xqkqfjdlqsjdqs odsqqlkdjqmsjd onelmlksqdjmlsqjd updates_spamassassin_org/25_razor2.cf 0000644 00000006134 15114422154 0013707 0 ustar 00 # SpamAssassin rules file: razor2 tests # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # @LICENSE> # ########################################################################### ## ## SpamAssassin 4.0.0 note: ## RAZOR rule priorities are automatically adjusted to -100 when razor_fork ## option is enabled (async lookup) ## ifplugin Mail::SpamAssassin::Plugin::Razor2 full RAZOR2_CHECK eval:check_razor2() describe RAZOR2_CHECK Listed in Razor2 (http://razor.sf.net/) tflags RAZOR2_CHECK net autolearn_body priority RAZOR2_CHECK 20 reuse RAZOR2_CHECK lang de describe RAZOR2_CHECK Gelistet im "Razor2"-System (http://razor.sf.net/) lang nl describe RAZOR2_CHECK Gevonden in Razor2 (http://razor.sf.net/) lang fr describe RAZOR2_CHECK Message list par Razor2, voir http://razor.sourceforge.net lang pl describe RAZOR2_CHECK Na licie Razor2 (http://razor.sf.net/) # cf (confidence level) is how likely the message is spam. RAZOR2_CHECK # returns true if cf>=min_cf (as defined by user/config). These return # true depending on what cf value the message has. The algorithm goes: # check the message via razor, then go through each mime part and check # how razor scored it. If the part is contested (ie: it's been reported # as both ham and spam) it's ignored. SA takes the highest non-contested # part cf score and returns it for the range rules. ie: This is essentially # Razor 2's logic_method 4. # # Note: Disabling RAZOR2_CHECK (score RAZOR2_CHECK 0) will also disable # these checks. # # Note: The scores are set to 0 on these tests right now until they get # better integrated with SA overall. # full RAZOR2_CF_RANGE_51_100 eval:check_razor2_range('','51','100') tflags RAZOR2_CF_RANGE_51_100 net priority RAZOR2_CF_RANGE_51_100 20 reuse RAZOR2_CF_RANGE_51_100 describe RAZOR2_CF_RANGE_51_100 Razor2 gives confidence level above 50% lang de describe RAZOR2_CF_RANGE_51_100 Razor2 Spam-Bewertung liegt zwischen 51 und 100 lang fr describe RAZOR2_CF_RANGE_51_100 Razor2 donne un indice de confiance entre 51 et 100 lang nl describe RAZOR2_CF_RANGE_51_100 Razor2 geeft een zekerheid tussen 51 en 100 lang pl describe RAZOR2_CF_RANGE_51_100 Razor2 stwierdzi pewno pomidzy 51 i 100 endif updates_spamassassin_org/MIRRORED.BY 0000644 00000002070 15114422154 0013322 0 ustar 00 #HOW TO UPDATE # # SOURCE: https://svn.apache.org/repos/asf/spamassassin/site/updates/ # # 'svn checkout' the repo, update this file, and commit it # # A svnpubsub update on spamassassin.apache.org will instantly pull # from SVN after the commit. # # A cron'd update on sa-vm.apache.org will also automatically pull # from SVN to /www/spamassassin.apache.org/updates which is also the # [updates] rsync module path the mirrors are syncing from. #CONTACT: Matthias Leisi http://sa-update.dnswl.org/ weight=3 #CONTACT: Kevin A. McGrail https://www.sa-update.pccc.com/ weight=5 #CONTACT: Rene Schwarz https://sa-update.space-pro.be/ weight=1 #CONTACT: Dave Jones http://sa-update.ena.com/ weight=5 #CONTACT: Dave Warren #https://sa-update.razx.cloud/ weight=5 #CONTACT: Jens Schleusener # Removed per list reqest 27.7.2022 #http://sa-update.fossies.org/ weight=1 #CONTACT: tobisworld gmail #http://sa-update.verein-clean.net/ weight=10 #CONTACT: Giovanni Bechis https://sa-update-asf.snb.it/ weight=5 #CONTACT: Giovanni Bechis https://sa-update.spamassassin.org/ weight=10 updates_spamassassin_org/60_welcomelist_subject.cf 0000644 00000007511 15114422154 0016535 0 ustar 00 # SpamAssassin rules file: default welcomelist/blocklist subject # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # @LICENSE> ########################################################################### # Welcomelist/Blocklist rules # # Note that most of these get 'noautolearn'. They should not be # considered when deciding whether to auto-learn a message, as a # user slip-up could result in scribbling side-effects in the bayes # db as a result -- which is hard to remedy. # 4.0 / Bug 7826 renames whitelist to welcomelist and blacklist to blocklist # Module was renamed WhiteListSubject -> WelcomeListSubject ifplugin