sa-updates/72_active.cf

   1 # SpamAssassin rules file
   2 #
   3 # Please don't modify this file as your changes will be overwritten with
   4 # the next update. Use /etc/mail/spamassassin/local.cf instead.
   5 # See 'perldoc Mail::SpamAssassin::Conf' for details.
   6 #
   7 # <@LICENSE>
   8 # Licensed to the Apache Software Foundation (ASF) under one or more
   9 # contributor license agreements.  See the NOTICE file distributed with
  10 # this work for additional information regarding copyright ownership.
  11 # The ASF licenses this file to you under the Apache License, Version 2.0
  12 # (the "License"); you may not use this file except in compliance with
  13 # the License.  You may obtain a copy of the License at:
  14 #
  15 #     http://www.apache.org/licenses/LICENSE-2.0
  16 #
  17 # Unless required by applicable law or agreed to in writing, software
  18 # distributed under the License is distributed on an "AS IS" BASIS,
  19 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  20 # See the License for the specific language governing permissions and
  21 # limitations under the License.
  22 # </@LICENSE>
  23 #
  24 ###########################################################################
  25
  26 require_version 4.000000
  27
  28 ##{ ACCT_PHISHING_MANY
  29
  30 meta        ACCT_PHISHING_MANY   (__ACCT_PHISH_MANY || __EMAIL_PHISH_MANY) && !GOOGLE_DOCS_PHISH_MANY && !GOOG_STO_HTML_PHISH_MANY
  31 describe    ACCT_PHISHING_MANY   Phishing for account information
  32 #score       ACCT_PHISHING_MANY   3.000  # limit
  33 ##} ACCT_PHISHING_MANY
  34
  35 ##{ AC_BR_BONANZA
  36
  37 rawbody AC_BR_BONANZA   /(?:<br>\s*){30}/i
  38 describe AC_BR_BONANZA  Too many newlines in a row... spammy template
  39 #score AC_BR_BONANZA     0.001
  40 tflags AC_BR_BONANZA    publish
  41 ##} AC_BR_BONANZA
  42
  43 ##{ AC_DIV_BONANZA
  44
  45 rawbody AC_DIV_BONANZA  /(?:<div>(?:\s*<\/div>)?\s*){10}/i
  46 describe AC_DIV_BONANZA Too many divs in a row... spammy template
  47 #score AC_DIV_BONANZA    0.001
  48 tflags AC_DIV_BONANZA   publish
  49 ##} AC_DIV_BONANZA
  50
  51 ##{ AC_FROM_MANY_DOTS
  52
  53 meta       AC_FROM_MANY_DOTS           __AC_FROM_MANY_DOTS_MINFP
  54 #score      AC_FROM_MANY_DOTS           3.000   # limit
  55 describe   AC_FROM_MANY_DOTS           Multiple periods in From user name
  56 tflags     AC_FROM_MANY_DOTS           publish
  57 ##} AC_FROM_MANY_DOTS
  58
  59 ##{ AC_HTML_NONSENSE_TAGS
  60
  61 rawbody         AC_HTML_NONSENSE_TAGS   /(?:<[A-Za-z0-9]{4,}>\s*){10}/
  62 describe        AC_HTML_NONSENSE_TAGS   Many consecutive multi-letter HTML tags, likely nonsense/spam
  63 #score          AC_HTML_NONSENSE_TAGS   2.0
  64 tflags          AC_HTML_NONSENSE_TAGS   publish
  65 ##} AC_HTML_NONSENSE_TAGS
  66
  67 ##{ AC_POST_EXTRAS
  68
  69 meta       AC_POST_EXTRAS              __AC_POST_EXTRAS && !__URI_MAILTO && !__HAS_LIST_ID
  70 describe   AC_POST_EXTRAS              Suspicious URL
  71 #score      AC_POST_EXTRAS              2.500   # limit
  72 tflags     AC_POST_EXTRAS              publish
  73 ##} AC_POST_EXTRAS
  74
  75 ##{ AC_SPAMMY_URI_PATTERNS1
  76
  77 meta            AC_SPAMMY_URI_PATTERNS1 (__AC_OUTL_URI && __AC_OUTI_URI)
  78 describe        AC_SPAMMY_URI_PATTERNS1 link combos match highly spammy template
  79 #score          AC_SPAMMY_URI_PATTERNS1 4.0
  80 tflags          AC_SPAMMY_URI_PATTERNS1 publish
  81 ##} AC_SPAMMY_URI_PATTERNS1
  82
  83 ##{ AC_SPAMMY_URI_PATTERNS10
  84
  85 meta            AC_SPAMMY_URI_PATTERNS10 __AC_PUNCTNUMS_URI
  86 describe        AC_SPAMMY_URI_PATTERNS10 link combos match highly spammy template
  87 #score          AC_SPAMMY_URI_PATTERNS10 4.0
  88 tflags          AC_SPAMMY_URI_PATTERNS10 publish
  89 ##} AC_SPAMMY_URI_PATTERNS10
  90
  91 ##{ AC_SPAMMY_URI_PATTERNS11
  92
  93 meta            AC_SPAMMY_URI_PATTERNS11 __AC_NDOMLONGNASPX_URI
  94 describe        AC_SPAMMY_URI_PATTERNS11 link combos match highly spammy template
  95 #score          AC_SPAMMY_URI_PATTERNS11 4.0
  96 tflags          AC_SPAMMY_URI_PATTERNS11 publish
  97 ##} AC_SPAMMY_URI_PATTERNS11
  98
  99 ##{ AC_SPAMMY_URI_PATTERNS12
 100
 101 meta            AC_SPAMMY_URI_PATTERNS12 (__AC_CHDSEQ_URI && __AC_MHDSEQ_URI && __AC_UHDSEQ_URI)
 102 describe        AC_SPAMMY_URI_PATTERNS12 link combos match highly spammy template
 103 #score          AC_SPAMMY_URI_PATTERNS12 4.0
 104 tflags          AC_SPAMMY_URI_PATTERNS12 publish
 105 ##} AC_SPAMMY_URI_PATTERNS12
 106
 107 ##{ AC_SPAMMY_URI_PATTERNS2
 108
 109 meta            AC_SPAMMY_URI_PATTERNS2 (__AC_LAND_URI && __AC_UNSUB_URI && __AC_REPORT_URI)
 110 describe        AC_SPAMMY_URI_PATTERNS2 link combos match highly spammy template
 111 #score          AC_SPAMMY_URI_PATTERNS2 4.0
 112 tflags          AC_SPAMMY_URI_PATTERNS2 publish
 113 ##} AC_SPAMMY_URI_PATTERNS2
 114
 115 ##{ AC_SPAMMY_URI_PATTERNS3
 116
 117 meta            AC_SPAMMY_URI_PATTERNS3 (__AC_PHPOFFTOP_URI && __AC_PHPOFFSUB_URI)
 118 describe        AC_SPAMMY_URI_PATTERNS3 link combos match highly spammy template
 119 #score          AC_SPAMMY_URI_PATTERNS3 4.0
 120 tflags          AC_SPAMMY_URI_PATTERNS3 publish
 121 ##} AC_SPAMMY_URI_PATTERNS3
 122
 123 ##{ AC_SPAMMY_URI_PATTERNS4
 124
 125 meta            AC_SPAMMY_URI_PATTERNS4 __AC_NUMS_URI
 126 describe        AC_SPAMMY_URI_PATTERNS4 link combos match highly spammy template
 127 #score          AC_SPAMMY_URI_PATTERNS4 4.0
 128 tflags          AC_SPAMMY_URI_PATTERNS4 publish
 129 ##} AC_SPAMMY_URI_PATTERNS4
 130
 131 ##{ AC_SPAMMY_URI_PATTERNS8
 132
 133 meta            AC_SPAMMY_URI_PATTERNS8 __AC_LONGSEQ_URI
 134 describe        AC_SPAMMY_URI_PATTERNS8 link combos match highly spammy template
 135 #score          AC_SPAMMY_URI_PATTERNS8 4.0
 136 tflags          AC_SPAMMY_URI_PATTERNS8 publish
 137 ##} AC_SPAMMY_URI_PATTERNS8
 138
 139 ##{ AC_SPAMMY_URI_PATTERNS9
 140
 141 meta            AC_SPAMMY_URI_PATTERNS9 (__AC_1SEQC_URI && (__AC_1SEQV_URI || __AC_RMOVE_URI))
 142 describe        AC_SPAMMY_URI_PATTERNS9 link combos match highly spammy template
 143 #score          AC_SPAMMY_URI_PATTERNS9 4.0
 144 tflags          AC_SPAMMY_URI_PATTERNS9 publish
 145 ##} AC_SPAMMY_URI_PATTERNS9
 146
 147 ##{ ADMAIL
 148
 149 meta        ADMAIL            __ADMAIL && !__DKIM_EXISTS && !__COMMENT_EXISTS
 150 describe    ADMAIL            "admail" and variants
 151 tflags      ADMAIL            publish
 152 ##} ADMAIL
 153
 154 ##{ ADMITS_SPAM
 155
 156 meta        ADMITS_SPAM       __ADMITS_SPAM && !__FROM_LOWER && !__MSGID_JAVAMAIL && !__HAS_CAMPAIGNID && !__STY_INVIS_2 && !__LYRIS_EZLM_REMAILER && !__RCD_RDNS_OB
 157 describe    ADMITS_SPAM       Admits this is an ad
 158 tflags      ADMITS_SPAM       publish
 159 ##} ADMITS_SPAM
 160
 161 ##{ ADULT_DATING_COMPANY
 162
 163 meta       ADULT_DATING_COMPANY        __ADULTDATINGCOMPANY_BODY || __ADULTDATINGCOMPANY_FROM || __ADULTDATINGCOMPANY_REPTO
 164 #score      ADULT_DATING_COMPANY        10.000  # limit
 165 tflags     ADULT_DATING_COMPANY        publish
 166 ##} ADULT_DATING_COMPANY
 167
 168 ##{ ADVANCE_FEE_2_NEW_FORM
 169
 170 meta      ADVANCE_FEE_2_NEW_FORM    (__ADVANCE_FEE_2_NEW_FORM && !__ADVANCE_FEE_3_NEW_FORM && !__ADVANCE_FEE_4_NEW_FORM && !__ADVANCE_FEE_5_NEW_FORM) && !__FROM_LOWER && !__HAS_X_LOOP
 171 describe  ADVANCE_FEE_2_NEW_FORM    Advance Fee fraud and a form
 172 #score     ADVANCE_FEE_2_NEW_FORM    2.000  # limit
 173 tflags    ADVANCE_FEE_2_NEW_FORM     publish
 174 ##} ADVANCE_FEE_2_NEW_FORM
 175
 176 ##{ ADVANCE_FEE_2_NEW_FRM_MNY
 177
 178 meta      ADVANCE_FEE_2_NEW_FRM_MNY    (__ADVANCE_FEE_2_NEW_FRM_MNY && !__ADVANCE_FEE_3_NEW_FRM_MNY && !__ADVANCE_FEE_4_NEW_FRM_MNY && !__ADVANCE_FEE_5_NEW_FRM_MNY) && !__HAS_X_LOOP
 179 describe  ADVANCE_FEE_2_NEW_FRM_MNY    Advance Fee fraud form and lots of money
 180 #score     ADVANCE_FEE_2_NEW_FRM_MNY    2.500
 181 tflags    ADVANCE_FEE_2_NEW_FRM_MNY  publish
 182 ##} ADVANCE_FEE_2_NEW_FRM_MNY
 183
 184 ##{ ADVANCE_FEE_2_NEW_MONEY
 185
 186 meta      ADVANCE_FEE_2_NEW_MONEY    (__ADVANCE_FEE_2_NEW_MONEY && !__ADVANCE_FEE_3_NEW_MONEY && !__ADVANCE_FEE_4_NEW_MONEY && !__ADVANCE_FEE_5_NEW_MONEY) && !__BOTH_INR_AND_REF && !__LYRIS_EZLM_REMAILER && !__COMMENT_EXISTS && !__VIA_ML && !__THREADED && !__HAS_SENDER && !__HAS_X_LOOP && !__BUGGED_IMG
 187 describe  ADVANCE_FEE_2_NEW_MONEY    Advance Fee fraud and lots of money
 188 #score     ADVANCE_FEE_2_NEW_MONEY    2.000  # limit
 189 tflags    ADVANCE_FEE_2_NEW_MONEY    publish
 190 ##} ADVANCE_FEE_2_NEW_MONEY
 191
 192 ##{ ADVANCE_FEE_3_NEW
 193
 194 meta      ADVANCE_FEE_3_NEW    (__ADVANCE_FEE_3_NEW && !__FILL_THIS_FORM && !LOTS_OF_MONEY && !__ADVANCE_FEE_4_NEW && !__ADVANCE_FEE_5_NEW) && !__HTML_LINK_IMAGE && !__COMMENT_EXISTS && !__HAS_SENDER && !__HAS_X_LOOP && !__TO_YOUR_ORG && !__BUGGED_IMG
 195 describe  ADVANCE_FEE_3_NEW    Appears to be advance fee fraud (Nigerian 419)
 196 #score     ADVANCE_FEE_3_NEW    3.5             # limit
 197 tflags    ADVANCE_FEE_3_NEW          publish
 198 ##} ADVANCE_FEE_3_NEW
 199
 200 ##{ ADVANCE_FEE_3_NEW_FORM
 201
 202 meta      ADVANCE_FEE_3_NEW_FORM    (__ADVANCE_FEE_3_NEW_FORM && !__ADVANCE_FEE_4_NEW_FORM && !__ADVANCE_FEE_5_NEW_FORM) && !__THREADED && !__HAS_SENDER && !__FROM_LOWER && !__HAS_X_LOOP
 203 describe  ADVANCE_FEE_3_NEW_FORM    Advance Fee fraud and a form
 204 tflags    ADVANCE_FEE_3_NEW_FORM     publish
 205 ##} ADVANCE_FEE_3_NEW_FORM
 206
 207 ##{ ADVANCE_FEE_3_NEW_FRM_MNY
 208
 209 meta      ADVANCE_FEE_3_NEW_FRM_MNY    (__ADVANCE_FEE_3_NEW_FRM_MNY && !__ADVANCE_FEE_4_NEW_FRM_MNY && !__ADVANCE_FEE_5_NEW_FRM_MNY) && !__HAS_X_LOOP
 210 describe  ADVANCE_FEE_3_NEW_FRM_MNY    Advance Fee fraud form and lots of money
 211 tflags    ADVANCE_FEE_3_NEW_FRM_MNY  publish
 212 ##} ADVANCE_FEE_3_NEW_FRM_MNY
 213
 214 ##{ ADVANCE_FEE_3_NEW_MONEY
 215
 216 meta      ADVANCE_FEE_3_NEW_MONEY    (__ADVANCE_FEE_3_NEW_MONEY && !__ADVANCE_FEE_4_NEW_MONEY && !__ADVANCE_FEE_5_NEW_MONEY) && !__BOTH_INR_AND_REF && !__VIA_ML && !__THREADED && !__HAS_SENDER && !__HAS_X_LOOP && !__BUGGED_IMG
 217 describe  ADVANCE_FEE_3_NEW_MONEY    Advance Fee fraud and lots of money
 218 tflags    ADVANCE_FEE_3_NEW_MONEY    publish
 219 ##} ADVANCE_FEE_3_NEW_MONEY
 220
 221 ##{ ADVANCE_FEE_4_NEW
 222
 223 meta      ADVANCE_FEE_4_NEW    (__ADVANCE_FEE_4_NEW && !__FILL_THIS_FORM && !LOTS_OF_MONEY && !__ADVANCE_FEE_5_NEW) && !__HTML_LINK_IMAGE && !__COMMENT_EXISTS && !__TAG_EXISTS_CENTER && !__HAS_ERRORS_TO && !__HAS_X_LOOP && !__BUGGED_IMG
 224 describe  ADVANCE_FEE_4_NEW    Appears to be advance fee fraud (Nigerian 419)
 225 tflags    ADVANCE_FEE_4_NEW          publish
 226 ##} ADVANCE_FEE_4_NEW
 227
 228 ##{ ADVANCE_FEE_4_NEW_FORM
 229
 230 meta      ADVANCE_FEE_4_NEW_FORM    (__ADVANCE_FEE_4_NEW_FORM && !__ADVANCE_FEE_5_NEW_FORM)
 231 describe  ADVANCE_FEE_4_NEW_FORM    Advance Fee fraud and a form
 232 tflags    ADVANCE_FEE_4_NEW_FORM     publish
 233 ##} ADVANCE_FEE_4_NEW_FORM
 234
 235 ##{ ADVANCE_FEE_4_NEW_FRM_MNY
 236
 237 meta      ADVANCE_FEE_4_NEW_FRM_MNY    (__ADVANCE_FEE_4_NEW_FRM_MNY && !__ADVANCE_FEE_5_NEW_FRM_MNY)
 238 describe  ADVANCE_FEE_4_NEW_FRM_MNY    Advance Fee fraud form and lots of money
 239 tflags    ADVANCE_FEE_4_NEW_FRM_MNY  publish
 240 ##} ADVANCE_FEE_4_NEW_FRM_MNY
 241
 242 ##{ ADVANCE_FEE_4_NEW_MONEY
 243
 244 meta      ADVANCE_FEE_4_NEW_MONEY    (__ADVANCE_FEE_4_NEW_MONEY && !__ADVANCE_FEE_5_NEW_MONEY) && !__BOTH_INR_AND_REF && !__HAS_SENDER && !__HAS_X_LOOP && !__BUGGED_IMG
 245 describe  ADVANCE_FEE_4_NEW_MONEY    Advance Fee fraud and lots of money
 246 tflags    ADVANCE_FEE_4_NEW_MONEY    publish
 247 ##} ADVANCE_FEE_4_NEW_MONEY
 248
 249 ##{ ADVANCE_FEE_5_NEW
 250
 251 meta      ADVANCE_FEE_5_NEW    (__ADVANCE_FEE_5_NEW && !__FILL_THIS_FORM && !LOTS_OF_MONEY) && !__BUGGED_IMG
 252 describe  ADVANCE_FEE_5_NEW    Appears to be advance fee fraud (Nigerian 419)
 253 tflags    ADVANCE_FEE_5_NEW          publish
 254 ##} ADVANCE_FEE_5_NEW
 255
 256 ##{ ADVANCE_FEE_5_NEW_FORM
 257
 258 meta      ADVANCE_FEE_5_NEW_FORM    __ADVANCE_FEE_5_NEW_FORM
 259 describe  ADVANCE_FEE_5_NEW_FORM    Advance Fee fraud and a form
 260 tflags    ADVANCE_FEE_5_NEW_FORM     publish
 261 ##} ADVANCE_FEE_5_NEW_FORM
 262
 263 ##{ ADVANCE_FEE_5_NEW_FRM_MNY
 264
 265 meta      ADVANCE_FEE_5_NEW_FRM_MNY    __ADVANCE_FEE_5_NEW_FRM_MNY
 266 describe  ADVANCE_FEE_5_NEW_FRM_MNY    Advance Fee fraud form and lots of money
 267 tflags    ADVANCE_FEE_5_NEW_FRM_MNY  publish
 268 ##} ADVANCE_FEE_5_NEW_FRM_MNY
 269
 270 ##{ ADVANCE_FEE_5_NEW_MONEY
 271
 272 meta      ADVANCE_FEE_5_NEW_MONEY    __ADVANCE_FEE_5_NEW_MONEY && !__BOUNCE_CTYPE && !__BUGGED_IMG
 273 describe  ADVANCE_FEE_5_NEW_MONEY    Advance Fee fraud and lots of money
 274 tflags    ADVANCE_FEE_5_NEW_MONEY    publish
 275 ##} ADVANCE_FEE_5_NEW_MONEY
 276
 277 ##{ AD_PREFS
 278
 279 body        AD_PREFS          /(?:\b|_)(?:ad(?:vert[i1l]s[i1l]ng)?|promo(?:tion)?|marketing)[- _](?:pref(?:s|erences)|settings)(?:\b|_)/i
 280 describe    AD_PREFS          Advertising preferences
 281 #score       AD_PREFS          0.500    # limit
 282 tflags      AD_PREFS          publish
 283 ##} AD_PREFS
 284
 285 ##{ ALIBABA_IMG_NOT_RCVD_ALI
 286
 287 meta       ALIBABA_IMG_NOT_RCVD_ALI    __ALIBABA_IMG_NOT_RCVD_ALI && !__YOUR_PASSWORD && !__UNSUB_LINK && !__MSGID_BEFORE_RECEIVED && !__HAS_HREF_ONECASE
 288 #score      ALIBABA_IMG_NOT_RCVD_ALI    2.500   # limit
 289 describe   ALIBABA_IMG_NOT_RCVD_ALI    Alibaba hosted image but message not from Alibaba
 290 tflags     ALIBABA_IMG_NOT_RCVD_ALI    publish
 291 ##} ALIBABA_IMG_NOT_RCVD_ALI
 292
 293 ##{ AMAZON_IMG_NOT_RCVD_AMZN
 294
 295 meta       AMAZON_IMG_NOT_RCVD_AMZN    __AMAZON_IMG_NOT_RCVD_AMZN && !__HDR_RCVD_KEEPA && !__URI_DBL_DOM && !__RCD_RDNS_SMTP && !__RCD_RDNS_MTA && !__DATE_LOWER && !__MSGID_LIST && !__URI_PRODUCT_AMAZON && !__HAS_ERRORS_TO
 296 #score      AMAZON_IMG_NOT_RCVD_AMZN    2.500   # limit
 297 describe   AMAZON_IMG_NOT_RCVD_AMZN    Amazon hosted image but message not from Amazon
 298 tflags     AMAZON_IMG_NOT_RCVD_AMZN    publish
 299 ##} AMAZON_IMG_NOT_RCVD_AMZN
 300
 301 ##{ APOSTROPHE_FROM
 302
 303 header          APOSTROPHE_FROM From:addr =~ /'/
 304 describe        APOSTROPHE_FROM From address contains an apostrophe
 305 ##} APOSTROPHE_FROM
 306
 307 ##{ APP_DEVELOPMENT_FREEM if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
 308
 309 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
 310   meta       APP_DEVELOPMENT_FREEM       __APP_DEVELOPMENT_MANY && (__REPTO_CHN_FREEM || __freemail_hdr_replyto)
 311   describe   APP_DEVELOPMENT_FREEM       App development pitch, freemail or CHN replyto
 312 #  score      APP_DEVELOPMENT_FREEM       3.500 # limit
 313   tflags     APP_DEVELOPMENT_FREEM       publish
 314 endif
 315 ##} APP_DEVELOPMENT_FREEM if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
 316
 317 ##{ APP_DEVELOPMENT_NORDNS if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
 318
 319 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
 320   meta       APP_DEVELOPMENT_NORDNS      __APP_DEVELOPMENT && __RDNS_NONE
 321   describe   APP_DEVELOPMENT_NORDNS      App development pitch, no rDNS
 322 #  score      APP_DEVELOPMENT_NORDNS      2.000 # limit
 323   tflags     APP_DEVELOPMENT_NORDNS      publish
 324 endif
 325 ##} APP_DEVELOPMENT_NORDNS if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
 326
 327 ##{ AXB_XMAILER_MIMEOLE_OL_024C2
 328
 329 meta   AXB_XMAILER_MIMEOLE_OL_024C2  (__AXB_XM_OL_024C2 && __AXB_MO_OL_024C2)
 330 describe AXB_XMAILER_MIMEOLE_OL_024C2 Yet another X header trait
 331 ##} AXB_XMAILER_MIMEOLE_OL_024C2
 332
 333 ##{ AXB_X_FF_SEZ_S
 334
 335 header          AXB_X_FF_SEZ_S          X-Forefront-Antispam-Report =~ /\bSFV\:SPM\b/
 336 describe        AXB_X_FF_SEZ_S          Forefront sez this is spam
 337 ##} AXB_X_FF_SEZ_S
 338
 339 ##{ BANKING_LAWS
 340
 341 body            BANKING_LAWS    /banking laws/i
 342 describe        BANKING_LAWS    Talks about banking laws
 343 ##} BANKING_LAWS
 344
 345 ##{ BASE64_LENGTH_78_79 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
 346
 347 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
 348 body BASE64_LENGTH_78_79        eval:check_base64_length('78','79')
 349 endif
 350 ##} BASE64_LENGTH_78_79 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
 351
 352 ##{ BASE64_LENGTH_79_INF ifplugin Mail::SpamAssassin::Plugin::MIMEEval
 353
 354 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
 355 describe BASE64_LENGTH_79_INF   base64 encoded email part uses line length of 78 or 79 characters
 356 body BASE64_LENGTH_79_INF       eval:check_base64_length('79')
 357 describe BASE64_LENGTH_79_INF   base64 encoded email part uses line length greater than 79 characters
 358 endif
 359 ##} BASE64_LENGTH_79_INF ifplugin Mail::SpamAssassin::Plugin::MIMEEval
 360
 361 ##{ BEBEE_IMG_NOT_RCVD_BB
 362
 363 meta       BEBEE_IMG_NOT_RCVD_BB       __BEBEE_IMG_NOT_RCVD_BB
 364 #score      BEBEE_IMG_NOT_RCVD_BB       2.000  # limit
 365 describe   BEBEE_IMG_NOT_RCVD_BB       Bebee hosted image but message not from Bebee
 366 tflags     BEBEE_IMG_NOT_RCVD_BB       publish
 367 ##} BEBEE_IMG_NOT_RCVD_BB
 368
 369 ##{ BIGNUM_EMAILS_FREEM
 370
 371 meta           BIGNUM_EMAILS_FREEM        __BIGNUM_EMAILS_FREEM
 372 describe       BIGNUM_EMAILS_FREEM        Lots of email addresses/leads, free email account
 373 #score          BIGNUM_EMAILS_FREEM        3.00         # limit
 374 tflags         BIGNUM_EMAILS_FREEM        publish
 375 ##} BIGNUM_EMAILS_FREEM
 376
 377 ##{ BIGNUM_EMAILS_MANY
 378
 379 meta           BIGNUM_EMAILS_MANY         __BIGNUM_EMAILS_3 && !__HAS_ERRORS_TO && !__HAS_CAMPAIGNID && !__DATE_LOWER
 380 describe       BIGNUM_EMAILS_MANY         Lots of email addresses/leads, over and over
 381 #score          BIGNUM_EMAILS_MANY         3.00         # limit
 382 tflags         BIGNUM_EMAILS_MANY         publish
 383 ##} BIGNUM_EMAILS_MANY
 384
 385 ##{ BITCOIN_BOMB
 386
 387 meta           BITCOIN_BOMB           __BITCOIN_ID && __EXPLOSIVE_DEVICE && !BITCOIN_EXTORT_01
 388 describe       BITCOIN_BOMB           BitCoin + bomb
 389 #score          BITCOIN_BOMB           3.000    # limit
 390 tflags         BITCOIN_BOMB           publish
 391 ##} BITCOIN_BOMB
 392
 393 ##{ BITCOIN_DEADLINE
 394
 395 meta           BITCOIN_DEADLINE       __BITCOIN_ID && __HOURS_DEADLINE && !BITCOIN_EXTORT_01
 396 describe       BITCOIN_DEADLINE       BitCoin with a deadline
 397 #score          BITCOIN_DEADLINE       3.000    # limit
 398 tflags         BITCOIN_DEADLINE       publish
 399 ##} BITCOIN_DEADLINE
 400
 401 ##{ BITCOIN_EXTORT_01
 402
 403 meta           BITCOIN_EXTORT_01      (__BITCOIN_ID && __EXTORT_MANY) && !( __FROM_FULL_NAME && __SENDER_BOT && __SINGLE_WORD_LINE && __MIME_HTML && __PHPMAILER_MUA )
 404 describe       BITCOIN_EXTORT_01      Extortion spam, pay via BitCoin
 405 #score          BITCOIN_EXTORT_01      5.000    # limit
 406 tflags         BITCOIN_EXTORT_01      publish
 407 ##} BITCOIN_EXTORT_01
 408
 409 ##{ BITCOIN_EXTORT_02
 410
 411 meta           BITCOIN_EXTORT_02      __OBFU_BITCOIN_NOID && __EXTORT_MANY
 412 describe       BITCOIN_EXTORT_02      Extortion spam, pay via BitCoin
 413 #score          BITCOIN_EXTORT_02      5.000    # limit
 414 tflags         BITCOIN_EXTORT_02      publish
 415 ##} BITCOIN_EXTORT_02
 416
 417 ##{ BITCOIN_IMGUR
 418
 419 meta       BITCOIN_IMGUR               __BITCOIN_IMGUR
 420 describe   BITCOIN_IMGUR               Bitcoin + hosted image
 421 #score      BITCOIN_IMGUR               3.500   # limit
 422 tflags     BITCOIN_IMGUR               publish
 423 ##} BITCOIN_IMGUR
 424
 425 ##{ BITCOIN_MALF_HTML
 426
 427 meta           BITCOIN_MALF_HTML    HTML_EXTRA_CLOSE && (__BITCOIN || __BITCOIN_ID)
 428 describe       BITCOIN_MALF_HTML    Bitcoin + malformed HTML
 429 #score          BITCOIN_MALF_HTML    3.500      # limit
 430 ##} BITCOIN_MALF_HTML
 431
 432 ##{ BITCOIN_MALWARE
 433
 434 meta           BITCOIN_MALWARE        __BITCOIN_ID && __MY_MALWARE && !BITCOIN_EXTORT_01 && !__NOT_SPOOFED
 435 describe       BITCOIN_MALWARE        BitCoin + malware bragging
 436 #score          BITCOIN_MALWARE        3.500    # limit
 437 tflags         BITCOIN_MALWARE        publish
 438 ##} BITCOIN_MALWARE
 439
 440 ##{ BITCOIN_OBFU_SUBJ
 441
 442 meta           BITCOIN_OBFU_SUBJ    __BITCOIN_OBFU_SUBJ && !__128_ALNUM_URI
 443 describe       BITCOIN_OBFU_SUBJ    Bitcoin + obfuscated subject
 444 #score          BITCOIN_OBFU_SUBJ    3.500      # limit
 445 tflags         BITCOIN_OBFU_SUBJ    publish
 446 ##} BITCOIN_OBFU_SUBJ
 447
 448 ##{ BITCOIN_ONAN
 449
 450 meta           BITCOIN_ONAN           __BITCOIN_ID && __YOUR_ONAN && __KHOP_NO_FULL_NAME && !BITCOIN_EXTORT_01
 451 describe       BITCOIN_ONAN           BitCoin + [censored]
 452 #score          BITCOIN_ONAN           3.000    # limit
 453 tflags         BITCOIN_ONAN           publish
 454 ##} BITCOIN_ONAN
 455
 456 ##{ BITCOIN_PAY_ME
 457
 458 meta           BITCOIN_PAY_ME         __BITCOIN_ID && __PAY_ME && !BITCOIN_EXTORT_01
 459 describe       BITCOIN_PAY_ME         Pay me via BitCoin
 460 #score          BITCOIN_PAY_ME         3.000    # limit
 461 tflags         BITCOIN_PAY_ME         publish
 462 ##} BITCOIN_PAY_ME
 463
 464 ##{ BITCOIN_SPAM_01
 465
 466 meta           BITCOIN_SPAM_01  __BITCOIN_ID && HTML_MIME_NO_HTML_TAG
 467 describe       BITCOIN_SPAM_01  BitCoin spam pattern 01
 468 #score          BITCOIN_SPAM_01  2.500  # limit
 469 tflags         BITCOIN_SPAM_01  publish
 470 ##} BITCOIN_SPAM_01
 471
 472 ##{ BITCOIN_SPAM_02
 473
 474 meta           BITCOIN_SPAM_02    __BITCOIN_SPAM_02 && !__URL_BTC_ID
 475 describe       BITCOIN_SPAM_02    BitCoin spam pattern 02
 476 #score          BITCOIN_SPAM_02    2.500        # limit
 477 tflags         BITCOIN_SPAM_02    publish
 478 ##} BITCOIN_SPAM_02
 479
 480 ##{ BITCOIN_SPAM_03
 481
 482 meta           BITCOIN_SPAM_03  __BITCOIN_ID && __SINGLE_WORD_SUBJ
 483 describe       BITCOIN_SPAM_03  BitCoin spam pattern 03
 484 #score          BITCOIN_SPAM_03  2.500  # limit
 485 tflags         BITCOIN_SPAM_03  publish
 486 ##} BITCOIN_SPAM_03
 487
 488 ##{ BITCOIN_SPAM_04
 489
 490 meta           BITCOIN_SPAM_04  __BITCOIN_ID && __freemail_hdr_replyto
 491 describe       BITCOIN_SPAM_04  BitCoin spam pattern 04
 492 #score          BITCOIN_SPAM_04  1.500  # limit
 493 tflags         BITCOIN_SPAM_04  publish
 494 ##} BITCOIN_SPAM_04
 495
 496 ##{ BITCOIN_SPAM_05
 497
 498 meta           BITCOIN_SPAM_05    __BITCOIN_SPAM_05 && !__HAS_IN_REPLY_TO
 499 describe       BITCOIN_SPAM_05    BitCoin spam pattern 05
 500 #score          BITCOIN_SPAM_05    2.500        # limit
 501 tflags         BITCOIN_SPAM_05    net publish
 502 ##} BITCOIN_SPAM_05
 503
 504 ##{ BITCOIN_SPAM_06
 505
 506 meta           BITCOIN_SPAM_06  __BITCOIN_ID && TVD_RCVD_SPACE_BRACKET
 507 describe       BITCOIN_SPAM_06  BitCoin spam pattern 06
 508 #score          BITCOIN_SPAM_06  1.500  # limit
 509 tflags         BITCOIN_SPAM_06  publish
 510 ##} BITCOIN_SPAM_06
 511
 512 ##{ BITCOIN_SPAM_07
 513
 514 meta           BITCOIN_SPAM_07    __BITCOIN_SPAM_07 && !__DKIM_EXISTS
 515 describe       BITCOIN_SPAM_07    BitCoin spam pattern 07
 516 #score          BITCOIN_SPAM_07    3.500        # limit
 517 tflags         BITCOIN_SPAM_07    publish
 518 ##} BITCOIN_SPAM_07
 519
 520 ##{ BITCOIN_SPAM_08
 521
 522 meta           BITCOIN_SPAM_08  __BITCOIN_ID && __TO_IN_SUBJ
 523 describe       BITCOIN_SPAM_08  BitCoin spam pattern 08
 524 #score          BITCOIN_SPAM_08  2.500  # limit
 525 tflags         BITCOIN_SPAM_08  publish
 526 ##} BITCOIN_SPAM_08
 527
 528 ##{ BITCOIN_SPAM_09
 529
 530 meta           BITCOIN_SPAM_09  __BITCOIN_ID && ( __DESTROY_ME || __DESTROY_YOU )
 531 describe       BITCOIN_SPAM_09  BitCoin spam pattern 09
 532 #score          BITCOIN_SPAM_09  1.500  # limit
 533 tflags         BITCOIN_SPAM_09  publish
 534 ##} BITCOIN_SPAM_09
 535
 536 ##{ BITCOIN_SPAM_10
 537
 538 meta           BITCOIN_SPAM_10  __BITCOIN_ID && ( HTML_IMAGE_ONLY_04 || HTML_IMAGE_ONLY_08 )
 539 describe       BITCOIN_SPAM_10  BitCoin spam pattern 10
 540 #score          BITCOIN_SPAM_10  2.500  # limit
 541 tflags         BITCOIN_SPAM_10  publish
 542 ##} BITCOIN_SPAM_10
 543
 544 ##{ BITCOIN_SPAM_11
 545
 546 meta           BITCOIN_SPAM_11  __BITCOIN_ID && HTML_MESSAGE && __HTML_SHRT_CMNT_OBFU
 547 describe       BITCOIN_SPAM_11  BitCoin spam pattern 11
 548 #score          BITCOIN_SPAM_11  2.500  # limit
 549 tflags         BITCOIN_SPAM_11  publish
 550 ##} BITCOIN_SPAM_11
 551
 552 ##{ BITCOIN_SPAM_12
 553
 554 meta           BITCOIN_SPAM_12  __BITCOIN_ID && __BOGUS_MIME_HDR_MANY
 555 describe       BITCOIN_SPAM_12  BitCoin spam pattern 12
 556 #score          BITCOIN_SPAM_12  2.500  # limit
 557 tflags         BITCOIN_SPAM_12  publish
 558 ##} BITCOIN_SPAM_12
 559
 560 ##{ BITCOIN_SPF_ONLYALL if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS
 561
 562 if (version >= 3.004001)
 563 ifplugin Mail::SpamAssassin::Plugin::AskDNS
 564 meta     BITCOIN_SPF_ONLYALL __PDS_SPF_ONLYALL && __BITCOIN_ID
 565 tflags   BITCOIN_SPF_ONLYALL net publish
 566 describe BITCOIN_SPF_ONLYALL Bitcoin from a domain specifically set to pass +all SPF
 567 #score    BITCOIN_SPF_ONLYALL 2.0 # limit
 568 endif
 569 endif
 570 ##} BITCOIN_SPF_ONLYALL if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS
 571
 572 ##{ BITCOIN_WFH_01
 573
 574 meta       BITCOIN_WFH_01              __BITCOIN_WFH_01
 575 describe   BITCOIN_WFH_01              Work-from-Home + bitcoin
 576 tflags     BITCOIN_WFH_01              publish
 577 ##} BITCOIN_WFH_01
 578
 579 ##{ BITCOIN_XPRIO
 580
 581 meta           BITCOIN_XPRIO        __BITCOIN_XPRIO && !__ML1 && !__HAS_SENDER && !__DKIM_EXISTS && !__RCD_RDNS_MAIL_MESSY
 582 describe       BITCOIN_XPRIO        Bitcoin + priority
 583 #score          BITCOIN_XPRIO        2.500      # limit
 584 ##} BITCOIN_XPRIO
 585
 586 ##{ BITCOIN_YOUR_INFO
 587
 588 meta           BITCOIN_YOUR_INFO      __BITCOIN_ID && __YOUR_PERSONAL && !BITCOIN_EXTORT_01
 589 describe       BITCOIN_YOUR_INFO      BitCoin with your personal info
 590 #score          BITCOIN_YOUR_INFO      3.000    # limit
 591 tflags         BITCOIN_YOUR_INFO      publish
 592 ##} BITCOIN_YOUR_INFO
 593
 594 ##{ BODY_SINGLE_URI
 595
 596 meta        BODY_SINGLE_URI     __BODY_SINGLE_URI && !ALL_TRUSTED && !__HDRS_LCASE_KNOWN && !__FROM_ALL_NUMS && !__RCD_RDNS_SMTP && !__VIA_ML
 597 describe    BODY_SINGLE_URI     Message body is only a URI
 598 #score       BODY_SINGLE_URI     2.500  # limit
 599 ##} BODY_SINGLE_URI
 600
 601 ##{ BODY_URI_ONLY
 602
 603 meta        BODY_URI_ONLY        __BODY_URI_ONLY && !__NOT_SPOOFED && !__TO_EQ_FROM_DOM && !__X_CRON_ENV && !__DKIM_EXISTS && !__VIA_ML && !__HAS_X_REF && !__RCD_RDNS_MX_MESSY && !__RCD_RDNS_MAIL_MESSY && !__RCD_RDNS_SMTP_MESSY && !__MSGID_JAVAMAIL && !__RP_MATCHES_RCVD && !__URI_GOOGLE_DRV
 604 describe    BODY_URI_ONLY        Message body is only a URI in one line of text or for an image
 605 #score       BODY_URI_ONLY        3.000   # limit
 606 tflags      BODY_URI_ONLY        publish
 607 ##} BODY_URI_ONLY
 608
 609 ##{ BOGUS_MIME_VERSION
 610
 611 meta       BOGUS_MIME_VERSION          __BOGUS_MIME_VER_02 || __MALF_MIME_VER
 612 #score      BOGUS_MIME_VERSION          3.500   # limit
 613 describe   BOGUS_MIME_VERSION          Mime version header is bogus
 614 tflags     BOGUS_MIME_VERSION          publish
 615 ##} BOGUS_MIME_VERSION
 616
 617 ##{ BOGUS_MSM_HDRS
 618
 619 meta       BOGUS_MSM_HDRS               __BOGUS_MSM_HDRS
 620 describe   BOGUS_MSM_HDRS               Apparently bogus Microsoft email headers
 621 #score      BOGUS_MSM_HDRS               3.000  # limit
 622 tflags     BOGUS_MSM_HDRS               publish
 623 ##} BOGUS_MSM_HDRS
 624
 625 ##{ BOMB_FREEM
 626
 627 meta           BOMB_FREEM             __EXPLOSIVE_DEVICE && __freemail_hdr_replyto
 628 describe       BOMB_FREEM             Bomb + freemail
 629 #score          BOMB_FREEM             2.000    # limit
 630 tflags         BOMB_FREEM             publish
 631 ##} BOMB_FREEM
 632
 633 ##{ BOMB_MONEY
 634
 635 meta           BOMB_MONEY             __EXPLOSIVE_DEVICE && ( __ADVANCE_FEE_3_NEW || __ADVANCE_FEE_4_NEW || __ADVANCE_FEE_5_NEW )
 636 describe       BOMB_MONEY             Bomb + money: bomb threat?
 637 #score          BOMB_MONEY             2.500    # limit
 638 tflags         BOMB_MONEY             publish
 639 ##} BOMB_MONEY
 640
 641 ##{ BTC_ORG
 642
 643 describe       BTC_ORG          Bitcoin wallet ID + unusual header
 644 #score          BTC_ORG          2.500  # limit
 645 ##} BTC_ORG
 646
 647 ##{ BTC_ORG if !plugin(Mail::SpamAssassin::Plugin::DKIM)
 648
 649 if !plugin(Mail::SpamAssassin::Plugin::DKIM)
 650   meta           BTC_ORG          (__BITCOIN_ID && __HAS_ORGANIZATION) && !ALL_TRUSTED && __DOS_HAS_MAILING_LIST
 651 endif
 652 ##} BTC_ORG if !plugin(Mail::SpamAssassin::Plugin::DKIM)
 653
 654 ##{ BTC_ORG ifplugin Mail::SpamAssassin::Plugin::DKIM
 655
 656 ifplugin Mail::SpamAssassin::Plugin::DKIM
 657   meta           BTC_ORG          (__BITCOIN_ID && __HAS_ORGANIZATION) && !ALL_TRUSTED && __DOS_HAS_MAILING_LIST && !DKIM_SIGNED
 658 endif
 659 ##} BTC_ORG ifplugin Mail::SpamAssassin::Plugin::DKIM
 660
 661 ##{ BULK_RE_SUSP_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
 662
 663 if (version >= 3.004002)
 664 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
 665 meta     BULK_RE_SUSP_NTLD __SUBJ_RE && __ML1 && __FROM_ADDRLIST_SUSPNTLD
 666 tflags   BULK_RE_SUSP_NTLD publish
 667 describe BULK_RE_SUSP_NTLD Precedence bulk and RE: from a suspicious TLD
 668 #score    BULK_RE_SUSP_NTLD 1.0 # limit
 669 endif
 670 endif
 671 ##} BULK_RE_SUSP_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
 672
 673 ##{ CANT_SEE_AD
 674
 675 meta        CANT_SEE_AD       (__CANT_SEE_AD_1 || __CANT_SEE_AD_2) && !__DOS_HAS_LIST_UNSUB
 676 describe    CANT_SEE_AD       You really want to see our spam.
 677 #score       CANT_SEE_AD       2.500    # limit
 678 tflags      CANT_SEE_AD       publish
 679 ##} CANT_SEE_AD
 680
 681 ##{ CK_HELO_GENERIC
 682
 683 header          CK_HELO_GENERIC         X-Spam-Relays-Untrusted =~ /^[^\]]+helo=(?=\S*(?:pool|dyna|lease|dial|dip|static))\S*\d+[^\d\s]+\d+[^\]]+ auth= /i
 684 describe        CK_HELO_GENERIC         Relay used name indicative of a Dynamic Pool or Generic rPTR
 685 #score          CK_HELO_GENERIC         0.25
 686 ##} CK_HELO_GENERIC
 687
 688 ##{ CN_B2B_SPAMMER
 689
 690 body        CN_B2B_SPAMMER         /\bWe are (?:(?:a )?(?:China|Taiwan)[-\s]based|(?:one of (?:the )?best|(?:a )?leading) (?:international|[^\.]{10,90} (?:in|from) (?:\w+, )?(?:China|Taiwan)))\b/i
 691 describe    CN_B2B_SPAMMER         Chinese company introducing itself
 692 tflags      CN_B2B_SPAMMER         publish
 693 ##} CN_B2B_SPAMMER
 694
 695 ##{ COMMENT_GIBBERISH
 696
 697 meta           COMMENT_GIBBERISH        __COMMENT_GIBBERISH && !__JM_REACTOR_DATE && !__RCD_RDNS_MTA_MESSY && !__SENDER_BOT
 698 describe       COMMENT_GIBBERISH        Nonsense in long HTML comment
 699 #score          COMMENT_GIBBERISH        1.50   # limit
 700 tflags         COMMENT_GIBBERISH        publish
 701 ##} COMMENT_GIBBERISH
 702
 703 ##{ CONTENT_AFTER_HTML
 704
 705 meta       CONTENT_AFTER_HTML          __CONTENT_AFTER_HTML && (__L_CTE_8BIT || __RDNS_NUMERIC_TLD || __HTML_TAG_BALANCE_CENTER || __STY_INVIS_MANY || __TO_EQ_FROM_USR || __TO_EQ_FROM_USR_2 || __KAM_HTML_FONT_INVALID || __SUBJECT_ENCODED_B64 )
 706 describe   CONTENT_AFTER_HTML          More content after HTML close tag + other spam signs
 707 #score      CONTENT_AFTER_HTML          2.500   # limit
 708 tflags     CONTENT_AFTER_HTML          publish
 709 ##} CONTENT_AFTER_HTML
 710
 711 ##{ CONTENT_AFTER_HTML_WEAK
 712
 713 meta       CONTENT_AFTER_HTML_WEAK     __CONTENT_AFTER_HTML && !CONTENT_AFTER_HTML && !__CT_TEXT_PLAIN && !__BOUNCE_FROM_DAEMON && !__MSGID_OK_HEX && !__HAS_SENDER && !__LYRIS_EZLM_REMAILER && !MAILING_LIST_MULTI && !__HAS_CID && !__URI_DOTGOV
 714 describe   CONTENT_AFTER_HTML_WEAK     More content after HTML close tag
 715 #score      CONTENT_AFTER_HTML_WEAK     1.500   # limit
 716 tflags     CONTENT_AFTER_HTML_WEAK     publish
 717 ##} CONTENT_AFTER_HTML_WEAK
 718
 719 ##{ CORRUPT_FROM_LINE_IN_HDRS
 720
 721 meta CORRUPT_FROM_LINE_IN_HDRS (MISSING_HEADERS && __BODY_STARTS_WITH_FROM_LINE && MISSING_DATE && NO_RELAYS)
 722 describe CORRUPT_FROM_LINE_IN_HDRS Informational: message is corrupt, with a From line in its headers
 723 tflags CORRUPT_FROM_LINE_IN_HDRS userconf publish
 724 #score CORRUPT_FROM_LINE_IN_HDRS 0.001
 725 ##} CORRUPT_FROM_LINE_IN_HDRS
 726
 727 ##{ CTE_8BIT_MISMATCH
 728
 729 meta CTE_8BIT_MISMATCH            (__CT_TEXT_PLAIN && (!__CTE || __L_CTE_7BIT) && __L_BODY_8BITS)
 730 describe CTE_8BIT_MISMATCH        Header says 7bits but body disagrees
 731 #score CTE_8BIT_MISMATCH           1
 732 tflags CTE_8BIT_MISMATCH          publish
 733 ##} CTE_8BIT_MISMATCH
 734
 735 ##{ CTYPE_001C_A
 736
 737 meta CTYPE_001C_A  (0)      # obsolete
 738 ##} CTYPE_001C_A
 739
 740 ##{ CTYPE_001C_B
 741
 742 header CTYPE_001C_B Content-Type =~ /multipart.{0,200}boundary=\"----=_NextPart_000_0000_01C[0-9A-F]{5}\.[0-9A-F]{7}0\"/
 743 ##} CTYPE_001C_B
 744
 745 ##{ CTYPE_8SPACE_GIF ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
 746
 747 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
 748 mimeheader CTYPE_8SPACE_GIF Content-Type:raw =~ /^image\/gif;\n {8}name=\".+?\"$/s
 749 describe CTYPE_8SPACE_GIF   Stock spam image part 'Content-Type' found (8 spc)
 750 endif
 751 ##} CTYPE_8SPACE_GIF ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
 752
 753 ##{ CURR_PRICE
 754
 755 body CURR_PRICE         /\bCurrent Price:/
 756 ##} CURR_PRICE
 757
 758 ##{ DAY_I_EARNED if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
 759
 760 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
 761   meta       DAY_I_EARNED              __DAY_I_EARNED >= 3
 762 #  score      DAY_I_EARNED              3.000   # limit
 763   describe   DAY_I_EARNED              Work-at-home spam
 764   tflags     DAY_I_EARNED              publish
 765 endif
 766 ##} DAY_I_EARNED if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
 767
 768 ##{ DEAR_BENEFICIARY
 769
 770 body     DEAR_BENEFICIARY         /\b(?:De[ae]r\s|At+(?:ention|n):?\s?)(?:\S+\s)?Ben[ei]ficiary\b/i
 771 describe DEAR_BENEFICIARY         Dear Beneficiary:
 772 ##} DEAR_BENEFICIARY
 773
 774 ##{ DEAR_WINNER
 775
 776 body DEAR_WINNER /\bdear.{1,20}winner/i
 777 describe DEAR_WINNER   Spam with generic salutation of "dear winner"
 778 ##} DEAR_WINNER
 779
 780 ##{ DKIMWL_BL ifplugin Mail::SpamAssassin::Plugin::AskDNS
 781
 782 ifplugin Mail::SpamAssassin::Plugin::AskDNS
 783 meta      DKIMWL_BL  __DKIMWL_WL_BL
 784 tflags    DKIMWL_BL  net publish
 785 describe  DKIMWL_BL  DKIMwl.org - Blocked sender
 786 #score     DKIMWL_BL  3.0 # limit
 787 endif
 788 ##} DKIMWL_BL ifplugin Mail::SpamAssassin::Plugin::AskDNS
 789
 790 ##{ DKIMWL_BLOCKED ifplugin Mail::SpamAssassin::Plugin::AskDNS
 791
 792 ifplugin Mail::SpamAssassin::Plugin::AskDNS
 793 meta      DKIMWL_BLOCKED  __DKIMWL_BLOCKED
 794 tflags    DKIMWL_BLOCKED  net publish
 795 describe  DKIMWL_BLOCKED  ADMINISTRATOR NOTICE: The query to DKIMWL.org was blocked.  See http://wiki.apache.org/spamassassin/DnsBlocklists\#dnsbl-block for more information.
 796 #score     DKIMWL_BLOCKED  0.001 # limit
 797 endif
 798 ##} DKIMWL_BLOCKED ifplugin Mail::SpamAssassin::Plugin::AskDNS
 799
 800 ##{ DKIMWL_WL_HIGH ifplugin Mail::SpamAssassin::Plugin::AskDNS
 801
 802 ifplugin Mail::SpamAssassin::Plugin::AskDNS
 803 meta      DKIMWL_WL_HIGH  __DKIMWL_WL_HI && !(FREEMAIL_FROM || FREEMAIL_REPLYTO || FREEMAIL_FORGED_REPLYTO || __DKIMWL_FREEMAIL || __DKIMWL_BULKMAIL)
 804 tflags    DKIMWL_WL_HIGH  net nice publish
 805 describe  DKIMWL_WL_HIGH  DKIMwl.org - High trust sender
 806 #score     DKIMWL_WL_HIGH  -3.0 # limit
 807 endif
 808 ##} DKIMWL_WL_HIGH ifplugin Mail::SpamAssassin::Plugin::AskDNS
 809
 810 ##{ DKIMWL_WL_MED ifplugin Mail::SpamAssassin::Plugin::AskDNS
 811
 812 ifplugin Mail::SpamAssassin::Plugin::AskDNS
 813 meta      DKIMWL_WL_MED    __DKIMWL_WL_MED && !(FREEMAIL_FROM || FREEMAIL_REPLYTO || FREEMAIL_FORGED_REPLYTO || __DKIMWL_FREEMAIL)
 814 tflags    DKIMWL_WL_MED    net nice publish
 815 describe  DKIMWL_WL_MED    DKIMwl.org - Medium trust sender
 816 #score     DKIMWL_WL_MED    -0.5 # limit
 817 endif
 818 ##} DKIMWL_WL_MED ifplugin Mail::SpamAssassin::Plugin::AskDNS
 819
 820 ##{ DKIMWL_WL_MEDHI ifplugin Mail::SpamAssassin::Plugin::AskDNS
 821
 822 ifplugin Mail::SpamAssassin::Plugin::AskDNS
 823 meta      DKIMWL_WL_MEDHI    __DKIMWL_WL_MEDHI && !(FREEMAIL_FROM || FREEMAIL_REPLYTO || FREEMAIL_FORGED_REPLYTO || __DKIMWL_FREEMAIL)
 824 tflags    DKIMWL_WL_MEDHI    net nice publish
 825 describe  DKIMWL_WL_MEDHI    DKIMwl.org - Medium-high trust sender
 826 #score     DKIMWL_WL_MEDHI    -1.0 # limit
 827 endif
 828 ##} DKIMWL_WL_MEDHI ifplugin Mail::SpamAssassin::Plugin::AskDNS
 829
 830 ##{ DOS_ANAL_SPAM_MAILER
 831
 832 header DOS_ANAL_SPAM_MAILER     X-mailer =~ /^[A-Z][a-z]{6}e \d\.\d{2}$/
 833 describe DOS_ANAL_SPAM_MAILER   X-mailer pattern common to anal porn site spam
 834 tflags DOS_ANAL_SPAM_MAILER     publish
 835 ##} DOS_ANAL_SPAM_MAILER
 836
 837 ##{ DOS_DEREK_AUG08
 838
 839 meta DOS_DEREK_AUG08    __DOS_SINGLE_EXT_RELAY && __DOS_HAS_ANY_URI && __NAKED_TO && __LAST_UNTRUSTED_RELAY_NO_AUTH && SPF_PASS && __TVD_MIME_ATT_TP && __CT_TEXT_PLAIN && (__DOS_MSGID_DIGITS9 || __DOS_MSGID_DIGITS10)
 840 ##} DOS_DEREK_AUG08
 841
 842 ##{ DOS_FIX_MY_URI
 843
 844 meta DOS_FIX_MY_URI             __MIMEOLE_1106 && __DOS_HAS_ANY_URI && __DOS_SINGLE_EXT_RELAY && __DOS_HI && __DOS_LINK
 845 describe DOS_FIX_MY_URI         Looks like a "fix my obfu'd URI please" spam
 846 ##} DOS_FIX_MY_URI
 847
 848 ##{ DOS_HIGH_BAT_TO_MX
 849
 850 meta DOS_HIGH_BAT_TO_MX         __DOS_DIRECT_TO_MX && __HIGHBITS && __LAST_UNTRUSTED_RELAY_NO_AUTH && __THEBAT_MUA
 851 describe DOS_HIGH_BAT_TO_MX     The Bat! Direct to MX with High Bits
 852 ##} DOS_HIGH_BAT_TO_MX
 853
 854 ##{ DOS_LET_GO_JOB
 855
 856 meta DOS_LET_GO_JOB     __DOS_LET_GO_JOB && __DOS_MY_OLD_JOB && __DOS_I_DRIVE_A && __DOS_TAKING_HOME
 857 describe DOS_LET_GO_JOB Let go from their job and now makes lots of dough!
 858 ##} DOS_LET_GO_JOB
 859
 860 ##{ DOS_OE_TO_MX
 861
 862 meta DOS_OE_TO_MX               __OE_MUA && __DOS_DIRECT_TO_MX && !DOS_OE_TO_MX_IMAGE
 863 describe DOS_OE_TO_MX           Delivered direct to MX with OE headers
 864 ##} DOS_OE_TO_MX
 865
 866 ##{ DOS_OE_TO_MX_IMAGE
 867
 868 meta DOS_OE_TO_MX_IMAGE         __OE_MUA && __DOS_DIRECT_TO_MX && __ANY_IMAGE_ATTACH
 869 describe DOS_OE_TO_MX_IMAGE     Direct to MX with OE headers and an image
 870 ##} DOS_OE_TO_MX_IMAGE
 871
 872 ##{ DOS_OUTLOOK_TO_MX
 873
 874 meta DOS_OUTLOOK_TO_MX          __ANY_OUTLOOK_MUA && !__OE_MUA && __DOS_DIRECT_TO_MX && !T_DOS_OUTLOOK_TO_MX_IMAGE
 875 describe DOS_OUTLOOK_TO_MX      Delivered direct to MX with Outlook headers
 876 ##} DOS_OUTLOOK_TO_MX
 877
 878 ##{ DOS_RCVD_IP_TWICE_C
 879
 880 header DOS_RCVD_IP_TWICE_C      X-Spam-Relays-External =~ /^\s*\[ ip=(?!127)([\d.]+) [^\[]*\bhelo=(?:![\d.]{7,15}!)? [^\[]*\[ ip=\1 [^\]]*\]\s*$/
 881 describe DOS_RCVD_IP_TWICE_C    Received from the same IP twice in a row (only one external relay; empty or IP helo)
 882 ##} DOS_RCVD_IP_TWICE_C
 883
 884 ##{ DOS_STOCK_BAT
 885
 886 meta            DOS_STOCK_BAT           __THEBAT_MUA && (__DOS_BODY_STOCK || __DOS_BODY_TICKER) && (__DOS_REF_TODAY || __DOS_REF_NEXT_WK_DAY || __DOS_REF_2_WK_DAYS)
 887 describe        DOS_STOCK_BAT           Probable pump and dump stock spam
 888 ##} DOS_STOCK_BAT
 889
 890 ##{ DOS_STOCK_BAT2
 891
 892 meta            DOS_STOCK_BAT2          DOS_STOCK_BAT && (__DOS_FIN_ADVANTAGE + __DOS_STRONG_CF + __DOS_STEADY_COURSE > 2)
 893 ##} DOS_STOCK_BAT2
 894
 895 ##{ DOS_URI_ASTERISK
 896
 897 uri DOS_URI_ASTERISK    m{^[Hh][Tt]{2}[Pp][Ss]?://[^/:]+(?:\*[A-Za-z0-9-]*\.|\*)[A-Za-z]{2,3}(?:\.[A-Za-z]{2})?(?:$|:|/)}
 898 describe DOS_URI_ASTERISK       Found an asterisk in a URI
 899 ##} DOS_URI_ASTERISK
 900
 901 ##{ DOS_YOUR_PLACE
 902
 903 meta    DOS_YOUR_PLACE  (__DOS_COMING_TO_YOUR_PLACE && __DOS_MEET_EACH_OTHER && (__DOS_DROP_ME_A_LINE || __DOS_CORRESPOND_EMAIL || __DOS_EMAIL_DIRECTLY || __DOS_I_AM_25 || __DOS_WRITE_ME_AT || __DOS_PERSONAL_EMAIL))
 904 describe        DOS_YOUR_PLACE          Russian dating spam
 905 ##} DOS_YOUR_PLACE
 906
 907 ##{ DOTGOV_IMAGE
 908
 909 meta       DOTGOV_IMAGE                __DOTGOV_IMAGE && !__HAVE_BOUNCE_RELAYS
 910 describe   DOTGOV_IMAGE                .gov URI + hosted image
 911 #score      DOTGOV_IMAGE                3.000   # limit
 912 tflags     DOTGOV_IMAGE                publish
 913 ##} DOTGOV_IMAGE
 914
 915 ##{ DRUGS_HDIA
 916
 917 header DRUGS_HDIA       Subject =~ /\bhoodia\b/i
 918 describe DRUGS_HDIA     Subject mentions "hoodia"
 919 ##} DRUGS_HDIA
 920
 921 ##{ DX_TEXT_02
 922
 923 body       DX_TEXT_02       /\b(?:change|modif(?:y|ications?)) (?:of|to|(?:yo)?ur) (?:message|sub|comm) stat/i
 924 describe   DX_TEXT_02       "change your message stat"
 925 tflags     DX_TEXT_02       publish
 926 ##} DX_TEXT_02
 927
 928 ##{ DX_TEXT_03
 929
 930 body       DX_TEXT_03       /\b[A-Z]{3} Media (?:Group|Relations)\b/
 931 describe   DX_TEXT_03       "XXX Media Group"
 932 tflags     DX_TEXT_03       publish
 933 ##} DX_TEXT_03
 934
 935 ##{ DYNAMIC_IMGUR
 936
 937 meta       DYNAMIC_IMGUR               __DYNAMIC_IMGUR
 938 describe   DYNAMIC_IMGUR               dynamic IP + hosted image
 939 #score      DYNAMIC_IMGUR               4.000   # limit
 940 tflags     DYNAMIC_IMGUR               publish
 941 ##} DYNAMIC_IMGUR
 942
 943 ##{ DYN_RDNS_AND_INLINE_IMAGE
 944
 945 meta DYN_RDNS_AND_INLINE_IMAGE     (RDNS_DYNAMIC && __ANY_IMAGE_ATTACH)
 946 describe DYN_RDNS_AND_INLINE_IMAGE Contains image, and was sent by dynamic rDNS
 947 ##} DYN_RDNS_AND_INLINE_IMAGE
 948
 949 ##{ DYN_RDNS_SHORT_HELO_HTML
 950
 951 meta DYN_RDNS_SHORT_HELO_HTML      (__HELO_NO_DOMAIN && RDNS_DYNAMIC && HTML_MESSAGE)
 952 describe DYN_RDNS_SHORT_HELO_HTML  Sent by dynamic rDNS, short HELO, and HTML
 953 ##} DYN_RDNS_SHORT_HELO_HTML
 954
 955 ##{ DYN_RDNS_SHORT_HELO_IMAGE
 956
 957 meta DYN_RDNS_SHORT_HELO_IMAGE       (__HELO_NO_DOMAIN && RDNS_DYNAMIC && __ANY_IMAGE_ATTACH)
 958 describe DYN_RDNS_SHORT_HELO_IMAGE    Short HELO string, dynamic rDNS, inline image
 959 ##} DYN_RDNS_SHORT_HELO_IMAGE
 960
 961 ##{ EBAY_IMG_NOT_RCVD_EBAY
 962
 963 meta       EBAY_IMG_NOT_RCVD_EBAY      __EBAY_IMG_NOT_RCVD_EBAY && !__URI_MAILTO && !__RCD_RDNS_MAIL && !__DKIM_EXISTS
 964 #score      EBAY_IMG_NOT_RCVD_EBAY      3.000   # limit
 965 describe   EBAY_IMG_NOT_RCVD_EBAY      E-bay hosted image but message not from E-bay
 966 tflags     EBAY_IMG_NOT_RCVD_EBAY      publish
 967 ##} EBAY_IMG_NOT_RCVD_EBAY
 968
 969 ##{ EMRCP
 970
 971 body     EMRCP            /\bExcess (?:Maximum )?Return Capital (?:Profits?|Funds?)\b/i
 972 describe EMRCP            "Excess Maximum Return Capital Profit" scam
 973 tflags   EMRCP            publish
 974 ##} EMRCP
 975
 976 ##{ ENCRYPTED_MESSAGE
 977
 978 meta       ENCRYPTED_MESSAGE           __CT_ENCRYPTED
 979 describe   ENCRYPTED_MESSAGE           Message is encrypted, not likely to be spam
 980 #score      ENCRYPTED_MESSAGE           -1.000
 981 tflags     ENCRYPTED_MESSAGE           nice publish
 982 ##} ENCRYPTED_MESSAGE
 983
 984 ##{ END_FUTURE_EMAILS
 985
 986 describe       END_FUTURE_EMAILS   Spammy unsubscribe
 987 #score          END_FUTURE_EMAILS   2.500       # limit
 988 ##} END_FUTURE_EMAILS
 989
 990 ##{ END_FUTURE_EMAILS if !plugin(Mail::SpamAssassin::Plugin::DKIM)
 991
 992 if !plugin(Mail::SpamAssassin::Plugin::DKIM)
 993   meta         END_FUTURE_EMAILS   __END_FUTURE_EMAILS && !__SUBJECT_ENCODED_B64 && !__HDRS_LCASE && !__HDRS_LCASE_KNOWN && !__TO___LOWER
 994 endif
 995 ##} END_FUTURE_EMAILS if !plugin(Mail::SpamAssassin::Plugin::DKIM)
 996
 997 ##{ END_FUTURE_EMAILS ifplugin Mail::SpamAssassin::Plugin::DKIM
 998
 999 ifplugin Mail::SpamAssassin::Plugin::DKIM
1000   meta         END_FUTURE_EMAILS   __END_FUTURE_EMAILS && !__SUBJECT_ENCODED_B64 && !__HDRS_LCASE && !__HDRS_LCASE_KNOWN && !__TO___LOWER && !__DKIM_DEPENDABLE && !DKIM_SIGNED
1001 endif
1002 ##} END_FUTURE_EMAILS ifplugin Mail::SpamAssassin::Plugin::DKIM
1003
1004 ##{ ENVFROM_GOOG_TRIX
1005
1006 meta       ENVFROM_GOOG_TRIX           __ENVFROM_GOOG_TRIX_SPAMMY
1007 describe   ENVFROM_GOOG_TRIX           From suspicious Google subdomain
1008 #score      ENVFROM_GOOG_TRIX           3.000   # limit
1009 tflags     ENVFROM_GOOG_TRIX           publish
1010 ##} ENVFROM_GOOG_TRIX
1011
1012 ##{ EXCUSE_24
1013
1014 body EXCUSE_24                  /you(?:'ve|'re| have| are)? receiv(?:e|ed|ing) this (?:advertisement|offer|special|recurring|paid).{0,16}\b(?:by either|because)/i
1015 describe EXCUSE_24              Claims you wanted this ad
1016 ##} EXCUSE_24
1017
1018 ##{ FACEBOOK_IMG_NOT_RCVD_FB
1019
1020 meta       FACEBOOK_IMG_NOT_RCVD_FB    __FACEBOOK_IMG_NOT_RCVD_FB && !__VIA_ML && !__ONE_IMG && !__RCD_RDNS_SMTP
1021 #score      FACEBOOK_IMG_NOT_RCVD_FB    2.000  # limit
1022 describe   FACEBOOK_IMG_NOT_RCVD_FB    Facebook hosted image but message not from Facebook
1023 tflags     FACEBOOK_IMG_NOT_RCVD_FB    publish
1024 ##} FACEBOOK_IMG_NOT_RCVD_FB
1025
1026 ##{ FAKE_REPLY_C
1027
1028 meta     FAKE_REPLY_C           (__SUBJ_RE && __MISSING_REF && __NO_INR_YES_REF)
1029 ##} FAKE_REPLY_C
1030
1031 ##{ FBI_MONEY
1032
1033 meta        FBI_MONEY            __FBI_SPOOF && LOTS_OF_MONEY
1034 describe    FBI_MONEY            The FBI wants to give you lots of money?
1035 #score       FBI_MONEY            2.00  # limit
1036 tflags      FBI_MONEY            publish
1037 ##} FBI_MONEY
1038
1039 ##{ FBI_SPOOF
1040
1041 meta        FBI_SPOOF            __FBI_SPOOF
1042 describe    FBI_SPOOF            Claims to be FBI, but not from FBI domain
1043 #score       FBI_SPOOF            2.00  # limit
1044 tflags      FBI_SPOOF            publish
1045 ##} FBI_SPOOF
1046
1047 ##{ FILL_THIS_FORM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1048
1049 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1050   meta     FILL_THIS_FORM                 __FILL_THIS_FORM && !__THREADED && !__FB_TOUR && !__VIA_ML
1051   describe FILL_THIS_FORM                 Fill in a form with personal information
1052   tflags   FILL_THIS_FORM                 publish
1053 endif
1054 ##} FILL_THIS_FORM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1055
1056 ##{ FILL_THIS_FORM_LONG ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1057
1058 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1059   meta     FILL_THIS_FORM_LONG            __FILL_THIS_FORM_LONG && !__VIA_ML && !__DOS_HAS_LIST_UNSUB && !__THREADED && !__TRAVEL_MANY
1060   describe FILL_THIS_FORM_LONG            Fill in a form with personal information
1061 #  score    FILL_THIS_FORM_LONG            2.00 # limit
1062 endif
1063 ##} FILL_THIS_FORM_LONG ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1064
1065 ##{ FONT_INVIS_DIRECT if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1066
1067 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1068   meta      FONT_INVIS_DIRECT             __FONT_INVIS_DIRECT && !__UNSUB_LINK && !__HAS_ERRORS_TO && !__MOZILLA_MSGID && !__RCD_RDNS_MAIL_MESSY && !__URI_DOTGOV && !__NAKED_TO && !__MSGID_OK_HEX
1069   describe  FONT_INVIS_DIRECT             Invisible text + direct-to-MX
1070 #  score     FONT_INVIS_DIRECT             3.500        # limit
1071   tflags    FONT_INVIS_DIRECT             publish
1072 endif
1073 ##} FONT_INVIS_DIRECT if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1074
1075 ##{ FONT_INVIS_DOTGOV if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1076
1077 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1078   meta      FONT_INVIS_DOTGOV             __FONT_INVIS_DOTGOV && !__MOZILLA_MSGID && !__RCD_RDNS_MAIL_MESSY && !__HAS_ERRORS_TO && !__HAS_LIST_ID
1079   describe  FONT_INVIS_DOTGOV             Invisible text + .gov URI
1080 #  score     FONT_INVIS_DOTGOV             3.500        # limit
1081   tflags    FONT_INVIS_DOTGOV             publish
1082 endif
1083 ##} FONT_INVIS_DOTGOV if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1084
1085 ##{ FONT_INVIS_HTML_NOHTML if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1086
1087 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1088   meta      FONT_INVIS_HTML_NOHTML        __FONT_INVIS_HTML_NOHTML && !__RDNS_LONG
1089   describe  FONT_INVIS_HTML_NOHTML        Invisible text + malformed HTML
1090 #  score     FONT_INVIS_HTML_NOHTML        3.000        # limit
1091   tflags    FONT_INVIS_HTML_NOHTML        publish
1092 endif
1093 ##} FONT_INVIS_HTML_NOHTML if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1094
1095 ##{ FONT_INVIS_LONG_LINE if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1096
1097 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1098   meta      FONT_INVIS_LONG_LINE          __FONT_INVIS_LONG_LINE && !__HTML_SINGLET
1099   describe  FONT_INVIS_LONG_LINE          Invisible text + long lines
1100 #  score     FONT_INVIS_LONG_LINE          3.000        # limit
1101   tflags    FONT_INVIS_LONG_LINE          publish
1102 endif
1103 ##} FONT_INVIS_LONG_LINE if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1104
1105 ##{ FONT_INVIS_MSGID if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1106
1107 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1108   meta      FONT_INVIS_MSGID              __FONT_INVIS_MSGID && !__RCD_RDNS_MX_MESSY && !__RCD_RDNS_MX && !__HAS_ERRORS_TO && !__RCD_RDNS_MAIL && !__MAIL_LINK && !__HDR_RCVD_AMAZON && !__MIME_QP && !__HAS_CAMPAIGNID && !__HAS_THREAD_INDEX && !__RCD_RDNS_MTA
1109   describe  FONT_INVIS_MSGID              Invisible text + suspicious message ID
1110 #  score     FONT_INVIS_MSGID              2.500        # limit
1111   tflags    FONT_INVIS_MSGID              publish
1112 endif
1113 ##} FONT_INVIS_MSGID if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1114
1115 ##{ FONT_INVIS_NORDNS if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1116
1117 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1118   meta      FONT_INVIS_NORDNS             __FONT_INVIS_NORDNS && !__HTML_SINGLET && !__LYRIS_EZLM_REMAILER && !__YOUR_PERSONAL && !__HAS_X_MAILER
1119   describe  FONT_INVIS_NORDNS             Invisible text + no rDNS
1120 #  score     FONT_INVIS_NORDNS             2.500        # limit
1121   tflags    FONT_INVIS_NORDNS             publish
1122 endif
1123 ##} FONT_INVIS_NORDNS if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1124
1125 ##{ FONT_INVIS_POSTEXTRAS if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1126
1127 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1128   meta      FONT_INVIS_POSTEXTRAS         (__FONT_INVIS || __STY_INVIS) && __AC_POST_EXTRAS
1129   describe  FONT_INVIS_POSTEXTRAS         Invisible text + suspicious URI
1130 #  score     FONT_INVIS_POSTEXTRAS         3.500        # limit
1131   tflags    FONT_INVIS_POSTEXTRAS         publish
1132 endif
1133 ##} FONT_INVIS_POSTEXTRAS if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1134
1135 ##{ FORGED_SPF_HELO
1136
1137 meta     FORGED_SPF_HELO        __HELO_NOT_RDNS && SPF_HELO_PASS && !SPF_PASS
1138 ##} FORGED_SPF_HELO
1139
1140 ##{ FORM_FRAUD
1141
1142 meta     FORM_FRAUD       (__FORM_FRAUD && !__FORM_FRAUD_3 && !__FORM_FRAUD_5) && !__DOS_HAS_LIST_UNSUB && !__THREADED && !__HAS_THREAD_INDEX && !__VIA_ML && !__HTML_LINK_IMAGE && !__COMMENT_EXISTS && !__NOT_SPOOFED && !__UPPERCASE_URI && !__UNSUB_LINK
1143 describe FORM_FRAUD       Fill a form and a fraud phrase
1144 #score    FORM_FRAUD       1.000   # limit
1145 tflags   FORM_FRAUD       publish
1146 ##} FORM_FRAUD
1147
1148 ##{ FORM_FRAUD_3
1149
1150 meta     FORM_FRAUD_3    (__FORM_FRAUD_3 && !__FORM_FRAUD_5 && !__ADVANCE_FEE_3_NEW_FORM && !__ADVANCE_FEE_3_NEW_FRM_MNY) && !__DOS_HAS_LIST_UNSUB && !__THREADED && !__HAS_THREAD_INDEX && !__VIA_ML && !__HTML_LINK_IMAGE && !__MIME_QP && !__DOS_BODY_FRI && !__UNSUB_LINK && !__BUGGED_IMG && !__NOT_SPOOFED
1151 describe FORM_FRAUD_3    Fill a form and several fraud phrases
1152 tflags   FORM_FRAUD_3    publish
1153 ##} FORM_FRAUD_3
1154
1155 ##{ FORM_FRAUD_5
1156
1157 meta     FORM_FRAUD_5    (__FORM_FRAUD_5 && !__ADVANCE_FEE_5_NEW_FORM && !__ADVANCE_FEE_5_NEW_FRM_MNY) && !__DOS_HAS_LIST_UNSUB && !__THREADED && !__HAS_THREAD_INDEX && !__VIA_ML && !__BOUNCE_CTYPE
1158 describe FORM_FRAUD_5    Fill a form and many fraud phrases
1159 tflags   FORM_FRAUD_5    publish
1160 ##} FORM_FRAUD_5
1161
1162 ##{ FOUND_YOU
1163
1164 meta        FOUND_YOU          __FOUND_YOU && !__DKIM_EXISTS && !__SUBJ_RE && !__HAS_X_REF && !__RP_MATCHES_RCVD && !__COMMENT_EXISTS && !__HAS_ERRORS_TO && !__HAS_IN_REPLY_TO
1165 #score       FOUND_YOU          3.25    # limit
1166 describe    FOUND_YOU          I found you...
1167 tflags      FOUND_YOU          publish
1168 ##} FOUND_YOU
1169
1170 ##{ FREEMAIL_FORGED_FROMDOMAIN ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::HeaderEval if (version >= 3.004000)
1171
1172 ifplugin Mail::SpamAssassin::Plugin::FreeMail
1173   ifplugin Mail::SpamAssassin::Plugin::HeaderEval
1174     if (version >= 3.004000)
1175       meta     FREEMAIL_FORGED_FROMDOMAIN FREEMAIL_FROM && HEADER_FROM_DIFFERENT_DOMAINS
1176       describe FREEMAIL_FORGED_FROMDOMAIN 2nd level domains in From and EnvelopeFrom freemail headers are different
1177 #      score    FREEMAIL_FORGED_FROMDOMAIN 0.25
1178       tflags   FREEMAIL_FORGED_FROMDOMAIN publish
1179 endif
1180 endif
1181 endif
1182 ##} FREEMAIL_FORGED_FROMDOMAIN ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::HeaderEval if (version >= 3.004000)
1183
1184 ##{ FREEMAIL_WFH_01
1185
1186 meta       FREEMAIL_WFH_01             __FREEMAIL_WFH_01
1187 describe   FREEMAIL_WFH_01             Work-from-Home + freemail
1188 tflags     FREEMAIL_WFH_01             publish
1189 ##} FREEMAIL_WFH_01
1190
1191 ##{ FREEM_FRNUM_UNICD_EMPTY
1192
1193 meta       FREEM_FRNUM_UNICD_EMPTY    __FREEM_FRNUM_UNICD_EMPTY
1194 describe   FREEM_FRNUM_UNICD_EMPTY    Numeric freemail From address, unicode From name and Subject, empty body
1195 #score      FREEM_FRNUM_UNICD_EMPTY    3.750    # limit
1196 tflags     FREEM_FRNUM_UNICD_EMPTY    publish
1197 ##} FREEM_FRNUM_UNICD_EMPTY
1198
1199 ##{ FRNAME_IN_MSG_XPRIO_NO_SUB
1200
1201 meta       FRNAME_IN_MSG_XPRIO_NO_SUB (__FROM_NAME_IN_MSG && __XPRIO && (__SUBJECT_EMPTY || __SUBJ_SHORT)) && !__DKIM_EXISTS  && !__SUBJ_NOT_SHORT && !ALL_TRUSTED
1202 describe   FRNAME_IN_MSG_XPRIO_NO_SUB From name in message + X-Priority + short or no subject
1203 #score      FRNAME_IN_MSG_XPRIO_NO_SUB 2.500    # limit
1204 tflags     FRNAME_IN_MSG_XPRIO_NO_SUB publish
1205 ##} FRNAME_IN_MSG_XPRIO_NO_SUB
1206
1207 ##{ FROM_ADDR_WS
1208
1209 meta       FROM_ADDR_WS                __FROM_ADDR_WS && !__RCD_RDNS_MTA_MESSY && !ANY_BOUNCE_MESSAGE && !__FROM_ENCODED_QP && !__RCD_RDNS_MAIL
1210 describe   FROM_ADDR_WS                Malformed From address
1211 #score      FROM_ADDR_WS                3.000   # limit
1212 tflags     FROM_ADDR_WS                publish
1213 ##} FROM_ADDR_WS
1214
1215 ##{ FROM_BANK_NOAUTH if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1216
1217 if (version >= 3.004002)
1218 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1219 meta     FROM_BANK_NOAUTH  __FROM_ADDRLIST_BANKS && (! NO_RELAYS && ! ALL_TRUSTED) && (! SPF_PASS && ! DKIM_VALID_AU)
1220 tflags   FROM_BANK_NOAUTH  publish net
1221 describe FROM_BANK_NOAUTH  From Bank domain but no SPF or DKIM
1222 #score    FROM_BANK_NOAUTH  1.0 # limit
1223 endif
1224 endif
1225 ##} FROM_BANK_NOAUTH if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1226
1227 ##{ FROM_FMBLA_NDBLOCKED if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS
1228
1229 if (version >= 3.004001)
1230 ifplugin Mail::SpamAssassin::Plugin::AskDNS
1231 meta       FROM_FMBLA_NDBLOCKED __FROM_FMBLA_NDBLOCKED
1232 describe   FROM_FMBLA_NDBLOCKED ADMINISTRATOR NOTICE: The query to fresh.fmb.la was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists\#dnsbl-block for more information.
