB_OPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_OPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_OPTIN_LT50 eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.5') describe RCVD_IN_IADB_OPTIN_LT50 IADB: Opt-in used less than 50% of the time tflags RCVD_IN_IADB_OPTIN_LT50 net nice endif ##} RCVD_IN_IADB_OPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_OPTOUTONLY ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_OPTOUTONLY eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.1') describe RCVD_IN_IADB_OPTOUTONLY IADB: Scrapes addresses, pure opt-out only tflags RCVD_IN_IADB_OPTOUTONLY net nice endif ##} RCVD_IN_IADB_OPTOUTONLY ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_RDNS ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_RDNS eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.4') describe RCVD_IN_IADB_RDNS IADB: Sender has reverse DNS record tflags RCVD_IN_IADB_RDNS net nice endif ##} RCVD_IN_IADB_RDNS ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_SENDERID ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_SENDERID eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.2') describe RCVD_IN_IADB_SENDERID IADB: Sender publishes Sender ID record tflags RCVD_IN_IADB_SENDERID net nice endif ##} RCVD_IN_IADB_SENDERID ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_SPF ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_SPF eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.1') describe RCVD_IN_IADB_SPF IADB: Sender publishes SPF record tflags RCVD_IN_IADB_SPF net nice endif ##} RCVD_IN_IADB_SPF ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_UNVERIFIED_1 ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_UNVERIFIED_1 eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.2') describe RCVD_IN_IADB_UNVERIFIED_1 IADB: Accepts unverified sign-ups tflags RCVD_IN_IADB_UNVERIFIED_1 net nice endif ##} RCVD_IN_IADB_UNVERIFIED_1 ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_UNVERIFIED_2 ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_UNVERIFIED_2 eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.3') describe RCVD_IN_IADB_UNVERIFIED_2 IADB: Accepts unverified sign-ups, gives chance to opt out tflags RCVD_IN_IADB_UNVERIFIED_2 net nice endif ##} RCVD_IN_IADB_UNVERIFIED_2 ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_UT_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_UT_CPEAR eval:check_rbl_sub('iadb-firsttrusted', '127.101.2.10') describe RCVD_IN_IADB_UT_CPEAR IADB: Complies with Utah's CPEAR law tflags RCVD_IN_IADB_UT_CPEAR net nice endif ##} RCVD_IN_IADB_UT_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_UT_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_UT_CPR_30 eval:check_rbl_sub('iadb-firsttrusted', '127.101.102.10') describe RCVD_IN_IADB_UT_CPR_30 IADB: Checked lists against Utah's CPR within 30 days tflags RCVD_IN_IADB_UT_CPR_30 net nice endif ##} RCVD_IN_IADB_UT_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_IADB_UT_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval ifplugin Mail::SpamAssassin::Plugin::DNSEval header RCVD_IN_IADB_UT_CPR_MAT eval:check_rbl_sub('iadb-firsttrusted', '127.101.202.10') describe RCVD_IN_IADB_UT_CPR_MAT IADB: Sends no material under Utah's CPR tflags RCVD_IN_IADB_UT_CPR_MAT net nice endif ##} RCVD_IN_IADB_UT_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval ##{ RCVD_IN_PSBL ifplugin Mail::SpamAssassin::Plugin::DNSEval # { ifplugin Mail::SpamAssassin::Plugin::DNSEval # { header RCVD_IN_PSBL eval:check_rbl('psbl-lastexternal', 'psbl.surriel.com.') describe RCVD_IN_PSBL Received via a relay in PSBL tflags RCVD_IN_PSBL net endif ##} RCVD_IN_PSBL ifplugin Mail::SpamAssassin::Plugin::DNSEval # { ##{ RCVD_MAIL_COM header RCVD_MAIL_COM Received =~ /[\s\(\[](?:post|mail)\.com[\s\)\]]/is describe RCVD_MAIL_COM Forged Received header (contains post.com or mail.com) ##} RCVD_MAIL_COM ##{ RDNS_LOCALHOST header RDNS_LOCALHOST X-Spam-Relays-External =~ /^\[ ip=(?!127)\d+\.\d+\.\d+\.\d+ rdns=localhost(?:\.localdomain)? /i describe RDNS_LOCALHOST Sender's public rDNS is "localhost" ##} RDNS_LOCALHOST ##{ RDNS_NUM_TLD_ATCHNX meta RDNS_NUM_TLD_ATCHNX __RDNS_NUMERIC_TLD && __ATTACH_NAME_NO_EXT describe RDNS_NUM_TLD_ATCHNX Relay rDNS has numeric TLD + suspicious attachment #score RDNS_NUM_TLD_ATCHNX 3.000 # limit tflags RDNS_NUM_TLD_ATCHNX publish ##} RDNS_NUM_TLD_ATCHNX ##{ RDNS_NUM_TLD_XM meta RDNS_NUM_TLD_XM __RDNS_NUMERIC_TLD && (__HAS_XM_SID || __HAS_XM_LID || __HAS_XM_RECPTID || __HAS_XM_SENTBY) describe RDNS_NUM_TLD_XM Relay rDNS has numeric TLD + suspicious headers #score RDNS_NUM_TLD_XM 3.000 # limit tflags RDNS_NUM_TLD_XM publish ##} RDNS_NUM_TLD_XM ##{ REPLYTO_WITHOUT_TO_CC meta REPLYTO_WITHOUT_TO_CC (__REPLYTO_EXISTS && !__TOCC_EXISTS) ##} REPLYTO_WITHOUT_TO_CC ##{ RP_8BIT header RP_8BIT Return-Path:raw =~ /[^\000-\177]/ describe RP_8BIT Return-Path contains 8-bit characters with high bit on ##} RP_8BIT ##{ SB_GIF_AND_NO_URIS meta SB_GIF_AND_NO_URIS (__GIF_ATTACH&&!__HAS_ANY_URI&&!__HAS_ANY_EMAIL) ##} SB_GIF_AND_NO_URIS ##{ SERGIO_SUBJECT_PORN014 header SERGIO_SUBJECT_PORN014 Subject =~ /f[^a-zA-Z0-9]{0,3}[uv][^a-zA-Z0-9]{0,3}c[^a-zA-Z0-9]{0,3}k/i describe SERGIO_SUBJECT_PORN014 F\*\*\* garbled subject ##} SERGIO_SUBJECT_PORN014 ##{ SERGIO_SUBJECT_VIAGRA01 header SERGIO_SUBJECT_VIAGRA01 Subject =~ /v[^a-zA-Z0-9]{0,3}[i1l][^a-zA-Z0-9]{0,3}a[^a-zA-Z0-9 ]{0,3}g[^a-zA-Z0-9]{0,3}r[^a-zA-Z0-9]{0,3}a/i describe SERGIO_SUBJECT_VIAGRA01 Viagra garbled subject ##} SERGIO_SUBJECT_VIAGRA01 ##{ SHORTENED_URL_SRC rawbody SHORTENED_URL_SRC /<[^>]{1,99}\ssrc=\W?https?:\/\/(?:bit\.ly|buff\.ly|tinyurl\.com|ow\.ly|owl\.li|is\.gd|tumblr\.com|formspring\.me|ff\.im|youtu\.be|tl\.gd|plurk\.com|migre\.me|j\.mp|cli\.gs|goo\.gl|yfrog\.com|lnk\.ms|su\.pr|fb\.me|alturl\.com|wp\.me|ping\.fm|chatter\.com|post\.ly|twurl\.nl|tiny\.cc|4sq\.com|ustre\.am|short\.to|u\.nu|flic\.kr|budurl\.com|digg\.com|twitvid\.com|gowal\.la|om\.ly|justin\.tv|icio\.us|p\.gs|loopt\.us|tcrn\.ch|xrl\.us|wpo\.st|bkite\.com|t\.cn|t\.co|x\.co|hop\.kz|urla\.ru|fw\.to|back\.ly|ecs\.page\.link)\/[^\/]{3}/ ##} SHORTENED_URL_SRC ##{ SHORTENER_SHORT_IMG meta SHORTENER_SHORT_IMG __URL_SHORTENER && HTML_SHORT_LINK_IMG_1 describe SHORTENER_SHORT_IMG Short HTML + image + URL shortener #score SHORTENER_SHORT_IMG 2.500 # limit ##} SHORTENER_SHORT_IMG ##{ SHORT_HELO_AND_INLINE_IMAGE meta SHORT_HELO_AND_INLINE_IMAGE (__HELO_NO_DOMAIN && __ANY_IMAGE_ATTACH) describe SHORT_HELO_AND_INLINE_IMAGE Short HELO string, with inline image ##} SHORT_HELO_AND_INLINE_IMAGE ##{ SHORT_TERM_PRICE body SHORT_TERM_PRICE /short\W+term\W+(target|projected)(\W+price)?