Mail::SpamAssassin::Plugin::WelcomeListSubject header SUBJECT_IN_WELCOMELIST eval:check_subject_in_welcomelist() describe SUBJECT_IN_WELCOMELIST Subject: contains string in the user's welcome-list tflags SUBJECT_IN_WELCOMELIST userconf nice noautolearn score SUBJECT_IN_WELCOMELIST -100 # Backwards compatibility # To disable set "enable_compat welcomelist_blocklist" in init.pre if !can(Mail::SpamAssassin::Conf::compat_welcomelist_blocklist) meta SUBJECT_IN_WHITELIST (SUBJECT_IN_WELCOMELIST) describe SUBJECT_IN_WHITELIST DEPRECATED: See SUBJECT_IN_WELCOMELIST tflags SUBJECT_IN_WHITELIST userconf nice noautolearn score SUBJECT_IN_WHITELIST -100 score SUBJECT_IN_WELCOMELIST -0.01 endif header SUBJECT_IN_BLOCKLIST eval:check_subject_in_blocklist() describe SUBJECT_IN_BLOCKLIST Subject: contains string in the user's block-list tflags SUBJECT_IN_BLOCKLIST userconf noautolearn score SUBJECT_IN_BLOCKLIST 100 if !can(Mail::SpamAssassin::Conf::compat_welcomelist_blocklist) meta SUBJECT_IN_BLACKLIST (SUBJECT_IN_BLOCKLIST) describe SUBJECT_IN_BLACKLIST DEPRECATED: See SUBJECT_IN_BLOCKLIST tflags SUBJECT_IN_BLACKLIST userconf noautolearn score SUBJECT_IN_BLACKLIST 100 score SUBJECT_IN_BLOCKLIST 0.01 endif endif if !plugin(Mail::SpamAssassin::Plugin::WelcomeListSubject) ifplugin Mail::SpamAssassin::Plugin::WhiteListSubject header SUBJECT_IN_WELCOMELIST eval:check_subject_in_whitelist() describe SUBJECT_IN_WELCOMELIST Subject: contains string in the user's welcome-list tflags SUBJECT_IN_WELCOMELIST userconf nice noautolearn score SUBJECT_IN_WELCOMELIST -0.01 meta SUBJECT_IN_WHITELIST (SUBJECT_IN_WELCOMELIST) describe SUBJECT_IN_WHITELIST DEPRECATED: See SUBJECT_IN_WELCOMELIST tflags SUBJECT_IN_WHITELIST userconf nice noautolearn score SUBJECT_IN_WHITELIST -100 header SUBJECT_IN_BLOCKLIST eval:check_subject_in_blacklist() describe SUBJECT_IN_BLOCKLIST Subject: contains string in the user's block-list tflags SUBJECT_IN_BLOCKLIST userconf noautolearn score SUBJECT_IN_BLOCKLIST 0.01 meta SUBJECT_IN_BLACKLIST (SUBJECT_IN_BLOCKLIST) describe SUBJECT_IN_BLACKLIST DEPRECATED: See SUBJECT_IN_BLOCKLIST tflags SUBJECT_IN_BLACKLIST userconf noautolearn score SUBJECT_IN_BLACKLIST 100 endif endif updates_spamassassin_org/20_porn.cf 0000644 00000004016 15114422154 0013436 0 ustar 00 # SpamAssassin rules file: porn tests # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # Note: body tests are run with long lines, so be sure to limit the # size of searches; use /.{0,30}/ instead of /.*/ to avoid huge # search times. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # @LICENSE> # ########################################################################### require_version 4.000001 ########################################################################### body FREE_PORN /\bfree (?:porn|xxx|adult)/i describe FREE_PORN Possible porn - Free Porn body CUM_SHOT /\bcum[ -]?shots?\b/i describe CUM_SHOT Possible porn - Cum Shot # "live cam" is a very common nonspam phrase, removed body LIVE_PORN /\blive .{0,9}(?:fuck(?:ing)?|sex|naked|girls?|virgins?|teens?|porno?)\b/i describe LIVE_PORN Possible porn - Live Porn header SUBJECT_SEXUAL Subject =~ /[s5][e3\xE8-\xEB]x[u\xB5\xF9-\xFC][a4\xE0-\xE6@][l!|1](?:[l!|1]y)?.{0,3}[e3\xE8-\xEB]xp[l!|1][i1!|l\xEC-\xEF]c[i1!|l\xEC-\xEF]t/i describe SUBJECT_SEXUAL Subject indicates sexually-explicit content updates_spamassassin_org/50_scores.cf 0000644 00000112161 15114422154 0013762 0 ustar 00 # SpamAssassin score file # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # @LICENSE> # ########################################################################### # Default scores. Note that if a test is named in the files, but a score is # not assigned here, the default score will be set to 1. # The following block of scores were generated using the mass-checking # scripts, and a perceptron to determine the optimum scores which # resulted in minimum false positives or negatives. The scores are # weighted to produce roughly 1 false positive in 2500 non-spam messages # using the default threshold of 5.0. # Start of generated scores. score ACT_NOW_CAPS 0.1 #score ADVANCE_FEE_2 2.314 2.294 1.198 1.053 #score ADVANCE_FEE_3 2.686 1.898 3.505 3.817 #score ADVANCE_FEE_4 0.001 0.001 0.001 0.271 score ALL_TRUSTED -1.000 score APOSTROPHE_FROM 0.148 0.786 0.651 0.545 # n=2 score BAD_CREDIT 0.1 score BANG_GUAR 1.0 score BANG_OPRAH 0 # n=0 n=1 n=2 n=3 score BANKING_LAWS 2.399 2.004 2.157 1.099 # n=2 score BILLION_DOLLARS 0.001 1.451 1.229 1.638 score BODY_ENHANCEMENT 0.927 1.611 0.974 0.001 score BODY_ENHANCEMENT2 0.1 score CONFIRMED_FORGED 0 # n=0 n=1 n=2 n=3 score CORRUPT_FROM_LINE_IN_HDRS 0 # n=0 n=1 n=2 n=3 score CTYPE_001C_A 0 # n=0 n=1 n=2 n=3 score CTYPE_001C_B 0.001 0.001 0.001 0.001 # n=1 score CUM_SHOT 0 # n=0 n=1 n=2 n=3 score CURR_PRICE 0.001 # n=0 n=1 n=2 n=3 score DATE_SPAMWARE_Y2K 0 # n=0 n=1 n=2 n=3 score DEAR_FRIEND 2.683 2.604 1.801 2.577 score DEAR_SOMETHING 1.999 1.731 1.787 1.973 score DEAR_WINNER 3.099 3.099 2.309 3.099 # n=2 score DIET_1 0.714 0.000 0.399 0.001 score DIGEST_MULTIPLE 0 0.001 0 0.293 # n=0 n=2 score DOS_ANAL_SPAM_MAILER 0 # n=0 n=1 n=2 score DOS_FIX_MY_URI 0 # n=0 n=1 n=2 n=3 score DOS_HIGH_BAT_TO_MX 0 # n=0 n=1 n=2 score DOS_LET_GO_JOB 0 # n=0 n=1 n=2 n=3 score DOS_OE_TO_MX 2.602 3.086 2.265 2.523 score DOS_OE_TO_MX_IMAGE 2.886 1.886 2.425 3.699 score DOS_OUTLOOK_TO_MX 2.636 1.449 1.737 2.845 score DOS_RCVD_IP_TWICE_C 2.599 2.060 3.292 0.096 score DOS_STOCK_BAT 0.001 # n=0 n=1 n=2 n=3 score DOS_STOCK_BAT2 0 # n=0 n=1 n=2 n=3 score DOS_URI_ASTERISK 0 # n=0 n=1 n=2 n=3 score DOS_YOUR_PLACE 0 # n=0 n=1 n=2 n=3 score DRUGS_ANXIETY 0.1 score DRUGS_ANXIETY_EREC 0 # n=0 n=1 n=2 n=3 score DRUGS_ANXIETY_OBFU 0 # n=0 n=1 n=2 n=3 score DRUGS_DIET 2.660 0.757 1.831 0.337 score DRUGS_DIET_OBFU 0 # n=0 n=1 n=2 n=3 score DRUGS_ERECTILE 1.778 2.221 1.299 1.994 score DRUGS_ERECTILE_OBFU 1.324 1.309 2.935 1.109 score DRUGS_HDIA 0 # n=0 n=1 n=2 n=3 score DRUGS_MANYKINDS 2.001 1.473 0.841 0.342 score DRUGS_MUSCLE 0.001 2.499 0.392 0.164 score DRUGS_SLEEP_EREC 0 # n=0 n=1 n=2 n=3 score DRUGS_SMEAR1 3.300 2.051 3.148 0.235 # n=0 score DRUGS_STOCK_MIMEOLE 2.699 1.681 2.478 1.321 # n=2 score DRUG_DOSAGE 0 # n=0 n=1 n=2 n=3 score DRUG_ED_CAPS 2.799 1.023 2.516 0.936 score DRUG_ED_GENERIC 0 # n=0 n=1 n=2 n=3 score DRUG_ED_ONLINE 0.696 1.152 1.221 0.608 # n=0 score DRUG_ED_SILD 0.001 score DYN_RDNS_AND_INLINE_IMAGE 1.345 1.344 1.434 1.168 # n=2 score DYN_RDNS_SHORT_HELO_HTML 0.001 0.001 0.000 0.001 # n=2 score DYN_RDNS_SHORT_HELO_IMAGE 1.825 2.516 2.285 1.013 # n=2 score EMAIL_ROT13 0 # n=0 n=1 n=2 n=3 score EMPTY_MESSAGE 2.195 2.344 1.552 2.320 score EM_ROLEX 0.595 1.309 2.068 0.618 # n=0 score ENGLISH_UCE_SUBJECT 0.953 1.542 2.569 2.899 # n=0 score EXCUSE_4 2.399 1.687 2.399 1.325 score EXCUSE_REMOVE 2.907 2.992 3.299 3.299 #score FAKE_HELO_MAIL_COM_DOM 1.887 0.152 1.370 2.136 score FAKE_OUTBLAZE_RCVD 0 # n=0 n=1 n=2 n=3 score FAKE_REPLY_C 0.688 0.001 2.553 1.486 # n=2 score FILL_THIS_FORM_FRAUD_PHISH 1.195 0.396 0.615 0.334 score FILL_THIS_FORM_LOAN 2.092 2.237 1.836 2.880 score FILL_THIS_FORM_LONG 3.800 3.476 2.300 3.404 score FIN_FREE 0.1 score FORGED_IMS_HTML 0 # n=0 n=1 n=2 n=3 score FORGED_IMS_TAGS 0 # n=0 n=1 n=2 n=3 score FORGED_MSGID_AOL 0 # n=0 n=1 n=2 n=3 score FORGED_MSGID_EXCITE 2.399 1.899 1.649 0.528 # n=0 score FORGED_MSGID_HOTMAIL 0 # n=0 n=1 n=2 n=3 score FORGED_MSGID_MSN 0 # n=0 n=1 n=2 n=3 score FORGED_MSGID_YAHOO 0.1 score FORGED_MUA_EUDORA 2.828 2.510 1.962 0.001 score FORGED_MUA_IMS 2.399 2.399 2.399 1.943 score FORGED_MUA_MOZILLA 2.399 1.596 2.399 2.309 score FORGED_MUA_OIMO 2.600 2.599 2.599 2.599 score FORGED_MUA_OUTLOOK 3.999 2.785 2.500 1.927 score FORGED_MUA_THEBAT_BOUN 3.046 3.220 3.207 3.399 score FORGED_MUA_THEBAT_CS 0 # n=0 n=1 n=2 n=3 score FORGED_OUTLOOK_HTML 0.001 0.001 0.001 0.021 score FORGED_OUTLOOK_TAGS 0.003 0.565 0.001 0.052 score FORGED_QUALCOMM_TAGS 0 # n=0 n=1 n=2 n=3 score FORGED_TELESP_RCVD 2.499 2.499 2.499 1.841 # n=0 score FORGED_THEBAT_HTML 0 # n=0 n=1 n=2 n=3 score FORWARD_LOOKING 0 # n=0 n=1 n=2 n=3 score FRAGMENTED_MESSAGE 0 # n=0 n=1 n=2 #FREEMAIL SCORES - Scores lowered per bug 6744 score FREEMAIL_FORGED_REPLYTO 1.199 2.503 1.204 2.095 score FREEMAIL_REPLY 1.0 score FREEMAIL_REPLYTO 1.0 score FREEMAIL_REPLYTO_END_DIGIT 0.25 score FREEMAIL_ENVFROM_END_DIGIT 0.25 score FREEMAIL_FROM 0.001 score FREE_PORN 0 # n=0 n=1 n=2 n=3 