1233 tflags     FROM_FMBLA_NDBLOCKED net publish
1234 #score      FROM_FMBLA_NDBLOCKED 0.001 # limit
1235 endif
1236 endif
1237 ##} FROM_FMBLA_NDBLOCKED if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS
1238
1239 ##{ FROM_FMBLA_NEWDOM if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS
1240
1241 if (version >= 3.004001)
1242 ifplugin Mail::SpamAssassin::Plugin::AskDNS
1243 meta       FROM_FMBLA_NEWDOM    __FROM_FMBLA_NEWDOM
1244 describe   FROM_FMBLA_NEWDOM    From domain was registered in last 7 days
1245 tflags     FROM_FMBLA_NEWDOM    net
1246 #score      FROM_FMBLA_NEWDOM    1.5 # limit
1247 endif
1248 endif
1249 ##} FROM_FMBLA_NEWDOM if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS
1250
1251 ##{ FROM_FMBLA_NEWDOM14 if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS
1252
1253 if (version >= 3.004001)
1254 ifplugin Mail::SpamAssassin::Plugin::AskDNS
1255 meta       FROM_FMBLA_NEWDOM14  __FROM_FMBLA_NEWDOM14
1256 describe   FROM_FMBLA_NEWDOM14  From domain was registered in last 7-14 days
1257 tflags     FROM_FMBLA_NEWDOM14  publish net
1258 #score      FROM_FMBLA_NEWDOM14  1.0 # limit
1259 endif
1260 endif
1261 ##} FROM_FMBLA_NEWDOM14 if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS
1262
1263 ##{ FROM_FMBLA_NEWDOM28 if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS
1264
1265 if (version >= 3.004001)
1266 ifplugin Mail::SpamAssassin::Plugin::AskDNS
1267 meta       FROM_FMBLA_NEWDOM28  __FROM_FMBLA_NEWDOM28
1268 describe   FROM_FMBLA_NEWDOM28  From domain was registered in last 14-28 days
1269 tflags     FROM_FMBLA_NEWDOM28  net publish
1270 #score      FROM_FMBLA_NEWDOM28  0.8 # limit
1271 endif
1272 endif
1273 ##} FROM_FMBLA_NEWDOM28 if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS
1274
1275 ##{ FROM_GOV_DKIM_AU if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1276
1277 if (version >= 3.004002)
1278 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1279 meta     FROM_GOV_DKIM_AU  DKIM_VALID_AU && __FROM_ADDRLIST_GOV
1280 tflags   FROM_GOV_DKIM_AU  net nice publish
1281 describe FROM_GOV_DKIM_AU  From Government address and DKIM signed
1282 #score    FROM_GOV_DKIM_AU  -1.0 # limit
1283 endif
1284 endif
1285 ##} FROM_GOV_DKIM_AU if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1286
1287 ##{ FROM_GOV_REPLYTO_FREEMAIL if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1288
1289 if (version >= 3.004002)
1290 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1291 meta     FROM_GOV_REPLYTO_FREEMAIL FREEMAIL_FORGED_REPLYTO && __FROM_ADDRLIST_GOV && !DKIM_VALID_AU
1292 tflags   FROM_GOV_REPLYTO_FREEMAIL net publish
1293 describe FROM_GOV_REPLYTO_FREEMAIL From Government domain but ReplyTo is FREEMAIL
1294 #score    FROM_GOV_REPLYTO_FREEMAIL 2.0
1295 endif
1296 endif
1297 ##} FROM_GOV_REPLYTO_FREEMAIL if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1298
1299 ##{ FROM_GOV_SPOOF if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1300
1301 if (version >= 3.004002)
1302 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1303 meta     FROM_GOV_SPOOF  !__NOT_SPOOFED && __FROM_ADDRLIST_GOV && (! NO_RELAYS && ! ALL_TRUSTED)
1304 tflags   FROM_GOV_SPOOF  net publish
1305 describe FROM_GOV_SPOOF  From Government domain but matches SPOOFED
1306 #score    FROM_GOV_SPOOF  1.0 # limit
1307 endif
1308 endif
1309 ##} FROM_GOV_SPOOF if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1310
1311 ##{ FROM_IN_TO_AND_SUBJ
1312
1313 meta           FROM_IN_TO_AND_SUBJ  (__TO_EQ_FROM && __SUBJ_HAS_FROM_1) && !__HAS_LIST_ID
1314 describe       FROM_IN_TO_AND_SUBJ  From address is in To and Subject
1315 tflags         FROM_IN_TO_AND_SUBJ  publish
1316 ##} FROM_IN_TO_AND_SUBJ
1317
1318 ##{ FROM_MISSPACED
1319
1320 meta           FROM_MISSPACED        __FROM_MISSPACED && !__RCD_RDNS_MTA_MESSY && !__CTYPE_MULTIPART_ALT && !__REPTO_QUOTE && !__MIME_QP && !__UNSUB_LINK && !__TO___LOWER && !__BUGGED_IMG && !__DOS_HAS_LIST_UNSUB && !__TO_EQ_FROM_DOM && !__MAIL_LINK && !__MTLANDROID_MUA && !__XEROXWORKCTR_MUA && !__PHP_MUA && !__AMADEUSMS_MUA && !__FLASHMAIL_MUA
1321 describe       FROM_MISSPACED        From: missing whitespace
1322 #score          FROM_MISSPACED        2.00
1323 ##} FROM_MISSPACED
1324
1325 ##{ FROM_MISSP_EH_MATCH
1326
1327 meta           FROM_MISSP_EH_MATCH   __FROM_MISSP_EH_MATCH && !__RCD_RDNS_MTA_MESSY && !__UNSUB_LINK && !__COMMENT_EXISTS && !__TO___LOWER && !__MIME_QP && !__TO_EQ_FROM_DOM && !__BUGGED_IMG && !__DKIM_EXISTS && !__RCVD_ZIXMAIL && !__MTLANDROID_MUA && !__XEROXWORKCTR_MUA && !__PHP_MUA && !__AMADEUSMS_MUA && !__FLASHMAIL_MUA
1328 describe       FROM_MISSP_EH_MATCH   From misspaced, matches envelope
1329 #score          FROM_MISSP_EH_MATCH   2.00      # max
1330 ##} FROM_MISSP_EH_MATCH
1331
1332 ##{ FROM_MISSP_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail
1333
1334 ifplugin Mail::SpamAssassin::Plugin::FreeMail
1335   meta         FROM_MISSP_FREEMAIL   __FROM_MISSP_FREEMAIL && !__TO_EQ_FROM_DOM && !__MTLANDROID_MUA
1336   describe     FROM_MISSP_FREEMAIL   From misspaced + freemail provider
1337 endif
1338 ##} FROM_MISSP_FREEMAIL ifplugin Mail::SpamAssassin::Plugin::FreeMail
1339
1340 ##{ FROM_MISSP_MSFT
1341
1342 meta           FROM_MISSP_MSFT       __FROM_RUNON && (__ANY_OUTLOOK_MUA || __MIMEOLE_MS)
1343 describe       FROM_MISSP_MSFT       From misspaced + supposed Microsoft tool
1344 ##} FROM_MISSP_MSFT
1345
1346 ##{ FROM_MISSP_REPLYTO
1347
1348 meta           FROM_MISSP_REPLYTO    __FROM_MISSP_REPLYTO && !__NOT_SPOOFED && !__RCD_RDNS_MTA_MESSY && !__TO___LOWER && !__COMMENT_EXISTS && !__UNSUB_LINK && !__MIME_QP && !__CTYPE_MULTIPART_ALT && !__JM_REACTOR_DATE && !__PLING_QUERY && !__DOS_HAS_LIST_UNSUB
1349 describe       FROM_MISSP_REPLYTO    From misspaced, has Reply-To
1350 #score          FROM_MISSP_REPLYTO    2.500     # limit
1351 ##} FROM_MISSP_REPLYTO
1352
1353 ##{ FROM_MISSP_SPF_FAIL ifplugin Mail::SpamAssassin::Plugin::SPF
1354
1355 ifplugin Mail::SpamAssassin::Plugin::SPF
1356   meta           FROM_MISSP_SPF_FAIL  (__FROM_RUNON && SPF_FAIL)
1357   tflags         FROM_MISSP_SPF_FAIL  net
1358 #  score          FROM_MISSP_SPF_FAIL  2.00     # limit
1359 endif
1360 ##} FROM_MISSP_SPF_FAIL ifplugin Mail::SpamAssassin::Plugin::SPF
1361
1362 ##{ FROM_MISSP_USER
1363
1364 meta           FROM_MISSP_USER       (__FROM_RUNON && NSL_RCVD_FROM_USER)
1365 describe       FROM_MISSP_USER       From misspaced, from "User"
1366 ##} FROM_MISSP_USER
1367
1368 ##{ FROM_NEWDOM_BTC if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS
1369
1370 if (version >= 3.004001)
1371 ifplugin Mail::SpamAssassin::Plugin::AskDNS
1372 meta     FROM_NEWDOM_BTC __PDS_BTC_ID && __PDS_NEWDOMAIN
1373 describe FROM_NEWDOM_BTC Newdomain with Bitcoin ID
1374 #score    FROM_NEWDOM_BTC 2.0 # limit
1375 tflags   FROM_NEWDOM_BTC net
1376 endif
1377 endif
1378 ##} FROM_NEWDOM_BTC if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS
1379
1380 ##{ FROM_NTLD_LINKBAIT if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1381
1382 if (version >= 3.004002)
1383 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1384 meta     FROM_NTLD_LINKBAIT __LCL__KAM_BODY_LENGTH_LT_512 && __FROM_ADDRLIST_SUSPNTLD && __BODY_URI_ONLY
1385 tflags   FROM_NTLD_LINKBAIT publish
1386 describe FROM_NTLD_LINKBAIT From abused NTLD with little more than a URI
1387 #score    FROM_NTLD_LINKBAIT 2.0 # limit
1388 endif
1389 endif
1390 ##} FROM_NTLD_LINKBAIT if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1391
1392 ##{ FROM_NTLD_REPLY_FREEMAIL if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1393
1394 if (version >= 3.004002)
1395 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1396 meta     FROM_NTLD_REPLY_FREEMAIL FREEMAIL_FORGED_REPLYTO && __FROM_ADDRLIST_SUSPNTLD
1397 tflags   FROM_NTLD_REPLY_FREEMAIL publish
1398 describe FROM_NTLD_REPLY_FREEMAIL From abused NTLD and Reply-To is FREEMAIL
1399 #score    FROM_NTLD_REPLY_FREEMAIL 2.0 # limit
1400 endif
1401 endif
1402 ##} FROM_NTLD_REPLY_FREEMAIL if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1403
1404 ##{ FROM_NUMBERO_NEWDOMAIN if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS
1405
1406 if (version >= 3.004001)
1407 ifplugin Mail::SpamAssassin::Plugin::AskDNS
1408 meta     FROM_NUMBERO_NEWDOMAIN __NUMBERONLY_TLD && __PDS_NEWDOMAIN
1409 describe FROM_NUMBERO_NEWDOMAIN Fingerprint and new domain
1410 #score    FROM_NUMBERO_NEWDOMAIN 2.0 # limit
1411 tflags   FROM_NUMBERO_NEWDOMAIN net publish
1412 endif
1413 endif
1414 ##} FROM_NUMBERO_NEWDOMAIN if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS
1415
1416 ##{ FROM_PAYPAL_SPOOF if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1417
1418 if (version >= 3.004002)
1419 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1420 meta     FROM_PAYPAL_SPOOF  !__NOT_SPOOFED && __FROM_ADDRLIST_PAYPAL && (! NO_RELAYS && ! ALL_TRUSTED)
1421 tflags   FROM_PAYPAL_SPOOF  publish net
1422 describe FROM_PAYPAL_SPOOF  From PayPal domain but matches SPOOFED
1423 #score    FROM_PAYPAL_SPOOF  1.6 # limit
1424 endif
1425 endif
1426 ##} FROM_PAYPAL_SPOOF if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1427
1428 ##{ FROM_SUSPICIOUS_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1429
1430 if (version >= 3.004002)
1431 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1432 meta     FROM_SUSPICIOUS_NTLD __FROM_ADDRLIST_SUSPNTLD
1433 tflags   FROM_SUSPICIOUS_NTLD publish
1434 describe FROM_SUSPICIOUS_NTLD From abused NTLD
1435 #score    FROM_SUSPICIOUS_NTLD 0.5 # limit
1436 endif
1437 endif
1438 ##} FROM_SUSPICIOUS_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1439
1440 ##{ FROM_SUSPICIOUS_NTLD_FP if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1441
1442 if (version >= 3.004002)
1443 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1444 meta     FROM_SUSPICIOUS_NTLD_FP __FROM_ADDRLIST_SUSPNTLD && !__HAS_SENDER && !__HAS_IN_REPLY_TO && !__HAS_X_MAILING_LIST
1445 tflags   FROM_SUSPICIOUS_NTLD_FP publish
1446 describe FROM_SUSPICIOUS_NTLD_FP From abused NTLD
1447 #score    FROM_SUSPICIOUS_NTLD_FP 2.0 # limit
1448 endif
1449 endif
1450 ##} FROM_SUSPICIOUS_NTLD_FP if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1451
1452 ##{ FROM_UNBAL1
1453
1454 header   FROM_UNBAL1    From:raw =~ / < [^>]* $/xm
1455 describe FROM_UNBAL1    From with unbalanced angle brackets, '>' missing
1456 ##} FROM_UNBAL1
1457
1458 ##{ FSL_BULK_SIG
1459
1460 meta     FSL_BULK_SIG          (DCC_CHECK || RAZOR2_CHECK || PYZOR_CHECK) && !__FSL_HAS_LIST_UNSUB && !__UNSUB_LINK && !__DOS_HAS_LIST_UNSUB && !__RCVD_IN_DNSWL && !__JM_REACTOR_DATE && !__RCD_RDNS_SMTP && !__RCD_RDNS_SMTP_MESSY && !__USING_VERP1 && !__KAM_BODY_LENGTH_LT_128
1461 describe FSL_BULK_SIG          Bulk signature with no Unsubscribe
1462 #score    FSL_BULK_SIG          2.500   # limit
1463 tflags   FSL_BULK_SIG          net publish
1464 ##} FSL_BULK_SIG
1465
1466 ##{ FSL_CTYPE_WIN1251
1467
1468 header   FSL_CTYPE_WIN1251   Content-Type =~ /charset="Windows-1251"/
1469 describe FSL_CTYPE_WIN1251   Content-Type only seen in 419 spam
1470 ##} FSL_CTYPE_WIN1251
1471
1472 ##{ FSL_FAKE_HOTMAIL_RVCD
1473
1474 header  FSL_FAKE_HOTMAIL_RVCD   X-Spam-Relays-External =~ /mx[1234]\.hotmail\.com/
1475 ##} FSL_FAKE_HOTMAIL_RVCD
1476
1477 ##{ FSL_HAS_TINYURL
1478
1479 uri FSL_HAS_TINYURL /tinyurl\.com\//
1480 ##} FSL_HAS_TINYURL
1481
1482 ##{ FSL_HELO_BARE_IP_1
1483
1484 meta    FSL_HELO_BARE_IP_1        __FSL_HELO_BARE_IP_1 && !ALL_TRUSTED
1485 ##} FSL_HELO_BARE_IP_1
1486
1487 ##{ FSL_HELO_DEVICE
1488
1489 header  FSL_HELO_DEVICE         X-Spam-Relays-External =~ /\bhelo=(?:(?:dsl)?device|speedtouch)\.lan\b/i
1490 ##} FSL_HELO_DEVICE
1491
1492 ##{ FSL_HELO_NON_FQDN_1
1493
1494 header  FSL_HELO_NON_FQDN_1     X-Spam-Relays-External =~ /^[^\]]+ helo=[a-zA-Z0-9-_]+ /i
1495 ##} FSL_HELO_NON_FQDN_1
1496
1497 ##{ FSL_HELO_SETUP
1498
1499 header  FSL_HELO_SETUP          X-Spam-Relays-External =~ /\bhelo=\S+\.setup\b/i
1500 ##} FSL_HELO_SETUP
1501
1502 ##{ FSL_INTERIA_ABUSE
1503
1504 uri FSL_INTERIA_ABUSE /\/\S+\.(?:w|eu|fm)\.interia\.pl/
1505 ##} FSL_INTERIA_ABUSE
1506
1507 ##{ FSL_NEW_HELO_USER
1508
1509 meta    FSL_NEW_HELO_USER   (__FSL_HELO_USER_1 || __FSL_HELO_USER_2 || __FSL_HELO_USER_3)
1510 describe  FSL_NEW_HELO_USER Spam's using Helo and User
1511 #score   FSL_NEW_HELO_USER   2.0
1512 tflags  FSL_NEW_HELO_USER   publish
1513 ##} FSL_NEW_HELO_USER
1514
1515 ##{ FUZZY_AMAZON ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1516
1517 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1518   body          FUZZY_AMAZON        /(?:^|\W)(?=<A>)(?!amazon)<A><M><A><Z><O><N>(?:$|\W)/i
1519   describe      FUZZY_AMAZON        Obfuscated "amazon"
1520   tflags        FUZZY_AMAZON        publish
1521 endif
1522 ##} FUZZY_AMAZON ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1523
1524 ##{ FUZZY_ANDROID ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1525
1526 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1527   body          FUZZY_ANDROID       /(?=<A>)(?!android)<A><N><D><R><O><I><D>/i
1528   describe      FUZZY_ANDROID       Obfuscated "android"
1529   tflags        FUZZY_ANDROID       publish
1530 endif
1531 ##} FUZZY_ANDROID ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1532
1533 ##{ FUZZY_APPLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1534
1535 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1536   body          FUZZY_APPLE         /(?:^|\W)(?=<A>)(?!appl[ey])<A><P><P><L><E>(?:$|\W)/i
1537   describe      FUZZY_APPLE         Obfuscated "apple"
1538   tflags        FUZZY_APPLE         publish
1539 endif
1540 ##} FUZZY_APPLE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1541
1542 ##{ FUZZY_BITCOIN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1543
1544 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1545   body          FUZZY_BITCOIN       /(?=<B>)(?!bit[-\s]?coin)<B>[-\s]?<I>[-\s]?<T>[-\s]?<C>[-\s]?<O>[-\s]?<I>[-\s]?<N>/i
1546   describe      FUZZY_BITCOIN       Obfuscated "Bitcoin"
1547   tflags        FUZZY_BITCOIN       publish
1548 endif
1549 ##} FUZZY_BITCOIN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1550
1551 ##{ FUZZY_BROWSER ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1552
1553 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1554   body          FUZZY_BROWSER       /(?=<B>)(?!browser)<B><R><O><W><S><E><R>/i
1555   describe      FUZZY_BROWSER       Obfuscated "browser"
1556   tflags        FUZZY_BROWSER       publish
1557 endif
1558 ##} FUZZY_BROWSER ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1559
1560 ##{ FUZZY_BTC_WALLET ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1561
1562 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1563   meta          FUZZY_BTC_WALLET    FUZZY_BITCOIN && FUZZY_WALLET
1564   describe      FUZZY_BTC_WALLET    Heavily obfuscated "bitcoin wallet"
1565   tflags        FUZZY_BTC_WALLET    publish
1566 endif
1567 ##} FUZZY_BTC_WALLET ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1568
1569 ##{ FUZZY_CLICK_HERE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1570
1571 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1572   body          FUZZY_CLICK_HERE    /(?=<C>)(?!click(?:\s|&nbsp;)here)<C><WS>*<L><WS>*<I><WS>*<C><WS>*<K><WS>+<H><WS>*<E><WS>*<R><WS>*<E>/i
1573   describe      FUZZY_CLICK_HERE    Obfuscated "click here"
1574   tflags        FUZZY_CLICK_HERE    publish
1575 endif
1576 ##} FUZZY_CLICK_HERE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1577
1578 ##{ FUZZY_DR_OZ ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1579
1580 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1581   meta          FUZZY_DR_OZ         __FUZZY_DR_OZ && !__VIA_ML
1582   describe      FUZZY_DR_OZ         Obfuscated Doctor Oz
1583   tflags        FUZZY_DR_OZ         publish
1584 endif
1585 ##} FUZZY_DR_OZ ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1586
1587 ##{ FUZZY_FACEBOOK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1588
1589 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1590   body          FUZZY_FACEBOOK      /(?=<F>)(?!fa[ck]ebook)<F><A><C><E><B><O><O><K>/i
1591   describe      FUZZY_FACEBOOK      Obfuscated "facebook"
1592   tflags        FUZZY_FACEBOOK      publish
1593 endif
1594 ##} FUZZY_FACEBOOK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1595
1596 ##{ FUZZY_IMPORTANT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1597
1598 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1599   body          FUZZY_IMPORTANT     /(?=<I>)(?!important)<I>(?:<M>|<N>)<P><O><R><T><A><N><T>/i
1600   describe      FUZZY_IMPORTANT     Obfuscated "important"
1601   tflags        FUZZY_IMPORTANT     publish
1602 endif
1603 ##} FUZZY_IMPORTANT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1604
1605 ##{ FUZZY_MERIDIA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1606
1607 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1608 body FUZZY_MERIDIA      /<inter W3><post P2>\b(?!meridia)<M><E><R><I><D><I><A>\b/i
1609 describe FUZZY_MERIDIA  Obfuscation of the word "meridia"
1610 endif
1611 ##} FUZZY_MERIDIA ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1612
1613 ##{ FUZZY_MICROSOFT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1614
1615 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1616   body          FUZZY_MICROSOFT     /(?=<M>)(?!microsoft)<M><I><C><R><O><S><O><F><T>/i
1617   describe      FUZZY_MICROSOFT     Obfuscated "microsoft"
1618   tflags        FUZZY_MICROSOFT     publish
1619 endif
1620 ##} FUZZY_MICROSOFT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1621
1622 ##{ FUZZY_MONERO
1623
1624 meta          FUZZY_MONERO        __FUZZY_MONERO
1625 describe      FUZZY_MONERO        Obfuscated "Monero"
1626 tflags        FUZZY_MONERO        publish
1627 ##} FUZZY_MONERO
1628
1629 ##{ FUZZY_NORTON ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1630
1631 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1632   body          FUZZY_NORTON        /(?:^|\W)(?=<N>)(?!norton)<N><O><R><T><O><N>(?:$|\W)/i
1633   describe      FUZZY_NORTON        Obfuscated "norton"
1634   tflags        FUZZY_NORTON        publish
1635 endif
1636 ##} FUZZY_NORTON ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1637
1638 ##{ FUZZY_OVERSTOCK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1639
1640 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1641   body          FUZZY_OVERSTOCK     /(?:^|\W)(?=<O>)(?!over[-\s]?stock)<O><V><E><R>[-\s]?<S><T><O><C><K>(?:$|\W)/i
1642   describe      FUZZY_OVERSTOCK     Obfuscated "overstock"
1643   tflags        FUZZY_OVERSTOCK     publish
1644 endif
1645 ##} FUZZY_OVERSTOCK ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1646
1647 ##{ FUZZY_PAYPAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1648
1649 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1650   body          FUZZY_PAYPAL        /(?:^|\W)(?=<P>)(?!pay[-\s]?pal)<P><A><Y>[-\s]?<P><A><L>(?:$|\W)/i
1651   describe      FUZZY_PAYPAL        Obfuscated "paypal"
1652   tflags        FUZZY_PAYPAL        publish
1653 endif
1654 ##} FUZZY_PAYPAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1655
1656 ##{ FUZZY_PORN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1657
1658 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1659   meta          FUZZY_PORN          __FUZZY_PORN && !( __ENV_AND_HDR_FROM_MATCH && __SENDER_BOT )
1660   describe      FUZZY_PORN          Obfuscated "Pornography" or "Pornographic"
1661   tflags        FUZZY_PORN          publish
1662 endif
1663 ##} FUZZY_PORN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1664
1665 ##{ FUZZY_PRIVACY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1666
1667 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1668   body          FUZZY_PRIVACY       /(?=<P>)(?!privacy)<P><R><I><V><A><C><Y>/i
1669   describe      FUZZY_PRIVACY       Obfuscated "privacy"
1670   tflags        FUZZY_PRIVACY       publish
1671 endif
1672 ##} FUZZY_PRIVACY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1673
1674 ##{ FUZZY_PROMOTION ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1675
1676 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1677   body          FUZZY_PROMOTION     /(?=<P>)(?!promotion)<P><R><O><M><O><T><I><O><N>/i
1678   describe      FUZZY_PROMOTION     Obfuscated "promotion"
1679   tflags        FUZZY_PROMOTION     publish
1680 endif
1681 ##} FUZZY_PROMOTION ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1682
1683 ##{ FUZZY_SAVINGS ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1684
1685 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1686   body          FUZZY_SAVINGS       /(?=<S>)(?!savings)<S><A><V><I><N><G><S>/i
1687   describe      FUZZY_SAVINGS       Obfuscated "savings"
1688   tflags        FUZZY_SAVINGS       publish
1689 endif
1690 ##} FUZZY_SAVINGS ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1691
1692 ##{ FUZZY_SECURITY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1693
1694 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1695   body          FUZZY_SECURITY      /(?=<S>)(?!security)(?!seguridad)(?!s\xc3\xa9curit\xc3\xa9)<S><E>(?:<C>|<G>)<U><R><I>(?:<T><Y>|<D><A><D>)/i
1696   describe      FUZZY_SECURITY      Obfuscated "security"
1697   tflags        FUZZY_SECURITY      publish
1698 endif
1699 ##} FUZZY_SECURITY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1700
1701 ##{ FUZZY_UNSUBSCRIBE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1702
1703 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1704   body          FUZZY_UNSUBSCRIBE   /(?=<U>)(?!unsubscribe)<U><N><S><U><B><S><C><R><I><B><E>/i
1705   describe      FUZZY_UNSUBSCRIBE   Obfuscated "unsubscribe"
1706   tflags        FUZZY_UNSUBSCRIBE   publish
1707 endif
1708 ##} FUZZY_UNSUBSCRIBE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1709
1710 ##{ FUZZY_WALLET ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1711
1712 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1713   body          FUZZY_WALLET        /(?=<W>)(?!wallet)<W><A><L><L><E><T>/i
1714   describe      FUZZY_WALLET        Obfuscated "Wallet"
1715   tflags        FUZZY_WALLET        publish
1716 endif
1717 ##} FUZZY_WALLET ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
1718
1719 ##{ GAPPY_SALES_LEADS_FREEM if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1720
1721 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1722   meta       GAPPY_SALES_LEADS_FREEM     __GAPPY_SALES_LEADS_MANY && (__REPTO_CHN_FREEM || __freemail_hdr_replyto)
1723   describe   GAPPY_SALES_LEADS_FREEM     Obfuscated marketing text, freemail or CHN replyto
1724 #  score      GAPPY_SALES_LEADS_FREEM     3.500 # limit
1725   tflags     GAPPY_SALES_LEADS_FREEM     publish
1726 endif
1727 ##} GAPPY_SALES_LEADS_FREEM if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
1728
1729 ##{ GB_BITCOIN_CP
1730
1731 meta     GB_BITCOIN_CP        ( __GB_BITCOIN_CP_DE || __GB_BITCOIN_CP_ES || __GB_BITCOIN_CP_EN || __GB_BITCOIN_CP_FR || __GB_BITCOIN_CP_IT || __GB_BITCOIN_CP_NL || __GB_BITCOIN_CP_SE )
1732 describe GB_BITCOIN_CP        Localized Bitcoin scam
1733 #score    GB_BITCOIN_CP        3.0 # limit
1734 ##} GB_BITCOIN_CP
1735
1736 ##{ GB_BITCOIN_NH
1737
1738 meta     GB_BITCOIN_NH        ( __BITCOIN_ID && !__URL_BTC_ID && ( __NEVER_HEAR_EN || __NEVER_HEAR_IT ) )
1739 describe GB_BITCOIN_NH        Localized Bitcoin scam
1740 #score    GB_BITCOIN_NH        3.0 # limit
1741 ##} GB_BITCOIN_NH
1742
1743 ##{ GB_CUSTOM_HTM_URI if (version >= 4.000000) if can(Mail::SpamAssassin::Conf::feature_capture_rules)
1744
1745 if (version >= 4.000000)
1746 if can(Mail::SpamAssassin::Conf::feature_capture_rules)
1747   meta          GB_CUSTOM_HTM_URI       ( __GB_CUSTOM_HTM_URI0 || __GB_CUSTOM_HTM_URI1 || __GB_CUSTOM_HTM_URI2 || __GB_DRUPAL_URI )
1748   describe      GB_CUSTOM_HTM_URI       Custom html uri
1749 #  score         GB_CUSTOM_HTM_URI       1.500 # limit
1750   tflags        GB_CUSTOM_HTM_URI       publish
1751 endif
1752 endif
1753 ##} GB_CUSTOM_HTM_URI if (version >= 4.000000) if can(Mail::SpamAssassin::Conf::feature_capture_rules)
1754
1755 ##{ GB_FAKE_RF_SHORT
1756
1757 meta       GB_FAKE_RF_SHORT              ( ! __THREADED && __GB_FAKE_RF && __URL_SHORTENER )
1758 describe   GB_FAKE_RF_SHORT              Fake reply or forward with url shortener
1759 #score      GB_FAKE_RF_SHORT              2.000 # limit
1760 tflags     GB_FAKE_RF_SHORT              publish
1761 ##} GB_FAKE_RF_SHORT
1762
1763 ##{ GB_FORGED_MUA_POSTFIX
1764
1765 meta         GB_FORGED_MUA_POSTFIX      ( __FORGED_MUA_POSTFIX0 || __FORGED_MUA_POSTFIX1 )
1766 describe     GB_FORGED_MUA_POSTFIX      Forged Postfix mua headers
1767 tflags       GB_FORGED_MUA_POSTFIX      publish
1768 #score       GB_FORGED_MUA_POSTFIX      2.0 # limit
1769 ##} GB_FORGED_MUA_POSTFIX
1770
1771 ##{ GB_FREEMAIL_DISPTO ifplugin Mail::SpamAssassin::Plugin::FreeMail
1772
1773 ifplugin Mail::SpamAssassin::Plugin::FreeMail
1774   meta     GB_FREEMAIL_DISPTO  ( __FREEMAIL_DISPTO && !__freemail_safe )
1775   describe GB_FREEMAIL_DISPTO  Disposition-Notification-To/From or Disposition-Notification-To/body contain different freemails
1776 #  score    GB_FREEMAIL_DISPTO  0.50 # limit
1777   tflags   GB_FREEMAIL_DISPTO  publish
1778 endif
1779 ##} GB_FREEMAIL_DISPTO ifplugin Mail::SpamAssassin::Plugin::FreeMail
1780
1781 ##{ GB_FREEMAIL_DISPTO_NOTFREEM ifplugin Mail::SpamAssassin::Plugin::FreeMail
1782
1783 ifplugin Mail::SpamAssassin::Plugin::FreeMail
1784   meta     GB_FREEMAIL_DISPTO_NOTFREEM  ( __FREEMAIL_DISPTO && !__freemail_safe && !FREEMAIL_FROM )
1785   describe GB_FREEMAIL_DISPTO_NOTFREEM  Disposition-Notification-To/From contain different freemails but mailfrom is not a freemail
1786 #  score    GB_FREEMAIL_DISPTO_NOTFREEM  0.50 # limit
1787   tflags   GB_FREEMAIL_DISPTO_NOTFREEM  publish
1788 endif
1789 ##} GB_FREEMAIL_DISPTO_NOTFREEM ifplugin Mail::SpamAssassin::Plugin::FreeMail
1790
1791 ##{ GB_GOOGLE_OBFUR
1792
1793 uri         GB_GOOGLE_OBFUR     /^https:\/\/www\.google\.([a-z]{2,3})\/url\?sa=t\&rct=j\&q=\&esrc=s\&source=web\&cd=([0-9])*\&(cad=rja\&uact=([0-9]+)\&ved=.{1,50}\&)?url=https?:\/\/.{1,50}(&usg=.{1,50})?/
1794 describe    GB_GOOGLE_OBFUR     Obfuscate url through Google redirect
1795 #score       GB_GOOGLE_OBFUR     0.75 # limit
1796 tflags      GB_GOOGLE_OBFUR     publish
1797 ##} GB_GOOGLE_OBFUR
1798
1799 ##{ GB_HASHBL_BTC if (version >= 3.004003) ifplugin Mail::SpamAssassin::Plugin::HashBL
1800
1801 if (version >= 3.004003)
1802   ifplugin Mail::SpamAssassin::Plugin::HashBL
1803     body          GB_HASHBL_BTC eval:check_hashbl_bodyre('bl.btcblack.it', 'raw/max=10/shuffle', '\b(?<!=)([13][a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[acdefghjklmnpqrstuvwxyz234567890]{30,62})\b')
1804     tflags        GB_HASHBL_BTC net publish
1805     describe      GB_HASHBL_BTC Message contains BTC address found on BTCBL
1806 #    score         GB_HASHBL_BTC 5.0 # limit
1807 endif
1808 endif
1809 ##} GB_HASHBL_BTC if (version >= 3.004003) ifplugin Mail::SpamAssassin::Plugin::HashBL
1810
1811 ##{ GB_STORAGE_GOOGLE_EMAIL if (version >= 4.000000) if can(Mail::SpamAssassin::Conf::feature_capture_rules)
1812
1813 if (version >= 4.000000)
1814 if can(Mail::SpamAssassin::Conf::feature_capture_rules)
1815   uri           GB_STORAGE_GOOGLE_EMAIL m|^https?://storage\.cloud\.google\.com/.{4,128}\#%{GB_TO_ADDR}|i
1816   describe      GB_STORAGE_GOOGLE_EMAIL Google storage cloud abuse
1817 #  score         GB_STORAGE_GOOGLE_EMAIL 2.000 # limit
1818   tflags        GB_STORAGE_GOOGLE_EMAIL publish
1819 endif
1820 endif
1821 ##} GB_STORAGE_GOOGLE_EMAIL if (version >= 4.000000) if can(Mail::SpamAssassin::Conf::feature_capture_rules)
1822
1823 ##{ GB_URI_FLEEK_STO_HTM
1824
1825 uri        GB_URI_FLEEK_STO_HTM          m,^https?://storageapi\.fleek\.co/.*\.html?,i
1826 describe   GB_URI_FLEEK_STO_HTM          Html file stored on Fleek cloud
1827 #score      GB_URI_FLEEK_STO_HTM          1.000 # limit
1828 tflags     GB_URI_FLEEK_STO_HTM          multiple maxhits=5
1829 ##} GB_URI_FLEEK_STO_HTM
1830
1831 ##{ GEO_QUERY_STRING
1832
1833 uri     GEO_QUERY_STRING        /^http:\/\/(?:\w{2,4}\.)?geocities\.com(?::\d*)?\/.+?\/\?/i
1834 ##} GEO_QUERY_STRING
1835
1836 ##{ GOOGLE_DOCS_PHISH
1837
1838 meta        GOOGLE_DOCS_PHISH    (__GOOGLE_DOCS_PHISH_1 || __GOOGLE_DOCS_PHISH_2)
1839 describe    GOOGLE_DOCS_PHISH    Possible phishing via a Google Docs form
1840 #score       GOOGLE_DOCS_PHISH    3.00  # limit
1841 tflags      GOOGLE_DOCS_PHISH    publish
1842 ##} GOOGLE_DOCS_PHISH
1843
1844 ##{ GOOGLE_DOCS_PHISH_MANY
1845
1846 meta        GOOGLE_DOCS_PHISH_MANY  __URI_GOOGLE_DOC && (__EMAIL_PHISH_MANY || __ACCT_PHISH_MANY)
1847 describe    GOOGLE_DOCS_PHISH_MANY  Phishing via a Google Docs form
1848 #score       GOOGLE_DOCS_PHISH_MANY  4.00       # limit
1849 tflags      GOOGLE_DOCS_PHISH_MANY  publish
1850 ##} GOOGLE_DOCS_PHISH_MANY
1851
1852 ##{ GOOGLE_DOC_SUSP
1853
1854 meta        GOOGLE_DOC_SUSP      __GOOGLE_DOC_SUSP && !GOOGLE_DOCS_PHISH_MANY && !__HAS_SENDER && !__RCD_RDNS_MTA_MESSY && !__LYRIS_EZLM_REMAILER && !__USING_VERP1 && !__RCD_RDNS_SMTP && !__HAS_THREAD_INDEX && !__RCD_RDNS_SMTP && ! __HAS_LIST_ID && !__SURVEY && !__BUGGED_IMG
1855 describe    GOOGLE_DOC_SUSP      Suspicious use of Google Docs
1856 #score       GOOGLE_DOC_SUSP      3.000 # limit
1857 tflags      GOOGLE_DOC_SUSP      publish
1858 ##} GOOGLE_DOC_SUSP
1859
1860 ##{ GOOGLE_DRIVE_REPLY_BAD_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1861
1862 if (version >= 3.004002)
1863 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1864 meta     GOOGLE_DRIVE_REPLY_BAD_NTLD __PDS_GOOGLE_DRIVE_SHARE && __REPLYTO_ADDRLIST_SUSPNTLD
1865 tflags   GOOGLE_DRIVE_REPLY_BAD_NTLD publish
1866 describe GOOGLE_DRIVE_REPLY_BAD_NTLD From Google Drive and Reply-To is from a suspicious TLD
1867 #score    GOOGLE_DRIVE_REPLY_BAD_NTLD 1.0 # limit
1868 endif
1869 endif
1870 ##} GOOGLE_DRIVE_REPLY_BAD_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
1871
1872 ##{ GOOG_MALWARE_DNLD
1873
1874 meta      GOOG_MALWARE_DNLD             __GOOG_MALWARE_DNLD
1875 describe  GOOG_MALWARE_DNLD             File download via Google - Malware?
1876 #score     GOOG_MALWARE_DNLD             5.000   # limit
1877 tflags    GOOG_MALWARE_DNLD             publish
1878 ##} GOOG_MALWARE_DNLD
1879
1880 ##{ GOOG_REDIR_DOCUSIGN
1881
1882 uri        GOOG_REDIR_DOCUSIGN         m;://www\.google\.com/url\?.*q=https?://www\.docusign\.com/;i
1883 describe   GOOG_REDIR_DOCUSIGN         Indirect docusign link, probable phishing
1884 tflags     GOOG_REDIR_DOCUSIGN         publish
1885 ##} GOOG_REDIR_DOCUSIGN
1886
1887 ##{ GOOG_REDIR_HTML_ONLY
1888
1889 meta      GOOG_REDIR_HTML_ONLY          (__GOOG_REDIR && MIME_HTML_ONLY) && !RDNS_NONE && !__LCL__KAM_BODY_LENGTH_LT_512
1890 describe  GOOG_REDIR_HTML_ONLY          Google redirect to obscure spamvertised website + HTML only
1891 #score     GOOG_REDIR_HTML_ONLY          2.000  # limit
1892 ##} GOOG_REDIR_HTML_ONLY
1893
1894 ##{ GOOG_REDIR_NORDNS
1895
1896 meta      GOOG_REDIR_NORDNS             __GOOG_REDIR && RDNS_NONE
1897 describe  GOOG_REDIR_NORDNS             Google redirect to obscure spamvertised website + no rDNS
1898 ##} GOOG_REDIR_NORDNS
1899
1900 ##{ GOOG_REDIR_SHORT
1901
1902 meta      GOOG_REDIR_SHORT              __GOOG_REDIR && __LCL__KAM_BODY_LENGTH_LT_512
1903 describe  GOOG_REDIR_SHORT              Google redirect to obscure spamvertised website + short message
1904 tflags    GOOG_REDIR_SHORT              publish
1905 ##} GOOG_REDIR_SHORT
1906
1907 ##{ GOOG_STO_EMAIL_PHISH
1908
1909 meta        GOOG_STO_EMAIL_PHISH       __URI_GOOG_STO_EMAIL && (__PDS_FROM_NAME_TO_DOMAIN || __TO_IN_SUBJ || __FROM_ADMIN || __VERIFY_ACCOUNT)
1910 describe    GOOG_STO_EMAIL_PHISH       Possible phishing with google hosted content URI having email address
1911 #score       GOOG_STO_EMAIL_PHISH       3.00    # limit
1912 tflags      GOOG_STO_EMAIL_PHISH       publish
1913 ##} GOOG_STO_EMAIL_PHISH
1914
1915 ##{ GOOG_STO_HTML_PHISH
1916
1917 meta        GOOG_STO_HTML_PHISH       __GOOG_STO_HTML_PHISH
1918 describe    GOOG_STO_HTML_PHISH       Possible phishing with google content hosting to avoid URIBL
1919 #score       GOOG_STO_HTML_PHISH       3.00     # limit
1920 tflags      GOOG_STO_HTML_PHISH       publish
1921 ##} GOOG_STO_HTML_PHISH
1922
1923 ##{ GOOG_STO_HTML_PHISH_MANY
1924
1925 meta        GOOG_STO_HTML_PHISH_MANY  __URI_GOOG_STO_HTML && (__EMAIL_PHISH_MANY || __ACCT_PHISH_MANY)
1926 describe    GOOG_STO_HTML_PHISH_MANY  Phishing with google content hosting to avoid URIBL
1927 #score       GOOG_STO_HTML_PHISH_MANY  4.00     # limit
1928 tflags      GOOG_STO_HTML_PHISH_MANY  publish
1929 ##} GOOG_STO_HTML_PHISH_MANY
1930
1931 ##{ GOOG_STO_IMG_HTML
1932
1933 meta       GOOG_STO_IMG_HTML          __GOOG_STO_IMG_HTML_1 && !URI_GOOG_STO_SPAMMY
1934 describe   GOOG_STO_IMG_HTML          Apparently using google content hosting to avoid URIBL
1935 #score      GOOG_STO_IMG_HTML          3.000    # limit
1936 tflags     GOOG_STO_IMG_HTML          publish
1937 ##} GOOG_STO_IMG_HTML
1938
1939 ##{ GOOG_STO_IMG_NOHTML
1940
1941 meta       GOOG_STO_IMG_NOHTML        __GOOG_STO_IMG_NOHTML && (__RDNS_NONE || HTML_TEXT_INVISIBLE_STYLE || THIS_AD || __SUBJECT_ENCODED_B64 || __LOTTO_ADMITS || __REPTO_QUOTE) && !__USING_VERP1 && !__HAS_ERRORS_TO && !__RCD_RDNS_MTA_MESSY && !__LYRIS_EZLM_REMAILER && !__HAS_CID && !URI_GOOG_STO_SPAMMY
1942 describe   GOOG_STO_IMG_NOHTML        Apparently using google content hosting to avoid URIBL
1943 #score      GOOG_STO_IMG_NOHTML        2.500    # limit
1944 tflags     GOOG_STO_IMG_NOHTML        publish
1945 ##} GOOG_STO_IMG_NOHTML
1946
1947 ##{ GOOG_STO_NOIMG_HTML
1948
1949 meta       GOOG_STO_NOIMG_HTML        __GOOG_STO_NOIMG_HTML && !URI_GOOG_STO_SPAMMY
1950 describe   GOOG_STO_NOIMG_HTML        Apparently using google content hosting to avoid URIBL
1951 #score      GOOG_STO_NOIMG_HTML        3.000    # limit
1952 tflags     GOOG_STO_NOIMG_HTML        publish
1953 ##} GOOG_STO_NOIMG_HTML
1954
1955 ##{ HAS_X_NO_RELAY
1956
1957 meta      HAS_X_NO_RELAY                __HAS_X_NO_RELAY && !__TO_EQ_FROM_1
1958 describe  HAS_X_NO_RELAY                Has spammy header
1959 #score     HAS_X_NO_RELAY                2.500  # limit
1960 tflags    HAS_X_NO_RELAY                publish
1961 ##} HAS_X_NO_RELAY
1962
1963 ##{ HAS_X_OUTGOING_SPAM_STAT
1964
1965 meta       HAS_X_OUTGOING_SPAM_STAT    __HAS_X_OUTGOING_SPAM_STAT && !MAILING_LIST_MULTI && !__HAS_X_MAILMAN_VERSION && !__AUTOREPLY_ASU && !__THREAD_INDEX_GOOD && !__HAS_X_LOOP && !__DOC_ATTACH && !__PDF_ATTACH && !__FROM_EQ_ORG_1 && !__HAS_IN_REPLY_TO
1966 describe   HAS_X_OUTGOING_SPAM_STAT    Has header claiming outbound spam scan - why trust the results?
1967 #score      HAS_X_OUTGOING_SPAM_STAT    2.000   # limit
1968 tflags     HAS_X_OUTGOING_SPAM_STAT    publish
1969 ##} HAS_X_OUTGOING_SPAM_STAT
1970
1971 ##{ HDRS_LCASE
1972
1973 describe       HDRS_LCASE            Odd capitalization of message header
1974 #score          HDRS_LCASE            0.10      # limit
1975 ##} HDRS_LCASE
1976
1977 ##{ HDRS_LCASE if !plugin(Mail::SpamAssassin::Plugin::FreeMail)
1978
1979 if !plugin(Mail::SpamAssassin::Plugin::FreeMail)
1980   meta         HDRS_LCASE            __HDRS_LCASE && !__HDRS_LCASE_KNOWN && !__VIA_ML && !__THREADED && !__UNUSABLE_MSGID && !__DOS_SINGLE_EXT_RELAY && !__DKIM_EXISTS && !__BUGGED_IMG && !__SUBSCRIPTION_INFO && !NO_RELAYS && !__RDNS_NONE && !__MIME_BASE64 && !__SUBJECT_ENCODED_B64 && !__RCD_RDNS_MX_MESSY && !__HTML_LINK_IMAGE && !__RDNS_SHORT && !__TAG_EXISTS_STYLE && !ALL_TRUSTED && !__NOT_SPOOFED && !__RCD_RDNS_SMTP_MESSY && !__NAKED_TO
1981 endif
1982 ##} HDRS_LCASE if !plugin(Mail::SpamAssassin::Plugin::FreeMail)
1983
1984 ##{ HDRS_LCASE ifplugin Mail::SpamAssassin::Plugin::FreeMail
1985
1986 ifplugin Mail::SpamAssassin::Plugin::FreeMail
1987   meta         HDRS_LCASE            __HDRS_LCASE && !__HDRS_LCASE_KNOWN && !__VIA_ML && !__freemail_safe && !__THREADED && !__UNUSABLE_MSGID && !__DOS_SINGLE_EXT_RELAY && !__DKIM_EXISTS && !__BUGGED_IMG && !__SUBSCRIPTION_INFO && !NO_RELAYS && !__RDNS_NONE && !__MIME_BASE64 && !__SUBJECT_ENCODED_B64 && !__RCD_RDNS_MX_MESSY && !__HTML_LINK_IMAGE && !__RDNS_SHORT && !__TAG_EXISTS_STYLE && !ALL_TRUSTED && !__NOT_SPOOFED && !__RCD_RDNS_SMTP_MESSY && !__NAKED_TO
1988 endif
1989 ##} HDRS_LCASE ifplugin Mail::SpamAssassin::Plugin::FreeMail
1990
1991 ##{ HDRS_LCASE_IMGONLY
1992
1993 meta           HDRS_LCASE_IMGONLY    __HDRS_LCASE && __HTML_IMG_ONLY && !__HDRS_LCASE_KNOWN
1994 describe       HDRS_LCASE_IMGONLY    Odd capitalization of message headers + image-only HTML
1995 #score          HDRS_LCASE_IMGONLY    0.10      # limit
1996 ##} HDRS_LCASE_IMGONLY
1997
1998 ##{ HDRS_MISSP
1999
2000 meta           HDRS_MISSP            __HDRS_MISSP && !ALL_TRUSTED && !(__FROM_ALL_HEX && __SUBJECT_PRESENT_EMPTY)
2001 describe       HDRS_MISSP            Misspaced headers
2002 #score          HDRS_MISSP            2.500     # limit
2003 tflags         HDRS_MISSP            publish
2004 ##} HDRS_MISSP
2005
2006 ##{ HDR_ORDER_FTSDMCXX_001C
2007
2008 meta HDR_ORDER_FTSDMCXX_001C  (__HDR_ORDER_FTSDMCXXXX && __MID_START_001C)
2009 describe HDR_ORDER_FTSDMCXX_001C  Header order similar to spam (FTSDMCXX/MID variant)
2010 ##} HDR_ORDER_FTSDMCXX_001C
2011
2012 ##{ HDR_ORDER_FTSDMCXX_BAT
2013
2014 meta HDR_ORDER_FTSDMCXX_BAT   (__HDR_ORDER_FTSDMCXXXX && __BAT_BOUNDARY)
2015 describe HDR_ORDER_FTSDMCXX_BAT   Header order similar to spam (FTSDMCXX/boundary variant)
2016 ##} HDR_ORDER_FTSDMCXX_BAT
2017
2018 ##{ HDR_ORDER_FTSDMCXX_DIRECT
2019
2020 meta       HDR_ORDER_FTSDMCXX_DIRECT  (__HDR_ORDER_FTSDMCXXXX && __DOS_SINGLE_EXT_RELAY) && !ALL_TRUSTED && !__VIA_ML
2021 describe   HDR_ORDER_FTSDMCXX_DIRECT  Header order similar to spam (FTSDMCXX/boundary variant) + direct-to-MX
2022 #score      HDR_ORDER_FTSDMCXX_DIRECT  2.000    # limit
2023 tflags     HDR_ORDER_FTSDMCXX_DIRECT  publish
2024 ##} HDR_ORDER_FTSDMCXX_DIRECT
2025
2026 ##{ HDR_ORDER_FTSDMCXX_NORDNS
2027
2028 meta       HDR_ORDER_FTSDMCXX_NORDNS  (__HDR_ORDER_FTSDMCXXXX && __RDNS_NONE) && !ALL_TRUSTED
2029 describe   HDR_ORDER_FTSDMCXX_NORDNS  Header order similar to spam (FTSDMCXX/boundary variant) + no rDNS
2030 #score      HDR_ORDER_FTSDMCXX_NORDNS  3.500    # limit
2031 tflags     HDR_ORDER_FTSDMCXX_NORDNS  publish
2032 ##} HDR_ORDER_FTSDMCXX_NORDNS
2033
2034 ##{ HEADER_COUNT_SUBJECT ifplugin Mail::SpamAssassin::Plugin::HeaderEval
2035
2036 ifplugin Mail::SpamAssassin::Plugin::HeaderEval
2037 header HEADER_COUNT_SUBJECT     eval:check_header_count_range('Subject','2','999')
2038 describe HEADER_COUNT_SUBJECT   Multiple Subject headers found
2039 endif
2040 ##} HEADER_COUNT_SUBJECT ifplugin Mail::SpamAssassin::Plugin::HeaderEval
2041
2042 ##{ HEADER_FROM_DIFFERENT_DOMAINS ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::HeaderEval if (version >= 3.004000)
2043
2044 ifplugin Mail::SpamAssassin::Plugin::FreeMail
2045   ifplugin Mail::SpamAssassin::Plugin::HeaderEval
2046     if (version >= 3.004000)
2047       header   HEADER_FROM_DIFFERENT_DOMAINS eval:check_equal_from_domains()
2048       describe HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different
2049 #      score    HEADER_FROM_DIFFERENT_DOMAINS 0.25
2050       tflags   HEADER_FROM_DIFFERENT_DOMAINS publish
2051 endif
2052 endif
2053 endif
2054 ##} HEADER_FROM_DIFFERENT_DOMAINS ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::HeaderEval if (version >= 3.004000)
2055
2056 ##{ HELO_FRIEND
2057
2058 header HELO_FRIEND  X-Spam-Relays-External =~ /^[^\]]+ helo=friend /i
2059 ##} HELO_FRIEND
2060
2061 ##{ HELO_LH_LD
2062
2063 header HELO_LH_LD   X-Spam-Relays-External =~ /^[^\]]+ helo=localhost\.localdomain /i
2064 ##} HELO_LH_LD
2065
2066 ##{ HELO_LOCALHOST
2067
2068 header HELO_LOCALHOST   X-Spam-Relays-External =~ /^[^\]]+ helo=localhost /i
2069 ##} HELO_LOCALHOST
2070
2071 ##{ HELO_MISC_IP
2072
2073 meta            HELO_MISC_IP            (__HELO_MISC_IP && !HELO_DYNAMIC_IPADDR && !HELO_DYNAMIC_IPADDR2 && !HELO_DYNAMIC_SPLIT_IP && !HELO_DYNAMIC_HCC && !HELO_DYNAMIC_DIALIN && ((TVD_RCVD_IP4 + TVD_RCVD_IP + __FSL_HELO_BARE_IP_2) <2))
2074 describe        HELO_MISC_IP            Looking for more Dynamic IP Relays
2075 #score          HELO_MISC_IP            0.25
2076 ##} HELO_MISC_IP
2077
2078 ##{ HELO_NO_DOMAIN
2079
2080 meta     HELO_NO_DOMAIN __HELO_NO_DOMAIN && !HELO_LOCALHOST
2081 describe HELO_NO_DOMAIN Relay reports its domain incorrectly
2082 tflags   HELO_NO_DOMAIN publish
2083 ##} HELO_NO_DOMAIN
2084
2085 ##{ HELO_OEM
2086
2087 header HELO_OEM  X-Spam-Relays-External =~ /^[^\]]+ helo=(?:pc|oem\S*) /i
2088 ##} HELO_OEM
2089
2090 ##{ HEXHASH_WORD
2091
2092 meta        HEXHASH_WORD       (__HEXHASHWORD_S2EU > 1) && !ALL_TRUSTED && !__LYRIS_EZLM_REMAILER && !__MSGID_HEXISH && !__RDNS_SHORT && !__CTYPE_MULTIPART_MIXED && !__HAS_X_REF && !__HAS_IMG_SRC_ONECASE && !__RCD_RDNS_MAIL_MESSY && !__VIA_ML && !__HAS_SENDER
2093 describe    HEXHASH_WORD       Multiple instances of word + hexadecimal hash
2094 #score       HEXHASH_WORD       3.000   # limit
2095 tflags      HEXHASH_WORD       publish
2096 ##} HEXHASH_WORD
2097
2098 ##{ HK_CTE_RAW ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2099
2100 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2101 mimeheader      HK_CTE_RAW              Content-Transfer-Encoding =~ /^raw$/
2102 #score          HK_CTE_RAW              2
2103 tflags          HK_CTE_RAW              publish
2104 endif
2105 ##} HK_CTE_RAW ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2106
2107 ##{ HK_LOTTO
2108
2109 meta            HK_LOTTO                __HK_LOTTO_2 || __HK_LOTTO_STAATS || __HK_LOTTO_BALLOT
2110 #score          HK_LOTTO                1
2111 ##} HK_LOTTO
2112
2113 ##{ HK_NAME_DRUGS
2114
2115 header          HK_NAME_DRUGS           From:name =~ /(viagra|\bcialis|cialis\b)/mi
2116 describe        HK_NAME_DRUGS           From name contains drugs
2117 #score          HK_NAME_DRUGS           2
2118 ##} HK_NAME_DRUGS
2119
2120 ##{ HK_NAME_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail if (version >= 3.004000)
2121
2122 ifplugin Mail::SpamAssassin::Plugin::FreeMail
2123 if (version >= 3.004000)
2124   meta          HK_NAME_MR_MRS          __HK_NAME_MR_MRS && !FREEMAIL_FROM
2125 #  score                HK_NAME_MR_MRS          1.0
2126 endif
2127 endif
2128 ##} HK_NAME_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail if (version >= 3.004000)
2129
2130 ##{ HK_RANDOM_ENVFROM
2131
2132 header          HK_RANDOM_ENVFROM        EnvelopeFrom =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#-]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr)|[^@]{26}|.*?\@.{0,20}\b(?:cmp-info|cmpgnr|cnn|tori|jysk|amadeus|amazon)\.[a-z]{2,3}$)[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi
2133 describe        HK_RANDOM_ENVFROM       Envelope sender username looks random
2134 #score          HK_RANDOM_ENVFROM       1
2135 tflags          HK_RANDOM_ENVFROM       publish
2136 ##} HK_RANDOM_ENVFROM
2137
2138 ##{ HK_RANDOM_FROM
2139
2140 header          HK_RANDOM_FROM              From:addr =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#-]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr)|[^@]{26}|.*?\@.{0,20}\b(?:cmp-info|cmpgnr|cnn|tori|jysk|amadeus|amazon)\.[a-z]{2,3}$)[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi
2141 describe        HK_RANDOM_FROM          From username looks random
2142 #score          HK_RANDOM_FROM          1
2143 tflags          HK_RANDOM_FROM          publish
2144 ##} HK_RANDOM_FROM
2145
2146 ##{ HK_RANDOM_REPLYTO
2147
2148 header          HK_RANDOM_REPLYTO       Reply-To:addr =~ /^(?!(?:mail|bounce)[_.-]|[^@]*(?:[+=^~\#-]|mcgr|kpmg|nlpbr|ndqv|lcgc|cplpr)|[^@]{26}|.*?\@.{0,20}\b(?:cmp-info|cmpgnr|cnn|tori|jysk|amadeus|amazon)\.[a-z]{2,3}$)[^@]*(?:[bcdfgjklmnpqrtvwxz]{5}|[aeiouy]{5}|([a-z]{1,2})(?:\1){3})/mi
2149 describe        HK_RANDOM_REPLYTO       Reply-To username looks random
2150 #score          HK_RANDOM_REPLYTO       1
2151 tflags          HK_RANDOM_REPLYTO       publish
2152 ##} HK_RANDOM_REPLYTO
2153
2154 ##{ HK_RCVD_IP_MULTICAST
2155
2156 header          HK_RCVD_IP_MULTICAST    X-Spam-Relays-External =~ / ip=(?:22[4-9]|23[0-9])\./
2157 #score          HK_RCVD_IP_MULTICAST    2
2158 tflags          HK_RCVD_IP_MULTICAST    publish
2159 ##} HK_RCVD_IP_MULTICAST
2160
2161 ##{ HK_SCAM
2162
2163 meta            HK_SCAM                 __HK_SCAM_N2 || __HK_SCAM_N3 || __HK_SCAM_N8 || __HK_SCAM_N15 || __HK_SCAM_N16 || __HK_SCAM_S1 || __HK_SCAM_S15 || __HK_SCAM_S25
2164 #score          HK_SCAM                 2
2165 tflags          HK_SCAM                 publish
2166 ##} HK_SCAM
2167
2168 ##{ HK_WIN
2169
2170 meta            HK_WIN                  ((__hk_win_2 + __hk_win_3 + __hk_win_4 + __hk_win_5 + __hk_win_7 + __hk_win_8 + __hk_win_9 + __hk_win_0 + __hk_win_a + __hk_win_b + __hk_win_c + __hk_win_d + __hk_win_i + __hk_win_j + __hk_win_l + __hk_win_m + __hk_win_n + __hk_win_o) >= 2)
2171 #score          HK_WIN                  1
2172 ##} HK_WIN
2173
2174 ##{ HOSTED_IMG_DIRECT_MX
2175
2176 meta       HOSTED_IMG_DIRECT_MX        __HOSTED_IMG_DIRECT_MX && !__DKIM_EXISTS
2177 #score      HOSTED_IMG_DIRECT_MX        3.500   # limit
2178 describe   HOSTED_IMG_DIRECT_MX        Image hosted at large ecomm, CDN or hosting site, message direct-to-mx
2179 tflags     HOSTED_IMG_DIRECT_MX        publish
2180 ##} HOSTED_IMG_DIRECT_MX
2181
2182 ##{ HOSTED_IMG_DQ_UNSUB
2183
2184 meta       HOSTED_IMG_DQ_UNSUB         __HOSTED_IMG_DQ_UNSUB
2185 #score      HOSTED_IMG_DQ_UNSUB         3.500   # limit
2186 describe   HOSTED_IMG_DQ_UNSUB         Image hosted at large ecomm site, IP addr unsub link
2187 tflags     HOSTED_IMG_DQ_UNSUB         publish
2188 ##} HOSTED_IMG_DQ_UNSUB
2189
2190 ##{ HOSTED_IMG_FREEM
2191
2192 meta       HOSTED_IMG_FREEM            __HOSTED_IMG_FREEM && !__THREADED
2193 #score      HOSTED_IMG_FREEM            3.500   # limit
2194 describe   HOSTED_IMG_FREEM            Image hosted at large ecomm, CDN or hosting site or redirected, freemail from or reply-to
2195 tflags     HOSTED_IMG_FREEM            publish
2196 ##} HOSTED_IMG_FREEM
2197
2198 ##{ HOSTED_IMG_MULTI
2199
2200 meta       HOSTED_IMG_MULTI            __HOSTED_IMG_MULTI && !__DKIM_EXISTS
2201 #score      HOSTED_IMG_MULTI            3.000   # limit
2202 describe   HOSTED_IMG_MULTI            Multiple images hosted at different large ecomm, CDN or hosting sites, free image sites, or redirected
2203 tflags     HOSTED_IMG_MULTI            publish
2204 ##} HOSTED_IMG_MULTI
2205
2206 ##{ HOSTED_IMG_MULTI_PUB_01
2207
2208 meta       HOSTED_IMG_MULTI_PUB_01     (__IMGUR_IMG_2 || __IMGUR_IMG_3) && !__DATE_LOWER && !__BOTH_INR_AND_REF && !__HAS_IN_REPLY_TO
2209 describe   HOSTED_IMG_MULTI_PUB_01     Multiple hosted images at public site
2210 #score      HOSTED_IMG_MULTI_PUB_01     3.000   # limit
2211 tflags     HOSTED_IMG_MULTI_PUB_01     publish
2212 ##} HOSTED_IMG_MULTI_PUB_01
2213
2214 ##{ HTML_ENTITY_ASCII
2215
2216 meta       HTML_ENTITY_ASCII           __HTML_ENTITY_ASCII_MINFP
2217 describe   HTML_ENTITY_ASCII           Obfuscated ASCII
2218 #score      HTML_ENTITY_ASCII           3.000   # limit
2219 tflags     HTML_ENTITY_ASCII           publish
2220 ##} HTML_ENTITY_ASCII
2221
2222 ##{ HTML_ENTITY_ASCII_TINY
2223
2224 meta       HTML_ENTITY_ASCII_TINY      __HTML_ENTITY_ASCII_TINY && !__HAS_IN_REPLY_TO
2225 describe   HTML_ENTITY_ASCII_TINY      Obfuscated ASCII + tiny fonts
2226 #score      HTML_ENTITY_ASCII_TINY      3.000   # limit
2227 tflags     HTML_ENTITY_ASCII_TINY      publish
2228 ##} HTML_ENTITY_ASCII_TINY
2229
2230 ##{ HTML_FONT_TINY_NORDNS
2231
2232 meta        HTML_FONT_TINY_NORDNS    __HTML_FONT_TINY_NORDNS && !__HAS_CID
2233 describe    HTML_FONT_TINY_NORDNS    Font too small to read, no rDNS
2234 #score       HTML_FONT_TINY_NORDNS    2.000     # limit
2235 ##} HTML_FONT_TINY_NORDNS
2236
2237 ##{ HTML_OFF_PAGE
2238
2239 meta        HTML_OFF_PAGE     __HTML_OFF_PAGE && !__RP_MATCHES_RCVD && !__LONGLINE && !__DKIM_EXISTS
2240 describe    HTML_OFF_PAGE     HTML element rendered well off the displayed page
2241 #score       HTML_OFF_PAGE     3.000    # limit
2242 tflags      HTML_OFF_PAGE     publish
2243 ##} HTML_OFF_PAGE
2244
2245 ##{ HTML_SHRT_CMNT_OBFU_MANY if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
2246
2247 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
2248   meta       HTML_SHRT_CMNT_OBFU_MANY    __HTML_SHRT_CMNT_OBFU_MANY
2249   describe   HTML_SHRT_CMNT_OBFU_MANY    Obfuscation with many short HTML comments
2250 #  score      HTML_SHRT_CMNT_OBFU_MANY    2.500 # limit
2251   tflags     HTML_SHRT_CMNT_OBFU_MANY    publish
2252 endif
2253 ##} HTML_SHRT_CMNT_OBFU_MANY if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
2254
2255 ##{ HTML_SINGLET_MANY
2256
2257 meta      HTML_SINGLET_MANY             __HTML_SINGLET_MANY && !__RCD_RDNS_MTA_MESSY && !__NOT_SPOOFED && !ALL_TRUSTED && !__USING_VERP1 && !__MIME_QP
2258 describe  HTML_SINGLET_MANY             Many single-letter HTML format blocks
2259 #score     HTML_SINGLET_MANY             2.500   # limit
2260 tflags    HTML_SINGLET_MANY             publish
2261 ##} HTML_SINGLET_MANY
2262
2263 ##{ HTML_TAG_BALANCE_CENTER ifplugin Mail::SpamAssassin::Plugin::HTMLEval
2264
2265 ifplugin Mail::SpamAssassin::Plugin::HTMLEval
2266   meta       HTML_TAG_BALANCE_CENTER       __HTML_TAG_BALANCE_CENTER && !__RCD_RDNS_MAIL_MESSY && !__RCD_RDNS_SMTP_MESSY
2267   describe   HTML_TAG_BALANCE_CENTER       Malformatted HTML
2268 endif
2269 ##} HTML_TAG_BALANCE_CENTER ifplugin Mail::SpamAssassin::Plugin::HTMLEval
2270
2271 ##{ HTML_TEXT_INVISIBLE_FONT if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
2272
2273 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
2274   meta      HTML_TEXT_INVISIBLE_FONT      __FONT_INVIS_MANY && !__HAS_ERRORS_TO && !__URI_DOTGOV && !__LYRIS_EZLM_REMAILER && !__ML3 && !__THREADED && !__DKIMWL_WL_HI && !USER_IN_DEF_DKIM_WL && !__MOZILLA_MSGID
2275   describe  HTML_TEXT_INVISIBLE_FONT      HTML hidden text - word obfuscation?
2276 #  score     HTML_TEXT_INVISIBLE_FONT      2.000   # limit
2277   tflags    HTML_TEXT_INVISIBLE_FONT      publish
2278 endif
2279 ##} HTML_TEXT_INVISIBLE_FONT if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
2280
2281 ##{ HTML_TEXT_INVISIBLE_STYLE if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
2282
2283 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
2284   meta      HTML_TEXT_INVISIBLE_STYLE     __STY_INVIS_MANY && (__RDNS_NONE || __HDRS_LCASE || __UNSUB_EMAIL ||  __ADMITS_SPAM || __FROM_DOM_INFO || __HTML_TAG_BALANCE_CENTER || __MSGID_RANDY ) && !__RDNS_LONG && !__FROM_ENCODED_QP && !__HAS_THREAD_INDEX
2285   describe  HTML_TEXT_INVISIBLE_STYLE     HTML hidden text + other spam signs
2286 #  score     HTML_TEXT_INVISIBLE_STYLE     3.500   # limit
2287   tflags    HTML_TEXT_INVISIBLE_STYLE     publish
2288 endif
2289 ##} HTML_TEXT_INVISIBLE_STYLE if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
2290
2291 ##{ HTTPS_HTTP_MISMATCH ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch
2292
2293 ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch
2294 body  HTTPS_HTTP_MISMATCH eval:check_https_http_mismatch('1','10')
2295 endif
2296 ##} HTTPS_HTTP_MISMATCH ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch
2297
2298 ##{ IMG_ONLY_FM_DOM_INFO
2299
2300 meta       IMG_ONLY_FM_DOM_INFO       __HTML_IMG_ONLY && __FROM_DOM_INFO
2301 describe   IMG_ONLY_FM_DOM_INFO       HTML image-only message from .info domain
2302 #score      IMG_ONLY_FM_DOM_INFO       2.500    # limit
2303 tflags     IMG_ONLY_FM_DOM_INFO       publish
2304 ##} IMG_ONLY_FM_DOM_INFO
2305
2306 ##{ JH_SPAMMY_HEADERS
2307
2308 meta       JH_SPAMMY_HEADERS           __HAS_COMPLAINT_TO || __HAS_TRACKING_CODE || __HAS_LOGID || __HAS_X_LETTER || __HAS_X_EBSERVER || __HAS_LIST_OPEN
2309 describe   JH_SPAMMY_HEADERS           Has unusual message header(s) seen primarily in spam
2310 #score      JH_SPAMMY_HEADERS           3.500   # limit
2311 tflags     JH_SPAMMY_HEADERS           publish
2312 ##} JH_SPAMMY_HEADERS
2313
2314 ##{ JH_SPAMMY_PATTERN01
2315
2316 rawbody    JH_SPAMMY_PATTERN01         m;<img src=['"](https?://[^'"]{1,80}/)C([^/.]{1,30}\.jpg)['"]>.{0,200}<img src="\1U\2";ism
2317 describe   JH_SPAMMY_PATTERN01         Unusual pattern seen in spam campaign
2318 #score      JH_SPAMMY_PATTERN01         3.000   # limit
2319 tflags     JH_SPAMMY_PATTERN01         publish
2320 ##} JH_SPAMMY_PATTERN01
2321
2322 ##{ JH_SPAMMY_PATTERN02
2323
2324 rawbody    JH_SPAMMY_PATTERN02         m;<img [^>]{0,50}src=['"](https?://[^"'\s]{1,80}\.php\?)t=o(\&[^"'\s]{1,50})["'][>\s].{0,200}<a href="\1t=c\2".{0,200}<a href="\1t=u\2";ism
2325 describe   JH_SPAMMY_PATTERN02         Unusual pattern seen in spam campaign
2326 #score      JH_SPAMMY_PATTERN02         3.000   # limit
2327 tflags     JH_SPAMMY_PATTERN02         publish
2328 ##} JH_SPAMMY_PATTERN02
2329
2330 ##{ JM_I_FEEL_LUCKY
2331
2332 uri JM_I_FEEL_LUCKY         /(?:\&|\?)btnI=ec(?:$|\&)/
2333 tflags JM_I_FEEL_LUCKY  publish     # low hitrate, but always a good sign
2334 ##} JM_I_FEEL_LUCKY
2335
2336 ##{ JM_RCVD_QMAILV1
2337
2338 header JM_RCVD_QMAILV1     Received =~ /by \S+ \(Qmailv1\) with ESMTP/
2339 ##} JM_RCVD_QMAILV1
2340
2341 ##{ JM_TORA_XM
2342
2343 meta JM_TORA_XM     (__MAILER_OL_6626 && __MOLE_2962 && __NAKED_TO)
2344 ##} JM_TORA_XM
2345
2346 ##{ KB_DATE_CONTAINS_TAB
2347
2348 meta     KB_DATE_CONTAINS_TAB  __KB_DATE_CONTAINS_TAB && !__ML_TURNS_SP_TO_TAB
2349 #score   KB_DATE_CONTAINS_TAB  0.5
2350 ##} KB_DATE_CONTAINS_TAB
2351
2352 ##{ KB_FAKED_THE_BAT
2353
2354 meta     KB_FAKED_THE_BAT      (__THEBAT_MUA && KB_DATE_CONTAINS_TAB)
2355 ##} KB_FAKED_THE_BAT
2356
2357 ##{ KB_RATWARE_BOUNDARY
2358
2359 meta   KB_RATWARE_BOUNDARY   __RATWARE_BOUND_A || __RATWARE_BOUND_B
2360 ##} KB_RATWARE_BOUNDARY
2361
2362 ##{ KB_RATWARE_MSGID
2363
2364 meta   KB_RATWARE_MSGID        (__KB_MSGID_OUTLOOK_888 && __ANY_OUTLOOK_MUA)
2365 ##} KB_RATWARE_MSGID
2366
2367 ##{ KB_RATWARE_OUTLOOK_08
2368
2369 header  KB_RATWARE_OUTLOOK_08  ALL =~ /^Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{100,400}boundary="----=_NextPart_000_...._\1\./msi  # "
2370 ##} KB_RATWARE_OUTLOOK_08
2371
2372 ##{ KB_RATWARE_OUTLOOK_12
2373
2374 header  KB_RATWARE_OUTLOOK_12  ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{4})[0-9a-f]{4}\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi  # "
2375 ##} KB_RATWARE_OUTLOOK_12
2376
2377 ##{ KB_RATWARE_OUTLOOK_16
2378
2379 header  KB_RATWARE_OUTLOOK_16  ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi  # "
2380 ##} KB_RATWARE_OUTLOOK_16
2381
2382 ##{ KB_RATWARE_OUTLOOK_MID
2383
2384 header  KB_RATWARE_OUTLOOK_MID  ALL =~ /^Message-Id: <....([0-9a-f]{8})\$([0-9a-f]{8})\$[0-9a-f]{8}\@.{100,400}boundary="----=_NextPart_000_...._\1\.\2"/msi
2385 ##} KB_RATWARE_OUTLOOK_MID
2386
2387 ##{ KHOP_FAKE_EBAY
2388
2389 meta     KHOP_FAKE_EBAY         __EBAY_ADDRESS && !__NOT_SPOOFED
2390 describe KHOP_FAKE_EBAY         Sender falsely claims to be from eBay
2391 ##} KHOP_FAKE_EBAY
2392
2393 ##{ KHOP_HELO_FCRDNS
2394
2395 meta     KHOP_HELO_FCRDNS       __HELO_NOT_RDNS && !(__VIA_ML || __freemail_safe || __RCVD_IN_DNSWL || __NOT_SPOOFED || __RDNS_SHORT)
2396 describe KHOP_HELO_FCRDNS       Relay HELO differs from its IP's reverse DNS
2397 #score   KHOP_HELO_FCRDNS       0.4 # 20090603
2398 ##} KHOP_HELO_FCRDNS
2399
2400 ##{ LINKEDIN_IMG_NOT_RCVD_LNKN
2401
2402 meta       LINKEDIN_IMG_NOT_RCVD_LNKN  __LINKED_IMG_NOT_RCVD_LINK && !__LUNSUB_BEFORE_SUBJDT
2403 #score      LINKEDIN_IMG_NOT_RCVD_LNKN  2.500  # limit
2404 describe   LINKEDIN_IMG_NOT_RCVD_LNKN  Linkedin hosted image but message not from Linkedin
2405 tflags     LINKEDIN_IMG_NOT_RCVD_LNKN  publish
2406 ##} LINKEDIN_IMG_NOT_RCVD_LNKN
2407
2408 ##{ LIST_PRTL_PUMPDUMP
2409
2410 meta        LIST_PRTL_PUMPDUMP     __LIST_PRTL_PUMPDUMP && !__DKIM_EXISTS
2411 describe    LIST_PRTL_PUMPDUMP     Incomplete List-* headers and stock pump-and-dump
2412 #score       LIST_PRTL_PUMPDUMP     2.000   # limit
2413 tflags      LIST_PRTL_PUMPDUMP     publish
2414 ##} LIST_PRTL_PUMPDUMP
2415
2416 ##{ LIST_PRTL_SAME_USER
2417
2418 meta        LIST_PRTL_SAME_USER    __LIST_PRTL_SAME_USER && !__BUGGED_IMG && !__DKIM_EXISTS && !__RP_MATCHES_RCVD && !__HAS_ERRORS_TO
2419 describe    LIST_PRTL_SAME_USER    Incomplete List-* headers and from+to user the same
2420 #score       LIST_PRTL_SAME_USER    3.000   # limit
2421 tflags      LIST_PRTL_SAME_USER    publish
2422 ##} LIST_PRTL_SAME_USER
2423
2424 ##{ LIVEFILESTORE
2425
2426 uri  LIVEFILESTORE       m~livefilestore.com/~
2427 ##} LIVEFILESTORE
2428
2429 ##{ LONG_HEX_URI
2430
2431 meta        LONG_HEX_URI      __128_HEX_URI && !__LCL__KAM_BODY_LENGTH_LT_1024
2432 describe    LONG_HEX_URI      Very long purely hexadecimal URI
2433 #score       LONG_HEX_URI      3.000    # limit
2434 tflags      LONG_HEX_URI      publish
2435 ##} LONG_HEX_URI
2436
2437 ##{ LONG_IMG_URI
2438
2439 meta        LONG_IMG_URI        __45_ALNUM_IMG && !ALL_TRUSTED && !__HAS_ERRORS_TO
2440 describe    LONG_IMG_URI        Image URI with very long path component - web bug?
2441 #score       LONG_IMG_URI        3.000  # limit
2442 tflags      LONG_IMG_URI        publish
2443 ##} LONG_IMG_URI
2444
2445 ##{ LONG_INVISIBLE_TEXT
2446
2447 describe  LONG_INVISIBLE_TEXT           Long block of hidden text - bayes poison?
2448 #score     LONG_INVISIBLE_TEXT           3.000  # limit
2449 tflags    LONG_INVISIBLE_TEXT           publish
2450 ##} LONG_INVISIBLE_TEXT
2451
2452 ##{ LONG_INVISIBLE_TEXT if !(can(Mail::SpamAssassin::Conf::feature_bug6558_free))
2453
2454 if !(can(Mail::SpamAssassin::Conf::feature_bug6558_free))
2455   meta      LONG_INVISIBLE_TEXT           __LONG_INVIS_DIV
2456 endif
2457 ##} LONG_INVISIBLE_TEXT if !(can(Mail::SpamAssassin::Conf::feature_bug6558_free))
2458
2459 ##{ LONG_INVISIBLE_TEXT if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
2460
2461 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
2462   meta      LONG_INVISIBLE_TEXT           __LONG_INVIS_DIV || (__LONG_STY_INVIS && !__UNSUB_LINK && !__RCD_RDNS_MTA_MESSY && !__USING_VERP1 && !__RCD_RDNS_MTA && !__RCD_RDNS_MTA_MESSY && !__MIME_QP && !__HAS_X_MAILER && !__REPTO_QUOTE && !__USING_VERP1 )
2463 endif
2464 ##} LONG_INVISIBLE_TEXT if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
2465
2466 ##{ LONG_TERM_PRICE
2467
2468 body LONG_TERM_PRICE  /long\W+term\W+(target|projected)(\W+price)?/i
2469 ##} LONG_TERM_PRICE
2470
2471 ##{ LOOPHOLE_1
2472
2473 body            LOOPHOLE_1      /loop-?hole in the banking/i
2474 describe        LOOPHOLE_1      A loop hole in the banking laws?
2475 ##} LOOPHOLE_1
2476
2477 ##{ LOTS_OF_MONEY if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
2478
2479 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
2480   meta     LOTS_OF_MONEY      0
2481 endif
2482 ##} LOTS_OF_MONEY if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
2483
2484 ##{ LOTS_OF_MONEY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
2485
2486 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
2487   meta     LOTS_OF_MONEY    (__LOTSA_MONEY_00 || __LOTSA_MONEY_01 || __LOTSA_MONEY_02 || __LOTSA_MONEY_03 || __LOTSA_MONEY_04 || __LOTSA_MONEY_05) && !__TRAVEL_ITINERARY
2488   describe LOTS_OF_MONEY    Huge... sums of money
2489 #  score    LOTS_OF_MONEY    0.01
2490   tflags   LOTS_OF_MONEY    publish
2491 endif
2492 ##} LOTS_OF_MONEY ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
2493
2494 ##{ LOTTERY_1
2495
2496 meta LOTTERY_1      (__DBLCLAIM && __CASHPRZ)
2497 ##} LOTTERY_1
2498
2499 ##{ LOTTERY_PH_004470
2500
2501 meta LOTTERY_PH_004470  (__AFF_004470_NUMBER && __AFF_LOTTERY)
2502 ##} LOTTERY_PH_004470
2503
2504 ##{ LOTTO_AGENT
2505
2506 meta     LOTTO_AGENT      __LOTTO_AGENT && !__HAS_IN_REPLY_TO && !__THREADED && !__TO_YOUR_ORG && !__DKIM_EXISTS && !__TRAVEL_ITINERARY && !__AUTO_ACCIDENT && !__HAS_ERRORS_TO && !__RP_MATCHES_RCVD
2507 describe LOTTO_AGENT      Claims Agent
2508 #score    LOTTO_AGENT      1.50         # limit
2509 ##} LOTTO_AGENT
2510
2511 ##{ LOTTO_DEPT
2512
2513 meta     LOTTO_DEPT       __LOTTO_DEPT && !__COMMENT_EXISTS && !__HAS_IN_REPLY_TO && !__THREADED && !__VIA_ML && !__TO_YOUR_ORG && !__TRAVEL_ITINERARY && !__AUTO_ACCIDENT
2514 describe LOTTO_DEPT       Claims Department
2515 #score    LOTTO_DEPT       2.00         # limit
2516 ##} LOTTO_DEPT
2517
2518 ##{ LUCRATIVE
2519
2520 meta     LUCRATIVE        ( __LUCRATIVE && __HELO_NO_DOMAIN ) && !ALL_TRUSTED
2521 describe LUCRATIVE        Make lots of money!
2522 #score    LUCRATIVE        2.00 # limit
2523 tflags   LUCRATIVE        publish
2524 ##} LUCRATIVE
2525
2526 ##{ L_SPAM_TOOL_13
2527
2528 header L_SPAM_TOOL_13   Date =~ /\s[+-]\d(?![2358]45)\d[124-9]\d$/
2529 ##} L_SPAM_TOOL_13
2530
2531 ##{ MALF_HTML_B64
2532
2533 meta       MALF_HTML_B64               MIME_BASE64_TEXT && HTML_MIME_NO_HTML_TAG
2534 describe   MALF_HTML_B64               Malformatted base64-encoded HTML content
2535 #score      MALF_HTML_B64               3.500   # limit
2536 tflags     MALF_HTML_B64               publish
2537 ##} MALF_HTML_B64
2538
2539 ##{ MALWARE_NORDNS
2540
2541 meta           MALWARE_NORDNS         __MALWARE_NORDNS && !BITCOIN_EXTORT_01 && !MONERO_EXTORT_01
2542 describe       MALWARE_NORDNS         Malware bragging + no rDNS
2543 #score          MALWARE_NORDNS         3.500    # limit
2544 tflags         MALWARE_NORDNS         publish
2545 ##} MALWARE_NORDNS
2546
2547 ##{ MALWARE_PASSWORD
2548
2549 meta           MALWARE_PASSWORD       __MALWARE_PASSWORD && !BITCOIN_EXTORT_01 && !MONERO_EXTORT_01
2550 describe       MALWARE_PASSWORD       Malware bragging + "password"
2551 #score          MALWARE_PASSWORD       3.500    # limit
2552 tflags         MALWARE_PASSWORD       publish
2553 ##} MALWARE_PASSWORD
2554
2555 ##{ MALW_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2556
2557 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2558   meta         MALW_ATTACH         __MALW_ATTACH && !__HAS_THREAD_INDEX
2559   describe     MALW_ATTACH         Attachment filename suspicious, probable malware exploit
2560   tflags       MALW_ATTACH         publish
2561 endif
2562 ##} MALW_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2563
2564 ##{ MANY_SPAN_IN_TEXT
2565
2566 meta           MANY_SPAN_IN_TEXT   __MANY_SPAN_IN_TEXT && !__VIA_ML
2567 describe       MANY_SPAN_IN_TEXT   Many <SPAN> tags embedded within text
2568 tflags         MANY_SPAN_IN_TEXT   publish
2569 ##} MANY_SPAN_IN_TEXT
2570
2571 ##{ MAY_BE_FORGED
2572
2573 meta     MAY_BE_FORGED  __MAY_BE_FORGED && !__NOT_SPOOFED && !__VIA_ML
2574 describe MAY_BE_FORGED  Relay IP's reverse DNS does not resolve to IP
2575 ##} MAY_BE_FORGED
2576
2577 ##{ MID_DEGREES
2578
2579 header MID_DEGREES  Message-ID =~ /^<\d{14}\.[A-F0-9]{10}\@[A-Z0-9]+>$/
2580 ##} MID_DEGREES
2581
2582 ##{ MILLION_HUNDRED
2583
2584 body            MILLION_HUNDRED         /Million\s+\S+\s+Hundred/i
2585 describe        MILLION_HUNDRED         Million "One to Nine" Hundred
2586 tflags          MILLION_HUNDRED         publish
2587 ##} MILLION_HUNDRED
2588
2589 ##{ MILLION_USD
2590
2591 body MILLION_USD                /Million\b.{0,40}\b(?:United States? Dollars?|USD)/i
2592 describe MILLION_USD            Talks about millions of dollars
2593 #score MILLION_USD 2
2594 ##} MILLION_USD
2595
2596 ##{ MIMEOLE_DIRECT_TO_MX
2597
2598 meta       MIMEOLE_DIRECT_TO_MX        __MIMEOLE_DIRECT_TO_MX && !__ANY_IMAGE_ATTACH && !__DKIM_EXISTS
2599 describe   MIMEOLE_DIRECT_TO_MX        MIMEOLE + direct-to-MX
2600 #score      MIMEOLE_DIRECT_TO_MX        2.000   # limit
2601 tflags     MIMEOLE_DIRECT_TO_MX        publish
2602 ##} MIMEOLE_DIRECT_TO_MX
2603
2604 ##{ MIME_BOUND_EQ_REL
2605
2606 header MIME_BOUND_EQ_REL    Content-Type =~ /boundary="=====================_\d+==\.REL"/s
2607 ##} MIME_BOUND_EQ_REL
2608
2609 ##{ MIME_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2610
2611 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2612   meta        MIME_NO_TEXT      __MIME_NO_TEXT && !__BOUNCE_CTYPE && !__CT_ENCRYPTED && !ALL_TRUSTED && !__MSGID_APPLEMAIL && !__USER_AGENT_APPLEMAIL && !__HAS_IN_REPLY_TO && !__HAS_X_REF && !__HS_SUBJ_RE_FW && !__PDF_ATTACH && !__LCL__KAM_BODY_LENGTH_LT_128
2613 #  score       MIME_NO_TEXT      2.00   # limit
2614   describe    MIME_NO_TEXT      No (properly identified) text body parts
2615   tflags      MIME_NO_TEXT      publish
2616 endif
2617 ##} MIME_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2618
2619 ##{ MIME_PHP_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2620
2621 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2622   meta        MIME_PHP_NO_TEXT  (MIME_NO_TEXT && __PHP_MUA)
2623   describe    MIME_PHP_NO_TEXT  No text body parts, X-Mailer: PHP
2624 endif
2625 ##} MIME_PHP_NO_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2626
2627 ##{ MIXED_AREA_CASE
2628
2629 meta       MIXED_AREA_CASE             __MIXED_AREA_CASE
2630 describe   MIXED_AREA_CASE             Has area tag in mixed case
2631 #score      MIXED_AREA_CASE             2.500    # limit
2632 tflags     MIXED_AREA_CASE             publish
2633 ##} MIXED_AREA_CASE
2634
2635 ##{ MIXED_CENTER_CASE
2636
2637 meta       MIXED_CENTER_CASE           __MIXED_CENTER_CASE
2638 describe   MIXED_CENTER_CASE           Has center tag in mixed case
2639 #score      MIXED_CENTER_CASE           2.500    # limit
2640 tflags     MIXED_CENTER_CASE           publish
2641 ##} MIXED_CENTER_CASE
2642
2643 ##{ MIXED_ES if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
2644
2645 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
2646   ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
2647     meta            MIXED_ES        ( ! HTML_IMAGE_ONLY_16 ) && ( __LOWER_E > 20 ) && ( __E_LIKE_LETTER > ( (__LOWER_E * 14 ) / 10) ) && ( __E_LIKE_LETTER < ( 10 * __LOWER_E ) )
2648     describe        MIXED_ES Too many es are not es
2649     tflags          MIXED_ES publish
2650 #    lang pl  score MIXED_ES  0.01
2651 #    lang cz  score MIXED_ES  0.01
2652 #    lang sk  score MIXED_ES  0.01
2653 #    lang hr  score MIXED_ES  0.01
2654 #    lang el  score MIXED_ES  0.01
2655 endif
2656 endif
2657 ##} MIXED_ES if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
2658
2659 ##{ MIXED_FONT_CASE
2660
2661 meta       MIXED_FONT_CASE             __MIXED_FONT_CASE
2662 describe   MIXED_FONT_CASE             Has font tag in mixed case
2663 #score      MIXED_FONT_CASE             2.500    # limit
2664 tflags     MIXED_FONT_CASE             publish
2665 ##} MIXED_FONT_CASE
2666
2667 ##{ MIXED_HREF_CASE
2668
2669 meta       MIXED_HREF_CASE             __MIXED_HREF_CASE_JH
2670 describe   MIXED_HREF_CASE             Has href in mixed case
2671 #score      MIXED_HREF_CASE             2.000    # limit
2672 tflags     MIXED_HREF_CASE             publish
2673 ##} MIXED_HREF_CASE
2674
2675 ##{ MIXED_IMG_CASE
2676
2677 meta       MIXED_IMG_CASE              __MIXED_IMG_CASE_JH && !__MSGID_JAVAMAIL
2678 describe   MIXED_IMG_CASE              Has img tag in mixed case
2679 #score      MIXED_IMG_CASE              3.000    # limit
2680 tflags     MIXED_IMG_CASE              publish
2681 ##} MIXED_IMG_CASE
2682
2683 ##{ MONERO_DEADLINE
2684
2685 meta           MONERO_DEADLINE        __MONERO && __HOURS_DEADLINE && !MONERO_EXTORT_01
2686 describe       MONERO_DEADLINE        Monero cryptocurrency with a deadline
2687 #score          MONERO_DEADLINE        3.000    # limit
2688 tflags         MONERO_DEADLINE        publish
2689 ##} MONERO_DEADLINE
2690
2691 ##{ MONERO_EXTORT_01
2692
2693 meta           MONERO_EXTORT_01       __MONERO && __EXTORT_MANY
2694 describe       MONERO_EXTORT_01       Extortion spam, pay via Monero cryptocurrency
2695 #score          MONERO_EXTORT_01       5.000    # limit
2696 tflags         MONERO_EXTORT_01       publish
2697 ##} MONERO_EXTORT_01
2698
2699 ##{ MONERO_MALWARE
2700
2701 meta           MONERO_MALWARE         __MONERO && __MY_MALWARE && !MONERO_EXTORT_01
2702 describe       MONERO_MALWARE         Monero cryptocurrency + malware bragging
2703 #score          MONERO_MALWARE         3.500    # limit
2704 tflags         MONERO_MALWARE         publish
2705 ##} MONERO_MALWARE
2706
2707 ##{ MONERO_PAY_ME
2708
2709 meta           MONERO_PAY_ME          __MONERO && __PAY_ME && !MONERO_EXTORT_01
2710 describe       MONERO_PAY_ME          Pay me via Monero cryptocurrency
2711 #score          MONERO_PAY_ME          3.000    # limit
2712 tflags         MONERO_PAY_ME          publish
2713 ##} MONERO_PAY_ME
2714
2715 ##{ MONEY_ATM_CARD
2716
2717 meta     MONEY_ATM_CARD   __MONEY_ATM_CARD && !__COMMENT_EXISTS && !__TAG_EXISTS_STYLE
2718 describe MONEY_ATM_CARD   Lots of money on an ATM card
2719 ##} MONEY_ATM_CARD
2720
2721 ##{ MONEY_BARRISTER
2722
2723 meta     MONEY_BARRISTER  __BARRISTER && LOTS_OF_MONEY
2724 describe MONEY_BARRISTER  Lots of money from a UK lawyer
2725 #score    MONEY_BARRISTER  1.000   # limit
2726 ##} MONEY_BARRISTER
2727
2728 ##{ MONEY_FORM
2729
2730 meta     MONEY_FORM          __MONEY_FORM && !__FB_TOUR && !__FM_MY_PRICE && !__FR_SPACING_8 && !__COMMENT_EXISTS && !__CAN_HELP
2731 describe MONEY_FORM          Lots of money if you fill out a form
2732 ##} MONEY_FORM
2733
2734 ##{ MONEY_FORM_SHORT
2735
2736 meta     MONEY_FORM_SHORT    __MONEY_FORM_SHORT && !__DOS_HAS_LIST_UNSUB && !__VIA_ML && !__HTML_LINK_IMAGE && !__UPPERCASE_URI && !__THREADED && !__COMMENT_EXISTS && !__TAG_EXISTS_CENTER && !__THREAD_INDEX_GOOD
2737 describe MONEY_FORM_SHORT    Lots of money if you fill out a short form
2738 #score    MONEY_FORM_SHORT    2.500     # limit
2739 ##} MONEY_FORM_SHORT
2740
2741 ##{ MONEY_FRAUD_3
2742
2743 meta     MONEY_FRAUD_3    (__MONEY_FRAUD_3 && !__MONEY_FRAUD_5 && !__MONEY_FRAUD_8 && !__ADVANCE_FEE_3_NEW_MONEY) && !__COMMENT_EXISTS && !__TAG_EXISTS_CENTER && !__IS_EXCH && !__VIA_ML && !__HAS_THREAD_INDEX && !__UNSUB_LINK && !__DOS_HAS_LIST_UNSUB && !__HTML_LINK_IMAGE && !__THREADED && !__DOS_BODY_THU && !__URL_SHORTENER && !__TAG_EXISTS_STYLE
2744 describe MONEY_FRAUD_3    Lots of money and several fraud phrases
2745 tflags   MONEY_FRAUD_3    publish
2746 ##} MONEY_FRAUD_3
2747
2748 ##{ MONEY_FRAUD_5
2749
2750 meta     MONEY_FRAUD_5    (__MONEY_FRAUD_5 && !__MONEY_FRAUD_8 && !__ADVANCE_FEE_5_NEW_MONEY) && !__VIA_ML && !__HAS_THREAD_INDEX && !__COMMENT_EXISTS && !__UNSUB_LINK && !__TAG_EXISTS_CENTER && !__URL_SHORTENER && !__TAG_EXISTS_STYLE
2751 describe MONEY_FRAUD_5    Lots of money and many fraud phrases
2752 tflags   MONEY_FRAUD_5    publish
2753 ##} MONEY_FRAUD_5
2754
2755 ##{ MONEY_FRAUD_8
2756
2757 meta     MONEY_FRAUD_8    __MONEY_FRAUD_8 && !__VIA_ML && !__HAS_THREAD_INDEX && !__BUGGED_IMG
2758 describe MONEY_FRAUD_8    Lots of money and very many fraud phrases
2759 tflags   MONEY_FRAUD_8    publish
2760 ##} MONEY_FRAUD_8
2761
2762 ##{ MONEY_FREEMAIL_REPTO ifplugin Mail::SpamAssassin::Plugin::FreeMail
2763
2764 ifplugin Mail::SpamAssassin::Plugin::FreeMail
2765   meta     MONEY_FREEMAIL_REPTO     __MONEY_FREEMAIL_REPTO && !__HAS_CAMPAIGNID
2766   describe MONEY_FREEMAIL_REPTO     Lots of money from someone using free email?