/i ##} SHORT_TERM_PRICE ##{ SINGLETS_LOW_CONTRAST meta SINGLETS_LOW_CONTRAST __HTML_SINGLET_MANY && __HTML_FONT_LOW_CONTRAST_MINFP describe SINGLETS_LOW_CONTRAST Single-letter formatted HTML + hidden text tflags SINGLETS_LOW_CONTRAST publish ##} SINGLETS_LOW_CONTRAST ##{ SPAMMY_XMAILER meta SPAMMY_XMAILER (__XM_OL_28001441||__XM_OL_48072300||__XM_OL_28004682||__XM_OL_10_0_4115||__XM_OL_4_72_2106_4) describe SPAMMY_XMAILER X-Mailer string is common in spam and not in ham ##} SPAMMY_XMAILER ##{ SPOOFED_FREEM_REPTO meta SPOOFED_FREEM_REPTO __SPOOFED_FREEM_REPTO && !__THREADED describe SPOOFED_FREEM_REPTO Forged freemail sender with freemail reply-to #score SPOOFED_FREEM_REPTO 2.500 tflags SPOOFED_FREEM_REPTO publish ##} SPOOFED_FREEM_REPTO ##{ SPOOFED_FREEM_REPTO_CHN meta SPOOFED_FREEM_REPTO_CHN (__SPOOFED_FREEM_REPTO || FORGED_YAHOO_RCVD) && __REPTO_CHN_FREEM describe SPOOFED_FREEM_REPTO_CHN Forged freemail sender with Chinese freemail reply-to #score SPOOFED_FREEM_REPTO_CHN 3.500 tflags SPOOFED_FREEM_REPTO_CHN publish ##} SPOOFED_FREEM_REPTO_CHN ##{ SPOOFED_FREEM_REPTO_RUS meta SPOOFED_FREEM_REPTO_RUS (__SPOOFED_FREEM_REPTO || FORGED_YAHOO_RCVD) && __REPTO_RUS_FREEM describe SPOOFED_FREEM_REPTO_RUS Forged freemail sender with Russian freemail reply-to #score SPOOFED_FREEM_REPTO_RUS 3.500 tflags SPOOFED_FREEM_REPTO_RUS publish ##} SPOOFED_FREEM_REPTO_RUS ##{ STATIC_XPRIO_OLE meta STATIC_XPRIO_OLE __STATIC_XPRIO_OLE describe STATIC_XPRIO_OLE Static RDNS + X-Priority + MIMEOLE #score STATIC_XPRIO_OLE 2.000 # limit tflags STATIC_XPRIO_OLE publish ##} STATIC_XPRIO_OLE ##{ STOCK_IMG_CTYPE meta STOCK_IMG_CTYPE (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__CTYPE_ONETAB_GIF&&__HTML_IMG_ONLY) describe STOCK_IMG_CTYPE Stock spam image part, with distinctive Content-Type header ##} STOCK_IMG_CTYPE ##{ STOCK_IMG_HDR_FROM meta STOCK_IMG_HDR_FROM (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__TVD_FW_GRAPHIC_ID1&&__HTML_IMG_ONLY) describe STOCK_IMG_HDR_FROM Stock spam image part, with distinctive From line ##} STOCK_IMG_HDR_FROM ##{ STOCK_IMG_HTML meta STOCK_IMG_HTML (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__PART_STOCK_CID&&__HTML_IMG_ONLY) describe STOCK_IMG_HTML Stock spam image part, with distinctive HTML ##} STOCK_IMG_HTML ##{ STOCK_IMG_OUTLOOK meta STOCK_IMG_OUTLOOK (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__XM_MS_IN_GENERAL&&__HTML_LENGTH_1536_2048) describe STOCK_IMG_OUTLOOK Stock spam image part, with Outlook-like features ##} STOCK_IMG_OUTLOOK ##{ STOCK_LOW_CONTRAST meta STOCK_LOW_CONTRAST (__HTML_FONT_LOW_CONTRAST_MINFP && __FB_S_STOCK) && !__BUGGED_IMG describe STOCK_LOW_CONTRAST Stocks + hidden text #score STOCK_LOW_CONTRAST 2.500 # limit tflags STOCK_LOW_CONTRAST publish ##} STOCK_LOW_CONTRAST ##{ STOCK_PRICES meta STOCK_PRICES (SHORT_TERM_PRICE && LONG_TERM_PRICE) ##} STOCK_PRICES ##{ STOCK_TIP meta STOCK_TIP __STOCK_TIP && !__DKIM_EXISTS describe STOCK_TIP Stock tips #score STOCK_TIP 3.000 # limit tflags STOCK_TIP publish ##} STOCK_TIP ##{ STOX_AND_PRICE meta STOX_AND_PRICE CURR_PRICE && STOX_REPLY_TYPE ##} STOX_AND_PRICE ##{ STOX_REPLY_TYPE header STOX_REPLY_TYPE Content-Type =~ /text\/plain; .* reply-type=original/ ##} STOX_REPLY_TYPE ##{ STOX_REPLY_TYPE_WITHOUT_QUOTES meta STOX_REPLY_TYPE_WITHOUT_QUOTES (STOX_REPLY_TYPE && !(__HS_SUBJ_RE_FW || __HS_QUOTE)) ##} STOX_REPLY_TYPE_WITHOUT_QUOTES ##{ STYLE_GIBBERISH meta STYLE_GIBBERISH __STYLE_GIBBERISH && (__BODY_XHTML || !__STYLE_TAG_IN_BODY) && !__RCD_RDNS_MX_MESSY && !__HAS_THREAD_INDEX && !__ANY_OUTLOOK_MUA && !__MIME_QP && !ALL_TRUSTED describe STYLE_GIBBERISH Nonsense in HTML