score FREE_QUOTE_INSTANT 2.700 2.699 2.699 1.297 # n=2 score FROM_BLANK_NAME 2.099 2.099 2.099 0.723 score FROM_DOMAIN_NOVOWEL 0.500 score FROM_EXCESS_BASE64 0.001 score FROM_LOCAL_DIGITS 0.001 score FROM_LOCAL_HEX 0.000 0.331 0.001 0.006 score FROM_LOCAL_NOVOWEL 0.500 score FROM_NO_USER 0.001 2.599 0.019 0.798 #score FROM_OFFERS 2.699 2.699 2.510 2.699 # defer to nightly GA rescorer per bug 6580 score FROM_STARTS_WITH_NUMS 2.801 0.553 1.201 0.738 score FSL_FAKE_HOTMAIL_RVCD 2.631 1.816 2.011 2.365 score FSL_HELO_BARE_IP_1 2.598 1.426 3.099 2.347 score FSL_HELO_DEVICE 0.1 score FSL_HELO_NON_FQDN_1 2.361 0.001 1.783 0.001 score FSL_HELO_SETUP 0 # n=0 n=1 n=2 score FSL_INTERIA_ABUSE 3.899 2.664 3.080 3.106 score GAPPY_SUBJECT 0.1 score GEO_QUERY_STRING 0 # n=0 n=1 n=2 n=3 score GUARANTEED_100_PERCENT 2.699 2.699 2.480 2.699 score HDR_ORDER_FTSDMCXX_001C 0 # n=0 n=1 n=2 n=3 score HDR_ORDER_FTSDMCXX_BAT 0 # n=0 n=1 n=2 n=3 score HEADER_SPAM 2.499 2.499 1.994 0.585 score HEAD_LONG 0 # n=0 n=1 n=2 score HELO_DYNAMIC_CHELLO_NL 2.412 1.918 2.019 2.428 score HELO_DYNAMIC_DHCP 2.602 0.841 1.537 0.206 score HELO_DYNAMIC_DIALIN 2.629 3.233 2.186 1.366 score HELO_DYNAMIC_HCC 4.299 2.514 2.931 2.762 score HELO_DYNAMIC_HEXIP 2.321 0.511 1.773 1.789 score HELO_DYNAMIC_HOME_NL 2.385 1.530 1.024 1.459 score HELO_DYNAMIC_IPADDR 2.633 3.243 3.680 1.951 score HELO_DYNAMIC_IPADDR2 2.815 3.888 3.728 3.607 score HELO_DYNAMIC_ROGERS 0 # n=0 n=1 n=2 n=3 score HELO_DYNAMIC_SPLIT_IP 3.031 2.893 4.225 3.482 score HELO_FRIEND 0 # n=0 n=1 n=2 n=3 score HELO_LH_HOME 0.001 2.023 0.537 1.736 # n=2 score HELO_LH_LD 0 # n=0 n=1 n=2 n=3 score HELO_LOCALHOST 2.639 3.603 2.915 3.828 # n=2 score HELO_OEM 2.899 2.899 1.234 0.270 # n=2 score HIDE_WIN_STATUS 0.001 score HIGH_CODEPAGE_URI 0 # n=0 n=1 n=2 # score HK_LOTTO 3.599 2.755 2.993 3.599 # Allow GA manage score score HK_NAME_DRUGS 4.299 0.001 3.077 0.552 # score HK_RANDOM_ENVFROM 2.638 0.626 1.798 0.001 # Allow GA manage score score HTML_MIME_NO_HTML_TAG 0.001 0.635 0.001 0.377 score HTML_MISSING_CTYPE 0 # n=0 n=1 n=2 n=3 score HTML_SHORT_CENTER 3.799 3.421 2.611 0.743 score HTML_SHORT_LINK_IMG_1 2.215 0.139 0.480 0.001 score HTML_SHORT_LINK_IMG_2 1.419 0.259 0.603 0.001 score HTML_SHORT_LINK_IMG_3 0.691 0.328 0.001 0.148 score HTML_TITLE_SUBJ_DIFF 1.149 2.171 1.801 2.036 score HTTP_77 0 # n=0 n=1 n=2 n=3 score HTTP_ESCAPED_HOST 0.1 score HTTP_EXCESSIVE_ESCAPES 0.001 score IMPOTENCE 1.539 2.144 3.028 1.374 score INVALID_DATE 1.701 0.432 1.200 1.096 score INVALID_DATE_TZ_ABSURD 0.262 0.632 0.706 0.491 score INVALID_MSGID 2.602 1.167 1.328 0.568 score INVALID_TZ_CST 0 # n=0 n=1 n=2 n=3 score INVALID_TZ_EST 0 # n=0 n=1 n=2 n=3 score INVESTMENT_ADVICE 0.1 score IP_LINK_PLUS 0.001 0.001 0.246 0.012 score JAPANESE_UCE_BODY 0 # n=0 n=1 n=2 n=3 score JAPANESE_UCE_SUBJECT 0 # n=0 n=1 n=2 n=3 score JM_I_FEEL_LUCKY 0 # n=0 n=1 n=2 score JM_RCVD_QMAILV1 0 # n=0 n=1 n=2 n=3 score JM_TORA_XM 0 # n=0 n=1 n=2 n=3 score JOIN_MILLIONS 0.1 score JS_FROMCHARCODE 0 # n=0 n=1 n=2 n=3 score KB_DATE_CONTAINS_TAB 3.800 3.799 3.799 2.751 score KB_FAKED_THE_BAT 2.432 3.441 2.008 2.694 score KB_RATWARE_MSGID 4.099 2.987 2.108 1.700 score KB_RATWARE_OUTLOOK_MID 4.400 4.400 2.503 1.499 score KOREAN_UCE_SUBJECT 0 # n=0 n=1 n=2 n=3 score LIVEFILESTORE 0.1 score LIVE_PORN 0 # n=0 n=1 n=2 n=3 #score LONGWORDS 2.199 1.844 1.819 2.035 score LONG_TERM_PRICE 0.001 # n=0 n=1 n=2 n=3 score LOOPHOLE_1 0 # n=0 n=1 n=2 n=3 score LOTTERY_1 0.001 1.488 1.630 0.087 # n=2 score LOTTERY_PH_004470 0.1 score LOW_PRICE 0.1 score L_SPAM_TOOL_13 0.539 0.485 0.494 1.333 # n=2 score MALE_ENHANCE 3.100 3.099 3.099 0.851 score MARKETING_PARTNERS 0.553 0.235 0.689 0.001 score MID_DEGREES 0 # n=0 n=1 n=2 n=3 #score MILLION_USD 3.799 2.477 3.221 3.247 score MIME_BOUND_DD_DIGITS 3.016 0.349 2.417 1.373 score MIME_BOUND_DIGITS_15 0.1 score MIME_BOUND_EQ_REL 0 # n=0 n=1 n=2 n=3 score MIME_BOUND_MANY_HEX 0 # n=0 n=1 n=2 n=3 score MIME_HEADER_CTYPE_ONLY 0.1 score MIME_HTML_ONLY_MULTI 0.000 0.001 0.001 0.001 score MIME_PHP_NO_TEXT 2.800 2.799 2.799 2.799 score MISSING_DATE 2.739 1.396 1.800 1.360 # n=0 score MISSING_HB_SEP 0 # n=0 n=1 n=2 score MISSING_MID 0.552 0.140 1.199 0.497 # n=1 score