2767 #  score    MONEY_FREEMAIL_REPTO     3.000      # limit
2768   tflags   MONEY_FREEMAIL_REPTO     publish
2769 endif
2770 ##} MONEY_FREEMAIL_REPTO ifplugin Mail::SpamAssassin::Plugin::FreeMail
2771
2772 ##{ MONEY_FROM_MISSP
2773
2774 meta     MONEY_FROM_MISSP   LOTS_OF_MONEY && __FROM_MISSPACED && !__MIME_QP
2775 describe MONEY_FROM_MISSP   Lots of money and misspaced From
2776 #score    MONEY_FROM_MISSP   2.000      # limit
2777 ##} MONEY_FROM_MISSP
2778
2779 ##{ MSGID_DOLLARS_URI_IMG
2780
2781 meta       MSGID_DOLLARS_URI_IMG       __MSGID_DOLLARS_URI_IMG && !__THREADED && !__HS_SUBJ_RE_FW
2782 describe   MSGID_DOLLARS_URI_IMG       Suspicious Message-ID and image
2783 #score      MSGID_DOLLARS_URI_IMG       3.000   # limit
2784 tflags     MSGID_DOLLARS_URI_IMG       publish
2785 ##} MSGID_DOLLARS_URI_IMG
2786
2787 ##{ MSGID_HDR_MALF
2788
2789 meta       MSGID_HDR_MALF              __HAS_MESSAGEID
2790 describe   MSGID_HDR_MALF              Has invalid message ID header
2791 #score      MSGID_HDR_MALF              3.500   # limit
2792 tflags     MSGID_HDR_MALF              publish
2793 ##} MSGID_HDR_MALF
2794
2795 ##{ MSGID_MULTIPLE_AT
2796
2797 header          MSGID_MULTIPLE_AT       MESSAGEID =~ /<[^>]*\@[^>]*\@/
2798 describe        MSGID_MULTIPLE_AT       Message-ID contains multiple '@' characters
2799 #score          MSGID_MULTIPLE_AT       0.001
2800 ##} MSGID_MULTIPLE_AT
2801
2802 ##{ MSMAIL_PRI_ABNORMAL
2803
2804 meta        MSMAIL_PRI_ABNORMAL        __MSMAIL_PRI_ABNORMAL && !ALL_TRUSTED && !__ANY_OUTLOOK_MUA && !__HAS_THREAD_INDEX  && !__DKIM_EXISTS && !__MSOE_MID_WRONG_CASE && !__HAS_X_MAILER && !__HAS_UA && !__MSMAIL_PRI_HIGH
2805 describe    MSMAIL_PRI_ABNORMAL        Email priority often abused
2806 #score       MSMAIL_PRI_ABNORMAL        1.500   # limit
2807 ##} MSMAIL_PRI_ABNORMAL
2808
2809 ##{ MSM_PRIO_REPTO
2810
2811 meta       MSM_PRIO_REPTO              __MSM_PRIO_REPTO && !__ENV_AND_HDR_FROM_MATCH
2812 describe   MSM_PRIO_REPTO              MSMail priority header + Reply-to + short subject
2813 #score      MSM_PRIO_REPTO              2.500   # limit
2814 tflags     MSM_PRIO_REPTO              publish
2815 ##} MSM_PRIO_REPTO
2816
2817 ##{ MSOE_MID_WRONG_CASE
2818
2819 meta MSOE_MID_WRONG_CASE  (__XM_OUTLOOK_EXPRESS && __MSOE_MID_WRONG_CASE && !__MIMEOLE_1106)
2820 ##} MSOE_MID_WRONG_CASE
2821
2822 ##{ NA_DOLLARS
2823
2824 body NA_DOLLARS                        /\b(?:\d{1,3})?Million\b.{0,40}\b(?:Canadian Dollar?s?|US\$|U\.? ?S\.? Dollar)/i
2825 describe NA_DOLLARS            Talks about a million North American dollars
2826 #score NA_DOLLARS 1.5
2827 ##} NA_DOLLARS
2828
2829 ##{ NEWEGG_IMG_NOT_RCVD_NEGG
2830
2831 meta       NEWEGG_IMG_NOT_RCVD_NEGG    __NEWEGG_IMG_NOT_RCVD_NEGG
2832 #score      NEWEGG_IMG_NOT_RCVD_NEGG    2.500   # limit
2833 describe   NEWEGG_IMG_NOT_RCVD_NEGG    Newegg hosted image but message not from Newegg
2834 tflags     NEWEGG_IMG_NOT_RCVD_NEGG    publish
2835 ##} NEWEGG_IMG_NOT_RCVD_NEGG
2836
2837 ##{ NEW_PRODUCTS
2838
2839 meta       NEW_PRODUCTS                __NEW_PRODUCTS && !__STY_INVIS_MANY
2840 #score      NEW_PRODUCTS                1.250   # limit
2841 tflags     NEW_PRODUCTS                publish
2842 ##} NEW_PRODUCTS
2843
2844 ##{ NICE_REPLY_A
2845
2846 meta     NICE_REPLY_A           (__SUBJ_RE && !__MISSING_REPLY && !__MISSING_REF && __BOTH_INR_AND_REF)
2847 describe NICE_REPLY_A           Looks like a legit reply (A)
2848 tflags   NICE_REPLY_A           nice
2849 ##} NICE_REPLY_A
2850
2851 ##{ NORDNS_LOW_CONTRAST
2852
2853 meta        NORDNS_LOW_CONTRAST   __NORDNS_LOW_CONTRAST && !ALL_TRUSTED && !__HAS_CID && !__THREADED
2854 describe    NORDNS_LOW_CONTRAST   No rDNS + hidden text
2855 #score       NORDNS_LOW_CONTRAST   2.500   # limit
2856 ##} NORDNS_LOW_CONTRAST
2857
2858 ##{ NOT_SPAM
2859
2860 body        NOT_SPAM           /\b(?:(?:this (?:e?-?mail|message)|we) (?:is not|are not|cannot be considered) Spam|ESTE CORREO NO PUEDE SER CONSIDERADO (?:INTRUSIVO|spam)|Diese Nachricht ist KEIN SPAM)/i
2861 describe    NOT_SPAM           I'm not spam! Really! I'm not, I'm not, I'm not!
2862 tflags      NOT_SPAM           publish
2863 ##} NOT_SPAM
2864
2865 ##{ NO_FM_NAME_IP_HOSTN
2866
2867 meta       NO_FM_NAME_IP_HOSTN        (__KHOP_NO_FULL_NAME && __IP_IN_RELAY) && !__DOS_RELAYED_EXT
2868 describe   NO_FM_NAME_IP_HOSTN        No From name + hostname using IP address
2869 #score      NO_FM_NAME_IP_HOSTN        2.500    # limit
2870 tflags     NO_FM_NAME_IP_HOSTN        publish
2871 ##} NO_FM_NAME_IP_HOSTN
2872
2873 ##{ NSL_RCVD_FROM_USER
2874
2875 header         NSL_RCVD_FROM_USER       Received =~ /from User [\[\(]/
2876 describe       NSL_RCVD_FROM_USER       Received from User
2877 ##} NSL_RCVD_FROM_USER
2878
2879 ##{ NSL_RCVD_HELO_USER
2880
2881 header         NSL_RCVD_HELO_USER       Received =~ /helo[= ]user\)/i
2882 describe       NSL_RCVD_HELO_USER       Received from HELO User
2883 ##} NSL_RCVD_HELO_USER
2884
2885 ##{ NULL_IN_BODY
2886
2887 full NULL_IN_BODY       /\x00/
2888 describe NULL_IN_BODY   Message has NUL (ASCII 0) byte in message
2889 ##} NULL_IN_BODY
2890
2891 ##{ NUMBERONLY_BITCOIN_EXP
2892
2893 meta     NUMBERONLY_BITCOIN_EXP __NUMBERONLY_TLD && __BITCOIN_ID && __NAKED_TO
2894 describe NUMBERONLY_BITCOIN_EXP Domain ends in a large number and very short body with link
2895 #score    NUMBERONLY_BITCOIN_EXP 2.0 # limit
2896 ##} NUMBERONLY_BITCOIN_EXP
2897
2898 ##{ OBFU_BITCOIN
2899
2900 meta           OBFU_BITCOIN     __OBFU_BITCOIN
2901 describe       OBFU_BITCOIN     Obfuscated BitCoin references
2902 #score          OBFU_BITCOIN     3.000  # limit
2903 tflags         OBFU_BITCOIN     publish
2904 ##} OBFU_BITCOIN
2905
2906 ##{ OBFU_JVSCR_ESC
2907
2908 rawbody     OBFU_JVSCR_ESC         /document\.write\(unescape\(["'](?:%[0-9a-f]{2}){10}/i
2909 describe    OBFU_JVSCR_ESC         Injects content using obfuscated javascript
2910 tflags      OBFU_JVSCR_ESC         publish
2911 ##} OBFU_JVSCR_ESC
2912
2913 ##{ OBFU_TEXT_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2914
2915 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2916   mimeheader   OBFU_TEXT_ATTACH    Content-Type =~ m,\bapplication/octet-stream\b.+\.txt\b,i
2917   describe     OBFU_TEXT_ATTACH    Text attachment with non-text MIME type
2918   tflags       OBFU_TEXT_ATTACH    publish
2919 endif
2920 ##} OBFU_TEXT_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2921
2922 ##{ OBFU_UNSUB_UL
2923
2924 meta       OBFU_UNSUB_UL               __OBFU_UNSUB_UL && !MAILING_LIST_MULTI
2925 describe   OBFU_UNSUB_UL               Obfuscated unsubscribe text
2926 tflags     OBFU_UNSUB_UL               publish
2927 ##} OBFU_UNSUB_UL
2928
2929 ##{ ODD_FREEM_REPTO ifplugin Mail::SpamAssassin::Plugin::FreeMail
2930
2931 ifplugin Mail::SpamAssassin::Plugin::FreeMail
2932   meta       ODD_FREEM_REPTO             __freemail_mailreplyto
2933   describe   ODD_FREEM_REPTO             Has unusual reply-to header
2934 #  score      ODD_FREEM_REPTO             3.000 # limit
2935   tflags     ODD_FREEM_REPTO             publish
2936 endif
2937 ##} ODD_FREEM_REPTO ifplugin Mail::SpamAssassin::Plugin::FreeMail
2938
2939 ##{ PART_CID_STOCK ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2940
2941 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2942 meta PART_CID_STOCK      (__ANY_IMAGE_ATTACH&&__PART_STOCK_CID&&!__PART_STOCK_CL&&!__PART_STOCK_CD_F)
2943 describe PART_CID_STOCK  Has a spammy image attachment (by Content-ID)
2944 endif
2945 ##} PART_CID_STOCK ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2946
2947 ##{ PART_CID_STOCK_LESS ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2948
2949 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2950 meta PART_CID_STOCK_LESS (__ANY_IMAGE_ATTACH&&__PART_CID_STOCK_LESS)
2951 describe PART_CID_STOCK_LESS Has a spammy image attachment (by Content-ID, more specific)
2952 endif
2953 ##} PART_CID_STOCK_LESS ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
2954
2955 ##{ PDS_BAD_THREAD_QP_64
2956
2957 meta     PDS_BAD_THREAD_QP_64 __PDS_QP_64 && __HAS_THREAD_INDEX && !__THREAD_INDEX_GOOD
2958 describe PDS_BAD_THREAD_QP_64 Bad thread header - short QP
2959 #score    PDS_BAD_THREAD_QP_64 1.0
2960 ##} PDS_BAD_THREAD_QP_64
2961
2962 ##{ PDS_BTC_ID
2963
2964 meta     PDS_BTC_ID __PDS_BTC_ID
2965 describe PDS_BTC_ID FP reduced Bitcoin ID
2966 #score    PDS_BTC_ID 0.5
2967 ##} PDS_BTC_ID
2968
2969 ##{ PDS_BTC_MSGID
2970
2971 meta     PDS_BTC_MSGID __PDS_BTC_ID && __MSGID_NOFQDN2
2972 describe PDS_BTC_MSGID Bitcoin ID with T_MSGID_NOFQDN2
2973 #score    PDS_BTC_MSGID 1.0
2974 ##} PDS_BTC_MSGID
2975
2976 ##{ PDS_BTC_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
2977
2978 if (version >= 3.004002)
2979 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
2980 meta     PDS_BTC_NTLD ( __BITCOIN_ID && __FROM_ADDRLIST_SUSPNTLD )
2981 describe PDS_BTC_NTLD Bitcoin suspect NTLD
2982 #score    PDS_BTC_NTLD 2.0 # limit
2983 endif
2984 endif
2985 ##} PDS_BTC_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
2986
2987 ##{ PDS_DBL_URL_TNB_RUNON
2988
2989 meta     PDS_DBL_URL_TNB_RUNON __TO_NO_BRKTS_FROM_RUNON && __PDS_DOUBLE_URL
2990 describe PDS_DBL_URL_TNB_RUNON Double-url and To no arrows, from runon
2991 #score    PDS_DBL_URL_TNB_RUNON 2.0
2992 ##} PDS_DBL_URL_TNB_RUNON
2993
2994 ##{ PDS_EMPTYSUBJ_URISHRT ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
2995
2996 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
2997 if (version >= 3.004000)
2998 meta     PDS_EMPTYSUBJ_URISHRT __URL_SHORTENER && __SUBJECT_EMPTY && __PDS_MSG_1024
2999 describe PDS_EMPTYSUBJ_URISHRT Empty subject with little more than URI shortener
3000 #score    PDS_EMPTYSUBJ_URISHRT 1.5 # limit
3001 endif
3002 endif
3003 ##} PDS_EMPTYSUBJ_URISHRT ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
3004
3005 ##{ PDS_FROM_2_EMAILS_SHRTNER ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
3006
3007 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
3008 if (version >= 3.004000)
3009 meta     PDS_FROM_2_EMAILS_SHRTNER __URL_SHORTENER && (__PDS_FROM_2_EMAILS || __NAME_EMAIL_DIFF) && __BODY_URI_ONLY
3010 describe PDS_FROM_2_EMAILS_SHRTNER From 2 emails short email with little more than a URI shortener
3011 #score    PDS_FROM_2_EMAILS_SHRTNER 1.5 # limit
3012 endif
3013 endif
3014 ##} PDS_FROM_2_EMAILS_SHRTNER ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
3015
3016 ##{ PDS_HELO_SPF_FAIL
3017
3018 meta     PDS_HELO_SPF_FAIL SPF_HELO_FAIL && __HELO_HIGHPROFILE
3019 describe PDS_HELO_SPF_FAIL High profile HELO that fails SPF
3020 #score    PDS_HELO_SPF_FAIL 2.0
3021 tflags   PDS_HELO_SPF_FAIL net
3022 ##} PDS_HELO_SPF_FAIL
3023
3024 ##{ PDS_NAKED_TO_NUMERO
3025
3026 meta     PDS_NAKED_TO_NUMERO __NAKED_TO && __NUMBERONLY_TLD
3027 describe PDS_NAKED_TO_NUMERO Naked-to, numberonly domain
3028 #score    PDS_NAKED_TO_NUMERO 2.0
3029 ##} PDS_NAKED_TO_NUMERO
3030
3031 ##{ PDS_NO_FULL_NAME_SPOOFED_URL ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
3032
3033 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
3034 if (version >= 3.004000)
3035 meta     PDS_NO_FULL_NAME_SPOOFED_URL __PDS_MSG_1024 && __KHOP_NO_FULL_NAME && __SPOOFED_URL && !(__VIA_ML || __SENDER_BOT || __YAHOO_BULK || __UNSUB_LINK || __THREADED || __URL_SHORTENER)
3036 describe PDS_NO_FULL_NAME_SPOOFED_URL HTML message short, T_SPOOFED_URL and T_KHOP_NO_FULL_NAME
3037 #score    PDS_NO_FULL_NAME_SPOOFED_URL 0.75 # limit
3038 endif
3039 endif
3040 ##} PDS_NO_FULL_NAME_SPOOFED_URL ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
3041
3042 ##{ PDS_PHP_EVAL
3043
3044 meta     PDS_PHP_EVAL __PDS_PHP_EVAL1
3045 describe PDS_PHP_EVAL PHP header shows eval'd code
3046 #score    PDS_PHP_EVAL 1.5
3047 ##} PDS_PHP_EVAL
3048
3049 ##{ PDS_RDNS_DYNAMIC_FP
3050
3051 meta     PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC && !__PDS_RDNS_MTA
3052 #score    PDS_RDNS_DYNAMIC_FP 0.01
3053 describe PDS_RDNS_DYNAMIC_FP RDNS_DYNAMIC with FP steps
3054 ##} PDS_RDNS_DYNAMIC_FP
3055
3056 ##{ PDS_SHORT_SPOOFED_URL ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
3057
3058 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
3059 if (version >= 3.004000)
3060 meta     PDS_SHORT_SPOOFED_URL __PDS_MSG_1024 && __SPOOFED_URL && !(__VIA_ML || __SENDER_BOT || __YAHOO_BULK || __UNSUB_LINK || __THREADED || __URL_SHORTENER)
3061 describe PDS_SHORT_SPOOFED_URL HTML message short and T_SPOOFED_URL (S_U_FP)
3062 #score    PDS_SHORT_SPOOFED_URL 2.0
3063 endif
3064 endif
3065 ##} PDS_SHORT_SPOOFED_URL ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
3066
3067 ##{ PDS_TINYSUBJ_URISHRT ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
3068
3069 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
3070 if (version >= 3.004000)
3071 meta     PDS_TINYSUBJ_URISHRT __URL_SHORTENER && __SUBJ_SHORT && __PDS_MSG_1024
3072 describe PDS_TINYSUBJ_URISHRT Short subject with URL shortener
3073 #score    PDS_TINYSUBJ_URISHRT 1.5 # limit
3074 endif
3075 endif
3076 ##} PDS_TINYSUBJ_URISHRT ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
3077
3078 ##{ PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE
3079
3080 meta     PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE FREEMAIL_FORGED_REPLYTO && __PDS_TONAME_EQ_TOLOCAL
3081 describe PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE Forged replyto and __PDS_TONAME_EQ_TOLOCAL
3082 #score    PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE 2.0 # limit
3083 ##} PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE
3084
3085 ##{ PDS_TONAME_EQ_TOLOCAL_VSHORT
3086
3087 meta     PDS_TONAME_EQ_TOLOCAL_VSHORT __KAM_BODY_LENGTH_LT_128 && __PDS_TONAME_EQ_TOLOCAL
3088 describe PDS_TONAME_EQ_TOLOCAL_VSHORT Very short body and From looks like 2 different emails
3089 #score    PDS_TONAME_EQ_TOLOCAL_VSHORT 1.0 # limit
3090 ##} PDS_TONAME_EQ_TOLOCAL_VSHORT
3091
3092 ##{ PHISH_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
3093
3094 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
3095   meta         PHISH_ATTACH          (__PHISH_ATTACH_01_01 || __PHISH_ATTACH_01_02) && !__HAS_SENDER
3096   describe     PHISH_ATTACH          Attachment filename suspicious, probable phishing
3097   tflags       PHISH_ATTACH          publish
3098 endif
3099 ##} PHISH_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
3100
3101 ##{ PHISH_AZURE_CLOUDAPP
3102
3103 uri PHISH_AZURE_CLOUDAPP m;^https?://(?=[^/]+\.cloudapp\.azure\.com)(?:(?:b(?:illetedecalle\.northeurope|urofaxnotificado\.eastus)|comprobante(?:digital\.southcentralus|fiscale\.eastus)|infracciondeestacionamiento(?:\.eastus|s\.ukwest)|multa(?:detrafico\.eastus|prev\.eastus|s\.(?:eastus|southcentralus))|notificadosburofax\.eastus|penadetransitomulta\.eastus))\.cloudapp\.azure\.com/;i
3104 describe PHISH_AZURE_CLOUDAPP Link to known phishing web application
3105 #score PHISH_AZURE_CLOUDAPP 3.500
3106 tflags PHISH_AZURE_CLOUDAPP publish
3107 ##} PHISH_AZURE_CLOUDAPP
3108
3109 ##{ PHISH_FBASEAPP
3110
3111 meta       PHISH_FBASEAPP              __PHISH_FBASE_01
3112 describe   PHISH_FBASEAPP              Probable phishing via hosted web app
3113 #score      PHISH_FBASEAPP              3.000   # limit
3114 tflags     PHISH_FBASEAPP              publish
3115 ##} PHISH_FBASEAPP
3116
3117 ##{ PHP_NOVER_MUA
3118
3119 describe  PHP_NOVER_MUA       Mail from PHP with no version number
3120 #score     PHP_NOVER_MUA       3.000    # limit
3121 tflags    PHP_NOVER_MUA       publish
3122 ##} PHP_NOVER_MUA
3123
3124 ##{ PHP_NOVER_MUA if !plugin(Mail::SpamAssassin::Plugin::DKIM)
3125
3126 if !plugin(Mail::SpamAssassin::Plugin::DKIM)
3127   meta    PHP_NOVER_MUA       __PHP_NOVER_MUA && !__TO_NO_BRKTS_HTML_ONLY && !__MSGID_OK_DIGITS && !__UPPERCASE_25_50 && !__RP_MATCHES_RCVD && !__GIF_ATTACH
3128 endif
3129 ##} PHP_NOVER_MUA if !plugin(Mail::SpamAssassin::Plugin::DKIM)
3130
3131 ##{ PHP_NOVER_MUA ifplugin Mail::SpamAssassin::Plugin::DKIM
3132
3133 ifplugin Mail::SpamAssassin::Plugin::DKIM
3134   meta    PHP_NOVER_MUA       __PHP_NOVER_MUA && !__DKIM_DEPENDABLE && !__TO_NO_BRKTS_HTML_ONLY && !__MSGID_OK_DIGITS && !__UPPERCASE_25_50 && !__RP_MATCHES_RCVD && !__GIF_ATTACH
3135 endif
3136 ##} PHP_NOVER_MUA ifplugin Mail::SpamAssassin::Plugin::DKIM
3137
3138 ##{ PHP_ORIG_SCRIPT
3139
3140 meta       PHP_ORIG_SCRIPT             __PHP_ORIG_SCRIPT_SONLY && !ALL_TRUSTED && !__SUBSCRIPTION_INFO && !__MSGID_BEFORE_RECEIVED && !MSGID_FROM_MTA_HEADER
3141 describe   PHP_ORIG_SCRIPT             Sent by bot & other signs
3142 #score      PHP_ORIG_SCRIPT             2.500   # limit
3143 tflags     PHP_ORIG_SCRIPT             publish
3144 ##} PHP_ORIG_SCRIPT
3145
3146 ##{ PHP_ORIG_SCRIPT_EVAL
3147
3148 meta       PHP_ORIG_SCRIPT_EVAL        __PHP_ORIG_SCRIPT_EVAL
3149 describe   PHP_ORIG_SCRIPT_EVAL        From suspicious PHP source
3150 #score      PHP_ORIG_SCRIPT_EVAL        3.000   # limit
3151 ##} PHP_ORIG_SCRIPT_EVAL
3152
3153 ##{ PHP_SCRIPT
3154
3155 meta       PHP_SCRIPT                  __HAS_PHP_SCRIPT && !ALL_TRUSTED && !__PHP_NOVER_MUA && !__TO___LOWER && !__MIME_BASE64 && !__HAS_ANY_EMAIL && !__L_CTE_7BIT
3156 describe   PHP_SCRIPT                  Sent by PHP script
3157 #score      PHP_SCRIPT                  2.500   # limit
3158 tflags     PHP_SCRIPT                  publish
3159 ##} PHP_SCRIPT
3160
3161 ##{ PHP_SCRIPT_MUA
3162
3163 meta       PHP_SCRIPT_MUA              __HAS_PHP_SCRIPT && __PHP_NOVER_MUA
3164 describe   PHP_SCRIPT_MUA              Sent by PHP script, no version number
3165 #score      PHP_SCRIPT_MUA              2.000   # limit
3166 tflags     PHP_SCRIPT_MUA              publish
3167 ##} PHP_SCRIPT_MUA
3168
3169 ##{ POSSIBLE_APPLE_PHISH_02
3170
3171 meta       POSSIBLE_APPLE_PHISH_02     (__FROM_NAME_APPLECOM && !__HDR_RCVD_APPLE)
3172 describe   POSSIBLE_APPLE_PHISH_02     Claims to be from apple but not processed by any apple MTA
3173 tflags     POSSIBLE_APPLE_PHISH_02     publish
3174 ##} POSSIBLE_APPLE_PHISH_02
3175
3176 ##{ POSSIBLE_EBAY_PHISH_02
3177
3178 meta       POSSIBLE_EBAY_PHISH_02      (__FROM_NAME_EBAYCOM && !__HDR_RCVD_EBAY)
3179 describe   POSSIBLE_EBAY_PHISH_02      Claims to be from ebay but not processed by any ebay MTA
3180 tflags     POSSIBLE_EBAY_PHISH_02      publish
3181 ##} POSSIBLE_EBAY_PHISH_02
3182
3183 ##{ POSSIBLE_GMAIL_PHISHER
3184
3185 meta       POSSIBLE_GMAIL_PHISHER      (__FROM_ADDR_GMAIL && __NAME_EMAIL_DIFF)
3186 describe   POSSIBLE_GMAIL_PHISHER      Apparent phishing email sent from a gmail account
3187 ##} POSSIBLE_GMAIL_PHISHER
3188
3189 ##{ POSSIBLE_PAYPAL_PHISH_01
3190
3191 meta       POSSIBLE_PAYPAL_PHISH_01    (__FROM_NAME_PAYPALCOM && __NAME_EMAIL_DIFF)
3192 describe   POSSIBLE_PAYPAL_PHISH_01    Claims to be from paypal but has non-paypal from email address
3193 tflags     POSSIBLE_PAYPAL_PHISH_01    publish
3194 ##} POSSIBLE_PAYPAL_PHISH_01
3195
3196 ##{ POSSIBLE_PAYPAL_PHISH_02
3197
3198 meta       POSSIBLE_PAYPAL_PHISH_02    (__FROM_NAME_PAYPALCOM && !__HDR_RCVD_PAYPAL)
3199 describe   POSSIBLE_PAYPAL_PHISH_02    Claims to be from paypal but not processed by any paypal MTA
3200 tflags     POSSIBLE_PAYPAL_PHISH_02    publish
3201 ##} POSSIBLE_PAYPAL_PHISH_02
3202
3203 ##{ PP_MIME_FAKE_ASCII_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEEval if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_for_ascii_text_illegal)
3204
3205 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
3206   if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_for_ascii_text_illegal)
3207     body     PP_MIME_FAKE_ASCII_TEXT  eval:check_for_ascii_text_illegal()
3208     describe PP_MIME_FAKE_ASCII_TEXT  MIME text/plain claims to be ASCII but isn't
3209 #    score    PP_MIME_FAKE_ASCII_TEXT  1.0
3210     tflags   PP_MIME_FAKE_ASCII_TEXT  publish
3211 endif
3212 endif
3213 ##} PP_MIME_FAKE_ASCII_TEXT ifplugin Mail::SpamAssassin::Plugin::MIMEEval if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_for_ascii_text_illegal)
3214
3215 ##{ PP_TOO_MUCH_UNICODE02 ifplugin Mail::SpamAssassin::Plugin::MIMEEval if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_abundant_unicode_ratio)
3216
3217 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
3218   if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_abundant_unicode_ratio)
3219     body     PP_TOO_MUCH_UNICODE02      eval:check_abundant_unicode_ratio(0.02)
3220     describe PP_TOO_MUCH_UNICODE02      Is text/plain but has many unicode escapes
3221 #    score    PP_TOO_MUCH_UNICODE02      0.5
3222     tflags   PP_TOO_MUCH_UNICODE02      publish
3223 endif
3224 endif
3225 ##} PP_TOO_MUCH_UNICODE02 ifplugin Mail::SpamAssassin::Plugin::MIMEEval if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_abundant_unicode_ratio)
3226
3227 ##{ PP_TOO_MUCH_UNICODE05 ifplugin Mail::SpamAssassin::Plugin::MIMEEval if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_abundant_unicode_ratio)
3228
3229 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
3230   if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_abundant_unicode_ratio)
3231     body     PP_TOO_MUCH_UNICODE05      eval:check_abundant_unicode_ratio(0.05)
3232     describe PP_TOO_MUCH_UNICODE05      Is text/plain but has many unicode escapes
3233 #    score    PP_TOO_MUCH_UNICODE05     1.0
3234     tflags   PP_TOO_MUCH_UNICODE05      publish
3235 endif
3236 endif
3237 ##} PP_TOO_MUCH_UNICODE05 ifplugin Mail::SpamAssassin::Plugin::MIMEEval if can(Mail::SpamAssassin::Plugin::MIMEEval::has_check_abundant_unicode_ratio)
3238
3239 ##{ PUMPDUMP
3240
3241 meta        PUMPDUMP          (__PUMPDUMP_01 || __PUMPDUMP_02 || __PUMPDUMP_03 || __PUMPDUMP_04 || __PUMPDUMP_05 || __PUMPDUMP_06 || __PUMPDUMP_07 || __PUMPDUMP_08 || __PUMPDUMP_09 || __PUMPDUMP_10) && !PUMPDUMP_MULTI
3242 describe    PUMPDUMP          Pump-and-dump stock scam phrase
3243 #score       PUMPDUMP          1.000    # limit
3244 tflags      PUMPDUMP          publish
3245 ##} PUMPDUMP
3246
3247 ##{ PUMPDUMP_MULTI
3248
3249 meta        PUMPDUMP_MULTI    (__PUMPDUMP_01+__PUMPDUMP_02+__PUMPDUMP_03+__PUMPDUMP_04+__PUMPDUMP_05+__PUMPDUMP_06+__PUMPDUMP_07+__PUMPDUMP_08+__PUMPDUMP_09+__PUMPDUMP_10) > 1
3250 describe    PUMPDUMP_MULTI    Pump-and-dump stock scam phrases
3251 #score       PUMPDUMP_MULTI    3.500    # limit
3252 tflags      PUMPDUMP_MULTI    publish
3253 ##} PUMPDUMP_MULTI
3254
3255 ##{ PUMPDUMP_TIP
3256
3257 meta        PUMPDUMP_TIP      __PD_CNT_1 && __STOCK_TIP
3258 describe    PUMPDUMP_TIP      Pump-and-dump stock tip
3259 tflags      PUMPDUMP_TIP      publish
3260 ##} PUMPDUMP_TIP
3261
3262 ##{ RAND_HEADER_LIST_SPOOF
3263
3264 meta      RAND_HEADER_LIST_SPOOF       __RAND_HEADER && __LIST_PARTIAL
3265 describe  RAND_HEADER_LIST_SPOOF       Random gibberish message header(s) + pretending to be a mailing list
3266 #score     RAND_HEADER_LIST_SPOOF       3.000   # limit
3267 tflags    RAND_HEADER_LIST_SPOOF       publish
3268 ##} RAND_HEADER_LIST_SPOOF
3269
3270 ##{ RAND_HEADER_MANY
3271
3272 meta      RAND_HEADER_MANY             __RAND_HEADER_2
3273 describe  RAND_HEADER_MANY             Multiple random gibberish message headers
3274 #score     RAND_HEADER_MANY             3.000   # limit
3275 tflags    RAND_HEADER_MANY             publish
3276 ##} RAND_HEADER_MANY
3277
3278 ##{ RAND_MKTG_HEADER
3279
3280 meta      RAND_MKTG_HEADER             __RAND_MKTG_HEADER && !__HAVE_BOUNCE_RELAYS && !__HAS_THREAD_INDEX && !__HAS_X_MAILING_LIST
3281 describe  RAND_MKTG_HEADER             Has partially-randomized marketing/tracking header(s)
3282 #score     RAND_MKTG_HEADER             2.000   # limit
3283 tflags    RAND_MKTG_HEADER             publish
3284 ##} RAND_MKTG_HEADER
3285
3286 ##{ RATWARE_NO_RDNS
3287
3288 meta       RATWARE_NO_RDNS            __RATWARE_BOUND_A && __RDNS_NONE && __MIME_HTML && __MISSING_REF
3289 describe   RATWARE_NO_RDNS            Suspicious MsgID and MIME boundary + no rDNS
3290 #score      RATWARE_NO_RDNS            3.000    # limit
3291 ##} RATWARE_NO_RDNS
3292
3293 ##{ RCVD_BAD_ID
3294
3295 header RCVD_BAD_ID      Received =~ /\bid\s+[a-zA-Z0-9_+\/\\,-]+(?:[!"\#\$\%&'()*<=>?\@\[\]^\`{|}~]|;\S)/
3296 describe RCVD_BAD_ID    Received header contains id field with bad characters
3297 ##} RCVD_BAD_ID
3298
3299 ##{ RCVD_DBL_DQ
3300
3301 header      RCVD_DBL_DQ                Received =~ /(?:\[\d+\.\d+\.\d+\.\d+\]){2}/
3302 describe    RCVD_DBL_DQ                Malformatted message header
3303 tflags      RCVD_DBL_DQ                publish
3304 ##} RCVD_DBL_DQ
3305
3306 ##{ RCVD_DOTEDU_SHORT
3307
3308 meta       RCVD_DOTEDU_SHORT           __RCVD_DOTEDU_SHORT && !ALL_TRUSTED && !__FS_SUBJ_RE && !__HAS_LIST_ID
3309 describe   RCVD_DOTEDU_SHORT           Via .edu MTA + short message
3310 #score      RCVD_DOTEDU_SHORT           1.500   # limit
3311 tflags     RCVD_DOTEDU_SHORT           publish
3312 ##} RCVD_DOTEDU_SHORT
3313
3314 ##{ RCVD_DOTEDU_SUSP_URI
3315
3316 meta       RCVD_DOTEDU_SUSP_URI        __RCVD_DOTEDU_SUSP_URI
3317 describe   RCVD_DOTEDU_SUSP_URI        Via .edu MTA + suspicious URI
3318 #score      RCVD_DOTEDU_SUSP_URI        3.000   # limit
3319 tflags     RCVD_DOTEDU_SUSP_URI        publish
3320 ##} RCVD_DOTEDU_SUSP_URI
3321
3322 ##{ RCVD_FORGED_WROTE
3323
3324 header RCVD_FORGED_WROTE    Received =~ / by \S+ with esmtp \([^a-z ]{6,} [^a-z ]{3,}\) id/
3325 describe RCVD_FORGED_WROTE  Forged 'Received' header found ('wrote:' spam)
3326 ##} RCVD_FORGED_WROTE
3327
3328 ##{ RCVD_FORGED_WROTE2
3329
3330 header RCVD_FORGED_WROTE2 Received =~ /from [0-9.]+ \(HELO \S+[A-Za-z]+\) by (\S+) with esmtp \(\S+\s\S+\) id \S{6}-\S{6}-\S\S for \S+@\1;/s
3331 ##} RCVD_FORGED_WROTE2
3332
3333 ##{ RCVD_IN_IADB_DK ifplugin Mail::SpamAssassin::Plugin::DNSEval
3334
3335 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3336 header RCVD_IN_IADB_DK                  eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.3')
3337 describe RCVD_IN_IADB_DK                IADB: Sender publishes Domain Keys record
3338 tflags RCVD_IN_IADB_DK                  net nice
3339 endif
3340 ##} RCVD_IN_IADB_DK ifplugin Mail::SpamAssassin::Plugin::DNSEval
3341
3342 ##{ RCVD_IN_IADB_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval
3343
3344 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3345 header RCVD_IN_IADB_DOPTIN              eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.10')
3346 describe RCVD_IN_IADB_DOPTIN            IADB: All mailing list mail is confirmed opt-in
3347 tflags RCVD_IN_IADB_DOPTIN              net nice
3348 endif
3349 ##} RCVD_IN_IADB_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval
3350
3351 ##{ RCVD_IN_IADB_DOPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3352
3353 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3354 header RCVD_IN_IADB_DOPTIN_GT50         eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.9')
3355 describe RCVD_IN_IADB_DOPTIN_GT50       IADB: Confirmed opt-in used more than 50% of the time
3356 tflags RCVD_IN_IADB_DOPTIN_GT50         net nice
3357 endif
3358 ##} RCVD_IN_IADB_DOPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3359
3360 ##{ RCVD_IN_IADB_DOPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3361
3362 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3363 header RCVD_IN_IADB_DOPTIN_LT50         eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.8')
3364 describe RCVD_IN_IADB_DOPTIN_LT50       IADB: Confirmed opt-in used less than 50% of the time
3365 tflags RCVD_IN_IADB_DOPTIN_LT50         net nice
3366 endif
3367 ##} RCVD_IN_IADB_DOPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3368
3369 ##{ RCVD_IN_IADB_EDDB ifplugin Mail::SpamAssassin::Plugin::DNSEval
3370
3371 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3372 header RCVD_IN_IADB_EDDB                eval:check_rbl_sub('iadb-firsttrusted', '127.0.2.1')
3373 describe RCVD_IN_IADB_EDDB              IADB: Participates in Email Deliverability Database
3374 tflags RCVD_IN_IADB_EDDB                net nice
3375 endif
3376 ##} RCVD_IN_IADB_EDDB ifplugin Mail::SpamAssassin::Plugin::DNSEval
3377
3378 ##{ RCVD_IN_IADB_EPIA ifplugin Mail::SpamAssassin::Plugin::DNSEval
3379
3380 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3381 header RCVD_IN_IADB_EPIA                eval:check_rbl_sub('iadb-firsttrusted', '127.0.2.2')
3382 describe RCVD_IN_IADB_EPIA              IADB: Member of Email Processing Industry Alliance
3383 tflags RCVD_IN_IADB_EPIA                net nice
3384 endif
3385 ##} RCVD_IN_IADB_EPIA ifplugin Mail::SpamAssassin::Plugin::DNSEval
3386
3387 ##{ RCVD_IN_IADB_GOODMAIL ifplugin Mail::SpamAssassin::Plugin::DNSEval
3388
3389 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3390 header RCVD_IN_IADB_GOODMAIL            eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.103')
3391 describe RCVD_IN_IADB_GOODMAIL          IADB: Sender has been certified by GoodMail
3392 tflags RCVD_IN_IADB_GOODMAIL            net nice
3393 endif
3394 ##} RCVD_IN_IADB_GOODMAIL ifplugin Mail::SpamAssassin::Plugin::DNSEval
3395
3396 ##{ RCVD_IN_IADB_LISTED ifplugin Mail::SpamAssassin::Plugin::DNSEval
3397
3398 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3399 header RCVD_IN_IADB_LISTED              eval:check_rbl_sub('iadb-firsttrusted', '^127\.0\.0\.[12]$')
3400 describe RCVD_IN_IADB_LISTED            Participates in the IADB system
3401 tflags RCVD_IN_IADB_LISTED              net nice
3402 endif
3403 ##} RCVD_IN_IADB_LISTED ifplugin Mail::SpamAssassin::Plugin::DNSEval
3404
3405 ##{ RCVD_IN_IADB_LOOSE ifplugin Mail::SpamAssassin::Plugin::DNSEval
3406
3407 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3408 header RCVD_IN_IADB_LOOSE               eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.4')
3409 describe RCVD_IN_IADB_LOOSE             IADB: Adds relationship addrs w/out opt-in
3410 tflags RCVD_IN_IADB_LOOSE               net nice
3411 endif
3412 ##} RCVD_IN_IADB_LOOSE ifplugin Mail::SpamAssassin::Plugin::DNSEval
3413
3414 ##{ RCVD_IN_IADB_MI_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval
3415
3416 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3417 header RCVD_IN_IADB_MI_CPEAR            eval:check_rbl_sub('iadb-firsttrusted', '127.101.1.10')
3418 describe RCVD_IN_IADB_MI_CPEAR          IADB: Complies with Michigan's CPEAR law
3419 tflags RCVD_IN_IADB_MI_CPEAR            net nice
3420 endif
3421 ##} RCVD_IN_IADB_MI_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval
3422
3423 ##{ RCVD_IN_IADB_MI_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3424
3425 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3426 header RCVD_IN_IADB_MI_CPR_30           eval:check_rbl_sub('iadb-firsttrusted', '127.101.101.10')
3427 describe RCVD_IN_IADB_MI_CPR_30         IADB: Checked lists against Michigan's CPR within 30 days
3428 tflags RCVD_IN_IADB_MI_CPR_30           net nice
3429 endif
3430 ##} RCVD_IN_IADB_MI_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3431
3432 ##{ RCVD_IN_IADB_MI_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval
3433
3434 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3435 header RCVD_IN_IADB_MI_CPR_MAT          eval:check_rbl_sub('iadb-firsttrusted', '127.101.201.10')
3436 describe RCVD_IN_IADB_MI_CPR_MAT        IADB: Sends no material under Michigan's CPR
3437 tflags RCVD_IN_IADB_MI_CPR_MAT          net nice
3438 endif
3439 ##} RCVD_IN_IADB_MI_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval
3440
3441 ##{ RCVD_IN_IADB_ML_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval
3442
3443 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3444 header RCVD_IN_IADB_ML_DOPTIN           eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.100')
3445 describe RCVD_IN_IADB_ML_DOPTIN         IADB: Mailing list email only, confirmed opt-in
3446 tflags RCVD_IN_IADB_ML_DOPTIN           net nice
3447 endif
3448 ##} RCVD_IN_IADB_ML_DOPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval
3449
3450 ##{ RCVD_IN_IADB_NOCONTROL ifplugin Mail::SpamAssassin::Plugin::DNSEval
3451
3452 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3453 header RCVD_IN_IADB_NOCONTROL           eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.0')
3454 describe RCVD_IN_IADB_NOCONTROL         IADB: Has absolutely no mailing controls in place
3455 tflags RCVD_IN_IADB_NOCONTROL           net nice
3456 endif
3457 ##} RCVD_IN_IADB_NOCONTROL ifplugin Mail::SpamAssassin::Plugin::DNSEval
3458
3459 ##{ RCVD_IN_IADB_OOO ifplugin Mail::SpamAssassin::Plugin::DNSEval
3460
3461 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3462 header RCVD_IN_IADB_OOO                 eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.200')
3463 describe RCVD_IN_IADB_OOO               IADB: One-to-one/transactional email only
3464 tflags RCVD_IN_IADB_OOO                 net nice
3465 endif
3466 ##} RCVD_IN_IADB_OOO ifplugin Mail::SpamAssassin::Plugin::DNSEval
3467
3468 ##{ RCVD_IN_IADB_OPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval
3469
3470 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3471 header RCVD_IN_IADB_OPTIN               eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.7')
3472 describe RCVD_IN_IADB_OPTIN             IADB: All mailing list mail is opt-in
3473 tflags RCVD_IN_IADB_OPTIN               net nice
3474 endif
3475 ##} RCVD_IN_IADB_OPTIN ifplugin Mail::SpamAssassin::Plugin::DNSEval
3476
3477 ##{ RCVD_IN_IADB_OPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3478
3479 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3480 header RCVD_IN_IADB_OPTIN_GT50          eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.6')
3481 describe RCVD_IN_IADB_OPTIN_GT50        IADB: Opt-in used more than 50% of the time
3482 tflags RCVD_IN_IADB_OPTIN_GT50          net nice
3483 endif
3484 ##} RCVD_IN_IADB_OPTIN_GT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3485
3486 ##{ RCVD_IN_IADB_OPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3487
3488 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3489 header RCVD_IN_IADB_OPTIN_LT50          eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.5')
3490 describe RCVD_IN_IADB_OPTIN_LT50        IADB: Opt-in used less than 50% of the time
3491 tflags RCVD_IN_IADB_OPTIN_LT50          net nice
3492 endif
3493 ##} RCVD_IN_IADB_OPTIN_LT50 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3494
3495 ##{ RCVD_IN_IADB_OPTOUTONLY ifplugin Mail::SpamAssassin::Plugin::DNSEval
3496
3497 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3498 header RCVD_IN_IADB_OPTOUTONLY          eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.1')
3499 describe RCVD_IN_IADB_OPTOUTONLY        IADB: Scrapes addresses, pure opt-out only
3500 tflags RCVD_IN_IADB_OPTOUTONLY          net nice
3501 endif
3502 ##} RCVD_IN_IADB_OPTOUTONLY ifplugin Mail::SpamAssassin::Plugin::DNSEval
3503
3504 ##{ RCVD_IN_IADB_RDNS ifplugin Mail::SpamAssassin::Plugin::DNSEval
3505
3506 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3507 header RCVD_IN_IADB_RDNS                eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.4')
3508 describe RCVD_IN_IADB_RDNS              IADB: Sender has reverse DNS record
3509 tflags RCVD_IN_IADB_RDNS                net nice
3510 endif
3511 ##} RCVD_IN_IADB_RDNS ifplugin Mail::SpamAssassin::Plugin::DNSEval
3512
3513 ##{ RCVD_IN_IADB_SENDERID ifplugin Mail::SpamAssassin::Plugin::DNSEval
3514
3515 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3516 header RCVD_IN_IADB_SENDERID            eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.2')
3517 describe RCVD_IN_IADB_SENDERID          IADB: Sender publishes Sender ID record
3518 tflags RCVD_IN_IADB_SENDERID            net nice
3519 endif
3520 ##} RCVD_IN_IADB_SENDERID ifplugin Mail::SpamAssassin::Plugin::DNSEval
3521
3522 ##{ RCVD_IN_IADB_SPF ifplugin Mail::SpamAssassin::Plugin::DNSEval
3523
3524 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3525 header RCVD_IN_IADB_SPF                 eval:check_rbl_sub('iadb-firsttrusted', '127.2.255.1')
3526 describe RCVD_IN_IADB_SPF               IADB: Sender publishes SPF record
3527 tflags RCVD_IN_IADB_SPF                 net nice
3528 endif
3529 ##} RCVD_IN_IADB_SPF ifplugin Mail::SpamAssassin::Plugin::DNSEval
3530
3531 ##{ RCVD_IN_IADB_UNVERIFIED_1 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3532
3533 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3534 header RCVD_IN_IADB_UNVERIFIED_1        eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.2')
3535 describe RCVD_IN_IADB_UNVERIFIED_1      IADB: Accepts unverified sign-ups
3536 tflags RCVD_IN_IADB_UNVERIFIED_1        net nice
3537 endif
3538 ##} RCVD_IN_IADB_UNVERIFIED_1 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3539
3540 ##{ RCVD_IN_IADB_UNVERIFIED_2 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3541
3542 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3543 header RCVD_IN_IADB_UNVERIFIED_2        eval:check_rbl_sub('iadb-firsttrusted', '127.3.100.3')
3544 describe RCVD_IN_IADB_UNVERIFIED_2      IADB: Accepts unverified sign-ups, gives chance to opt out
3545 tflags RCVD_IN_IADB_UNVERIFIED_2        net nice
3546 endif
3547 ##} RCVD_IN_IADB_UNVERIFIED_2 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3548
3549 ##{ RCVD_IN_IADB_UT_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval
3550
3551 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3552 header RCVD_IN_IADB_UT_CPEAR            eval:check_rbl_sub('iadb-firsttrusted', '127.101.2.10')
3553 describe RCVD_IN_IADB_UT_CPEAR          IADB: Complies with Utah's CPEAR law
3554 tflags RCVD_IN_IADB_UT_CPEAR            net nice
3555 endif
3556 ##} RCVD_IN_IADB_UT_CPEAR ifplugin Mail::SpamAssassin::Plugin::DNSEval
3557
3558 ##{ RCVD_IN_IADB_UT_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3559
3560 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3561 header RCVD_IN_IADB_UT_CPR_30           eval:check_rbl_sub('iadb-firsttrusted', '127.101.102.10')
3562 describe RCVD_IN_IADB_UT_CPR_30         IADB: Checked lists against Utah's CPR within 30 days
3563 tflags RCVD_IN_IADB_UT_CPR_30           net nice
3564 endif
3565 ##} RCVD_IN_IADB_UT_CPR_30 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3566
3567 ##{ RCVD_IN_IADB_UT_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval
3568
3569 ifplugin Mail::SpamAssassin::Plugin::DNSEval
3570 header RCVD_IN_IADB_UT_CPR_MAT          eval:check_rbl_sub('iadb-firsttrusted', '127.101.202.10')
3571 describe RCVD_IN_IADB_UT_CPR_MAT        IADB: Sends no material under Utah's CPR
3572 tflags RCVD_IN_IADB_UT_CPR_MAT          net nice
3573 endif
3574 ##} RCVD_IN_IADB_UT_CPR_MAT ifplugin Mail::SpamAssassin::Plugin::DNSEval
3575
3576 ##{ RCVD_IN_PSBL ifplugin Mail::SpamAssassin::Plugin::DNSEval # {
3577
3578 ifplugin Mail::SpamAssassin::Plugin::DNSEval # {
3579 header   RCVD_IN_PSBL  eval:check_rbl('psbl-lastexternal', 'psbl.surriel.com.')
3580 describe RCVD_IN_PSBL  Received via a relay in PSBL
3581 tflags   RCVD_IN_PSBL  net
3582 endif
3583 ##} RCVD_IN_PSBL ifplugin Mail::SpamAssassin::Plugin::DNSEval # {
3584
3585 ##{ RCVD_MAIL_COM
3586
3587 header RCVD_MAIL_COM        Received =~ /[\s\(\[](?:post|mail)\.com[\s\)\]]/is
3588 describe RCVD_MAIL_COM      Forged Received header (contains post.com or mail.com)
3589 ##} RCVD_MAIL_COM
3590
3591 ##{ RDNS_LOCALHOST
3592
3593 header         RDNS_LOCALHOST  X-Spam-Relays-External =~ /^\[ ip=(?!127)\d+\.\d+\.\d+\.\d+ rdns=localhost(?:\.localdomain)? /i
3594 describe       RDNS_LOCALHOST  Sender's public rDNS is "localhost"
3595 ##} RDNS_LOCALHOST
3596
3597 ##{ RDNS_NUM_TLD_ATCHNX
3598
3599 meta       RDNS_NUM_TLD_ATCHNX         __RDNS_NUMERIC_TLD && __ATTACH_NAME_NO_EXT
3600 describe   RDNS_NUM_TLD_ATCHNX         Relay rDNS has numeric TLD + suspicious attachment
3601 #score      RDNS_NUM_TLD_ATCHNX         3.000   # limit
3602 tflags     RDNS_NUM_TLD_ATCHNX         publish
3603 ##} RDNS_NUM_TLD_ATCHNX
3604
3605 ##{ RDNS_NUM_TLD_XM
3606
3607 meta       RDNS_NUM_TLD_XM             __RDNS_NUMERIC_TLD && (__HAS_XM_SID || __HAS_XM_LID || __HAS_XM_RECPTID || __HAS_XM_SENTBY)
3608 describe   RDNS_NUM_TLD_XM             Relay rDNS has numeric TLD + suspicious headers
3609 #score      RDNS_NUM_TLD_XM             3.000   # limit
3610 tflags     RDNS_NUM_TLD_XM             publish
3611 ##} RDNS_NUM_TLD_XM
3612
3613 ##{ REPLYTO_WITHOUT_TO_CC
3614
3615 meta REPLYTO_WITHOUT_TO_CC     (__HAS_REPLY_TO && !__TOCC_EXISTS)
3616 ##} REPLYTO_WITHOUT_TO_CC
3617
3618 ##{ REPTO_419_FRAUD
3619
3620 header REPTO_419_FRAUD Reply-To:addr =~ /^(?![^\s<>@]+\@(?:(?:gmail|yahoo|outlook|hotmail|aol|yandex|protonmail|qq|consultant)\.com|yahoo\.co\.jp)(?:$|[>,\s]))(?:(?:mail)\@101private\.com|(?:(?:alfredcheuk002|mavis_wanczyk))\@126\.com|(?:(?:alfredcheuk_yuchow|ehagler))\@163\.com|(?:mathew\.yon2)\@abbsinvestment\.com|(?:wang)\@abconline\.hk|(?:russia2018worldcuplotto5)\@accountant\.com|(?:midwestern)\@adexec\.com|(?:joxford)\@adm-irs\.com|(?:office)\@admntline\.ml|(?:(?:infovsa|maria\.louge|w(?:bfefft|n\.buffett)))\@aim\.com|(?:(?:jessikasingh|lawmensa|travisalex))\@aliyun\.com|(?:(?:deanie_ron|mundo\.europe|richwetton))\@aol\.co\.uk|(?:mrssabah_ibrahim7)\@aol\.fr|(?:support)\@apostlesfoundation\.com|(?:jeromecgb12)\@asia\.com|(?:bllphillips)\@att\.net|(?:atendimento\-multiplus\-banco\-brasil)\@bb\.com|(?:(?:admin|info))\@bhleu\.com|(?:costruire)\@bigmat\.it|(?:susan\.lampard)\@bk\.ru|(?:(?:office\.uk|renataapsilva))\@bol\.com\.br|(?:onmydestiny18)\@boulevardmalls\.com|(?:luciamariacampbell)\@boximail\.com|(?:ochiaisatoruasistbank)\@brew-master\.com|(?:nicola)\@brighenti\.net|(?:mrshelen)\@btarneauds\.com|(?:inter01)\@c2\.hu|(?:20156488)\@ce\.pucmm\.edu\.do|(?:gregwingo)\@cheapnet\.it|(?:(?:andrelwotti|contact\.roycockrumgrantoffice|dbank12|fbipayment(?:50|600)|harunajim667|manuel\.rabelais|paul\.wilson|r(?:alphwjohnson|ev_markbless)|trustees101))\@citromail\.hu|(?:info)\@classicmail\.co\.za|(?:martin)\@claudiatrincado\.com|(?:irdi33)\@cock\.li|(?:federal_ministrayoffinance)\@comtube\.com|(?:cc(?:hendik|jjdesk))\@consultancydesk\.co\.ua|(?:mundo_seguros)\@contorli\.site|(?:(?:jones\-co|kellyzwo))\@cox\.net|(?:(?:brunoso|lisatroutman))\@currently\.com|(?:(?:dmalpasswb|i(?:lanasoloshneor|nfo90000)|joseramonjr1|re(?:covered\-tax|em(?:2018|alhashimi|ealhashimi|hashimi2020))))\@daum\.net|(?:blythemasters)\@digitalassetholding\.org|(?:bar_sahil)\@dominionassociates\.uk|(?:zahvoedir)\@donations\.christchurchliverpool\.xyz|(?:(?:abd\.aljassem|claimreview))\@dr\.com|(?:atmpaymentcentttt)\@e-mail\.ua|(?:rogersteare02)\@e1\.ru|(?:jesusgacia)\@eclipso\.email|(?:davison\.warwick)\@eclipso\.eu|(?:(?:denbrink|kathy_gerald1965|pch\.cliamdept))\@email\.com|(?:infoleonfredberbst)\@emailgroups\.net|(?:info)\@euro-pinnacle\.com|(?:(?:advancedsegurosespana|monitorunitbelgium))\@europe\.com|(?:us\.secretaryofstate)\@ex\.ua|(?:susanibrahim)\@exclusivemail\.co\.za|(?:lottomax)\@execs\.com|(?:jabufa)\@executivemail\.co\.za|(?:adam_moroney\.esq)\@fedco-usa\.com|(?:steven)\@federalreservebanks\.us|(?:jeferrey)\@financier\.com|(?:mrsdebbielevin)\@firemail\.de|(?:steve_dickson)\@firemail\.eu|(?:harry\.jones)\@firstbondcapital\.com|(?:admindepart)\@firstinlandbnkplc\.com|(?:info)\@fnconsultant\.biz|(?:(?:egolan2|gella1|qatardonations16|smadartsadik|tepnherve00))\@foxmail\.com|(?:zen)\@fpg\.com\.co|(?:mmpaulsmith145)\@frontier\.com|(?:mrchau1)\@gala\.net|(?:info)\@gcbonline\.co\.ua|(?:(?:bn|jb))\@getmaworldwide\.org|(?:info)\@gezimarkt\.com|(?:octaviancm)\@gmx\.co\.uk|(?:(?:ahmet\.broker|f(?:aridaomar|er3nrod1512)|kevin\-office|p\.hamedmoff|rosicboteruff|walter_anderson))\@gmx\.com|(?:(?:fernrodyup12|harrish|miraiminaki))\@gmx\.fr|(?:juliairis)\@gmx\.net|(?:(?:arthur1alan|joxford))\@gmx\.us|(?:m(?:\.johnson10012|aryclayton123))\@googlemail\.com|(?:solotexglobalcouriercompany)\@groupesgb\.net|(?:raymondchanjp)\@hkmaltd\.org|(?:marketing)\@homebg\.in|(?:christgoldwilliams)\@hotmail\.fr|(?:gtakeshi)\@htisteel\.com|(?:alexgoodwill129)\@ibibo\.com|(?:bo_li)\@imgrantfunds\.com|(?:irdi33)\@inbox\.lt|(?:imffunds)\@inbox\.lv|(?:info\.fidelity\.finance)\@inbox\.ru|(?:(?:a\.josepaulino|jonardossantos|mingmui0012|offer2021|pierresgift_2021))\@indamail\.hu|(?:lizawong)\@infohsbc\.net|(?:info)\@intarpol-int\.online|(?:sheikhwahab)\@islamicfb\.com|(?:mrsfatimahhassan[12])\@itbox\.ro|(?:info)\@johannaconsultancy\.com|(?:info)\@johnhenryorg\.com|(?:john)\@johnpedroconsults\.com|(?:(?:annzainab2022|h(?:ashimirrr22|re187390)|re(?:e(?:m\.alhashimi|ninvestor111)|mmhashimi)))\@kakao\.com|(?:europsenderscouriers)\@keemail\.me|(?:a015)\@laposte\.net|(?:johndavid)\@lawdistributionlimited\.com|(?:info)\@lbafltd\.com|(?:ecowascourt)\@legislator\.com|(?:fatih)\@leventsimsek\.com\.tr|(?:olivia_simon)\@lihat\.dds-akaun\.com|(?:pb\-2pb012)\@live\.co\.uk|(?:(?:financiero172|helen_galloway|markjohnson650))\@live\.com|(?:mr\.williamrigule)\@live\.fr|(?:miraminaki)\@lycos\.com|(?:drdanielmminele)\@magicmail\.co\.za|(?:andrewh1)\@mail2banker\.com|(?:bmwofficeinfo)\@mail2consultant\.com|(?:lanxianjun)\@mail2hongkong\.com|(?:hwc2)\@mail2world\.com|(?:shillay)\@mail\.bg|(?:(?:a(?:isha\-gaddafi0|yishagddafio|zimhashim2018)|kateclough1|mriamchombo1968))\@mail\.com|(?:ayishagddafio?)\@mail\.ru|(?:(?:publishers_clearinghouse|rev\.williamschurch))\@mail\.uk|(?:mrcheongg2012)\@mailbox\.hu|(?:cb(?:nofficemail|officemail))\@mailsire\.com|(?:doo\.yusin)\@matherline-trade\.com|(?:johannreimann)\@memeware\.net|(?:sarb_bnk086)\@meta\.ua|(?:miguel)\@miguel-sanchez\.com|(?:info)\@morbicera\.com|(?:anjer\.keith)\@ms-fsp-europe\.com|(?:cadpayout01)\@my\.com|(?:me)\@myprivatemail\.website|(?:stephanfalzer)\@myself\.com|(?:(?:reem9999|wujames))\@naver\.com|(?:abel)\@nbdeil\.com|(?:jessicahunt1960)\@net-c\.com|(?:lindsaytrembley)\@oimail\.com|(?:(?:accountingdrg|emmy\.marty))\@onet\.eu|(?:(?:allanwoodmarko1|eco\.depo\.services|fred\.grenville))\@onet\.pl|(?:jarramos)\@ono\.com|(?:pablomancilla1)\@orange\.es|(?:ahmed3khan)\@outlook\.fr|(?:info\-casino888\.com)\@ozu\.es|(?:info)\@peagent\.net|(?:andrew\.penning)\@penninglegalassociate\.com|(?:wood)\@poczta\.onet\.eu|(?:(?:m(?:aryjosen|boyaeth)|uncch\-info))\@post\.com|(?:martinahrivnakova)\@post\.cz|(?:ffundsremitunits)\@premiumtbnk\.com|(?:santiagomachado)\@presidency\.com|(?:(?:charitylisajohnrobinson700|leonardbain|stwrightsmaxinvestment))\@proton\.me|(?:ecowaspayoffice)\@protonmail\.ch|(?:uni1)\@rayana\.ir|(?:(?:franciscoperezc|garethbull808|mrsrose\.hill|robert\.cota|unionbatmpaymentsection))\@rediffmail\.com|(?:nidiabustamante)\@registerednurses\.com|(?:info)\@rehapmed\.com|(?:info)\@repsol\.org\.uk|(?:msn)\@resrubini\.com|(?:wanczykmavis101)\@rogers\.com|(?:elena\.santos)\@rollageoup\.com|(?:mrs\.rachel2013)\@safe-mail\.net|(?:enqraward)\@sbcglobal\.net|(?:fbotha2009)\@secsuremail\.com|(?:francisbotha65)\@securesvsmail\.online|(?:smtpfox\-ys2n8)\@semillasdeamor\.com\.co|(?:wils)\@send\.com|(?:ibralsmma)\@seznam\.cz|(?:(?:jimyang77|kentpace))\@sina\.com|(?:stan)\@soborka\.net|(?:dycheseaan)\@sol\.dk|(?:info(?:04|1))\@sony\.com|(?:info\.jschneider)\@spainmail\.com|(?:mroliverbergmuellers)\@specialautokins\.com|(?:barrister_hans)\@stationlibraryjhelum\.com|(?:alexander)\@stny\.rr\.com|(?:fbidirector(?:11|wadc))\@superposta\.com|(?:anders\.karlsson)\@swedbankabgroup\.com|(?:insurance_contl)\@swissmail\.com|(?:nnbank)\@szm\.sk|(?:mhua)\@tbochk\.com|(?:clory)\@technet\.it|(?:billard\.thompson)\@thompsonlawassociates\.com|(?:fabio2016)\@tim\.it|(?:bobby\.william)\@tradent\.net|(?:lopez\.rios)\@udttld\.com|(?:2100973645smsgateway)\@ukraine\.wheat-farmers\.website|(?:info)\@un-grant\.info|(?:(?:info\.(?:clev\.frb|imfamerica)|policyaddmin\.file))\@usa\.com|(?:dataphilanthropy)\@vipmail\.hu|(?:bmuczdh)\@virgilio\.it|(?:holt1231)\@w\.cn|(?:daydreamin)\@wanadoo\.fr|(?:weboffice05)\@web\.de|(?:portiaw)\@webbe\.work|(?:b(?:\-calebfirm2007|enklerk\-postpact2|oriscaleb121))\@webmail\.co\.za|(?:(?:elizabethlyonsfield|frboffice|jw\.ny\.frb))\@webmail\.hu|(?:verificationsector)\@webname\.com|(?:tbryant6)\@woh\.rr\.com|(?:henleywatkinss)\@y7mail\.com|(?:johnkwanghooi101)\@yahoo\.c|(?:chapelliermadeleine)\@yahoo\.ca|(?:arroblutt\.paymentoffice)\@yahoo\.cn|(?:bencook5511)\@yahoo\.co\.nz|(?:gloriamoses02)\@yahoo\.co\.th|(?:(?:abigailbanga1975|jeffwilliam207|owengreen70|samue95))\@yahoo\.co\.uk|(?:(?:changgordon946|thomaspeter227))\@yahoo\.com\.hk|(?:boa2cb)\@yahoo\.com\.vn|(?:contactus88\-00)\@yahoo\.es|(?:fortinsandrine)\@yahoo\.fr|(?:dr\.amelia\.george1)\@yandex\.ru|(?:(?:alfred_cheuk_chow|maviswanczyk01))\@yeah\.net|(?:(?:avaethan21|westernunion817))\@ymail\.com|(?:goldfish20123)\@zing\.vn|(?:jefflindsay)\@zoho\.com|(?:(?:benaffleck1977|monicadaniels909))\@zohomail\.com|(?:laprimitivaes)\@zohomail\.eu)$/i
3621 describe REPTO_419_FRAUD Reply-To is known advance fee fraud collector mailbox
3622 #score REPTO_419_FRAUD 3.000
3623 tflags REPTO_419_FRAUD publish
3624 ##} REPTO_419_FRAUD
3625
3626 ##{ REPTO_419_FRAUD_AOL
3627
3628 header REPTO_419_FRAUD_AOL Reply-To:addr =~ /^(?=[^\s<>@]+\@aol\.com)(?:(?:a(?:brajjohn|f\.2[06]|ljaber111|meliageorge|nd(?:_bley|rew_hans)|rthur\.alan)|b(?:a(?:anidleewy|rr_luc)|claimdept)|c(?:\.european|allumfoundation|h(?:anprivacy03|eungdavidd|ngeric|ristyruwalt)|laimdept21|ristinabruno38|ustom_service58)|d(?:avid\.kms|hodgkins001|ianwaynie)|e(?:ricalbertdpm|velynjoshua44)|f(?:d\.29|ernandezfernandez3|oundation\.charity)|g(?:arang\.rebeca|eorge_clifford4|roupfacility)|hernandezrosemary632|jmesaud|k\.doreen00|l(?:\.b162k|erynnewest99|isarobinson5\.0|orrainewirangee|ynnpage44)|m(?:_l\.wanczyk62|a(?:sayohara21|viswanczyk[do])|rs(?:isabelladzsesszika|janetedwards0001|safiagaddafi))|officework172|p(?:aulpollard2|otfolio\.management)|royalpalace2018|s(?:\.fofo|afiiagadafi|ovchan|pwalker721|t(?:aatsloterijnederlands|efano_pessina))|usembassy330|wattson\.renwick|yurdaaytarkan5))\@aol\.com$/i
3629 describe REPTO_419_FRAUD_AOL Reply-To is known advance fee fraud collector mailbox
3630 #score REPTO_419_FRAUD_AOL 3.000
3631 tflags REPTO_419_FRAUD_AOL publish
3632 ##} REPTO_419_FRAUD_AOL
3633
3634 ##{ REPTO_419_FRAUD_AOL_LOOSE
3635
3636 meta REPTO_419_FRAUD_AOL_LOOSE __REPTO_419_FRAUD_AOL_LOOSE && !REPTO_419_FRAUD_AOL
3637 describe REPTO_419_FRAUD_AOL_LOOSE Ends-in-digits Reply-To is similar to known advance fee fraud collector mailbox
3638 #score REPTO_419_FRAUD_AOL_LOOSE 1.000
3639 tflags REPTO_419_FRAUD_AOL_LOOSE publish
3640 ##} REPTO_419_FRAUD_AOL_LOOSE
3641
3642 ##{ REPTO_419_FRAUD_CNS
3643
3644 header REPTO_419_FRAUD_CNS Reply-To:addr =~ /^(?=[^\s<>@]+\@consultant\.com)(?:(?:anthonyalvarad|davidhenri|lottomaxclaims7|morrisherb|t(?:eo\.westin|he\.trustees1|rustees202000)|westernuniopayment\.agent0018))\@consultant\.com$/i
3645 describe REPTO_419_FRAUD_CNS Reply-To is known advance fee fraud collector mailbox
3646 #score REPTO_419_FRAUD_CNS 3.000
3647 tflags REPTO_419_FRAUD_CNS publish
3648 ##} REPTO_419_FRAUD_CNS
3649
3650 ##{ REPTO_419_FRAUD_GM
3651
3652 header REPTO_419_FRAUD_GM Reply-To:addr =~ /^(?=[^\s<>@]+\@gmail\.com)(?:(?:01marviswanczyk|7912richardtony|9porssts9|a(?:\.wafager1|b(?:d(?:97412345|ullahmundani019)|u(?:lkareem461|shadi0004))|c(?:count\.optionsmr\.jonasarmstrong|ecere001)|d(?:iallo\.boa|rabidiahmed)|isha(?:1976(?:algaddafi|gaddafi25)|gaddafiaam)|l(?:\.jo60691737|an\.austin(?:041|223)|ex(?:anderpeterson4499|hoffman3319)|ghafrij13|kasimunadi221|l(?:enholden121|isoncluade11)|nizmaria|ure\.wawrenka1472)|m(?:bassadormarybethleonardl4|ericadeliverycomapny1(?:300|800)|ina(?:ltwaijiri02|medjahed95))|n(?:d(?:rewumehunitedbankforafrica|yfox0022)|n(?:a(?:llee091|sigurlaug458)|ettrevor|jenijohnsonn)|t(?:honyalvaradollc|o(?:meuenio|niopaco20consultant)))|office1office1|r(?:adka01|chibaldhamble|thur11alan)|shwestwood7|ttohlawoffice\.tg|ustinbillmark9|w1614860|z(?:i(?:m(?:\.h(?:ashim\.premj|premji13)|hashim(?:2018|donation2019))|z(?:dake0|george50))|zedineguessous))|b(?:a(?:nkcentralasiahalobca34|ochang7a|r(?:bersmadar75|clays\.kenya\.bank|rister(?:\.fidelisokafor|lordruben94)|teld\.huisman01))|bongo593|e(?:alitoniua9|linekra1|n(?:ezero392|gatl80|jaminsarah195))|ill\.lawrence0747|laisevodoun|mw(?:automobile242|officeline)|o(?:arddept0|cchenyi)|r(?:andy\.heavenscenttt|endalaporte112)|uff(?:ettwarrene21|ookj)|w1832621)|c(?:artwrighttownhomesllc|claimsa|elicerez|h(?:a(?:ngching885|r(?:itylisajohnrobinson41|l(?:es(?:luenga01|wrightdepartments)|tonnewmanus1)))|e(?:mchung1011|nchung1011)|ienkwongp)|iticonsultantjohncg0|kruger00017|l(?:axtonpaul00|s79408)|o(?:l(?:edavid77032|husseinharmuchc(?:cj|j)|ombasjuan53)|mp(?:asationsettlement|ensationcommitteboard)|n(?:sult(?:matthias|sto\.u)|tactad00[04]))|pt\.eugenebarash|r(?:abbechambers|ist(?:bru(?:05|n05)|davis67|i1537bru|ydavisdonation1))|ustomerservicelacaixa2)|d(?:29laws|a(?:n(?:008629|i(?:el35508109|shlokija)|n(?:uar4|ydan24532))|tukannuarbinmusa|vi(?:d(?:\.loanfirm18|kaltschmidtmaureend|larbi11|pere337|r(?:amirez\.luis9012|ikhen))|scarolyn334|yax98))|cole77032|e(?:n(?:iwalts|nisclark659)|partmentofstate123|tlefeckhardd)|hsdevice|i(?:ane\.s\.wojcicki|gitalassetholding|plomatsshenry)|minique200|o(?:minicahkye|na(?:ldwilliam1988|tionhelpercare5))|r(?:\.meirh|abodid|davidrhama221|jamesdee|kennedyuzo|meier\.heidi?|owenfrederick)|u(?:nsilva58|stinmoskovitz\.2facebook)|v\.metus)|e(?:benezero392|christina937|drunity|l(?:i(?:bethgomez(?:175|499)|sabethmaria600|zabethedw0)|o(?:diesawadogo123|tocashoffice1?))|m(?:2keld|efiele(?:328|g757)|ilyrichmond391)|r(?:e(?:nakgeorge123|zcelic0)|ioncarter\.private)|stherkatherine1960|vgpatmow|wynn284)|f(?:\.mikhail025|a(?:ithdesrie511|tme\.mehmed001)|blott47|e(?:deralreservebankdallasdst|lix88995)|g0067333|irstbank(?:49966|6669|k49666)|j569282|l(?:556249|uhmann\.dn)|oundations\.west|p462558|r(?:a(?:100dub132|n(?:c(?:espatrickconnolly(?:5050|4)|iscamendoza960)|k(?:j(?:ane984|wangg)|linpiesie6)))|eelottosweepstake51)|spero8[02]|u(?:lanlan28|ngg1w))|g(?:00gleggewinner19|a(?:b(?:albertoassociates|riel(?:eschmitt002|kalia1102))|r(?:ciavincent500|ethbull112016))|b(?:528796|ill4880)|e(?:neralwilliamstony990|orgekwame481|raldjhjh11)|iidp955|l(?:enmoore0011|oriachow5052)|o(?:dfreyscottdonation|glegewinnerteam|o(?:dnessxtra|golteam2019|oglegwiinner219))|r(?:aceobia001|e(?:ant311|energeoffrey776))|veraallen)|h(?:a(?:r(?:gate2909|ryebert101)|s(?:h(?:imyreem78|mireem801)|sanalshujairy))|e(?:atherbrooeke101|cto(?:alon|r(?:castillos653|scastillo6))|l(?:en(?:adamsidaho|giggs88)|pdesk47321))|g(?:8669000|old8080)|i(?:ldad837|toshurui)|o(?:nmackjohn518|rnbeckmajordennis63[478]|seoky(?:34|9))|sbchgm|uichmh)|i(?:1955smael|amannjejosonn|bed627|mf(?:deputyoff000|grantinter)|n(?:fo(?:\.(?:a(?:bogadosmfontana|nnedouglas10)|g00gleclaim|ulmusau)|64240|asminternationalpk|bankofamerikaa|dessk\.dfwairportonline|fdrserve|ttcuckk)|gridrolle2)|rvinekim67|smail(?:eman874|tarkan533))|j(?:35809121|a(?:6002932|888179|m(?:alpriv8un|esokoh82)|n(?:nsjonifer|usensecureprivate)|sonyeungchiwai|vierlesme001)|b(?:5406424|lsuntrust)|c2222222rrr|e(?:fferydean1960|nniannjhsonn|robtt)|josvu|k3311131|m(?:3461128|powellfr)|o(?:edward023|hn(?:\.wilde\.oneplusfinance|a9577|griffn818|paton\.alphafmc|r(?:awlings956|oxfordjr1)|son(?:deba|wilson(?:389|490))|uba234|walterlove2010)|monkzza|n(?:athanhaskel377|hugo1964|monkssa)|seph(?:acevedo024|ichael41)|vannyanderson001|yce00011)|rawlings007|s4fernado|uliewatson975|w6935997)|k(?:a(?:l(?:iaksandr5|tschmidtdavid8)|malnizar000|rabo\.ramala39|t(?:ebaron(?:barr|xq)|jamess043|rinaziako56))|en(?:mckenziejr|nedy\.sawadogo19)|halidbuhazza99|js09376|kasbu790|o(?:ntakt\.claim|tokairportcargo|watsusho\.co\.ltd\.jp)|rnkl1109|un(?:gwei7777|ioue28))|l(?:a(?:rrytoms200|ursent892|w(?:officealouancooparation|rencefoundation30))|blackshirepm|e(?:enasinghs97|onidasresearch|rynne(?:0west99|west2289))|i(?:amfinchus(?:11|3)|ezlnatashavanessa|fecshortt63|li(?:ane\.bettencourt1945|ianchrstph)|nelink008|sa(?:milner001|robin117))|john6132|o(?:ganntomas|rrainewirengee|ughreymargaret67)|p319765|u(?:ckywinners2018|sba\.moored2019)|w94059|y(?:\.cheapiseth909|diawright836|n(?:\.arthur011|cmba440|nmkl3332)))|m(?:a(?:bel\.manaku|ckenzbezos|damkoenig\.ruhama1b|incare655|j(?:ialfutt|or(?:dennishornbeck53|townsend01))|kaltschmidt|ll(?:am\.mlawal|etman2021)|mastar33m|n(?:ankovefimovich|duesq58|fran630|uelfranco(?:727|donation02|foundation0|spende8))|r(?:i(?:a(?:111dembele|27idemba|3(?:31lucas|51lucas)|hhills00)|opabl26|tinesecurityusa)|kroth456|shalh011|tin(?:amayer903|eziglesiasabogados|jrschwarz)|y(?:franson56|josen(?:62|81)))|thewriaanza|u(?:noveutileina|rhinck11?)|viswan(?:142|czyk(?:01478|1(?:19|987)|4(?:89|5)|775|foundation45|k112))|xaajn|ydetratt)|c(?:\.cheadychang76|kenthando)|dredban775|e(?:044386|l(?:lagolan|vidabullock5))|gfrederick80|husameddine|i(?:c(?:h(?:ael\.woosley1972|eal(?:sjohnj|wuu002))|paulla|w954)|k(?:e\.weirsky\.foundational001|h(?:\.fridman|ai(?:\.fridman261|lfridm32)))|ss(?:\.(?:melisa\.mehmett|yasmineibrahim101)|yaelronen))|jminabii|k(?:ent7117|untjoro52)|m(?:1086771|argaritalouisdreyfus|ohammadaljllilati)|nmalarge|oham(?:edabdul1717|m(?:daljililati1|edshamekh24))|r(?:\.(?:elbahi\.mohammed\.2021|justinmaxwell09|lusee)|cjames001|d517341|eric(?:franck|schmid4002)|hanimuhammad627|jamesmc6|r(?:echardthomas|ichardanthony1)|s(?:\.(?:janetolsen?|olsenjanett|susanread12)|a(?:ishaalqadafi1976|ngela454)|dominiquethomas7777|evelynbrown7|fatimaamiraqureshi1983|gezeria|h(?:amima60|ristinemadeleine)|isabelladz|j(?:ackman123|lleach)|lisamilner08|ma(?:ureens847|yaoliver31)|r(?:obinsanders185|uthsmith9900)|sarahbenjamin103|v(?:eraaellen|ictoriaedmond03))|tomcrist\.ca|viktorzubkovv)|s(?:\.ellagolan56|agent02|golaan4|smadar44)|u(?:ali000111|stadris22)|y(?:burghhugohendrik|racbally))|n(?:aomiiwasaki181|ckniem|eilt(?:9108|rotter968)|icholas\.jose73|obuyuki\.hirano128|tawdglobal|v637245)|o(?:\.peace004|3344nb|ffice(?:\.012123|rricherd876|windowterms)|hallkenneth1|marinyandeng|nufoundationclaims|pcwkdw|xfaminternationa1980)|p(?:a(?:trick(?:\.efcc|andfrancessconnolly)|ul(?:eed1969|n8018))|b(?:ph202lay2|rookk0)|e(?:130304|rezdonlorenzo336|t(?:er(?:\.waddell204|guggi0|kenin73?|stephen4040)|ronasofficepromo))|good60000|hillip\.richead218|ilz37754|olloke|ro1nvstream|trsvermeulen|w178483)|q(?:iquanzhou7|nzeng1)|r(?:19772744|677gfd|a(?:johnfernn|kidy23|lhashimi78|ymondaba200)|e(?:alyh596|beccagarang11|em(?:has(?:himy(?:1978|mail)|m044)|n(?:2214|asser003302))|lpandemic|mittanceofficeasaba|neehii\.omb|plyback00|v(?:\.jamesabel1|ernestcebi|fr(?:ankjackson91|paulwilliams2)))|icha(?:miller18|rd(?:lustig4u|w(?:ahl511|il(?:lis815|son19091))))|josh200000|main2028|o(?:b(?:erthanandez6655|inf036)|naldmorris786|s(?:a\.gomes0044|ekipkalya934))|raya9989|svcdusan|t(?:\.rev\.ericmark05|honrichardshepherd)|u(?:ddicklana561|ssiaworldcuppromo))|s(?:a(?:chingrams|l(?:ehhussienconsult1|imzaid7000)|nchoscozfifa|rfiafarfask7)|cottpeters7989|e(?:cretservicce[78]|rgeantrobertbrown1)|g(?:\.offiice\.group|t(?:\.monicab03|ireneb2))|h(?:a(?:msiahmohamadyunusbnegara|nemissler2009)|ery(?:\.gtl131|etr03)|inawatrathaksin93)|im(?:lkheng5|onhei47)|op(?:adam3|hiajesse41)|peelman1972|t(?:anleyjohn1469|ephentam1(?:47|6))|u(?:iyang(?:\.boc|02)|n\.hor20|san(?:freeman112x|neklatten502)|zana111bah)|weeneyjohnson384)|t(?:a(?:mmywebster24|y(?:ebsouami0|lorcathy362))|ch33555|davalvse|erryparkins11|h(?:ailandbankoffice01|e(?:ara\.choy2|odorosloannis9))|imothymetheny01|lyerdonald613|mason9w4r|o(?:m(?:\.cristdonor|ander231|c(?:hrist1995|rist(?:52|donation12|foundation99|world))|spende480)|ny(?:\.chung760|zimpro11)|pchronodesk|shikazusendo101)|p2911220|tkhan69s)|u(?:kponguko|marukareem8|n(?:claimedfunds554|itednation(?:organization70|s(?:8182|councilrefunds)))|s(?:alotery2|departmentofjustice80))|v(?:a(?:mamakazlegalchambers|nderwesthuizen560)|e(?:enapatel883|linagreen|neerchris20003|r(?:a(?:aellen7|hollinkvan0)|enichekaterinaekaterina4))|i(?:ctoriaabraham2310|dalpamela85|ngut170|pjeferrey)|n935990|owpovertyfoundation)|w(?:a(?:dp4726|hlr(?:5990|ichard18)|ldibeatesieberhagen|nczykm61|rrenebuffett2)|b(?:271981|6159980)|c5000dle|hatsappofficial001|i(?:elandherzog\.sw\.herad16|ll(?:clark(?:2618|629)|iamsmartyrs888))|kfinancialservice|orldbankregionalmanageroffice|u\.office212|ww\.moneygram9054)|y(?:\.oguzhan011|anghoseok5|doo974|o(?:ngkm00|usefzongo5722))|z(?:bank8876|enithbankplconline98|kiaslan1963|minhong65|ubkovmrviktor)))\@gmail\.com$/i
3653 describe REPTO_419_FRAUD_GM Reply-To is known advance fee fraud collector mailbox
3654 #score REPTO_419_FRAUD_GM 3.000
3655 tflags REPTO_419_FRAUD_GM publish
3656 ##} REPTO_419_FRAUD_GM
3657
3658 ##{ REPTO_419_FRAUD_GM_LOOSE
3659
3660 meta REPTO_419_FRAUD_GM_LOOSE __REPTO_419_FRAUD_GM_LOOSE && !REPTO_419_FRAUD_GM
3661 describe REPTO_419_FRAUD_GM_LOOSE Ends-in-digits Reply-To is similar to known advance fee fraud collector mailbox
3662 #score REPTO_419_FRAUD_GM_LOOSE 1.000
3663 tflags REPTO_419_FRAUD_GM_LOOSE publish
3664 ##} REPTO_419_FRAUD_GM_LOOSE
3665
3666 ##{ REPTO_419_FRAUD_HM
3667
3668 header REPTO_419_FRAUD_HM Reply-To:addr =~ /^(?=[^\s<>@]+\@hotmail\.com)(?:(?:a(?:brahambeniam|n(?:ikal01|nagray00)|zezul\.idrisazezulidris)|c(?:hoi21|laytousey)|d(?:l13139|r\.dukanalycoulibaly)|egorbunova22|faxttransfer\.skyebk\.service\.care\.th|infos(?:43|8)|katabettencourt2018|l(?:e(?:a_edem|galcosme|wisarm44)|ulihongm)|mr(?:abrahambeniamfc|pedrohilldonations|s(?:\.chantal_bill|micheleallison2003))|n(?:inajohn226|waigwe2765)|ocbc\-ba\-nkonline|powen10001|quickcashloansservices|s(?:a(?:jda\.andleeb|nchamps798)|ulaimaninfante)|t(?:ashacap|omashntr)|unb(?:2015|int)|yostinbellamohammad))\@hotmail\.com$/i
3669 describe REPTO_419_FRAUD_HM Reply-To is known advance fee fraud collector mailbox
3670 #score REPTO_419_FRAUD_HM 3.000
3671 tflags REPTO_419_FRAUD_HM publish
3672 ##} REPTO_419_FRAUD_HM
3673
3674 ##{ REPTO_419_FRAUD_OL
3675
3676 header REPTO_419_FRAUD_OL Reply-To:addr =~ /^(?=[^\s<>@]+\@outlook\.com)(?:(?:a(?:16u71|b(?:rahamwilliamsonrpsltduk|s0000200)|lbertchebe|ndrewgamble7)|b(?:asidris|etty\.c_investment|illgfile203)|c(?:bforeignremitdept|harlie\.j\.goodmand|laimunit\.facebook|ompensationfunding)|d(?:eborahleeconsult|hl(?:customercares|express\.fastservice)|onation_dept|rjonathankuku)|e(?:benezernonyeagwuceozbplc|urope\.win2)|f(?:abienna\.s|iduciarybmw2020|mr01|oundation701|p\.conn)|g(?:20compessdesk|race\.manonfoundation)|j(?:ackson4steve|e(?:anedo1|ssicameir30))|k(?:aujong|officollins)|l(?:\.williams722|ui1480)|m(?:card\.msoftuk|illerjeffreylawchambers|oussa\.sayyid|r(?:\.henrichkisker|antonioguterress|b(?:illgate9|ryandavisuk44)|mduku|s(?:_elizabeth20|michelleallison|roseallen))|spvt2020)|philcohen0012|r(?:ichardwahlfreegrant|obertleeonly01)|s(?:aaman10|gi2019|t(?:\.monica|eve\.lenkathomson11))|t(?:g331965|oyotadrawboard2019)|unvanzyl_mrs|w(?:esteruniontransferunite7|hatsapp_givewin|inuklotocash2018)))\@outlook\.com$/i
3677 describe REPTO_419_FRAUD_OL Reply-To is known advance fee fraud collector mailbox
3678 #score REPTO_419_FRAUD_OL 3.000
3679 tflags REPTO_419_FRAUD_OL publish
3680 ##} REPTO_419_FRAUD_OL
3681
3682 ##{ REPTO_419_FRAUD_PM
3683
3684 header REPTO_419_FRAUD_PM Reply-To:addr =~ /^(?=[^\s<>@]+\@protonmail\.com)(?:(?:armstrong0244|berndkoch|davidmetus|euclaim|p(?:a(?:melagriffi|t\.nwankwo)|rotonydonation)|scottpeter012|the\.trustees1|v\.brianpierre|yihsbltan|ziraatbankasi))\@protonmail\.com$/i
3685 describe REPTO_419_FRAUD_PM Reply-To is known advance fee fraud collector mailbox
3686 #score REPTO_419_FRAUD_PM 3.000
3687 tflags REPTO_419_FRAUD_PM publish
3688 ##} REPTO_419_FRAUD_PM
3689
3690 ##{ REPTO_419_FRAUD_QQ
3691
3692 header REPTO_419_FRAUD_QQ Reply-To:addr =~ /^(?=[^\s<>@]+\@qq\.com)(?:(?:1731419584|2(?:032508290|3(?:72948239|89029403|97857528))|3523284224|akia\.j55|l\.valiant|peterwong20177|qatarfoundation01|wang_cjianlin))\@qq\.com$/i
3693 describe REPTO_419_FRAUD_QQ Reply-To is known advance fee fraud collector mailbox
3694 #score REPTO_419_FRAUD_QQ 3.000
3695 tflags REPTO_419_FRAUD_QQ publish
3696 ##} REPTO_419_FRAUD_QQ
3697
3698 ##{ REPTO_419_FRAUD_YH
3699
3700 header REPTO_419_FRAUD_YH Reply-To:addr =~ /^(?=[^\s<>@]+\@yahoo\.com)(?:(?:a(?:driantongson13|ilmohammed11|lesiakalina2006|mbassador\.l|nnhester\.usa4)|b(?:a(?:che\.delfine|nk\.phbng14|rr\.thomasclark)|en(?:jaminb34|nicholas22)|illlawrenceee|riceangela45)|c(?:\.aroline90|abinet_maitre_emmanuel_patris|h(?:arlesscharf112|hoy\.t|jackson65)|juan852|ontelamine|ythiamiller\.un10)|d(?:hamilton9099|r(?:_raymondfung|kobiorah|obiorahkenneth|victorobaji))|e(?:denvictor71|ricalbert24)|f(?:bicompensation_funds|ederal\.r73)|i(?:\.project33411|befranfgnfmf|nfomoney|project32411)|j(?:a(?:ckson\.davis915|netemoon150)|kimyong21|lawrencefrb|ulietjohnsonn)|k(?:altschmidtdavid8|elvinmark629|im(?:\.leang2018?|leang(?:575|90)))|l(?:e(?:a_edem13|hman(?:909|bila))|i(?:m_kaan|sarobinson_555)|o(?:an\.assist|rrainewirengee)|y_cheapiseth(?:11|2019))|m(?:\.kogi81|a(?:itre_arthur\.catheau|rie_avis12)|d(?:\.ps|zsesszika672)|elissalewis4004|o(?:hammedaahil46|keye79)|rs(?:\.esthernicolas|isabella\.dzesszikan)|s\.gracie_olakun)|o(?:legkozyrev1|mranshaalan52)|p(?:ackerkelvin|eterlee1950|rincerasmane)|r(?:alphw(?:\.johnson78|johnson78)|o(?:bertbailey2004|serichard655))|s(?:amthong4040|igurlauganna34|leo25|opheap\.munny|pwalker101|te(?:fanopessina573|vecox\.98))|t(?:\.murasawa|ep1chen|heara\.chhoy|ylerhess\.43)|vanserge2001|will(?:clark0010|smi68)|xianglongdai60|zhaodonghk))\@yahoo\.com$/i
3701 describe REPTO_419_FRAUD_YH Reply-To is known advance fee fraud collector mailbox
3702 #score REPTO_419_FRAUD_YH 3.000
3703 tflags REPTO_419_FRAUD_YH publish
3704 ##} REPTO_419_FRAUD_YH
3705
3706 ##{ REPTO_419_FRAUD_YH_LOOSE
3707
3708 meta REPTO_419_FRAUD_YH_LOOSE __REPTO_419_FRAUD_YH_LOOSE && !REPTO_419_FRAUD_YH
3709 describe REPTO_419_FRAUD_YH_LOOSE Ends-in-digits Reply-To is similar to known advance fee fraud collector mailbox
3710 #score REPTO_419_FRAUD_YH_LOOSE 1.000
3711 tflags REPTO_419_FRAUD_YH_LOOSE publish
3712 ##} REPTO_419_FRAUD_YH_LOOSE
3713
3714 ##{ REPTO_419_FRAUD_YJ
3715
3716 header REPTO_419_FRAUD_YJ Reply-To:addr =~ /^(?=[^\s<>@]+\@yahoo\.co\.jp)(?:(?:a(?:drianbayford|lainminc73)|d(?:eborahmark2|raymndch)|e(?:d(?:032000100|ithi0iochou)|millybrownnc)|fred_gamba|henrybanko1970|m(?:24erc|aryp1799_8335|eghanbutlerfca|oneygram100|rs_chen_00001)|r(?:acheljude000|itawi668)|s(?:andrabates418|d203077)))\@yahoo\.co\.jp$/i
3717 describe REPTO_419_FRAUD_YJ Reply-To is known advance fee fraud collector mailbox
3718 #score REPTO_419_FRAUD_YJ 3.000
3719 tflags REPTO_419_FRAUD_YJ publish
3720 ##} REPTO_419_FRAUD_YJ
3721
3722 ##{ REPTO_419_FRAUD_YN
3723
3724 header REPTO_419_FRAUD_YN Reply-To:addr =~ /^(?=[^\s<>@]+\@yandex\.com)(?:(?:a(?:lhashimi123|m(?:andarandle|g3333txx101)|n(?:a\.mariposa|n(?:acooper2019|zainab))|wesome\.mariacarmen)|c(?:harles\.kable|lemlau)|de(?:edee\-paul|jongpeter|ptoversea)|f(?:3dex\.courier|ed\.r3v|reedommarketinvestments)|gadd4fi\.aisha|h(?:ashimireem|halesbbanddd?)|joseph\-scott2k5|l(?:es20sc|otointernational\.elgordo)|m(?:arcarmenguty|fdpm|r(?:\.kongkea|akram\.elkerrami|spercy))|p(?:aragonloansinc|rincedarren0244)|rich(?:ard\.wahl|lawands)|tresor\.mambo|w(?:b\.foundation|ill(?:1amsmarg1|iam(?:simon1960|wilbert1)))|za\.dc2016))\@yandex\.com$/i
3725 describe REPTO_419_FRAUD_YN Reply-To is known advance fee fraud collector mailbox
3726 #score REPTO_419_FRAUD_YN 3.000
3727 tflags REPTO_419_FRAUD_YN publish
3728 ##} REPTO_419_FRAUD_YN
3729
3730 ##{ REPTO_INFONUMSCOM
3731
3732 meta       REPTO_INFONUMSCOM           __REPTO_INFONUMSCOM
3733 #score      REPTO_INFONUMSCOM           3.000   # limit
3734 tflags     REPTO_INFONUMSCOM           publish
3735 ##} REPTO_INFONUMSCOM
3736
3737 ##{ RISK_FREE
3738
3739 meta     RISK_FREE      __FRAUD_IOV && !__UNSUB_LINK && !__VIA_ML && !__HTML_LINK_IMAGE && !__SUBSCRIPTION_INFO && !__HS_SUBJ_RE_FW && !__LCL__ENV_AND_HDR_FROM_MATCH
3740 describe RISK_FREE      No risk!
