update SpamAssassin signatures

[proxmox-spamassassin.git] / sa-updates / 20_ratware.cf

diff --git a/sa-updates/20_ratware.cf b/sa-updates/20_ratware.cf
index b25cd705091b0487fc3092255a93d6eba9f4f9a3..464a1e5e93665c019c0b6d0c07fc953062ecfeae 100644 (file)
--- a/sa-updates/20_ratware.cf
+++ b/sa-updates/20_ratware.cf
@@ -63,7 +63,10 @@ header __HAS_XORIGMSGID              X-Orig-Message-Id =~ /^<.+\@.+>$/m
 
 meta   __GROUPSIO_GATED                __GROUPSIO_MSGID && __HAS_XORIGMSGID
 
-meta __UNUSABLE_MSGID (__LYRIS_EZLM_REMAILER || __GATED_THROUGH_RCVD_REMOVER || __WACKY_SENDMAIL_VERSION || __IPLANET_MESSAGING_SERVER || __HOTMAIL_BAYDAV_MSGID || __SYMPATICO_MSGID && __GROUPSIO_GATED)
+#bz8202
+header __MCRSFT_MSGID  MESSAGEID =~ /^<[[:alnum:]]{30,45}@[^>]*\.(outlook|exchangelabs).com>$/im
+
+meta   __UNUSABLE_MSGID (__MCRSFT_MSGID || __LYRIS_EZLM_REMAILER || __GATED_THROUGH_RCVD_REMOVER || __WACKY_SENDMAIL_VERSION || __IPLANET_MESSAGING_SERVER || __HOTMAIL_BAYDAV_MSGID || __SYMPATICO_MSGID && __GROUPSIO_GATED)
 
 ## now on to the forgery rules
 
@@ -270,7 +273,7 @@ describe X_MESSAGE_INFO             Bulk email fingerprint (X-Message-Info) found
 
 # case-sensitive rule
 # only significant rules with no FPs, hit recently, on 2+ corpuses
-header HEADER_SPAM             ALL =~ /^(Alternate-Recipient|Antivirus|Approved|Delivery-Notification|Disclose-Recipients|Error-path|Language|Location|Mime-Subversion|Newsletter-ID|PID|Rot|UID|X-BounceTrace|X-CS-IP|X-Company-Address|X-Company-City|X-Company-Country|X-Company-State|X-Company-Zip|X-E(?:[Mm]ail)?|X-Encoding|X-Originating-Company|X-RMD-Text|X-SG4|X-SP-Track-ID|X-Webmail-Time|X-bounce-to):/m
+header HEADER_SPAM             ALL =~ /^(?:Alternate-Recipient|Antivirus|Approved|Delivery-Notification|Disclose-Recipients|Error-path|Language|Location|Mime-Subversion|Newsletter-ID|PID|Rot|UID|X-BounceTrace|X-CS-IP|X-Company-Address|X-Company-City|X-Company-Country|X-Company-State|X-Company-Zip|X-E(?:[Mm]ail)?|X-Encoding|X-Originating-Company|X-RMD-Text|X-SG4|X-SP-Track-ID|X-Webmail-Time|X-bounce-to):/m
 describe HEADER_SPAM           Bulk email fingerprint (header-based) found
 
 header RATWARE_RCVD_PF         Received =~ / \(Postfix\) with ESMTP id [^;]+\; \S+ \d+ \S+ \d+ \d+:\d+:\d+ \S+$/s