MISSING_MIMEOLE 0.392 1.843 0.571 1.899 score MISSING_SUBJECT 0.001 1.767 1.300 1.799 score MORE_SEX 2.799 2.765 2.568 1.413 score MSGID_DOLLARS_RANDOM 0 # n=0 n=1 n=2 n=3 score MSGID_FROM_MTA_HEADER 0.401 0.001 0.473 0.001 score MSGID_RANDY 2.196 2.599 2.599 2.599 score MSGID_SHORT 0.001 0.337 0.001 0.001 score MSGID_SPAM_CAPS 2.366 1.997 3.099 3.099 score MSGID_SPAM_LETTERS 0 # n=0 n=1 n=2 n=3 score MSGID_YAHOO_CAPS 0.797 1.413 2.278 1.411 score MSOE_MID_WRONG_CASE 0.993 3.373 0.960 2.584 # n=2 score MULTI_FORGED 0 # n=0 n=1 n=2 n=3 #score NA_DOLLARS 3.599 score NONEXISTENT_CHARSET 0 # n=0 n=1 n=2 n=3 score NORMAL_HTTP_TO_IP 0.159 0.001 0.795 0.001 score NOT_ADVISOR 0 # n=0 n=1 n=2 n=3 score NO_MEDICAL 2.199 1.254 2.199 1.773 # n=0 score NO_PRESCRIPTION 1.915 1.102 2.280 2.399 score NULL_IN_BODY 0.511 0.498 2.056 1.596 # n=2 score NUMERIC_HTTP_ADDR 0.000 0.001 0.001 1.242 score OBFUSCATING_COMMENT 0.000 0.000 0.001 0.723 score OBSCURED_EMAIL 0 # n=0 n=1 n=2 n=3 score ONE_TIME 1.840 1.175 1.830 0.714 # n=0 score ONLINE_PHARMACY 0.843 2.371 0.008 0.650 score PERCENT_RANDOM 2.999 2.837 2.983 1.838 score PLING_QUERY 0.1 score PREST_NON_ACCREDITED 0 # n=0 n=1 n=2 n=3 score PREVENT_NONDELIVERY 0 # n=0 n=1 n=2 n=3 score PRICES_ARE_AFFORDABLE 0.794 0.851 1.112 0.551 score RATWARE_EGROUPS 1.898 1.258 1.406 1.621 score RATWARE_HASH_DASH 0 # n=0 n=1 n=2 n=3 score RATWARE_MOZ_MALFORMED 0 # n=0 n=1 n=2 n=3 score RATWARE_MPOP_WEBMAIL 1.153 1.338 1.229 1.999 # n=0 # jhardin 05/2021 # masscheck corpora thin or nonexistent, real world FPs reported - exposing to ruleqa for eval #score RATWARE_MS_HASH 2.036 3.692 0.454 2.148 score RATWARE_OE_MALFORMED 0 # n=0 n=1 n=2 n=3 # jhardin 05/2021 # masscheck corpora thin or nonexistent, real world FPs reported - exposing to ruleqa for eval #score RATWARE_OUTLOOK_NONAME 2.964 0.033 2.685 2.950 score RATWARE_RCVD_AT 0 # n=0 n=1 n=2 n=3 score RATWARE_RCVD_PF 0 # n=0 n=1 n=2 n=3 score RATWARE_ZERO_TZ 2.392 2.535 0.265 1.781 # n=0 score RCVD_AM_PM 0 # n=0 n=1 n=2 n=3 score RCVD_BAD_ID 0 # n=0 n=1 n=2 n=3 score RCVD_DOUBLE_IP_LOOSE 1.150 0.960 1.042 1.012 score RCVD_DOUBLE_IP_SPAM 2.411 2.777 1.912 1.808 score RCVD_FAKE_HELO_DOTCOM 2.799 2.389 2.605 1.189 score RCVD_FORGED_WROTE 0 # n=0 n=1 n=2 n=3 score RCVD_FORGED_WROTE2 0 # n=0 n=1 n=2 n=3 #score RCVD_IN_BRBL_LASTEXT 0 1.644 0 1.449 # n=0 n=2 score RCVD_IN_PSBL 0 2.700 0 2.700 # n=0 n=2 score RCVD_MAIL_COM 0 # n=0 n=1 n=2 n=3 score RDNS_DYNAMIC 2.639 0.363 1.663 0.982 score RDNS_LOCALHOST 3.700 0.969 2.345 0.001 score RDNS_NONE 2.399 1.274 1.228 0.793 score REFINANCE_NOW 0 # n=0 n=1 n=2 n=3 score REFINANCE_YOUR_HOME 0 # n=0 n=1 n=2 n=3 score REMOVE_BEFORE_LINK 0.1 score REPLICA_WATCH 3.487 3.164 4.074 3.775 score REPLYTO_WITHOUT_TO_CC 2.399 1.946 0.607 1.552 score REPTO_QUOTE_AOL 0 # n=0 n=1 n=2 n=3 score REPTO_QUOTE_IMS 0 # n=0 n=1 n=2 n=3 score REPTO_QUOTE_MSN 0 # n=0 n=1 n=2 n=3 score REPTO_QUOTE_QUALCOMM 0 # n=0 n=1 n=2 n=3 score REPTO_QUOTE_YAHOO 0.001 0.490 0.001 0.646 score RUDE_HTML 0 # n=0 n=1 n=2 n=3 score SB_GIF_AND_NO_URIS 2.199 2.199 2.200 2.199 # n=2 score SHORT_HELO_AND_INLINE_IMAGE 0.1 score SHORT_TERM_PRICE 0.001 # n=0 n=1 n=2 n=3 score SPAMMY_XMAILER 2.650 0.862 1.993 2.491 # n=2 score SPOOF_COM2COM 0.001 score SPOOF_COM2OTH 0.001 score SPOOF_NET2COM 0 # n=0 n=1 n=2 n=3 score STOCK_ALERT 0 # n=0 n=1 n=2 n=3 score STOCK_IMG_CTYPE 0.001 0.005 0.001 0.001 # n=2 score STOCK_IMG_HDR_FROM 0.001 0.001 0.001 0.021 # n=2 score STOCK_IMG_HTML 0.000 0.028 0.000 0.005 # n=2 score STOCK_IMG_OUTLOOK 0.001 0.702 0.413 0.190 # n=2 score STOCK_PRICES 0 # n=0 n=1 n=2 n=3 score STOX_AND_PRICE 0 # n=0 n=1 n=2 n=3 score STOX_REPLY_TYPE 1.898 0.212 0.141 0.439 # n=1 score STOX_REPLY_TYPE_WITHOUT_QUOTES 3.099 1.860 1.629 1.757 score STRONG_BUY 0 # n=0 n=1 n=2 n=3 score SUBJECT_DIET 1.927 1.563 0.817 1.466 score SUBJECT_DRUG_GAP_C 2.108 0.989 1.348 2.140 score SUBJECT_DRUG_GAP_L 2.799 2.304 1.402 1.561 score SUBJECT_DRUG_GAP_S 0 # n=0 n=1 n=2 n=3 #score SUBJECT_DRUG_GAP_VA 0 # n=0 n=1 n=2 n=3 score SUBJECT_DRUG_GAP_X 0 # n=0 n=1 n=2 n=3 score SUBJECT_NEEDS_ENCODING 0.498 0.100 0.804 0.049 # n=2 score SUBJECT_SEXUAL 0 # n=0 n=1 n=2 n=3 score SUBJ_AS_SEEN 2.711 3.099 3.099 