3741 ##} RISK_FREE
3742
3743 ##{ SB_GIF_AND_NO_URIS
3744
3745 meta SB_GIF_AND_NO_URIS (__GIF_ATTACH&&!__HAS_ANY_URI&&!__HAS_ANY_EMAIL)
3746 ##} SB_GIF_AND_NO_URIS
3747
3748 ##{ SCC_BOGUS_CTE_1 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
3749
3750 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
3751 meta            SCC_BOGUS_CTE_1 __SCC_BOGUS_CTE_1
3752 describe        SCC_BOGUS_CTE_1 Bogus Content-Transfer-Encoding header
3753 tflags          SCC_BOGUS_CTE_1 publish
3754 endif
3755 ##} SCC_BOGUS_CTE_1 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
3756
3757 ##{ SCC_CTMPP ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
3758
3759 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
3760 describe        SCC_CTMPP       Uncommon Content-Type
3761 meta            SCC_CTMPP       __SCC_CTMPP
3762 tflags          SCC_CTMPP       publish
3763 endif
3764 ##} SCC_CTMPP ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
3765
3766 ##{ SCC_ISEMM_LID_1
3767
3768 describe SCC_ISEMM_LID_1        Fingerprint of a particular spammer using an old spamware
3769 header SCC_ISEMM_LID_1          X-Mailer-LID =~ /54,55,56,58,53/
3770 tflags SCC_ISEMM_LID_1          publish
3771 #score SCC_ISEMM_LID_1          3.5
3772 ##} SCC_ISEMM_LID_1
3773
3774 ##{ SCC_ISEMM_LID_1B
3775
3776 describe SCC_ISEMM_LID_1B       Genericized spammer fingerprint
3777 header SCC_ISEMM_LID_1B         X-Mailer-LID =~ /([56][0-9],)+/
3778 tflags SCC_ISEMM_LID_1B         publish
3779 #score SCC_ISEMM_LID_1B         1.5
3780 ##} SCC_ISEMM_LID_1B
3781
3782 ##{ SCC_SPECIAL_GUID
3783
3784 describe  SCC_SPECIAL_GUID      Unique in a similar way
3785 rawbody   SCC_SPECIAL_GUID      /^([[:xdigit:]]{8})-([[:xdigit:]]{4})-([[:xdigit:]]{3})-\3-([[:xdigit:]]{12})$/m
3786 tflags    SCC_SPECIAL_GUID      publish multiple maxhits=15
3787 ##} SCC_SPECIAL_GUID
3788
3789 ##{ SENDGRID_REDIR
3790
3791 meta       SENDGRID_REDIR              __SENDGRID_REDIR_NOPHISH && !ALL_TRUSTED && !__HAS_ERRORS_TO && !__HAS_X_BEEN_THERE && !__HAS_X_MAILMAN_VERSION && !__STY_INVIS_MANY && !__HTML_SINGLET_10 && !__HAVE_BOUNCE_RELAYS
3792 describe   SENDGRID_REDIR              Redirect URI via Sendgrid
3793 #score      SENDGRID_REDIR              1.500   # limit
3794 tflags     SENDGRID_REDIR              publish
3795 ##} SENDGRID_REDIR
3796
3797 ##{ SENDGRID_REDIR_PHISH
3798
3799 meta       SENDGRID_REDIR_PHISH        __SENDGRID_REDIR_PHISH
3800 describe   SENDGRID_REDIR_PHISH        Redirect URI via Sendgrid + phishing signs
3801 #score      SENDGRID_REDIR_PHISH        3.500   # limit
3802 tflags     SENDGRID_REDIR_PHISH        publish
3803 ##} SENDGRID_REDIR_PHISH
3804
3805 ##{ SEO_SUSP_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
3806
3807 if (version >= 3.004002)
3808 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
3809 meta     SEO_SUSP_NTLD __FROM_ADDRLIST_SUSPNTLD && (__PDS_SEO1 + __PDS_SEO2 >= 1)
3810 tflags   SEO_SUSP_NTLD publish
3811 describe SEO_SUSP_NTLD SEO offer from suspicious TLD
3812 #score    SEO_SUSP_NTLD 1.2 # limit
3813 endif
3814 endif
3815 ##} SEO_SUSP_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
3816
3817 ##{ SHOPIFY_IMG_NOT_RCVD_SFY
3818
3819 meta       SHOPIFY_IMG_NOT_RCVD_SFY    __SHOPIFY_IMG_NOT_RCVD_SFY && !MIME_QP_LONG_LINE && !__RCD_RDNS_MTA_MESSY && !__AC_UNSUB_URI && !__HAS_CAMPAIGNID && !__HAS_SENDER && !__HAS_ORGANIZATION && !__RCD_RDNS_OB && !__DOS_LINK
3820 #score      SHOPIFY_IMG_NOT_RCVD_SFY    2.500   # limit
3821 describe   SHOPIFY_IMG_NOT_RCVD_SFY    Shopify hosted image but message not from Shopify
3822 tflags     SHOPIFY_IMG_NOT_RCVD_SFY    publish
3823 ##} SHOPIFY_IMG_NOT_RCVD_SFY
3824
3825 ##{ SHORTENED_URL_SRC
3826
3827 rawbody  SHORTENED_URL_SRC      /<[^>]{1,99}\ssrc=\W?https?:\/\/(?:bit\.ly|bit\.do|buff\.ly|tinyurl\.com|ow\.ly|owl\.li|is\.gd|tumblr\.com|mysp\.ac|formspring\.me|ff\.im|youtu\.be|tl\.gd|plurk\.com|migre\.me|j\.mp|cli\.gs|goo\.gl|goo\.io|yfrog\.com|lnk\.ms|su\.pr|fb\.me|alturl\.com|wp\.me|ping\.fm|chatter\.com|post\.ly|twurl\.nl|tiny\.cc|4sq\.com|ustre\.am|short\.to|u\.nu|flic\.kr|budurl\.com|digg\.com|twitvid\.com|gowal\.la|om\.ly|justin\.tv|icio\.us|p\.gs|loopt\.us|tcrn\.ch|xrl\.us|wpo\.st|bkite\.com|t\.cn|t\.co|x\.co|hop\.kz|urla\.ru|fw\.to|back\.ly|ecs\.page\.link|cc\.uz|smarturl\.it|s\.apache\.org)\/[^\/]{3}/
3828 ##} SHORTENED_URL_SRC
3829
3830 ##{ SHORTENER_SHORT_IMG
3831
3832 meta       SHORTENER_SHORT_IMG         __URL_SHORTENER && HTML_SHORT_LINK_IMG_1
3833 describe   SHORTENER_SHORT_IMG         Short HTML + image + URL shortener
3834 #score      SHORTENER_SHORT_IMG         2.500   # limit
3835 tflags     SHORTENER_SHORT_IMG         publish
3836 ##} SHORTENER_SHORT_IMG
3837
3838 ##{ SHORT_HELO_AND_INLINE_IMAGE
3839
3840 meta SHORT_HELO_AND_INLINE_IMAGE     (__HELO_NO_DOMAIN && __ANY_IMAGE_ATTACH)
3841 describe SHORT_HELO_AND_INLINE_IMAGE    Short HELO string, with inline image
3842 ##} SHORT_HELO_AND_INLINE_IMAGE
3843
3844 ##{ SHORT_IMG_SUSP_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
3845
3846 if (version >= 3.004002)
3847 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
3848 meta     SHORT_IMG_SUSP_NTLD __LCL__KAM_BODY_LENGTH_LT_1024 && __HTML_LINK_IMAGE && __FROM_ADDRLIST_SUSPNTLD
3849 tflags   SHORT_IMG_SUSP_NTLD publish
3850 describe SHORT_IMG_SUSP_NTLD Short HTML + image + suspicious TLD
3851 #score    SHORT_IMG_SUSP_NTLD 1.5 # limit
3852 endif
3853 endif
3854 ##} SHORT_IMG_SUSP_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
3855
3856 ##{ SHORT_SHORTNER ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
3857
3858 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
3859 if (version >= 3.004000)
3860 meta     SHORT_SHORTNER __PDS_MSG_512 && __URL_SHORTENER && !DRUGS_ERECTILE
3861 describe SHORT_SHORTNER Short body with little more than a link to a shortener
3862 #score    SHORT_SHORTNER 2.0 # limit
3863 endif
3864 endif
3865 ##} SHORT_SHORTNER ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
3866
3867 ##{ SHORT_TERM_PRICE
3868
3869 body SHORT_TERM_PRICE /short\W+term\W+(target|projected)(\W+price)?/i
3870 ##} SHORT_TERM_PRICE
3871
3872 ##{ SPAMMY_XMAILER
3873
3874 meta SPAMMY_XMAILER (__XM_OL_28001441||__XM_OL_48072300||__XM_OL_28004682||__XM_OL_10_0_4115||__XM_OL_4_72_2106_4)
3875 describe SPAMMY_XMAILER X-Mailer string is common in spam and not in ham
3876 ##} SPAMMY_XMAILER
3877
3878 ##{ SPOOFED_FREEMAIL
3879
3880 meta     SPOOFED_FREEMAIL       __SPOOFED_FREEMAIL && !__HAS_IN_REPLY_TO && !__FS_SUBJ_RE && !__MSGID_GUID && !__freemail_safe && !__THREADED && !__HDRS_LCASE_KNOWN && !__HDR_RCVD_GOOGLE && !__HDR_RCVD_TONLINEDE
3881 #score    SPOOFED_FREEMAIL       2.000  # limit
3882 tflags   SPOOFED_FREEMAIL       net
3883 ##} SPOOFED_FREEMAIL
3884
3885 ##{ SPOOFED_FREEMAIL_NO_RDNS
3886
3887 meta     SPOOFED_FREEMAIL_NO_RDNS __SPOOFED_FREEMAIL && __RDNS_NONE
3888 describe SPOOFED_FREEMAIL_NO_RDNS From SPOOFED_FREEMAIL and no rDNS
3889 #score    SPOOFED_FREEMAIL_NO_RDNS 1.5
3890 ##} SPOOFED_FREEMAIL_NO_RDNS
3891
3892 ##{ SPOOFED_FREEM_REPTO
3893
3894 meta      SPOOFED_FREEM_REPTO           __SPOOFED_FREEM_REPTO && !__AC_TINY_FONT && !__HAS_IN_REPLY_TO && !__HAS_THREAD_INDEX
3895 describe  SPOOFED_FREEM_REPTO           Forged freemail sender with freemail reply-to
3896 #score     SPOOFED_FREEM_REPTO           2.500
3897 tflags    SPOOFED_FREEM_REPTO           net publish
3898 ##} SPOOFED_FREEM_REPTO
3899
3900 ##{ SPOOFED_FREEM_REPTO_CHN
3901
3902 meta      SPOOFED_FREEM_REPTO_CHN       (__SPOOFED_FREEM_REPTO || FORGED_YAHOO_RCVD) && __REPTO_CHN_FREEM
3903 describe  SPOOFED_FREEM_REPTO_CHN       Forged freemail sender with Chinese freemail reply-to
3904 #score     SPOOFED_FREEM_REPTO_CHN       3.500
3905 tflags    SPOOFED_FREEM_REPTO_CHN       net publish
3906 ##} SPOOFED_FREEM_REPTO_CHN
3907
3908 ##{ SPOOFED_FREEM_REPTO_RUS
3909
3910 meta      SPOOFED_FREEM_REPTO_RUS       (__SPOOFED_FREEM_REPTO || FORGED_YAHOO_RCVD) && __REPTO_RUS_FREEM
3911 describe  SPOOFED_FREEM_REPTO_RUS       Forged freemail sender with Russian freemail reply-to
3912 #score     SPOOFED_FREEM_REPTO_RUS       3.500
3913 tflags    SPOOFED_FREEM_REPTO_RUS       net publish
3914 ##} SPOOFED_FREEM_REPTO_RUS
3915
3916 ##{ SPOOF_GMAIL_MID
3917
3918 meta     SPOOF_GMAIL_MID SPOOFED_FREEMAIL && __PDS_SPOOF_GMAIL_MID
3919 #score    SPOOF_GMAIL_MID 1.5
3920 describe SPOOF_GMAIL_MID From Gmail but it doesn't seem to be...
3921 ##} SPOOF_GMAIL_MID
3922
3923 ##{ STATIC_XPRIO_OLE
3924
3925 meta        STATIC_XPRIO_OLE     __STATIC_XPRIO_OLE
3926 describe    STATIC_XPRIO_OLE     Static RDNS + X-Priority + MIMEOLE
3927 #score       STATIC_XPRIO_OLE     2.000   # limit
3928 tflags      STATIC_XPRIO_OLE     publish
3929 ##} STATIC_XPRIO_OLE
3930
3931 ##{ STOCK_IMG_CTYPE
3932
3933 meta STOCK_IMG_CTYPE (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__CTYPE_ONETAB_GIF&&__HTML_IMG_ONLY)
3934 describe STOCK_IMG_CTYPE  Stock spam image part, with distinctive Content-Type header
3935 ##} STOCK_IMG_CTYPE
3936
3937 ##{ STOCK_IMG_HDR_FROM
3938
3939 meta STOCK_IMG_HDR_FROM  (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__TVD_FW_GRAPHIC_ID1&&__HTML_IMG_ONLY)
3940 describe STOCK_IMG_HDR_FROM Stock spam image part, with distinctive From line
3941 ##} STOCK_IMG_HDR_FROM
3942
3943 ##{ STOCK_IMG_HTML
3944
3945 meta STOCK_IMG_HTML  (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__PART_STOCK_CID&&__HTML_IMG_ONLY)
3946 describe STOCK_IMG_HTML   Stock spam image part, with distinctive HTML
3947 ##} STOCK_IMG_HTML
3948
3949 ##{ STOCK_IMG_OUTLOOK
3950
3951 meta STOCK_IMG_OUTLOOK  (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__XM_MS_IN_GENERAL&&__HTML_LENGTH_1536_2048)
3952 describe STOCK_IMG_OUTLOOK  Stock spam image part, with Outlook-like features
3953 ##} STOCK_IMG_OUTLOOK
3954
3955 ##{ STOCK_PRICES
3956
3957 meta STOCK_PRICES (SHORT_TERM_PRICE && LONG_TERM_PRICE)
3958 ##} STOCK_PRICES
3959
3960 ##{ STOCK_TIP
3961
3962 meta        STOCK_TIP         __STOCK_TIP && !__DKIM_EXISTS
3963 describe    STOCK_TIP         Stock tips
3964 #score       STOCK_TIP         3.000    # limit
3965 tflags      STOCK_TIP         publish
3966 ##} STOCK_TIP
3967
3968 ##{ STOX_AND_PRICE
3969
3970 meta STOX_AND_PRICE     CURR_PRICE && STOX_REPLY_TYPE
3971 ##} STOX_AND_PRICE
3972
3973 ##{ STOX_BOUND_090909_B
3974
3975 header STOX_BOUND_090909_B Content-Type:raw =~ /;\n boundary=\"------------0[0-9]0[0-9]0[0-9]0[0-9]0[0-9]0[0-9]0[0-9]0[0-9]0[0-9]0[0-9]0[0-9]0[0-9]\"$/s
3976 ##} STOX_BOUND_090909_B
3977
3978 ##{ STOX_REPLY_TYPE
3979
3980 header STOX_REPLY_TYPE  Content-Type =~ /text\/plain; .* reply-type=original/
3981 ##} STOX_REPLY_TYPE
3982
3983 ##{ STOX_REPLY_TYPE_WITHOUT_QUOTES
3984
3985 meta STOX_REPLY_TYPE_WITHOUT_QUOTES (STOX_REPLY_TYPE && !(__HS_SUBJ_RE_FW || __HS_QUOTE))
3986 ##} STOX_REPLY_TYPE_WITHOUT_QUOTES
3987
3988 ##{ SUBJECT_NEEDS_ENCODING
3989
3990 meta SUBJECT_NEEDS_ENCODING    (!__SUBJECT_ENCODED_B64 && !__SUBJECT_ENCODED_QP) && __SUBJECT_NEEDS_MIME
3991 describe SUBJECT_NEEDS_ENCODING  Subject includes non-encoded illegal characters
3992 ##} SUBJECT_NEEDS_ENCODING
3993
3994 ##{ SUBJ_BRKN_WORDNUMS
3995
3996 #score     SUBJ_BRKN_WORDNUMS     1.500 # limit
3997 describe  SUBJ_BRKN_WORDNUMS     Subject contains odd word breaks and numbers
3998 ##} SUBJ_BRKN_WORDNUMS
3999
4000 ##{ SUBJ_BRKN_WORDNUMS if !plugin(Mail::SpamAssassin::Plugin::DKIM)
4001
4002 if !plugin(Mail::SpamAssassin::Plugin::DKIM)
4003   meta      SUBJ_BRKN_WORDNUMS     __SUBJ_BRKN_WORDNUMS
4004 endif
4005 ##} SUBJ_BRKN_WORDNUMS if !plugin(Mail::SpamAssassin::Plugin::DKIM)
4006
4007 ##{ SUBJ_BRKN_WORDNUMS ifplugin Mail::SpamAssassin::Plugin::DKIM
4008
4009 ifplugin Mail::SpamAssassin::Plugin::DKIM
4010   meta      SUBJ_BRKN_WORDNUMS     __SUBJ_BRKN_WORDNUMS && !DKIM_SIGNED && !__TO___LOWER
4011 endif
4012 ##} SUBJ_BRKN_WORDNUMS ifplugin Mail::SpamAssassin::Plugin::DKIM
4013
4014 ##{ SUSP_UTF8_WORD_SUBJ
4015
4016 meta       SUSP_UTF8_WORD_SUBJ         __4BYTE_UTF8_WORD_SUBJ
4017 describe   SUSP_UTF8_WORD_SUBJ         Word in Subject using only suspicious UTF-8 characters
4018 #score      SUSP_UTF8_WORD_SUBJ         2.000   # limit
4019 ##} SUSP_UTF8_WORD_SUBJ
4020
4021 ##{ SYSADMIN
4022
4023 meta        SYSADMIN             __SYSADMIN && !ALL_TRUSTED && !__ANY_TEXT_ATTACH && !__DKIM_EXISTS && !__LCL__ENV_AND_HDR_FROM_MATCH && !__MSGID_OK_DIGITS
4024 describe    SYSADMIN             Supposedly from your IT department
4025 #score       SYSADMIN             3.500 # limit
4026 tflags      SYSADMIN             publish
4027 ##} SYSADMIN
4028
4029 ##{ TAGSTAT_IMG_NOT_RCVD_TGST
4030
4031 meta       TAGSTAT_IMG_NOT_RCVD_TGST   __TAGSTAT_IMG_NOT_RCVD_TGST
4032 #score      TAGSTAT_IMG_NOT_RCVD_TGST   2.000  # limit
4033 describe   TAGSTAT_IMG_NOT_RCVD_TGST   Tagstat hosted image but message not from Tagstat
4034 tflags     TAGSTAT_IMG_NOT_RCVD_TGST   publish
4035 ##} TAGSTAT_IMG_NOT_RCVD_TGST
4036
4037 ##{ TARINGANET_IMG_NOT_RCVD_TN
4038
4039 meta       TARINGANET_IMG_NOT_RCVD_TN    __TARINGANET_IMG_NOT_RCVD_TN
4040 #score      TARINGANET_IMG_NOT_RCVD_TN    2.000  # limit
4041 describe   TARINGANET_IMG_NOT_RCVD_TN    media.taringa.net hosted image but message not from taringa.net
4042 tflags     TARINGANET_IMG_NOT_RCVD_TN    publish
4043 ##} TARINGANET_IMG_NOT_RCVD_TN
4044
4045 ##{ TBIRD_SUSP_MIME_BDRY
4046
4047 meta           TBIRD_SUSP_MIME_BDRY  __MUA_TBIRD && __TB_MIME_BDRY_NO_Z
4048 describe       TBIRD_SUSP_MIME_BDRY  Unlikely Thunderbird MIME boundary
4049 ##} TBIRD_SUSP_MIME_BDRY
4050
4051 ##{ TEQF_USR_IMAGE
4052
4053 meta      TEQF_USR_IMAGE                __TO_EQ_FROM_USR_NN_MINFP && __ANY_IMAGE_ATTACH
4054 describe  TEQF_USR_IMAGE                To and from user nearly same + image
4055 tflags    TEQF_USR_IMAGE                publish
4056 ##} TEQF_USR_IMAGE
4057
4058 ##{ TEQF_USR_MSGID_HEX
4059
4060 meta      TEQF_USR_MSGID_HEX            __TO_EQ_FROM_USR_NN_MINFP && __MSGID_OK_HEX && !__MSGID_NOFQDN2
4061 describe  TEQF_USR_MSGID_HEX            To and from user nearly same + unusual message ID
4062 tflags    TEQF_USR_MSGID_HEX            publish
4063 ##} TEQF_USR_MSGID_HEX
4064
4065 ##{ TEQF_USR_MSGID_MALF
4066
4067 meta      TEQF_USR_MSGID_MALF           __TO_EQ_FROM_USR_NN_MINFP && __MSGID_NOFQDN2
4068 describe  TEQF_USR_MSGID_MALF           To and from user nearly same + malformed message ID
4069 tflags    TEQF_USR_MSGID_MALF           publish
4070 ##} TEQF_USR_MSGID_MALF
4071
4072 ##{ THEBAT_UNREG
4073
4074 header  THEBAT_UNREG  X-Mailer =~ /^The Bat! .{0,20} UNREG$/
4075 ##} THEBAT_UNREG
4076
4077 ##{ THIS_AD
4078
4079 meta        THIS_AD           __THIS_AD && !__MOZILLA_MSGID && !__FROM_ENCODED_QP && !__CR_IN_SUBJ && !__RP_MATCHES_RCVD
4080 describe    THIS_AD           "This ad" and variants
4081 tflags      THIS_AD           publish
4082 ##} THIS_AD
4083
4084 ##{ THIS_IS_ADV_SUSP_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
4085
4086 if (version >= 3.004002)
4087 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
4088 meta     THIS_IS_ADV_SUSP_NTLD __FROM_ADDRLIST_SUSPNTLD && __ADMITS_SPAM
4089 tflags   THIS_IS_ADV_SUSP_NTLD publish
4090 describe THIS_IS_ADV_SUSP_NTLD This is an advertisement from a suspicious TLD
4091 #score    THIS_IS_ADV_SUSP_NTLD 1.5 # limit
4092 endif
4093 endif
4094 ##} THIS_IS_ADV_SUSP_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
4095
4096 ##{ TONLINE_FAKE_DKIM
4097
4098 meta        TONLINE_FAKE_DKIM          __HDR_RCVD_TONLINEDE && __DKIM_EXISTS
4099 describe    TONLINE_FAKE_DKIM          t-online.de doesn't do DKIM
4100 #score       TONLINE_FAKE_DKIM          3.000   # limit
4101 tflags      TONLINE_FAKE_DKIM          publish
4102 ##} TONLINE_FAKE_DKIM
4103
4104 ##{ TONOM_EQ_TOLOC_SHRT_SHRTNER ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
4105
4106 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
4107 if (version >= 3.004000)
4108 meta     TONOM_EQ_TOLOC_SHRT_SHRTNER __URL_SHORTENER && __PDS_TONAME_EQ_TOLOCAL && __PDS_MSG_1024
4109 describe TONOM_EQ_TOLOC_SHRT_SHRTNER Short email with shortener and To:name eq To:local
4110 #score    TONOM_EQ_TOLOC_SHRT_SHRTNER 1.5 # limit
4111 endif
4112 endif
4113 ##} TONOM_EQ_TOLOC_SHRT_SHRTNER ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
4114
4115 ##{ TO_EQ_FM_DIRECT_MX
4116
4117 meta           TO_EQ_FM_DIRECT_MX   __TO_EQ_FM_DIRECT_MX && !__THREAD_INDEX_GOOD && !__IS_EXCH && !__CTYPE_MULTIPART_MIXED
4118 describe       TO_EQ_FM_DIRECT_MX   To == From and direct-to-MX
4119 #score          TO_EQ_FM_DIRECT_MX   2.500      # limit
4120 tflags         TO_EQ_FM_DIRECT_MX   publish
4121 ##} TO_EQ_FM_DIRECT_MX
4122
4123 ##{ TO_EQ_FM_DOM_SPF_FAIL ifplugin Mail::SpamAssassin::Plugin::SPF
4124
4125 ifplugin Mail::SpamAssassin::Plugin::SPF
4126   meta           TO_EQ_FM_DOM_SPF_FAIL    __TO_EQ_FM_DOM_SPF_FAIL && !__THREADED && !ALL_TRUSTED
4127   describe       TO_EQ_FM_DOM_SPF_FAIL    To domain == From domain and external SPF failed
4128   tflags         TO_EQ_FM_DOM_SPF_FAIL    net
4129 endif
4130 ##} TO_EQ_FM_DOM_SPF_FAIL ifplugin Mail::SpamAssassin::Plugin::SPF
4131
4132 ##{ TO_EQ_FM_SPF_FAIL ifplugin Mail::SpamAssassin::Plugin::SPF
4133
4134 ifplugin Mail::SpamAssassin::Plugin::SPF
4135   meta           TO_EQ_FM_SPF_FAIL    __TO_EQ_FM_SPF_FAIL && !__THREADED && !ALL_TRUSTED
4136   describe       TO_EQ_FM_SPF_FAIL    To == From and external SPF failed
4137   tflags         TO_EQ_FM_SPF_FAIL    net
4138 endif
4139 ##} TO_EQ_FM_SPF_FAIL ifplugin Mail::SpamAssassin::Plugin::SPF
4140
4141 ##{ TO_IN_SUBJ
4142
4143 meta           TO_IN_SUBJ           __TO_IN_SUBJ && !__VIA_ML && !MISSING_MIMEOLE && !__THREAD_INDEX_GOOD && !__FSL_RELAY_GOOGLE && !__LCL__ENV_AND_HDR_FROM_MATCH && !__HS_SUBJ_RE_FW
4144 describe       TO_IN_SUBJ           To address is in Subject
4145 tflags         TO_IN_SUBJ           publish
4146 #score          TO_IN_SUBJ           0.1
4147 ##} TO_IN_SUBJ
4148
4149 ##{ TO_NAME_SUBJ_NO_RDNS
4150
4151 meta       TO_NAME_SUBJ_NO_RDNS        LOCALPART_IN_SUBJECT && __RDNS_NONE
4152 describe   TO_NAME_SUBJ_NO_RDNS        Recipient username in subject + no rDNS
4153 #score      TO_NAME_SUBJ_NO_RDNS        3.000   # limit
4154 tflags     TO_NAME_SUBJ_NO_RDNS        publish
4155 ##} TO_NAME_SUBJ_NO_RDNS
4156
4157 ##{ TO_NO_BRKTS_FROM_MSSP
4158
4159 meta       TO_NO_BRKTS_FROM_MSSP     __TO_NO_BRKTS_FROM_RUNON && !__RCD_RDNS_MTA_MESSY && !__CTYPE_MULTIPART_ALT && !__REPTO_QUOTE && !__MIME_QP && !__TO___LOWER && !__BUGGED_IMG && !__SUBJECT_ENCODED_QP && !__VIA_ML && !__FR_SPACING_8 && !__TAG_EXISTS_CENTER && !__RCVD_ZIXMAIL && !__RP_MATCHES_RCVD && !__HAS_SENDER
4160 #score      TO_NO_BRKTS_FROM_MSSP     2.50      # max
4161 describe   TO_NO_BRKTS_FROM_MSSP     Multiple header formatting problems
4162 ##} TO_NO_BRKTS_FROM_MSSP
4163
4164 ##{ TO_NO_BRKTS_HTML_IMG
4165
4166 meta       TO_NO_BRKTS_HTML_IMG    __TO_NO_BRKTS_HTML_IMG && !__FM_TO_ALL_NUMS && !__FROM_FULL_NAME && !__HAS_THREAD_INDEX && !__DKIM_EXISTS && !__HAS_SENDER && !__THREADED && !__LONGLINE
4167 describe   TO_NO_BRKTS_HTML_IMG    To: lacks brackets and HTML and one image
4168 #score      TO_NO_BRKTS_HTML_IMG    2.000   # limit
4169 tflags     TO_NO_BRKTS_HTML_IMG    publish
4170 ##} TO_NO_BRKTS_HTML_IMG
4171
4172 ##{ TO_NO_BRKTS_HTML_ONLY
4173
4174 meta       TO_NO_BRKTS_HTML_ONLY   __TO_NO_BRKTS_HTML_ONLY && !RDNS_NONE && !__MIME_QP && !__MSGID_JAVAMAIL && !__CTYPE_CHARSET_QUOTED && !__SUBJECT_ENCODED_B64 && !__VIA_ML && !__MSGID_BEFORE_RECEIVED && !__MIME_BASE64 && !__RCD_RDNS_MAIL_MESSY && !__COMMENT_EXISTS && !LOTS_OF_MONEY && !__TAG_EXISTS_CENTER && !__UPPERCASE_URI && !__UNSUB_LINK && !__RCD_RDNS_MX_MESSY && !__DKIM_EXISTS && !__BUGGED_IMG && !__FM_TO_ALL_NUMS && !__URI_12LTRDOM && !__RDNS_NO_SUBDOM && !__HDRS_LCASE && !__LCL__ENV_AND_HDR_FROM_MATCH
4175 #score      TO_NO_BRKTS_HTML_ONLY   2.00        # limit
4176 describe   TO_NO_BRKTS_HTML_ONLY   To: lacks brackets and HTML only
4177 tflags     TO_NO_BRKTS_HTML_ONLY   publish
4178 ##} TO_NO_BRKTS_HTML_ONLY
4179
4180 ##{ TO_NO_BRKTS_MSFT
4181
4182 meta       TO_NO_BRKTS_MSFT         __TO_NO_BRKTS_MSFT && !__VIA_ML && !__LYRIS_EZLM_REMAILER && !__THREAD_INDEX_GOOD && !__IS_EXCH && !__UNSUB_LINK && !__NOT_SPOOFED && !__DOS_HAS_LIST_UNSUB && !__NAME_EQ_EMAIL && !__SUBJECT_ENCODED_QP && !__THREADED && !__HAS_THREAD_INDEX && !__HAS_X_REF && !__HAS_IN_REPLY_TO && !__FROM_ENCODED_QP && !__RP_MATCHES_RCVD
4183 describe   TO_NO_BRKTS_MSFT         To: lacks brackets and supposed Microsoft tool
4184 #score      TO_NO_BRKTS_MSFT         2.50       # limit
4185 ##} TO_NO_BRKTS_MSFT
4186
4187 ##{ TO_NO_BRKTS_NORDNS_HTML
4188
4189 meta       TO_NO_BRKTS_NORDNS_HTML      __TO_NO_BRKTS_NORDNS_HTML && !ALL_TRUSTED && !__MSGID_JAVAMAIL && !__MSGID_BEFORE_RECEIVED && !__VIA_ML && !__UA_MUTT && !__COMMENT_EXISTS && !__HTML_LENGTH_384 && !__MIME_BASE64 && !__UPPERCASE_URI && !__TO___LOWER && !__TAG_EXISTS_CENTER && !__LONGLINE && !__DKIM_EXISTS
4190 #score      TO_NO_BRKTS_NORDNS_HTML      2.00   # limit
4191 describe   TO_NO_BRKTS_NORDNS_HTML      To: lacks brackets and no rDNS and HTML only
4192 tflags     TO_NO_BRKTS_NORDNS_HTML      publish
4193 ##} TO_NO_BRKTS_NORDNS_HTML
4194
4195 ##{ TO_NO_BRKTS_PCNT
4196
4197 meta       TO_NO_BRKTS_PCNT         __TO_NO_BRKTS_PCNT && !__SUBJECT_ENCODED_B64 && !__DOS_HAS_LIST_UNSUB && !__VIA_ML && !__ISO_2022_JP_DELIM && !__IMS_MSGID && !__THREAD_INDEX_GOOD && !__RCD_RDNS_MX_MESSY && !__UNSUB_LINK && !__LONGLINE && !URI_HEX && !__RP_MATCHES_RCVD && !__MAIL_LINK && !__BUGGED_IMG && !__MIME_QP && !__COMMENT_EXISTS && !__TAG_EXISTS_STYLE && !__LCL__ENV_AND_HDR_FROM_MATCH && !__HAS_X_MAILER && !__HTML_LINK_IMAGE && !__SENDER_BOT && !__DKIM_EXISTS && !__KHOP_NO_FULL_NAME && !__THREADED
4198 describe   TO_NO_BRKTS_PCNT         To: lacks brackets + percentage
4199 #score      TO_NO_BRKTS_PCNT         2.50       # limit
4200 tflags     TO_NO_BRKTS_PCNT         publish
4201 ##} TO_NO_BRKTS_PCNT
4202
4203 ##{ TO_TOO_MANY_WFH_01
4204
4205 meta       TO_TOO_MANY_WFH_01          __TO_TOO_MANY_WFH_01
4206 describe   TO_TOO_MANY_WFH_01          Work-from-Home + many recipients
4207 tflags     TO_TOO_MANY_WFH_01          publish
4208 ##} TO_TOO_MANY_WFH_01
4209
4210 ##{ TT_MSGID_TRUNC
4211
4212 header TT_MSGID_TRUNC   Message-Id =~ /^\s*<?[^<>\s]+\[\d+$/
4213 describe TT_MSGID_TRUNC Scora: Message-Id ends after left-bracket + digits
4214 ##} TT_MSGID_TRUNC
4215
4216 ##{ TT_OBSCURED_VALIUM
4217
4218 meta TT_OBSCURED_VALIUM         ( __TT_BROKEN_VALIUM || __TT_OBSCURED_VALIUM ) && ! __TT_VALIUM
4219 describe TT_OBSCURED_VALIUM     Scora: obscured "VALIUM" in subject
4220 ##} TT_OBSCURED_VALIUM
4221
4222 ##{ TT_OBSCURED_VIAGRA
4223
4224 meta TT_OBSCURED_VIAGRA         ( __TT_BROKEN_VIAGRA || __TT_OBSCURED_VIAGRA ) && ! __TT_VIAGRA
4225 describe TT_OBSCURED_VIAGRA     Scora: obscured "VIAGRA" in subject
4226 ##} TT_OBSCURED_VIAGRA
4227
4228 ##{ TVD_ACT_193
4229
4230 body TVD_ACT_193                /\bact of (?:193|nineteen thirty)/i
4231 describe TVD_ACT_193            Message refers to an act passed in the 1930s
4232 ##} TVD_ACT_193
4233
4234 ##{ TVD_APPROVED
4235
4236 body TVD_APPROVED               /you.{1,2}re .{0,20}approved/i
4237 describe TVD_APPROVED           Body states that the recipient has been approved
4238 ##} TVD_APPROVED
4239
4240 ##{ TVD_DEAR_HOMEOWNER
4241
4242 body TVD_DEAR_HOMEOWNER         /^dear homeowner/i
4243 describe TVD_DEAR_HOMEOWNER     Spam with generic salutation of "dear homeowner"
4244 ##} TVD_DEAR_HOMEOWNER
4245
4246 ##{ TVD_EB_PHISH
4247
4248 meta TVD_EB_PHISH       __FROM_EBAY && NORMAL_HTTP_TO_IP
4249 ##} TVD_EB_PHISH
4250
4251 ##{ TVD_ENVFROM_APOST
4252
4253 header TVD_ENVFROM_APOST        EnvelopeFrom =~ /\'/
4254 describe TVD_ENVFROM_APOST      Envelope From contains single-quote
4255 ##} TVD_ENVFROM_APOST
4256
4257 ##{ TVD_FINGER_02
4258
4259 header TVD_FINGER_02    Content-Type =~ /^text\/plain(?:; (?:format=flowed|charset="Windows-1252"|reply-type=original)){3}/i
4260 ##} TVD_FINGER_02
4261
4262 ##{ TVD_FLOAT_GENERAL
4263
4264 rawbody TVD_FLOAT_GENERAL       /\bstyle\s*=\s*"[^"]*\bfloat\s*:\s*[a-z]+\s*">\s*[a-zA-Z]+\s*</i
4265 describe TVD_FLOAT_GENERAL      Message uses CSS float style
4266 ##} TVD_FLOAT_GENERAL
4267
4268 ##{ TVD_FUZZY_DEGREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4269
4270 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4271 body TVD_FUZZY_DEGREE   /<inter W1><post P1>\b(?!degree)<D><E><G><R><E><E>\b/i
4272 describe TVD_FUZZY_DEGREE  Obfuscation of the word "degree"
4273 endif
4274 ##} TVD_FUZZY_DEGREE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4275
4276 ##{ TVD_FUZZY_FINANCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4277
4278 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4279 body TVD_FUZZY_FINANCE  /(?!finance)<F><I><N><A><N><C><E>/i
4280 describe TVD_FUZZY_FINANCE  Obfuscation of the word "finance"
4281 endif
4282 ##} TVD_FUZZY_FINANCE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4283
4284 ##{ TVD_FUZZY_FIXED_RATE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4285
4286 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4287 body TVD_FUZZY_FIXED_RATE       /<inter W2><post P2>(?!fixed rate)<F><I><X><E><D>\s+<R><A><T><E>/i
4288 describe TVD_FUZZY_FIXED_RATE   Obfuscation of the phrase "fixed rate"
4289 endif
4290 ##} TVD_FUZZY_FIXED_RATE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4291
4292 ##{ TVD_FUZZY_MICROCAP ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4293
4294 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4295 body TVD_FUZZY_MICROCAP /<inter W2><post P2>(?!microcap)(?!micro-cap)<M><I><C><R><O>-?<C><A><P>/i
4296 describe TVD_FUZZY_MICROCAP  Obfuscation of the word "micro-cap"
4297 endif
4298 ##} TVD_FUZZY_MICROCAP ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4299
4300 ##{ TVD_FUZZY_PHARMACEUTICAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4301
4302 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4303 body TVD_FUZZY_PHARMACEUTICAL   /<inter W2><post P2>(?!pharmaceutical)<P><H><A><R><M><A><C><E><U><T><I><C><A><L>/i
4304 describe TVD_FUZZY_PHARMACEUTICAL  Obfuscation of the word "pharmaceutical"
4305 endif
4306 ##} TVD_FUZZY_PHARMACEUTICAL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4307
4308 ##{ TVD_FUZZY_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4309
4310 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4311 body TVD_FUZZY_SYMBOL   /<inter W2><post P2>(?!symboo?l)<S><Y><M><B><O><L>/i
4312 describe TVD_FUZZY_SYMBOL  Obfuscation of the word "symbol"
4313 endif
4314 ##} TVD_FUZZY_SYMBOL ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4315
4316 ##{ TVD_FW_GRAPHIC_NAME_LONG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4317
4318 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4319 mimeheader TVD_FW_GRAPHIC_NAME_LONG     Content-Type =~ /\bname="[a-z]{8,}\.gif/
4320 describe   TVD_FW_GRAPHIC_NAME_LONG     Long image attachment name
4321 endif
4322 ##} TVD_FW_GRAPHIC_NAME_LONG ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4323
4324 ##{ TVD_FW_GRAPHIC_NAME_MID ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4325
4326 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4327 mimeheader TVD_FW_GRAPHIC_NAME_MID      Content-Type =~ /\bname="[a-z]{6,7}\.gif/
4328 describe   TVD_FW_GRAPHIC_NAME_MID      Medium sized image attachment name
4329 endif
4330 ##} TVD_FW_GRAPHIC_NAME_MID ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4331
4332 ##{ TVD_INCREASE_SIZE
4333
4334 body TVD_INCREASE_SIZE          /\bsize of .{1,20}(?:penis|dick|manhood)/i
4335 describe TVD_INCREASE_SIZE      Advertising for penis enlargement
4336 ##} TVD_INCREASE_SIZE
4337
4338 ##{ TVD_LINK_SAVE
4339
4340 body TVD_LINK_SAVE              /\blink to save\b/i
4341 describe TVD_LINK_SAVE          Spam with the text "link to save"
4342 ##} TVD_LINK_SAVE
4343
4344 ##{ TVD_PH_7
4345
4346 body TVD_PH_7   /\baccount .{0,20}suspen/i
4347 ##} TVD_PH_7
4348
4349 ##{ TVD_PH_BODY_ACCOUNTS_PRE
4350
4351 meta TVD_PH_BODY_ACCOUNTS_PRE           __TVD_PH_BODY_ACCOUNTS_PRE
4352 describe TVD_PH_BODY_ACCOUNTS_PRE       The body matches phrases such as "accounts suspended", "account credited", "account verification"
4353 ##} TVD_PH_BODY_ACCOUNTS_PRE
4354
4355 ##{ TVD_PH_REC
4356
4357 body TVD_PH_REC         /\byour .{0,40}account .{0,40}record/i
4358 describe TVD_PH_REC     Message includes a phrase commonly used in phishing mails
4359 ##} TVD_PH_REC
4360
4361 ##{ TVD_PH_SEC
4362
4363 body TVD_PH_SEC         /\byour .{0,40}account .{0,40}security/i
4364 describe TVD_PH_SEC     Message includes a phrase commonly used in phishing mails
4365 ##} TVD_PH_SEC
4366
4367 ##{ TVD_PP_PHISH
4368
4369 meta TVD_PP_PHISH       __FROM_PAYPAL && NORMAL_HTTP_TO_IP
4370 ##} TVD_PP_PHISH
4371
4372 ##{ TVD_QUAL_MEDS
4373
4374 body TVD_QUAL_MEDS              /\bquality med(?:ication)?s\b/i
4375 describe TVD_QUAL_MEDS          The body matches phrases such as "quality meds" or "quality medication"
4376 ##} TVD_QUAL_MEDS
4377
4378 ##{ TVD_RATWARE_CB
4379
4380 header TVD_RATWARE_CB           Content-Type =~ /\bboundary\b.{1,40}qzsoft_directmail_seperator/i
4381 describe TVD_RATWARE_CB         Content-Type header that is commonly indicative of ratware
4382 ##} TVD_RATWARE_CB
4383
4384 ##{ TVD_RATWARE_CB_2
4385
4386 header TVD_RATWARE_CB_2         Content-Type =~ /\bboundary\s*=\s*"?-+\d+=+\.MRA/
4387 describe TVD_RATWARE_CB_2       Content-Type header that is commonly indicative of ratware
4388 ##} TVD_RATWARE_CB_2
4389
4390 ##{ TVD_RATWARE_MSGID_02
4391
4392 header TVD_RATWARE_MSGID_02     Message-ID =~ /^[^<]*<[a-z]+\@/
4393 describe TVD_RATWARE_MSGID_02   Ratware with a Message-ID header that is entirely lower-case
4394 ##} TVD_RATWARE_MSGID_02
4395
4396 ##{ TVD_RCVD_IP
4397
4398 header TVD_RCVD_IP  Received =~ /^from\s+(?:\d+[^0-9a-zA-Z\s]){3}\d+[.\s]/
4399 describe TVD_RCVD_IP  Message was received from an IP address
4400 ##} TVD_RCVD_IP
4401
4402 ##{ TVD_RCVD_IP4
4403
4404 header TVD_RCVD_IP4 Received =~ /^from\s+(?:\d+\.){3}\d+\s/
4405 describe TVD_RCVD_IP4  Message was received from an IPv4 address
4406 ##} TVD_RCVD_IP4
4407
4408 ##{ TVD_RCVD_SPACE_BRACKET
4409
4410 header TVD_RCVD_SPACE_BRACKET Received =~ /\(\[(?!unix)[^\[\]]*\s/i
4411 ##} TVD_RCVD_SPACE_BRACKET
4412
4413 ##{ TVD_SECTION
4414
4415 body TVD_SECTION                /\bSection (?:27A|21B)/i
4416 describe TVD_SECTION            References to specific legal codes
4417 ##} TVD_SECTION
4418
4419 ##{ TVD_SILLY_URI_OBFU
4420
4421 body TVD_SILLY_URI_OBFU         m!https?://[a-z0-9-]+\.[a-z0-9-]*\.?[^a-z0-9.:/\s"'\@?\)>-]+[a-z0-9.-]*[a-z]{3}(?:\s|$)!i
4422 describe TVD_SILLY_URI_OBFU     URI obfuscation that can fool a URIBL or a uri rule
4423 ##} TVD_SILLY_URI_OBFU
4424
4425 ##{ TVD_SPACED_SUBJECT_WORD3
4426
4427 header TVD_SPACED_SUBJECT_WORD3 Subject =~ /^(?:(?:Re|Fw)[^:]{0,5}: )?[A-Z]+[a-z]+[A-Z]+$/
4428 describe TVD_SPACED_SUBJECT_WORD3  Entire subject is "UPPERlowerUPPER" with no whitespace
4429 ##} TVD_SPACED_SUBJECT_WORD3
4430
4431 ##{ TVD_STOCK1 ifplugin Mail::SpamAssassin::Plugin::BodyEval
4432
4433 ifplugin Mail::SpamAssassin::Plugin::BodyEval
4434 body TVD_STOCK1    eval:check_stock_info('2')
4435 describe TVD_STOCK1  Spam related to stock trading
4436 endif
4437 ##} TVD_STOCK1 ifplugin Mail::SpamAssassin::Plugin::BodyEval
4438
4439 ##{ TVD_SUBJ_ACC_NUM
4440
4441 header  TVD_SUBJ_ACC_NUM        Subject =~ /\b[a-zA-Z]+ [\#\s]{1,4}\d+[A-Z]+/
4442 describe TVD_SUBJ_ACC_NUM       Subject has spammy looking monetary reference
4443 ##} TVD_SUBJ_ACC_NUM
4444
4445 ##{ TVD_SUBJ_APPR_LOAN
4446
4447 header TVD_SUBJ_APPR_LOAN       Subject =~ /approved? .{0,20}loan/i
4448 ##} TVD_SUBJ_APPR_LOAN
4449
4450 ##{ TVD_SUBJ_FINGER_03
4451
4452 header TVD_SUBJ_FINGER_03       Subject =~ /^\s*\*\s+(?:\w+\W+)+\*\s*$/
4453 describe TVD_SUBJ_FINGER_03     Entire subject is enclosed in asterisks "* like so *"
4454 ##} TVD_SUBJ_FINGER_03
4455
4456 ##{ TVD_SUBJ_NUM_OBFU_MINFP
4457
4458 meta        TVD_SUBJ_NUM_OBFU_MINFP   __TVD_SUBJ_NUM_OBFU && !__RP_MATCHES_RCVD && !__RCD_RDNS_MAIL_MESSY && !__VIA_ML && !__ISO_2022_JP_DELIM && !__NOT_SPOOFED && !__X_CRON_ENV && !__NOT_A_PERSON && !__HAS_THREAD_INDEX && !__THREADED && !__NUMBERS_IN_SUBJ && !__URI_MAILTO
4459 ##} TVD_SUBJ_NUM_OBFU_MINFP
4460
4461 ##{ TVD_SUBJ_OWE
4462
4463 header TVD_SUBJ_OWE Subject =~ /^\s*(?:\w+\s+)+you\s+(?:\w+\s+)*(?:owe|indebted)\s+(?:\w+\s+)+an\s*other/i
4464 describe TVD_SUBJ_OWE  Subject line states that the recipieint is in debt
4465 ##} TVD_SUBJ_OWE
4466
4467 ##{ TVD_SUBJ_WIPE_DEBT
4468
4469 header TVD_SUBJ_WIPE_DEBT       Subject =~ /(?:wipe out|remove|get (?:rid|out) of|eradicate) .{0,20}(?:owe|debt|obligation)/i
4470 describe TVD_SUBJ_WIPE_DEBT     Spam advertising a way to eliminate debt
4471 ##} TVD_SUBJ_WIPE_DEBT
4472
4473 ##{ TVD_VISIT_PHARMA
4474
4475 body TVD_VISIT_PHARMA           /Online Ph.rmacy/i
4476 describe TVD_VISIT_PHARMA       Body mentions online pharmacy
4477 ##} TVD_VISIT_PHARMA
4478
4479 ##{ TVD_VIS_HIDDEN
4480
4481 rawbody TVD_VIS_HIDDEN /<TEXTAREA[^>]+style\s*=\s*"visibility:\s*hidden\b/i
4482 describe TVD_VIS_HIDDEN Invisible textarea HTML tags
4483 ##} TVD_VIS_HIDDEN
4484
4485 ##{ TW_GIBBERISH_MANY
4486
4487 meta           TW_GIBBERISH_MANY      __TENWORD_GIBBERISH > 20
4488 describe       TW_GIBBERISH_MANY      Lots of gibberish text to spoof pattern matching filters
4489 #score          TW_GIBBERISH_MANY      2.000   # limit
4490 tflags         TW_GIBBERISH_MANY      publish
4491 ##} TW_GIBBERISH_MANY
4492
4493 ##{ T_ACH_CANCELLED_EXE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4494
4495 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4496         meta         T_ACH_CANCELLED_EXE   __ACH_CANCELLED_EXE
4497         describe     T_ACH_CANCELLED_EXE   "ACH cancelled" probable malware
4498 endif
4499 ##} T_ACH_CANCELLED_EXE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4500
4501 ##{ T_ANY_PILL_PRICE if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
4502
4503 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
4504   meta        T_ANY_PILL_PRICE         (__PILL_PRICE_01 || __PILL_PRICE_02) && !__NOT_A_PERSON
4505   describe    T_ANY_PILL_PRICE         Prices for pills
4506 endif
4507 ##} T_ANY_PILL_PRICE if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
4508
4509 ##{ T_CDISP_SZ_MANY ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4510
4511 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4512   mimeheader   T_CDISP_SZ_MANY      Content-Disposition =~ /\bsize\s?=\s?\d.*\bsize\s?=\s?\d/
4513   describe     T_CDISP_SZ_MANY      Suspicious MIME header
4514 #  score        T_CDISP_SZ_MANY      2.0  # limit
4515 endif
4516 ##} T_CDISP_SZ_MANY ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4517
4518 ##{ T_COMPENSATION
4519
4520 describe T_COMPENSATION     "Compensation"
4521 #score    T_COMPENSATION     1.50       # limit
4522 ##} T_COMPENSATION
4523
4524 ##{ T_COMPENSATION if !plugin(Mail::SpamAssassin::Plugin::DKIM)
4525
4526 if !plugin(Mail::SpamAssassin::Plugin::DKIM)
4527   meta   T_COMPENSATION     __COMPENSATION && !__DOS_HAS_LIST_UNSUB && !__HAS_X_LOOP && !__HAS_ERRORS_TO && !__UNSUB_LINK && !__OPERA_MID_NON_OP && !__FB_S_STOCK && !__COMMENT_EXISTS && !__NOT_SPOOFED && !__LOCAL_PP_NONPPURL && !__NOT_A_PERSON && !__SUBSCRIPTION_INFO && !__DKIM_EXISTS && !__HAS_SENDER && !__RP_MATCHES_RCVD
4528 endif
4529 ##} T_COMPENSATION if !plugin(Mail::SpamAssassin::Plugin::DKIM)
4530
4531 ##{ T_COMPENSATION ifplugin Mail::SpamAssassin::Plugin::DKIM
4532
4533 ifplugin Mail::SpamAssassin::Plugin::DKIM
4534   meta   T_COMPENSATION     __COMPENSATION && !__DOS_HAS_LIST_UNSUB && !__HAS_X_LOOP && !__HAS_ERRORS_TO && !__UNSUB_LINK && !__OPERA_MID_NON_OP && !__FB_S_STOCK && !__COMMENT_EXISTS && !__NOT_SPOOFED && !__LOCAL_PP_NONPPURL && !__NOT_A_PERSON && !__SUBSCRIPTION_INFO && !__DKIM_EXISTS && !__HAS_SENDER && !__RP_MATCHES_RCVD && !__DKIM_DEPENDABLE
4535 endif
4536 ##} T_COMPENSATION ifplugin Mail::SpamAssassin::Plugin::DKIM
4537
4538 ##{ T_CTYPE_NULL ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4539
4540 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4541   meta         T_CTYPE_NULL          __CTYPE_NULL
4542   describe     T_CTYPE_NULL          Malformed Content-Type header
4543 endif
4544 ##} T_CTYPE_NULL ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4545
4546 ##{ T_DATE_IN_FUTURE_96_Q ifplugin Mail::SpamAssassin::Plugin::HeaderEval
4547
4548 ifplugin Mail::SpamAssassin::Plugin::HeaderEval
4549 header   T_DATE_IN_FUTURE_96_Q    eval:check_for_shifted_date('96', '2920')
4550 describe T_DATE_IN_FUTURE_96_Q    Date: is 4 days to 4 months after Received: date
4551 endif
4552 ##} T_DATE_IN_FUTURE_96_Q ifplugin Mail::SpamAssassin::Plugin::HeaderEval
4553
4554 ##{ T_DATE_IN_FUTURE_Q_PLUS ifplugin Mail::SpamAssassin::Plugin::HeaderEval
4555
4556 ifplugin Mail::SpamAssassin::Plugin::HeaderEval
4557 header   T_DATE_IN_FUTURE_Q_PLUS  eval:check_for_shifted_date('2920', 'undef')
4558 describe T_DATE_IN_FUTURE_Q_PLUS  Date: is over 4 months after Received: date
4559 endif
4560 ##} T_DATE_IN_FUTURE_Q_PLUS ifplugin Mail::SpamAssassin::Plugin::HeaderEval
4561
4562 ##{ T_DOC_ATTACH_NO_EXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4563
4564 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4565   meta         T_DOC_ATTACH_NO_EXT   __ATTACH_NAME_NO_EXT && (__PDF_ATTACH_MT || __DOC_ATTACH_MT)
4566   describe     T_DOC_ATTACH_NO_EXT   Document attachment with suspicious name
4567 endif
4568 ##} T_DOC_ATTACH_NO_EXT ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4569
4570 ##{ T_DOS_OUTLOOK_TO_MX_IMAGE
4571
4572 meta T_DOS_OUTLOOK_TO_MX_IMAGE          __ANY_OUTLOOK_MUA && !__OE_MUA && __DOS_DIRECT_TO_MX && __ANY_IMAGE_ATTACH
4573 describe T_DOS_OUTLOOK_TO_MX_IMAGE      Direct to MX with Outlook headers and an image
4574 ##} T_DOS_OUTLOOK_TO_MX_IMAGE
4575
4576 ##{ T_DOS_ZIP_HARDCORE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4577
4578 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4579   mimeheader    T_DOS_ZIP_HARDCORE        Content-Type =~ /^application\/zip;\sname="hardcore\.zip"$/
4580   describe      T_DOS_ZIP_HARDCORE        hardcore.zip file attached; quite certainly a virus
4581 #  score         T_DOS_ZIP_HARDCORE        2.5
4582 endif
4583 ##} T_DOS_ZIP_HARDCORE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4584
4585 ##{ T_DRUGS_ERECTILE_SHORT_SHORTNER ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
4586
4587 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
4588 if (version >= 3.004000)
4589 meta     T_DRUGS_ERECTILE_SHORT_SHORTNER __PDS_HTML_LENGTH_1024 && __URL_SHORTENER && DRUGS_ERECTILE
4590 describe T_DRUGS_ERECTILE_SHORT_SHORTNER Short erectile drugs advert with T_URL_SHORTENER
4591 #score    T_DRUGS_ERECTILE_SHORT_SHORTNER 1.5 # limit
4592 endif
4593 endif
4594 ##} T_DRUGS_ERECTILE_SHORT_SHORTNER ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
4595
4596 ##{ T_FILL_THIS_FORM_FRAUD_PHISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4597
4598 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4599   meta     T_FILL_THIS_FORM_FRAUD_PHISH     __FILL_THIS_FORM_FRAUD_PHISH && !__SPOOFED_URL && !__VIA_ML && !__HAS_IN_REPLY_TO && !__THREADED && !__HDR_RCVD_SHOPIFY && !__HAS_ERRORS_TO
4600   describe T_FILL_THIS_FORM_FRAUD_PHISH     Answer suspicious question(s)
4601 endif
4602 ##} T_FILL_THIS_FORM_FRAUD_PHISH ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4603
4604 ##{ T_FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4605
4606 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4607   meta     T_FILL_THIS_FORM_LOAN            __FILL_THIS_FORM_LOAN && !__COMMENT_EXISTS && !__HTML_LINK_IMAGE
4608   describe T_FILL_THIS_FORM_LOAN            Answer loan question(s)
4609 #  score    T_FILL_THIS_FORM_LOAN            2.0
4610 endif
4611 ##} T_FILL_THIS_FORM_LOAN ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4612
4613 ##{ T_FILL_THIS_FORM_SHORT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4614
4615 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4616   meta     T_FILL_THIS_FORM_SHORT           __FILL_THIS_FORM_SHORT && !__VIA_ML && !__MSGID_JAVAMAIL
4617   describe T_FILL_THIS_FORM_SHORT           Fill in a short form with personal information
4618 #  score    T_FILL_THIS_FORM_SHORT           1.00       # limit
4619 endif
4620 ##} T_FILL_THIS_FORM_SHORT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4621
4622 ##{ T_FORGED_TBIRD_IMG_SIZE ifplugin Mail::SpamAssassin::Plugin::ImageInfo
4623
4624 ifplugin Mail::SpamAssassin::Plugin::ImageInfo
4625   meta       T_FORGED_TBIRD_IMG_SIZE   __FORGED_TBIRD_IMG && __ONE_IMG && __IMG_LE_300K
4626   describe   T_FORGED_TBIRD_IMG_SIZE   Likely forged Thunderbird image spam
4627 endif
4628 ##} T_FORGED_TBIRD_IMG_SIZE ifplugin Mail::SpamAssassin::Plugin::ImageInfo
4629
4630 ##{ T_FREEMAIL_DOC_PDF ifplugin Mail::SpamAssassin::Plugin::FreeMail
4631
4632 ifplugin Mail::SpamAssassin::Plugin::FreeMail
4633   meta         T_FREEMAIL_DOC_PDF       __FREEMAIL_DOC_PDF
4634   describe     T_FREEMAIL_DOC_PDF       MS document or PDF attachment, from freemail
4635 endif
4636 ##} T_FREEMAIL_DOC_PDF ifplugin Mail::SpamAssassin::Plugin::FreeMail
4637
4638 ##{ T_FREEMAIL_DOC_PDF_BCC ifplugin Mail::SpamAssassin::Plugin::FreeMail
4639
4640 ifplugin Mail::SpamAssassin::Plugin::FreeMail
4641   meta         T_FREEMAIL_DOC_PDF_BCC   __FREEMAIL_DOC_PDF && __TO_UNDISCLOSED
4642   describe     T_FREEMAIL_DOC_PDF_BCC   MS document or PDF attachment, from freemail, all recipients hidden
4643 endif
4644 ##} T_FREEMAIL_DOC_PDF_BCC ifplugin Mail::SpamAssassin::Plugin::FreeMail
4645
4646 ##{ T_FREEMAIL_RVW_ATTCH ifplugin Mail::SpamAssassin::Plugin::FreeMail
4647
4648 ifplugin Mail::SpamAssassin::Plugin::FreeMail
4649   meta         T_FREEMAIL_RVW_ATTCH     (__PLS_REVIEW || __DLND_ATTACH) && __FREEMAIL_DOC_PDF
4650   describe     T_FREEMAIL_RVW_ATTCH     Please review attached document, from freemail
4651 endif
4652 ##} T_FREEMAIL_RVW_ATTCH ifplugin Mail::SpamAssassin::Plugin::FreeMail
4653
4654 ##{ T_FROMNAME_EQUALS_TO ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
4655
4656 ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
4657 meta     T_FROMNAME_EQUALS_TO __PLUGIN_FROMNAME_EQUALS_TO
4658 describe T_FROMNAME_EQUALS_TO From:name matches To:
4659 #score    T_FROMNAME_EQUALS_TO 1.0
4660 tflags   T_FROMNAME_EQUALS_TO publish
4661 endif
4662 ##} T_FROMNAME_EQUALS_TO ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
4663
4664 ##{ T_FROMNAME_SPOOFED_EMAIL ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
4665
4666 ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
4667 meta     T_FROMNAME_SPOOFED_EMAIL  (__PLUGIN_FROMNAME_SPOOF && !__VIA_ML && !__VIA_RESIGNER && !__RP_MATCHES_RCVD)
4668 describe T_FROMNAME_SPOOFED_EMAIL From:name looks like a spoofed email
4669 #score    T_FROMNAME_SPOOFED_EMAIL 0.3
4670 tflags   T_FROMNAME_SPOOFED_EMAIL publish
4671 endif
4672 ##} T_FROMNAME_SPOOFED_EMAIL ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
4673
4674 ##{ T_FROM_MULTI_NORDNS if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
4675
4676 if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
4677   meta       T_FROM_MULTI_NORDNS        __FROM_MULTI_NORDNS
4678   describe   T_FROM_MULTI_NORDNS        Multiple From addresses + no rDNS
4679 endif
4680 ##} T_FROM_MULTI_NORDNS if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
4681
4682 ##{ T_FROM_MULTI_SHORT_IMG if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
4683
4684 if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
4685   meta       T_FROM_MULTI_SHORT_IMG     __FROM_MULTI_SHORT_IMG && !__RCD_RDNS_MX_MESSY
4686   describe   T_FROM_MULTI_SHORT_IMG     Multiple From addresses + short message with image
4687 endif
4688 ##} T_FROM_MULTI_SHORT_IMG if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
4689
4690 ##{ T_FUZZY_OPTOUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4691
4692 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4693   body           T_FUZZY_OPTOUT             /(?:$|\W)(?=<O>)(?!opt[-\s]?out)<O><P><T>[-\s]?<O><U><T>(?:$|\W)/i
4694   describe       T_FUZZY_OPTOUT             Obfuscated opt-out text
4695 endif
4696 ##} T_FUZZY_OPTOUT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4697
4698 ##{ T_FUZZY_SPRM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4699
4700 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4701 body T_FUZZY_SPRM /<inter W1><post P2><S><P><U><R><M>/i
4702 endif
4703 ##} T_FUZZY_SPRM ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4704
4705 ##{ T_FUZZY_WELLSFARGO ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4706
4707 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4708   meta          T_FUZZY_WELLSFARGO         __FUZZY_WELLSFARGO_BODY || __FUZZY_WELLSFARGO_FROM
4709   describe      T_FUZZY_WELLSFARGO         Obfuscated "Wells Fargo"
4710 endif
4711 ##} T_FUZZY_WELLSFARGO ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4712
4713 ##{ T_GB_FREEM_FROM_NOT_REPLY ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
4714
4715 ifplugin Mail::SpamAssassin::Plugin::FreeMail
4716   ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
4717     meta     T_GB_FREEM_FROM_NOT_REPLY    ( !__FROM_EQ_REPLY && FREEMAIL_FROM && FREEMAIL_REPLYTO )
4718     describe T_GB_FREEM_FROM_NOT_REPLY    From: and Reply-To: have different freemail domains
4719 #    score    T_GB_FREEM_FROM_NOT_REPLY    1.500 # limit
4720     tflags   T_GB_FREEM_FROM_NOT_REPLY    publish
4721 endif
4722 endif
4723 ##} T_GB_FREEM_FROM_NOT_REPLY ifplugin Mail::SpamAssassin::Plugin::FreeMail ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
4724
4725 ##{ T_GB_FROMNAME_SPOOFED_EMAIL_IP ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
4726
4727 ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
4728   meta      T_GB_FROMNAME_SPOOFED_EMAIL_IP  ( T_FROMNAME_SPOOFED_EMAIL && !__NOT_SPOOFED )
4729   describe  T_GB_FROMNAME_SPOOFED_EMAIL_IP  From:name looks like a spoofed email from a spoofed ip
4730 #  score     T_GB_FROMNAME_SPOOFED_EMAIL_IP  0.50 # limit
4731   tflags    T_GB_FROMNAME_SPOOFED_EMAIL_IP  publish
4732 endif
4733 ##} T_GB_FROMNAME_SPOOFED_EMAIL_IP ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
4734
4735 ##{ T_GB_WEBFORM ifplugin Mail::SpamAssassin::Plugin::FreeMail
4736
4737 ifplugin Mail::SpamAssassin::Plugin::FreeMail
4738   meta            T_GB_WEBFORM              ( ( __XMAIL_CODEIGN || __XMAIL_PHPMAIL ) && __URL_SHORTENER && FREEMAIL_FROM )
4739   describe        T_GB_WEBFORM              Webform with url shortener
4740 #  score           T_GB_WEBFORM              1.500 # limit
4741 endif
4742 ##} T_GB_WEBFORM ifplugin Mail::SpamAssassin::Plugin::FreeMail
4743
4744 ##{ T_HK_NAME_FM_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail if (version >= 3.004000)
4745
4746 ifplugin Mail::SpamAssassin::Plugin::FreeMail
4747 if (version >= 3.004000)
4748   meta          T_HK_NAME_FM_FROM               __HK_NAME_FROM && FREEMAIL_FROM
4749 #  score                T_HK_NAME_FM_FROM               1.5
4750 endif
4751 endif
4752 ##} T_HK_NAME_FM_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail if (version >= 3.004000)
4753
4754 ##{ T_HK_NAME_FM_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail if (version >= 3.004000)
4755
4756 ifplugin Mail::SpamAssassin::Plugin::FreeMail
4757 if (version >= 3.004000)
4758   meta          T_HK_NAME_FM_MR_MRS     __HK_NAME_MR_MRS && FREEMAIL_FROM
4759 #  score                T_HK_NAME_FM_MR_MRS     1.5
4760 endif
4761 endif
4762 ##} T_HK_NAME_FM_MR_MRS ifplugin Mail::SpamAssassin::Plugin::FreeMail if (version >= 3.004000)
4763
4764 ##{ T_HK_NAME_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail if (version >= 3.004000)
4765
4766 ifplugin Mail::SpamAssassin::Plugin::FreeMail
4767 if (version >= 3.004000)
4768   meta          T_HK_NAME_FROM          __HK_NAME_FROM && !FREEMAIL_FROM
4769 #  score                T_HK_NAME_FROM          1.0
4770 endif
4771 endif
4772 ##} T_HK_NAME_FROM ifplugin Mail::SpamAssassin::Plugin::FreeMail if (version >= 3.004000)
4773
4774 ##{ T_HK_SPAMMY_FILENAME ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4775
4776 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4777 meta            T_HK_SPAMMY_FILENAME    __HK_SPAMMY_CTFN || __HK_SPAMMY_CDFN
4778 endif
4779 ##} T_HK_SPAMMY_FILENAME ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4780
4781 ##{ T_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4782
4783 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4784   meta         T_HTML_ATTACH         __HTML_ATTACH_01 || __HTML_ATTACH_02
4785   describe     T_HTML_ATTACH         HTML attachment to bypass scanning?
4786 endif
4787 ##} T_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4788
4789 ##{ T_ISO_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4790
4791 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4792   meta         T_ISO_ATTACH          __ISO_ATTACH || __ISO_ATTACH_MT
4793   describe     T_ISO_ATTACH          ISO attachment - possible malware delivery
4794 #  score        T_ISO_ATTACH          3.000     # limit
4795 endif
4796 ##} T_ISO_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4797
4798 ##{ T_KAM_HTML_FONT_INVALID ifplugin Mail::SpamAssassin::Plugin::HTMLEval
4799
4800 ifplugin Mail::SpamAssassin::Plugin::HTMLEval
4801 meta            T_KAM_HTML_FONT_INVALID         __KAM_HTML_FONT_INVALID
4802 describe        T_KAM_HTML_FONT_INVALID         Test for Invalidly Named or Formatted Colors in HTML
4803 #score          T_KAM_HTML_FONT_INVALID         0.1
4804 endif
4805 ##} T_KAM_HTML_FONT_INVALID ifplugin Mail::SpamAssassin::Plugin::HTMLEval
4806
4807 ##{ T_LARGE_PCT_AFTER_MANY if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
4808
4809 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
4810    meta        T_LARGE_PCT_AFTER_MANY   __LARGE_PERCENT_AFTER > 3
4811    describe    T_LARGE_PCT_AFTER_MANY   Many large percentages after...
4812 endif
4813 ##} T_LARGE_PCT_AFTER_MANY if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
4814
4815 ##{ T_LFUZ_PWRMALE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4816
4817 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4818 body T_LFUZ_PWRMALE       /<inter W1><post P2><P><O><W><E><R><M><A><L><E>/i
4819 endif
4820 ##} T_LFUZ_PWRMALE ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4821
4822 ##{ T_LOTTO_AGENT_FM
4823
4824 header   T_LOTTO_AGENT_FM   From =~ /(?:claim(?:s|ing)?(?:[\s_.]processing)?|fiducia\w+|dispatch|reimbursement|payout|prize[\s_.]transfer|(?:international|foreign|win+ing)[\s_.]rem+it+ance)[\s_.]?(?:agent|manager|officer|secretary|director|department|dept)/i
4825 describe T_LOTTO_AGENT_FM   Claims Agent
4826 ##} T_LOTTO_AGENT_FM
4827
4828 ##{ T_LOTTO_AGENT_RPLY
4829
4830 meta     T_LOTTO_AGENT_RPLY __LOTTO_AGENT_RPLY && !__TO_YOUR_ORG
4831 describe T_LOTTO_AGENT_RPLY Claims Agent
4832 ##} T_LOTTO_AGENT_RPLY
4833
4834 ##{ T_LOTTO_URI
4835
4836 uri      T_LOTTO_URI       /(?:claim(?:s|ing)?(?:[-_]?processing)?|fiducia\w+|reimbursement|(?:international|foreign|win+ing)?[-_]?rem+it+ance|award)[-_]?(?:department|dept|unit|group|committee|office|agent|manager|secretary)/i
4837 describe T_LOTTO_URI       Claims Department URL
4838 ##} T_LOTTO_URI
4839
4840 ##{ T_MANY_HDRS_LCASE
4841
4842 describe       T_MANY_HDRS_LCASE       Odd capitalization of multiple message headers
4843 #score          T_MANY_HDRS_LCASE       0.10    # limit
4844 ##} T_MANY_HDRS_LCASE
4845
4846 ##{ T_MANY_HDRS_LCASE if !plugin(Mail::SpamAssassin::Plugin::FreeMail)
4847
4848 if !plugin(Mail::SpamAssassin::Plugin::FreeMail)
4849   meta         T_MANY_HDRS_LCASE       __MANY_HDRS_LCASE && !__HDRS_LCASE_KNOWN && !__VIA_ML && !__THREADED && !__UNUSABLE_MSGID && !__DOS_SINGLE_EXT_RELAY && !__DKIM_EXISTS && !__NOT_SPOOFED && !__BUGGED_IMG && !__MIME_QP && !__RDNS_NONE
4850 endif
4851 ##} T_MANY_HDRS_LCASE if !plugin(Mail::SpamAssassin::Plugin::FreeMail)
4852
4853 ##{ T_MANY_HDRS_LCASE ifplugin Mail::SpamAssassin::Plugin::FreeMail
4854
4855 ifplugin Mail::SpamAssassin::Plugin::FreeMail
4856   meta         T_MANY_HDRS_LCASE       __MANY_HDRS_LCASE && !__HDRS_LCASE_KNOWN && !__VIA_ML && !__freemail_safe && !__THREADED && !__UNUSABLE_MSGID && !__DOS_SINGLE_EXT_RELAY && !__DKIM_EXISTS && !__NOT_SPOOFED && !__BUGGED_IMG && !__MIME_QP && !__RDNS_NONE
4857 endif
4858 ##} T_MANY_HDRS_LCASE ifplugin Mail::SpamAssassin::Plugin::FreeMail
4859
4860 ##{ T_MANY_PILL_PRICE if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
4861
4862 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
4863   meta        T_MANY_PILL_PRICE        (__PILL_PRICE_01 + __PILL_PRICE_02) > 2
4864   describe    T_MANY_PILL_PRICE        Prices for many pills
4865 endif
4866 ##} T_MANY_PILL_PRICE if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
4867
4868 ##{ T_MIME_MALF if (version >= 3.004000)
4869
4870 if (version >= 3.004000)
4871         meta        T_MIME_MALF        __MIME_MALF && !ALL_TRUSTED
4872         describe    T_MIME_MALF        Malformed MIME: headers in body
4873 #       score       T_MIME_MALF        2.00     # limit
4874 endif
4875 ##} T_MIME_MALF if (version >= 3.004000)
4876
4877 ##{ T_MONEY_PERCENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4878
4879 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4880   meta     T_MONEY_PERCENT    LOTS_OF_MONEY && (__PCT_FOR_YOU || __PCT_OF_PMTS || __FIFTY_FIFTY)
4881   describe T_MONEY_PERCENT    X% of a lot of money for you
4882 endif
4883 ##} T_MONEY_PERCENT ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4884
4885 ##{ T_OBFU_ATTACH_MISSP ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4886
4887 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4888   meta         T_OBFU_ATTACH_MISSP   __FROM_RUNON && (T_OBFU_HTML_ATTACH || OBFU_TEXT_ATTACH || T_OBFU_DOC_ATTACH || T_OBFU_PDF_ATTACH || T_OBFU_JPG_ATTACH || T_OBFU_GIF_ATTACH)
4889   describe     T_OBFU_ATTACH_MISSP   Obfuscated attachment type and misspaced From
4890 endif
4891 ##} T_OBFU_ATTACH_MISSP ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4892
4893 ##{ T_OBFU_DOC_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4894
4895 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4896   mimeheader   T_OBFU_DOC_ATTACH     Content-Type =~ m,\bapplication/octet-stream\b.+\.(?:doc|rtf)\b,i
4897   describe     T_OBFU_DOC_ATTACH     MS Document attachment with generic MIME type
4898 endif
4899 ##} T_OBFU_DOC_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4900
4901 ##{ T_OBFU_GIF_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4902
4903 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4904   mimeheader   T_OBFU_GIF_ATTACH     Content-Type =~ m,\bapplication/octet-stream\b.+\.gif\b,i
4905   describe     T_OBFU_GIF_ATTACH     GIF attachment with generic MIME type
4906 endif
4907 ##} T_OBFU_GIF_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4908
4909 ##{ T_OBFU_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4910
4911 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4912   mimeheader   T_OBFU_HTML_ATTACH    Content-Type =~ m,\bapplication/octet-stream\b.+\.s?html?\b,i
4913   describe     T_OBFU_HTML_ATTACH    HTML attachment with non-text MIME type
4914 endif
4915 ##} T_OBFU_HTML_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4916
4917 ##{ T_OBFU_HTML_ATT_MALW ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4918
4919 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4920   meta         T_OBFU_HTML_ATT_MALW  __ZIP_ATTACH_NOFN && __HTML_ATTACH_02
4921   describe     T_OBFU_HTML_ATT_MALW  HTML attachment with incorrect MIME type - possible malware
4922 endif
4923 ##} T_OBFU_HTML_ATT_MALW ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4924
4925 ##{ T_OBFU_JPG_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4926
4927 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4928   mimeheader   T_OBFU_JPG_ATTACH     Content-Type =~ m,\bapplication/octet-stream\b.+\.jpe?g\b,i
4929   describe     T_OBFU_JPG_ATTACH     JPG attachment with generic MIME type
4930 endif
4931 ##} T_OBFU_JPG_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4932
4933 ##{ T_OBFU_PDF_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4934
4935 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4936   mimeheader   T_OBFU_PDF_ATTACH     Content-Type =~ m,\bapplication/octet-stream\b.+\.pdf\b,i
4937   describe     T_OBFU_PDF_ATTACH     PDF attachment with generic MIME type
4938 endif
4939 ##} T_OBFU_PDF_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
4940
4941 ##{ T_OFFER_ONLY_AMERICA if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
4942
4943 if (version >= 3.004002)
4944 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
4945 meta     T_OFFER_ONLY_AMERICA __FROM_ADDRLIST_SUSPNTLD && __PDS_OFFER_ONLY_AMERICA
4946 describe T_OFFER_ONLY_AMERICA Offer only available to US
4947 #score    T_OFFER_ONLY_AMERICA 2.0 # limit
4948 endif
4949 endif
4950 ##} T_OFFER_ONLY_AMERICA if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
4951
4952 ##{ T_PDS_BTC_AHACKER ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4953
4954 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4955   meta     T_PDS_BTC_AHACKER ( __PDS_BTC_ID && __PDS_BTC_BADFROM && __PDS_BTC_ANON )
4956   describe T_PDS_BTC_AHACKER Bitcoin Hacker
4957 #  score    T_PDS_BTC_AHACKER 3.0 # limit
4958 endif
4959 ##} T_PDS_BTC_AHACKER ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4960
4961 ##{ T_PDS_BTC_HACKER ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4962
4963 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4964   meta     T_PDS_BTC_HACKER ( __PDS_BTC_ID && __PDS_BTC_ANON && !__PDS_BTC_BADFROM )
4965   describe T_PDS_BTC_HACKER Bitcoin Hacker
4966 #  score    T_PDS_BTC_HACKER 2.0 # limit
4967 endif
4968 ##} T_PDS_BTC_HACKER ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4969
4970 ##{ T_PDS_FREEMAIL_REPLYTO_URISHRT ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
4971
4972 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
4973 if (version >= 3.004000)
4974 meta     T_PDS_FREEMAIL_REPLYTO_URISHRT __URL_SHORTENER && __freemail_hdr_replyto && __SUBJ_SHORT && __PDS_HTML_LENGTH_2048
4975 describe T_PDS_FREEMAIL_REPLYTO_URISHRT Freemail replyto with URI shortener
4976 #score    T_PDS_FREEMAIL_REPLYTO_URISHRT 1.5 # limit
4977 endif
4978 endif
4979 ##} T_PDS_FREEMAIL_REPLYTO_URISHRT ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
4980
4981 ##{ T_PDS_FROM_2_EMAILS if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
4982
4983 if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
4984   meta       T_PDS_FROM_2_EMAILS        __PDS_FROM_2_EMAILS && !__VIA_ML && !__VIA_RESIGNER && !__MSGID_JAVAMAIL && !__RCD_RDNS_MAIL_MESSY && !__RCD_RDNS_SMTP_MESSY && !__DKIM_EXISTS
4985   describe   T_PDS_FROM_2_EMAILS        From header has multiple different addresses
4986 #  score      T_PDS_FROM_2_EMAILS        3.500  # limit
4987 endif
4988 ##} T_PDS_FROM_2_EMAILS if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
4989
4990 ##{ T_PDS_LTC_AHACKER ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4991
4992 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4993   meta     T_PDS_LTC_AHACKER ( __PDS_LITECOIN_ID && __PDS_BTC_BADFROM && __PDS_BTC_ANON )
4994   describe T_PDS_LTC_AHACKER Litecoin Hacker
4995 #  score    T_PDS_LTC_AHACKER 3.0 # limit
4996 endif
4997 ##} T_PDS_LTC_AHACKER ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
4998
4999 ##{ T_PDS_LTC_HACKER ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
5000
5001 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
5002   meta     T_PDS_LTC_HACKER ( __PDS_LITECOIN_ID && __PDS_BTC_ANON && !__PDS_BTC_BADFROM )
5003   describe T_PDS_LTC_HACKER Litecoin Hacker
5004 #  score    T_PDS_LTC_HACKER 2.0 # limit
5005 endif
5006 ##} T_PDS_LTC_HACKER ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
5007
5008 ##{ T_PDS_OTHER_BAD_TLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5009
5010 if (version >= 3.004002)
5011 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5012 header   T_PDS_OTHER_BAD_TLD eval:check_uri_host_listed('SUSP_URI_NTLD')
5013 #score    T_PDS_OTHER_BAD_TLD 2.0
5014 describe T_PDS_OTHER_BAD_TLD Untrustworthy TLDs
5015 endif
5016 endif
5017 ##} T_PDS_OTHER_BAD_TLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5018
5019 ##{ T_PDS_PRO_TLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5020
5021 if (version >= 3.004002)
5022 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5023 header   T_PDS_PRO_TLD eval:check_uri_host_listed('SUSP_URI_NTLD_PRO')
5024 #score    T_PDS_PRO_TLD 1.0
5025 describe T_PDS_PRO_TLD .pro TLD
5026 endif
5027 endif
5028 ##} T_PDS_PRO_TLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5029
5030 ##{ T_PDS_SHORTFWD_URISHRT ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
5031
5032 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5033 if (version >= 3.004000)
5034 meta     T_PDS_SHORTFWD_URISHRT __URL_SHORTENER && (__THREADED || __HAS_IN_REPLY_TO || __HAS_THREAD_INDEX || __URI_MAILTO || __REPTO_QUOTE) && __SUBJ_SHORT && __PDS_HTML_LENGTH_2048
5035 describe T_PDS_SHORTFWD_URISHRT Threaded email with URI shortener
5036 #score    T_PDS_SHORTFWD_URISHRT 1.5 # limit
5037 endif
5038 endif
5039 ##} T_PDS_SHORTFWD_URISHRT ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
5040
5041 ##{ T_PDS_SHORTFWD_URISHRT_FP ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
5042
5043 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5044 if (version >= 3.004000)
5045 meta     T_PDS_SHORTFWD_URISHRT_FP __URL_SHORTENER && __HS_SUBJ_RE_FW && __PDS_MSG_512
5046 describe T_PDS_SHORTFWD_URISHRT_FP Apparently a short fwd/re with URI shortener
5047 #score    T_PDS_SHORTFWD_URISHRT_FP 1.5 # limit
5048 endif
5049 endif
5050 ##} T_PDS_SHORTFWD_URISHRT_FP ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
5051
5052 ##{ T_PDS_SHORTFWD_URISHRT_QP ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
5053
5054 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5055 if (version >= 3.004000)
5056 meta     T_PDS_SHORTFWD_URISHRT_QP __URL_SHORTENER && __HS_SUBJ_RE_FW && __T_PDS_MSG_512 && !T_PDS_SHORTFWD_URISHRT_FP
5057 describe T_PDS_SHORTFWD_URISHRT_QP Apparently a short fwd/re with URI shortener
5058 #score    T_PDS_SHORTFWD_URISHRT_QP 1.5 # limit
5059 endif
5060 endif
5061 ##} T_PDS_SHORTFWD_URISHRT_QP ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
5062
5063 ##{ T_PDS_TO_EQ_FROM_NAME if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
5064
5065 if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
5066   meta       T_PDS_TO_EQ_FROM_NAME      (__PDS_TO_EQ_FROM_NAME_1 || __PDS_TO_EQ_FROM_NAME_2) && !__HAS_SENDER
5067   describe   T_PDS_TO_EQ_FROM_NAME      From: name same as To: address
5068 endif
5069 ##} T_PDS_TO_EQ_FROM_NAME if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
5070
5071 ##{ T_PDS_URISHRT_LOCALPART_SUBJ ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
5072
5073 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5074 if (version >= 3.004000)
5075 meta     T_PDS_URISHRT_LOCALPART_SUBJ LOCALPART_IN_SUBJECT && __URL_SHORTENER && __PDS_MSG_1024
5076 describe T_PDS_URISHRT_LOCALPART_SUBJ Localpart of To in subject
5077 #score    T_PDS_URISHRT_LOCALPART_SUBJ 1.0
5078 endif
5079 endif
5080 ##} T_PDS_URISHRT_LOCALPART_SUBJ ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
5081
5082 ##{ T_PHOTO_EDITING_DIRECT if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5083
5084 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5085   meta       T_PHOTO_EDITING_DIRECT       (__PHOTO_RETOUCHING && __DOS_DIRECT_TO_MX) && !ALL_TRUSTED && !__HAS_HREF
5086   describe   T_PHOTO_EDITING_DIRECT       Image editing service, direct to MX
5087 #  score      T_PHOTO_EDITING_DIRECT       3.000        # limit
5088 endif
5089 ##} T_PHOTO_EDITING_DIRECT if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5090
5091 ##{ T_PHOTO_EDITING_FREEM if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5092
5093 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5094   meta       T_PHOTO_EDITING_FREEM        __PHOTO_RETOUCHING > 4 && (__REPTO_CHN_FREEM || __freemail_hdr_replyto)
5095   describe   T_PHOTO_EDITING_FREEM        Image editing service, freemail or CHN replyto
5096 #  score      T_PHOTO_EDITING_FREEM        3.750        # limit
5097 endif
5098 ##} T_PHOTO_EDITING_FREEM if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5099
5100 ##{ T_REMOTE_IMAGE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
5101
5102 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
5103   meta  T_REMOTE_IMAGE  __REMOTE_IMAGE
5104   describe T_REMOTE_IMAGE       Message contains an external image
5105 endif
5106 ##} T_REMOTE_IMAGE ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
5107
5108 ##{ T_SENT_TO_EMAIL_ADDR if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5109
5110 if (version >= 3.004002)
5111 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5112 meta     T_SENT_TO_EMAIL_ADDR __FROM_ADDRLIST_SUSPNTLD && __PDS_SENT_TO_EMAIL_ADDR
5113 describe T_SENT_TO_EMAIL_ADDR Email was sent to email address
5114 #score    T_SENT_TO_EMAIL_ADDR 2.0 # limit
5115 endif
5116 endif
5117 ##} T_SENT_TO_EMAIL_ADDR if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5118
5119 ##{ T_SHARE_50_50
5120
5121 meta     T_SHARE_50_50     (__SHARE_IT || __AGREED_RATIO) && __FIFTY_FIFTY
5122 describe T_SHARE_50_50     Share the money 50/50
5123 ##} T_SHARE_50_50
5124
5125 ##{ T_STY_INVIS_DIRECT if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5126
5127 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5128   meta      T_STY_INVIS_DIRECT              __STY_INVIS_DIRECT && !__L_BODY_8BITS && !__UNSUB_LINK && !__HDR_RCVD_AMAZON && !__TO___LOWER && !__PDS_DOUBLE_URL && !__MAIL_LINK
5129   describe  T_STY_INVIS_DIRECT              HTML hidden text + direct-to-MX
5130 #  score     T_STY_INVIS_DIRECT              2.500      # limit
5131 endif
5132 ##} T_STY_INVIS_DIRECT if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5133
5134 ##{ T_SUSPNTLD_EXPIRATION_EXTORT if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5135
5136 if (version >= 3.004002)
5137 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5138 meta     T_SUSPNTLD_EXPIRATION_EXTORT LOTS_OF_MONEY && __PDS_EXPIRATION_NOTICE && __FROM_ADDRLIST_SUSPNTLD
5139 describe T_SUSPNTLD_EXPIRATION_EXTORT Susp NTLD with an expiration notice and lotsa money
5140 #score    T_SUSPNTLD_EXPIRATION_EXTORT 2.0 # limit
5141 endif
5142 endif
5143 ##} T_SUSPNTLD_EXPIRATION_EXTORT if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5144
5145 ##{ T_TONOM_EQ_TOLOC_SHRT_PSHRTNER ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
5146
5147 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5148 if (version >= 3.004000)
5149 meta     T_TONOM_EQ_TOLOC_SHRT_PSHRTNER __PDS_SHORT_URL && __PDS_TONAME_EQ_TOLOCAL && __SUBJ_SHORT
5150 describe T_TONOM_EQ_TOLOC_SHRT_PSHRTNER Short subject with potential shortener and To:name eq To:local
5151 #score    T_TONOM_EQ_TOLOC_SHRT_PSHRTNER 1.5 # limit
5152 endif
5153 endif
5154 ##} T_TONOM_EQ_TOLOC_SHRT_PSHRTNER ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
5155
5156 ##{ T_TVD_FUZZY_SECTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
5157
5158 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
5159 body T_TVD_FUZZY_SECTOR   /(?!sector)<S><E><C><T><O><R>/i
5160 endif
5161 ##} T_TVD_FUZZY_SECTOR ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
5162
5163 ##{ T_TVD_FUZZY_SECURITIES ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
5164
5165 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
5166 body T_TVD_FUZZY_SECURITIES       /<inter W2><post P2>(?!securities)(?!security,? es)<S><E><C><U><R><I><T><I><E><S>/i
5167 endif
5168 ##} T_TVD_FUZZY_SECURITIES ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
5169
5170 ##{ T_TVD_FW_GRAPHIC_ID2 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
5171
5172 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
5173 mimeheader T_TVD_FW_GRAPHIC_ID2   Content-Id =~ /<(?:[0-9A-F]{8}\.){3}[0-9A-F]{8}/
5174 endif
5175 ##} T_TVD_FW_GRAPHIC_ID2 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
5176
5177 ##{ T_TVD_MIME_EPI ifplugin Mail::SpamAssassin::Plugin::MIMEEval
5178
5179 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
5180 body T_TVD_MIME_EPI             eval:check_msg_parse_flags('mime_epilogue_exists')
5181 endif
5182 ##} T_TVD_MIME_EPI ifplugin Mail::SpamAssassin::Plugin::MIMEEval
5183
5184 ##{ T_TVD_MIME_NO_HEADERS ifplugin Mail::SpamAssassin::Plugin::MIMEEval
5185
5186 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
5187 body T_TVD_MIME_NO_HEADERS      eval:check_msg_parse_flags('missing_mime_headers')
5188 endif
5189 ##} T_TVD_MIME_NO_HEADERS ifplugin Mail::SpamAssassin::Plugin::MIMEEval
5190
5191 ##{ T_WON_MONEY_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
5192
5193 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
5194   meta       T_WON_MONEY_ATTACH   __YOU_WON && LOTS_OF_MONEY && (__PDF_ATTACH || __DOC_ATTACH)
5195   describe   T_WON_MONEY_ATTACH   You won lots of money! See attachment.