1.461 # n=0 score SUBJ_BUY 0.594 1.498 0.001 0.639 score SUBJ_DOLLARS 0.1 #score SUBJ_YOUR_DEBT 3.299 3.045 1.199 0.987 score SUBJ_YOUR_FAMILY 2.910 2.999 2.999 2.999 score TBIRD_SUSP_MIME_BDRY 2.400 2.400 2.399 2.399 score THEBAT_UNREG 2.599 1.843 2.324 1.524 score TO_MALFORMED 0.1 score TRACKER_ID 0.1 score TT_MSGID_TRUNC 0.748 0.023 1.434 1.448 # n=2 score TT_OBSCURED_VALIUM 0 # n=0 n=1 n=2 n=3 score TT_OBSCURED_VIAGRA 0 # n=0 n=1 n=2 n=3 score TVD_ACT_193 0 # n=0 n=1 n=2 n=3 score TVD_DEAR_HOMEOWNER 0 # n=0 n=1 n=2 n=3 score TVD_EB_PHISH 0 # n=0 n=1 n=2 n=3 score TVD_ENVFROM_APOST 0 # n=0 n=1 n=2 n=3 score TVD_FINGER_02 0.001 score TVD_FLOAT_GENERAL 0 # n=0 n=1 n=2 n=3 score TVD_INCREASE_SIZE 1.529 0.601 1.055 0.001 # n=1 score TVD_LINK_SAVE 0 # n=0 n=1 n=2 n=3 score TVD_PH_BODY_ACCOUNTS_PRE 0.001 #changed to 0.001 due to .211 S/O on 2015-05-01 but left due to Meta Use - #1.201 1.527 1.327 2.393 # n=1 score TVD_PH_REC 0.1 score TVD_PH_SEC 0.1 score TVD_PP_PHISH 0 # n=0 n=1 n=2 n=3 score TVD_QUAL_MEDS 2.697 2.397 2.799 2.483 # n=2 score TVD_RATWARE_CB 0 # n=0 n=1 n=2 n=3 score TVD_RATWARE_CB_2 0 # n=0 n=1 n=2 n=3 score TVD_RATWARE_MSGID_02 0 # n=0 n=1 n=2 n=3 #score TVD_RCVD_SPACE_BRACKET 0.001 0.001 0.001 0.001 # n=1 score TVD_SECTION 0 # n=0 n=1 n=2 n=3 score TVD_SILLY_URI_OBFU 0 # n=0 n=1 n=2 n=3 score TVD_SPACED_SUBJECT_WORD3 0 # n=0 n=1 n=2 n=3 score TVD_SUBJ_ACC_NUM 0.1 score TVD_SUBJ_FINGER_03 0 # n=0 n=1 n=2 n=3 score TVD_SUBJ_OWE 0 # n=0 n=1 n=2 n=3 score TVD_SUBJ_WIPE_DEBT 2.599 2.291 2.599 1.004 # n=2 score TVD_VISIT_PHARMA 1.957 1.196 0.417 1.406 # n=2 score TVD_VIS_HIDDEN 0 # n=0 n=1 n=2 n=3 score UNCLAIMED_MONEY 2.699 2.699 2.699 2.427 score UNCLOSED_BRACKET 2.699 1.329 1.425 1.496 score UPPERCASE_50_75 0.001 0.791 0.001 0.008 score UPPERCASE_75_100 1.480 1.189 0.001 0.001 score URG_BIZ 1.750 0.941 0.568 0.573 score URI_NOVOWEL 0.500 #score URI_NO_WWW_BIZ_CGI 2.399 2.399 2.400 2.399 # n=0 #score URI_NO_WWW_INFO_CGI 2.299 2.299 0.292 2.071 #score URI_OBFU_WWW 3.099 3.099 2.306 2.475 score URI_UNSUBSCRIBE 0 # n=0 n=1 n=2 n=3 #score US_DOLLARS_3 2.599 2.523 1.780 1.754 score VIA_GAP_GRA 0 # n=0 n=1 n=2 n=3 score WEIRD_PORT 0.001 0.001 0.097 0.001 score WEIRD_QUOTING 0.001 0.001 0.001 0.001 score WITH_LC_SMTP 0 # n=0 n=1 n=2 n=3 score X_IP 0.001 0.001 0.001 0.001 score X_MAILER_CME_6543_MSN 2.886 2.004 3.002 3.348 score X_MESSAGE_INFO 0 # n=0 n=1 n=2 n=3 score X_PRIORITY_CC 0 # n=0 n=1 n=2 n=3 score YAHOO_DRS_REDIR 0 # n=0 n=1 n=2 n=3 score YAHOO_RD_REDIR 0 # n=0 n=1 n=2 n=3 # End of generated scores. # Bug 5700 - performing terribly 6/2019 #score URI_HEX 2.800 1.313 1.206 1.122 score URI_HEX 0.1 # Bug 6022, settle at informative score score TVD_RCVD_IP 0.001 score TVD_RCVD_IP4 0.001 # Bug 6280, 5690, settle at informative score score BAD_ENC_HEADER 0.001 ########################################################################### ifplugin Mail::SpamAssassin::Plugin::Shortcircuit score SHORTCIRCUIT 0 endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::AccessDB score ACCESSDB 0 endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::BodyEval # score BLANK_LINES_80_90 0 # n=0 n=1 n=2 n=3 score MPART_ALT_DIFF 2.246 0.724 0.595 0.790 score MPART_ALT_DIFF_COUNT 2.799 1.483 1.199 1.112 score TVD_STOCK1 0 # n=0 n=1 n=2 n=3 # score TVD_SPACE_RATIO 0.001 endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::HTMLEval # score HTML_COMMENT_SAVED_URL 0.198 0.357 0.899 1.391 score HTML_COMMENT_SHORT 0 # n=0 n=1 n=2 n=3 score HTML_EMBEDS 0.001 score HTML_EXTRA_CLOSE 0.001 score HTML_FONT_FACE_BAD 0.001 score HTML_FONT_LOW_CONTRAST 0.713 0.001 0.786 0.001 score HTML_FONT_SIZE_HUGE 0.001 score HTML_FONT_SIZE_LARGE 0.001 score HTML_FORMACTION_MAILTO 0 # n=0 n=1 n=2 n=3 score HTML_IFRAME_SRC 0 # n=0 n=1 n=2 n=3 score HTML_IMAGE_ONLY_04 1.680 0.342 1.799 1.172 score HTML_IMAGE_ONLY_08 0.585 1.781 1.845 1.651 score HTML_IMAGE_ONLY_12 1.381 1.629 1.400 2.059 score HTML_IMAGE_ONLY_16 1.969 1.048 1.199 1.092 score HTML_IMAGE_ONLY_20 2.109 0.700 1.300 1.546 score HTML_IMAGE_ONLY_24 2.799 1.282 1.328 1.618 score HTML_IMAGE_ONLY_28 2.799 0.726 1.512 1.404 score HTML_IMAGE_ONLY_32 2.196 0.001 1.172 0.001 score HTML_IMAGE_RATIO_02 0.001 score