5196 endif
5197 ##} T_WON_MONEY_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
5198
5199 ##{ T_WON_NBDY_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
5200
5201 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
5202   meta       T_WON_NBDY_ATTACH    __YOU_WON && __EMPTY_BODY && (__PDF_ATTACH || __DOC_ATTACH || __GIF_ATTACH || __JPEG_ATTACH)
5203   describe   T_WON_NBDY_ATTACH    You won lots of money! See attachment.
5204 endif
5205 ##} T_WON_NBDY_ATTACH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
5206
5207 ##{ T_ZW_OBFU_BITCOIN if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5208
5209 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5210   meta       T_ZW_OBFU_BITCOIN            __UNICODE_OBFU_ZW && __BITCOIN_ID
5211   describe   T_ZW_OBFU_BITCOIN            Obfuscated text + bitcoin ID - possible extortion
5212 #  score      T_ZW_OBFU_BITCOIN            2.500        # limit
5213 endif
5214 ##} T_ZW_OBFU_BITCOIN if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5215
5216 ##{ T_ZW_OBFU_FREEM if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5217
5218 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5219   meta       T_ZW_OBFU_FREEM              __UNICODE_OBFU_ZW && __freemail_hdr_replyto
5220   describe   T_ZW_OBFU_FREEM              Obfuscated text + freemail
5221 #  score      T_ZW_OBFU_FREEM              2.000        # limit
5222 endif
5223 ##} T_ZW_OBFU_FREEM if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5224
5225 ##{ T_ZW_OBFU_FROMTOSUBJ if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5226
5227 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5228   meta       T_ZW_OBFU_FROMTOSUBJ         __UNICODE_OBFU_ZW && FROM_IN_TO_AND_SUBJ
5229   describe   T_ZW_OBFU_FROMTOSUBJ         Obfuscated text + from in to and subject
5230 #  score      T_ZW_OBFU_FROMTOSUBJ         2.000        # limit
5231 endif
5232 ##} T_ZW_OBFU_FROMTOSUBJ if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5233
5234 ##{ UC_GIBBERISH_OBFU
5235
5236 meta        UC_GIBBERISH_OBFU  (__UC_GIBB_OBFU > 1) && !__RP_MATCHES_RCVD && !__VIA_ML && !__DKIM_EXISTS && !ALL_TRUSTED
5237 describe    UC_GIBBERISH_OBFU  Multiple instances of "word VERYLONGGIBBERISH word"
5238 #score       UC_GIBBERISH_OBFU  3.000   # Limit
5239 tflags      UC_GIBBERISH_OBFU  publish
5240 ##} UC_GIBBERISH_OBFU
5241
5242 ##{ UNDISC_FREEM
5243
5244 meta       UNDISC_FREEM                __UNDISC_FREEM
5245 describe   UNDISC_FREEM                Undisclosed recipients + freemail reply-to
5246 tflags     UNDISC_FREEM                publish
5247 ##} UNDISC_FREEM
5248
5249 ##{ UNDISC_MONEY
5250
5251 meta       UNDISC_MONEY                __UNDISC_MONEY && !__VIA_ML && !__MSGID_HEXISH
5252 describe   UNDISC_MONEY                Undisclosed recipients + money/fraud signs
5253 tflags     UNDISC_MONEY                publish
5254 ##} UNDISC_MONEY
5255
5256 ##{ UNICODE_OBFU_ASC if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5257
5258 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5259   meta       UNICODE_OBFU_ASC           __UNICODE_OBFU_ASC && !__SPAN_BEG_TEXT && !HTML_IMAGE_ONLY_32
5260   describe   UNICODE_OBFU_ASC           Obfuscating text with unicode
5261 #  score      UNICODE_OBFU_ASC           2.500  # limit
5262   tflags     UNICODE_OBFU_ASC           publish
5263 endif
5264 ##} UNICODE_OBFU_ASC if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5265
5266 ##{ UNICODE_OBFU_ZW if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5267
5268 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5269   meta       UNICODE_OBFU_ZW            __UNICODE_OBFU_ZW_2 && !__SUBSCRIPTION_INFO && !__RCD_RDNS_MAIL_MESSY && !__DOS_HAS_LIST_ID && !__USING_VERP1 && !__DOS_HAS_LIST_UNSUB && !__RCD_RDNS_SMTP && !__DKIM_EXISTS
5270   describe   UNICODE_OBFU_ZW            Obfuscating text with hidden characters
5271 #  score      UNICODE_OBFU_ZW            3.500  # limit
5272   tflags     UNICODE_OBFU_ZW            publish
5273 endif
5274 ##} UNICODE_OBFU_ZW if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5275
5276 ##{ UNSUB_GOOG_FORM
5277
5278 meta        UNSUB_GOOG_FORM      __UNSUB_GOOG_FORM
5279 describe    UNSUB_GOOG_FORM      Unsubscribe via Google Docs form
5280 #score       UNSUB_GOOG_FORM      2.500 # limit
5281 tflags      UNSUB_GOOG_FORM      publish
5282 ##} UNSUB_GOOG_FORM
5283
5284 ##{ URIBL_RHS_DOB ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
5285
5286 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
5287 urirhssub URIBL_RHS_DOB         dob.sibl.support-intelligence.net  A   2
5288 body URIBL_RHS_DOB              eval:check_uridnsbl('URIBL_RHS_DOB')
5289 describe URIBL_RHS_DOB          Contains an URI of a new domain (Day Old Bread)
5290 tflags URIBL_RHS_DOB            net
5291 endif
5292 ##} URIBL_RHS_DOB ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
5293
5294 ##{ URI_ADOBESPARK
5295
5296 meta       URI_ADOBESPARK              __URI_ADOBESPARK
5297 #score      URI_ADOBESPARK              3.500   # limit
5298 tflags     URI_ADOBESPARK              publish
5299 ##} URI_ADOBESPARK
5300
5301 ##{ URI_AZURE_CLOUDAPP
5302
5303 meta       URI_AZURE_CLOUDAPP          __URI_AZURE_CLOUDAPP && __NAKED_TO && !__HDR_RCVD_GOOGLE
5304 describe   URI_AZURE_CLOUDAPP          Link to hosted azure web application, possible phishing
5305 #score      URI_AZURE_CLOUDAPP          3.000   # limit
5306 tflags     URI_AZURE_CLOUDAPP          publish
5307 ##} URI_AZURE_CLOUDAPP
5308
5309 ##{ URI_DASHGOVEDU
5310
5311 meta       URI_DASHGOVEDU              __URI_DASHGOVEDU
5312 describe   URI_DASHGOVEDU              Suspicious domain name
5313 #score      URI_DASHGOVEDU              3.500   # limit
5314 tflags     URI_DASHGOVEDU              publish
5315 ##} URI_DASHGOVEDU
5316
5317 ##{ URI_DATA
5318
5319 meta        URI_DATA           __URI_DATA && !ALL_TRUSTED && !__RCD_RDNS_MAIL_MESSY && !__HAS_ERRORS_TO && !__VIA_ML && !__ENV_AND_HDR_FROM_MATCH && !__DOS_HAS_LIST_UNSUB
5320 describe    URI_DATA           "data:" URI - possible malware or phish
5321 #score       URI_DATA           3.250   # limit
5322 tflags      URI_DATA           publish
5323 ##} URI_DATA
5324
5325 ##{ URI_DOTEDU
5326
5327 meta       URI_DOTEDU                  __URI_DOTEDU && !__RCVD_DOTEDU_EXT && !__DOS_HAS_LIST_UNSUB && !__VIA_ML && !__HAS_X_MAILER && !ALL_TRUSTED && !__UNSUB_LINK && !__RDNS_SHORT && !__MAIL_LINK
5328 describe   URI_DOTEDU                  Has .edu URI
5329 #score      URI_DOTEDU                  2.000   # limit
5330 tflags     URI_DOTEDU                  publish
5331 ##} URI_DOTEDU
5332
5333 ##{ URI_DOTEDU_ENTITY
5334
5335 meta       URI_DOTEDU_ENTITY           __URI_DOTEDU_ENTITY && !__SUBSCRIPTION_INFO
5336 describe   URI_DOTEDU_ENTITY           Via .edu MTA + suspicious HTML content
5337 #score      URI_DOTEDU_ENTITY           3.000   # limit
5338 tflags     URI_DOTEDU_ENTITY           publish
5339 ##} URI_DOTEDU_ENTITY
5340
5341 ##{ URI_DOTTY_HEX
5342
5343 meta        URI_DOTTY_HEX              __URI_DOTTY_HEX
5344 describe    URI_DOTTY_HEX              Suspicious URI format
5345 tflags      URI_DOTTY_HEX              publish
5346 ##} URI_DOTTY_HEX
5347
5348 ##{ URI_DQ_UNSUB
5349
5350 meta           URI_DQ_UNSUB     __URI_DQ_UNSUB
5351 describe       URI_DQ_UNSUB     IP-address unsubscribe URI
5352 tflags         URI_DQ_UNSUB     publish
5353 ##} URI_DQ_UNSUB
5354
5355 ##{ URI_FIREBASEAPP
5356
5357 meta       URI_FIREBASEAPP             __URI_FIREBASEAPP || __URI_WEBAPP
5358 describe   URI_FIREBASEAPP             Link to hosted firebase web application, possible phishing
5359 #score      URI_FIREBASEAPP             3.000   # limit
5360 tflags     URI_FIREBASEAPP             publish
5361 ##} URI_FIREBASEAPP
5362
5363 ##{ URI_GOOGLE_PROXY
5364
5365 meta           URI_GOOGLE_PROXY       __URI_GOOGLE_PROXY && !__FSL_RELAY_GOOGLE && !__TO___LOWER && !__MSGID_OK_HEX && !__HAS_CAMPAIGNID
5366 describe       URI_GOOGLE_PROXY       Accessing a blacklisted URI or obscuring source of phish via Google proxy?
5367 tflags         URI_GOOGLE_PROXY       publish
5368 ##} URI_GOOGLE_PROXY
5369
5370 ##{ URI_GOOG_STO_SPAMMY
5371
5372 uri URI_GOOG_STO_SPAMMY m;^https?://storage\.googleapis\.com/(?:(?:1tactc1200|430bc3a2d98b15a0c58bf8df8f938d|5(?:a70f8147b2241c|lose1weight)|7(?:7(?:7burnf4|ancemrani|kneesleeve|metabolism)|88medw4|arshield777|burn7774|savingsoff)|a(?:1discover|d(?:t100visa|vanced1500)|geless(?:brain|t001)|ir0doc5octor|l(?:liedtrust7?|zheimerbrain)|merican(?:ho(?:777|me(?:191|warranty))|w1)|n(?:c77emen777|dersens40|n(?:nuities0102|utsegtsety)|ti(?:1virus|dcfsdfzef))|pp(?:1ointment|empresa|itausa)|tividade|udio0254)|b(?:337276797de5b3|7772dcb|a(?:ckmedic|th(?:and777|bhow98|dfgdfgdfh|rooomlki))|cvncv7845|d(?:fbgverhg|sgbsehtth|thdethydeth)|e(?:achskinnew|dvgervg|lly(?:00fetyy|gluca)|t(?:ter(?:09909|863|butter008)|umpoiytre))|io(?:swit(?:010|sh0908)|techinvest)|l(?:oo(?:ds(?:hark0508|ug(?:217|ar(?:010|blueprint)))|odsugarerte)|ue(?:0sky|printms0?))|o(?:bby\-dependencies|ostinglive01)|r(?:ain(?:232654|al87484)|i(?:an(?:0(?:101|509)|the0101)|eanfrg)|tghrh)|u(?:kssin|ll(?:gold|market)|rnomegaultra|tter(?:knife|spreader(?:0[48]|news)))|yte01smil1e)|c(?:a(?:99rshield|nvascheap|rt\-checkout|unlimited)|bd(?:11gummies|g(?:m0202|umm(?:ty|y005))|health7417|kfgdfg|sgummys)|dfeesde|ertificat01|hoicehom8270|ircaknee0|jowa|o(?:gnigenix|mp(?:erssac00232|r(?:e(?:essaa001|hensiveamericanhomewarranty|ss(?:a(?:0(?:105|201)|191)|ionsocks))|ovanteanexo))|n(?:7cealed|cealed(?:aff0054|tactical)|defesf|ne5ctrou4t0s)|ptquad5e1r|rrectskin|verageinsu)|quelleczema|reative14141)|d(?:0ujdusudu9s9u\.appspot\.com|e(?:mentiabrain|nta77fend|rma(?:01247|1correct|587475|7correc7t|acorrectskin|correct(?:001new1|new001|skin|1)|hdth|thbsdrhg)|tranmultas)|g(?:iadikir784|vdevgege)|i(?:abetes7|gitaldots1|recting77|ta0526)|rtrebtgh747|ysfunction0707|zdzefef)|e(?:7co7verage|a(?:rsring01|sy(?:1canvas|canvasprints))|ingingears|l(?:eepexperts|iminatorlower)|n(?:e(?:nce7777|rgy(?:0icits|savings))|trega)|rec(?:01tions|tiledysfunction)|t(?:alsprcious|ernal07light)|vent(?:0saves01?|save(?:010?|s010))|xpertwindows(?:0102)?|yes(?:1ight|ightmax))|f(?:4747|d(?:128218622bd3f|fdfdzezr78|zdzelom)|edilty5401|habgfdgbfrtg|i(?:7(?:485612|542512)|d(?:el(?:ity(?:09|217|insulife)|ty(?:gbdtrbr|tyhjudtyu))|iity5660|y001)|ghttinnitusnow(?:(?:911|s))?|ltyredfezz|refig(?:22hting|hting)|tnesswatch|xguca777)|l(?:a(?:sh(?:light7fr7ee|tric540)|tbelly)|oodlight(?:010|slima))|o(?:mrulasugaa|od54451|toswhatsapps)|rgdfgdfh|s(?:dcfzef|efzgefz)|tlkopmdrdfe|u(?:ng(?:01ft|9901|enail010|us(?:eliminator0807|fghgh))|turistic00insol))|g(?:7oldco|cumbmdys|eniusbutter|fhfjgfhfg|hetiop|lu(?:1lossn01k|lossn01k|ster)|old(?:ii00215|trust00)|r(?:7owtmaihn9ew|fgrgrg|ow(?:191|plus11|savage01085))|u(?:ardiao|mm(?:ies11cbd|yss|zdfefzf)|tter(?:0fr1(?:dian)?|protection7))|ympro22)|h(?:4ome1owne1r|dfghbrh|e(?:1al1t4|a(?:lt(?:h(?:life|news|yhairremedy)|ycbd0909)|rt(?:14141|beat911))|rp(?:ly(?:24701|y0012)|y1414))|ome(?:1security|9865|choice45841|w(?:arranty|rr0216)))|i(?:n(?:formedetranmulta|ogen0065|s(?:1urance7net|7urance7net|t(?:9854|a(?:0541|1heater|863|f(?:atioplo|gregrerg)|hard0(?:0021|605)|nttranslator)|h(?:ard879477|eater001))|urance(?:7net|net))|vest777in)|ron479max5x|tchrelief)|k(?:757474|e(?:ranfvgdgfrder|to(?:0(?:102|202|81477)|191|7(?:878|rim)|adv217|ghghgh|healthnews|jkkfghk|o(?:2(?:22|45)|o7896)|rapid00888|s(?:hark0908|s0479)|toto2323))|iller1111|ne(?:e852|f6565))|l(?:a(?:bcream|wn(?:care3|trugreen001))|e(?:a(?:f7filt7er|nde0585)|ciofve1748)|giesnaturas0|i(?:berty77arran|fefiltrevdf|ve(?:r(?:0health0support|md|supp10)|wirenew024))|o(?:caweb|odlight(?:s0|0)|ss(?:00wrabido0|rapid01245|weightnew85))|u(?:llmattressne000|mi(?:00guard01|agudiidd|g(?:87[56]|uard(?:1074|87585)))))|m(?:a(?:galu|l(?:4e7e5nhanc7ement|e(?:0(?:1ed|541)|24700|77en|health475))|ttress0707)|e(?:di(?:ca(?:lsupplies|r(?:0085|123n|df747))|p0lanning)|llitox00545|morybooster|t(?:a(?:bolismlos|greens|lspr(?:ciou[0s]|ecious))|f(?:85|dfvde)))|iracl(?:ecannabidiol|sweight[0s]?|weight)|le(?:3mlemlm3lm\.appspot\.com|n(?:hsances?|shsance0s))|o(?:bile57mint|n(?:5g154g|t(?:ezuma0(?:01|101)|zdzsds))|onmenermaintain\-66j)|y(?:seniorpe?|theraposture001))|n(?:at(?:ional14587|uralgies)|badefdfg|e(?:sdsd|wtiniggrgr)|inoty74|lmsld|u(?:bupatches|trisd17))|o(?:m(?:eg(?:7aburn|a(?:7burn|n(?:ew|ow00?)))|gaburn)|ne(?:00shot|shot(?:0[01]|124578))|zmenshe)|p(?:a(?:in(?:en01(?:ew|sew)|supp(?:10|l8778)|wenes010)|rtnersav01)|e(?:rsonalized21|tplan85)|ho(?:01to001|tostick004)|leteroid|o(?:rtable(?:heater7|telescope045)|vsedfzef)|r(?:eadvanceds|i(?:mal(?:08544|fhdfh|grow)|ntsvalentine)|otectsecurity)|soidngf8147|ure(?:cbdgummies7|plant7))|r(?:apidecision77|e(?:5model1ro4om|adclub11|direct0gumm0|grow101|n(?:ew(?:al20consult|laemailved)|walllll0065)|v(?:caus181|e(?:alscause|rsirol0101)|kcaus181|scaus181))|i(?:ght0108|ngingearstinnitus|verb1986srt4)|oundupccancer|vices8|yokorout(?:(?:01|s010?))?)|s(?:a(?:fety(?:homes?|shome0?)|mples7nuge7|v(?:age(?:0502|72|999|grow010)|es0even0t|ingsevent)|y(?:byebugs|life004))|coutstonenew|dfgwsd74fg|e(?:curity(?:homenew|providernew)|ni(?:147orperk|orserk77s))|gp008|h(?:arkcbd0808|owersafe)|i(?:gnlaotrrmp|mplex18742)|leepditch|o(?:lbeam004|uthbeach(?:001|skin))|preader35|sgummy777|t(?:ain245|eelprobite77|rictionbp0)|u(?:g(?:ar4701|hdetged)|mmersy0(?:10)?)|zdzdzdzd)|t(?:a(?:cflashlight72|lcumpowder)|e(?:lescope001|rminix0909|stomus)|h(?:e(?:photostick2804|rasl(?:eeves|ves)|unbreakable)|opinall)|i(?:me0share|nnitus(?:102|new911))|mobile0sur1vey|o(?:enailfungus|p(?:inal|olio29034))|r(?:4ans1lat5or|a(?:balhos|nslato10)|im1life0|ugreen(?:30|s30))|telescope44|unnifgdege)|u(?:berxlm|ltra(?:hgt|omegaburn|u(?:ifipro|wifip)|wifi(?:058|pro002))|n(?:breakable(?:0417|brain0087)|limitedcanvase[es]?)|rgentfung171|s(?:bmosquito|6)|tility3in1)|v(?:e(?:7hicle7cov|hi(?:7clesh7|cle01))|frgrerg|i(?:sa(?:alandere?|lander[es]?)|v(?:247w01|int(?:0(?:401|officially)|1010smart|967857)))|szdefzsfzef)|w(?:4enmedicra8|a(?:l(?:k(?:0015|7485|ghghgh|inbath(?:tub44|0))|lkk0409|mart010)|rranhome0012)|defgzegfze|e(?:atherproof|bwhatsfotos|edkiller[1s]?|ight(?:00loss|loss(?:005|newketo))|llgrove90)|i(?:fi(?:booste(?:01|r)|tiop)|n(?:0101|doexpr001))|painen01es)|xcbxcbopiaze|yusdgtduf777|z(?:antacdedzef|ipp874ype57t)))/;i
5373 describe URI_GOOG_STO_SPAMMY Link to spammy content hosted by google storage
5374 #score URI_GOOG_STO_SPAMMY 3.000
5375 tflags URI_GOOG_STO_SPAMMY publish
5376 ##} URI_GOOG_STO_SPAMMY
5377
5378 ##{ URI_HEX_IP
5379
5380 meta       URI_HEX_IP                  __URI_HEX_IP
5381 #score      URI_HEX_IP                  2.500   # limit
5382 describe   URI_HEX_IP                  URI with hex-encoded IP-address host
5383 tflags     URI_HEX_IP                  publish
5384 ##} URI_HEX_IP
5385
5386 ##{ URI_IMG_WP_REDIR
5387
5388 meta       URI_IMG_WP_REDIR            __URI_IMG_WP_REDIR
5389 #score      URI_IMG_WP_REDIR            3.000   # limit
5390 describe   URI_IMG_WP_REDIR            Image via WordPress "accelerator" proxy
5391 tflags     URI_IMG_WP_REDIR            publish
5392 ##} URI_IMG_WP_REDIR
5393
5394 ##{ URI_LONG_REPEAT
5395
5396 meta       URI_LONG_REPEAT             __URI_LONG_REPEAT
5397 describe   URI_LONG_REPEAT             Long identical host+domain
5398 #score      URI_LONG_REPEAT             2.500   # limit
5399 tflags     URI_LONG_REPEAT             publish
5400 ##} URI_LONG_REPEAT
5401
5402 ##{ URI_MALWARE_SCMS
5403
5404 uri         URI_MALWARE_SCMS   /\.SettingContent-ms\b/i
5405 describe    URI_MALWARE_SCMS   Link to malware exploit download (.SettingContent-ms file)
5406 tflags      URI_MALWARE_SCMS   publish
5407 ##} URI_MALWARE_SCMS
5408
5409 ##{ URI_ONLY_MSGID_MALF
5410
5411   meta      URI_ONLY_MSGID_MALF           __URI_ONLY_MSGID_MALF && !__RP_MATCHES_RCVD && !__URI_MAILTO && !__NOT_SPOOFED && !__DKIM_EXISTS && !__MSGID_JAVAMAIL && !__HAS_REPLY_TO && !RCVD_IN_DNSWL_LOW
5412   tflags    URI_ONLY_MSGID_MALF           net
5413   meta      URI_ONLY_MSGID_MALF           __URI_ONLY_MSGID_MALF && !__RP_MATCHES_RCVD && !__URI_MAILTO && !__NOT_SPOOFED && !__DKIM_EXISTS && !__MSGID_JAVAMAIL && !__HAS_REPLY_TO
5414 describe  URI_ONLY_MSGID_MALF           URI only + malformed message ID
5415 #score     URI_ONLY_MSGID_MALF           2.000  # limit
5416 tflags    URI_ONLY_MSGID_MALF           publish
5417 ##} URI_ONLY_MSGID_MALF
5418
5419 ##{ URI_OPTOUT_3LD
5420
5421 uri         URI_OPTOUT_3LD    m,^https?://(?:quit|bye|remove|exit|leave|disallow|halt|stop|end|herego|out|discontinue)\d*\.[^/]+\.(?:com|net)\b,i
5422 describe    URI_OPTOUT_3LD    Opt-out URI, suspicious hostname
5423 #score       URI_OPTOUT_3LD    2.000   # limit
5424 tflags      URI_OPTOUT_3LD    publish
5425 ##} URI_OPTOUT_3LD
5426
5427 ##{ URI_OPTOUT_USME
5428
5429 uri         URI_OPTOUT_USME   m,^https?://(?:quit|bye|remove|exit|leave|disallow|halt|stop|end|herego|out|discontinue)\d*\.[^/]+\.(?:us|me|mobi|club)\b,i
5430 describe    URI_OPTOUT_USME   Opt-out URI, unusual TLD
5431 tflags      URI_OPTOUT_USME   publish
5432 ##} URI_OPTOUT_USME
5433
5434 ##{ URI_PHISH
5435
5436 describe    URI_PHISH            Phishing using web form
5437 #score       URI_PHISH            4.00   # limit
5438 tflags      URI_PHISH            publish
5439 ##} URI_PHISH
5440
5441 ##{ URI_PHISH if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
5442
5443 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
5444   meta      URI_PHISH      __URI_PHISH && !ALL_TRUSTED && !__UNSUB_LINK && !__TAG_EXISTS_CENTER && !__HAS_SENDER && !__CAN_HELP && !__VIA_ML && !__UPPERCASE_URI && !__HAS_CC && !__NUMBERS_IN_SUBJ && !__PCT_FOR_YOU && !__MOZILLA_MSGID && !__FB_COST && !__hk_bigmoney && !__HELO_HIGHPROFILE && !__RCD_RDNS_SMTP_MESSY && !__BUGGED_IMG && !__FB_TOUR && !__RCVD_DOTGOV_EXT
5445 endif
5446 ##} URI_PHISH if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
5447
5448 ##{ URI_PHISH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
5449
5450 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
5451   meta      URI_PHISH      __URI_PHISH && !ALL_TRUSTED && !__UNSUB_LINK && !__TAG_EXISTS_CENTER && !__HAS_SENDER && !__CAN_HELP && !__VIA_ML && !__UPPERCASE_URI && !__HAS_CC && !__NUMBERS_IN_SUBJ && !__PCT_FOR_YOU && !__MOZILLA_MSGID && !__FB_COST && !__hk_bigmoney && !__REMOTE_IMAGE && !__HELO_HIGHPROFILE && !__RCD_RDNS_SMTP_MESSY && !__BUGGED_IMG && !__FB_TOUR && !__RCVD_DOTGOV_EXT
5452 endif
5453 ##} URI_PHISH ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
5454
5455 ##{ URI_PHP_REDIR
5456
5457 meta       URI_PHP_REDIR               __URI_PHP_REDIR && !__USING_VERP1 && !__RCD_RDNS_MTA
5458 #score      URI_PHP_REDIR               3.500   # limit
5459 describe   URI_PHP_REDIR               PHP redirect to different URL (link obfuscation)
5460 tflags     URI_PHP_REDIR               publish
5461 ##} URI_PHP_REDIR
5462
5463 ##{ URI_TRY_3LD
5464
5465 meta        URI_TRY_3LD       __URI_TRY_3LD && !__HAS_ERRORS_TO && !__HDR_RCVD_ALIBABA && !__HDR_CASE_REVERSED && !__XM_EC_MESSENGER && !__CHARITY && !__URI_DOTEDU && !__HAS_X_REF && !__HDR_RCVD_APPLE
5466 describe    URI_TRY_3LD       "Try it" URI, suspicious hostname
5467 #score       URI_TRY_3LD       2.000   # limit
5468 tflags      URI_TRY_3LD       publish
5469 ##} URI_TRY_3LD
5470
5471 ##{ URI_TRY_USME
5472
5473 meta        URI_TRY_USME      __URI_TRY_USME && !__DKIM_EXISTS
5474 describe    URI_TRY_USME      "Try it" URI, unusual TLD
5475 #score       URI_TRY_USME      2.000    # limit
5476 tflags      URI_TRY_USME      publish
5477 ##} URI_TRY_USME
5478
5479 ##{ URI_WPADMIN
5480
5481 meta        URI_WPADMIN        __URI_WPADMIN
5482 describe    URI_WPADMIN        WordPress login/admin URI, possible phishing
5483 tflags      URI_WPADMIN        publish
5484 ##} URI_WPADMIN
5485
5486 ##{ URI_WP_DIRINDEX
5487
5488 meta        URI_WP_DIRINDEX    __URI_WPDIRINDEX
5489 describe    URI_WP_DIRINDEX    URI for compromised WordPress site, possible malware
5490 #score       URI_WP_DIRINDEX    3.500   # limit
5491 tflags      URI_WP_DIRINDEX    publish
5492 ##} URI_WP_DIRINDEX
5493
5494 ##{ URI_WP_HACKED
5495
5496 meta        URI_WP_HACKED      (__URI_WPCONTENT || __URI_WPINCLUDES) && !__VIA_ML && !__HAS_ERRORS_TO && !__RCD_RDNS_SMTP && !__THREADED && !ALL_TRUSTED && !__NOT_SPOOFED
5497 describe    URI_WP_HACKED      URI for compromised WordPress site, possible malware
5498 #score       URI_WP_HACKED      3.500   # limit
5499 tflags      URI_WP_HACKED      publish
5500 ##} URI_WP_HACKED
5501
5502 ##{ URI_WP_HACKED_2
5503
5504 meta        URI_WP_HACKED_2    (__PS_TEST_LOC_WP && !URI_WP_HACKED) && !__HAS_LIST_ID && !__THREADED && !__USING_VERP1
5505 describe    URI_WP_HACKED_2    URI for compromised WordPress site, possible malware
5506 #score       URI_WP_HACKED_2    2.500   # limit
5507 tflags      URI_WP_HACKED_2    publish
5508 ##} URI_WP_HACKED_2
5509
5510 ##{ USB_DRIVES
5511
5512 meta       USB_DRIVES                 __SUBJ_USB_DRIVES
5513 describe   USB_DRIVES                 Trying to sell custom USB flash drives
5514 #score      USB_DRIVES                 2.000    # limit
5515 tflags     USB_DRIVES                 publish
5516 ##} USB_DRIVES
5517
5518 ##{ VFY_ACCT_NORDNS
5519
5520 meta        VFY_ACCT_NORDNS      __VFY_ACCT_NORDNS && !__STY_INVIS_MANY
5521 describe    VFY_ACCT_NORDNS      Verify your account to a poorly-configured MTA - probable phishing
5522 #score       VFY_ACCT_NORDNS      3.000 # limit
5523 tflags      VFY_ACCT_NORDNS      publish
5524 ##} VFY_ACCT_NORDNS
5525
5526 ##{ VPS_NO_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5527
5528 if (version >= 3.004002)
5529 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5530 meta     VPS_NO_NTLD __VPSNUMBERONLY_TLD && __FROM_ADDRLIST_SUSPNTLD
5531 tflags   VPS_NO_NTLD publish
5532 describe VPS_NO_NTLD vps[0-9] domain at a suspiscious TLD
5533 #score    VPS_NO_NTLD 1.0 # limit
5534 endif
5535 endif
5536 ##} VPS_NO_NTLD if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5537
5538 ##{ WALMART_IMG_NOT_RCVD_WAL
5539
5540 meta       WALMART_IMG_NOT_RCVD_WAL    __WALMART_IMG_NOT_RCVD_WAL && !__DKIM_EXISTS
5541 #score      WALMART_IMG_NOT_RCVD_WAL    2.500   # limit
5542 describe   WALMART_IMG_NOT_RCVD_WAL    Walmart hosted image but message not from Walmart
5543 tflags     WALMART_IMG_NOT_RCVD_WAL    publish
5544 ##} WALMART_IMG_NOT_RCVD_WAL
5545
5546 ##{ WORD_INVIS if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5547
5548 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5549   meta      WORD_INVIS                    __WORD_INVIS_MINFP && !WORD_INVIS_MANY
5550   describe  WORD_INVIS                    A hidden word
5551 #  score     WORD_INVIS                    3.000        # limit
5552   tflags    WORD_INVIS                    publish
5553 endif
5554 ##} WORD_INVIS if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5555
5556 ##{ WORD_INVIS_MANY if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5557
5558 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5559   meta      WORD_INVIS_MANY               __WORD_INVIS_2
5560   describe  WORD_INVIS_MANY               Multiple individual hidden words
5561 #  score     WORD_INVIS_MANY               3.000        # limit
5562   tflags    WORD_INVIS_MANY               publish
5563 endif
5564 ##} WORD_INVIS_MANY if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
5565
5566 ##{ XFER_LOTSA_MONEY
5567
5568 meta     XFER_LOTSA_MONEY        __XFER_LOTSA_MONEY && !__VIA_ML && !__HAS_SENDER && !__SUBSCRIPTION_INFO
5569 describe XFER_LOTSA_MONEY        Transfer a lot of money
5570 #score    XFER_LOTSA_MONEY        1.000   # limit
5571 ##} XFER_LOTSA_MONEY
5572
5573 ##{ XM_DIGITS_ONLY
5574
5575 meta       XM_DIGITS_ONLY              __XM_DIGITS_ONLY
5576 describe   XM_DIGITS_ONLY              X-Mailer malformed
5577 #score      XM_DIGITS_ONLY              3.000   # limit
5578 tflags     XM_DIGITS_ONLY              publish
5579 ##} XM_DIGITS_ONLY
5580
5581 ##{ XM_PHPMAILER_FORGED
5582
5583 meta        XM_PHPMAILER_FORGED    __XM_PHPMAILER_FORGED
5584 describe    XM_PHPMAILER_FORGED    Apparently forged header
5585 tflags      XM_PHPMAILER_FORGED    publish
5586 ##} XM_PHPMAILER_FORGED
5587
5588 ##{ XM_RANDOM
5589
5590 meta       XM_RANDOM                   __XM_RANDOM && !__STY_INVIS_3 && !__HAS_IN_REPLY_TO && !__XM_UC_ONLY && !__XM_ASPQMAIL && !__XM_VERY_LONG
5591 describe   XM_RANDOM                   X-Mailer apparently random
5592 #score      XM_RANDOM                   2.500   # limit
5593 tflags     XM_RANDOM                   publish
5594 ##} XM_RANDOM
5595
5596 ##{ XM_RECPTID
5597
5598 meta       XM_RECPTID                  __HAS_XM_RECPTID && !__TAG_EXISTS_SCRIPT && !__REPLYTO_NOREPLY && !__ENVFROM_AMAZONSES && !__DOS_DIRECT_TO_MX && !__FRAUD_PTX
5599 describe   XM_RECPTID                  Has spammy message header
5600 #score      XM_RECPTID                  3.000   # limit
5601 ##} XM_RECPTID
5602
5603 ##{ XPRIO
5604
5605 describe    XPRIO              Has X-Priority header
5606 #score       XPRIO              2.250   # limit
5607 tflags      XPRIO              publish
5608 ##} XPRIO
5609
5610 ##{ XPRIO if !plugin(Mail::SpamAssassin::Plugin::DKIM)
5611
5612 if !plugin(Mail::SpamAssassin::Plugin::DKIM)
5613   meta      XPRIO              __XPRIO_MINFP
5614 endif
5615 ##} XPRIO if !plugin(Mail::SpamAssassin::Plugin::DKIM)
5616
5617 ##{ XPRIO ifplugin Mail::SpamAssassin::Plugin::DKIM
5618
5619 ifplugin Mail::SpamAssassin::Plugin::DKIM
5620   tflags    XPRIO              net
5621 endif
5622 ##} XPRIO ifplugin Mail::SpamAssassin::Plugin::DKIM
5623
5624 ##{ XPRIO ifplugin Mail::SpamAssassin::Plugin::DKIM if !plugin(Mail::SpamAssassin::Plugin::SPF)
5625
5626 ifplugin Mail::SpamAssassin::Plugin::DKIM
5627 if !plugin(Mail::SpamAssassin::Plugin::SPF)
5628     meta    XPRIO              __XPRIO_MINFP && !DKIM_SIGNED && !DKIM_VALID && !DKIM_VALID_AU && !RCVD_IN_DNSWL_NONE
5629 endif
5630 endif
5631 ##} XPRIO ifplugin Mail::SpamAssassin::Plugin::DKIM if !plugin(Mail::SpamAssassin::Plugin::SPF)
5632
5633 ##{ XPRIO ifplugin Mail::SpamAssassin::Plugin::DKIM ifplugin Mail::SpamAssassin::Plugin::SPF
5634
5635 ifplugin Mail::SpamAssassin::Plugin::DKIM
5636   ifplugin Mail::SpamAssassin::Plugin::SPF
5637     meta    XPRIO              __XPRIO_MINFP && !DKIM_SIGNED && !DKIM_VALID && !DKIM_VALID_AU && !RCVD_IN_DNSWL_NONE && !SPF_PASS
5638 endif
5639 endif
5640 ##} XPRIO ifplugin Mail::SpamAssassin::Plugin::DKIM ifplugin Mail::SpamAssassin::Plugin::SPF
5641
5642 ##{ XPRIO_SHORT_SUBJ
5643
5644 meta        XPRIO_SHORT_SUBJ   __XPRIO_SHORT_SUBJ && !__MSM_PRIO_REPTO && !ALL_TRUSTED && !__DKIM_EXISTS && !__RELAY_THRU_WWW && !__CTYPE_HAS_BOUNDARY && !__RCD_RDNS_MTA && !__HAS_HREF
5645 describe    XPRIO_SHORT_SUBJ   Has X Priority header + short subject
5646 #score       XPRIO_SHORT_SUBJ   2.500   # limit
5647 tflags      XPRIO_SHORT_SUBJ   publish
5648 ##} XPRIO_SHORT_SUBJ
5649
5650 ##{ XPRIO_URL_SHORTNER ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
5651
5652 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
5653 if (version >= 3.004000)
5654 meta     XPRIO_URL_SHORTNER __XPRIO_MINFP && __URL_SHORTENER
5655 describe XPRIO_URL_SHORTNER X-Priority header and short URL
5656 #score    XPRIO_URL_SHORTNER 1.0 # limit
5657 endif
5658 endif
5659 ##} XPRIO_URL_SHORTNER ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)
5660
5661 ##{ X_MAILER_CME_6543_MSN
5662
5663 header X_MAILER_CME_6543_MSN    X-Mailer =~ /^CME-V6\.5\.4\.3; MSN\s*$/
5664 ##} X_MAILER_CME_6543_MSN
5665
5666 ##{ YOU_INHERIT
5667
5668 meta     YOU_INHERIT      __YOU_INHERIT
5669 describe YOU_INHERIT      Discussing your inheritance
5670 ##} YOU_INHERIT
5671
5672 ##{ bayes_ignore_header_sandbox
5673
5674 bayes_ignore_header ARC-Authentication-Results
5675 bayes_ignore_header ARC-Message-Signature
5676 bayes_ignore_header ARC-Seal
5677 bayes_ignore_header Authentication-Results
5678 bayes_ignore_header Auto-Submitted
5679 bayes_ignore_header Autocrypt
5680 bayes_ignore_header CTCH-SenderID-TotalSpam
5681 bayes_ignore_header IronPort-SDR
5682 bayes_ignore_header List-Archive
5683 bayes_ignore_header List-Help
5684 bayes_ignore_header List-Id
5685 bayes_ignore_header List-Post
5686 bayes_ignore_header List-Subscribe
5687 bayes_ignore_header List-Unsubscribe
5688 bayes_ignore_header Mailing-List
5689 bayes_ignore_header Precedence
5690 bayes_ignore_header Received-SPF
5691 bayes_ignore_header suggested_attachment_session_id
5692 bayes_ignore_header X-ACL-Warn
5693 bayes_ignore_header X-Alimail-AntiSpam
5694 bayes_ignore_header X-Amavis-Modified
5695 bayes_ignore_header X-Anti-Spam
5696 bayes_ignore_header X-Anti-Virus
5697 bayes_ignore_header X-Anti-Virus-Version
5698 bayes_ignore_header X-AntiAbuse
5699 bayes_ignore_header X-Antispam
5700 bayes_ignore_header X-Antivirus
5701 bayes_ignore_header X-Antivirus-Code
5702 bayes_ignore_header X-Antivirus-Status
5703 bayes_ignore_header X-Antivirus-Version
5704 bayes_ignore_header x-aol-global-disposition
5705 bayes_ignore_header X-ASF-Spam-Status
5706 bayes_ignore_header X-ASG-Debug-ID
5707 bayes_ignore_header X-ASG-Orig-Subj
5708 bayes_ignore_header X-ASG-Recipient-Whitelist
5709 bayes_ignore_header X-ASG-Tag
5710 bayes_ignore_header X-Assp-Version
5711 bayes_ignore_header X-Attachment-Id
5712 bayes_ignore_header X-Authority-Analysis
5713 bayes_ignore_header X-Authvirus
5714 bayes_ignore_header X-Auto-Response-Suppress
5715 bayes_ignore_header X-AV-Do-Run
5716 bayes_ignore_header X-AV-Status
5717 bayes_ignore_header x-avast-antispam
5718 bayes_ignore_header X-Backend
5719 bayes_ignore_header X-Barracuda-Apparent-Source-IP
5720 bayes_ignore_header X-Barracuda-Bayes
5721 bayes_ignore_header X-Barracuda-BBL-IP
5722 bayes_ignore_header X-Barracuda-BRTS-Status
5723 bayes_ignore_header X-Barracuda-BRTS-URL-Found
5724 bayes_ignore_header X-Barracuda-Connect
5725 bayes_ignore_header X-Barracuda-Encrypted
5726 bayes_ignore_header X-Barracuda-Envelope-From
5727 bayes_ignore_header X-Barracuda-Fingerprint-Found
5728 bayes_ignore_header X-Barracuda-Orig-Rcpt
5729 bayes_ignore_header X-Barracuda-RBL-IP
5730 bayes_ignore_header X-Barracuda-RBL-Trusted-Forwarder
5731 bayes_ignore_header X-Barracuda-Spam-Report
5732 bayes_ignore_header X-Barracuda-Spam-Score
5733 bayes_ignore_header X-Barracuda-Spam-Status
5734 bayes_ignore_header X-Barracuda-Start-Time
5735 bayes_ignore_header X-Barracuda-UID
5736 bayes_ignore_header X-Barracuda-URL
5737 bayes_ignore_header X-Barracuda-Virus-Alert
5738 bayes_ignore_header X-Bayes-Prob
5739 bayes_ignore_header X-Bayesian-Result
5740 bayes_ignore_header X-BeenThere
5741 bayes_ignore_header X-BitDefender-Spam
5742 bayes_ignore_header X-BitDefender-SpamStamp
5743 bayes_ignore_header X-BL
5744 bayes_ignore_header X-Bogosity
5745 bayes_ignore_header X-Boxtrapper
5746 bayes_ignore_header X-Brightmail-Tracker
5747 bayes_ignore_header X-BTI-AntiSpam
5748 bayes_ignore_header X-Bugzilla-Version
5749 bayes_ignore_header X-CanIt-Geo
5750 bayes_ignore_header X-Canit-Stats-ID
5751 bayes_ignore_header X-CanItPRO-Stream
5752 bayes_ignore_header X-Clapf-spamicity
5753 bayes_ignore_header X-ClientProxiedBy
5754 bayes_ignore_header X-Cloud-Security
5755 bayes_ignore_header X-CM-Score
5756 bayes_ignore_header X-CMAE-Analysis
5757 bayes_ignore_header X-CMAE-Match
5758 bayes_ignore_header X-CMAE-Score
5759 bayes_ignore_header X-CMAE-Verdict
5760 bayes_ignore_header X-CNFS-Analysis
5761 bayes_ignore_header X-Company
5762 bayes_ignore_header X-Complaints-To
5763 bayes_ignore_header X-Coremail-Antispam
5764 bayes_ignore_header X-CRM114-CacheID
5765 bayes_ignore_header X-CRM114-Status
5766 bayes_ignore_header X-CRM114-Version
5767 bayes_ignore_header X-CT-Spam
5768 bayes_ignore_header X-CTCH-SenderID
5769 bayes_ignore_header X-CTCH-SenderID-TotalBulk
5770 bayes_ignore_header X-CTCH-SenderID-TotalConfirmed
5771 bayes_ignore_header X-CTCH-SenderID-TotalMessages
5772 bayes_ignore_header X-CTCH-SenderID-TotalRecipients
5773 bayes_ignore_header X-CTCH-SenderID-TotalSpam
5774 bayes_ignore_header X-CTCH-SenderID-TotalSuspected
5775 bayes_ignore_header X-CTCH-SenderID-TotalVirus
5776 bayes_ignore_header X-CTCH-Spam
5777 bayes_ignore_header X-CTCH-VOD
5778 bayes_ignore_header X-Delivered-To
5779 bayes_ignore_header X-Drweb-SpamState
5780 bayes_ignore_header X-DSPAM-Confidence
5781 bayes_ignore_header X-DSPAM-Factors
5782 bayes_ignore_header X-DSPAM-Improbability
5783 bayes_ignore_header X-DSPAM-Probability
5784 bayes_ignore_header X-DSPAM-Processed
5785 bayes_ignore_header X-DSPAM-Result
5786 bayes_ignore_header X-DSPAM-Signature
5787 bayes_ignore_header x-eavas
5788 bayes_ignore_header x-eavas-action
5789 bayes_ignore_header x-eavas-eavasid
5790 bayes_ignore_header X-Enigmail-Version
5791 bayes_ignore_header X-EsetId
5792 bayes_ignore_header X-EsetResult
5793 bayes_ignore_header X-Exchange-Antispam-Report
5794 bayes_ignore_header X-Exchange-Antispam-Report-CFA-Test
5795 bayes_ignore_header X-ExtloopSabreCommercials1
5796 bayes_ignore_header X-EYOU-SPAMVALUE
5797 bayes_ignore_header X-FB-OUTBOUND-SPAM
5798 bayes_ignore_header X-FEAS-SBL
5799 bayes_ignore_header X-FILTER-SCORE
5800 bayes_ignore_header X-Forefront-Antispam-Report
5801 bayes_ignore_header X-Forefront-Antispam-Report-Untrusted
5802 bayes_ignore_header X-Forefront-PRVS
5803 bayes_ignore_header X-Freemail-From
5804 bayes_ignore_header X-Fuglu-Spamstatus
5805 bayes_ignore_header X-Fuglu-Suspect
5806 bayes_ignore_header X-getmail-filter-classifier
5807 bayes_ignore_header X-GFIME-MASPAM
5808 bayes_ignore_header X-Gm-Message-State
5809 bayes_ignore_header X-Gmane-NNTP-Posting-Host
5810 bayes_ignore_header X-GMX-Antispam
5811 bayes_ignore_header X-GMX-Antivirus
5812 bayes_ignore_header X-Google-DKIM-Signature
5813 bayes_ignore_header X-He-Spam
5814 bayes_ignore_header X-hMailServer-Spam
5815 bayes_ignore_header X-IAS
5816 bayes_ignore_header X-iGspam-global
5817 bayes_ignore_header X-Injected-Via-Gmane
5818 bayes_ignore_header X-Interia-Antivirus
5819 bayes_ignore_header X-IP-Spam-Verdict
5820 bayes_ignore_header X-Ironport
5821 bayes_ignore_header X-IronPort-Anti-Spam-Filtered
5822 bayes_ignore_header X-IronPort-Anti-Spam-Result
5823 bayes_ignore_header X-IronPort-AV
5824 bayes_ignore_header X-Ironport-HAT
5825 bayes_ignore_header X-Ironport-HOSTNAME
5826 bayes_ignore_header X-Ironport-LNR
5827 bayes_ignore_header X-Ironport-MessageFilter
5828 bayes_ignore_header X-Ironport-MFP
5829 bayes_ignore_header X-Ironport-MID
5830 bayes_ignore_header X-IronPort-Outgoing-Antispam
5831 bayes_ignore_header X-Ironport-RIF
5832 bayes_ignore_header X-Ironport-SBRS
5833 bayes_ignore_header X-Ironport-SENDER
5834 bayes_ignore_header X-Ironport-SUBJECT
5835 bayes_ignore_header X-Junk-Score
5836 bayes_ignore_header X-Junkmail
5837 bayes_ignore_header X-Klms-Anti
5838 bayes_ignore_header X-KLMS-AntiPhishing
5839 bayes_ignore_header X-Klms-Antispam
5840 bayes_ignore_header X-KLMS-AntiSpam-Info
5841 bayes_ignore_header X-KLMS-AntiSpam-Interceptor-Info
5842 bayes_ignore_header X-KLMS-AntiSpam-Lua-Profiles
5843 bayes_ignore_header X-KLMS-AntiSpam-Method
5844 bayes_ignore_header X-KLMS-AntiSpam-Moebius-Timestamps
5845 bayes_ignore_header X-KLMS-AntiSpam-Rate
5846 bayes_ignore_header X-KLMS-AntiSpam-Status
5847 bayes_ignore_header X-KLMS-AntiSpam-Version
5848 bayes_ignore_header X-KLMS-AntiVirus
5849 bayes_ignore_header X-KLMS-AntiVirus-Status
5850 bayes_ignore_header X-KLMS-Message-Action
5851 bayes_ignore_header X-KLMS-Rule-ID
5852 bayes_ignore_header X-KMail-EncryptionState
5853 bayes_ignore_header X-KMail-MDN-Sent
5854 bayes_ignore_header X-KMail-SignatureState
5855 bayes_ignore_header X-Kse-Anti
5856 bayes_ignore_header X-Loom-IP
5857 bayes_ignore_header X-MailCleaner-SpamChec
5858 bayes_ignore_header X-MailCleaner-SpamCheck
5859 bayes_ignore_header X-MailFoundry
5860 bayes_ignore_header X-Mailman-Version
5861 bayes_ignore_header X-MDAV-Processed
5862 bayes_ignore_header X-MDMailLookup-Result
5863 bayes_ignore_header X-ME-Bayesian
5864 bayes_ignore_header X-ME-Content
5865 bayes_ignore_header X-MessageFilter
5866 bayes_ignore_header x-microsoft-antispam
5867 bayes_ignore_header X-Microsoft-Antispam-Message-Info
5868 bayes_ignore_header X-Microsoft-Antispam-Message-Info-Original
5869 bayes_ignore_header X-Microsoft-Antispam-Untrusted
5870 bayes_ignore_header X-Microsoft-Exchange-Diagnostics
5871 bayes_ignore_header X-Mlf-Version
5872 bayes_ignore_header X-Mozilla-Keys
5873 bayes_ignore_header X-Mozilla-Status
5874 bayes_ignore_header X-Mozilla-Status2
5875 bayes_ignore_header x-ms-exchange-antispam-messagedata
5876 bayes_ignore_header x-ms-exchange-antispam-messagedata-0
5877 bayes_ignore_header X-MS-Exchange-CrossTenant-AuthAs
5878 bayes_ignore_header X-MS-Exchange-CrossTenant-AuthSource
5879 bayes_ignore_header X-MS-Exchange-CrossTenant-FromEntityHeader
5880 bayes_ignore_header x-ms-exchange-crosstenant-id
5881 bayes_ignore_header x-ms-exchange-crosstenant-network-message-id
5882 bayes_ignore_header X-MS-Exchange-CrossTenant-OriginalArrivalTime
5883 bayes_ignore_header x-ms-exchange-crosstenant-rms-persistedconsumerorg
5884 bayes_ignore_header X-MS-Exchange-CrossTenant-userprincipalname
5885 bayes_ignore_header x-ms-exchange-slblob-mailprops
5886 bayes_ignore_header X-MS-Exchange-Transport-CrossTenantHeadersStamped
5887 bayes_ignore_header x-ms-office365-filtering-correlation-id
5888 bayes_ignore_header X-MS-TrafficTypeDiagnostic
5889 bayes_ignore_header X-MSFBL
5890 bayes_ignore_header X-MSMail-Priority
5891 bayes_ignore_header X-MXScan-AntiSpam
5892 bayes_ignore_header X-MXScan-AntiVirus
5893 bayes_ignore_header X-MXScan-Country-Sequence
5894 bayes_ignore_header X-MXScan-License
5895 bayes_ignore_header X-MXScan-Msgid
5896 bayes_ignore_header X-MXScan-ProcessingTime
5897 bayes_ignore_header X-MXScan-Scan
5898 bayes_ignore_header X-NAI-Spam-Flag
5899 bayes_ignore_header X-NAI-Spam-Rules
5900 bayes_ignore_header X-NAI-Spam-Score
5901 bayes_ignore_header X-NAI-Spam-Threshold
5902 bayes_ignore_header X-NetStation-Status
5903 bayes_ignore_header X-No-Relay
5904 bayes_ignore_header X-OriginatorOrg
5905 bayes_ignore_header X-OVH-SPAMCAUSE
5906 bayes_ignore_header X-OVH-SPAMCAUSE:
5907 bayes_ignore_header X-OVH-SPAMSCORE
5908 bayes_ignore_header X-OVH-SPAMSTATE
5909 bayes_ignore_header X-PerlMx-Spam
5910 bayes_ignore_header X-PerlMx-Virus-Scanned
5911 bayes_ignore_header X-PFSI-Info
5912 bayes_ignore_header X-PMX-Spam
5913 bayes_ignore_header X-PMX-Version
5914 bayes_ignore_header X-Policy-Service
5915 bayes_ignore_header X-policyd-weight
5916 bayes_ignore_header X-PreRBLs
5917 bayes_ignore_header X-Probable-Spam
5918 bayes_ignore_header X-PROLinux-SpamCheck
5919 bayes_ignore_header X-Proofpoint-Spam-Reason
5920 bayes_ignore_header X-Proofpoint-Virus-Version
5921 bayes_ignore_header X-Provags-ID
5922 bayes_ignore_header x-purgate-eavas: clean
5923 bayes_ignore_header x-purgate-id
5924 bayes_ignore_header x-purgate-size
5925 bayes_ignore_header x-purgate-type
5926 bayes_ignore_header X-Qmail-Scanner-Diagnostics
5927 bayes_ignore_header X-Qmail-Scanner-MOVED-X-Spam-Status
5928 bayes_ignore_header X-Quarantine-ID
5929 bayes_ignore_header X-Received
5930 bayes_ignore_header X-RSpam-Report
5931 bayes_ignore_header X-SA-Do-Not-Run
5932 bayes_ignore_header X-SA-Exim-Version
5933 bayes_ignore_header X-Scanned-by
5934 bayes_ignore_header X-ServerMaster-MailScanner
5935 bayes_ignore_header X-SG-EID
5936 bayes_ignore_header X-SG-ID
5937 bayes_ignore_header X-SmarterMail-CustomSpamHeader
5938 bayes_ignore_header X-Spam
5939 bayes_ignore_header X-Spam-Action
5940 bayes_ignore_header X-SPAM-AISP
5941 bayes_ignore_header X-Spam-Check-By
5942 bayes_ignore_header X-Spam-Checker-Version
5943 bayes_ignore_header X-Spam-CMAE-Analysis
5944 bayes_ignore_header X-Spam-CMAESCORE
5945 bayes_ignore_header X-Spam-CTCH-RefID
5946 bayes_ignore_header X-Spam-Flag
5947 bayes_ignore_header X-Spam-Level
5948 bayes_ignore_header X-Spam-Processed
5949 bayes_ignore_header X-Spam-Report
5950 bayes_ignore_header X-Spam-Scanned
5951 bayes_ignore_header X-Spam-Score
5952 bayes_ignore_header X-Spam-Score-Int
5953 bayes_ignore_header X-Spam-SmartLearn
5954 bayes_ignore_header X-Spam-Status
5955 bayes_ignore_header X-Spam-Threshold
5956 bayes_ignore_header X-Spam_bar
5957 bayes_ignore_header X-Spambayes-Classification
5958 bayes_ignore_header X-SpamExperts-Domain
5959 bayes_ignore_header X-SpamExperts-Outgoing-Class
5960 bayes_ignore_header X-SpamExperts-Outgoing-Evidence
5961 bayes_ignore_header X-SpamExperts-Username
5962 bayes_ignore_header X-Spamfilter-host
5963 bayes_ignore_header X-Spamina-Bogosity
5964 bayes_ignore_header X-Spamina-Spam-Report
5965 bayes_ignore_header X-Spamina-Spam-Score
5966 bayes_ignore_header X-SpamInfo
5967 bayes_ignore_header X-Spamsave
5968 bayes_ignore_header X-SpamTest-Group-ID
5969 bayes_ignore_header X-SpamTest-Info
5970 bayes_ignore_header X-SpamTest-Method
5971 bayes_ignore_header X-SpamTest-Rate
5972 bayes_ignore_header X-SpamTest-SPF
5973 bayes_ignore_header X-SpamTest-Status
5974 bayes_ignore_header X-SpamTest-Status-Extended
5975 bayes_ignore_header X-SPF-Scan-By
5976 bayes_ignore_header X-STA-Metric
5977 bayes_ignore_header X-STA-NotSpam
5978 bayes_ignore_header X-STA-Spam
5979 bayes_ignore_header X-StarScan-Version
5980 bayes_ignore_header X-SurGATE-Result
5981 bayes_ignore_header X-SWITCHham-Score
5982 bayes_ignore_header X-UI-Filterresults
5983 bayes_ignore_header X-UI-Loop
5984 bayes_ignore_header X-UI-Out-Filterresults
5985 bayes_ignore_header X-Univie-Spam-Checker-Version
5986 bayes_ignore_header X-Univie-Virus-Scan
5987 bayes_ignore_header X-Virus
5988 bayes_ignore_header X-Virus-Checker-Version
5989 bayes_ignore_header X-Virus-Scanned
5990 bayes_ignore_header X-Virus-Scanner-Result
5991 bayes_ignore_header X-Virus-Scanner-Version
5992 bayes_ignore_header X-Virus-Status
5993 bayes_ignore_header X-VirusChecked
5994 bayes_ignore_header X-VR-SCORE
5995 bayes_ignore_header X-VR-SPAMCAUSE
5996 bayes_ignore_header X-VR-STATUS
5997 bayes_ignore_header X-WatchGuard-Mail-Client-IP
5998 bayes_ignore_header X-WatchGuard-Mail-From
5999 bayes_ignore_header X-WatchGuard-Mail-Recipients
6000 bayes_ignore_header X-WatchGuard-Spam-ID
6001 bayes_ignore_header X-WatchGuard-Spam-Score
6002 bayes_ignore_header X-Whitelist-Domain
6003 bayes_ignore_header X-WUM-CCI
6004 bayes_ignore_header X_CMAE_Category
6005 ##} bayes_ignore_header_sandbox
6006
6007 ##{ if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS_sandbox
6008
6009 if (version >= 3.004001)
6010 ifplugin Mail::SpamAssassin::Plugin::AskDNS
6011 askdns     __FROM_FMBLA_NEWDOM    _AUTHORDOMAIN_.fresh.fmb.la. A /^127\.2\.0\.2$/
6012 askdns     __FROM_FMBLA_NEWDOM14  _AUTHORDOMAIN_.fresh.fmb.la. A /^127\.2\.0\.14$/
6013 askdns     __FROM_FMBLA_NEWDOM28  _AUTHORDOMAIN_.fresh.fmb.la. A /^127\.2\.0\.28$/
6014 askdns     __FROM_FMBLA_NDBLOCKED _AUTHORDOMAIN_.fresh.fmb.la. A /^127\.255\.255\.255$/
6015 reuse      FROM_FMBLA_NEWDOM
6016 reuse      FROM_FMBLA_NEWDOM14
6017 reuse      FROM_FMBLA_NEWDOM28
6018 reuse      FROM_FMBLA_NDBLOCKED
6019 reuse    __PDS_NEWDOMAIN
6020 reuse    FROM_NUMBERO_NEWDOMAIN
6021 reuse    FROM_NEWDOM_BTC
6022 askdns   __PDS_SPF_ONLYALL _SENDERDOMAIN_ TXT /^v=spf1 \+all$/
6023 reuse    BITCOIN_SPF_ONLYALL
6024 endif
6025 endif
6026 ##} if (version >= 3.004001) ifplugin Mail::SpamAssassin::Plugin::AskDNS_sandbox
6027
6028 ##{ if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval_sandbox
6029
6030 if (version >= 3.004002)
6031 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
6032 enlist_addrlist (PAYPAL) *@paypal.com *@paypal.co.uk *@paypal.de *@paypal.com.au *@paypal.it
6033 enlist_addrlist (PAYPAL) *@paypal.es *@paypal.fr *@paypal.de *@paypal.com.hk
6034 enlist_addrlist (PAYPAL) *@*.paypal.com *@*.paypal.co.uk
6035 reuse    __FROM_ADDRLIST_PAYPAL
6036 reuse    FROM_PAYPAL_SPOOF
6037 enlist_addrlist (BANKS) *@abbey.co.uk *@abbey.com *@abbeyinternational.com *@abbeyinternational.co.uk *@abbeynational.com *@abbeynational.co.uk
6038 enlist_addrlist (BANKS) *@allianceleicester.com *@allianceleicester.co.uk *@alliance-leicester.com *@alliance-leicester.co.uk
6039 enlist_addrlist (BANKS) *@bankofamerica.com *@bankofamerica.co.uk
6040 enlist_addrlist (BANKS) *@barclaycard.com *@barclays.com
6041 enlist_addrlist (BANKS) *@citibank.com
6042 enlist_addrlist (BANKS) *@firstdirect.com *@firstdirect.co.uk
6043 enlist_addrlist (BANKS) *@halifax.com *@halifax.co.uk *@halifax-online.co.uk *@halifax-online.com
6044 enlist_addrlist (BANKS) *@hbos.com *@hbos.co.uk
6045 enlist_addrlist (BANKS) *@hsbc.com *@hsbc.co.uk *@hsbc.hk *@hsbcgroup.com *@hsbcgroup.co.uk
6046 enlist_addrlist (BANKS) *@lloydstsb.com *@lloydstsb.co.uk *@lloyds.com
6047 enlist_addrlist (BANKS) *@mbna.com
6048 enlist_addrlist (BANKS) *@nationwide.com *@nationwide.co.uk
6049 enlist_addrlist (BANKS) *@natwest.com *@natwest.co.uk
6050 enlist_addrlist (BANKS) *@santander.com *@santander.co.uk
6051 enlist_addrlist (BANKS) *@standardbank.co.za
6052 enlist_addrlist (BANKS) *@ybonline.co.uk *@ybonline.com
6053 reuse    __FROM_ADDRLIST_BANKS
6054 reuse    FROM_BANK_NOAUTH
6055 enlist_addrlist (GOV) *@*.gov
6056 enlist_addrlist (GOV) *@*.gov.uk *@parliament.uk *@*.parliament.uk
6057 reuse    __FROM_ADDRLIST_GOV
6058 reuse    FROM_GOV_SPOOF
6059 reuse    FROM_GOV_DKIM_AU
6060 reuse    FROM_GOV_REPLYTO_FREEMAIL
6061 enlist_addrlist (SUSP_NTLD) *@*.icu
6062 enlist_addrlist (SUSP_NTLD) *@*.online
6063 enlist_addrlist (SUSP_NTLD) *@*.work
6064 enlist_addrlist (SUSP_NTLD) *@*.date
6065 enlist_addrlist (SUSP_NTLD) *@*.top
6066 enlist_addrlist (SUSP_NTLD) *@*.fun
6067 enlist_addrlist (SUSP_NTLD) *@*.life
6068 enlist_addrlist (SUSP_NTLD) *@*.review
6069 enlist_addrlist (SUSP_NTLD) *@*.bid
6070 enlist_addrlist (SUSP_NTLD) *@*.stream
6071 enlist_addrlist (SUSP_NTLD) *@*.gdn
6072 enlist_addrlist (SUSP_NTLD) *@*.click
6073 enlist_addrlist (SUSP_NTLD) *@*.world
6074 enlist_addrlist (SUSP_NTLD) *@*.fit
6075 enlist_addrlist (SUSP_NTLD) *@*.ooo
6076 enlist_addrlist (SUSP_NTLD) *@*.faith
6077 enlist_addrlist (SUSP_NTLD) *@*.buzz
6078 enlist_addrlist (SUSP_NTLD) *@*.trade
6079 enlist_addrlist (SUSP_NTLD) *@*.cyou
6080 enlist_addrlist (SUSP_NTLD) *@*.vip
6081 enlist_uri_host (SUSP_URI_NTLD) icu
6082 enlist_uri_host (SUSP_URI_NTLD) online
6083 enlist_uri_host (SUSP_URI_NTLD) work
6084 enlist_uri_host (SUSP_URI_NTLD) date
6085 enlist_uri_host (SUSP_URI_NTLD) top
6086 enlist_uri_host (SUSP_URI_NTLD) fun
6087 enlist_uri_host (SUSP_URI_NTLD) life
6088 enlist_uri_host (SUSP_URI_NTLD) review
6089 enlist_uri_host (SUSP_URI_NTLD) bid
6090 enlist_uri_host (SUSP_URI_NTLD) stream
6091 enlist_uri_host (SUSP_URI_NTLD) gdn
6092 enlist_uri_host (SUSP_URI_NTLD) click
6093 enlist_uri_host (SUSP_URI_NTLD) world
6094 enlist_uri_host (SUSP_URI_NTLD) fit
6095 enlist_uri_host (SUSP_URI_NTLD) ooo
6096 enlist_uri_host (SUSP_URI_NTLD) faith
6097 enlist_uri_host (SUSP_URI_NTLD) buzz
6098 enlist_uri_host (SUSP_URI_NTLD) trade
6099 enlist_uri_host (SUSP_URI_NTLD) cyou
6100 enlist_uri_host (SUSP_URI_NTLD) vip
6101 enlist_uri_host (SUSP_URI_NTLD_PRO) pro
6102 reuse    __FROM_ADDRLIST_SUSPNTLD
6103 reuse    __REPLYTO_ADDRLIST_SUSPNTLD
6104 reuse    FROM_SUSPICIOUS_NTLD
6105 reuse    GOOGLE_DRIVE_REPLY_BAD_NTLD
6106 reuse    VPS_NO_NTLD
6107 endif
6108 endif
6109 ##} if (version >= 3.004002) ifplugin Mail::SpamAssassin::Plugin::WLBLEval_sandbox
6110
6111 ##{ if (version >= 3.004003) ifplugin Mail::SpamAssassin::Plugin::HashBL_sandbox
6112
6113 if (version >= 3.004003)
6114   ifplugin Mail::SpamAssassin::Plugin::HashBL
6115     priority      GB_HASHBL_BTC -100
6116     reuse         GB_HASHBL_BTC
6117 endif
6118 endif
6119 ##} if (version >= 3.004003) ifplugin Mail::SpamAssassin::Plugin::HashBL_sandbox
6120
6121 ##{ if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ifplugin Mail::SpamAssassin::Plugin::ReplaceTags_sandbox
6122
6123 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
6124   ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
6125     replace_tag lcase_e (?:e|\xc3[\xa8\xa9\xaa\xab]|\xc4[\x93\x95\x97\x99\x9b]|\xc8[\x85\x87\x80]|\xcf\xb5|\xd0\xb5|\xd1[\x90\x91\x94\xb3]|\xd2[\xbc\xbd\xbe\xbf]|\xd3[\x07\xa9\xab])
6126     replace_rules   __E_LIKE_LETTER
6127 endif
6128 endif
6129 ##} if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ifplugin Mail::SpamAssassin::Plugin::ReplaceTags_sandbox
6130
6131 ##{ ifplugin Mail::SpamAssassin::Plugin::AskDNS_sandbox
6132
6133 ifplugin Mail::SpamAssassin::Plugin::AskDNS
6134 askdns    __DKIMWL_FREEMAIL _DKIMDOMAIN_.lookup.dkimwl.org A /^127\.\d+\.3\.\d+$/
6135 reuse     __DKIMWL_FREEMAIL
6136 askdns    __DKIMWL_BULKMAIL _DKIMDOMAIN_.lookup.dkimwl.org A /^127\.\d+\.2\.\d+$/
6137 reuse     __DKIMWL_BULKMAIL
6138 askdns    __DKIMWL_WL_HI    _DKIMDOMAIN_.lookup.dkimwl.org A /^127\.\d+\.\d+\.5$/
6139 reuse     __DKIMWL_WL_HI
6140 askdns    __DKIMWL_WL_MEDHI _DKIMDOMAIN_.lookup.dkimwl.org A /^127\.\d+\.\d+\.4$/
6141 reuse     __DKIMWL_WL_MEDHI
6142 askdns    __DKIMWL_WL_MED   _DKIMDOMAIN_.lookup.dkimwl.org A /^127\.\d+\.\d+\.3$/
6143 reuse     __DKIMWL_WL_MED
6144 askdns    __DKIMWL_WL_BL   _DKIMDOMAIN_.lookup.dkimwl.org A /^127\.\d+\.\d+\.0$/
6145 reuse     __DKIMWL_WL_BL
6146 askdns    __DKIMWL_BLOCKED  _DKIMDOMAIN_.lookup.dkimwl.org A /^127\.255\.255\.255$/
6147 reuse     __DKIMWL_BLOCKED
6148 reuse     DKIMWL_WL_HIGH
6149 reuse     DKIMWL_WL_MEDHI
6150 reuse     DKIMWL_WL_MED
6151 reuse     DKIMWL_BL
6152 reuse     DKIMWL_BLOCKED
6153 askdns   __HELO_DNS _LASTEXTERNALHELO_ A /./
6154 endif
6155 ##} ifplugin Mail::SpamAssassin::Plugin::AskDNS_sandbox
6156
6157 ##{ ifplugin Mail::SpamAssassin::Plugin::DNSEval # {_sandbox
6158
6159 ifplugin Mail::SpamAssassin::Plugin::DNSEval # {
6160 reuse    RCVD_IN_PSBL
6161 endif
6162 ##} ifplugin Mail::SpamAssassin::Plugin::DNSEval # {_sandbox
6163
6164 ##{ ifplugin Mail::SpamAssassin::Plugin::DNSEval_sandbox
6165
6166 ifplugin Mail::SpamAssassin::Plugin::DNSEval
6167 reuse  RCVD_IN_IADB_LISTED
6168 reuse  RCVD_IN_IADB_EDDB
6169 reuse  RCVD_IN_IADB_EPIA
6170 reuse  RCVD_IN_IADB_SPF
6171 reuse  RCVD_IN_IADB_SENDERID
6172 reuse  RCVD_IN_IADB_DK
6173 reuse  RCVD_IN_IADB_RDNS
6174 reuse  RCVD_IN_IADB_GOODMAIL
6175 reuse  RCVD_IN_IADB_NOCONTROL
6176 reuse  RCVD_IN_IADB_OPTOUTONLY
6177 reuse  RCVD_IN_IADB_UNVERIFIED_1
6178 reuse  RCVD_IN_IADB_UNVERIFIED_2
6179 reuse  RCVD_IN_IADB_LOOSE
6180 reuse  RCVD_IN_IADB_OPTIN_LT50
6181 reuse  RCVD_IN_IADB_OPTIN_GT50
6182 reuse  RCVD_IN_IADB_OPTIN
6183 reuse  RCVD_IN_IADB_DOPTIN_LT50
6184 reuse  RCVD_IN_IADB_DOPTIN_GT50
6185 reuse  RCVD_IN_IADB_DOPTIN
6186 reuse  RCVD_IN_IADB_ML_DOPTIN
6187 reuse  RCVD_IN_IADB_OOO
6188 reuse  RCVD_IN_IADB_MI_CPEAR
6189 reuse  RCVD_IN_IADB_UT_CPEAR
6190 reuse  RCVD_IN_IADB_MI_CPR_30
6191 reuse  RCVD_IN_IADB_UT_CPR_30
6192 reuse  RCVD_IN_IADB_MI_CPR_MAT
6193 reuse  RCVD_IN_IADB_UT_CPR_MAT
6194 endif
6195 ##} ifplugin Mail::SpamAssassin::Plugin::DNSEval_sandbox
6196
6197 ##{ ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof_sandbox
6198
6199 ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
6200 fns_ignore_dkim linkedin.com googlegroups.com yahoogroups.com yahoogroups.de
6201 fns_ignore_headers List-Id
6202 fns_check 1
6203 reuse    __PLUGIN_FROMNAME_SPOOF
6204 reuse    __PLUGIN_FROMNAME_EQUALS_TO
6205 endif
6206 ##} ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof_sandbox
6207
6208 ##{ ifplugin Mail::SpamAssassin::Plugin::ReplaceTags_sandbox
6209
6210 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
6211 replace_rules T_FUZZY_SPRM
6212 replace_rules FUZZY_MERIDIA
6213 replace_rules TVD_FUZZY_PHARMACEUTICAL
6214 replace_rules TVD_FUZZY_SYMBOL
6215 replace_rules T_TVD_FUZZY_SECURITIES
6216 replace_rules TVD_FUZZY_FINANCE
6217 replace_rules TVD_FUZZY_FIXED_RATE
6218 replace_rules TVD_FUZZY_MICROCAP
6219 replace_rules T_TVD_FUZZY_SECTOR
6220 replace_rules TVD_FUZZY_DEGREE
6221   replace_rules __COPY_PASTE_EN
6222   replace_tag FF_LNNO   (?:(?:\d{1,3}(?:[)}\]:.,]{1,80}|(?:st|nd|rd|th)[)}\]:.,]{0,3})|\W?\([\div]{1,5}\)|\W?\{\d{1,3}\}|\[\d{1,3}\]|\*{1,5}|\#{1,5}|\(?[A-K][)}\]:.,]{1,3})\s?)
6223   replace_tag FF_YOUR   (?:a?\s?copy\sof\s)?(?:(?:your|din|seu|twoje)[\s,:]{1,5})?(?:present\s|c[uo]rrent\s|full(?:st[\xe4]ndigt)?\s?|complete\s|direct\s|private?\s|valid\s|personal\s|nuvarande\s|vollst[\xe4]ndige\s|aktuelle\s|pe\s(?:ne\s)?){0,3}
6224   replace_tag ANDOR     (?:\s?[\/&+,]\s?|\sor\s|\sand?\s)
6225   replace_tag NUMBER    (?:(?:ruf)?num(?:[bm]er)?\(?s?\)?|nos?\.|no\b|n[\xb0]|\#s?|nbrs?\.?)
6226   replace_tag FF_SUFFIX (?:\sin\s(?:full|words)|\scompleto)?:?(?:\s?[({][^)}]{1,30}[)}])?
6227   replace_tag FF_BLANK1 (?:[\s:;]{0,4}(?:(?:[-=_.,:;*\s\x85]|&\#\d{1,3};|[\xe2][\x80][\xa6]){3,100}))
6228   replace_tag FF_BLANK2 (?:[^-=_.,:;*\w]{0,3}(?:[-=_.,:;*\s\x85]|&\#\d{1,3};|[\xe2][\x80][\xa6]){1,100})
6229   replace_tag FF_A1 (?:(?:countr?y|city|province|ter+itory|(?:zip|post(?:al)?)(?:\s?code)?|st?ates?|ad+res+e?)<ANDOR>?){1,3}(?:\sof\s(?:residence|birth|employment|citizenship|origin))?
6230   replace_tag FF_A2 (?:(?:contact|full|house|home|resident[ia]+l|busines+|mailing|work|delivery|ship+ing|post(?:al)?|of+ice|e-?mail|bostads|wohn)<ANDOR>?){0,3}\s?(?:ad+res+[es]{0,2}|location|endere[\xe7]o)(?:\sline)?(?:\s[0-9])?
6231   replace_tag FF_N1 (?:company|first|last|all|busines+|legal|ben[ei]ficiary|user|vollstaendigen)?\s?(?:name?[sn]?|navne|nome|nazwy)(?:<ANDOR>ad+res+)?
6232   replace_tag FF_P1 (?:(?:(?:busines+|contact|fax|voice|house|home|mobile?|cel+(?:ular)?|of+ice|tel+e?(?:\s?(?:ph|f)one?)?|(?:ph|f)one|private)(?:\s(?:ph|f)one)?<ANDOR>?){1,3}(?:\s?<NUMBER>)?<ANDOR>?){1,3}
6233   replace_tag FF_M1 (?:(?:ages?|marital\s?statu[se]|sex|gender|male\sor\sfemale|(?:date\s(?:of\s)?)?birth|religion|nationality|(?:user )?email|next\sof\skin|alter|staatsangehoerigkeit|nationalitet|idade|weik)<ANDOR>?){1,3}
6234   replace_tag FF_L1 (?:(?:previous\s)?work(?:ing)\s?experience|employment|position|profes+ion|(?:monthly|an+ual)?\s?income|purpose\sof\sl(?:oa|ao)n|an+ual\sturn\s?over|l(?:oa|ao)n\sduration|oc+up[ae]tion(?:\/position)?s?|(?:l(?:oa|ao)n\s|the\s)?amount(?:\sneed(ed)?|\sdesired)?(?:\s(?:as|of)\sloan)?|beruf|zaw(?:=F3|[\xf3])d)
6235   replace_tag FF_F1 (?:(?:bank(?:ing)?|beneficiary|billing|acc(?:oun)?t|rout(?:ing)?|swift|receiver|user)<ANDOR>?){1,3}\s(?:(?:name|ad+res+(?:es)?|location|code|details|institution|a\/c|<NUMBER>)<ANDOR>?){1,3}
6236   replace_tag FF_F2 (?:(?:(?:international\s)?driver'?s?\sli[sc]+(?:en[sc]e)?|pas+\s?port|id\scard|[ia]d(?:entification|entity)(?:\s(?:card|<NUMBER>|papers?))?)<ANDOR>?){1,3}(?:\s<NUMBER>)?
6237   replace_tag FF_F3 (?:picture|zdj\scie|test\squestion|answer|amount\swon|(?:inheritance\s)?funds?\svalue|(?:e-?mail\s)?pas+word|e-?mai?l\sid|amount\s[\w\s]{0,30}lost[\w\s]{0,15})
6238   replace_tag FF_F4 (?:log[-\s]?in|(?:e-?mail\s)?user)\s?names?
6239   replace_tag FF_F5 (?:ref(?:erence)?|batch|win+ing|award|billet)[-\s]?<NUMBER>
6240   replace_tag FF_ALL (?:<FF_A1>|<FF_A2>|<FF_N1>|<FF_P1>|<FF_M1>|<FF_F1>|<FF_F2>|<FF_F3>|<FF_F4>|<FF_F5>|<FF_L1>)
6241   replace_rules   __FILL_THIS_FORM_LONG1
6242   replace_rules   __FILL_THIS_FORM_LONG2
6243   replace_rules   __FILL_THIS_FORM_PARTIAL
6244   replace_rules   __FILL_THIS_FORM_PARTIAL_RAW
6245   replace_rules   __FILL_THIS_FORM_SHORT1
6246   replace_rules   __FILL_THIS_FORM_SHORT2
6247   replace_rules   __FILL_THIS_FORM_LOAN1
6248   replace_rules   __FILL_THIS_FORM_FRAUD_PHISH1
6249   replace_tag  CURRENCY   (?:[\(\[]?(?:\bU[Ss][D\$]{0,2}|\$(?:US)?|usd|USD|CAD|GBP|=[Aa][34]|\xa3|&\#16[34];|(?i:pounds\ssterling)|\xa4|EUR(?:OS?)?|(?:d')?[Ee]uro?s?|(?i:eur)\sde|CHF|FCFA|d[\xf3]lares\sde\slos\sE+\.\s?U+\.)[\]\)]?)
6250   replace_tag  GB_UK      \b(?:U\.?K\.?|(?:Great\s)?Brit(?:ain|ish)|G\.?B\.?)\b
6251   replace_tag  NUM_NOT_DATE       [1-9](?!\d\d\d\.\d\d\.\d\d\s)(?!\d?\.\d\d?\.\d\d\d\d\s)
6252   replace_tag  NUM_NOT_DATE_IP    <NUM_NOT_DATE>(?!\d{0,2}(?:\.0|\.[1-2]\d{0,2}){3}(?:\D|$))
6253   replace_rules   __LOTSA_MONEY_00 __LOTSA_MONEY_01 __LOTSA_MONEY_02 __LOTSA_MONEY_03 __LOTSA_MONEY_04
6254   replace_tag  PERCENT      \b(?:\d\d|ten|[a-z]+teen|(?:twen|thir|fou?r|fif)ty(?:-?[a-z]+)?)\s?(?:%|percent)
6255   replace_rules  __PCT_FOR_YOU_1 __PCT_FOR_YOU_2 __PCT_FOR_YOU_3 __PCT_OF_PMTS
6256   replace_rules  T_FUZZY_OPTOUT
6257         replace_rules                  __FRT_PRICE
6258   replace_rules FUZZY_UNSUBSCRIBE
6259   replace_rules FUZZY_ANDROID
6260   replace_rules FUZZY_PROMOTION
6261   replace_rules FUZZY_PRIVACY
6262   replace_rules FUZZY_BROWSER
6263   replace_rules FUZZY_SAVINGS
6264   replace_rules FUZZY_IMPORTANT
6265   replace_rules FUZZY_SECURITY
6266   replace_rules __FUZZY_DR_OZ
6267   replace_rules FUZZY_CLICK_HERE
6268   replace_rules FUZZY_BITCOIN
6269   replace_rules __BITCOIN
6270   replace_rules FUZZY_WALLET
6271   replace_rules __FUZZY_MONERO
6272   replace_rules __FUZZY_WELLSFARGO_BODY
6273   replace_rules __FUZZY_WELLSFARGO_FROM
6274   replace_rules __FUZZY_PORN
6275   replace_rules FUZZY_AMAZON
6276   replace_rules FUZZY_APPLE
6277   replace_rules FUZZY_MICROSOFT
6278   replace_rules FUZZY_FACEBOOK
6279   replace_rules FUZZY_PAYPAL
6280   replace_rules FUZZY_NORTON
6281   replace_rules FUZZY_OVERSTOCK
6282   replace_rules  __MY_VICTIM
6283   replace_rules  __MY_MALWARE
6284   replace_rules  __PAY_ME
6285   replace_rules  __YOUR_PASSWORD
6286   replace_rules  __YOUR_WEBCAM
6287   replace_rules  __YOUR_ONAN
6288   replace_rules  __YOUR_PERSONAL
6289   replace_rules  __HOURS_DEADLINE
6290   replace_rules  __EXPLOSIVE_DEVICE
6291 replace_rules T_LFUZ_PWRMALE
6292   replace_rules   __PDS_BTC_HACKER __PDS_BTC_PIRATE
6293   reuse    T_PDS_BTC_AHACKER
6294   reuse    T_PDS_BTC_HACKER
6295   reuse    T_PDS_LTC_AHACKER
6296   reuse    T_PDS_LTC_HACKER
6297 endif
6298 ##} ifplugin Mail::SpamAssassin::Plugin::ReplaceTags_sandbox
6299
6300 ##{ ifplugin Mail::SpamAssassin::Plugin::URIDNSBL_sandbox
6301
6302 ifplugin Mail::SpamAssassin::Plugin::URIDNSBL
6303 reuse URIBL_RHS_DOB
6304 endif
6305 ##} ifplugin Mail::SpamAssassin::Plugin::URIDNSBL_sandbox
6306
6307 ##{ ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)_sandbox
6308
6309 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
6310 if (version >= 3.004000)
6311 enlist_uri_host (PDS_CASHSHORTENER) cutpaid.com
6312 enlist_uri_host (PDS_CASHSHORTENER) caat.site
6313 enlist_uri_host (PDS_CASHSHORTENER) triabicia.com
6314 enlist_uri_host (PDS_CASHSHORTENER) 2xs.io
6315 enlist_uri_host (PDS_CASHSHORTENER) ocest.site
6316 enlist_uri_host (PDS_CASHSHORTENER) spiin.xyz
6317 enlist_uri_host (PDS_CASHSHORTENER) waar.site
6318 enlist_uri_host (PDS_CASHSHORTENER) cpmlink.net
6319 enlist_uri_host (PDS_CASHSHORTENER) cowner.net
6320 enlist_uri_host (PDS_CASHSHORTENER) adfoc.us
6321 enlist_uri_host (PDS_CASHSHORTENER) shrinkhere.xyz
6322 enlist_uri_host (PDS_CASHSHORTENER) gurl.pw
6323 enlist_uri_host (PDS_CASHSHORTENER) shortearn.eu
6324 enlist_uri_host (PDS_CASHSHORTENER) spiin.xyz
6325 enlist_uri_host (PDS_CASHSHORTENER) libittarc.com
6326 enlist_uri_host (PDS_CASHSHORTENER) pc.cd
6327 enlist_uri_host (PDS_CASHSHORTENER) fc.lc
6328 enlist_uri_host (PDS_CASHSHORTENER) dares.xyz
6329 enlist_uri_host (PDS_CASHSHORTENER) trendlouds.com
6330 enlist_uri_host (PDS_CASHSHORTENER) yogaf.xyz
6331 enlist_uri_host (PDS_CASHSHORTENER) cobs.xyz
6332 enlist_uri_host (PDS_CASHSHORTENER) olnew.xyz
6333 enlist_uri_host (PDS_CASHSHORTENER) cleft.xyz
6334 enlist_uri_host (PDS_CASHSHORTENER) 7r6.com
6335 enlist_uri_host (PDS_CASHSHORTENER) mitly.us
6336 enlist_uri_host (PDS_CASHSHORTENER) kutpay.com
6337 enlist_uri_host (PDS_CASHSHORTENER) gsurl.me
6338 enlist_uri_host (PDS_CASHSHORTENER) gurl.ly
6339 enlist_uri_host (PDS_CASHSHORTENER) gsurl.in
6340 enlist_uri_host (PDS_CASHSHORTENER) acitoate.com
6341 enlist_uri_host (PDS_CASHSHORTENER) aclabink.com
6342 enlist_uri_host (PDS_CASHSHORTENER) activeation.com
6343 enlist_uri_host (PDS_CASHSHORTENER) activeterium.com
6344 enlist_uri_host (PDS_CASHSHORTENER) adflyforum.com
6345 enlist_uri_host (PDS_CASHSHORTENER) adflymail.com
6346 enlist_uri_host (PDS_CASHSHORTENER) adult.xyz
6347 enlist_uri_host (PDS_CASHSHORTENER) agileurbia.com
6348 enlist_uri_host (PDS_CASHSHORTENER) atomcurve.com
6349 enlist_uri_host (PDS_CASHSHORTENER) ay.gy
6350 enlist_uri_host (PDS_CASHSHORTENER) battleate.com
6351 enlist_uri_host (PDS_CASHSHORTENER) biastonu.com
6352 enlist_uri_host (PDS_CASHSHORTENER) bitigee.com
6353 enlist_uri_host (PDS_CASHSHORTENER) briskrange.com
6354 enlist_uri_host (PDS_CASHSHORTENER) brisktopia.com
6355 enlist_uri_host (PDS_CASHSHORTENER) casualient.com
6356 enlist_uri_host (PDS_CASHSHORTENER) clesolea.com
6357 enlist_uri_host (PDS_CASHSHORTENER) code404.biz
6358 enlist_uri_host (PDS_CASHSHORTENER) coginator.com
6359 enlist_uri_host (PDS_CASHSHORTENER) cogismith.com
6360 enlist_uri_host (PDS_CASHSHORTENER) covelign.com
6361 enlist_uri_host (PDS_CASHSHORTENER) crefranek.com
6362 enlist_uri_host (PDS_CASHSHORTENER) dashsphere.com
6363 enlist_uri_host (PDS_CASHSHORTENER) dataurbia.com
6364 enlist_uri_host (PDS_CASHSHORTENER) deciomm.com
6365 enlist_uri_host (PDS_CASHSHORTENER) ducolomal.com
6366 enlist_uri_host (PDS_CASHSHORTENER) east-jones.com
6367 enlist_uri_host (PDS_CASHSHORTENER) ecleneue.com
6368 enlist_uri_host (PDS_CASHSHORTENER) ellevolaw.com
6369 enlist_uri_host (PDS_CASHSHORTENER) endroudo.com
6370 enlist_uri_host (PDS_CASHSHORTENER) eunsetee.com
6371 enlist_uri_host (PDS_CASHSHORTENER) fainbory.com
6372 enlist_uri_host (PDS_CASHSHORTENER) fasttory.com
6373 enlist_uri_host (PDS_CASHSHORTENER) fawright.com
6374 enlist_uri_host (PDS_CASHSHORTENER) flyserve.co
6375 enlist_uri_host (PDS_CASHSHORTENER) greponozy.com
6376 enlist_uri_host (PDS_CASHSHORTENER) homoluath.com
6377 enlist_uri_host (PDS_CASHSHORTENER) hopigrarn.com
6378 enlist_uri_host (PDS_CASHSHORTENER) infopade.com
6379 enlist_uri_host (PDS_CASHSHORTENER) j.gs
6380 enlist_uri_host (PDS_CASHSHORTENER) kaitect.com
6381 enlist_uri_host (PDS_CASHSHORTENER) kializer.com
6382 enlist_uri_host (PDS_CASHSHORTENER) kibuilder.com
6383 enlist_uri_host (PDS_CASHSHORTENER) kimechanic.com
6384 enlist_uri_host (PDS_CASHSHORTENER) kudoflow.com
6385 enlist_uri_host (PDS_CASHSHORTENER) legeerook.com
6386 enlist_uri_host (PDS_CASHSHORTENER) libittarc.com
6387 enlist_uri_host (PDS_CASHSHORTENER) linkjaunt.com
6388 enlist_uri_host (PDS_CASHSHORTENER) locinealy.com
6389 enlist_uri_host (PDS_CASHSHORTENER) maetrimal.com
6390 enlist_uri_host (PDS_CASHSHORTENER) metastead.com
6391 enlist_uri_host (PDS_CASHSHORTENER) mmoity.com
6392 enlist_uri_host (PDS_CASHSHORTENER) mondoagram.com
6393 enlist_uri_host (PDS_CASHSHORTENER) neswery.com
6394 enlist_uri_host (PDS_CASHSHORTENER) nimbleinity.com
6395 enlist_uri_host (PDS_CASHSHORTENER) onisedeo.com
6396 enlist_uri_host (PDS_CASHSHORTENER) optitopt.com
6397 enlist_uri_host (PDS_CASHSHORTENER) picocurl.com
6398 enlist_uri_host (PDS_CASHSHORTENER) pladollmo.com
6399 enlist_uri_host (PDS_CASHSHORTENER) preofery.com
6400 enlist_uri_host (PDS_CASHSHORTENER) prereheus.com
6401 enlist_uri_host (PDS_CASHSHORTENER) q.gs
6402 enlist_uri_host (PDS_CASHSHORTENER) quainator.com
6403 enlist_uri_host (PDS_CASHSHORTENER) quamiller.com
6404 enlist_uri_host (PDS_CASHSHORTENER) queuecosm.bid
6405 enlist_uri_host (PDS_CASHSHORTENER) raboninco.com
6406 enlist_uri_host (PDS_CASHSHORTENER) rapidteria.com
6407 enlist_uri_host (PDS_CASHSHORTENER) rapidtory.com
6408 enlist_uri_host (PDS_CASHSHORTENER) sapolatsu.com
6409 enlist_uri_host (PDS_CASHSHORTENER) scapognel.com
6410 enlist_uri_host (PDS_CASHSHORTENER) simizer.com
6411 enlist_uri_host (PDS_CASHSHORTENER) skamaker.com
6412 enlist_uri_host (PDS_CASHSHORTENER) skamason.com
6413 enlist_uri_host (PDS_CASHSHORTENER) sluppend.com
6414 enlist_uri_host (PDS_CASHSHORTENER) sprysphere.com
6415 enlist_uri_host (PDS_CASHSHORTENER) streamvoyage.com
6416 enlist_uri_host (PDS_CASHSHORTENER) swarife.com
6417 enlist_uri_host (PDS_CASHSHORTENER) swiftation.com
6418 enlist_uri_host (PDS_CASHSHORTENER) swifttopia.com
6419 enlist_uri_host (PDS_CASHSHORTENER) techigo.com
6420 enlist_uri_host (PDS_CASHSHORTENER) threadsphere.bid
6421 enlist_uri_host (PDS_CASHSHORTENER) tinyical.com
6422 enlist_uri_host (PDS_CASHSHORTENER) tonancos.com
6423 enlist_uri_host (PDS_CASHSHORTENER) triabicia.com
6424 enlist_uri_host (PDS_CASHSHORTENER) turboagram.com
6425 enlist_uri_host (PDS_CASHSHORTENER) twineer.com
6426 enlist_uri_host (PDS_CASHSHORTENER) twiriock.com
6427 enlist_uri_host (PDS_CASHSHORTENER) userlab66.com
6428 enlist_uri_host (PDS_CASHSHORTENER) vaugette.com
6429 enlist_uri_host (PDS_CASHSHORTENER) velocicosm.com
6430 enlist_uri_host (PDS_CASHSHORTENER) velociterium.com
6431 enlist_uri_host (PDS_CASHSHORTENER) viahold.com
6432 enlist_uri_host (PDS_CASHSHORTENER) vializer.com
6433 enlist_uri_host (PDS_CASHSHORTENER) viwright.com
6434 enlist_uri_host (PDS_CASHSHORTENER) whareotiv.com
6435 enlist_uri_host (PDS_CASHSHORTENER) wirecellar.com
6436 enlist_uri_host (PDS_CASHSHORTENER) x19.biz
6437 enlist_uri_host (PDS_CASHSHORTENER) x19network.com
6438 enlist_uri_host (PDS_CASHSHORTENER) yabuilder.com
6439 enlist_uri_host (PDS_CASHSHORTENER) yamechanic.com
6440 enlist_uri_host (PDS_CASHSHORTENER) yoalizer.com
6441 enlist_uri_host (PDS_CASHSHORTENER) yobuilder.com
6442 enlist_uri_host (PDS_CASHSHORTENER) yoineer.com
6443 enlist_uri_host (PDS_CASHSHORTENER) yoitect.com
6444 enlist_uri_host (PDS_CASHSHORTENER) zipansion.com
6445 enlist_uri_host (PDS_CASHSHORTENER) zipteria.com
6446 enlist_uri_host (PDS_CASHSHORTENER) zipvale.com
6447 reuse    T_PDS_SHORTFWD_URISHRT
6448 endif
6449 endif
6450 ##} ifplugin Mail::SpamAssassin::Plugin::WLBLEval if (version >= 3.004000)_sandbox
6451
6452 ##{ redirector_pattern_sandbox
6453
6454 redirector_pattern m'/(?:index.php)?\?.*(?<=[?&])URL=(.*?)(?:$|[&\#])'i
6455 redirector_pattern m'^https?:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/url\?.*?(?<=[?&])q=(.*?)(?:$|[&\#])'i
6456 redirector_pattern m'^https?:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/search\?.*?(?<=[?&])q=[^&]*?(?<=%20|..[=+\s])(?:site|inurl):(.*?)(?:$|%20|[\s+&\#])'i
6457 redirector_pattern m'^https?:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/search\?.*?(?<=[?&])q=[^&]*?(?<=%20|..[=+\s])(?:"|%22)(.*?)(?:$|%22|["\s+&\#])'i
6458 redirector_pattern m'^https?:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/translate\?.*?(?<=[?&])u=(.*?)(?:$|[&\#])'i
6459 redirector_pattern m'^https?:/*(?:\w+\.)?google(?:\.\w{2,3}){1,2}/pagead/iclk\?.*?(?<=[?&])adurl=(.*?)(?:$|[&\#])'i
6460 redirector_pattern m'^https?:/*(?:\w+\.)?aol\.com/redir\.adp\?.*(?<=[?&])_url=(.*?)(?:$|[&\#])'i
6461 redirector_pattern m'^https?/*(?:\w+\.)?facebook\.com/l/;(.*)'i
6462 ##} redirector_pattern_sandbox
6463
6464 ##{ reuse_sandbox
6465
6466 reuse    T_PDS_HIDDEN_UK_BUSINESSLOAN
6467 reuse    T_PDS_DOUBLE_URL
6468 reuse    T_PDS_DBL_URL_LINKBAIT
6469 reuse    PDS_DBL_URL_TNB_RUNON
6470 reuse    T_PDS_DBL_URL_ILLEGAL_CHARS
6471 reuse    T_FROM_2_EMAILS_SHORT
6472 reuse    T_SHORT_BODY_QUOTE
6473 reuse    T_BODY_QUOTE_MALF_MSGID
6474 reuse    SPOOFED_FREEMAIL_NO_RDNS
6475 reuse    T_PDS_URI_HIDDEN_HELO_NO_DOMAIN
6476 reuse    T_PDS_TONAME_EQ_TOLOCAL_HDRS_LCASE
6477 reuse    T_PDS_TONAME_EQ_TOLOCAL_SHORT
6478 reuse    PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE
6479 reuse    PDS_TONAME_EQ_TOLOCAL_VSHORT
6480 reuse    T_PDS_LITECOIN_ID
6481 reuse    PDS_BTC_ID
6482 reuse    PDS_BTC_MSGID
6483 reuse  __PDS_GOOGLE_DRIVE_SHARE_1
6484 reuse  __PDS_GOOGLE_DRIVE_SHARE_2
6485 reuse  __PDS_GOOGLE_DRIVE_SHARE_3
6486 reuse    __PDS_GOOGLE_DRIVE_SHARE
6487 reuse    T_GOOGLE_DRIVE_DEAR_SOMETHING
6488 reuse    __PDS_GOOGLE_DRIVE_FILE
6489 reuse    __SHORT_BODY_G_DRIVE
6490 reuse    __SHORT_BODY_G_DRIVE_DYN
6491 reuse    T_SHORT_BODY_G_DRIVE_DYN
6492 reuse    T_FROM_NAME_EQ_TO_G_DRIVE
6493 ##} reuse_sandbox
6494
6495
6496 uri         __128_ALNUM_URI     m;[/?][0-9a-z]{128,}$;i
6497
6498 uri         __128_HEX_URI     m,/[0-9a-f]{128},
6499
6500 uri         __128_LC_URI        m;[/?][a-z]{128,}$;
6501
6502 uri         __45_ALNUM_IMG      m;/[0-9a-z]{45,}/\w+\.(?:png|gif|jpe?g)$;i
6503
6504 uri         __45_ALNUM_URI      m;[/?][0-9a-z]{45,}$;i
6505
6506 meta        __45_ALNUM_URI_O    __45_ALNUM_URI && !__64_ANY_URI && !__128_ALNUM_URI && !__128_LC_URI
6507
6508 header     __4BYTE_UTF8_WORD_SUBJ      Subject =~ /(?:\xf0\x9d[\x90-\x9f][\x80-\xbf]){3,10}/
6509
6510 uri         __64_ANY_URI        m;[/?]\w{64,}$;i
6511
6512 body        __ACCESS_RESTORE     /\bto (?:(?:restore|regain) access|(?:remove|uplift) (?:the|this) suspens|continue using your (?:account|online|mailbox)|zugreifen wiederhergestellt)/i
6513
6514 body        __ACCESS_REVOKE      /(?:(?:temporary|permanent) (?:de-?activation|removal) of your (?:\w{1,30} )?(?:access|account)|Ihre Kreditkarte wird gesperrt)/i
6515
6516 body        __ACCESS_SUSPENDED   /\b(?:(?:access|account|e?-?mails) (?:suspension|(?:has|have) (?:been )?(?:temporar(?:il)?y (?:been )?)?(?:suspended|blocked|locked|blacklisted))|suspend (?:you from|your) access(?:ing)?|suspen(?:sion|se|ded) noti(?:ce|fication))\b/i
6517 tflags      __ACCESS_SUSPENDED   multiple maxhits=2
6518
6519 body        __ACCOUNT_DISRUPT    /\b(?:ensure (?:that )?your (?:account|access) is not (?:disrupted|suspended|interrupted)|(?:avoid|incoming) (?:[a-z]+ ){0,5}e?-?mails? (?:from )?being rejected|avoid (?:account|e?-?mail(?: ?box)? )?(?:shut ?down|suspension|locking|termination|expiration)|will terminate (?:your|its) service)\b/i
6520 tflags      __ACCOUNT_DISRUPT    multiple maxhits=2
6521
6522 body        __ACCOUNT_ERROR      /\b(?:your account (?:is|appears to be) (?:incorrect|missing|in error|invalid))\b/i
6523
6524 body        __ACCOUNT_REACTIV    /(?:(?:account|access) (?:has been )?(?:successfully )?(?:reviewed and )?re-?(?:activat(?:ion|ed)|new(?:al|ed))|(?:unlock|re-?activate|restore|recover) (?:your|the|this) (?:account|access))/i
6525
6526 body        __ACCOUNT_SECURE     /\b(?:make your (?:"?[^\@\s]+\@\S+"? |e-?mail )?account more secure|Ihre Kreditkarte weist einige Sicherheitsprobleme)\b/i
6527
6528 body        __ACCOUNT_UPGRADE    /\b(?:upgrade (?:of )your (?:account|access)|your (?:access|account) is[\w\s]{0,40}being upgraded|Weiter zur Aktualisierung)\b/i
6529
6530 meta        __ACCT_PHISH         (__ACCESS_SUSPENDED + __ACCESS_RESTORE + __ACCESS_REVOKE + __VERIFY_ACCOUNT + __FAILED_LOGINS + __ACCOUNT_REACTIV + __SECURITY_DEPT + __ACCOUNT_ERROR + __ACCOUNT_DISRUPT + __ACCOUNT_UPGRADE + __ACCOUNT_SECURE + __SUSPICION_LOGIN + __PDS_FROM_NAME_TO_DOMAIN) > 1 && !__ACCT_PHISH_MANY
6531
6532 meta        __ACCT_PHISH_MANY    (__ACCESS_SUSPENDED + __ACCESS_RESTORE + __ACCESS_REVOKE + __VERIFY_ACCOUNT + __FAILED_LOGINS + __ACCOUNT_REACTIV + __SECURITY_DEPT + __ACCOUNT_ERROR + __ACCOUNT_DISRUPT + __ACCOUNT_UPGRADE + __ACCOUNT_SECURE + __SUSPICION_LOGIN + __TO_IN_SUBJ + __SUBJ_DOM_ADMIN + __FROM_DOM_ADMIN + __PDS_FROM_NAME_TO_DOMAIN) > 3
6533
6534 body        __ACH_CANCELLED_01     /\b(?:(?-i:ACH)|dividend)[-_ ](?:payment|transfer|transaction|was)[-_ ](?:(?:was|is)[-_ ])?(?:rejected|cancel+ed|declined|disabled|not[-_ ]accepted|(?:technical )?error)/i
6535
6536 body        __ACH_CANCELLED_02     /(?:rejected|cancel+ed|declined|your)[-_ ](?:(?-i:ACH)|direct[-_ ]deposit)[-_ ](?:payment|transfer|transaction|declin(?:ed|ing))/i
6537
6538 body        __ACH_CANCELLED_03     /\bwire[-_ ]?(?:payment|transfer|transaction)[-_ ](?:(?:was|is)[-_ ])?(?:rejected|cancel+ed|declined|disabled|not[-_ ]accepted|(?:technical )?error)/i
6539
6540 body        __ACH_CANCELLED_04     /\bregarding[-_ ]your[-_ ]direct[-_ ]deposit[-_ ]via[-_ ](?-i:ACH)/i
6541
6542 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
6543         meta         __ACH_CANCELLED_EXE (__ACH_CANCELLED_01 || __ACH_CANCELLED_02 || __ACH_CANCELLED_03 || __ACH_CANCELLED_04) && __EXE_ATTACH
6544 endif
6545
6546 uri __AC_1SEQC_URI      /\/1[a-z0-9]8[a-z0-9_]{20,}\/C\//
6547
6548 uri __AC_1SEQV_URI      /\/1[a-z0-9]8[a-z0-9_]{20,}\/V\//
6549
6550 uri __AC_CHDSEQ_URI     /\/chd[a-z0-9]{20,}/
6551
6552 header     __AC_FROM_MANY_DOTS         From =~ /<(?:\w{2,}\.){2,}\w+@/
6553
6554 meta       __AC_FROM_MANY_DOTS_MINFP   __AC_FROM_MANY_DOTS && !ALL_TRUSTED && !FREEMAIL_FORGED_FROMDOMAIN && !FORGED_GMAIL_RCVD && !__UNSUB_LINK && !__XM_VBULLETIN && !__RDNS_SHORT && !__REPTO_QUOTE && !__FSL_RELAY_GOOGLE && !__HAS_IN_REPLY_TO && !__RCD_RDNS_SMTP && !__HAS_THREAD_INDEX && !__RCD_RDNS_MX_MESSY && !__CTYPE_MULTIPART_MIXED && !__RCD_RDNS_MTA && !__VIA_ML && !__HAS_ERRORS_TO
6555
6556 rawbody    __AC_HTML_ENTITY_BONANZA_SHRT_RAW          /(?:&[A-Z0-9\#]{2,};\s{0,64}){10}/i
6557
6558 uri __AC_LAND_URI       /\/land\//
6559
6560 uri __AC_LONGSEQ_URI    /\/[A-Z0-9]{50,}\.(?:php|html|cgi)\b/
6561
6562 uri __AC_MHDSEQ_URI     /\/mhd[a-z0-9]{20,}/
6563
6564 uri __AC_NDOMLONGNASPX_URI      /[A-Za-z]+[0-9]{2}\.[A-Za-z0-9-]+\.me\/(?:[A-Za-z0-9-]{10,}\/){2}[0-9]{8,}\/[A-Za-z]+\.aspx/
6565
6566 uri __AC_NUMS_URI       /(?:\/[0-9]+){5}\.[0-9a-zA-Z]+\.(:?php|html)\b/
6567
6568 uri __AC_OUTI_URI       /\/outi\b/
6569
6570 uri __AC_OUTL_URI       /\/outl\b/
6571
6572 uri __AC_PHPOFFSUB_URI  /\/php\/off\/[0-9.]+\/sub\//
6573
6574 uri __AC_PHPOFFTOP_URI  /\/php\/off\/[0-9.]+\/top\//
6575
6576 uri        __AC_POSTHTMLEXTRAS         /(?:main[0-9]?|mian|start(?:page)?|info(?:page|source|center)?|(?:one|view)?(?:site|source)(?:view|[0-9])?|(?:hub|file)one|index(?:[0-9]|page)?|mediafile|userlink|faction1)[.,]html?\/\w{2,}\b/i
6577
6578 uri        __AC_POSTIMGEXTRAS          /(?:(?:main|external|hosted|new|file)?(?:im(?:g|age)?|user|one)s?-?(?:view(?:er)?|file|map|finder|portal|hub|online)?s?|library|media(?:source|-?files?)?|main|png|view|begin|file|port|space|webpics|host)(?:[-]?(?:[0-9]|one|two|three|four|five|six|seven|eight|nine))?[.,](?:jpe?g|png|gif)\/\w{2,}\b/i
6579
6580 meta       __AC_POST_EXTRAS            (__AC_POSTHTMLEXTRAS || __AC_POSTIMGEXTRAS)
6581
6582 uri __AC_PUNCTNUMS_URI  /\.com\/[A-Za-z+=\/.?_-]{4,}[0-9]{9,12}[a-z0-9]{1,2}[A-Za-z+=\/.?_-]+[0-9]{7,9}[A-Za-z+=\/.?_-]{6,}[0-9]{7,9}\b/
6583
6584 uri __AC_REPORT_URI     /\/report\//
6585
6586 uri __AC_RMOVE_URI      /\/r\/move\/[0-9]+\//
6587
6588 rawbody     __AC_TINY_FONT           /(?:font-size)\s*:\s*[1-3]\s*(?:em|p[tx]|%)?(?:\s*!important)?\s*[";]/i
6589
6590 uri __AC_UHDSEQ_URI     /\/uhd[a-z0-9]{20,}/
6591
6592 uri __AC_UNSUB_URI      /\/unsub\//
6593
6594 body        __ADMAIL          /(?:\b|_)ad-?(?:mail|message)s?(?:\b|_)/i
6595
6596 body        __ADMITS_SPAM     /\bth(?:e[- ]+above|is)(?:\?+s|[- ]+is)[- ]+(?:intended[- ]+as[- ]+)?an?[- ]+(?:e-?mail[- ]+)?[a@]dvert[i1l]sement\b/i
6597
6598 body       __ADULTDATINGCOMPANY_BODY   /\bAdultDatingCompany\b/i
6599
6600 header     __ADULTDATINGCOMPANY_FROM   From:name =~ /\bAdultDatingCompany\b/i
6601
6602 header     __ADULTDATINGCOMPANY_REPTO  Reply-To:name =~ /\bAdultDatingCompany\b/i
6603
6604 meta      __ADVANCE_FEE_2_NEW  (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH +  __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY + __LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT +  UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __URG_BIZ + __YOUR_CONSIGNMENT + __YOUR_FUND + __YOUR_PERM + __YOU_WON > 1) && !__THREAD_INDEX_GOOD
6605
6606 meta      __ADVANCE_FEE_2_NEW_FORM  __FILL_THIS_FORM && !LOTS_OF_MONEY && __ADVANCE_FEE_2_NEW
6607
6608 meta      __ADVANCE_FEE_2_NEW_FRM_MNY  __FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_2_NEW
6609
6610 meta      __ADVANCE_FEE_2_NEW_MONEY  !__FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_2_NEW
6611
6612 meta      __ADVANCE_FEE_3_NEW  (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH +  __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY + __LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT +  UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __URG_BIZ + __YOUR_CONSIGNMENT + __YOUR_FUND + __YOUR_PERM + __YOU_WON > 2) && !__THREAD_INDEX_GOOD
6613
6614 meta      __ADVANCE_FEE_3_NEW_FORM  __FILL_THIS_FORM && !LOTS_OF_MONEY && __ADVANCE_FEE_3_NEW
6615
6616 meta      __ADVANCE_FEE_3_NEW_FRM_MNY  __FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_3_NEW
6617
6618 meta      __ADVANCE_FEE_3_NEW_MONEY  !__FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_3_NEW
6619
6620 meta      __ADVANCE_FEE_4_NEW  (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH +  __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY + __LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT +  UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __URG_BIZ + __YOUR_CONSIGNMENT + __YOUR_FUND + __YOUR_PERM + __YOU_WON > 3) && !__THREAD_INDEX_GOOD
6621
6622 meta      __ADVANCE_FEE_4_NEW_FORM  __FILL_THIS_FORM && !LOTS_OF_MONEY && __ADVANCE_FEE_4_NEW
6623
6624 meta      __ADVANCE_FEE_4_NEW_FRM_MNY  __FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_4_NEW
6625
6626 meta      __ADVANCE_FEE_4_NEW_MONEY  !__FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_4_NEW
6627
6628 meta      __ADVANCE_FEE_5_NEW  (__AFRICAN_STATE + __ATM_CARD + __BACK_SCRATCH +  __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + __EX_CUSTOMER + __FOUND_YOU + __FRAUD_AON + __FRAUD_AUM + __FRAUD_AXF + __FRAUD_BEP + __FRAUD_BGP + __FRAUD_CKF + __FRAUD_DPR + __FRAUD_FVU + __FRAUD_GBW + __FRAUD_IPK + __FRAUD_IRT + __FRAUD_JNB + __FRAUD_JYG + __FRAUD_MCQ + __FRAUD_MLY + __FRAUD_MQO + __FRAUD_NEB + __FRAUD_QFY + __FRAUD_QXX + __FRAUD_SNT + __FRAUD_ULK + __FRAUD_UOQ + __FRAUD_VQE + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_XJR + __FRAUD_XWW + __FRAUD_YPO + __FRAUD_YQV + __I_INHERIT + __INTL_BANK + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + LOTTO_AGENT + T_LOTTO_AGENT_RPLY + __LOTTO_DEPT + __LOTTO_RELATED + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __NEXT_OF_KIN + __NOT_DEAD_YET + __PCT_OF_PMTS + __SCAM + __SHARE_IT + __THEY_INHERIT +  UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __URG_BIZ + __YOUR_CONSIGNMENT + __YOUR_FUND + __YOUR_PERM + __YOU_WON > 4) && !__THREAD_INDEX_GOOD
6629
6630 meta      __ADVANCE_FEE_5_NEW_FORM  __FILL_THIS_FORM && !LOTS_OF_MONEY && __ADVANCE_FEE_5_NEW
6631
6632 meta      __ADVANCE_FEE_5_NEW_FRM_MNY  __FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_5_NEW
6633
6634 meta      __ADVANCE_FEE_5_NEW_MONEY  !__FILL_THIS_FORM && LOTS_OF_MONEY && __ADVANCE_FEE_5_NEW
6635
6636 body __AFF_004470_NUMBER  /(?:\+|00|011)\W{0,3}44\W{0,3}0?\W{0,3}70/
6637
6638 body __AFF_LOTTERY        /(?:lottery|winner)/i
6639
6640 meta     __AFRICAN_STATE  (__NIGERIA || __IVORY_COAST || __BURKINA_FASO || __GHANA || __BENIN || __AFR_UNION)
6641
6642 body     __AFR_UNION      /\bafrican\sunion\b/i
6643
6644 body     __AGREED_RATIO   /\b(?:agreed|sharing)\s(?:ratios?|percent\w+)\b/i
6645
6646 meta       __ALIBABA_IMG_NOT_RCVD_ALI  __URI_IMG_ALICDN && !__HDR_RCVD_ALIBABA
6647
6648 header         __AMADEUSMS_MUA     X-Mailer =~ /^Amadeus Messaging Server/
6649
6650 meta       __AMAZON_IMG_NOT_RCVD_AMZN  __URI_IMG_AMAZON && !__HDR_RCVD_AMAZON && !__HDR_RCVD_AMAZON_HELO
6651
6652 body     __AM_DYING       /\b(?:am\s(?:\S+\s)?dying|terminally\sill|cancer|en\sphase\sterminale|(?:become|is|devenu|maladie)\sincurable|que\sje\smeurs)\b/i
6653
6654 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
6655 mimeheader __ANY_IMAGE_ATTACH Content-Type =~ /\bimage\//i
6656 endif
6657
6658 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
6659   meta        __ANY_TEXT_ATTACH 0
6660 endif
6661
6662 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
6663   mimeheader  __ANY_TEXT_ATTACH Content-Type =~ /text\/\w+/i
6664 endif
6665
6666 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
6667 mimeheader __ANY_TEXT_ATTACH_DOC     Content-Type =~ /text\/\w+/i
6668 endif
6669
6670 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
6671   body       __APP_DEVELOPMENT           /\b(?:mobile apps|(?:apps?|portal) (?:dev(?:elop(?:ment|ed))?|design|test(?:ing)?|U[IX]|maintenance|support)|(?:we |can |have )+(?:design(?:ed)?|buil[dt]|maintain(?:ed)?|created?)(?: over| more than)?[\s0-9]+apps|different platforms|we are (?:[-a-z]+ ){1,4}(?:software|apps?) (?:company|develop(?:ers|ment)))\b/i
6672   tflags     __APP_DEVELOPMENT           multiple maxhits=6
6673 endif
6674
6675 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
6676   meta       __APP_DEVELOPMENT_MANY      __APP_DEVELOPMENT > 5
6677 endif
6678
6679 body     __ATM_CARD       /\b(?:your|the|this|through|via|by\smeans\sof\|that\sa|issue\s(?:(?:to|for)\s)?you\sa)[\s\(](?:\w{1,20}\s)?(?:atm|debit|(?:money[\s-]?gram\s)?fast\scash)(?:\smaster|swift|value?|cash)?[\s\)]card/i
6680
6681 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
6682   meta         __ATTACH_MSO_MHTML  __TEXT_XML_MT && __MSO_THEME_MT && __X_MSO_MT
6683 endif
6684
6685 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
6686   meta         __ATTACH_NAME_NO_EXT 0
6687 endif
6688
6689 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
6690   mimeheader   __ATTACH_NAME_NO_EXT Content-Type =~ m,\bname\s?=\s?"(?!=\?)[^."]+",i
6691 endif
6692
6693 body        __ATTN_MAIL_USER     /\b(?:att(?:entio)?n|dear|caro) (?:web ?(?:mail)?\s\S\s)?(?:web ?|e-?)?mail (?:user|DO USU(?:=E1|[\xe1]|[\xc3][\xa1])RIO)[:;,]/i
6694
6695 body     __AUTO_ACCIDENT     /auto(?:mobile)? accident/i
6696
6697 header __AXB_MO_OL_024C2  X-MimeOLE =~ /Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2600\.0000/
6698
6699 header __AXB_XM_OL_024C2  X-Mailer =~ /Microsoft\ Outlook\ Express\ 6\.00\.2600\.0000/
6700
6701 body     __BACK_SCRATCH   /\bmutual+y?\s(?:benefi(?:t|cial)|interest)\b/i
6702
6703 body     __BANK_DRAFT     /\bbank\sdraft/i
6704
6705 body     __BARRISTER      /\b(?:barrister|solicitor at law|barr\.)/i
6706
6707 meta       __BEBEE_IMG_NOT_RCVD_BB     __URI_IMG_BEBEE && !__HDR_RCVD_BEBEE
6708
6709 body     __BENEFICIARY    /\bb(?:e|=E9|[\xe9]|[\xc3][\xa9])n(?:e|=E9|[\xe9]|[\xc3][\xa9])fi(?:c|sh)i?ai?r(?:y|ies|es?)/i
6710
6711 body     __BENIN          /\bb(?:e|=E9|[\xe9]|[\xc3][\xa9])nin\b/i
6712
6713 body           __BIGNUM_EMAILS            /\b(?:thousand|million|\d[,1-9]{0,6}(?:[,0]{2,}k?|k))\s(?:(?!and|or|your|place|baby|suspicious|supportive|subpoenaed)\w+\s)?(?:e-?mail(?:(?![-:.\)\>\]])s?|\saddresses)|fax numbers|leads|names)\b/i
6714 tflags         __BIGNUM_EMAILS            multiple maxhits=5
6715
6716 meta           __BIGNUM_EMAILS_3          __BIGNUM_EMAILS > 2
6717
6718 meta           __BIGNUM_EMAILS_FREEM      __BIGNUM_EMAILS && __freemail_hdr_replyto
6719
6720 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
6721   body          __BITCOIN           /\bB[-\s]?i[-\s]?t[-\s]?c[-\s]?o[-\s]?i[-\s]?n\b/i
6722 endif
6723
6724 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
6725   body          __BITCOIN           /<B>[-\s]?<I>[-\s]?<T>[-\s]?<C>[-\s]?<O>[-\s]?<I>[-\s]?<N>/i
6726 endif
6727
6728 body           __BITCOIN_ID     /\b(?<!=)(?:[13](?:(?:[-_=\s][a-km-zA-HJ-NP-Z1-9]){29,34}|[a-km-zA-HJ-NP-Z1-9]{29,34})|bc1[acdefghjklmnpqrstuvwxyz234567890]{30,90}|b[-_=\s]c[-_=\s]1(?:[-_=\s][acdefghjklmnpqrstuvwxyz234567890]){30,90})\b/
6729
6730 meta       __BITCOIN_IMGUR             __IMGUR_IMG && __BITCOIN
6731
6732 meta           __BITCOIN_OBFU_SUBJ  __BITCOIN && __SUBJ_OBFU_PUNCT
6733
6734 meta           __BITCOIN_SPAM_02  __BITCOIN_ID && __BOTH_INR_AND_REF
6735
6736 meta           __BITCOIN_SPAM_05  __BITCOIN_ID && __SPOOFED_FREEMAIL
6737
6738 meta           __BITCOIN_SPAM_07  __BITCOIN_ID && __TO_EQ_FROM
6739
6740 meta       __BITCOIN_WFH_01            __BITCOIN && __WFH_01
6741
6742 meta           __BITCOIN_XPRIO      __XPRIO && (__BITCOIN || __BITCOIN_ID)
6743
6744 meta        __BODY_SINGLE_URI     (__BODY_SINGLE_WORD && __HAS_ANY_URI)
6745
6746 meta        __BODY_SINGLE_WORD    __BODY_TEXT_LINE < 3 && !__EMPTY_BODY && !__SMIME_MESSAGE && ((__SINGLE_WORD_LINE && !__SINGLE_WORD_SUBJ) || __SINGLE_WORD_LINE > 1)
6747
6748 body __BODY_STARTS_WITH_FROM_LINE /^From \S+ \S\S\S \S\S\S .. ..:..:.. \S+\s+\S+\: /s
6749
6750 body        __BODY_TEXT_LINE     /^\s*\S/
6751 tflags      __BODY_TEXT_LINE     multiple maxhits=3
6752
6753 meta        __BODY_URI_ONLY      __BODY_TEXT_LINE < 3 && __HAS_ANY_URI && !__SMIME_MESSAGE
6754
6755 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
6756   full       __BOGUS_MIME_HDR            /\bContent-[XYZ]-[a-z]{6,15}:\s+[a-z]{6,15}\b/
6757   tflags     __BOGUS_MIME_HDR            multiple maxhits=8
6758 endif
6759
6760 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
6761   meta       __BOGUS_MIME_HDR_MANY       __BOGUS_MIME_HDR > 7
6762 endif
6763
6764 header     __BOGUS_MIME_VER_02         MIME-Version =~ /^(?!.*\b1\.0\b).+/
6765
6766 meta       __BOGUS_MSM_HDRS             __HAS_MSMAIL_PRI && __MSOE_MID_WRONG_CASE && __HDR_ORDER_FTSDMCXXXX
6767
6768 body       __BONUS_LAST_DAY            /\b(?:last|final) day of the (?:\$\d+ |\d+ dollars? )?bonus offer(?:ing)?\b/i
6769
6770 meta     __BOTH_INR_AND_REF     (__XM_BALSA || __XM_CALYPSO || __XM_FORTE || __XM_MHE || __XM_SQRLMAIL || __XM_SYLPHEED || __THEBAT_MUA || __XM_VM || __XM_XIMEVOL || __UA_KMAIL || __UA_MOZ5 || __UA_OPERA7)
6771
6772 body           __BTC_OBFU_2     /\b\W{0,10}b(?!it[-\s]?coin)\W{0,10}i\W{0,10}t\W{0,10}c\W{0,10}o\W{0,10}i\W{0,10}n\W{0,10}\b/i
6773
6774 body           __BTC_OBFU_3     /\b\W{0,10}b(?!tc\b)\W{0,10}t\W{0,10}c\W{0,10}\b/i
6775
6776 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
6777   body           __BTC_OBFU_4     /\bb(?!itcoin)[i\x{0456}]t[c\x{0441}][o\x{043E}][i\x{0456}]n\b/i
6778 endif
6779
6780 body           __BTC_OBFU_5     /&\#x62;&\#x69;&\#x74;&\#x63;&\#x6F;&\#x69;&\#x6E;/i
6781
6782 rawbody  __BUGGED_IMG   m{<img\b[^>]{0,100}\ssrc=.?https?://[^>]{6,80}(?:\?[^>]{8}|[^a-z](?![a-f]{3}|20\d\d[01]\d[0-3]\d)[0-9a-f]{8})}i
6783
6784 body     __BURKINA_FASO   /\bburkina\s?faso\b/i
6785
6786 body        __CANT_SEE_AD_1   /\b(?:can(?:no|')?t|(?:aren'?t[-,!\s]{1,3}|not[-,!\s]{1,3}|un)able[-,!\s]{1,3}to)[-,!\s]{1,3}(?:(?!our|this|the)\w{1,12}[-,\s]{1,3}){1,2}(?:our|this|the)[-.,\s*]{1,3}(?:commercial[-.,\s]{1,3}|ad(?:v[-.]?ert[i1l]se-?ment)?[-.,\s]{1,3}|images |newsletter |mailing ){1,2}(?:at all|(?:(?:down )?(?:below|underneath))|in (?:your|this) mail|(?:due to|because(?: of)?|as|from) (?:no |missing |unloaded |blocked )?(?:images|graphics))\b/i
6787
6788 body        __CANT_SEE_AD_2   /\b(?:issue|problem|trouble) (?:getting|viewing|with) (?:(?:our|the) )?(?:message|content|e-?mail|details)(?: below)?[.?] (?:please|go ahead and) (?:click|browse)\b/i
6789
6790 body        __CAN_HELP         /\bcan help\b/i
6791
6792 body __CASHPRZ      /cash prize of/
6793
6794 body     __CHARITY        /\b(?:charit(?:y|[ai]ble)|orphans?|homeless|orphelins|sans\sabri)\b/i
6795
6796 body        __CLEAN_MAILBOX      /\b(?:(?:e-?mail|mail\s?box|violation:|(?-i:CLICK)) (?:quota size|clean(?:-?up))|clean ?up click ?here|(?:please|automatically) reduce (?:your|the) e?-?mail ?box size|reduce (?:your |the )?(?:e?-?mail(?: ?box)? )?size automatically)\b/i
6797 tflags      __CLEAN_MAILBOX      multiple maxhits=2
6798
6799 rawbody        __COMMENT_GIBBERISH      /<!--(?:\s{1,10}[-\w'"]{1,40}){100}/im
6800
6801 body     __COMPENSATION   /\b(?:compensat(?:e|ion)|recompensed?|ausgleich)\b/i
6802
6803 body     __CONTACT_ATTY   /\bcontact(?:er)?\s(?:my|(?:de\s)?mon)\s(?:barrister|attou?rney|lawyer|avocat|gestionnaire)\b/i
6804
6805 body     __CONTACT_YOU    /\b(?:contact(?:ing)\syou|vous\scontacter?)\b/i
6806
6807 rawbody    __CONTENT_AFTER_HTML        /<\/html>\s*[a-z0-9]/i
6808
6809 body     __COPY_PASTE_DE      /Kopieren Sie es und f(?:\xfc|\xc3\xbc)gen Sie es ein|Kopieren \& Einf(?:\xfc|\xc3\xbc)gen/i
6810
6811 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
6812   body     __COPY_PASTE_EN    /Copy (and|\+|\&) paste/i
6813 endif
6814
6815 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
6816   body     __COPY_PASTE_EN    /<C><O><P><Y> (?:<A><N><D>|\+|\&) <P><A><S><T><E>/i
6817 endif
6818
6819 body     __COPY_PASTE_ES      /copiarlo y pegarlo/i
6820
6821 body     __COPY_PASTE_FR      /le copier (et le|\+) coller/i
6822
6823 body     __COPY_PASTE_IT      /copia(r?)lo (e|\&) incolla(r?)lo/i
6824
6825 body     __COPY_PASTE_NL      /kopieer en plak het/i
6826
6827 body     __COPY_PASTE_SE      /kopiera den och klistra in/i
6828
6829 body     __COURIER        /\bcourier\s(?:company|service)\b/i
6830
6831 header      __CR_IN_SUBJ      Subject:raw =~ /\015/
6832
6833 header  __CTYPE_MULTIPART_ANY Content-Type =~ /multipart\/\w+/i
6834
6835 header     __CTYPE_MULTIPART_MIXED Content-Type =~ /multipart\/mixed/i
6836
6837 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
6838   meta         __CTYPE_NULL        0
6839 endif
6840
6841 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
6842   mimeheader   __CTYPE_NULL        Content-Type =~ /^\s*;/
6843 endif
6844
6845 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
6846 mimeheader __CTYPE_ONETAB_GIF Content-Type:raw =~ /^image\/gif;\n\tname=\".+?\"$/s
6847 endif
6848
6849 header     __CT_ENCRYPTED              Content-Type =~ /^multipart\/(?:x-)?(?:pgp-)?encrypted|application\/(?:x-)?pkcs7-mime/
6850
6851 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
6852 mimeheader      __CT_UTF7               Content-Type =~ /\bcharset=.?utf-7\b/i
6853 endif
6854
6855 header      __DATE_LOWER       ALL =~ /date:\s\S{5}/
6856
6857 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
6858   body       __DAY_I_EARNED            /day,?\sI\s(?:earned|got|received|made|brought\sin)\s\$\s?\d{3}/i
6859   tflags     __DAY_I_EARNED            multiple maxhits=4
6860 endif
6861
6862 body __DBLCLAIM     /avoid double claiming/
6863
6864 body     __DEAD_PARENT    /\b(?:my|meu)\s(?:(?:deceased|dead)\s(?:father|mother|husband)|(?:father|dad|mother|mom|husband|marido)(?:'?s)?\s(?:death|died|passed\saway|murder|was\s(?:killed|murdered|poisoned)|faleceu))/i
6865
6866 body     __DEAL           /\b(?:(?:business|financial|this|the|mutual|die(?:se)?r?|cette|profitable)\s(?:deal|transa[ck]tion|proposal|off[er]{2}|venture|suggestion|partnership)|your\spartnership)/i
6867
6868 body     __DECEASED       /\b(?:the|my|your|der|du|le|meu?)\s(?:deceased|late|verstorbenen|d(?:i|e|=E9|[\xe9]|[\xc3][\xa9])funto?|d(?:e|=E9|[\xe9]|[\xc3][\xa9])nt|falecido)\b/i
6869
6870 body     __DESTROY_ME     /\b(?:destroy|hunt|quemar)\sm[eyi]\b/i
6871
6872 body           __DESTROY_YOU    /\b(?:destroy\syou|deine Zukunft zerst\S{1,3}ren)/i
6873
6874 body     __DIED_IN        /\bdied\sin\b/i
6875
6876 body     __DIPLOMATIC     /\bdiplomatic\b/i
6877
6878 ifplugin Mail::SpamAssassin::Plugin::AskDNS
6879 tflags    __DKIMWL_BLOCKED  net
6880 endif
6881
6882 ifplugin Mail::SpamAssassin::Plugin::AskDNS
6883 tflags    __DKIMWL_BULKMAIL net
6884 endif
6885
6886 ifplugin Mail::SpamAssassin::Plugin::AskDNS
6887 tflags    __DKIMWL_FREEMAIL net
6888 endif
6889
6890 ifplugin Mail::SpamAssassin::Plugin::AskDNS
6891 tflags    __DKIMWL_WL_BL   net
6892 endif
6893
6894 ifplugin Mail::SpamAssassin::Plugin::AskDNS
6895 tflags    __DKIMWL_WL_HI    net
6896 endif
6897
6898 ifplugin Mail::SpamAssassin::Plugin::AskDNS
6899 tflags    __DKIMWL_WL_MED   net
6900 endif
6901
6902 ifplugin Mail::SpamAssassin::Plugin::AskDNS
6903 tflags    __DKIMWL_WL_MEDHI net
6904 endif
6905
6906 header   __DKIM_EXISTS  exists:DKIM-Signature
6907 tflags   __DKIM_EXISTS  nice
6908
6909 body           __DLND_ATTACH      /\bdownload\sthe\sattach(?:ed|ment)\b/i
6910
6911 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
6912   meta         __DOC_ATTACH       0
6913 endif
6914
6915 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
6916   meta         __DOC_ATTACH       (__DOC_ATTACH_MT || __DOC_ATTACH_FN1 || __DOC_ATTACH_FN2)
6917 endif
6918
6919 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
6920   meta         __DOC_ATTACH_FN1   0
6921 endif
6922
6923 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
6924   mimeheader   __DOC_ATTACH_FN1   Content-Type =~ /="[^"]+\.(?:docx?|rtf)"/i
6925 endif
6926
6927 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
6928   meta         __DOC_ATTACH_FN2   0
6929 endif
6930
6931 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
6932   mimeheader   __DOC_ATTACH_FN2   Content-Disposition =~ /="[^"]+\.(?:docx?|rtf)"/i
6933 endif
6934
6935 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
6936   meta         __DOC_ATTACH_MT    0
6937 endif
6938
6939 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
6940   mimeheader   __DOC_ATTACH_MT    Content-Type =~ m,\bapplication/(?:msword|rtf|vnd\.ms-word|vnd\.openxmlformats-officedocument\.wordprocessingml\.document)\b,i
6941 endif
6942
6943 body     __DORMANT_ACCT   /\b(?:(?:dormant|abandoned|left\s?over)\s(?:account|fund|transaction|sum|deposit)|fonds\sdorment)/i
6944
6945 body    __DOS_BODY_FRI  /\bfri(?:day)?\b/i
6946
6947 body    __DOS_BODY_MON  /\bmon(?:day)?\b/i
6948
6949 body    __DOS_BODY_SAT  /\bsat(?:day)?\b/i
6950
6951 body            __DOS_BODY_STOCK        /\bstock\b/i
6952
6953 body    __DOS_BODY_SUN  /\bsun(?:day)?\b/i
6954
6955 body    __DOS_BODY_THU  /\bthu(?:r(?:s(?:day)?)?)?\b/i
6956
6957 body            __DOS_BODY_TICKER       /\b[A-Z]{4}\.(?:OB|PK)\b/
6958
6959 body    __DOS_BODY_TUE  /\btue(?:s(?:day)?)?\b/i
6960
6961 body    __DOS_BODY_WED  /\bwed(?:nesday)?\b/i
6962
6963 body    __DOS_COMING_TO_YOUR_PLACE      /I (?:am|might(?: be)?) c[a-z]?o[a-z]?m[a-z]?(?:i[a-z]?n[a-z]?g[a-z]{0,2}|e down) to y[!a-z]{2,4}r (?:city|place[a-z]{0,2}|co[a-z]?u[a-z]?n[a-z]?t[a-z]?ry) in (?:f[a-z]?e[a-z]?w|\d{1,2}) (?:day|week)s/
6964
6965 body    __DOS_CORRESPOND_EMAIL          /correspond with me using my email/
6966
6967 meta __DOS_DIRECT_TO_MX         __DOS_SINGLE_EXT_RELAY && !__DOS_HAS_LIST_ID && !__DOS_HAS_LIST_UNSUB && !__DOS_HAS_MAILING_LIST && !__DOS_RELAYED_EXT
6968
6969 meta __DOS_DIRECT_TO_MX_UNTRUSTED       __DOS_DIRECT_TO_MX && !ALL_TRUSTED
6970
6971 body    __DOS_DROP_ME_A_LINE            /Drop me a line at/
6972
6973 body    __DOS_EMAIL_DIRECTLY            /(?:Email m[a-z]?e|address) direc(?:tl|lt)y at/
6974
6975 body            __DOS_FIN_ADVANTAGE     /\bfinancial advantage/i
6976
6977 uri __DOS_HAS_ANY_URI           /^\w+:\/\//
6978
6979 header __DOS_HAS_LIST_ID        exists:List-ID
6980
6981 header __DOS_HAS_LIST_UNSUB     exists:List-Unsubscribe
6982
6983 header __DOS_HAS_MAILING_LIST   exists:Mailing-List
6984
6985 body __DOS_HI                   /^Hi,$/
6986
6987 body    __DOS_I_AM_25                   /I a.?m 25/
6988
6989 body __DOS_I_DRIVE_A    /I drive a/
6990
6991 body __DOS_LET_GO_JOB   /I was (?:let go|fired|layed off|dismissed) from a job I h(?:el|a)d for (?:2\d years|\d{3} months)/
6992
6993 body __DOS_LINK                 /\blink\b/
6994
6995 body    __DOS_MEET_EACH_OTHER           /(?:meet each other|[Mm]ay ?be we can meet)/
6996
6997 header __DOS_MSGID_DIGITS10 Message-ID =~ /<1[013-9]\d{8}\@.*>/
6998
6999 header __DOS_MSGID_DIGITS9 Message-ID =~ /<\d{9}\@.*>/
7000
7001 body __DOS_MY_OLD_JOB   /my old job/
7002
7003 body    __DOS_PERSONAL_EMAIL            /personal email at/
7004
7005 header  __DOS_RCVD_FRI  Received =~ / Fri, /
7006
7007 header  __DOS_RCVD_MON  Received =~ / Mon, /
7008
7009 header  __DOS_RCVD_SAT  Received =~ / Sat, /
7010
7011 header  __DOS_RCVD_SUN  Received =~ / Sun, /
7012
7013 header  __DOS_RCVD_THU  Received =~ / Thu, /
7014
7015 header  __DOS_RCVD_TUE  Received =~ / Tue, /
7016
7017 header  __DOS_RCVD_WED  Received =~ / Wed, /
7018
7019 meta    __DOS_REF_2_WK_DAYS     (__DOS_RCVD_MON && __DOS_BODY_WED) || (__DOS_RCVD_TUE && __DOS_BODY_THU) || (__DOS_RCVD_WED && __DOS_BODY_FRI) || (__DOS_RCVD_THU && __DOS_BODY_MON) || (__DOS_RCVD_FRI && __DOS_BODY_TUE) || (__DOS_RCVD_SAT && __DOS_BODY_TUE) || (__DOS_RCVD_SUN && __DOS_BODY_TUE)
7020
7021 meta    __DOS_REF_NEXT_WK_DAY   (__DOS_RCVD_MON && __DOS_BODY_TUE) || (__DOS_RCVD_TUE && __DOS_BODY_WED) || (__DOS_RCVD_WED && __DOS_BODY_THU) || (__DOS_RCVD_THU && __DOS_BODY_FRI) || (__DOS_RCVD_FRI && __DOS_BODY_MON) || (__DOS_RCVD_SAT && __DOS_BODY_MON) || (__DOS_RCVD_SUN && __DOS_BODY_MON)
7022
7023 meta    __DOS_REF_TODAY         (__DOS_RCVD_MON && __DOS_BODY_MON) || (__DOS_RCVD_TUE && __DOS_BODY_TUE) || (__DOS_RCVD_WED && __DOS_BODY_WED) || (__DOS_RCVD_THU && __DOS_BODY_THU) || (__DOS_RCVD_FRI && __DOS_BODY_FRI) || (__DOS_RCVD_SAT && __DOS_BODY_SAT) || (__DOS_RCVD_SUN && __DOS_BODY_SUN)
7024
7025 header __DOS_RELAYED_EXT        ALL-EXTERNAL =~ /(?:^|\n)[Rr][eE][cC][eE][iI][vV][eE][dD]:\s.+\n[Rr][eE][cC][eE][iI][vV][eE][dD]:\s/s
7026
7027 header __DOS_SINGLE_EXT_RELAY   X-Spam-Relays-External =~ /^\[ [^\]]+ \]$/
7028
7029 body            __DOS_STEADY_COURSE     /\bsteady (?:and increasing )?course\b/i
7030
7031 body            __DOS_STRONG_CF         /\bstrong cash flow/i
7032
7033 body __DOS_TAKING_HOME  /Taking home \d (?:digit level|figures) in \d{1,2} months/
7034
7035 body    __DOS_WRITE_ME_AT               /[Ww].?r.?i.?t.?e me at/
7036
7037 meta       __DOTGOV_IMAGE              __URI_DOTGOV && __REMOTE_IMAGE
7038
7039 meta       __DYNAMIC_IMGUR             __IMGUR_IMG && __RDNS_DYNAMIC_IPADDR
7040
7041 body     __EARLY_DEMISE   /\buntimely\sdeath\b/i
7042
7043 header   __EBAY_ADDRESS         From:addr =~ /[\@.]ebay\.\w\w\w?(?:\.\w\w)?$/i
7044
7045 meta       __EBAY_IMG_NOT_RCVD_EBAY    __URI_IMG_EBAY && !__HDR_RCVD_EBAY
7046
7047 meta        __EMAIL_PHISH        (__WEBMAIL_ACCT + __MAILBOX_FULL + __MAILBOX_FULL_SE + __CLEAN_MAILBOX + __VALIDATE_MAILBOX + __VALIDATE_MBOX_SE + __UPGR_MAILBOX + __LOCK_MAILBOX + __SYSADMIN + __ATTN_MAIL_USER + __MAIL_ACCT_ACCESS1 + __MAIL_ACCT_ACCESS2 + __ACCESS_REVOKE + __PASSWORD_UPGRADE + __PENDING_MESSAGES + __RELEASE_MESSAGES + __PASSWORD_EXP_CLUMSY + (__TVD_PH_SUBJ_META || __TVD_PH_BODY_META || __TVD_PH_BODY_ACCOUNTS_PRE || __TVD_PH_BODY_ACCOUNTS_POST || __PDS_FROM_NAME_TO_DOMAIN) > 1) && !__EMAIL_PHISH_MANY
7048
7049 meta        __EMAIL_PHISH_MANY   (__WEBMAIL_ACCT + __MAILBOX_FULL + __MAILBOX_FULL_SE + __CLEAN_MAILBOX + __VALIDATE_MAILBOX + __VALIDATE_MBOX_SE + __UPGR_MAILBOX + __LOCK_MAILBOX + __SYSADMIN + __ATTN_MAIL_USER + __MAIL_ACCT_ACCESS1 + __MAIL_ACCT_ACCESS2 + __ACCESS_REVOKE + __PASSWORD_UPGRADE + __PENDING_MESSAGES + __RELEASE_MESSAGES + __PASSWORD_EXP_CLUMSY + __TO_IN_SUBJ + __SUBJ_DOM_ADMIN + __FROM_DOM_ADMIN + (__TVD_PH_SUBJ_META || __TVD_PH_BODY_META || __TVD_PH_BODY_ACCOUNTS_PRE || __TVD_PH_BODY_ACCOUNTS_POST || __PDS_FROM_NAME_TO_DOMAIN || __TO_IN_SUBJ) > 3)
7050
7051 meta        __EMPTY_BODY         __BODY_TEXT_LINE < 2 && !__SMIME_MESSAGE
7052
7053 body           __END_FUTURE_EMAILS /\b(?:end|stop(?! receiving these (?:alerts|emails))|cease|discontinue|removed?|(?:do(?! not wish to receive [\w\s]{0,20}emails)|would|you(?:'d)?) (?:not (?:wish|want|like|desire)|(?:prefer|wish|want|like|desire) not) to|exclude yourself|fore?go)[- ](?:get |receiv(?:ing|e) |or |(?:a-z{1,30} ){0,4}from )?(?:these|our|(?:any )?(?:future|further)) (?:(?:e|ad)?-?m(?:ail(?:ing)?|es+[age]{3})|alert|PSA|marketing|notice)[- ]?(?:ad|update)?s?\b/i
7054
7055 header     __ENVFROM_AMAZONSES         EnvelopeFrom =~ /\@amazonses\.com$/
7056
7057 header     __ENVFROM_GOOG_TRIX         EnvelopeFrom =~ /(?:@|=)trix\.bounces\.google\.com(?:$|=)/
7058
7059 meta       __ENVFROM_GOOG_TRIX_SPAMMY  __ENVFROM_GOOG_TRIX && (__GOOGLE_DOC_SUSP || FREEMAIL_REPLYTO_END_DIGIT || __ADVANCE_FEE_2_NEW || FORGED_GMAIL_RCVD || LOTS_OF_MONEY || __HAS_X_SOURCE_DIR )
7060
7061 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
7062         meta         __EXE_ATTACH        0
7063 endif
7064
7065 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
7066         mimeheader   __EXE_ATTACH        Content-Type =~ /\.exe\b/i
7067 endif
7068
7069 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7070   body           __EXPLOSIVE_DEVICE     /\b(?:explosive\sdevice|bomb)\b/i
7071 endif
7072
7073 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7074   body           __EXPLOSIVE_DEVICE     /(?:^|\s)(?:<E><X><P><L><O><S><I><V><E>\s<D><E><V><I><C><E>|<B><O><M><B>)\s/i
7075 endif
7076
7077 meta           __EXTORT_MANY          (__MY_MALWARE + __PAY_ME + __MY_VICTIM + __YOUR_WEBCAM + __YOUR_ONAN + __YOUR_PERSONAL + __HOURS_DEADLINE + __YOUR_PASSWORD + LOCALPART_IN_SUBJECT + __DESTROY_ME + __DESTROY_YOU + __EXPLOSIVE_DEVICE + __PAXFUL + __HUSH_HUSH) > 3
7078
7079 body     __EX_CUSTOMER    /\b(?:(?:dead|deceased|late|verstorbenen|death\sof\sthe)\s(?:[ck]lient|customer|ac+ount|invest[eo]r|beneficiary|depositor|mr\.|kunde|engr?\.?)|titulaire\sdu\scompte\sest\sd(?:e|=E9|[\xe9]|[\xc3][\xa9])c(?:e|=E9|[\xe9]|[\xc3][\xa9])d(?:e|=E9|[\xe9]|[\xc3][\xa9])|invest[eo]r\sdied|(?:e|=E9|[\xe9]|[\xc3][\xa9])tranger\sd(?:e|=E9|[\xe9]|[\xc3][\xa9])c(?:e|=E9|[\xe9]|[\xc3][\xa9])d(?:e|=E9|[\xe9]|[\xc3][\xa9])|(?:[ck]lient|customer|ac+ount|invest[eo]r|beneficiary|mr\.|kunde|engr?\.?)\s(?:[a-z]{1,10}\s)?(?:dead|deceased|verstorbenen))/i
7080
7081 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7082   ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7083     body            __E_LIKE_LETTER /<lcase_e>/
7084     tflags          __E_LIKE_LETTER multiple maxhits=320
7085 endif
7086 endif
7087
7088 meta       __FACEBOOK_IMG_NOT_RCVD_FB  __URI_IMG_FACEBOOK && !__HDR_RCVD_FACEBOOK
7089
7090 body        __FAILED_LOGINS      /unsuc+es+ful log-?[io]n at+empts/i
7091
7092 body        __FBI_BODY_SHOUT_1   /^FEDERAL BUREAU OF INVESTIGATIONS?\b/
7093
7094 rawbody     __FBI_BODY_SHOUT_2   /^FEDERAL BUREAU OF INVESTIGATIONS?\b/m
7095
7096 header      __FBI_FM_DOM         From:addr =~ /\bfbi\.gov$/
7097
7098 header      __FBI_FM_NAME        From:name =~ /federal\sbureau\sof\sinvestigation/i
7099
7100 header      __FBI_RCVD_DOM       X-Spam-Relays-External =~ / rdns=\S+\bfbi\.gov /
7101
7102 meta        __FBI_SPOOF          (__FBI_FM_NAME || __FBI_FM_DOM || __FBI_BODY_SHOUT_1 || __FBI_BODY_SHOUT_2) && !__FBI_RCVD_DOM && __HAS_REPLY_TO
7103
7104 body        __FB_COST          /\bcost\b/i
7105
7106 body        __FB_NUM_PERCNT    /\d\s?\%/
7107
7108 body        __FB_S_PRICE       /pri{1,2}c[a-z]?e/i
7109
7110 body        __FB_S_STOCK       /\bstock/i
7111
7112 body        __FB_TOUR          /\btour/i
7113
7114 body     __FEES           /\b(?:security|safe\w*|courier|registration|pay|paid|up-?front|processing|delivery|transfer|keeping)[\s\w]{0,15}\s(?:fee|charge)s?\b/i
7115
7116 body     __FIFTY_FIFTY    /\b(?:50|fifty)(?:%?[\/:]50%?|%|\spercent)/i
7117
7118 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7119   meta     __FILL_THIS_FORM               0
7120 endif
7121
7122 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7123   meta     __FILL_THIS_FORM               (__FILL_THIS_FORM_LONG || __FILL_THIS_FORM_PARTIAL > 4 || __FILL_THIS_FORM_PARTIAL_RAW > 4)
7124 endif
7125
7126 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7127   meta     __FILL_THIS_FORM_FRAUD_PHISH   0
7128 endif
7129
7130 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7131   meta     __FILL_THIS_FORM_FRAUD_PHISH   (__FILL_THIS_FORM || __FILL_THIS_FORM_SHORT) && (__FILL_THIS_FORM_FRAUD_PHISH1 || __EMAIL_PHISH || __ACCT_PHISH)
7132 endif
7133
7134 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7135   meta     __FILL_THIS_FORM_FRAUD_PHISH1  0
7136 endif
7137
7138 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7139   body     __FILL_THIS_FORM_FRAUD_PHISH1   /<FF_YOUR>(?:<FF_F1>|<FF_F2>|<FF_F3>|<FF_F4>|<FF_F5>)<FF_SUFFIX>(?:<FF_BLANK1>|<FF_BLANK2>$)/i
7140 endif
7141
7142 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7143   meta     __FILL_THIS_FORM_LOAN          0
7144 endif
7145
7146 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7147   meta     __FILL_THIS_FORM_LOAN          __FILL_THIS_FORM && __FILL_THIS_FORM_LOAN1
7148 endif
7149
7150 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7151   meta     __FILL_THIS_FORM_LOAN1         0
7152 endif
7153
7154 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7155   body     __FILL_THIS_FORM_LOAN1         /<FF_YOUR><FF_L1><FF_SUFFIX>(?:<FF_BLANK1>|<FF_BLANK2>$)/i
7156 endif
7157
7158 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7159   meta     __FILL_THIS_FORM_LONG          0
7160 endif
7161
7162 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7163   meta     __FILL_THIS_FORM_LONG          __FILL_THIS_FORM_LONG1 || __FILL_THIS_FORM_LONG2
7164 endif
7165
7166 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7167   meta     __FILL_THIS_FORM_LONG1         0
7168 endif
7169
7170 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7171   body     __FILL_THIS_FORM_LONG1         /(?:<FF_LNNO><FF_YOUR><FF_ALL><FF_SUFFIX>(?:<FF_BLANK2>(?:P[a-z\.\s]{10,30})?|<ANDOR>)){5}/i
7172 endif
7173
7174 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7175   meta     __FILL_THIS_FORM_LONG2         0
7176 endif
7177
7178 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7179   body     __FILL_THIS_FORM_LONG2         /(?:<FF_YOUR><FF_ALL><FF_SUFFIX>(?:<FF_BLANK2>(?:P[a-z\.\s]{10,30})?|<ANDOR>)){5}/i
7180 endif
7181
7182 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7183   meta     __FILL_THIS_FORM_PARTIAL       0
7184 endif
7185
7186 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7187   body     __FILL_THIS_FORM_PARTIAL       /^\s?<FF_LNNO>?<FF_YOUR>(?:<FF_ALL><ANDOR>?){1,3}<FF_SUFFIX>(?:<FF_BLANK1>|(?:[-=_.,:;*\s]|=20){1,4}$)/im
7188   tflags   __FILL_THIS_FORM_PARTIAL       multiple maxhits=5
7189 endif
7190
7191 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7192   meta     __FILL_THIS_FORM_PARTIAL_RAW   0
7193 endif
7194
7195 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7196   rawbody  __FILL_THIS_FORM_PARTIAL_RAW   /^(?>\s{0,50})<FF_LNNO>?<FF_YOUR>(?:<FF_ALL><ANDOR>?){1,3}<FF_SUFFIX>(?:<FF_BLANK1>|(?:[-=_.,:;*\s]|=20|&nbsp;|<\/\w+>){0,4}$)/im
7197   tflags   __FILL_THIS_FORM_PARTIAL_RAW   multiple maxhits=5
7198 endif
7199
7200 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7201   meta     __FILL_THIS_FORM_SHORT         0
7202 endif
7203
7204 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7205   meta     __FILL_THIS_FORM_SHORT         !__FILL_THIS_FORM && (__FILL_THIS_FORM_SHORT1 || __FILL_THIS_FORM_SHORT2 || __FILL_THIS_FORM_PARTIAL > 2 || __FILL_THIS_FORM_PARTIAL_RAW > 2)
7206 endif
7207
7208 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7209   meta     __FILL_THIS_FORM_SHORT1        0
7210 endif
7211
7212 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7213   body     __FILL_THIS_FORM_SHORT1        /(?:<FF_LNNO><FF_YOUR><FF_ALL><FF_SUFFIX>(?:<FF_BLANK2>|<ANDOR>)){3}/i
7214 endif
7215
7216 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7217   meta     __FILL_THIS_FORM_SHORT2        0
7218 endif
7219
7220 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7221   body     __FILL_THIS_FORM_SHORT2        /(?:<FF_YOUR><FF_ALL><FF_SUFFIX>(?:<FF_BLANK2>|<ANDOR>)){3}/i
7222 endif
7223
7224 header         __FLASHMAIL_MUA     X-Mailer =~ /^NetEase Flash Mail \d/
7225
7226 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7227         meta        __FM_MY_PRICE      __FB_S_PRICE
7228 endif
7229
7230 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7231         meta        __FM_MY_PRICE      (__FB_S_PRICE || __FRT_PRICE)
7232 endif
7233
7234 meta           __FM_TO_ALL_NUMS     __FROM_ALL_NUMS && __TO_ALL_NUMS
7235
7236 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7237   rawbody   __FONT_INVIS                  /<(?!style)[a-z]+\s[^>]{1,80}(?:font(?:-size)?\s*:\s*(?:0*[01](?:\.\d+)?(?:px|pt|Q|vw|vh|vmin)|0+(?:\.\d+)?(?:cm|mm|pc|ch|rem|lh|vmax|%)|0+(?:\.0\d*)(?:em|ex|in))(?:\s[a-z]|\s*[;'])|['"\s;]color\s*:\s*transparent\s*[;'])[^>]{0,80}>\w/i
7238   tflags    __FONT_INVIS                  multiple maxhits=11
7239 endif
7240
7241 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7242   meta      __FONT_INVIS_10               __FONT_INVIS > 10
7243 endif
7244
7245 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7246   meta      __FONT_INVIS_2                __FONT_INVIS > 2
7247 endif
7248
7249 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7250   meta      __FONT_INVIS_5                __FONT_INVIS > 5
7251 endif
7252
7253 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7254   meta      __FONT_INVIS_CENTER           __FONT_INVIS && __TAG_EXISTS_CENTER
7255 endif
7256
7257 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7258   meta      __FONT_INVIS_DIRECT           __FONT_INVIS && __DOS_DIRECT_TO_MX_UNTRUSTED
7259 endif
7260
7261 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7262   meta      __FONT_INVIS_DOTGOV           __FONT_INVIS && __URI_DOTGOV
7263 endif
7264
7265 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7266   meta      __FONT_INVIS_HTML_NOHTML      __FONT_INVIS && HTML_MIME_NO_HTML_TAG
7267 endif
7268
7269 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7270   meta      __FONT_INVIS_LONG_LINE        __FONT_INVIS && __LONGLINE
7271 endif
7272
7273 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7274   meta      __FONT_INVIS_MANY             __FONT_INVIS_2
7275 endif
7276
7277 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7278   meta      __FONT_INVIS_MSGID            __FONT_INVIS && __MSGID_OK_HOST
7279 endif
7280
7281 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7282   meta      __FONT_INVIS_NORDNS           __FONT_INVIS && __RDNS_NONE
7283 endif
7284
7285 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7286   meta      __FONT_INVIS_SINGLET          __FONT_INVIS && __HTML_SINGLET
7287 endif
7288
7289 header       __FORGED_MUA_POSTFIX0      User-Agent =~ /Postfix/
7290
7291 header       __FORGED_MUA_POSTFIX1      X-Mailer =~ /Postfix/
7292
7293 header __FORGED_RELAY_MUA_TO_MX       X-Spam-Relays-External =~ /^\[ ip=(?!127)([\d.]+) [^\[]*\[ ip=\1 [^\[]+ helo=(!(?!(?:10|127|169\.254|172\.(?:1[6-9]|2[0-9]|3[01])|192\.168)\.)| )[^\[]+$/
7294
7295 meta       __FORGED_TBIRD_IMG      __MUA_TBIRD && __JPEG_ATTACH && __MIME_BDRY_0D0D
7296 describe   __FORGED_TBIRD_IMG      Possibly forged Thunderbird image spam
7297
7298 meta     __FORM_FRAUD     (__FILL_THIS_FORM || __FILL_THIS_FORM_SHORT) && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH +  __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX +  __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 1)
7299
7300 meta     __FORM_FRAUD_3  (__FILL_THIS_FORM || __FILL_THIS_FORM_SHORT) && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH +  __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX +  __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 3)
7301
7302 meta     __FORM_FRAUD_5  (__FILL_THIS_FORM || __FILL_THIS_FORM_SHORT) && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH +  __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX +  __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 5)
7303
7304 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7305   body        __FOR_SALE_LTP            /00\.? (?:less 10%|LTP)/i
7306   tflags      __FOR_SALE_LTP            multiple maxhits=11
7307 endif
7308
7309 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7310   meta        __FOR_SALE_LTP_MANY       __FOR_SALE_LTP > 10
7311 endif
7312
7313 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7314   body        __FOR_SALE_NET            /00\.? NET/i
7315   tflags      __FOR_SALE_NET            multiple maxhits=11
7316 endif
7317
7318 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7319   meta        __FOR_SALE_NET_MANY       __FOR_SALE_NET > 10
7320 endif
7321
7322 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7323   body        __FOR_SALE_OBO            /\bor best offer\b/i
7324   tflags      __FOR_SALE_OBO            multiple maxhits=6
7325 endif
7326
7327 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7328   meta        __FOR_SALE_OBO_MANY       __FOR_SALE_OBO > 5
7329 endif
7330
7331 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7332   body        __FOR_SALE_PRC_100K       /\bprice:? \$\d\d\d,\d\d\d/i
7333   tflags      __FOR_SALE_PRC_100K       multiple maxhits=11
7334 endif
7335
7336 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7337   meta        __FOR_SALE_PRC_100K_MANY  __FOR_SALE_PRC_100K > 5
7338 endif
7339
7340 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7341   body        __FOR_SALE_PRC_10K        /\bprice:? \$\d\d,\d\d\d/i