HTML_IMAGE_RATIO_04 0.001 score HTML_IMAGE_RATIO_06 0.001 0.001 0.001 0.001 score HTML_IMAGE_RATIO_08 0.001 0.001 0.001 0.001 score HTML_OBFUSCATE_05_10 0.601 0.001 0.718 0.260 score HTML_OBFUSCATE_10_20 0.174 1.162 0.588 0.093 score HTML_OBFUSCATE_20_30 2.499 2.441 1.449 1.999 score HTML_OBFUSCATE_30_40 0 # n=0 n=1 n=2 n=3 score HTML_OBFUSCATE_50_60 0 # n=0 n=1 n=2 n=3 score HTML_OBFUSCATE_70_80 0 # n=0 n=1 n=2 n=3 score HTML_OBFUSCATE_90_100 2.000 # n=0 n=1 n=2 n=3 - manually scored per list discussion score HTML_BADTAG_40_50 0 # n=0 n=1 n=2 n=3 score HTML_BADTAG_50_60 0 # n=0 n=1 n=2 n=3 score HTML_BADTAG_60_70 0 # n=0 n=1 n=2 n=3 score HTML_BADTAG_90_100 0 # n=0 n=1 n=2 n=3 score HTML_NONELEMENT_30_40 0.000 0.001 0.308 0.001 score HTML_NONELEMENT_40_50 0 # n=0 n=1 n=2 n=3 score HTML_NONELEMENT_60_70 0 # n=0 n=1 n=2 n=3 score HTML_NONELEMENT_80_90 0 # n=0 n=1 n=2 n=3 score HTML_TAG_BALANCE_BODY 0.1 score HTML_TAG_BALANCE_HEAD 0.520 0.000 0.600 0.817 score HTML_TAG_EXIST_BGSOUND 0 # n=0 n=1 n=2 n=3 # # HTML control test score HTML_MESSAGE 0.001 endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::DNSEval # score RCVD_IN_BL_SPAMCOP_NET 0 1.246 0 1.347 # n=0 n=2 score RCVD_IN_IADB_DK 0 -0.223 0 -0.095 # n=0 n=1 n=2 score RCVD_IN_IADB_DOPTIN_GT50 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_DOPTIN_LT50 0 -0.001 0 -0.001 # n=0 n=1 n=2 score RCVD_IN_IADB_EDDB 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_EPIA 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_GOODMAIL 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_LISTED 0 -0.380 0 -0.001 # n=0 n=2 score RCVD_IN_IADB_LOOSE 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_MI_CPEAR 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_MI_CPR_30 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_MI_CPR_MAT 0 -0.332 0 -0.000 # n=0 n=1 n=2 score RCVD_IN_IADB_NOCONTROL 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_OOO 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_OPTIN 0 -2.057 0 -1.470 # n=0 n=1 n=2 score RCVD_IN_IADB_OPTIN_GT50 0 -1.208 0 -0.007 # n=0 n=2 score RCVD_IN_IADB_OPTIN_LT50 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_OPTOUTONLY 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_RDNS 0 -0.167 0 -0.235 # n=0 n=1 n=2 score RCVD_IN_IADB_SENDERID 0 -0.001 0 -0.001 # n=0 n=2 score RCVD_IN_IADB_SPF 0 -0.001 0 -0.059 # n=0 n=2 score RCVD_IN_IADB_UNVERIFIED_1 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_UNVERIFIED_2 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_UT_CPEAR 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_UT_CPR_30 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_UT_CPR_MAT 0 -0.095 0 -0.001 # n=0 n=1 n=2 score RCVD_IN_SBL 0 2.596 0 0.141 # n=0 n=2 score RCVD_IN_XBL 0 0.724 0 0.375 # n=0 n=2 score RCVD_IN_PBL 0 3.558 0 3.335 # n=0 n=2 score RCVD_IN_SBL_CSS 0 3.558 0 3.335 # n=0 n=2 score NO_DNS_FOR_FROM 0 0.379 0 0.001 # n=0 n=2 # score RCVD_IN_ZEN_BLOCKED_OPENDNS 0 0.001 0 0.001 score RCVD_IN_ZEN_BLOCKED 0 0.001 0 0.001 # Validity (née ReturnPath) Certified # https://www.validity.com/resource-center/fact-sheet-certification/ # CERTIFIED is a subset of SAFE, thus the score is cumulative. # -2 + -3 = -5 points for CERTIFIED # disabled by default 2025-05-11 WKC bz#8278 score RCVD_IN_VALIDITY_CERTIFIED 0 score RCVD_IN_VALIDITY_SAFE 0 score RCVD_IN_VALIDITY_RPBL 0 # Uncomment these if you enable the ones above #score RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 #score RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 #score RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 # DNSWL is a "free for most" service that requires subscriptions for servers making over 100K queries daily. # score RCVD_IN_DNSWL_NONE 0 -0.0001 0 -0.0001 score RCVD_IN_DNSWL_LOW 0 -0.7 0 -0.7 score RCVD_IN_DNSWL_MED 0 -2.3 0 -2.3 score RCVD_IN_DNSWL_HI 0 -5 0 -5 score RCVD_IN_DNSWL_BLOCKED 0 0.001 0 0.001 # IADB score RCVD_IN_IADB_VOUCHED 0 -2.2 0 -2.2 score RCVD_IN_IADB_DOPTIN 0 -4 0 -4 score RCVD_IN_IADB_ML_DOPTIN 0 -6 0 -6 # MAPS # MAPS is a commercial service. If you pay for these, assign a score # so they will be checked. score RCVD_IN_MAPS_RBL 0 score RCVD_IN_MAPS_DUL 0 score RCVD_IN_MAPS_RSS 0 