7342   tflags      __FOR_SALE_PRC_10K        multiple maxhits=11
7343 endif
7344
7345 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7346   meta        __FOR_SALE_PRC_10K_MANY   __FOR_SALE_PRC_10K > 10
7347 endif
7348
7349 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7350   body        __FOR_SALE_PRC_1K         /\bprice:? \$\d,?\d\d\d[.\s]/i
7351   tflags      __FOR_SALE_PRC_1K         multiple maxhits=11
7352 endif
7353
7354 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7355   meta        __FOR_SALE_PRC_1K_MANY    __FOR_SALE_PRC_1K > 10
7356 endif
7357
7358 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7359   rawbody     __FOR_SALE_PRC_EOL        /\s\$\d{1,3},\d00(?:\.00)?$/m
7360   tflags      __FOR_SALE_PRC_EOL        multiple maxhits=11
7361 endif
7362
7363 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7364   meta        __FOR_SALE_PRC_EOL_MANY   __FOR_SALE_PRC_EOL > 10
7365 endif
7366
7367 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7368   meta        __FOR_SALE_PRC_MANY       (__FOR_SALE_PRC_1K + __FOR_SALE_PRC_10K + __FOR_SALE_PRC_100K) > 20
7369 endif
7370
7371 body     __FOUND_YOU      /\b(?:I|we)\sfound\syour?\b/i
7372
7373 body     __FRAUD          /\b(?:de)?fraud/i
7374
7375 body __FRAUD_IOV        /\b(?:no risks?|risky?[- ]{0,3}free|free of risks?|100% safe|v\S{1,3}llig Risikofrei ist)\b/i
7376
7377 body __FRAUD_PTX        /\b(?:ass?ass?inat(?:ed|ion)|murder(?:e?d)?|poison(?:e?d)?|kill(?:ed|ing|ers)\b[^.]{0,99}\b(?:war veterans|rebels?)|les tueurs)\b/i
7378
7379 body __FRAUD_XWW        /\b(?:honest(?:ly)?\sco(?:-?operat(?:e|ion)|llaborat(?:e|ion))|ehrliche\szusammenarbeit|sichere [kc]o+p[eo]ration|col+aboration\swith\sme)\b/i
7380
7381 ifplugin Mail::SpamAssassin::Plugin::FreeMail
7382   header   __FREEMAIL_DISPTO   eval:check_freemail_header('Disposition-Notification-To')
7383 endif
7384
7385 ifplugin Mail::SpamAssassin::Plugin::FreeMail
7386   meta         __FREEMAIL_DOC_PDF     (__DOC_ATTACH || __PDF_ATTACH) && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
7387 endif
7388
7389 meta       __FREEMAIL_WFH_01           (FREEMAIL_FROM || FREEMAIL_REPLYTO) && __WFH_01
7390
7391 meta       __FREEM_FRNUM_UNICD_EMPTY  FREEMAIL_FROM && __FROM_ALL_NUMS && __FROM_ENCODED_B64 && __SUBJECT_ENCODED_B64 && __EMPTY_BODY
7392
7393 if !plugin(Mail::SpamAssassin::Plugin::FreeMail)
7394   meta         __FROM_41_FREEMAIL         0
7395 endif
7396
7397 ifplugin Mail::SpamAssassin::Plugin::FreeMail
7398   meta         __FROM_41_FREEMAIL         (__NSL_ORIG_FROM_41 || __NSL_RCVD_FROM_41) && (FREEMAIL_FROM || FREEMAIL_REPLYTO) && !__THREADED
7399   describe     __FROM_41_FREEMAIL         Sent from Africa + freemail provider
7400 endif
7401
7402 if (version >= 3.004002)
7403 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
7404 header   __FROM_ADDRLIST_BANKS eval:check_from_in_list('BANKS')
7405 endif
7406 endif
7407
7408 if (version >= 3.004002)
7409 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
7410 header   __FROM_ADDRLIST_GOV eval:check_from_in_list('GOV')
7411 endif
7412 endif
7413
7414 if (version >= 3.004002)
7415 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
7416 header   __FROM_ADDRLIST_PAYPAL eval:check_from_in_list('PAYPAL')
7417 endif
7418 endif
7419
7420 if (version >= 3.004002)
7421 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
7422 header   __FROM_ADDRLIST_SUSPNTLD eval:check_from_in_list('SUSP_NTLD')
7423 endif
7424 endif
7425
7426 header     __FROM_ADDR_GMAIL           From:addr =~ /\@gmail\.com>?$/i
7427
7428 header     __FROM_ADDR_WS              From:addr =~ /\s/
7429
7430 header      __FROM_ADMIN         From =~ /\b(?:(?:sys)?admin(?:istrator)?|server|service|support)\b/i
7431
7432 header __FROM_ALL_HEX       From:addr =~ /^(?!(?:19|20)\d\d[01]\d[0-3]\d)(?![0-9a-f]*[a-f]{3})[0-9a-f]+\@/
7433
7434 header         __FROM_ALL_NUMS      From:addr =~ /^\d+@/
7435
7436 header   __FROM_DNS             From =~ /(?<![^\w.-])dns(?:admin)?\@/i
7437
7438 meta        __FROM_DOM_ADMIN     __FROM_ADMIN && __PDS_FROM_NAME_TO_DOMAIN
7439
7440 header      __FROM_DOM_INFO    From:addr =~ /\.info$/i
7441
7442 header __FROM_EBAY      From:addr =~ /\@ebay\.com$/i
7443
7444 header         __FROM_EQ_ORG_1       ALL =~ /\nFrom: "?([^\n]+)"? <[^>]+>\n.*Organization: \1\n/ism
7445
7446 ifplugin Mail::SpamAssassin::Plugin::FreeMail
7447   ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
7448     header   __FROM_EQ_REPLY            eval:check_fromname_equals_replyto()
7449 endif
7450 endif
7451
7452 if (version >= 3.004001)
7453 ifplugin Mail::SpamAssassin::Plugin::AskDNS
7454 tflags     __FROM_FMBLA_NDBLOCKED net
7455 endif
7456 endif
7457
7458 if (version >= 3.004001)
7459 ifplugin Mail::SpamAssassin::Plugin::AskDNS
7460 tflags     __FROM_FMBLA_NEWDOM    net
7461 endif
7462 endif
7463
7464 if (version >= 3.004001)
7465 ifplugin Mail::SpamAssassin::Plugin::AskDNS
7466 tflags     __FROM_FMBLA_NEWDOM14  net
7467 endif
7468 endif
7469
7470 if (version >= 3.004001)
7471 ifplugin Mail::SpamAssassin::Plugin::AskDNS
7472 tflags     __FROM_FMBLA_NEWDOM28  net
7473 endif
7474 endif
7475
7476 header   __FROM_FULL_NAME       From:name =~ /^[^a-z[:punct:][:cntrl:]\d\s][^[:punct:][:cntrl:]\d\s]*[[:punct:]\s]+[^a-z[:punct:][:cntrl:]\d\s]/
7477 tflags   __FROM_FULL_NAME       nice
7478
7479 header   __FROM_INFO            From =~ /(?<![^\w.-])info\@/i
7480
7481 header      __FROM_LOWER       ALL =~ /from:\s\S{5}/
7482
7483 header         __FROM_MISSPACED      From =~ /^\s*"[^"]*"</
7484
7485 meta           __FROM_MISSP_EH_MATCH __FROM_RUNON_UNCODED && __LCL__ENV_AND_HDR_FROM_MATCH
7486
7487 if !plugin(Mail::SpamAssassin::Plugin::FreeMail)
7488   meta         __FROM_MISSP_FREEMAIL 0
7489 endif
7490
7491 ifplugin Mail::SpamAssassin::Plugin::FreeMail
7492   meta         __FROM_MISSP_FREEMAIL __FROM_RUNON && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
7493 endif
7494
7495 meta           __FROM_MISSP_REPLYTO  __FROM_RUNON && __HAS_REPLY_TO
7496
7497 if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
7498   meta       __FROM_MULTI_NORDNS      __PDS_FROM_2_EMAILS && __RDNS_NONE
7499 endif
7500
7501 if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
7502   meta       __FROM_MULTI_SHORT_IMG   __PDS_FROM_2_EMAILS && (HTML_IMAGE_ONLY_16 || HTML_SHORT_LINK_IMG_2 || __HTML_IMG_ONLY)
7503 endif
7504
7505 header     __FROM_NAME_APPLECOM        From:name =~ /\bapple\.com\b/i
7506
7507 header     __FROM_NAME_EBAYCOM         From:name =~ /\bebay\.com\b/i
7508
7509 full       __FROM_NAME_IN_MSG         /^From:\s+([^<]\S+\s\S+)\s(?=.{1,2048}^\1\r?$)/sm
7510
7511 header     __FROM_NAME_PAYPALCOM       From:name =~ /\bpaypal\.com\b/i
7512
7513 header __FROM_PAYPAL    From:addr =~ /\@paypal\.com$/i
7514
7515 header         __FROM_RUNON          From =~ /\S+<\w+/
7516
7517 header         __FROM_RUNON_UNCODED  From:raw =~ /\S+(?<!\?=)<\w+/
7518
7519 header __FROM_WEB_DAEMON From:addr =~ /(?:apache|www|web|tomcat|\biis\b).*\@/i
7520
7521 header     __FROM_WORDY                From:addr =~ /^(?:(?:[A-Z][A-Za-z]+|or|&)\.)+[A-Z][A-Za-z]+\@/
7522
7523 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7524         meta        __FRT_PRICE        0
7525 endif
7526
7527 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7528         body        __FRT_PRICE        /<inter SP2><post P2>\b(?!price)<P><R><IX><C><E>\b/i
7529 endif
7530
7531 rawbody     __FR_SPACING_8     /[a-z0-9]{6}\s{8}[a-z0-9]{5}/i
7532
7533 header   __FSL_HAS_LIST_UNSUB  exists:List-Unsubscribe
7534
7535 header  __FSL_HELO_BARE_IP_1      X-Spam-Relays-External =~ /^[^\]]+ helo=(?!127)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} [^\]]*auth= /i
7536
7537 header  __FSL_HELO_BARE_IP_2    X-Spam-Relays-Untrusted =~ /helo=(?!127)\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} /i
7538
7539 header  __FSL_HELO_USER_1   X-Spam-Relays-External =~ / helo=user /i
7540
7541 header  __FSL_HELO_USER_2   Received =~ /from User(?:\s+by|\s*[\[\(]|$)/i
7542
7543 header  __FSL_HELO_USER_3   Received =~ /(?:eh|he)lo(?:=|\s)User\)/i
7544
7545 header   __FSL_RELAY_GOOGLE     X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.google\.com\.? /i
7546
7547 header      __FS_SUBJ_RE       Subject =~ /^Re: /
7548
7549 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7550   body          __FUZZY_DR_OZ       /(?=<D>)(?!(?-i:D(?:r.|octor)(?:\s|&nbsp;)Oz))(?:<R>|<O><C>(?:<T><O><R>)?)\.?<WS>*<O><Z>(?:$|\W)/i
7551 endif
7552
7553 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7554   meta          __FUZZY_MONERO      0
7555 endif
7556
7557 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7558   body          __FUZZY_MONERO      /(?=<M>)(?!monero)<M><O><N><E><R><O>/i
7559 endif
7560
7561 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7562   body          __FUZZY_PORN        /(?=<P>)(?!pornograph?(?:y|i[ca]|er))<P><O><R><N><O><G><R><A><P><H>?(?:<Y>|<I><C>|<E><R>)/i
7563 endif
7564
7565 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7566   body          __FUZZY_WELLSFARGO_BODY  /(?=<W>)(?!Wells[-\s]?Fargo)<W><E><L><L><S>[-\s]?<F><A><R><G><O>/i
7567 endif
7568
7569 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7570   header        __FUZZY_WELLSFARGO_FROM  From:name =~ /(?=<W>)(?!Wells[-\s]?Fargo)<W><E><L><L><S>[-\s]?<F><A><R><G><O>/i
7571 endif
7572
7573 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7574   body       __GAPPY_SALES_LEADS         /\b(?:business|e?-?mail|your|marketing|advertising)\s(?!sales|leads|campaign)(?:s\s?a\s?l\s?e\s?s|l\s?e\s?a\s?d\s?s|c\s?a\s?m\s?p\s?a\s?i\s?g\s?n)\b/i
7575   tflags     __GAPPY_SALES_LEADS         multiple maxhits=3
7576 endif
7577
7578 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7579   meta       __GAPPY_SALES_LEADS_MANY    __GAPPY_SALES_LEADS > 2
7580 endif
7581
7582 meta     __GB_BITCOIN_CP_DE   ( __BITCOIN_ID && !__URL_BTC_ID && __COPY_PASTE_DE )
7583 describe __GB_BITCOIN_CP_DE   German Bitcoin scam
7584
7585 meta     __GB_BITCOIN_CP_EN   ( __BITCOIN_ID && !__URL_BTC_ID && __COPY_PASTE_EN )
7586 describe __GB_BITCOIN_CP_EN   English Bitcoin scam
7587
7588 meta     __GB_BITCOIN_CP_ES   ( __BITCOIN_ID && !__URL_BTC_ID && __COPY_PASTE_ES )
7589 describe __GB_BITCOIN_CP_ES   Spanish Bitcoin scam
7590
7591 meta     __GB_BITCOIN_CP_FR   ( __BITCOIN_ID && !__URL_BTC_ID && __COPY_PASTE_FR )
7592 describe __GB_BITCOIN_CP_FR   French Bitcoin scam
7593
7594 meta     __GB_BITCOIN_CP_IT   ( __BITCOIN_ID && !__URL_BTC_ID && __COPY_PASTE_IT )
7595 describe __GB_BITCOIN_CP_IT   Italian Bitcoin scam
7596
7597 meta     __GB_BITCOIN_CP_NL   ( __BITCOIN_ID && !__URL_BTC_ID && __COPY_PASTE_NL )
7598 describe __GB_BITCOIN_CP_NL   Dutch Bitcoin scam
7599
7600 meta     __GB_BITCOIN_CP_SE   ( __BITCOIN_ID && !__URL_BTC_ID && __COPY_PASTE_SE )
7601 describe __GB_BITCOIN_CP_SE   Swedish Bitcoin scam
7602
7603 if (version >= 4.000000)
7604 if can(Mail::SpamAssassin::Conf::feature_capture_rules)
7605   uri           __GB_CUSTOM_HTM_URI0    m;^https?://.{10,128}(?:\.html?|\.php|\/)(?:\#|\?&e=)%{GB_TO_ADDR};i
7606 endif
7607 endif
7608
7609 if (version >= 4.000000)
7610 if can(Mail::SpamAssassin::Conf::feature_capture_rules)
7611   uri           __GB_CUSTOM_HTM_URI1    m|^https?://.{10,64}\=https?://.{4,64}\#%{GB_TO_ADDR}|i
7612 endif
7613 endif
7614
7615 if (version >= 4.000000)
7616 if can(Mail::SpamAssassin::Conf::feature_capture_rules)
7617   uri           __GB_CUSTOM_HTM_URI2    m;^https?://.{10,256}(?:\/\?)?(?:email=|wapp\#)%{GB_TO_ADDR};i
7618 endif
7619 endif
7620
7621 if (version >= 4.000000)
7622 if can(Mail::SpamAssassin::Conf::feature_capture_rules)
7623   uri           __GB_DRUPAL_URI         m|^https?://.{10,64}/default/files/(?:\@)?\#%{GB_TO_ADDR}|i
7624 endif
7625 endif
7626
7627 header     __GB_FAKE_RF                  Subject =~ /(Fw|Re)\:{1,2}[\W+]/i
7628
7629 if (version >= 4.000000)
7630 if can(Mail::SpamAssassin::Conf::feature_capture_rules)
7631   header        __GB_TO_ADDR            To:addr =~ /(?<GB_TO_ADDR>.*)/
7632 endif
7633 endif
7634
7635 body     __GHANA          /\bghana\b/i
7636
7637 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
7638 mimeheader __GIF_ATTACH Content-Type =~ /^image\/gif\b/i
7639 endif
7640
7641 body     __GIVE_MONEY     /\b(?:(?:give\syou\s(?:this\s)?(?:money|fund|inheritance))|(?:donated?\s(?:\w\+\s){0,3}(?:the\ssum\sof|(?:(?:the|this|some)\s(?:money|funds?|inheritance)|to\s)(?:you|(?:(?:the|a)\s)?church|charit(?:y|ies)|humanit\w+|needy|poor|orphan(?:age)?s?|philanthropists\?)))|de vous donner cet argent|faire don de la somme|voudrais en faire don|tego funduszu do dom(?:=F3|[\xf3])w (?:dziecka|wdowy))\b/i
7642
7643 meta        __GOOGLE_DOCS_PHISH_1  __URI_GOOGLE_DOC && (__TVD_PH_SUBJ_META || __TVD_PH_BODY_META || __TVD_PH_BODY_ACCOUNTS_PRE || __TVD_PH_BODY_ACCOUNTS_POST)
7644
7645 meta        __GOOGLE_DOCS_PHISH_2  __URI_GOOGLE_DOC && (__EMAIL_PHISH || __ACCT_PHISH) && !__EMAIL_PHISH_MANY && !__ACCT_PHISH_MANY
7646
7647 meta        __GOOGLE_DOC_SUSP    __URI_GOOGLE_DOC && (__HAS_DOMAINKEY_SIG || __RDNS_NONE || __SYSADMIN || __STY_INVIS || LOTS_OF_MONEY || __XFER_MONEY || __ADVANCE_FEE_2_NEW) && !ALL_TRUSTED
7648
7649 uri       __GOOG_MALWARE_DNLD           m;^https?://[^/]*\.google\.com/[^?]*url\?.*[\?&/]download;i
7650
7651 uri       __GOOG_REDIR                  m;^https?://[^/]*\.google\.com/url\?;i
7652
7653 meta        __GOOG_STO_HTML_PHISH     __URI_GOOG_STO_HTML && (__EMAIL_PHISH || __ACCT_PHISH) && !__EMAIL_PHISH_MANY && !__ACCT_PHISH_MANY
7654
7655 meta       __GOOG_STO_IMG_HTML_1      __URI_GOOG_STO_IMG && __URI_GOOG_STO_HTML
7656
7657 meta       __GOOG_STO_IMG_NOHTML      __URI_GOOG_STO_IMG && !__URI_GOOG_STO_HTML
7658
7659 meta       __GOOG_STO_NOIMG_HTML      !__URI_GOOG_STO_IMG && __URI_GOOG_STO_HTML
7660
7661 body __HAS_ANY_EMAIL /\w@\S+\.\w/
7662
7663 uri __HAS_ANY_URI   /^\w+:\/\//
7664
7665 header     __HAS_CAMPAIGNID            exists:X-Campaignid
7666
7667 header     __HAS_CID                   exists:X-CID
7668
7669 header     __HAS_COMPLAINT_TO          exists:Complaint-To
7670
7671 header     __HAS_DOMAINKEY_SIG         exists:DomainKey-Signature
7672
7673 describe        __HAS_HREF      Has an anchor tag with a href attribute in non-quoted line
7674 rawbody         __HAS_HREF      /^[^>].*?<a href=/im
7675 tflags          __HAS_HREF      multiple maxhits=100
7676
7677 describe        __HAS_HREF_ONECASE      Has an anchor tag with a href attribute in non-quoted line with consistent case
7678 rawbody         __HAS_HREF_ONECASE      /^[^>].*?<(a href|A HREF)=/m
7679 tflags          __HAS_HREF_ONECASE      multiple maxhits=100
7680
7681 describe        __HAS_IMG_SRC   Has an img tag on a non-quoted line
7682 rawbody         __HAS_IMG_SRC   /^[^>].*?<img src=/im
7683 tflags          __HAS_IMG_SRC   multiple maxhits=100
7684
7685 rawbody  __HAS_IMG_SRC_DATA  /^[^>].*?<img src=['"]data/im
7686
7687 describe        __HAS_IMG_SRC_ONECASE   Has an img tag on a non-quoted line with consistent case
7688 rawbody         __HAS_IMG_SRC_ONECASE   /^[^>].*?<(img src|IMG SRC)=/m
7689 tflags          __HAS_IMG_SRC_ONECASE   multiple maxhits=100
7690
7691 header     __HAS_LIST_OPEN             exists:List-Open
7692
7693 header     __HAS_LOGID                 exists:logid
7694
7695 header     __HAS_MESSAGEID             exists:MessageID
7696
7697 header     __HAS_PHP_ORIG_SCRIPT       exists:X-PHP-Originating-Script
7698
7699 header     __HAS_PHP_SCRIPT            exists:X-PHP-Script
7700
7701 header __HAS_THREAD_INDEX  exists:Thread-Index
7702
7703 header     __HAS_TRACKING_CODE         exists:Tracking-Code
7704
7705 body     __HAS_WON_01    /\bque ha ganado\b/i
7706
7707 header     __HAS_XM_LID                exists:X-Mailer-LID
7708
7709 header     __HAS_XM_RECPTID            exists:X-Mailer-RecptId
7710
7711 header     __HAS_XM_SENTBY             exists:X-Mailer-Sent-By
7712
7713 header     __HAS_XM_SID                exists:X-Mailer-SID
7714
7715 header     __HAS_X_EBSERVER            exists:X-EBSERVER
7716
7717 header     __HAS_X_LETTER              exists:X-Letter
7718
7719 header    __HAS_X_NO_RELAY              exists:X-No-Relay
7720
7721 header     __HAS_X_OUTGOING_SPAM_STAT  exists:X-OutGoing-Spam-Status
7722
7723 header     __HAS_X_SENDER              exists:X-Sender
7724
7725 header     __HAS_X_SOURCE_DIR          exists:X-Source-Dir
7726
7727 header         __HDRS_LCASE          ALL =~ /\n(?:Message-id|Content-type|X-MSMail-priority|from|subject|to|cc|Disposition-notification-to):/sm
7728 tflags         __HDRS_LCASE          multiple maxhits=3
7729
7730 meta           __HDRS_LCASE_KNOWN    __MSGID_JAVAMAIL || __UA_MSOEMAC || __UA_MSOMAC || __MSGID_APPLEMAIL || __MSGID_HEX_UID || __MSGID_HEXISH
7731
7732 header         __HDRS_MISSP          ALL:raw =~ /^(?:Subject|From|To|Reply-To):\S/ism
7733
7734 header     __HDR_CASE_REVERSED         ALL =~ /^(?!DomainKey)[^-:\s]*[a-z][A-Z]/m
7735 tflags     __HDR_CASE_REVERSED         multiple maxhits=4
7736
7737 header     __HDR_ENVFROM_SHOPIFY       X-Spam-Relays-External =~ /\shelo=\S+\.mailer\.shopify\.com\s(?:[^\]\s]+\s)*envfrom=\S+\.shopifyemail\.com\s/
7738
7739 header __HDR_ORDER_FTSDMCXXXX ALL =~ /\nFrom: .{1,80}?\nTo: .{1,80}?\nSubject: .{1,200}?\nDate: .{1,40}?\nMIME-Version: .{1,40}?\nContent-Type: .{1,120}?\nX-Priority: .{1,40}?\nX-MSMail-Priority: .{1,40}?\nX-Mailer: .{1,80}?\nX-MimeOLE:/s
7740
7741 header     __HDR_RCVD_ALIBABA          X-Spam-Relays-External =~ /\srdns=\S+\.alibaba\.com\s/
7742
7743 header     __HDR_RCVD_AMAZON           X-Spam-Relays-External =~ /\srdns=\S+\.amazon(?:ses)?\.com\s/
7744
7745 header     __HDR_RCVD_AMAZON_HELO      X-Spam-Relays-External =~ /\srdns=\shelo=[^.]+\.smtp-out\.amazonses\.com\s/
7746
7747 header     __HDR_RCVD_APPLE            X-Spam-Relays-External =~ /\srdns=\S+\.apple\.com\s/
7748
7749 header     __HDR_RCVD_BEBEE            X-Spam-Relays-External =~ /\srdns=\S+\.bebee\.com\s/
7750
7751 header     __HDR_RCVD_EBAY             X-Spam-Relays-External =~ /\srdns=\S+\.ebay\.com\s/
7752
7753 header     __HDR_RCVD_FACEBOOK         X-Spam-Relays-External =~ /\srdns=\S+\.facebook\.com\s/
7754
7755 header     __HDR_RCVD_GOOGLE           X-Spam-Relays-External =~ / rdns=mail-\S+\.google\.com\.?\s/
7756
7757 header     __HDR_RCVD_KEEPA            X-Spam-Relays-External =~ /\srdns=\S+\.keepa\.com\s/
7758
7759 header     __HDR_RCVD_LINKEDIN         X-Spam-Relays-External =~ /\srdns=\S+\.linkedin\.com\s/
7760
7761 header     __HDR_RCVD_NEWEGG           X-Spam-Relays-External =~ /\srdns=\S+\.newegg\.com\s/
7762
7763 header     __HDR_RCVD_PAYPAL           X-Spam-Relays-External =~ /\srdns=\S+\.paypal\.com\s/
7764
7765 header     __HDR_RCVD_SHOPIFY          X-Spam-Relays-External =~ /\srdns=\S+\.shopify\.com\s/
7766
7767 header     __HDR_RCVD_TAGSTAT          X-Spam-Relays-External =~ /\srdns=\S+\.tagstat\.com\s/
7768
7769 header     __HDR_RCVD_TARINGANET       X-Spam-Relays-External =~ /\srdns=\S+\.taringa\.net\s/
7770
7771 header      __HDR_RCVD_TONLINEDE       X-Spam-Relays-External =~ /\srdns=\S+\.t-online\.de\s/
7772
7773 header     __HDR_RCVD_WALMART          X-Spam-Relays-External =~ /\srdns=\S+\.walmart\.com\s/
7774
7775 ifplugin Mail::SpamAssassin::Plugin::AskDNS
7776 tflags   __HELO_DNS net
7777 endif
7778
7779 header   __HELO_HIGHPROFILE  X-Spam-Relays-External =~ /^[^\]]+ helo=\S*(?:hotmail|gmail|google|yahoo|msn|microsoft|outlook|paypal|xxx)\.[\w]+\b/i
7780
7781 header   __HELO_MISC_IP         X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[^a-z\?]\S{0,30}(?:\d{1,3}[^\d]){4}[^\]]+ auth= /i
7782
7783 header __HELO_NOT_RDNS  X-Spam-Relays-External =~ /^[^\]]+ rdns=(\S+) helo=(?!(?i)\1)\S/
7784
7785 header __HELO_NO_DOMAIN   X-Spam-Relays-External =~ /^[^\]]+ helo=[^\.]+ /
7786
7787 body        __HEXHASHWORD_S2EU /\s[A-Z]?[a-z]{1,15}\s(?![a-z]{10,20}\s)[a-z]{0,10}(?!-?\d{1,5}-)(?!\d{10}\s)(?:(?!--)[-0-9a-f]){10,64}(?:[g-z][a-z]{0,10})?\s[A-Z]?[a-z]{1,15}\b/
7788 tflags      __HEXHASHWORD_S2EU multiple maxhits=4
7789
7790 body            __HK_LOTTO_2            /\blot(?:eri[ej]|t(?:ery|o)) ?(?:(?:inter)?national|foundation|mercato|univers|euro ?million|e-?mail|euro-pw|bill ?gates|swiss|prestige|cristal|am.ricaine|coca.?cola|fiduciary|department)/i
7791
7792 body            __HK_LOTTO_BALLOT       /\b(?:promotional|on.?line|computer|internet|e-?mail|fran.aise) (?:ballot|draw|sweepstake)/i
7793
7794 body            __HK_LOTTO_STAATS       /\bstaatsloteri/i
7795
7796 ifplugin Mail::SpamAssassin::Plugin::FreeMail
7797 if (version >= 3.004000)
7798   header        __HK_NAME_FROM          From:name =~ /^FROM\b/mi
7799 endif
7800 endif
7801
7802 ifplugin Mail::SpamAssassin::Plugin::FreeMail
7803 if (version >= 3.004000)
7804   header        __HK_NAME_MR_MRS        From:name =~ /^M(?:RS?|ISS)\b/mi
7805 endif
7806 endif
7807
7808 body            __HK_SCAM_N15           /\b(?:account (?:overseas?|offshore)|(?:overseas?|offshore) account)\b/i
7809
7810 body            __HK_SCAM_N16           /\b(?:arrangement secret|secret arrangement)\b/i
7811
7812 body            __HK_SCAM_N2            /\bnext of kin\b/i
7813
7814 body            __HK_SCAM_N3            /\bdirect telephone numbers?\b/i
7815
7816 body            __HK_SCAM_N8            /\byour compensation\b/i
7817
7818 body            __HK_SCAM_S1            /pay you the sum of/i
7819
7820 body            __HK_SCAM_S15           /(?:discovered a dormant account|can you be my partner)/i
7821
7822 body            __HK_SCAM_S25           /\bbank (?:in|of) ghana/i
7823
7824 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
7825 mimeheader      __HK_SPAMMY_CDFN        Content-Disposition =~ /name=.*?(?:lot(?:eri[ej]|t(?:ery|o))|award|prize|winn(?:er|ing)|microsoft|congrat|urgent)/mi
7826 endif
7827
7828 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
7829 mimeheader      __HK_SPAMMY_CTFN        Content-Type =~ /name=.*?(?:lot(?:eri[ej]|t(?:ery|o))|award|prize|winn(?:er|ing)|microsoft|congrat|urgent)/mi
7830 endif
7831
7832 meta       __HOSTED_IMG_DIRECT_MX      __DOS_DIRECT_TO_MX && __URI_HOSTED_IMG
7833
7834 meta       __HOSTED_IMG_DQ_UNSUB       __URI_DQ_UNSUB && __URI_HOSTED_IMG
7835
7836 meta       __HOSTED_IMG_FREEM          ( FREEMAIL_REPLYTO || FREEMAIL_FROM ) && __URI_HOSTED_IMG
7837
7838 meta       __HOSTED_IMG_MULTI          ( __URI_IMG_EBAY + __URI_IMG_AMAZON + __URI_IMG_ALICDN + __URI_IMG_WALMART + __URI_IMG_NEWEGG + __URI_IMG_SHOPIFY + __URI_IMG_YTIMG + __URI_IMG_JOOMCDN + __URI_IMG_WISH + __URI_IMG_WP_REDIR + __URI_IMG_STATICBG + __URI_IMG_CHANNYPIC + __URI_IMG_TOPHATTER + __URI_IMG_GBTCDN + __URI_IMG_LINKEDIN + __URI_IMG_TUMBLR + __URI_IMG_TAGSTAT + __URI_IMG_FACEBOOK + __URI_IMG_TARINGANET + __URI_IMG_BEBEE + __URI_IMG_EFUSERASSETS + __URI_IMG_IMGBOX_THUMB + __URI_IMG_500PXORG + __URI_IMG_WIXMP + __URI_IMG_POSTIMGCC + __URI_IMG_GTRACING + __URI_IMG_JOOMCDN + __URI_IMG_DHRESOURCE) > 1
7839
7840 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
7841   body           __HOURS_DEADLINE       /\b(?:(?:give\syou|gebe\sihnen(?:\snur)?|you\s(?:will\s)?have(?:\sonly|\sjust)?|within)(?:(\sthe)?\s(?:last|next))?\s(?:\d+|one|two|three|a few)\s?(?:hours?|hr(?:\s?s)?|days?|stunden)|(?:by|to|until|before)\sthe\send\sof\sthe\s(?:work(?:ing)?\s)?day|Ich\sgebe\sIhnen\s\d+\sStunden|\d+\shours?\sbefore\s(?:sending|releasing|exposing|publishing)|(?:the|your)\sdeadline\s(?:is|will\sbe))\b/i
7842 endif
7843
7844 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
7845   body           __HOURS_DEADLINE       /(?:^|\s)(?:(?:<G><I><V><E>\s<Y><O><U>|<G><E><B><E>\s<I><H><N><E><N>(?:\s<N><U><R>)?|<Y><O><U>\s(?:<W><I><L><L>\s)?<H><A><V><E>(?:\s<O><N><L><Y>|\s<J><U><S><T>)?|<W><I><T><H><I><N>)(?:(\s<T><H><E>)?\s(?:<L><A><S><T>|<N><E><X><T>))?\s(?:\d+|<O><N><E>|<T><W><O>|<T><H><R><E><E>|<A> <F><E><W>)\s?(?:<H><O><U><R><S>?|<H><R>\s?<S>?|<D><A><Y><S>?|<S><T><U><N><D><E><N>)|(?:<B><Y>|<T><O>|<U><N><T><I><L>|<B><E><F><O><R><E>)\s<T><H><E>\s<E><N><D>\s<O><F>\s<T><H><E>\s(?:<W><O><R><K>(?:<I><N><G>)?\s)?<D><A><Y>|Ich\sgebe\sIhnen\s\d+\sStunden|\d+\s<H><O><U><R><S>?\s<B><E><F><O><R><E>\s(?:<S><E><N><D><I><N><G>|<R><E><L><E><A><S><I><N><G>|<E><X><P><O><S><I><N><G>|<P><U><B><L><I><S><H><I><N><G>)|(?:<T><H><E>|<Y><O><U><R>)\s<D><E><A><D><L><I><N><E>\s(?:<I><S>|<W><I><L><L>\s<B><E>))/i
7846 endif
7847
7848 rawbody __HS_QUOTE /^> /
7849
7850 header __HS_SUBJ_RE_FW Subject =~ /^(?i:re|fw):/
7851
7852 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
7853   meta         __HTML_ATTACH_01    0
7854 endif
7855
7856 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
7857   mimeheader   __HTML_ATTACH_01    Content-Type =~ m,\btext/html\b.+\.s?html?\b,i
7858 endif
7859
7860 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
7861   meta         __HTML_ATTACH_02    0
7862 endif
7863
7864 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
7865   mimeheader   __HTML_ATTACH_02    Content-Disposition =~ m,\bfilename="?[^"]+\.s?html?\b,i
7866 endif
7867
7868 rawbody    __HTML_ENTITY_ASCII         /(?:&\#(?:(?:\d{1,2}|1[01]\d|12[0-7])|x[0-7][0-9a-f])\s{0,64};\s{0,64}){10}/i
7869
7870 meta       __HTML_ENTITY_ASCII_MINFP   __HTML_ENTITY_ASCII && !__DKIM_EXISTS && !__RCD_RDNS_SMTP && !__RCD_RDNS_SMTP_MESSY && !__JM_REACTOR_DATE && !__HAS_ERRORS_TO && !__L_BODY_8BITS && !__RCD_RDNS_MAIL_MESSY && !__VIA_ML
7871
7872 meta       __HTML_ENTITY_ASCII_TINY    __HTML_ENTITY_ASCII && (__HTML_FONT_TINY_01 || __HTML_FONT_TINY_02 || __AC_TINY_FONT)
7873
7874 rawbody     __HTML_FONT_TINY_01      /font-size:\s{0,5}[0-4]px;/i
7875
7876 rawbody     __HTML_FONT_TINY_02      /<font\s[^>]{0,80}size\s*=\s*["']?-(?:[2-9]|[1-9]\d+)["']?[^>]{0,80}>/i
7877
7878 meta        __HTML_FONT_TINY_NORDNS  (__HTML_FONT_TINY_01 || __HTML_FONT_TINY_02 || __AC_TINY_FONT) && __RDNS_NONE
7879
7880 rawbody     __HTML_OFF_PAGE   /;(?:top|left):-\d{3,9}px;/i
7881
7882 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7883   rawbody    __HTML_SHRT_CMNT_OBFU       /\w<!--\s*\w+\s*-->\w/
7884   tflags     __HTML_SHRT_CMNT_OBFU       multiple maxhits=10
7885 endif
7886
7887 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
7888   meta       __HTML_SHRT_CMNT_OBFU_MANY  __HTML_SHRT_CMNT_OBFU > 5 && HTML_MESSAGE
7889 endif
7890
7891 rawbody   __HTML_SINGLET                />\s*(?:[a-z"]|&\#(?:\d+|x[0-9a-f]+);)\s*</i
7892 tflags    __HTML_SINGLET                multiple maxhits=21
7893
7894 meta      __HTML_SINGLET_10             __HTML_SINGLET > 10
7895
7896 meta      __HTML_SINGLET_MANY           __HTML_SINGLET > 20
7897
7898 ifplugin Mail::SpamAssassin::Plugin::HTMLEval
7899   body       __HTML_TAG_BALANCE_CENTER     eval:html_tag_balance('center', '!= 0')
7900 endif
7901
7902 body     __HUSH_HUSH      /\b(?:confiden[tc]i[ae]l(?:\b|ity\b|it(?:=E9|[\xe9]|[\xc3][\xa9]))|private\b|secr[e\xe8](?:te?|cy)\b|sensitive\b|concealed\b|obscured?\b|discre(?:et|tion)\b|very\sdiscrete|top\ssecret|vertraulich(?:en)?\b|geheim\b|priv(?:e|=E9|[\xe9]|[\xc3][\xa9]))/i
7903
7904 uri        __IMGUR_IMG                 m,^https?://(?:[^.]+\.)?imgur\.com/[a-z0-9]{7}\.(?:png|gif|jpe?g)$,i
7905 tflags     __IMGUR_IMG                 multiple maxhits=4
7906
7907 meta       __IMGUR_IMG_2               __IMGUR_IMG == 2
7908
7909 meta       __IMGUR_IMG_3               __IMGUR_IMG == 3
7910
7911 if !plugin(Mail::SpamAssassin::Plugin::ImageInfo)
7912   meta       __IMG_LE_300K           0
7913 endif
7914
7915 ifplugin Mail::SpamAssassin::Plugin::ImageInfo
7916   body       __IMG_LE_300K           eval:pixel_coverage('all',62500,300000)
7917 endif
7918
7919 body     __INHERIT_PMT    /\binheritance\spayment\s/i
7920
7921 body     __INTL_BANK      /\b(?:international\s(?:\w+\s)?bank|banque\sinternationale)\b/i
7922
7923 body     __INVEST_COUNTRY /\binvest\sin\syour?\scountry\b/i
7924
7925 body     __INVEST_MONEY   /\binvest(?:ir)?\s(?:this|ces|d[ae]s|sur ce|de ces)\s(?:money|f[ou]nds?)\b/i
7926
7927 header __IP_IN_RELAY  X-Spam-Relays-External =~ /^\[ ip=(\d+)\.(\d+)\.(\d+)\.(\d+) (?:[^\]]* )?(?:rdns|helo)=\S*(?:\1\D\2\D\3\D\4|\4\D\3\D\2\D\1)/
7928
7929 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
7930   meta         __ISO_ATTACH        0
7931 endif
7932
7933 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
7934   mimeheader   __ISO_ATTACH        Content-Disposition =~ m,\bfilename="?[^"]+\.iso[";$],i
7935 endif
7936
7937 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
7938   meta         __ISO_ATTACH_MT     0
7939 endif
7940
7941 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
7942   mimeheader   __ISO_ATTACH_MT     Content-Type =~ m,\bapplication/x-iso9660-image\b,i
7943 endif
7944
7945 body     __IS_LEGAL       /\b(?:(?:(this|esta)\s(?:deal|offer|transac[tc]i(?:o|[\xc3][\xb3])n|proposal|exchange|arrangement|work)|it)?\s[ie]s\s(?:(?:guaranteed|completely|absolutely|perfectly|100%|very|fully)\s)?(?:legal|hitch-free|seguro|legitimate)|legitimate\sarrangement|toute?\sl(?:e|=E9|[\xe9]|[\xc3][\xa9])gale)\b/i
7946
7947 body     __IVORY_COAST    /\b(?:Cote\s?D.Ivoire|Ivory\s?Coast|Costa\sde\sMarfil)\b/i
7948
7949 body     __I_INHERIT      /\b(?:I|eu)\s[a-z\s]{0,30}(?:inherited|herdei)\b/i
7950
7951 body     __I_WILL_YOU     /\bwill(?:ed)?\s(?:[a-z\s]{0,20}(?:fortune|money|\$[\d,]+[a-z]{0,9})\s)?to\syou\b/i
7952
7953 header __JM_REACTOR_DATE    Date =~ / \+0000$/
7954
7955 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
7956   mimeheader __JPEG_ATTACH           Content-Type =~ /image\/jpe?g/i
7957 endif
7958
7959 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
7960 mimeheader      __KAM_BLOCK_UTF7_2      Content-Type =~ /charset=(?:unicode-\d+-\d+-)?utf-7/i
7961 endif
7962
7963 ifplugin Mail::SpamAssassin::Plugin::BodyEval
7964   if can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length)
7965         body            __KAM_BODY_LENGTH_LT_1024       eval:check_body_length('1024')
7966         describe        __KAM_BODY_LENGTH_LT_1024       The length of the body of the email is less than 1024 bytes.
7967 endif
7968 endif
7969
7970 ifplugin Mail::SpamAssassin::Plugin::BodyEval
7971   if can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length)
7972         body            __KAM_BODY_LENGTH_LT_128        eval:check_body_length('128')
7973         describe        __KAM_BODY_LENGTH_LT_128        The length of the body of the email is less than 128 bytes.
7974 endif
7975 endif
7976
7977 ifplugin Mail::SpamAssassin::Plugin::BodyEval
7978   if can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length)
7979         body            __KAM_BODY_LENGTH_LT_256        eval:check_body_length('256')
7980         describe        __KAM_BODY_LENGTH_LT_256        The length of the body of the email is less than 256 bytes.
7981 endif
7982 endif
7983
7984 ifplugin Mail::SpamAssassin::Plugin::BodyEval
7985   if can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length)
7986         body            __KAM_BODY_LENGTH_LT_512        eval:check_body_length('512')
7987         describe        __KAM_BODY_LENGTH_LT_512        The length of the body of the email is less than 512 bytes.
7988 endif
7989 endif
7990
7991 if !plugin(Mail::SpamAssassin::Plugin::HTMLEval)
7992 meta            __KAM_HTML_FONT_INVALID         0
7993 endif
7994
7995 ifplugin Mail::SpamAssassin::Plugin::HTMLEval
7996 body            __KAM_HTML_FONT_INVALID         eval:html_test('font_invalid_color')
7997 endif
7998
7999 body            __KAM_LOTTO2    /((ticket|serial|lucky) number|secret pin ?code|batch number|reference number|promotion date)/is
8000
8001 header   __KB_DATE_CONTAINS_TAB  Date:raw =~ /^\t/
8002
8003 header __KB_MSGID_OUTLOOK_888  Message-Id =~ /^<[0-9a-f]{8}(?:\$[0-9a-f]{8}){2}\@/
8004
8005 meta     __KHOP_NO_FULL_NAME    !(__NOT_A_PERSON || __FROM_ENCODED_QP || __FROM_NEEDS_MIME || __FROM_FULL_NAME)
8006
8007 if !(can(Mail::SpamAssassin::Conf::feature_bug6558_free))
8008    meta        __LARGE_PERCENT_AFTER  0
8009 endif
8010
8011 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
8012    body        __LARGE_PERCENT_AFTER  /\d{3}% after/i
8013    tflags      __LARGE_PERCENT_AFTER  multiple maxhits=4
8014 endif
8015
8016 if !plugin(Mail::SpamAssassin::Plugin::HeaderEval)
8017   meta      __LCL__ENV_AND_HDR_FROM_MATCH     0
8018 endif
8019
8020 ifplugin Mail::SpamAssassin::Plugin::HeaderEval
8021   meta      __LCL__ENV_AND_HDR_FROM_MATCH     __ENV_AND_HDR_FROM_MATCH
8022 endif
8023
8024 if !plugin(Mail::SpamAssassin::Plugin::BodyEval)
8025   meta      __LCL__KAM_BODY_LENGTH_LT_1024    0
8026 endif
8027
8028 ifplugin Mail::SpamAssassin::Plugin::BodyEval
8029 if !(can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length))
8030     meta      __LCL__KAM_BODY_LENGTH_LT_1024    0
8031 endif
8032 endif
8033
8034 ifplugin Mail::SpamAssassin::Plugin::BodyEval
8035   if can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length)
8036     meta      __LCL__KAM_BODY_LENGTH_LT_1024    __KAM_BODY_LENGTH_LT_1024
8037 endif
8038 endif
8039
8040 if !plugin(Mail::SpamAssassin::Plugin::BodyEval)
8041   meta      __LCL__KAM_BODY_LENGTH_LT_128     0
8042 endif
8043
8044 ifplugin Mail::SpamAssassin::Plugin::BodyEval
8045 if !(can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length))
8046     meta      __LCL__KAM_BODY_LENGTH_LT_128     0
8047 endif
8048 endif
8049
8050 ifplugin Mail::SpamAssassin::Plugin::BodyEval
8051   if can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length)
8052     meta      __LCL__KAM_BODY_LENGTH_LT_128     __KAM_BODY_LENGTH_LT_128
8053 endif
8054 endif
8055
8056 if !plugin(Mail::SpamAssassin::Plugin::BodyEval)
8057   meta      __LCL__KAM_BODY_LENGTH_LT_512     0
8058 endif
8059
8060 ifplugin Mail::SpamAssassin::Plugin::BodyEval
8061 if !(can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length))
8062     meta      __LCL__KAM_BODY_LENGTH_LT_512     0
8063 endif
8064 endif
8065
8066 ifplugin Mail::SpamAssassin::Plugin::BodyEval
8067   if can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length)
8068     meta      __LCL__KAM_BODY_LENGTH_LT_512     __KAM_BODY_LENGTH_LT_512
8069 endif
8070 endif
8071
8072 meta       __LINKED_IMG_NOT_RCVD_LINK  __URI_IMG_LINKEDIN && !__HDR_RCVD_LINKEDIN
8073
8074 meta        __LIST_PARTIAL         __DOS_HAS_LIST_UNSUB && !__DOS_HAS_LIST_ID
8075
8076 meta        __LIST_PRTL_PUMPDUMP   __LIST_PARTIAL && __PD_CNT_1
8077
8078 meta        __LIST_PRTL_SAME_USER  __LIST_PARTIAL && __TO_EQ_FROM_USR
8079
8080 body     __LITECOIN_ID   /\b(?<!=)[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}\b/
8081
8082 uri __LOCAL_PP_NONPPURL         m'https?://(?:[A-Za-z0-9-_]+)\.(?!paypal\.com)(?:[A-Za-z0-9-_\.]+)'i
8083
8084 body        __LOCK_MAILBOX       /\b(?:(?:deactivate|lock(?: up)?|lose ac+ess to|los[se] (?:of )?(?:important )?(?:information|mail|messages) in) (?:your )?(?:mail\s?box|(?:web ?|e-?)mail)|your (?:mail\s?box|(?:(?:web ?|e-?)mail)(?: account)?) (?:(?:will|may) be(?:come)? )?(?:in-?a(?:ctive|cess[ia]ble)|locked|disabled|deleted|removed)\b|ditt konto vara "?deaktiverad"?|begr(?:=E4|\xe4|[\xc3][\xa4])nsad tillg(?:=E5|[\xe5]|[\xc3][\xa5])ng till din brevl(?:=E5|[\xe5]|[\xc3][\xa5])da|contas? de (?:web ?|e-?)mail (?:ser(?:=E1|[\xe1]|[\xc3][\xa1]) (?:desativado|exclu(?:=ED|[\xed]|[\xc3][\xad])do)|(?:=E9|[\xe9]|[\xc3][\xa9]) exclu(?:=ED|[\xed]|[\xc3][\xad])do)|destruir a sua caixa de (?:correio|entrada)|tw(?:=F3|[\xf3])j konto zostalo ograniczone|straci swoje e-?mail na sta[\xc5][\x82]e|konto zostanie automatycznie wy[\xc5][\x82][\xc4][\x85]czona|e-?mail account[^.]{0,30}deactivated (?:in|from) our (?:database|system|server)|you will be deactivated|(?:account|e?-?mail(?: ?box)?) (?:will (?:be )?)?(?:shut ?down|expire|deactivate)|we have (?:stopped|suspended) (?:processing|accepting) (?:any )?(?:incoming|new|fresh) email)/i
8085 tflags      __LOCK_MAILBOX       multiple maxhits=2
8086
8087 full     __LONGLINE     /^[^\r\n]{998}/m
8088
8089 rawbody   __LONG_INVIS_DIV              /<div\s+style\s*=\s*"(?:(?<!-)visibility\s*:\s*hidden|display\s*:\s*none)\s*">[^<\s]{1400}/i
8090
8091 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
8092   meta      __LONG_STY_INVIS              __STY_INVIS && __LONGLINE
8093 endif
8094
8095 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
8096   meta     __LOTSA_MONEY_00   0
8097 endif
8098
8099 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8100   body     __LOTSA_MONEY_00   /<CURRENCY>[\s\.]?<NUM_NOT_DATE>[\dOo][,\.][\dOo]{3}(?:(?!\d)|\b)/
8101 endif
8102
8103 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
8104   meta     __LOTSA_MONEY_01   0
8105 endif
8106
8107 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8108   body     __LOTSA_MONEY_01   /(?:(?i:sum\sof\s)[\(\[]?|<CURRENCY>\s?)[\s\.]?<NUM_NOT_DATE_IP>[\d.,\sOo]{5,20}[\dOo](?<!\.00)\b/
8109 endif
8110
8111 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
8112   meta     __LOTSA_MONEY_02   0
8113 endif
8114
8115 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8116   body     __LOTSA_MONEY_02   /(?<![-\d])<NUM_NOT_DATE_IP>[\d.,\sOo]{5,20}[\dOo][\)\]\(]?\s?(?:<CURRENCY>|Pounds|(?i:dollars?|bucks))\b/
8117 endif
8118
8119 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
8120   meta     __LOTSA_MONEY_03   0
8121 endif
8122
8123 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8124   body     __LOTSA_MONEY_03   /(?:(?i:sum\sof\s)[\(\[]?|<CURRENCY>\s?)<NUM_NOT_DATE>[\d.,\sOo]{0,5}[\)\]]?\s?(?i:M(?i:il+)?\b|mil+(?i:io|<O>)n|hund?[re]+a?[dt]|thousand|tausend|milh[\xf5]es)/
8125 endif
8126
8127 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
8128   meta     __LOTSA_MONEY_04   0
8129 endif
8130
8131 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8132   body     __LOTSA_MONEY_04   /(?:(?<![-\d])<NUM_NOT_DATE>[\d\.,]{0,4}(?:M|\smilli?one?s|\s?mln)|million(?!s)|mill<O>n|hund?rea?d(?!s)[^\.]{1,25}thousand(?!s)|cents?[^\.]{1,25}mille|hundert[^\.]{1,30}tausend|ientos?[^\.]{1,20}mil|cent[a-z\s]{1,20}mil\s[a-z]{1,20}centos)[^\.\$]{0,50}?(?:(?:U\.?\s?S\.?\s?(?:A\.?\s?)?|united\s?states\s|E\.\s?U\.\s|canad(?:ian|a)\s|(?:ia\s)?de\s)?d(?:[o\xf3]|[\xc3][\xb3])l+are?s?|\bbucks|USD|GBP|<GB_UK>\spounds?|(?:<GB_UK>\s)?pounds?\ssterling|pounds(?!\sof)|(?:d'\s?)?euros?|francs?)\b/i
8133 endif
8134
8135 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
8136   meta     __LOTSA_MONEY_05   0
8137 endif
8138
8139 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8140   body     __LOTSA_MONEY_05   /(?:(?:sum|value|amount)\sof\s)<NUM_NOT_DATE_IP>[\d.,\sO]{7,20}[\dO\.][\)\]\(\s]{0,3}(?:pounds?|dollars?|euros?|bucks)\b/i
8141 endif
8142
8143 meta     __LOTTO_ADMITS     __LOTTO_ADMITS_1 || __LOTTO_ADMITS_2 || __LOTTO_ADMITS_3 || __LOTTO_ATTACH_1 || __LOTTO_ATTACH_2
8144
8145 body     __LOTTO_ADMITS_1 /\b(?:on-?line|e-?mail|ballot|(?:inter)?national|state|(?:UK|euro)[- ]?(?:mil+ions?|PW)|Canada|Microsoft|MSN|internet|mega|jackpot+|Royal Heritage|foundation|cash\sgrant|mercato|univers|staatsloterij|bill\s?gates|Olympics?|swiss|this|est[ea]|internationaux de gagnants de)(?:\s(?!lot|swe|prom)\w{1,20}){0,3}\s?(?:lot(?:to|t+ery|eri[ea])|sweepstakes?|promo(?:tion|cao|cion)?|jackpot+)\b/i
8146
8147 body     __LOTTO_ADMITS_2 /\b(?:free)?(?:lot(?:to|tery|erie)|sweepstakes)\s(?:(?:inter)?na[tz]ional|department|bureau|group|award|microsoft)/i
8148
8149 uri      __LOTTO_ADMITS_3 /lott+ery/i
8150
8151 meta     __LOTTO_AGENT    __LOTTO_AGENT_01 || __LOTTO_AGENT_02
8152
8153 body     __LOTTO_AGENT_01 /\b(?:(?:(?:the|y?our)(?:\s\w{1,20})?|contact|accredited|listed)\sclaim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|reimbursement|(?:prize|international|intl|foreign|win+ing)(?:[\s,.]+(?:rem+it+ance|settlement|payment|payout|award|transfer))+|payment|payout|immunity|(?<!memory\s)grants?(?!\smanager))\s?(?:agent|manager|officer|secretary|director|mgr\b)/i
8154
8155 body     __LOTTO_AGENT_02 /\blot+ery[^\.]{1,40} ticket agent/i
8156
8157 header   __LOTTO_AGENT_RPLY Reply-To =~ /(?:claim(?:s|ing)?(?:[\s_.]processing)?|fiducia\w+|dispatch|reimbursement|payout|prize\stransfer|(?:international|foreign|win+ing)[\s_.]rem+it+ance)[\s_.]?(?:agent|manager|officer|secretary|director|department|dept)/i
8158
8159 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
8160   meta         __LOTTO_ATTACH_1   0
8161 endif
8162
8163 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8164   mimeheader   __LOTTO_ATTACH_1   Content-Type =~ /lott(?:o|ery)/i
8165 endif
8166
8167 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
8168   meta         __LOTTO_ATTACH_2   0
8169 endif
8170
8171 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8172   mimeheader   __LOTTO_ATTACH_2   Content-Disposition =~ /lott(?:o|ery)/i
8173 endif
8174
8175 body     __LOTTO_DEPT       /\b(?:claim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|reimbursement|(?:international|foreign|win+ing)(?:\s(?:rem+it+ance|settlement|payment|award))+|payment|award|compensation|lot+ery)(?:\s\w+)?\s?(?:department|dept|unit|group|committee|bureau)/i
8176
8177 body     __LOTTO_RELATED    /\b(?:lot+(?:o|ery)|sweepstakes)\s(?:prize|draw(?:s|ing)?|(?:ge)?win(?:n?er|n?ing)?|jackpot+|award|fund|com+it+e+|com+is+ion|guild|promotion|promocao|program|day|online|company|(?:in)?corporat|agent|co[-,]?ordinator|team)/i
8178
8179 body     __LOTTO_VERIFY     /\bpromo\sverification/i
8180
8181 body     __LOTTO_WINNINGS   /\b(?:claim|process(?:ing)?|transfert?(?:\s\w+)?|redeem|payment|virement|zahlung|reivindicar|demandar|remise)\s(?:(?:[a-z]{1,5}\s)?(?:your|of|the|this|de|ihrer|seu|tu)\s)+(?:win+ings?|money|(?:cash\s)?prize|award|f[ou]nds?|grant|gewinne|premio|gain)\b/i
8182
8183 body     __LOTTO_WIN_01     /\bwin+ing\s(?:prize|number|notification|draw|check|cheque|details|information|payment)/i
8184
8185 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
8186   ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8187     body            __LOWER_E       /e/
8188     tflags          __LOWER_E       multiple maxhits=230
8189 endif
8190 endif
8191
8192 body     __LUCKY_WINNER   /\b(?:lucky|gl.cklich(?:en)?|afortunados)\s(?:(?:ge)?win+ers?|ganador(?:es)?|individuals?)\b/i
8193
8194 body     __LUCRATIVE      /\b(?:lucrative|profitable|tr[\xe8]s\ssalutaire)\b/i
8195
8196 header     __LUNSUB_BEFORE_SUBJDT      ALL =~ /^List-unsubscribe: (?:[^\n]+\n){1,40}^(?:Subject|Date): /ism
8197
8198 rawbody __L_BODY_8BITS          /[\x80-\xff]/
8199
8200 header __L_CTE_7BIT             Content-Transfer-Encoding =~ /^7bit$/
8201
8202 header __L_CTE_8BIT             Content-Transfer-Encoding =~ /^8bit$/
8203
8204 body        __MAILBOX_FULL       /\b(?:you(?:r (?:mail\s?box|(?:e-?|web ?)mail))? (?:is (?:almost )?full|quota is running low|(?:quota )?ha(?:s|ve) (?:reached|exceeded|passed) (?:the|your|it'?s?) (?:university )?(?:size|storage|set|(?:e-?|web ?)mail|quota|folder|mail ?box)[\/\s](?:limit |quota |account )+)|over your mail\s?box (?:size )?(?:limit|quota)|maximum mail\s?box (?:size )?(?:limit|quota) exceeded|sua (?:conta|caixa) de (?:(?:e-?|web ?)mail|correio) (?:excedeu (?:sua|o) limite|est(?:=E1|[\xe1]|[\xc3][\xa1]) quase cheio))\b/i
8205
8206 body        __MAILBOX_FULL_SE    /(?:\b=F6|[\xf6]|[\xc3][\xb6])verskridit gr(?:=E4|[\xe4]|[\xc3][\xa4])nsen f(?:=F6|[\xf6]|[\xc3][\xb6])r din postl(?:=E5|[\xe5]|[\xc3][\xa5])da\b/i
8207
8208 header __MAILER_OL_6626 X-Mailer =~ /^Microsoft Outlook, Build 10\.0\.6626$/
8209
8210 body        __MAIL_ACCT_ACCESS1  /\b(?:your (?:web ?|e-?)?mail (?:account|log-?in) (?:has )?been accessed|r(?:=F3|[\xf3])zne komputery zalogowaniu sie)\b/i
8211
8212 body        __MAIL_ACCT_ACCESS2  /\blo+se ac+es+ to your (?:web|e-?)?mail ?(?:account|log-?in|box|address)\b/i
8213
8214 uri      __MAIL_LINK    /\?.{0,200}\w\@[\w-]{1,20}.\w\w\w?\b/i
8215 tflags   __MAIL_LINK    nice
8216
8217 body       __MAKE_XTRA_DOLLAR          /\bmake an extra dollar\b/i
8218
8219 header     __MALF_MIME_VER             MIME-Version =~ /^1\.0\S/
8220
8221 meta           __MALWARE_NORDNS       __MY_MALWARE && __RDNS_NONE
8222
8223 meta           __MALWARE_PASSWORD     __MY_MALWARE && __PASSWORD
8224
8225 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8226   meta         __MALW_ATTACH       __MALW_ATTACH_01_01 || __MALW_ATTACH_01_02 || __MALW_ATTACH_02_01 || __MALW_ATTACH_02_02
8227 endif
8228
8229 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
8230   meta         __MALW_ATTACH_01_01 0
8231 endif
8232
8233 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8234   mimeheader   __MALW_ATTACH_01_01 Content-Disposition =~ /\bfilename(?:="?[^"]+|\*(?:\d+\*)?=(?:UTF-8'')?\S+)\.SettingContent-ms\b/i
8235 endif
8236
8237 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
8238   meta         __MALW_ATTACH_01_02 0
8239 endif
8240
8241 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8242   mimeheader   __MALW_ATTACH_01_02 Content-Type =~ /\bname="?[^"]+\.SettingContent-ms\b/i
8243 endif
8244
8245 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
8246   meta         __MALW_ATTACH_02_01 0
8247 endif
8248
8249 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8250   mimeheader   __MALW_ATTACH_02_01 Content-Disposition =~ /\bfilename(?:="?[^"]*|\*(?:\d+\*)?=(?:UTF-8'')?\S*)(?:invoice|statement|payment(?: advice)?|(?:[.,_]|%C2%B7|[\xc2][\xb7])(?:pdf|img|png|gif|jpe?g))\.(?:ace|zip|rar|r17|[7g]?z|iso)[";$]/i
8251 endif
8252
8253 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
8254   meta         __MALW_ATTACH_02_02 0
8255 endif
8256
8257 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8258   mimeheader   __MALW_ATTACH_02_02 Content-Type =~ /\bname="?[^"]*(?:invoice|statement|payment(?: advice)?|(?:[.,_]|[\xc2][\xb7])(?:pdf|img|png|gif|jpe?g))\.(?:ace|zip|rar|r17|[7g]?z|iso)[";$]/i
8259 endif
8260
8261 meta           __MANY_HDRS_LCASE     __HDRS_LCASE > 1
8262
8263 meta           __MANY_SPAN_IN_TEXT   (__SPAN_BEG_TEXT > 4) && (__SPAN_END_TEXT > 4)
8264
8265 header __MAY_BE_FORGED  Received =~ /\(may be forged\)/
8266
8267 header __MID_START_001C   Message-ID =~ /^<000001c/
8268
8269 body     __MILLIONS       /\bmillions\sof\s(?:dollar|euro|pound)/i
8270
8271 header __MIMEOLE_1106   X-MimeOLE =~ /^Produced By Microsoft MimeOLE V6.00.2800.1106$/
8272
8273 meta       __MIMEOLE_DIRECT_TO_MX      __HAS_MIMEOLE && __DOS_DIRECT_TO_MX
8274
8275 header     __MIME_BDRY_0D0D        Content-Type =~ /boundary="-{12}(?:0[1-9]){12}/
8276
8277 if !((version >= 3.004000))
8278         meta        __MIME_CTYPE_IN_BODY    0
8279 endif
8280
8281 if (version >= 3.004000)
8282         body        __MIME_CTYPE_IN_BODY    /^Content-Type:\s/
8283 endif
8284
8285 if !((version >= 3.004000))
8286         meta        __MIME_MALF      0
8287 endif
8288
8289 if (version >= 3.004000)
8290         meta        __MIME_MALF      __CTYPE_MULTIPART_ANY && __MIME_CTYPE_IN_BODY
8291 endif
8292
8293 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
8294   meta        __MIME_NO_TEXT    0
8295 endif
8296
8297 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8298   meta        __MIME_NO_TEXT    (__CTYPE_MULTIPART_ANY && !__ANY_TEXT_ATTACH)
8299 endif
8300
8301 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
8302   rawbody __MIME_QPC           eval:check_for_mime('mime_qp_count')
8303 endif
8304
8305 header   __MISSING_REF          References =~ /^UNSET$/ [if-unset: UNSET]
8306
8307 header   __MISSING_REPLY        In-Reply-To =~ /^UNSET$/ [if-unset: UNSET]
8308
8309 rawbody    __MIXED_AREA_CASE           /<(?!AREA|area)[Aa][Rr][Ee][Aa]\s/
8310
8311 rawbody    __MIXED_CENTER_CASE         /<(?!CENTER|center)[Cc][Ee][Nn][Tt][Ee][Rr]>/
8312
8313 rawbody    __MIXED_FONT_CASE           /<(?!FONT|font)[Ff][Oo][Nn][Tt]\s/
8314
8315 rawbody    __MIXED_HREF_CASE_JH        /<[Aa](?i:rea)?\s+(?!HREF|href)[Hh][Rr][Ee][Ff]=/
8316
8317 rawbody    __MIXED_IMG_CASE_JH         /<(?!IMG|img)[Ii][Mm][Gg]\s/
8318
8319 header __MOLE_2962  X-MimeOLE =~ /^Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2962$/
8320
8321 meta           __MONERO         (__MONERO_ID || __MONERO_CURNCY || __URI_MONERO || __FUZZY_MONERO)
8322
8323 body           __MONERO_CURNCY  /Monero \(XMR\)/
8324
8325 body           __MONERO_ID      /\b4[0-9AB][1-9A-HJ-NP-Za-km-z]{93,104}\b/
8326
8327 meta     __MONEY_ATM_CARD LOTS_OF_MONEY && __ATM_CARD
8328
8329 meta     __MONEY_FORM        LOTS_OF_MONEY && __FILL_THIS_FORM
8330
8331 meta     __MONEY_FORM_SHORT  LOTS_OF_MONEY && __FILL_THIS_FORM_SHORT
8332
8333 meta     __MONEY_FRAUD_3  LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH +  __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS +  __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX +  __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 3)
8334
8335 meta     __MONEY_FRAUD_5  LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH +  __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS +  __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX +  __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 5)
8336
8337 meta     __MONEY_FRAUD_8  LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH +  __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS +  __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX +  __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 8)
8338
8339 ifplugin Mail::SpamAssassin::Plugin::FreeMail
8340   meta     __MONEY_FREEMAIL_REPTO   LOTS_OF_MONEY && __freemail_hdr_replyto
8341 endif
8342
8343 body     __MOVE_MONEY     /\b(?:(?:receive|re-?profile|transfer(?:ring|ir|t)?|release|repatriat(?:e|ion)|rapatrier|secure|r(?:e|=E9|[\xe9]|[\xc3][\xa9])clamation|possession|virer|dona(?:te|r)|depositante|dep[\xc3][\xb3]sito)\s(?:th(?:e(?:se)?|is)|d[ae]s|sur ce|de ce[st]|cet|est[eao]s?|del?)|re-?profiling|receive|re-?locat(?:e|ing)(?:\s\w{1,15})?)\s(?:of\s|your\s|the\s){0,2}(?:sums?\sof\s|inheritance\s)?(?:proceeds|funds?|money|balance|account|g[eo]ld|compte|fond[so]{1,2}|dinero|argent)\b/i
8344
8345 meta       __MSGID_DOLLARS_URI_IMG     __MSGID_DOLLARS_MAYBE && __HAS_ANY_URI && __HTML_LINK_IMAGE
8346
8347 header         __MSGID_GUID          Message-ID =~ /^<?[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}\@/i
8348
8349 header         __MSGID_HEXISH        Message-ID =~ /^<?OF[0-9A-F]{8}\.[0-9A-F]{8}-ON[0-9A-F]{8}\.[0-9A-F]{8}(?:-[0-9A-F]{8}\.[0-9A-F]{8})?\@/
8350
8351 header         __MSGID_HEX_UID       Message-ID =~ /^<?[0-9A-F]{8}\.[0-9A-F]{2,5}%[a-zA-Z]/
8352
8353 header __MSGID_JAVAMAIL Message-ID =~ /\.JavaMail\./
8354 tflags __MSGID_JAVAMAIL nice
8355
8356 header   __MSGID_LIST   Message-ID =~ /-\w+\#[\w.]+\.\w{2,4}\@/
8357 tflags   __MSGID_LIST   nice
8358
8359 header   __MSGID_NOFQDN2  Message-ID =~ /<.*\@[A-Za-z0-9]+>/m
8360
8361 meta        __MSMAIL_PRI_ABNORMAL      __HAS_MSMAIL_PRI && !__MSMAIL_PRI_NORMAL
8362
8363 header      __MSMAIL_PRI_HIGH          X-MSMail-Priority =~ /^(?:high|urgent)$/i
8364
8365 header      __MSMAIL_PRI_NORMAL        X-MSMail-Priority =~ /^normal$/i
8366
8367 meta       __MSM_PRIO_REPTO             __HAS_MSMAIL_PRI && __HAS_REPLY_TO && __SUBJ_SHORT
8368
8369 header __MSOE_MID_WRONG_CASE   ALL =~ /\nMessage-Id: /
8370
8371 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8372   mimeheader   __MSO_THEME_MT      Content-Type =~ m,\bapplication/vnd.ms-officetheme\b,i
8373 endif
8374
8375 header         __MTLANDROID_MUA    X-Mailer =~ /\bMotorola android mail \d+\.\d/
8376
8377 header     __MUA_TBIRD             User-Agent =~ /^Mozilla\/(.*) Thunderbird/
8378
8379 body     __MY_FORTUNE     /\b(?:my|his|her)\s(?:fortune|heritage)\b/i
8380
8381 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
8382   body           __MY_MALWARE           /\b(?:(?:I(?:'ve|\shave)?\s(?:put|set\s?up|installed|buil[td]\sin|placed)\s(?:a\s)?|my\s(?:personal\s|background\s|hidden\s)?)(?:mal+ware|virus|spy\s?ware|trojan|program\srecorded|expl[o0]it|backdoor|(?:sneaky\s|hidden\s|malicious\s)+(?:app|stuff))|(?:application|mal+ware)[^\.]{1,30}(?:enable[sd]|allow(?:s|ed))\sme\sto\s(?:access|control)|I\s(?:contaminated|infected|hacked|toxified|poisoned)\s(?:your|this)\s(?:machine|computer|gadget|(?:smart\s?)?phone|device|email)|Anwendung\s[^\.]{1,50}\sich\sauf\salle\sIhre\sdarauf\sgespeicherten\sDateien\szugreifen\skann|mein\shinterhältiges\sProgramm|I\s?am\s?a\s?hacker|(?:(?:trojan|virus|spyware|mal+ware)\s)+giv(?:es|ing)\sme)\b/i
8383 endif
8384
8385 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8386   body           __MY_MALWARE           /(?:^|\s)(?:(?:<I>(?:'<V><E>|\s<H><A><V><E>)?\s(?:<P><U><T><|><S><E><T>\s?<U><P>|<I><N><S><T><A><L><L><E><D>|<B><U><I><L>(?:<T>|<D>)\s<I><N>|<P><L><A><C><E><D>)\s(?:<A>\s)?|<M><Y>\s(?:<P><E><R><S><O><N><A><L>\s|<B><A><C><K><G><R><O><U><N><D>\s|<H><I><D><D><E><N>\s)?)(?:<M><A><L>+<W><A><R><E>|<V><I><R><U><S>|<S><P><Y>\s?<W><A><R><E>|<T><R><O><J><A><N>|<P><R><O><G><R><A><M>\s<R><E><C><O><R><D><E><D>|<E><X><P><L>(?:<O>|0)<I><T>|<B><A><C><K><D><O><O><R>|(?:<S><N><E><A><K><Y>\s|<H><I><D><D><E><N>\s|<M><A><L><I><C><I><O><U><S>\s)+(?:<A><P><P>|<S><T><U><F><F>))|(?:<A><P><P><L><I><C><A><T><I><O><N>|<M><A><L>+<W><A><R><E>)[^\.]{1,30}(?:<E><N><A><B><L><E>(?:<D>|<S>)|<A><L><L><O><W>(?:<S>|<E><D>))\s<M><E>\s<T><O>\s(?:<A><C><C><E><S><S>|<C><O><N><T><R><O><L>)|<I>\s(?:<C><O><N><T><A><M><I><N><A><T><E><D>|<I><N><F><E><C><T><E><D>|<H><A><C><K><E><D>|<T><O><X><I><F><I><E><D>|<P><O><I><S><O><N><E><D>)\s(?:<Y><O><U><R>|<T><H><I><S>)\s(?:<M><A><C><H><I><N><E>|<C><O><M><P><U><T><E><R>|<G><A><D><G><E><T>|(?:<S><M><A><R><T>\s?)?<P><H><O><N><E>|<D><E><V><I><C><E>|<E><M><A><I><L>)|Anwendung\s[^\.]{1,50}\sich\sauf\salle\sIhre\sdarauf\sgespeicherten\sDateien\szugreifen\skann|<M><E><I><N>\s<H><I><N><T><E><R><H><A><L><T><I><G><E><S>\s<P><R><O><G><R><A><M>+|<I>\s?<A><M>\s?<A>\s?<H><A><C><K><E><R>|(?:(?:<T><R><O><J><A><N>|<V><I><R><U><S>|<S><P><Y><W><A><R><E>|<M><A><L>+<W><A><R><E>)\s)+<G><I><V>(?:<E><S>|<I><N><G>)\s<M><E>)[\s\.,]/i
8387 endif
8388
8389 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
8390   body           __MY_VICTIM            /\b(?:hi|hello),?(?:\smy)?\s(?:victim|prey)\b/i
8391 endif
8392
8393 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8394   body           __MY_VICTIM            /(?:<H><I>|<H><E><L><L><O>),?(?:\s<M><Y>)?\s(?:<V><I><C><T><I><M>|<P><R><E><Y>)/i
8395 endif
8396
8397 header __NAKED_TO   To =~ /^[^\s<>]+\@[^\s<>]+$/
8398
8399 meta           __NAME_EMAIL_DIFF   __NAME_IS_EMAIL && ! __NAME_EQ_EMAIL
8400
8401 header __NAME_EQ_EMAIL  From:raw =~ /([\w+.-]+\@[\w.-]+\.\w\w+)["'`\s]*<\s*\1>/i
8402
8403 header __NAME_IS_EMAIL  From:raw =~ /\w\@[\w.-]+\.\w\w+["'`]*\s*<\w+\@\w/
8404
8405 body     __NEVER_HEAR_EN      /(never hear me again|destroy all your secrets|not bother you again|leave you alone)/i
8406
8407 body     __NEVER_HEAR_IT      /eliminare tutti i tuoi segreti|Ti garantisco che non ti disturbe/i
8408
8409 meta       __NEWEGG_IMG_NOT_RCVD_NEGG  __URI_IMG_NEWEGG && !__HDR_RCVD_NEWEGG
8410
8411 body       __NEW_PRODUCTS              /\bhere are new products|\b(?:Our company|we) (?:has |have )?(?:(?:recently|just|newly) (?:introduce|release|launche)[ds](?: a| our| the)? (?:new|(?:\w+\s){1,5}below)|a new (?!cat\s|kitten\s|dog\s|puppy\s|pet\s|baby\s|child\s|boy\s|girl\s)(?:\w+\s){1,5} here)|recently,? our company (?:launch|releas)ed|\bI want to recommend a new (?:\w+ ){1,5}(?:we|our)\b|latest version of our (?:stock|product)|\b(?:our|a) new (?:\w+ ){1,3}has (?:recently|just) been released/i
8412
8413 body     __NEXT_OF_KIN    /\bnext[-\s]of[-\s]kin\b/i
8414
8415 body     __NIGERIA        /\bnigeria\b/i
8416
8417 meta        __NORDNS_LOW_CONTRAST HTML_FONT_LOW_CONTRAST && __RDNS_NONE
8418
8419 meta     __NOT_A_PERSON __VACATION || ANY_BOUNCE_MESSAGE || __CHALLENGE_RESPONSE || __VIA_ML || __DOS_HAS_LIST_UNSUB || __SENDER_BOT || __UNSUB_LINK || __UNSUB_EMAIL || __MSGID_LIST || __SUBSCRIPTION_INFO
8420 tflags   __NOT_A_PERSON nice
8421
8422 body     __NOT_DEAD_YET   /\b(?:will\sinherit|que\sherede|your\sdeath|your?\sbeing\sdead)\b/i
8423
8424 body     __NOT_SCAM       /\b(?:not\sa\sscam|(?:not|never)\sscam\syou)\b/i
8425
8426 tflags     __NOT_SPOOFED        nice
8427
8428 if !(!plugin(Mail::SpamAssassin::Plugin::DKIM))
8429 if !plugin(Mail::SpamAssassin::Plugin::SPF)
8430   meta __NOT_SPOOFED  DKIM_VALID || !__LAST_EXTERNAL_RELAY_NO_AUTH || ALL_TRUSTED       # yes DKIM, no SPF
8431 endif
8432 endif
8433
8434 if !(!plugin(Mail::SpamAssassin::Plugin::DKIM))
8435  ifplugin Mail::SpamAssassin::Plugin::SPF
8436   meta __NOT_SPOOFED  SPF_PASS || DKIM_VALID || !__LAST_EXTERNAL_RELAY_NO_AUTH || ALL_TRUSTED   # yes DKIM, yes SPF
8437 endif
8438 endif
8439
8440 if !plugin(Mail::SpamAssassin::Plugin::DKIM)
8441 if !plugin(Mail::SpamAssassin::Plugin::SPF)
8442    meta __NOT_SPOOFED  __DKIM_EXISTS || !__LAST_EXTERNAL_RELAY_NO_AUTH || ALL_TRUSTED   # no DKIM, no SPF.
8443 endif
8444 endif
8445
8446 if !plugin(Mail::SpamAssassin::Plugin::DKIM)
8447  ifplugin Mail::SpamAssassin::Plugin::SPF
8448    meta __NOT_SPOOFED  SPF_PASS || __DKIM_EXISTS || !__LAST_EXTERNAL_RELAY_NO_AUTH || ALL_TRUSTED       # no DKIM, yes SPF
8449 endif
8450 endif
8451
8452 meta     __NO_INR_YES_REF       (__XM_GNUS || __XM_MSOE5 || __XM_MSOE6 || __XM_MOZ4 || __XM_SKYRI || __XM_WWWMAIL || __UA_GNUS || __UA_KNODE || __UA_MUTT || __UA_PAN || __UA_XNEWS)
8453
8454 header          __NSL_ORIG_FROM_41        X-Originating-IP =~ /^(?:.+\[)?41\./
8455 describe        __NSL_ORIG_FROM_41        Originates from 41.0.0.0/8
8456
8457 header          __NSL_RCVD_FROM_41        X-Spam-Relays-External =~ / ip=41\./
8458 describe        __NSL_RCVD_FROM_41        Received from 41.0.0.0/8
8459
8460 header   __NUMBERONLY_TLD From:addr =~ /\@[0-9]{4,}(\.[a-z]{2,4})?\.[a-z]+$/i
8461
8462 header      __NUMBERS_IN_SUBJ  Subject =~ /\d{3}/
8463
8464 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
8465   meta           __OBFU_BITCOIN   ( __BITCOIN_ID && ( __BTC_OBFU_2 || __BTC_OBFU_3 || __BTC_OBFU_4 || __BTC_OBFU_5 ) )
8466 endif
8467
8468 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8469   meta           __OBFU_BITCOIN   ( __BITCOIN_ID && ( __BTC_OBFU_2 || __BTC_OBFU_3 || FUZZY_BITCOIN || __BTC_OBFU_5 ) )
8470 endif
8471
8472 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
8473   meta           __OBFU_BITCOIN_NOID   ( !__BITCOIN_ID && ( __BTC_OBFU_2 || __BTC_OBFU_3 || __BTC_OBFU_4 || __BTC_OBFU_5 ) )
8474 endif
8475
8476 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8477   meta           __OBFU_BITCOIN_NOID   ( !__BITCOIN_ID && ( __BTC_OBFU_2 || __BTC_OBFU_3 || FUZZY_BITCOIN || __BTC_OBFU_5 ) )
8478 endif
8479
8480 body       __OBFU_UNSUB_UL             /(?:click_here|remove_your|our_e?mail|this_list|to_unsubscribe|future_e?mail|our_list)/
8481
8482 if !plugin(Mail::SpamAssassin::Plugin::ImageInfo)
8483   meta       __ONE_IMG               0
8484 endif
8485
8486 ifplugin Mail::SpamAssassin::Plugin::ImageInfo
8487   body       __ONE_IMG               eval:image_count('all',1,1)
8488 endif
8489
8490 header   __OPERA_MID_NON_OP    Message-ID =~ /^<[^o][^p]\./
8491
8492 body     __OUR_BEHALF     /\b(?:on\s(?:my|our)\sbehalf|of\sbehalf\sof)\b/i
8493
8494 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8495 mimeheader __PART_CID_STOCK_LESS    Content-ID =~ /^<00[a-f0-9]{10}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[A-Za-z]+>$/
8496 endif
8497
8498 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8499 mimeheader __PART_STOCK_CD_F Content-Disposition =~ /filename/
8500 endif
8501
8502 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8503 mimeheader __PART_STOCK_CID Content-ID =~ /^<[a-f0-9]{12}\$[a-f0-9]{8}\$[a-f0-9]{8}\@[^\s\.]+>$/
8504 endif
8505
8506 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8507 mimeheader __PART_STOCK_CL Content-Location =~ /./
8508 endif
8509
8510 body       __PASSIVE_INCOME            /\bpassive income\b/i
8511
8512 body       __PASSWORD                  /\bp[-\s_]?a[-\s_]?s[-\s_]?s[-\s_]?w[-\s_]?o[-\s_]?r[-\s_]?d\b/i
8513
8514 body        __PASSWORD_EXP_CLUMSY  /\bpassword is due for expiration yesterday\b/i
8515
8516 body        __PASSWORD_UPGRADE   /\bpassword upgrade\b/i
8517
8518 body           __PAXFUL         /\bp-?a+-?x+-?f-?u+-?l\b/i
8519
8520 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
8521   body           __PAY_ME               /\b(?:pay\sme|(?:(?:send|transmit|give)\s(?:to\s)?me|(?:send(?:en\ssie)?|transfer)\s(?:the\samount\sof|exactly|genau)|I\swant|den\sbetrag\svon|payment\sof)\s(?:[\d,'.\$£]+\s?(?:usd?|eur?(?:os)?|gbp|BTC)?|bitcoin|BTC)|(?:make|perform|send|transmit)\sthe\spayment|amount\sfor\smy\ssilence|(?:pay|fund)\sthis\s(?:bitcoin|monero)[-\s](?:address|wallet|brieftasche)|my bribe(?:ry)?)\b/i
8522 endif
8523
8524 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8525   body           __PAY_ME               /(?:^|\s)(?:<P><A><Y>\s<M><E>|(?:(?:<S><E><N><D>|<T><R><A><N><S><M><I><T>|<G><I><V><E>)\s(?:<T><O>\s)?<M><E>|(?:<S><E><N><D>(?:<E><N>\s<S><I><E>)?|<T><R><A><N><S><F><E><R>)\s(?:<T><H><E>\s<A><M><O><U><N><T>\s<O><F>|<E><X><A><C><T><L><Y>|<G><E><N><A><U>)|<I>\s<W><A><N><T>|<D><E><N>\s<B><E><T><R><A><G>\s<V><O><N>|<P><A><Y><M><E><N><T>\s<O><F>)\s(?:[\d,'.\$£]+\s?(?:<U><S><D>?|<E><U><R>?(?:<O><S>)?|<G><B><P>|<B><T><C>)?|<B><I><T><C><O><I><N>|<B><T><C>)|(?:<M><A><K><E>|<P><E><R><F><O><R><M>|<S><E><N><D>|<T><R><A><N><S><M><I><T>)\s<T><H><E>\s<P><A><Y><M><E><N><T>|<A><M><O><U><N><T>\s<F><O><R>\s<M><Y>\s<S><I><L><E><N><C><E>|(?:<P><A><Y>|<F><U><N><D>)\s<T><H><I><S>\s(?:<B><I><T><C><O><I><N>|<M><O><N><E><R><O>)[-\s](?:<A><D><D><R><E><S><S>|<W><A><L><L><E><T>|<B><R><I><E><F><T><A><S><C><H><E>|<M><Y> <B><R><I><B><E>(?:<R><Y>)?))[\s\.,]/i
8526 endif
8527
8528 body     __PAY_YOU        /\bpay\syou\b/
8529
8530 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
8531   meta     __PCT_FOR_YOU    0
8532 endif
8533
8534 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8535   meta     __PCT_FOR_YOU    __PCT_FOR_YOU_1 || __PCT_FOR_YOU_2 || __PCT_FOR_YOU_3 || T_SHARE_50_50
8536 endif
8537
8538 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
8539   meta     __PCT_FOR_YOU_1  0
8540 endif
8541
8542 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8543   body     __PCT_FOR_YOU_1  /<PERCENT>[\s)]{0,3}(?:(?:of\s[\w\s]{0,35}?)?(?:for|to|as)\syour?|(?:[^\s.]{1,15}\s)?an uns beide)/i
8544 endif
8545
8546 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
8547   meta     __PCT_FOR_YOU_2  0
8548 endif
8549
8550 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8551   body     __PCT_FOR_YOU_2  /\b(?:(?:give|offer)\syou|vous\s(?:aurez\sdroit\s(?:=E0|[\xe0])|donnerai|all(?:e|=E9|[\xe9]|[\xc3][\xa9])\srecevoir\sautour\sde)|ihnen)\s<PERCENT>/i
8552 endif
8553
8554 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
8555   meta     __PCT_FOR_YOU_3  0
8556 endif
8557
8558 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8559   body     __PCT_FOR_YOU_3  /\byour?\s(?!can)(?:(?!you)\w{1,15}\s){0,10}(?:(?:share|entiti?le(?:d|ment)?|percentage|fee|assist(?:ance)?|comp[ea]nsat(?:ed?|tion)|reward(?:ed)?|renumerat(?:e|tion)|com+is+ion|paid|deduct|account|tage|(?:will|shall|would|(?:are|stand|going)\sto)\s(?:be\s)?(?:tak(?:e|ing)|earn|get(?:ting)?|remit|subtract|with+old)|(?:deduct|taken?|subtract(?:ed)?)\syour|keep(?:ing)?|receiv(?:e|ing)|retain(?:ing)?|have|half|giv(?:en|ing)|paid|(?:give|pay|offer)\s(?:me|you|him)|bank\saccount|to\s(?:take|use)|(?:time|country)\sand|ratio\sof)(?:\s(?!you)\w{1,15}){0,10})\s(?<!by\s)(?<!up\sto\s)<PERCENT>/i
8560 endif
8561
8562 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
8563   meta     __PCT_OF_PMTS    0
8564 endif
8565
8566 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8567   body     __PCT_OF_PMTS    /<PERCENT>[\s)]+(?:of\s[\w\s]{0,35}?)?(?:of|du|de)\s(?:(?:the|la)\s)?(?:total\s)?(?:payments?|rem+it+ances?|capital|chec(?:k|que)s?|mon(?:ey|ies)|suma?)/i
8568 endif
8569
8570 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
8571   meta         __PDF_ATTACH       0
8572 endif
8573
8574 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8575   meta         __PDF_ATTACH       (__PDF_ATTACH_MT || __PDF_ATTACH_FN1 || __PDF_ATTACH_FN2)
8576 endif
8577
8578 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
8579   meta         __PDF_ATTACH_FN1   0
8580 endif
8581
8582 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8583   mimeheader   __PDF_ATTACH_FN1   Content-Type =~ /="[^"]+\.pdf"/i
8584 endif
8585
8586 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
8587   meta         __PDF_ATTACH_FN2   0
8588 endif
8589
8590 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8591   mimeheader   __PDF_ATTACH_FN2   Content-Disposition =~ /="[^"]+\.pdf"/i
8592 endif
8593
8594 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
8595   meta         __PDF_ATTACH_MT    0
8596 endif
8597
8598 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8599   mimeheader   __PDF_ATTACH_MT    Content-Type =~ m,\bapplication/pdf\b,i
8600 endif
8601
8602 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8603   header   __PDS_BTC_ANON     From:name =~ /\bAnon/
8604 endif
8605
8606 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8607   meta     __PDS_BTC_BADFROM     ( __PDS_BTC_HACKER || __PDS_BTC_PIRATE )
8608 endif
8609
8610 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8611   header   __PDS_BTC_HACKER   From:name =~ /h<A>ck<E>r/i
8612 endif
8613
8614 meta     __PDS_BTC_ID   ( __BITCOIN_ID && !__URL_BTC_ID && !__HAS_IMG_SRC_DATA && !__BUGGED_IMG)
8615
8616 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
8617   header   __PDS_BTC_PIRATE   From:name =~ /p<I>r<A>t<E>/i
8618 endif
8619
8620 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
8621 if (version >= 3.004000)
8622 header   __PDS_CASHSHORTENER eval:check_uri_host_listed('PDS_CASHSHORTENER')
8623 endif
8624 endif
8625
8626 uri  __PDS_DOUBLE_URL m;https?://[\S]+(?:\?|=)https?://[\S]+[\w]+$;
8627
8628 if (version >= 3.004002)
8629 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
8630 body     __PDS_EXPIRATION_NOTICE /\bexpiration (notice|alert|date)\b/i
8631 endif
8632 endif
8633
8634 if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
8635   header     __PDS_FROM_2_EMAILS      From =~ /(?:^|<|"| )([\w+.-]+\@[\w.-]+\.\w\w++)(?:[^\n\w<]{0,80})?<(?!\1)[^\n\s]*\@/i
8636 endif
8637
8638 header   __PDS_FROM_GMAIL From:addr =~ /\@g(?:oogle)?mail\.com$/i
8639
8640 header   __PDS_FROM_NAME_TO_DOMAIN  ALL =~ /From: ["']?([a-z0-9\.-]+\.[0-9a-z\.-]+)["']? [^\n]+\nTo:[^\n]+\@\1/ism
8641
8642 header   __PDS_GMAIL_MID Message-Id =~ /\@mail.gmail.com>$/
8643
8644 meta     __PDS_GOOGLE_DRIVE_SHARE (__PDS_GOOGLE_DRIVE_SHARE_1 + __PDS_GOOGLE_DRIVE_SHARE_2 + __PDS_GOOGLE_DRIVE_SHARE_3 >= 2)
8645
8646 header __PDS_GOOGLE_DRIVE_SHARE_1 References =~ /\@docs\-share\.google\.com\>/
8647
8648 header __PDS_GOOGLE_DRIVE_SHARE_2 From:addr =~ /^drive\-shares\-noreply\@google\.com$/
8649
8650 header __PDS_GOOGLE_DRIVE_SHARE_3 X-Envelope-From:addr =~ /\@doclist\.bounces\.google\.com$/
8651
8652 ifplugin Mail::SpamAssassin::Plugin::AskDNS
8653 meta     __PDS_HP_HELO_NODNS (__HELO_HIGHPROFILE && !__HELO_DNS)
8654 tflags   __PDS_HP_HELO_NODNS net
8655 endif
8656
8657 ifplugin Mail::SpamAssassin::Plugin::HTMLEval
8658 meta __PDS_HTML_LENGTH_1024 __HTML_LENGTH_0000_1024
8659 endif
8660
8661 ifplugin Mail::SpamAssassin::Plugin::HTMLEval
8662 meta __PDS_HTML_LENGTH_2048 __HTML_LENGTH_0000_1024 || __HTML_LENGTH_1024_1536 || __HTML_LENGTH_1536_2048
8663 endif
8664
8665 meta     __PDS_LITECOIN_ID (__LITECOIN_ID && !__URL_LTC_ID && !__HAS_IMG_SRC_DATA && !__BUGGED_IMG)
8666
8667 meta     __PDS_MSG_1024 (__KAM_BODY_LENGTH_LT_1024 || __PDS_HTML_LENGTH_1024)
8668
8669 meta     __PDS_MSG_512 (__KAM_BODY_LENGTH_LT_512 || __HTML_LENGTH_512)
8670
8671 if (version >= 3.004001)
8672 ifplugin Mail::SpamAssassin::Plugin::AskDNS
8673 meta     __PDS_NEWDOMAIN  (__FROM_FMBLA_NEWDOM || __FROM_FMBLA_NEWDOM14 || __FROM_FMBLA_NEWDOM28)
8674 tflags   __PDS_NEWDOMAIN  net
8675 endif
8676 endif
8677
8678 if (version >= 3.004002)
8679 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
8680 body     __PDS_OFFER_ONLY_AMERICA /This offer (?:is )?(?:only )?for (United States|USA)/i
8681 endif
8682 endif
8683
8684 header   __PDS_PHP_EVAL1 X-PHP-Originating-Script =~ /eval..'d code/i
8685
8686 if !plugin(Mail::SpamAssassin::Plugin::MIMEEval)
8687   meta    __PDS_QP_1024 0
8688 endif
8689
8690 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
8691   meta    __PDS_QP_1024      (__MIME_QPC > 0) && (__MIME_QPC < 1024)
8692 endif
8693
8694 if !plugin(Mail::SpamAssassin::Plugin::MIMEEval)
8695   meta    __PDS_QP_128 0
8696 endif
8697
8698 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
8699   meta    __PDS_QP_128       (__MIME_QPC > 0) && (__MIME_QPC < 128)
8700 endif
8701
8702 if !plugin(Mail::SpamAssassin::Plugin::MIMEEval)
8703   meta    __PDS_QP_512 0
8704 endif
8705
8706 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
8707   meta    __PDS_QP_512       (__MIME_QPC > 0) && (__MIME_QPC < 512)
8708 endif
8709
8710 if !plugin(Mail::SpamAssassin::Plugin::MIMEEval)
8711   meta    __PDS_QP_64 0
8712 endif
8713
8714 ifplugin Mail::SpamAssassin::Plugin::MIMEEval
8715   meta    __PDS_QP_64        (__MIME_QPC > 0) && (__MIME_QPC < 64)
8716 endif
8717
8718 header   __PDS_RDNS_MTA X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*(mta|mail|mx|smtp)\b\S* /i
8719
8720 if (version >= 3.004002)
8721 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
8722 body     __PDS_SENT_TO_EMAIL_ADDR /This message was sent to Email Address\./i
8723 endif
8724 endif
8725
8726 if (version >= 3.004002)
8727 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
8728 body     __PDS_SEO1 /(?:top|first page|1st) (?:(?:results|rank(?:ing)?) )?(?:in|of|on) (?:Google|MSN|Yahoo|Bing)|rank number one|top page rank|guarantee you 1st|link.building/i
8729 endif
8730 endif
8731
8732 if (version >= 3.004002)
8733 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
8734 body     __PDS_SEO2 /losing your (?:[a-z]+ )?(?:rank(?:ing)?|results)|rank well on [a-z]+\b/i
8735 endif
8736 endif
8737
8738 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
8739 if (version >= 3.004000)
8740 meta     __PDS_SHORT_URL __SHORT_URL && !__URL_SHORTENER && !ALL_TRUSTED
8741 endif
8742 endif
8743
8744 if (version >= 3.004001)
8745 ifplugin Mail::SpamAssassin::Plugin::AskDNS
8746 tflags   __PDS_SPF_ONLYALL net
8747 endif
8748 endif
8749
8750 meta     __PDS_SPOOF_GMAIL_MID __PDS_FROM_GMAIL && !__PDS_GMAIL_MID && !__FSL_RELAY_GOOGLE
8751
8752 header   __PDS_TONAME_EQ_TOLOCAL To:raw =~ /^\s*['"]?([^'"]+)['"]? <?\1\@/
8753
8754 if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
8755   header     __PDS_TO_EQ_FROM_NAME_1  ALL =~ /\nTo:\s+(?:[^\n<]{0,80}<)?([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*From:\W+(\1)([^\n\w<]++<)?((?!\1)[^\n">]++)>?\n/ism
8756 endif
8757
8758 if can(Mail::SpamAssassin::Conf::perl_min_version_5010000)
8759   header     __PDS_TO_EQ_FROM_NAME_2  ALL =~ /\nFrom:\W+"([\w+.-]+\@[\w.-]+\.\w\w+)(?:[^\n\w<]{0,80}<)?((?!\1)[^\n">]++)>?\n(?:[^\n]{1,100}\n)*To:\s+(?:[^\n<]{0,80}<)?(\1)>?/ism
8760 endif
8761
8762 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
8763 if (version >= 3.004000)
8764 meta     __PDS_TO_SUBJ_URISHRT __TO_IN_SUBJ && __URL_SHORTENER && __PDS_MSG_1024
8765 endif
8766 endif
8767
8768 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
8769 if (version >= 3.004000)
8770 meta     __PDS_URISHORTENER __URL_SHORTENER
8771 endif
8772 endif
8773
8774 meta        __PD_CNT_1        (__PUMPDUMP_01+__PUMPDUMP_02+__PUMPDUMP_03+__PUMPDUMP_04+__PUMPDUMP_05+__PUMPDUMP_06+__PUMPDUMP_07+__PUMPDUMP_08+__PUMPDUMP_09+__PUMPDUMP_10) > 0
8775
8776 body        __PENDING_MESSAGES   /\b(?:messages pending|(?:your|\d+[\])}]?) (?:pending|un(?:delivered|received)) (?:messages|e?-?mails))\b/i
8777
8778 body       __PERFECT_BINARY            /\bperfect binary option\b/i
8779
8780 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8781   mimeheader   __PHISH_ATTACH_01_01  Content-Disposition =~ /\bfilename(?:="?[^"]*|\*(?:\d+\*)?=(?:UTF-8'')?\S*)(?:\.|%C2%B7|[\xc2][\xb7]|_)(?:pdf|docx?)\.html?[";$]/i
8782 endif
8783
8784 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8785   mimeheader   __PHISH_ATTACH_01_02  Content-Type =~ /\bname="?[^"]*(?:\.|[\xc2][\xb7]|_)(?:pdf|docx?)\.html?[";$]/i
8786 endif
8787
8788 meta       __PHISH_FBASE_01            (__URI_FIREBASEAPP || __URI_WEBAPP) && __PDS_FROM_NAME_TO_DOMAIN && __MAIL_LINK
8789
8790 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
8791   body       __PHOTO_RETOUCHING         /\b(?:(?:retouching|(?:image|photo|pic)s? (?:[a-z]{1,15} ){0,3}(?:edit(?:ing|ors)|team|(?:cut+|mask|clip+|clean|crop+|resiz|enhanc|etch)ing|cut+(?:ing)?[-\s]?out|enhancement|manipulation|restoration|compositing|working|(?:color|contrast|brightnes+|background|make-?up) (?:cor+ection|change)|solution|work|services?)|(?<!that\s)(?<!\.\s)your (?:imag(?:es|ing)|pics)|photo\s?shop (?:expert|service)s?|(?:deliver (?:the|your) |(?:(?:send|throw|ship|drop|deliver|give|provide|e-?mail) us|(?:cut+(?:ing)?[-\s]?out|masking|(?:test|edit)(?:ing)?) (?:for|of|on|with)) (?:(?:an?|one|your|some|sample|test|example|the) )+)(?:image|photo|pic)s?|(?:proces+|edit)(?:\sover|\smore th[ae]n)? \d{2,5}\D? (?:image|photo|pic)s|improv(?:e|ing) (?:(?:image|photo|picture|pic) (?:quality|lighting)|(?:(?:image|photo|picture|pic) )?(?:resolution|contrast|background|color))|cor+ecting (?:color|contrast|brightnes+|background))\b|(?:e-?com+erce|website|jew[el]+r(?:[y's]+|ies)|model+(?:s|ing)?|products?|portraits?|graduation['s]*|school['s]*|bab(?:[y's]+|ies)|famil(?:[y's]+|ies)|kids|wedding|beauty|glamou?r|catalog['s]*|store['s]*|shop['s]*|(?:cut+(?:ing)?[-\s]?out|clip+ing\spath|(?:all|any) kinds? of|enhance|retouch|edit(?:ing)?)[,;]?(?:\s[a-z]{1,15}){0,4})\s(?:image|photo|pic)s?(?:[.,?]|$|\sand\b|\sor\b|\setc\b)|\b(?:imag(?:es|ing)|photos)\s\d+$)/i
8792   tflags     __PHOTO_RETOUCHING         multiple maxhits=5
8793 endif
8794
8795 header  __PHPMAILER_MUA       X-Mailer =~ /^PHPMailer\b/
8796
8797 meta    __PHP_MUA             __PHP_MUA_1 || __PHP_MUA_2
8798
8799 header  __PHP_MUA_1           X-Mailer =~ /^PHP\s?v?\/?\d\./
8800
8801 header  __PHP_MUA_2           X-Mailer =~ /^PHP\d$/
8802
8803 header  __PHP_NOVER_MUA       X-Mailer =~ /^PHP$/
8804
8805 header     __PHP_ORIG_SCRIPT_EVAL      X-PHP-Originating-Script =~ /\beval\b.*\bcode\b/i
8806
8807 meta       __PHP_ORIG_SCRIPT_SONLY     __HAS_PHP_ORIG_SCRIPT && (__TVD_SPACE_RATIO || __SINGLE_WORD_SUBJ || __OBFUSCATING_COMMENT_B)
8808
8809 if !(can(Mail::SpamAssassin::Conf::feature_bug6558_free))
8810   meta        __PILL_PRICE_01        0
8811 endif
8812
8813 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
8814   body        __PILL_PRICE_01        m;(?=[\d .f])(?:free|[\d .]{3}(?:/|per|each)) ?(?=[ptc])(?:pill|tablet|cap(?:sule|let))s?\b;i
8815   tflags      __PILL_PRICE_01        multiple maxhits=3
8816 endif
8817
8818 if !(can(Mail::SpamAssassin::Conf::feature_bug6558_free))
8819   meta        __PILL_PRICE_02        0
8820 endif
8821
8822 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
8823   body        __PILL_PRICE_02        /(?=[ptc])(?:pill|tablet|cap(?:sule|let))s[-= :]{1,5}\$?[\d .]{3}/i
8824   tflags      __PILL_PRICE_02        multiple maxhits=3
8825 endif
8826
8827 body           __PLS_REVIEW       /\b(?:please|kindly)\s(?:(?:re)?view|see)(?:\s\w+)?\sattach(?:ed|ment)\b/i
8828
8829 ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
8830 header   __PLUGIN_FROMNAME_EQUALS_TO eval:check_fromname_equals_to()
8831 endif
8832
8833 ifplugin Mail::SpamAssassin::Plugin::FromNameSpoof
8834 header   __PLUGIN_FROMNAME_SPOOF eval:check_fromname_spoof()
8835 endif
8836
8837 uri         __PS_TEST_LOC_WP   m;/(?:wp-content/plugins|wp-content/themes|wp-includes|modules/mod_wdbanners|includes/|google_recommends|mt-static|data/module)/.{1,128}(?!\.gif|\.jpg|\.png|\.bmp|\.ico|\.pdf|\.svg)[^?]{4}(?:\?[^?]{1,5})?$;i
8838
8839 body        __PUMPDUMP_01     /\b(?:times|multiply|tripl(?:e|ing)|quadrupl(?:e|ing)|quintupl(?:e|ing)) (?:your|an) (?:princip(?:al|le)|investment)\b/i
8840
8841 body        __PUMPDUMP_02     /\b(?:sto[ck]{2}|share price) (?:will |may |is (?:(?:about|poised|positioned|ready) to |gonna ))?(?:triple|quadruple|quintuple|soar|go(?:es?) (?:nuts|crazy|sky high|way up))\b/i
8842
8843 body        __PUMPDUMP_03     /\bbuy (?:[^.!]{1,30} )?(?:(?:(?:mon|tues|wednes|thurs|fri)day|tomorrow) (?:first thing|open|morning)|(?:first thing|opens|before) (?:(?:mon|tues|wednes|thurs|fri)day|tomorrow))/i
8844
8845 body        __PUMPDUMP_04     /\bmake you (?:big bucks|hundreds|thousands)\b/i
8846
8847 body        __PUMPDUMP_05     /\b(?:tripled|quadrupled|quintupled|(?:shares|value|company) (?:go up|increase|has (?:increased|gained)) (?:by|more than) [a-z\s]{0,20}\d+(?: times| percent| ?%)) (?:and that )?in (?:(?:\d|a (?:span of|few)) days|a very short period)\b/i
8848
8849 body        __PUMPDUMP_06     /\brecommend(?:ed|s)? (?:a|this) (?:company|stock)\b/i
8850
8851 body        __PUMPDUMP_07     /\b(?:buy|grab it) for (?:around |about |less than )?\d+ cents\b/i
8852
8853 body        __PUMPDUMP_08     /\b?(:sto[ck]{2}|sotk) of the year/i
8854
8855 body        __PUMPDUMP_09     /\b(?:buy|get|snap up|grab) as many shares (?:of it )?as (?:you|I) can\b/i
8856
8857 body        __PUMPDUMP_10     /\btrading at (?:such )?a (?:bargain|cheap|low)\b/i
8858
8859 body     __RANDOM_PICK    /\b(?:random(?:ly)?\s(?:\w+\s)?(?:select(?:ion|ed)|pick(?:ed)?|computer)|(?:select|pick)ed\s(?:at\s)?random(?:ly)?|(?:esco(?:g|lh)idos|seleccion) (?:aleatoria(?:mente)?|al azar))\b/i
8860
8861 header    __RAND_HEADER                ALL =~ /^(?!Accept-Language|Authentication-Results|Content-|DomainKey-Signature|DKIM-|List-|MIME-|Received-SPF|Return-Path|Thread-|User-Agent|Tracking-Code)(?:[a-z]{4,}-[a-z]{3,}|[a-z]{3,}-[a-z]{4,}):\s+\d(?=\S{6,}\s*$)[\da-f]*(?:[-.]\w+)*\s*$/ism
8862 tflags    __RAND_HEADER                multiple maxhits=4
8863
8864 meta      __RAND_HEADER_2              __RAND_HEADER > 1
8865
8866 header    __RAND_MKTG_HEADER           ALL =~ /^X-(?:[a-z]{2}){1,2}-(?:EBS|(?:Tracking|Subscriber|Delivery|Customer|Campaign)-[DSU]?id):/ism
8867
8868 header __RATWARE_BOUND_A  ALL =~ /^Message-Id: <....([0-9a-f]{8})\$[0-9a-f]{8}\$.{10,400}boundary="----=_NextPart_000_...._\1\./msi # "
8869
8870 header __RATWARE_BOUND_B  ALL =~ /boundary="----=_NextPart_000_...._([0-9a-f]{8})\..{10,400}^Message-Id: <....\1\$[0-9a-f]{8}\$/msi # "
8871
8872 header __RCD_RDNS_MAIL X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*\bmail[^a-z]/i
8873 tflags __RCD_RDNS_MAIL nice
8874
8875 header __RCD_RDNS_MAIL_MESSY X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*mail/i
8876 tflags __RCD_RDNS_MAIL_MESSY nice
8877
8878 header __RCD_RDNS_MTA X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*\bmta[^a-z]/i
8879 tflags __RCD_RDNS_MTA nice
8880
8881 header __RCD_RDNS_MTA_MESSY X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*mta/i
8882 tflags __RCD_RDNS_MTA_MESSY nice
8883
8884 header __RCD_RDNS_MX X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*\bmx[^a-z]/i
8885 tflags __RCD_RDNS_MX nice
8886
8887 header __RCD_RDNS_MX_MESSY X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*mx/
8888 tflags __RCD_RDNS_MX_MESSY nice
8889
8890 header __RCD_RDNS_OB X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*\boutbounds?[^a-z]/i
8891 tflags __RCD_RDNS_OB nice
8892
8893 header __RCD_RDNS_SMTP X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*\bsmtps?[^a-z]/i
8894 tflags __RCD_RDNS_SMTP nice
8895
8896 header __RCD_RDNS_SMTP_MESSY X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*smtp/
8897 tflags __RCD_RDNS_SMTP_MESSY nice
8898
8899 header     __RCVD_DOTEDU_EXT           X-Spam-Relays-External =~ /\srdns=\S+\.edu\s/i
8900
8901 meta       __RCVD_DOTEDU_SHORT         __RCVD_DOTEDU_EXT && ( __HTML_IMG_ONLY || __BODY_URI_ONLY || __HTML_LENGTH_1024_1536 )
8902
8903 meta       __RCVD_DOTEDU_SUSP_URI      __RCVD_DOTEDU_EXT && ( __45_ALNUM_URI || __45_ALNUM_URI_O || __64_ANY_URI )
8904
8905 header     __RCVD_DOTGOV_EXT           X-Spam-Relays-External =~ /\srdns=\S+\.gov\s/i
8906
8907 header         __RCVD_ZIXMAIL        X-Spam-Relays-Untrusted =~ / helo=smtpout\.zixmail\.net /
8908
8909 header __RDNS_LONG      X-Spam-Relays-External =~ /^[^\]]+ rdns=\S{30}/
8910
8911 header __RDNS_NO_SUBDOM X-Spam-Relays-External =~ /^[^\]]+ rdns=[^. ]*\.\w+ /
8912
8913 header     __RDNS_NUMERIC_TLD          X-Spam-Relays-External =~ /\srdns=\S+\.\d+\s/
8914
8915 header __RDNS_SHORT     X-Spam-Relays-External =~ /^[^\]]+ rdns=\S{4,14} /
8916
8917 body       __RECEIVE_BONUS             /\byou(?:'ll)?(?: also| will)* (?:rec[ei]*ve|get|earn|collect|be (?:awarded|handed|remitted|given|paid|(?:greeted|welcomed|started) with)) (?:an? )?(?:gift|bonus|extra)(?: of|:)? \$[\d,]+/i
8918
8919 header __RELAY_THRU_WWW Received =~ /from (?:[^ \@]+\@)?www\./
8920
8921 body        __RELEASE_MESSAGES   /\b(?:release messages|(?:retrieve|release|download) your(?: undelivered|unreceived|held|pending)? e?-?mails|(?:e?-?mails|messages).{1,20}download them now)\b/i
8922
8923 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # {
8924   meta  __REMOTE_IMAGE  (__HTML_IMG_ONLY || __HTML_LINK_IMAGE) && !(__SUBSCRIPTION_INFO || __VIA_ML || __SENDER_BOT || __ANY_IMAGE_ATTACH)
8925 endif
8926
8927 if (version >= 3.004002)
8928 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
8929 header   __REPLYTO_ADDRLIST_SUSPNTLD eval:check_replyto_in_list('SUSP_NTLD')
8930 endif
8931 endif
8932
8933 header      __REPLYTO_NOREPLY          Reply-To =~ /\bno-?reply@/i
8934
8935 header __REPTO_419_FRAUD_AOL_LOOSE Reply-To:addr =~ /^(?=[^\s<>@]+\@aol\.com)(?:(?:a(?:f\.|ljaber)|c(?:hanprivacy|laimdept|ristinabruno|ustom_service)|dhodgkins|evelynjoshua|f(?:d\.|ernandezfernandez)|george_clifford|hernandezrosemary|k\.doreen|l(?:erynnewest|ynnpage)|m(?:_l\.wanczyk|asayohara|rsjanetedwards)|officework|paulpollard|royalpalace|spwalker|usembassy|yurdaaytarkan))\d+\@aol\.com$/i
8936
8937 header __REPTO_419_FRAUD_GM_LOOSE Reply-To:addr =~ /^(?=[^\s<>@]+\@gmail\.com)(?:(?:9porssts|a(?:\.wafager|b(?:dullahmundani|u(?:lkareem|shadi))|cecere|isha1976gaddafi|l(?:an\.austin|ex(?:anderpeterson|hoffman)|ghafrij|kasimunadi|l(?:enholden|isoncluade)|ure\.wawrenka)|m(?:bassadormarybethleonardl|ericadeliverycomapny|ina(?:ltwaijiri|medjahed))|n(?:dyfox|na(?:llee|sigurlaug))|office1office|radka|shwestwood|ustinbillmark|zi(?:m(?:\.hpremji|hashim(?:donation)?)|z(?:dake|george)))|b(?:a(?:nkcentralasiahalobca|r(?:bersmadar|risterlordruben|teld\.huisman))|bongo|e(?:alitoniua|linekra|n(?:ezero|gatl|jaminsarah))|ill\.lawrence|mwautomobile|oarddept|rendalaporte|uffettwarrene)|c(?:h(?:a(?:ngching|r(?:itylisajohnrobinson|l(?:esluenga|tonnewmanus)))|e(?:mchung|nchung))|iticonsultantjohncg|laxtonpaul|o(?:lombasjuan|ntactad)|rist(?:brun?|davis|ydavisdonation)|ustomerservicelacaixa)|d(?:a(?:nnuar|vi(?:d(?:\.loanfirm|larbi|pere|ramirez\.luis)|scarolyn|yax))|e(?:nnisclark|partmentofstate)|minique|ona(?:ldwilliam|tionhelpercare)|rdavidrhama|unsilva)|e(?:benezero|christina|l(?:i(?:bethgomez|sabethmaria|zabethedw)|o(?:diesawadogo|tocashoffice))|m(?:efieleg?|ilyrichmond)|re(?:nakgeorge|zcelic)|stherkatherine|wynn)|f(?:\.mikhail|a(?:ithdesrie|tme\.mehmed)|blott|irstbank|r(?:a(?:100dub|n(?:c(?:espatrickconnolly|iscamendoza)|k(?:jane|linpiesie)))|eelottosweepstake)|spero|ulanlan)|g(?:00gleggewinner|a(?:briel(?:eschmitt|kalia)|rciavincent)|bill|e(?:neralwilliamstony|orgekwame|raldjhjh)|iidp|l(?:enmoore|oriachow)|oo(?:golteam|oglegwiinner)|r(?:aceobia|e(?:ant|energeoffrey)))|h(?:a(?:r(?:gate|ryebert)|sh(?:imyreem|mireem))|e(?:atherbrooeke|ctor(?:castillos|scastillo)|lengiggs)|gold|ildad|o(?:nmackjohn|rnbeckmajordennis|seoky))|i(?:bed|mfdeputyoff|n(?:fo\.annedouglas|gridrolle)|rvinekim|smail(?:eman|tarkan))|j(?:a(?:mesokoh|vierlesme)|efferydean|o(?:edward|hn(?:griffn|r(?:awlings|oxfordjr)|sonwilson|uba|walterlove|a)|n(?:athanhaskel|hugo)|seph(?:acevedo|ichael)|vannyanderson)|rawlings|uliewatson)|k(?:a(?:l(?:iaksandr|tschmidtdavid)|malnizar|rabo\.ramala|t(?:jamess|rinaziako))|ennedy\.sawadogo|halidbuhazza|kasbu|rnkl|un(?:gwei|ioue))|l(?:a(?:rrytoms|ursent|wrencefoundation)|e(?:enasinghs|rynne(?:0west|west))|i(?:amfinchus|fecshortt|liane\.bettencourt|nelink|sa(?:milner|robin))|john|oughreymargaret|u(?:ckywinners|sba\.moored)|y(?:\.cheapiseth|diawright|n(?:\.arthur|cmba|nmkl)))|m(?:a(?:incare|jor(?:dennishornbeck|townsend)|lletman|n(?:duesq|fran|uelfranco(?:(?:donation|foundation|spende))?)|r(?:i(?:ahhills|opabl)|kroth|shalh|tinamayer|y(?:franson|josen))|urhinck|viswan(?:czyk(?:(?:foundation|k))?)?)|c\.cheadychang|dredban|elvidabullock|gfrederick|i(?:c(?:h(?:ael\.woosley|ealwuu)|w)|k(?:e\.weirsky\.foundational|hai(?:\.fridman|lfridm))|ss\.yasmineibrahim)|k(?:ent|untjoro)|oham(?:edabdul|m(?:daljililati|edshamekh))|r(?:\.(?:elbahi\.mohammed\.|justinmaxwell)|cjames|ericschmid|hanimuhammad|jamesmc|richardanthony|s(?:\.susanread|a(?:ishaalqadafi|ngela)|dominiquethomas|evelynbrown|fatimaamiraqureshi|hamima|jackman|lisamilner|ma(?:ureens|yaoliver)|r(?:obinsanders|uthsmith)|sarahbenjamin|victoriaedmond))|s(?:\.ellagolan|agent|golaan|smadar)|ustadris)|n(?:aomiiwasaki|eilt(?:rotter)?|icholas\.jose|obuyuki\.hirano)|o(?:\.peace|fficerricherd|hallkenneth|xfaminternationa)|p(?:aul(?:eed|n)|b(?:ph202lay|rookk)|e(?:rezdonlorenzo|ter(?:\.waddell|guggi|kenin|stephen))|hillip\.richead)|q(?:iquanzhou|nzeng)|r(?:a(?:kidy|lhashimi|ymondaba)|e(?:alyh|beccagarang|em(?:has(?:himy|m)|n)|plyback|v(?:\.jamesabel|fr(?:ankjackson|paulwilliams)))|icha(?:miller|rdw(?:ahl|illis))|main|o(?:b(?:erthanandez|inf)|naldmorris|s(?:a\.gomes|ekipkalya))|raya|t\.rev\.ericmark|uddicklana)|s(?:a(?:l(?:ehhussienconsult|imzaid)|rfiafarfask)|cottpeters|e(?:cretservicce|rgeantrobertbrown)|gt(?:\.monicab|ireneb)|h(?:anemissler|ery(?:\.gtl|etr)|inawatrathaksin)|im(?:lkheng|onhei)|op(?:adam|hiajesse)|peelman|t(?:anleyjohn|ephentam)|u(?:iyang|n\.hor|sanneklatten)|weeneyjohnson)|t(?:a(?:mmywebster|y(?:ebsouami|lorcathy))|erryparkins|h(?:ailandbankoffice|e(?:ara\.choy|odorosloannis))|imothymetheny|lyerdonald|o(?:m(?:ander|c(?:hrist|rist(?:(?:donation|foundation))?)|spende)|ny(?:\.chung|zimpro)|shikazusendo))|u(?:marukareem|n(?:claimedfunds|itednation(?:organization|s))|s(?:alotery|departmentofjustice))|v(?:anderwesthuizen|e(?:enapatel|r(?:a(?:aellen|hollinkvan)|enichekaterinaekaterina))|i(?:ctoriaabraham|dalpamela|ngut))|w(?:a(?:dp|hlr(?:ichard)?|nczykm|rrenebuffett)|hatsappofficial|i(?:elandherzog\.sw\.herad|ll(?:clark|iamsmartyrs))|u\.office|ww\.moneygram)|y(?:\.oguzhan|anghoseok|doo|o(?:ngkm|usefzongo))|z(?:bank|enithbankplconline|kiaslan|minhong)))\d+\@gmail\.com$/i
8938
8939 header __REPTO_419_FRAUD_YH_LOOSE Reply-To:addr =~ /^(?=[^\s<>@]+\@yahoo\.com)(?:(?:a(?:driantongson|ilmohammed|lesiakalina|nnhester\.usa)|b(?:ank\.phbng|en(?:jaminb|nicholas)|riceangela)|c(?:\.aroline|h(?:arlesscharf|jackson)|juan|ythiamiller\.un)|dhamilton|e(?:denvictor|ricalbert)|federal\.r|j(?:a(?:ckson\.davis|netemoon)|kimyong)|k(?:altschmidtdavid|elvinmark|im(?:\.leang|leang))|l(?:e(?:a_edem|hman)|isarobinson_|y_cheapiseth)|m(?:\.kogi|arie_avis|dzsesszika|elissalewis|o(?:hammedaahil|keye))|o(?:legkozyrev|mranshaalan)|peterlee|r(?:alphw(?:\.johnson|johnson)|o(?:bertbailey|serichard))|s(?:amthong|igurlauganna|leo|pwalker|te(?:fanopessina|vecox\.))|tylerhess\.|vanserge|will(?:clark|smi)|xianglongdai))\d+\@yahoo\.com$/i
8940
8941 header    __REPTO_CHN_FREEM             Reply-To =~ /\@(?:sina|aliyun)\.com/i
8942
8943 header     __REPTO_INFONUMSCOM         Reply-To:addr =~ /^info@\d{5,}\.com$/i
8944
8945 header    __REPTO_RUS_FREEM             Reply-To =~ /\@mail\.ru/i
8946
8947 if !((version >= 3.003000))
8948   meta        __RP_MATCHES_RCVD      0
8949 endif
8950
8951 if (version >= 3.003000)
8952 if !plugin(Mail::SpamAssassin::Plugin::WLBLEval)
8953   meta        __RP_MATCHES_RCVD      0
8954 endif
8955 endif
8956
8957 if (version >= 3.003000)
8958 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
8959   header      __RP_MATCHES_RCVD      eval:check_mailfrom_matches_rcvd()
8960 endif
8961 endif
8962
8963 body     __SCAM           /\bscam(?:m?e[dr])?s?\b/i
8964
8965 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8966 mimeheader      __SCC_BOGUS_CTE_1       Content-Transfer-Encoding =~ /^Hexa/i
8967 endif
8968
8969 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
8970 mimeheader      __SCC_CTMPP     Content-Type =~ /multipart\/parallel/
8971 endif
8972
8973 body        __SECURITY_DEPT      /\bsecurity dep(?:artmen)?t\b/i
8974
8975 header   __SENDER_BOT   ALL =~ /(?:not?\W?repl[yi]|bounce|contact|daemon|subscri|report|respon[ds]e?r?s?\b|\b(?:root|news|nobody|agent|(?:post|web)?master|manag|send(?:er|ing)?|out|(?:bot|web|www)\b))[^\@ >]{0,5}s?\@\w/i
8976 tflags   __SENDER_BOT   nice
8977
8978 uri        __SENDGRID_REDIR            m,://u\d+\.ct\.sendgrid\.net/ls/click\?upn=,
8979
8980 meta       __SENDGRID_REDIR_NOPHISH    __SENDGRID_REDIR && !__SENDGRID_REDIR_PHISH
8981
8982 meta       __SENDGRID_REDIR_PHISH      __SENDGRID_REDIR && ( __PDS_FROM_NAME_TO_DOMAIN || __FORGED_RELAY_MUA_TO_MX || __TO_IN_SUBJ )
8983
8984 body     __SHARE_IT       /\b(?:(?:share|allocate|teilen|parteger(?:ez|ons)?|partage)\s(?:th(?:e|is)|das|les?|des)\s(?:proceeds|funds?|money|balance|account|geld|compte|fonds)|partager(?:ez|ons)? (?:avec (?:vous|moi)|ratio|suivant un pourcentage))\b/i
8985
8986 meta       __SHOPIFY_IMG_NOT_RCVD_SFY  __URI_IMG_SHOPIFY && !__HDR_RCVD_SHOPIFY && !__HDR_ENVFROM_SHOPIFY
8987
8988 uri      __SHORT_URL    /^https?:\/\/[^\/]{3,6}\.\w\w\/[^\/]{3,8}\/?$/
8989
8990 body        __SINGLE_WORD_LINE  /^\s?\S{1,60}\s?$/
8991 tflags      __SINGLE_WORD_LINE  multiple maxhits=2
8992
8993 header      __SINGLE_WORD_SUBJ  Subject =~ /^\s*\S{1,60}\s*$/
8994
8995 header      __SMIME_MESSAGE    Content-Type =~ /application\/pkcs7-mime;/i
8996
8997 rawbody        __SPAN_BEG_TEXT     /[a-z]{2}<(?i:span)\s/
8998 tflags         __SPAN_BEG_TEXT     multiple maxhits=5
8999
9000 rawbody        __SPAN_END_TEXT     /[^;>]<\/(?i:span)>[a-z]{3}/
9001 tflags         __SPAN_END_TEXT     multiple maxhits=5
9002
9003 if !plugin(Mail::SpamAssassin::Plugin::SPF)
9004   meta            __SPF_FULL_PASS         0
9005 endif
9006
9007 ifplugin Mail::SpamAssassin::Plugin::SPF
9008   meta            __SPF_FULL_PASS         (SPF_PASS && SPF_HELO_PASS)
9009   tflags          __SPF_FULL_PASS         net
9010 endif
9011
9012 if !plugin(Mail::SpamAssassin::Plugin::SPF)
9013   meta            __SPF_RANDOM_SENDER     0
9014 endif
9015
9016 ifplugin Mail::SpamAssassin::Plugin::SPF
9017   meta            __SPF_RANDOM_SENDER     (SPF_HELO_PASS && !SPF_PASS)
9018   tflags          __SPF_RANDOM_SENDER     net
9019 endif
9020
9021 meta     __SPOOFED_FREEMAIL     !__NOT_SPOOFED && FREEMAIL_FROM
9022 tflags   __SPOOFED_FREEMAIL     net
9023
9024 meta      __SPOOFED_FREEM_REPTO         __SPOOFED_FREEMAIL && FREEMAIL_REPLYTO
9025 tflags    __SPOOFED_FREEM_REPTO         net
9026
9027 rawbody  __SPOOFED_URL  m/<a\s[^>]{0,2048}\bhref=(?:3D)?.?(https?:[^>"'\# ]{8,29}[^>"'\# :\/?&=])[^>]{0,2048}>(?:[^<]{0,1024}<(?!\/a)[^>]{1,1024}>){0,99}\s{0,10}(?!\1)https?[^\w<]{1,3}[^<]{5}/i
9028
9029 meta        __STATIC_XPRIO_OLE   __XPRIO && __RDNS_STATIC && __HAS_MIMEOLE
9030
9031 body       __STAY_HOME                 /\b(?:going out of|leaving)(?: your)? (?:home|house|residence)\b/i
9032
9033 body        __STOCK_TIP       /\bsto[ck]{2}\s?tip\b/i
9034
9035 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9036   rawbody   __STY_INVIS                   /\bstyle\s*=\s*"[^">]{0,80}(?:(?<!-)visibility\s*:\s*hidden\s*|display\s*:\s*none\s*)[;"!]/i
9037   tflags    __STY_INVIS                   multiple maxhits=6
9038 endif
9039
9040 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9041   meta      __STY_INVIS_1                 __STY_INVIS == 1
9042 endif
9043
9044 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9045   meta      __STY_INVIS_1_MINFP           __STY_INVIS_1 && !MIME_QP_LONG_LINE && !__MOZILLA_MSGID
9046 endif
9047
9048 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9049   meta      __STY_INVIS_2                 __STY_INVIS > 1
9050 endif
9051
9052 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9053   meta      __STY_INVIS_3                 __STY_INVIS > 2
9054 endif
9055
9056 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9057   meta      __STY_INVIS_DIRECT            __STY_INVIS && __DOS_DIRECT_TO_MX_UNTRUSTED
9058 endif
9059
9060 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9061   meta      __STY_INVIS_MANY              __STY_INVIS > 5
9062 endif
9063
9064 header     __SUBJECT_EMPTY              Subject:raw =~ /^\s*$/
9065
9066 meta       __SUBJECT_PRESENT_EMPTY      __HAS_SUBJECT && __SUBJECT_EMPTY
9067
9068 header      __SUBJ_ADMIN         Subject =~ /\b(?:(?:sys)?admin(?:istrator)?|server|service|support)\b/i
9069
9070 meta        __SUBJ_BRKN_WORDNUMS   __SUBJ_BROKEN_WORD && __TVD_SUBJ_NUM_OBFU
9071
9072 header      __SUBJ_BROKEN_WORD     Subject =~ /\s(?!i[PTM][aoh][bcdou]|e[MP]a[is])[a-z]{1,3}[A-Z][a-z]{2}/
9073 tflags      __SUBJ_BROKEN_WORD     multiple maxhits=2
9074
9075 meta        __SUBJ_DOM_ADMIN     __SUBJ_ADMIN && __PDS_FROM_NAME_TO_DOMAIN
9076
9077 header         __SUBJ_HAS_FROM_1    ALL =~ /\nFrom:\s+(?:[^\n<]{0,80}<)?([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*Subject:\s+[^\n]{0,100}\1[>,:\s\n]/ism
9078
9079 header         __SUBJ_HAS_TO_1      ALL =~ /\nTo:\s+(?:[^\n<]{0,80}<)?([^\n\s>,]+)>?\n(?:[^\n]{1,200}\n)*Subject:\s+[^\n]{0,100}\1[^a-z0-9]/ism
9080
9081 header         __SUBJ_HAS_TO_2      ALL =~ /\nReceived:[^\n]{0,200} for <?([^\n\s>;]+)>?;(?:[^\n]+\n)*Subject:\s+[^\n]{0,100}\1[^a-z0-9]/ism
9082
9083 header         __SUBJ_HAS_TO_3      ALL =~ /\nSubject:(?=[^\n]{0,200}@)[^\n]{0,200}([a-z][a-z0-9_.]{3,80}@(?:[a-z0-9_]{1,80}\.){1,4}[a-z]{2,30})(?:[^\n]+\n)*To:\s+[^\n]{0,100}\1[^a-z0-9.]/ism
9084
9085 header   __SUBJ_NOT_SHORT       Subject =~ /^.{16}/
9086
9087 header      __SUBJ_OBFU_PUNCT      Subject =~ /(?:[-~`"!@\#$%^&*()_+={}|\\\/?<>,.:;][a-z][-~`"!@\#$%^&*()_+={}|\\\/?<>,.:;\s]|(?:[a-z][~`"!@\#$%^&*()_+={}|\\?<>,.:;][a-z](?![a-z])))/i
9088 tflags      __SUBJ_OBFU_PUNCT      multiple maxhits=4
9089
9090 header   __SUBJ_RE              Subject =~ /^(?:R[eE]|S[vV]|V[sS]|A[wW]):/
9091
9092 header __SUBJ_SHORT     Subject =~ /^.{0,8}$/
9093
9094 header     __SUBJ_USB_DRIVES          Subject =~ /\bUSB (?:[Ff]lash )?[Dd]rives\b/
9095
9096 body     __SUBSCRIPTION_INFO    /\b(?:e?newsletters?|(?:un)?(?:subscrib|register)|you(?:r| are) subscri(?:b|ption)|opt(?:.|ing)?out\b|further info|you do ?n[o']t w(?:ish|ant)|remov\w{1,3}.{1,9}\blists?\b|to your white.?list)/i
9097 tflags   __SUBSCRIPTION_INFO    nice
9098
9099 body     __SUM_OF_FUND    /\b(?:sum|release|freigabe)\s(?:of|der)\s(?:amount|fund|investment|mittel)\b/i
9100
9101 body        __SURVEY           /\bsurvey\b/i
9102
9103 body     __SURVIVORS      /\b(?:widow|son|daughter|husband|wife|brother|sister|attorney|vi(?:=FA|[\xfa]|[\xc3][\xba])va|esposa|veuve)\s(?:of|to|do|de)\s(?:the\s)?(?:late|falecido|finales|feu|d(?:e|=E9|[\xe9]|[\xc3][\xa9])funt|mr\.?)\s\w+\b/i
9104
9105 body        __SUSPICION_LOGIN    /\bsuspicion login\b/i
9106
9107 body        __SYSADMIN           /\b(?:help?[- ]?desk|(?:(?:web ?)?mail ?|sys(?:tem )?)admin(?:istrator)|local[- ]host|(?:support|upgrade|management|security|admin(?:istrat(?:or|ion))?) (?:team|center)|message from administrator|university mail server copyright|suporte t(?:=E9|[\xe9]|[\xc3][\xa9])cnico|administrador do sistema)\b/i
9108
9109 meta       __TAGSTAT_IMG_NOT_RCVD_TGST __URI_IMG_TAGSTAT && !__HDR_RCVD_TAGSTAT
9110
9111 meta       __TARINGANET_IMG_NOT_RCVD_TN  __URI_IMG_TARINGANET && !__HDR_RCVD_TARINGANET
9112
9113 header         __TB_MIME_BDRY_NO_Z   Content-Type =~ /boundary="-{8,}(?:[1-9]){16}/
9114
9115 rawbody        __TENWORD_GIBBERISH    /^\s*(?:[a-z]+\s+){10}\.$/m
9116 tflags         __TENWORD_GIBBERISH    multiple maxhits=21
9117
9118 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
9119   mimeheader   __TEXT_XML_MT       Content-Type =~ m,\btext/xml\b,i
9120 endif
9121
9122 body     __THEY_INHERIT   /\b(?:inherit\sth(?:e|is)\smoney|herede\sest[ea]\sdinero)\b/i
9123
9124 body        __THIS_AD         /(?:\b|_)this[- _]+(?:ad(?:vert[i1l]sement)?|promo(?:tion)?)s?(?:\b|_)/i
9125
9126 meta    __THREADED     (!__MISSING_REPLY && !__NO_INR_YES_REF) || (__MISSING_REPLY && !__MISSING_REF)
9127 tflags  __THREADED     nice
9128
9129 header __THREAD_INDEX_GOOD  Thread-Index =~ m,^A[a-z0-9][A-Za-z0-9+/]{27}(?:[A-Za-z0-9+/]{20})?(?:[AQgw]==|[A-Za-z0-9+/]{7}|[A-Za-z0-9+/]{13}[AEIMQUYcgkosw048]=)$,
9130
9131 header         __TO_ALL_NUMS        To:addr =~ /^\d+@/
9132
9133 meta           __TO_EQ_FM_DIRECT_MX __TO_EQ_FROM && __DOS_DIRECT_TO_MX
9134
9135 if !plugin(Mail::SpamAssassin::Plugin::SPF)
9136   meta           __TO_EQ_FM_DOM_SPF_FAIL  0
9137 endif
9138
9139 ifplugin Mail::SpamAssassin::Plugin::SPF
9140   meta           __TO_EQ_FM_DOM_SPF_FAIL  __TO_EQ_FROM_DOM && SPF_FAIL
9141   tflags         __TO_EQ_FM_DOM_SPF_FAIL  net
9142 endif
9143
9144 if !plugin(Mail::SpamAssassin::Plugin::SPF)
9145   meta           __TO_EQ_FM_SPF_FAIL  0
9146 endif
9147
9148 ifplugin Mail::SpamAssassin::Plugin::SPF
9149   meta           __TO_EQ_FM_SPF_FAIL  __TO_EQ_FROM && SPF_FAIL
9150   tflags         __TO_EQ_FM_SPF_FAIL  net
9151 endif
9152
9153 meta           __TO_EQ_FROM         (__TO_EQ_FROM_1 || __TO_EQ_FROM_2)
9154 describe       __TO_EQ_FROM         To: same as From:
9155
9156 header         __TO_EQ_FROM_1       ALL =~ /\nFrom:\s+(?:[^\n<]{0,80}<)?([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*To:\s+(?:[^\n]{0,80}<)?\1[>,\s\n]/ism
9157
9158 header         __TO_EQ_FROM_2       ALL =~ /\nTo:\s+(?:[^\n<]{0,80}<)?([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*From:\s+(?:[^\n]{0,80}<)?\1[>,\s\n]/ism
9159
9160 meta           __TO_EQ_FROM_DOM     (__TO_EQ_FROM_DOM_1 || __TO_EQ_FROM_DOM_2)
9161 describe       __TO_EQ_FROM_DOM     To: domain same as From: domain
9162
9163 header         __TO_EQ_FROM_DOM_1   ALL =~ /\nFrom:\s+[^\n@]{0,80}@([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*To:\s+[^\n]+@\1[>,\s\n]/ism
9164
9165 header         __TO_EQ_FROM_DOM_2   ALL =~ /\nTo:\s+[^\n@]{0,80}@([^\n\s>]+)>?\n(?:[^\n]{1,100}\n)*From:\s+[^\n]+@\1[>,\s\n]/ism
9166
9167 meta     __TO_EQ_FROM_USR       (__TO_EQ_FROM_USR_1 || __TO_EQ_FROM_USR_2) && !(__FROM_DNS || __FROM_INFO || __SENDER_BOT)
9168 describe __TO_EQ_FROM_USR       To: username same as From: username
9169
9170 header   __TO_EQ_FROM_USR_1     ALL =~ /\nFrom:\s+(?:[^\n<]{0,80}<)?([^\n\s\@>]+)\@[^\n\s]+>?\n(?:[^\n]{1,100}\n)*To:\s+(?:[^\n]{0,80}<)?\1[\@>,\s\n]/ism
9171
9172 header   __TO_EQ_FROM_USR_2     ALL =~ /\nTo:\s+(?:[^\n<]{0,80}<)?([^\n\s\@>]+)\@[^\n\s]+>?\n(?:[^\n]{1,100}\n)*From:\s+(?:[^\n]{0,80}<)?\1[\@>,\s\n]/ism
9173
9174 meta     __TO_EQ_FROM_USR_NN    (__TO_EQ_FROM_USR_NN_1 || __TO_EQ_FROM_USR_NN_2) && !(__FROM_DNS || __FROM_INFO || __SENDER_BOT)
9175 describe __TO_EQ_FROM_USR_NN    To: username same as From: username sans trailing nums
9176
9177 header   __TO_EQ_FROM_USR_NN_1  ALL =~ /\nFrom:\s+(?:[^\n<]{0,80}<)?([^\n\s\@>]{4,80}?)\d*\@[^\n\s]+>?\n(?:[^\n]{1,100}\n)*To:\s+(?:[^\n]{0,80}<)?\1\d*[\@>,\s\n]/ism
9178
9179 header   __TO_EQ_FROM_USR_NN_2  ALL =~ /\nTo:\s+(?:[^\n<]{0,80}<)?([^\n\s\@>]{4,80}?)\d*\@[^\n\s]+>?\n(?:[^\n]{1,100}\n)*From:\s+(?:[^\n]{0,80}<)?\1\d*[\@>,\s\n]/ism
9180
9181 meta     __TO_EQ_FROM_USR_NN_MINFP      __TO_EQ_FROM_USR_NN && !__TO_EQ_FROM_USR_1 && !__TO_EQ_FROM && !__TO_EQ_FROM_DOM && !__LCL__ENV_AND_HDR_FROM_MATCH && !__DKIM_EXISTS && !__NOT_SPOOFED && !__RCD_RDNS_SMTP && !__RCD_RDNS_MX_MESSY && !__THREADED
9182
9183 meta           __TO_IN_SUBJ         (__SUBJ_HAS_TO_1 || __SUBJ_HAS_TO_2 || __SUBJ_HAS_TO_3)
9184
9185 header     __TO_NO_ARROWS_R        To !~ /(?:>$|>,)/
9186
9187 if !plugin(Mail::SpamAssassin::Plugin::FreeMail)
9188   meta       __TO_NO_BRKTS_FREEMAIL  0
9189 endif
9190
9191 ifplugin Mail::SpamAssassin::Plugin::FreeMail
9192   meta       __TO_NO_BRKTS_FREEMAIL  __TO_NO_ARROWS_R && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
9193 endif
9194
9195 meta       __TO_NO_BRKTS_FROM_RUNON  __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && __FROM_RUNON
9196
9197 meta       __TO_NO_BRKTS_HTML_IMG  __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && HTML_MESSAGE && __ONE_IMG
9198
9199 meta       __TO_NO_BRKTS_HTML_ONLY __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && MIME_HTML_ONLY
9200
9201 meta       __TO_NO_BRKTS_MSFT       __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && (__ANY_OUTLOOK_MUA || __MIMEOLE_MS)
9202
9203 meta       __TO_NO_BRKTS_NORDNS_HTML    __TO_NO_BRKTS_HTML_ONLY && RDNS_NONE
9204
9205 meta       __TO_NO_BRKTS_PCNT       __TO_NO_ARROWS_R && __FB_NUM_PERCNT
9206
9207 meta       __TO_TOO_MANY_WFH_01        __TO_WAY_TOO_MANY && __WFH_01
9208
9209 header     __TO_UNDISCLOSED        To =~ /\b(?:undisclosed[-\s]recipients|destinataires inconnus|destinatari nascosti)\b/i
9210
9211 header      __TO_WAY_TOO_MANY      ToCc =~ /(?:,[^,]{1,90}){50}/
9212
9213 body     __TO_YOUR_ACCT   /\b(?:(?:f[uo]nds|money|f[uo]ndo|dinheiro|bank)\s(?:\w{1,10}\s){0,4}(?:transfer(?:red)?|transferido|sont)|\d+)\s(?:to|para|en)\s(?:your?|sua|votre)\s(?:account|conta|pos+es+ion)/i
9214
9215 body     __TO_YOUR_ORG       /\b(?:to|for) your organi[sz]ation\b/i
9216
9217 header      __TO___LOWER       ALL =~ /to:\s\S{5}/
9218
9219 body       __TRANSFORM_LIFE            /\b(transform|change) your (?:daily )?life(?:style)?\b/i
9220
9221 body        __TRAVEL_AGENT     /\btravel\sagen(?:t|cy)\b/i
9222
9223 body        __TRAVEL_BUSINESS  /\bbusiness\stravel\b/i
9224
9225 body     __TRAVEL_ITINERARY  /(?:travel|ticketed|your|current) itinerary/i
9226
9227 meta        __TRAVEL_MANY      (__TRAVEL_PROFILE + __TRAVEL_RESERV + __TRAVEL_BUSINESS + __TRAVEL_AGENT) > 2
9228
9229 body        __TRAVEL_PROFILE   /\btravel+er\sprofile\b/i
9230
9231 body        __TRAVEL_RESERV    /\b(?:reservation\s(?:confirmed|number)|travel\sreservations?)\b/i
9232
9233 body     __TRTMT_DEFILED  /\bdefiled\sall\s(?:forms\sof\s)?(?:medical\s)?treatments?\b/i
9234
9235 body     __TRUNK_BOX      /\b(?:(?:trunk|metallic|proof|security|consignment)\sbox(?:es)?|sealed\ssafe|une mallette m(?:e|=E9|[\xe9]|[\xc3][\xa9])tallique)\b/i
9236
9237 body     __TRUSTED_CHECK  /\b(?:cashier'?s?|certified)\sche(?:ck|que)/i
9238
9239 header __TT_BROKEN_VALIUM       Subject =~ /V[:^."%()*\[\\]?A[:^."%()*\[\\]?L[:^."%()*\[\\]?I[:^."%()*\[\\]?U[:^."%()*\[\\]?M/i
9240
9241 header __TT_BROKEN_VIAGRA       Subject =~ /V[:^."%()*\[\\]?I[:^."%()*\[\\]?A[:^."%()*\[\\]?G[:^."%()*\[\\]?R[:^."%()*\[\\]?A/i
9242
9243 header __TT_OBSCURED_VALIUM     Subject =~ /(v|V|\\\/)(a|A|\(a\)|4|@)(l|L|\|)(i|I|1|\xef|\|)(u|U|\(u\))(m|M)/
9244
9245 header __TT_OBSCURED_VIAGRA     Subject =~ /(v|V|\\\/)(i|I|1|\xef|\|)(a|A|\(a\)|4|@)(g|G)(r|R)(a|A|\(a\)|4|@)/
9246
9247 header __TT_VALIUM              Subject =~ /VALIUM/i
9248
9249 header __TT_VIAGRA              Subject =~ /VIAGRA/i
9250
9251 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
9252 mimeheader __TVD_FW_GRAPHIC_ID1 Content-Id =~ /<[0-9a-f]{12}(?:\$[0-9a-f]{8}){2}\@/
9253 endif
9254
9255 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
9256 mimeheader __TVD_MIME_ATT_AOPDF Content-Type =~ /^application\/octet-stream.*\.pdf/i
9257 endif
9258
9259 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
9260 mimeheader __TVD_MIME_ATT_AP    Content-Type =~ /^application\/pdf/i
9261 endif
9262
9263 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
9264 mimeheader __TVD_MIME_ATT_TP    Content-Type =~ /^text\/plain/i
9265 endif
9266
9267 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
9268 mimeheader __TVD_OUTLOOK_IMG    Content-Id =~ /<image\d+\.(?:gif|jpe?g|png)\@/
9269 endif
9270
9271 body __TVD_PH_BODY_01           /\baccount .{0,20}placed? [io]n restricted status/i
9272
9273 body __TVD_PH_BODY_02           /\brecords (?:[a-z_,-]+ )+?(?:feature|(?:a|re)ward)/i
9274
9275 body __TVD_PH_BODY_03           /\byou(?:'ve| have) been (?:[a-z_,-]+ )+?payment/i
9276
9277 body __TVD_PH_BODY_04           /\bfunds? (?!transfer from)(?!from)(?!in)(?!via)(?:[a-z_,-]+ )+?to your (?:[a-z_,-]+ )*?account/i
9278
9279 body __TVD_PH_BODY_05           /\bthis is (?:[a-z_,-]+ )+?protect (?:[a-z_,-]+ )+?your/i
9280
9281 body __TVD_PH_BODY_06           /Dear [a-z]+ bank (?:member|customer)/i
9282
9283 body __TVD_PH_BODY_07           /\bguarantee the safety of your (?:[a-z_,-]+ )*?account/i
9284
9285 body __TVD_PH_BODY_08           /\bmultiple password failures/i
9286
9287 body __TVD_PH_BODY_ACCOUNTS_POST        /\b(?:(?:[dr]e-?)?activat[a-z]*|(?:re-?)?validate|secure|restore|confirm|update|suspend) (?!your)(?:[a-z_,-]+ )+?accounts?\b/i
9288
9289 body __TVD_PH_BODY_ACCOUNTS_PRE         /\baccounts? (?:[a-z_,-]+ )+?(?:record[a-z]*|suspen[a-z]+|notif(?:y|ication)|updated|verifications?|credited)\b/i
9290
9291 meta __TVD_PH_BODY_META         __TVD_PH_BODY_01 || __TVD_PH_BODY_02 || __TVD_PH_BODY_03 || __TVD_PH_BODY_04 || __TVD_PH_BODY_05 || __TVD_PH_BODY_06 || __TVD_PH_BODY_07 || __TVD_PH_BODY_08
9292
9293 header __TVD_PH_SUBJ_00         Subject =~ /\brewards? survey\b/i
9294
9295 header __TVD_PH_SUBJ_02         Subject =~ /\byour payment has been sent\b/i
9296
9297 header __TVD_PH_SUBJ_04         Subject =~ /\baccounts? profile\b/i
9298
9299 header __TVD_PH_SUBJ_15         Subject =~ /\binvestment for (?:[a-z_,-]+ )*?to(?:morrow|day)\b/i
9300
9301 header __TVD_PH_SUBJ_17         Subject =~ /\bremove limitations?\b/i
9302
9303 header __TVD_PH_SUBJ_18         Subject =~ /\bsecurity (?:[a-z_,-]+ )*?changes\b/i
9304
9305 header __TVD_PH_SUBJ_19         Subject =~ /\bmessage (?:[a-z_,-]+ )*?bank\b/i
9306
9307 header __TVD_PH_SUBJ_29         Subject =~ /^notice(?::|[\s\W]*$)/i
9308
9309 header __TVD_PH_SUBJ_31         Subject =~ /\bsecurity (?:[a-z_,-]+ )*?verification\b/i
9310
9311 header __TVD_PH_SUBJ_36         Subject =~ /\bconsumer notice\b/i
9312
9313 header __TVD_PH_SUBJ_37         Subject =~ /\bvalued member[a-z]*\b/i
9314
9315 header __TVD_PH_SUBJ_38         Subject =~ /\bonline bank[a-z]*\b/i
9316
9317 header __TVD_PH_SUBJ_39         Subject =~ /\bonline department\b/i
9318
9319 header __TVD_PH_SUBJ_41         Subject =~ /\bunusual activity\b/i
9320
9321 header __TVD_PH_SUBJ_52         Subject =~ /\b(?:account|online) profile\b/i
9322
9323 header __TVD_PH_SUBJ_54         Subject =~ /\bun-?authorized access(?:es)?\b/i
9324
9325 header __TVD_PH_SUBJ_56         Subject =~ /\brespond now\b/i
9326
9327 header __TVD_PH_SUBJ_58         Subject =~ /\bbilling service\b/i
9328
9329 header __TVD_PH_SUBJ_59         Subject =~ /\bquestion from (?:[a-z_,-]+ )*?member\b/i
9330
9331 header __TVD_PH_SUBJ_ACCESS_POST        Subject =~ /\b(?:(?:re-?)?activat[a-z]*|secure|verify|restore|flagged|limited|unusual|report|notif(?:y|ication)|suspen(?:d|ded|sion)) (?:[a-z_,-]+ )*?access\b/i
9332
9333 meta __TVD_PH_SUBJ_META         __TVD_PH_SUBJ_00 || __TVD_PH_SUBJ_02 || __TVD_PH_SUBJ_04 || __TVD_PH_SUBJ_15 || __TVD_PH_SUBJ_17 || __TVD_PH_SUBJ_18 || __TVD_PH_SUBJ_19 || __TVD_PH_SUBJ_29 || __TVD_PH_SUBJ_31 || __TVD_PH_SUBJ_36 || __TVD_PH_SUBJ_37 || __TVD_PH_SUBJ_38 || __TVD_PH_SUBJ_39 || __TVD_PH_SUBJ_41 || __TVD_PH_SUBJ_52 || __TVD_PH_SUBJ_54 || __TVD_PH_SUBJ_56 || __TVD_PH_SUBJ_58 || __TVD_PH_SUBJ_59 || __TVD_PH_SUBJ_ACCESS_POST
9334
9335 if !plugin(Mail::SpamAssassin::Plugin::BodyEval)
9336   meta      __TVD_SPACE_RATIO      0
9337 endif
9338
9339 header      __TVD_SUBJ_NUM_OBFU    Subject =~ /[a-z]{3,}\d+[a-z]{2,}/i
9340
9341 meta     __T_PDS_MSG_512 (__KAM_BODY_LENGTH_LT_512 || __HTML_LENGTH_512 || __PDS_QP_512)
9342
9343 header   __UA_GNUS              User-Agent =~ /^Gnus/
9344
9345 header   __UA_KMAIL             User-Agent =~ /^KMail/
9346
9347 header   __UA_KNODE             User-Agent =~ /^KNode/
9348
9349 header   __UA_MOZ5              User-Agent =~ /^Mozilla\/5/
9350
9351 header   __UA_MSOEMAC           User-Agent =~ /^Microsoft-Outlook-Express-Mac/
9352
9353 header         __UA_MSOMAC           User-Agent =~ /^Microsoft-MacOutlook\/(?:\d+\.){3}/
9354
9355 header   __UA_MUTT              User-Agent =~ /^Mutt/
9356
9357 header   __UA_OPERA7            User-Agent =~ /^Opera7/
9358
9359 header   __UA_PAN               User-Agent =~ /^Pan/
9360
9361 header   __UA_XNEWS             User-Agent =~ /^Xnews/
9362
9363 body        __UC_GIBB_OBFU     /\b[A-Za-z][a-z]{0,20}[,;)]?\s[A-Z]{16,}[a-z]?\s[A-Za-z][a-z]{1,15}\b/
9364 tflags      __UC_GIBB_OBFU     multiple maxhits=2
9365
9366 body     __UN             /\bunited\snations?\b/i
9367
9368 meta       __UNDISC_FREEM              __TO_UNDISCLOSED && __freemail_replyto
9369
9370 meta       __UNDISC_MONEY              __TO_UNDISCLOSED && (__ADVANCE_FEE_2_NEW || LOTS_OF_MONEY)
9371
9372 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9373   body       __UNICODE_OBFU_ASC         /[a-z0-9\s](?:\xd0[\xb0\xb5\xbe]|\xd1[\x80\x81])+[a-z0-9]{1,8}(?:\xd0[\xb0\xb5\xbe]|\xd1[\x80\x81])+[a-z0-9\s]/i
9374   tflags     __UNICODE_OBFU_ASC         multiple maxhits=10
9375 endif
9376
9377 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9378   meta       __UNICODE_OBFU_ASC_MANY    __UNICODE_OBFU_ASC > 9
9379 endif
9380
9381 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9382   body       __UNICODE_OBFU_ZW          /[a-z0-9\s](?:\x9d|\xe2\x80[\x8b\x8c\x8d]|\xef\xbb\xbf)+(?!\s)[a-z0-9\s]{1,8}(?:\x9d|\xe2\x80[\x8b\x8c\x8d]|\xef\xbb\xbf)+[a-z0-9\s]/i
9383   tflags     __UNICODE_OBFU_ZW          multiple maxhits=10
9384 endif
9385
9386 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9387   meta       __UNICODE_OBFU_ZW_10       __UNICODE_OBFU_ZW > 9
9388 endif
9389
9390 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9391   meta       __UNICODE_OBFU_ZW_2        __UNICODE_OBFU_ZW > 1
9392 endif
9393
9394 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9395   meta       __UNICODE_OBFU_ZW_3        __UNICODE_OBFU_ZW > 2
9396 endif
9397
9398 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9399   meta       __UNICODE_OBFU_ZW_5        __UNICODE_OBFU_ZW > 4
9400 endif
9401
9402 body     __UNSUB_EMAIL  /\b(?:(?:un)?subscri(?:ber?|ptions?)|abuses?|opt(?:ing)?.?out)\b[-a-z_0-9.+=]{0,60}\@[a-z0-9][-a-z_0-9.]{4,20}(?:[^a-z_0-9.-]|$)/i
9403 tflags   __UNSUB_EMAIL  nice
9404
9405 body        __UNSUB_GOOG_FORM    m,Unsub?sc?ribe\s<?https?://docs\.google\.com/forms/,i
9406
9407 uri      __UNSUB_LINK   /\b(?:(?:un)?subscri(?:ber?|ptions?)|abuses?|opt(?:ing)?.?out)\b/i
9408 tflags   __UNSUB_LINK   nice
9409
9410 body        __UPGR_MAILBOX       /\b(?:up(?:g[ra]+d(?:e|ing)|date) (?:(?:[hw]as|and)\s(?:[a-z]+\s){1,5})?(?:o[nf] )?(?:your )?(?:mail\s?box|(?:web ?|e-?)mail)|(?:web ?|e-?)mail Upgrade cuenta|atualiz(?:e|ar) (?:a|sua) caixa de correio|click\S{0,10} (?:here(?:[:\.\s]{0,5}\S{0,10}http\S{10,80})?|below)(?: link)? to (?:(?:complete|finish|increase) )?(?:(?:the|this|your)\s)?(?:up(?:date|grade)|(?:web ?|e-?)?mail(?:\s?box)? (?:size|quota|limit))|utrzymania aktywnego konta|request (?:for )additional storage|you (?:have )?(?:failed|refused) to up(?:date|grade))\b/i
9411
9412 uri         __UPPERCASE_URI        /^[^:A-Z]+[A-Z]/
9413
9414 uri            __URI_12LTRDOM      m,://(?:[^./]+\.)*[a-z]{12}\.[^./]+/,i
9415
9416 uri        __URI_ADOBESPARK            m,https?://branchlink\.adobespark\.com/,i
9417
9418 uri        __URI_AZURE_CLOUDAPP        m,://(?:[^./]+\.)+cloudapp\.azure\.com/,
9419
9420 uri        __URI_DASHGOVEDU            m,://[^/]*-(?:gov|edu)\.com/,i
9421
9422 uri         __URI_DATA         /^data:(?!image\/)[a-z]/i
9423
9424 uri         __URI_DBL_DOM      m,^https?://[^.]+\.(?!amazon\.com)([^/]+)/.*https?://[^.]+\.\1/,i
9425
9426 uri        __URI_DOTEDU                m;^https?://(?:[^./]+\.)+edu/;i
9427
9428 meta       __URI_DOTEDU_ENTITY         __URI_DOTEDU && __AC_HTML_ENTITY_BONANZA_SHRT_RAW
9429
9430 uri        __URI_DOTGOV                m;^https?://(?:[^./]+\.)+gov/;i
9431
9432 uri         __URI_DOTTY_HEX            /(?:\.[0-9a-f]{2}){30}/
9433
9434 uri            __URI_DQ_UNSUB   m;^[a-z]+://(?:\d+\.){3}\d+/.*unsubscribe;i
9435
9436 uri        __URI_FIREBASEAPP           m,://[^./]+\.firebaseapp\.com/,
9437
9438 uri         __URI_GOOGLE_DOC     m,^https?://docs\.google\.com/(?:[^/]+/)*(?:view(?:form)?\?(?:[^&]+&)*(?:id|formkey|usp)=|document/),i
9439
9440 uri         __URI_GOOGLE_DRV     m,^https?://(?:drive\.google|googledrive)\.com/,i
9441
9442 uri            __URI_GOOGLE_PROXY     m;^https?://[^.]+\.googleusercontent\.com/proxy/;i
9443
9444 uri         __URI_GOOG_STO_EMAIL       m;^https?://(?:firebase)?storage\.googleapis\.com/.*[a-z0-9]@(?:[a-z0-9]{2,20}\.){1,3}[a-z]{2,3}$;i
9445
9446 uri        __URI_GOOG_STO_HTML        m,^https?://(?:firebase)?storage\.googleapis\.com/.*\.html?(?:$|\?),i
9447 tflags     __URI_GOOG_STO_HTML        multiple maxhits=5
9448
9449 uri        __URI_GOOG_STO_IMG         m,^https?://(?:firebase)?storage\.googleapis\.com/.*\.(?:png|jpe?g|gif)$,i
9450 tflags     __URI_GOOG_STO_IMG         multiple maxhits=5
9451
9452 uri        __URI_HEX_IP                m;://0x[0-9A-F]{8,}[:/];i
9453
9454 meta       __URI_HOSTED_IMG            ( __URI_IMG_EBAY || __URI_IMG_AMAZON || __URI_IMG_ALICDN || __URI_IMG_WALMART || __URI_IMG_NEWEGG || __URI_IMG_SHOPIFY || __URI_IMG_YTIMG || __URI_IMG_JOOMCDN || __URI_IMG_WISH || __URI_IMG_STATICBG || __URI_IMG_CHANNYPIC || __URI_IMG_TOPHATTER || __URI_IMG_GBTCDN || __URI_IMG_LINKEDIN || __URI_IMG_TUMBLR || __URI_IMG_TAGSTAT || __URI_IMG_FACEBOOK || __URI_IMG_TARINGANET || __URI_IMG_BEBEE || __URI_IMG_EFUSERASSETS || __URI_IMG_IMGBOX_THUMB || __URI_IMG_500PXORG || __URI_IMG_WIXMP || __URI_IMG_POSTIMGCC || __URI_IMG_GTRACING || __URI_IMG_JOOMCDN || __URI_IMG_DHRESOURCE )
9455
9456 uri        __URI_IMG_500PXORG          m;://drscdn\.500px\.org/photo/;i
9457
9458 uri        __URI_IMG_ALICDN            m,//(?:[^/.]+\.)*alicdn\.com/.+\.(?:jpe?g|gif|png|webp),i
9459
9460 uri        __URI_IMG_AMAZON            m,://[^/?]+\.(?:ssl-)?(?:images|media)-amazon\.com/.*\.(?:png|gif|jpe?g|webp)$,i
9461
9462 uri        __URI_IMG_BEBEE             m;://contents\.bebee\.com/users/.+\.(?:jpe?g|gif|png|webp);i
9463
9464 uri        __URI_IMG_CHANNYPIC         m,://www\.channypicture\.com/pic/,i
9465
9466 uri        __URI_IMG_DHRESOURCE        m;://www\.dhresource\.com/.+\.(?:jpe?g|gif|png|webp);i
9467
9468 uri        __URI_IMG_EBAY              m,://[^/?]+\.ebayimg\.com/,i
9469
9470 uri        __URI_IMG_EFUSERASSETS      m;://\d+\.efuserassets\.com/\d+/.+\.(?:jpe?g|gif|png|webp);i
9471
9472 uri        __URI_IMG_FACEBOOK          m;://([^/.]+\.)+fbcdn\.net/v/.+\.(?:jpe?g|gif|png|webp);i
9473
9474 uri        __URI_IMG_GBTCDN            m;://des\.gbtcdn\.com/storage/store/[0-9a-f/]{30,}\.(?:png|gif|jpe?g|webp)$;i
9475
9476 uri        __URI_IMG_GTRACING          m;://shopify\.gtracing\.com/img/.+\.(?:jpe?g|gif|png|webp);i
9477
9478 uri        __URI_IMG_IMGBOX_THUMB      m;://thumbs\d*\.imgbox\.com/.+\.(?:jpe?g|gif|png|webp);i
9479
9480 uri        __URI_IMG_JOOMCDN           m,://img\.joomcdn\.net/,i
9481 uri        __URI_IMG_JOOMCDN           m;://img\.joomcdn\.net/.+\.(?:jpe?g|gif|png|webp);i
9482
9483 uri        __URI_IMG_LINKEDIN          m;://media-exp\d\.licdn\.com/dms/image/;i
9484
9485 uri        __URI_IMG_NEWEGG            m,://[^/?]+\.neweggimages\.com/,i
9486
9487 uri        __URI_IMG_POSTIMGCC         m;://i\.postimg\.cc/.+\.(?:jpe?g|gif|png|webp);i
9488
9489 uri        __URI_IMG_SHOPIFY           m,://cdn\.shopify\.com/.+\.(?:jpe?g|gif|png|webp),i
9490
9491 uri        __URI_IMG_STATICBG          m,://imgaz\.staticbg\.com/images/,i
9492
9493 uri        __URI_IMG_TAGSTAT           m;://i\d+\.tagstat\.com/.+\.(?:jpe?g|gif|png|webp);i
9494
9495 uri        __URI_IMG_TARINGANET        m;://media\.taringa\.net/knn/;i
9496
9497 uri        __URI_IMG_TOPHATTER         m;://images\.tophatter\.com/[0-9a-f]{30,}/;i
9498
9499 uri        __URI_IMG_TUMBLR            m;://\d+\.media\.tumblr\.com/.+\.(?:jpe?g|gif|png|webp);i
9500
9501 uri        __URI_IMG_WALMART           m,://[^/?]+\.walmartimages\.com/,i
9502
9503 uri        __URI_IMG_WISH              m,://contestimg\.wish\.com/,i
9504
9505 uri        __URI_IMG_WIXMP             m;://images-wixmp-[0-9a-f]{20,}\.wixmp\.com/;i
9506
9507 uri        __URI_IMG_WP_REDIR          m;://i[02]\.wp\.com/.*\.(?:jpe?g|gif|png)$;i
9508
9509 uri        __URI_IMG_YTIMG             m,://[^/?]+\.ytimg\.com/,i
9510
9511 uri        __URI_LONG_REPEAT           m;(?:://|@)(?:\w+\.)*(\w{7,}\.)\1;i
9512
9513 uri         __URI_MAILTO              /^mailto:/i
9514 tflags      __URI_MAILTO              multiple maxhits=16
9515
9516 uri            __URI_MONERO     /buy-monero/i
9517
9518 meta      __URI_ONLY_MSGID_MALF         __BODY_URI_ONLY && __MSGID_NOFQDN2
9519
9520 meta        __URI_PHISH    __HAS_ANY_URI && !__URI_GOOGLE_DOC && !__URI_GOOG_STO_HTML && (__EMAIL_PHISH || __ACCT_PHISH)
9521
9522 uri        __URI_PHP_REDIR             m;/redirect\.php\?;i
9523
9524 uri        __URI_PRODUCT_AMAZON        m,://www\.amazon\.(?:com|co\.uk|[a-z][a-z])/dp/[a-z0-9]{10}/,i
9525
9526 uri         __URI_TRY_3LD     m,^https?://(?:try(?!r\.codeschool)|start|get(?!\.adobe)|save|check(?!out)|act|compare|join|learn(?!ing)|request|visit(?!or|\.vermont)|my(?!sub|turbotax|news\.apple|a\.godaddy|account|support|build|blob|images?|photos?)\w)[^.]*\.(?:(?!list-manage\.)[^/.]+\.)+(?:com|net)\b,i
9527
9528 uri         __URI_TRY_USME    m,^https?://(?:try|start|get|save|check|act|compare|join|learn|request|visit|my)[^.]*\.[^/]+\.(?:us|me|mobi|club)\b,i
9529
9530 uri        __URI_WEBAPP                m,://[^./]+\.web\.app/,
9531
9532 uri         __URI_WPADMIN      m,/wp-admin/\w+/,i
9533
9534 uri         __URI_WPCONTENT    m,/wp-content/.*\.(?:php|html?)\b,i
9535
9536 uri         __URI_WPDIRINDEX   m,/wp-(?:content|includes)/.*/$,i
9537
9538 uri         __URI_WPINCLUDES   m,/wp-includes/.*\.(?:php|html?)\b,i
9539
9540 uri            __URL_BTC_ID     m;[/.](?:[13][a-km-zA-HJ-NP-Z1-9]{25,34}|bc1[acdefghjklmnpqrstuvwxyz234567890]{30,90})(?:/|$);
9541
9542 uri      __URL_LTC_ID     m;[/.][LM3][a-km-zA-HJ-NP-Z1-9]{26,33}(?:/|$);
9543
9544 header __USING_VERP1 Return-Path =~ /[+-].*=/
9545
9546 header __VACATION Subject =~ /\b(?:vacatio|away|out.of.offic|auto.?re|confirm)/i
9547 tflags __VACATION nice
9548
9549 body        __VALIDATE_MAILBOX   /\b(?:(?:re-?)?(?:valida(?:te|r)|confirm|set)(?:\S?(?:increase|raise))? (?:your|(?:a )?sua) (?:mail\s?box|(?:e-?)?mail quota|caixa)|confirmar (?:que )?a sua conta (?:de e-?mail|ainda est(?:=E1|[\xe1]|[\xc3][\xa1]) ativa)|wprowadz dane konta ponizej|utrzymania aktywnego konta e-?mail|weryfikacji konta|you (?:have )?(?:failed|refused) to (?:verify|validate)|(?:e-?mail|confirm) verification|verify k?now|logs?in below to (\S+\s){0,10}(?:download|release|retrieve) your (?:messages|e?-?mails)|verify [a-z][a-z0-9_]{3,40}@[a-z][a-z0-9]{2,30}\.[a-z]{2,6}|your mailbox [^@\s]{3,30}@\S{3,30} (?:(?:needs to|must) be verified|(?:needs|requires) verification))\b/i
9550 tflags      __VALIDATE_MAILBOX   multiple maxhits=2
9551
9552 body        __VALIDATE_MBOX_SE   /(?:\b=E5|[\xe5]|[\xc3][\xa5])terst(?:=E4|\xe4|[\xc3][\xa4])lla ditt konto\b/i
9553
9554 body        __VERIFY_ACCOUNT     /(?:confirm|updated?|verif(?:y|ied)) (?:your|the) (?:(?:account|current|billing|personal|online)? ?(?:records?|information|account|identity|access|data|login)|"?[^\@\s]+\@\S+"? (?:account|mail ?box)|confirm verification|verify k?now|Ihre Angaben .berpr.ft und best.tigt)/i
9555 tflags      __VERIFY_ACCOUNT     multiple maxhits=2
9556
9557 meta        __VFY_ACCT_NORDNS    __VERIFY_ACCOUNT && __RDNS_NONE
9558
9559 if (version >= 3.004002)
9560 ifplugin Mail::SpamAssassin::Plugin::WLBLEval
9561 header   __VPSNUMBERONLY_TLD From:addr =~ /\@vps[0-9]{4,}\.[a-z]+$/i
9562 endif
9563 endif
9564
9565 meta       __WALMART_IMG_NOT_RCVD_WAL  __URI_IMG_WALMART && !__HDR_RCVD_WALMART
9566
9567 body        __WEBMAIL_ACCT       /\byour web ?mail account/i
9568
9569 body       __WE_PAID                   /\bwe have (?:already )?(?:paid|sent|remitted|issued) \$?\d+(?:,\d+)* (?:thousand )?(?:dollars )?to our (?:users|subscribers|members|clients|affiliates|partners)\b/i
9570
9571 meta       __WFH_01                    ( __PERFECT_BINARY + __WE_PAID + __MAKE_XTRA_DOLLAR + __BONUS_LAST_DAY + __PASSIVE_INCOME + __WITHOUT_EFFORT + __TRANSFORM_LIFE + __STAY_HOME + __RECEIVE_BONUS ) > 2
9572
9573 body     __WIDOW          /\b(?:widow(?:e[rd])'?s?|veuve)\b/i
9574
9575 body     __WILL_LEGAL     /\b(?:codicil|last\stestament|probate|executor|intestate|bequest|mandamus)\b/i
9576
9577 body     __WIRE_XFR       /\b(?:wire|telegraph(?:ic)?|bank)\s?transfer/i
9578
9579 body       __WITHOUT_EFFORT            /\bwith(?:out(?: a(?:ny)?| the)?| no)(?: great| special| extra)? effort\b/i
9580
9581 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9582   rawbody   __WORD_INVIS                  /<(?!style)[a-z]+\s[^>]{1,80}(?:font(?:-size)?\s*:\s*(?:0*[01](?:\.\d+)?(?:px|pt|Q|vw|vh|vmin)|0+(?:\.\d+)?(?:cm|mm|in|pc|em|ex|ch|rem|lh|vmax))\s*[;'a-z]|['"\s;]color\s*:\s*transparent\s*[;'])[^>]{0,80}>\w{1,20}</i
9583   tflags    __WORD_INVIS                  multiple maxhits=6
9584 endif
9585
9586 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9587   meta      __WORD_INVIS_2                __WORD_INVIS > 1
9588 endif
9589
9590 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9591   meta      __WORD_INVIS_5                __WORD_INVIS > 5
9592 endif
9593
9594 if can(Mail::SpamAssassin::Conf::feature_bug6558_free)
9595   meta      __WORD_INVIS_MINFP            __WORD_INVIS && !__SURVEY && !MIME_QP_LONG_LINE && !__FB_TOUR && !__MSGID_GUID
9596 endif
9597
9598 header         __XEROXWORKCTR_MUA  X-Mailer =~ /^WorkCentre \D?\d[\d\.]\d+/
9599
9600 meta     __XFER_LOTSA_MONEY      __XFER_MONEY && LOTS_OF_MONEY
9601
9602 meta     __XFER_MONEY     (__WIRE_XFR || __TRUSTED_CHECK || __BANK_DRAFT || __MOVE_MONEY || __TO_YOUR_ACCT || __PAY_YOU || __GIVE_MONEY)
9603
9604 ifplugin Mail::SpamAssassin::Plugin::FreeMail
9605   header          __XMAIL_CODEIGN         X-Mailer =~ /CodeIgniter/
9606 endif
9607
9608 ifplugin Mail::SpamAssassin::Plugin::FreeMail
9609   header          __XMAIL_PHPMAIL         X-Mailer =~ /PHPMailer/
9610 endif
9611
9612 header     __XM_ASPQMAIL               X-Mailer =~ /^AspQMail/
9613
9614 header   __XM_BALSA             X-Mailer =~ /^Balsa \d/
9615
9616 header   __XM_CALYPSO           X-Mailer =~ /^Calypso/
9617
9618 header     __XM_DIGITS_ONLY            X-Mailer =~ /^\s*\d+\s*$/
9619
9620 header      __XM_EC_MESSENGER      X-Mailer =~ /\beC-Messenger\b/
9621
9622 header   __XM_FORTE             X-Mailer =~ /^Forte Agent \d/
9623
9624 header   __XM_GNUS              X-Mailer =~ /^Gnus v/
9625
9626 header   __XM_MHE               X-Mailer =~ /^mh-e \d/
9627
9628 header   __XM_MOZ4              X-Mailer =~ /^Mozilla 4/
9629
9630 header   __XM_MSOE5             X-Mailer =~ /^Microsoft Outlook Express 5/
9631
9632 header   __XM_MSOE6             X-Mailer =~ /^Microsoft Outlook Express 6/
9633
9634 header __XM_MS_IN_GENERAL     X-Mailer =~ /\bMSCRM\b|Microsoft (?:CDO|Outlook|Office Outlook)\b/
9635
9636 header __XM_OL_10_0_4115    X-Mailer =~ /^Microsoft Outlook, Build 10.0.4115$/
9637
9638 header __XM_OL_28001441    X-Mailer =~ /^Microsoft Outlook Express 6.00.2800.1441$/
9639
9640 header __XM_OL_28004682    X-Mailer =~ /^Microsoft Outlook Express 6.00.2800.4682$/
9641
9642 header __XM_OL_48072300    X-Mailer =~ /^Microsoft Outlook Express 5.50.4807.2300$/
9643
9644 header __XM_OL_4_72_2106_4  X-Mailer =~ /^Microsoft Outlook Express 4.72.2106.4$/
9645
9646 header __XM_OUTLOOK_EXPRESS    X-Mailer =~ /^Microsoft Outlook Express \d/
9647
9648 header      __XM_PHPMAILER_FORGED  X-Mailer =~ /PHPMailer\s.*version\D+$/
9649
9650 header     __XM_RANDOM                 X-Mailer =~ /q(?!(?:q|box|i\s)?mail|\d|[-\w]*=+;)[^u]/i
9651
9652 header   __XM_SKYRI             X-Mailer =~ /^SKYRiXgreen/
9653
9654 header   __XM_SQRLMAIL          X-Mailer =~ /^SquirrelMail/
9655
9656 header   __XM_SYLPHEED          X-Mailer =~ /^Sylpheed/
9657
9658 header     __XM_UC_ONLY                X-Mailer =~ /^[^a-z]+$/
9659
9660 header     __XM_VERY_LONG              X-Mailer =~ /.{50}/
9661
9662 header   __XM_VM                X-Mailer =~ /^VM \d/
9663
9664 header   __XM_WWWMAIL           X-Mailer =~ /^WWW-Mail \d/
9665
9666 header   __XM_XIMEVOL           X-Mailer =~ /^Ximian Evolution/
9667
9668 meta        __XPRIO_MINFP      __XPRIO && !__CT_ENCRYPTED && !ALL_TRUSTED && !__HAS_ERRORS_TO && !__HAS_IMG_SRC && !__RCD_RDNS_MAIL_MESSY && !__VIA_ML && !__PHPMAILER_MUA && !__AC_TINY_FONT && !__HAS_PHP_SCRIPT && !__DOS_HAS_LIST_UNSUB && !__HAS_IMG_SRC_ONECASE && !__NAKED_TO && !__HAS_THREAD_INDEX && !__HAS_TNEF && !__HAS_SENDER && !__UNPARSEABLE_RELAY_COUNT && !__PDS_RDNS_MTA && !__RCD_RDNS_SMTP_MESSY && !__RCD_RDNS_MX_MESSY && !__TO___LOWER && !__FROM_WORDY && !__RP_MATCHES_RCVD && !__DKIM_EXISTS && !__FROM_WEB_DAEMON && !__RDNS_SHORT && !__L_BODY_8BITS && !__HAS_X_SENDER
9669
9670 meta        __XPRIO_SHORT_SUBJ __XPRIO_MINFP && __SUBJ_SHORT
9671
9672 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
9673   mimeheader   __X_MSO_MT          Content-Type =~ m,\bapplication/x-mso\b,i
9674 endif
9675
9676 body     __YOUR_BANK      /\byour?\s(?:full\s)?bank(?:ing)?\sinformations?\b/i
9677
9678 body     __YOUR_CONSIGNMENT     /\b(?:received?|pa(?:y|id)|sen[dt]|h[oe]ld|delay(?:ed)?|impound(?:ed)?|released?|ship(?:ped)?)\syour(?:\s\w+)?\sconsignment\b/i
9679
9680 body     __YOUR_FUND      /\b(?:your|ihr)\s(?:unpaid\s|win+ing\s|ap+roved\s|foreign\s|overdue\s|outstanding\s|contract\s|inheritance\s|nicht\sausbezahlten\s){0,3}(?:fund|f\su\sn\sd|payment|geld)\b/i
9681
9682 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
9683   body           __YOUR_ONAN            /\b(?:your?|ihrer)\s(?:ma+s+t+[ur]+b+a+t+(?:ion|ing|e)(?:svideo)?|onanism|solitary\ssex|hand\sfucking|Selbstbefriedigung|(?:pleasur(?:e|ing)|satisfy(?:ing)?)\syourself)\b/i
9684 endif
9685
9686 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
9687   body           __YOUR_ONAN            /(?:^|\s)(?:<Y><O><U><R>?|<I><H><R><E><R>)\s(?:<M>+<A>+<S>+<T>+(?:<U>|<R>)+<B>+<A>+<T>+(?:<I><O><N>|<I><N><G>|<E>)(?:<S><V><I><D><E><O>)?|<O><N><A><N><I><S><M>|<S><O><L><I><T><A><R><Y>\s<S><E><X>|<H><A><N><D>\s<F><U><C><K><I><N><G>|<S><E><L><B><S><T><B><E><F><R><I><E><D><I><G><U><N><G>|(?:<P><L><E><A><S><U><R>(?:<E>|<I><N><G>)|<S><A><T><I><S><F><Y>(?:<I><N><G>)?)\s<Y><O><U><R><S><E><L><F>)/i
9688 endif
9689
9690 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
9691   body           __YOUR_PASSWORD        /\b(?:your|(?:change|modify|update|reset|alter|fix)\sthe)\s(?:account\s|e-?mail\s)?(?:pass[-\s_]?word|pswd)\b/i
9692 endif
9693
9694 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
9695   body           __YOUR_PASSWORD        /(?:^|\s)(?:<Y><O><U><R>|(?:<C><H><A><N><G><E>|<M><O><D><I><F><Y>|<U><P><D><A><T><E>|<R><E><S><E><T>|<A><L><T><E><R>|<F><I><X>)\s<T><H><E>)\s(?:<A><C><C><O><U><N><T>\s|<E>-?<M><A><I><L>\s)?(?:<P><A><S><S>[-\s_]?<W><O><R><D>|<P><S><W><D>\s)/i
9696 endif
9697
9698 body     __YOUR_PERM      /\byour\spermission\b/i
9699
9700 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
9701   body           __YOUR_PERSONAL        /\b(?:your\s(?:personal|private|social\scontact|address|friends)\s(?:info(?:rmation)?|data|details|book|secrets)|all\s(?:of\s)?your\s(?:files|contacts|secrets|correspondence))\b/i
9702 endif
9703
9704 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
9705   body           __YOUR_PERSONAL        /(?:^|\s)(?:<Y><O><U><R>\s(?:<P><E><R><S><O><N><A><L>|<P><R><I><V><A><T><E>|<S><O><C><I><A><L>\s<C><O><N><T><A><C><T>|<A><D><D><R><E><S><S>|<F><R><I><E><N><D><S>)\s(?:<I><N><F><O>(?:<R><M><A><T><I><O><N>)?|<D><A><T><A>|<D><E><T><A><I><L><S>|<B><O><O><K>|<S><E><C><R><E><T><S>)|<A><L><L>\s(?:<O><F>\s)?<Y><O><U><R>\s(?:<F><I><L><E><S>|<C><O><N><T><A><C><T><S>|<S><E><C><R><E><T><S>|<C><O><R><R><E><S><P><O><N><D><E><N><C><E>))[\s\.,]/i
9706 endif
9707
9708 body     __YOUR_PROFIT    /\byour?\sprofit/i
9709
9710 if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags)
9711   body           __YOUR_WEBCAM          /\b(?:from|your|with|and|on)\s(?:(?:screen|desktop|microphone)\sand\s|own\s)?(?:web[-\s]?|front[-\s]?|network\s|your\s)camer+a/i
9712 endif
9713
9714 ifplugin Mail::SpamAssassin::Plugin::ReplaceTags
9715   body           __YOUR_WEBCAM          /(?:^|\s)(?:<F><R><O><M>|<Y><O><U><R>|<W><I><T><H>|<A><N><D>|<O><N>)\s(?:(?:<S><C><R><E><E><N>|<D><E><S><K><T><O><P>|<M><I><C><R><O><P><H><O><N><E>)\s<A><N><D>\s|<O><W><N>\s)?(?:<W><E><B>[-\s]?|<F><R><O><N><T>[-\s]?|<N><E><T><W><O><R><K>\s|<Y><O><U><R>\s)<C><A><M><E><R>+<A>/i
9716 endif
9717
9718 body     __YOU_ASSIST     /\b(?:your\sas+istan(?:ce|t)|votre\s(?:as+istance|aide))\b/i
9719
9720 body     __YOU_INHERIT    /\byour\s[a-z\s]{0,30}inherit+ance\b/i
9721
9722 meta     __YOU_WON       __YOU_WON_01 || __YOU_WON_02 || __YOU_WON_03 || __YOU_WON_04 || __HAS_WON_01 || (__YOU_WON_05 && (__MOVE_MONEY || __GIVE_MONEY))
9723
9724 body     __YOU_WON_01    /\byou(?:r|'re|'ve|'ll|\shave|\sdid)?\s(?:e-?mail\s)?(?:\w+\s){0,2}(?:a\s)?w[io]n+(?:er|ing)?(?!\xe2\x80\x99t)(?![`'\x92]t)\b/i
9725
9726 body     __YOU_WON_02    /\bw[io]n\s(?:(?:for|by)\s)?your?\b/i
9727
9728 body     __YOU_WON_03    /\b(?:your?|win+ing|win+ers?|beneficiaries|participants?|individuals?|address(?:es)?|accounts?|emails?)(?:\s[-a-z\s]{4,40})?\s(?:w(?:ere|as)|ha(?:ve|s) be(?:en)?)\s(?:automatically\s)?(?:(?:randomly|raffly)\s(?:selected|cho+sen|cho+sing|picked)|(?:selected|cho+sen|cho+sing|picked)\s(?:[a-z\s]{2,40}?\srandom(?:ly)?|online|lottery|computer\s(?:ballot|wahlgang))|(?:selected|cho+sen|cho+sing|picked)(?:\sas?|\sthe){0,3}\swin+er)/i
9729
9730 body     __YOU_WON_04    /\bqu[ei]\s?(?:vous (?:[\xc3][\xaa]|=C3=AA|[\xea]|e)tes\s?gagnant|en\scons(?:e|=E9|[\xe9]|[\xc3][\xa9])quence\sgagne)\b/i
9731
9732 body     __YOU_WON_05    /\bI won(?!\xe2\x80\x99t)(?![`'\x92]t)\b/i
9733
9734 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
9735   meta         __ZIP_ATTACH_MT     0
9736 endif
9737
9738 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
9739   mimeheader   __ZIP_ATTACH_MT     Content-Type =~ m,\bapplication/(?:zip|x-(?:zip-)?compress(?:ed)?)\b,i
9740 endif
9741
9742 if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader)
9743   meta         __ZIP_ATTACH_NOFN   0
9744 endif
9745
9746 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
9747   mimeheader   __ZIP_ATTACH_NOFN   Content-Type =~ m,\bapplication/(?:zip|x-(?:zip-)?compress(?:ed)?)[;\s]*$,i
9748 endif
9749
9750 ifplugin Mail::SpamAssassin::Plugin::FreeMail
9751   header     __freemail_mailreplyto      eval:check_freemail_header('Mail-Reply-To')
9752 endif
9753
9754 body            __hk_bigmoney           /(?:EURO?|USD?|GBP|CFA|\&\#163;|[\xa3\xa4]|\$|sum of).{0,4}(?:[0-9]{3}[^0-9a-z]?[0-9]{3}|[0-9.,]{1,4}(?: ?M\b| ?(?:de )?Mil))/i
9755
9756 body            __hk_win_0              /\byour? e-?mail just w[oi]n/i
9757
9758 body            __hk_win_2              /\battn.{0,10}winner/i
9759
9760 body            __hk_win_3              /\bhappily aa?nnounce/i
9761
9762 body            __hk_win_4              /\bpleas(?:ure|ed) to inform/i
9763
9764 body            __hk_win_5              /\b(?:notice the|your) winning/i
9765
9766 body            __hk_win_7              /\bcongratulations? to your/i
9767
9768 body            __hk_win_8              /\bunexpected luck/i
9769
9770 body            __hk_win_9              /\blucky (?:nl )number/i
9771
9772 body            __hk_win_a              /\bwinning (?:e-?mail|numbers|information)/i
9773
9774 body            __hk_win_b              /\byour e-?mail (?:address )?(?:has )?w[io]n/i
9775
9776 body            __hk_win_c              /\bune adresse e-?mail sur internet/i
9777
9778 body            __hk_win_d              /\bcategory (?:\S{0,5} )?winner of our/i
9779
9780 body            __hk_win_i              /\bfunds? transfer/i
9781
9782 body            __hk_win_j              /\b(?:winning|ready for|sum) pay ?out/i
9783
9784 body            __hk_win_l              /\b(?:make|file) (?:for )?your claim/i
9785
9786 body            __hk_win_m              /\br.clamation de votre prix/i
9787
9788 body            __hk_win_n              /\bcollect your prize/i
9789
9790 body            __hk_win_o              /\bclarification and procedure/i
9791
9792 ifplugin Mail::SpamAssassin::Plugin::FreeMail
9793 header   __smf_freemail_hdr_replyto  eval:check_freemail_header('Reply-To:addr')
9794 endif