score RCVD_IN_MAPS_OPS 0 score RCVD_IN_MAPS_NML 0 endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::HeaderEval # score DATE_IN_FUTURE_03_06 3.399 2.426 2.997 3.027 score DATE_IN_FUTURE_06_12 2.899 0.001 2.222 1.947 score DATE_IN_FUTURE_12_24 2.603 2.489 3.199 3.199 score DATE_IN_FUTURE_24_48 2.598 1.248 0.001 2.048 score DATE_IN_FUTURE_48_96 2.384 0.813 1.078 2.181 #score DATE_IN_FUTURE_96_XX 2.614 3.028 2.851 3.087 score DATE_IN_FUTURE_96_XX 0 score DATE_IN_PAST_03_06 2.399 1.076 1.200 1.592 score DATE_IN_PAST_06_12 1.699 1.103 1.274 1.543 score DATE_IN_PAST_12_24 0.001 0.804 1.190 1.049 score DATE_IN_PAST_24_48 1.109 0.485 0.624 1.340 score DATE_IN_PAST_96_XX 2.600 2.070 1.233 3.405 score FORGED_HOTMAIL_RCVD2 0.001 1.187 0.698 0.874 score FORGED_YAHOO_RCVD 2.397 1.022 2.599 1.630 score FROM_ILLEGAL_CHARS 2.192 2.059 0.240 0.036 score HEADER_COUNT_CTYPE 0 # n=0 n=1 n=2 n=3 score HEADER_COUNT_SUBJECT 0 # n=0 n=1 n=2 n=3 score HEAD_ILLEGAL_CHARS 0 # n=0 n=1 n=2 n=3 score LOCALPART_IN_SUBJECT 0.001 0.730 1.199 1.107 score MISSING_HEADERS 0.915 1.207 1.204 1.021 score MSGID_OUTLOOK_INVALID 3.899 score RATWARE_EFROM 0.1 score RATWARE_NAME_ID 3.099 0.309 3.099 0.247 # n=0 score SORTED_RECIPS 1.801 2.474 1.791 2.499 score SUBJ_ALL_CAPS 0.5 score SUBJ_ILLEGAL_CHARS 0.620 1.105 0.448 1.518 score SUSPICIOUS_RECIPS 2.499 2.497 2.139 2.510 score UNRESOLVED_TEMPLATE 3.035 0.716 2.424 1.252 # # ok_locales score CHARSET_FARAWAY_HEADER 3.200 endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::ImageInfo # score DC_GIF_UNO_LARGO 0.001 1.323 0.053 2.176 # n=2 score DC_IMAGE_SPAM_HTML 0.1 score DC_IMAGE_SPAM_TEXT 0.1 score DC_PNG_UNO_LARGO 0.001 # n=0 n=1 n=2 n=3 # endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::MIMEEval # score BASE64_LENGTH_78_79 0.1 score BASE64_LENGTH_79_INF 1.379 2.019 0.583 1.502 # n=2 score MIME_BAD_ISO_CHARSET 0 # n=0 n=1 n=2 n=3 #score MIME_BASE64_BLANKS 0.001 0.001 0.001 0.001 score MIME_BASE64_TEXT 0.001 0.001 0.001 1.741 score MIME_HTML_MOSTLY 0.1 score MIME_HTML_ONLY 0.1 score MISSING_MIME_HB_SEP 0.001 0.001 0.001 0.001 score MULTIPART_ALT_NON_TEXT 0 # n=0 n=1 n=2 n=3 # score MIME_QP_LONG_LINE 0.001 score MIMEPART_LIMIT_EXCEEDED 0.001 # ok_locales score CHARSET_FARAWAY 3.200 # we dare you # score HEAD_LONG 2.5 # score MISSING_HB_SEP 2.5 endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::RelayEval # score NO_RDNS_DOTCOM_HELO 3.100 0.433 3.099 0.823 score RCVD_HELO_IP_MISMATCH 1.680 1.186 2.362 2.368 # score RCVD_ILLEGAL_IP 3.399 score RCVD_ILLEGAL_IP 1.3 score RCVD_NUMERIC_HELO 0.001 0.865 0.001 1.164 # # Informational rules about Received header parsing score NO_RELAYS -0.001 score UNPARSEABLE_RELAY 0.001 score HELO_STATIC_HOST -0.001 # immutable (due to tflags userconf), see bug 5544 # score ALL_TRUSTED -1.360 -1.440 -1.665 -1.800 endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::URIEval # score HTTPS_IP_MISMATCH 0 # n=0 n=1 n=2 n=3 # score URI_TRUNCATED 0.001 endif ########################################################################### # Scores for tests that are scored manually or with isolated rescore runs. # Most are net tests, userconf tests, tests occuring with very low frequency, # or tests with many false positives. # GTUBE - Generic Test for Unsolicited Bulk Email score GTUBE 1000.000 # we dare you # score FRAGMENTED_MESSAGE 2.5 # score HIGH_CODEPAGE_URI 2.5 # make the Bayes scores unmutable (as discussed in bug 4505) ifplugin Mail::SpamAssassin::Plugin::Bayes score BAYES_00 0 0 -1.5 -1.9 score BAYES_05 0 0 -0.3 -0.5 score BAYES_20 0 0 -0.001 -0.001 score BAYES_40 0 0 -0.001 -0.001 score BAYES_50 0 0 2.0 0.8 score BAYES_60 0 0 2.5 1.5 score BAYES_80 0 0 2.7 2.0 score BAYES_95 0 0 3.2 3.0 score BAYES_99 0 0 3.8 3.5 score BAYES_999 0 0 0.2 0.2 endif # Informational rules about Received header parsing score NO_RECEIVED -0.001 # Informational rule, URI parsing encountered an overlong URI # Informational rule, typically means corrupt corpus/input score NO_HEADERS_MESSAGE 0.001 # ok_locales score HTML_CHARSET_FARAWAY 0.500 score MIME_CHARSET_FARAWAY 2.450 # rescore never changes the welcomelist/blocklist scores ifplugin Mail::SpamAssassin::Plugin::WLBLEval #score USER_IN_BLOCKLIST 100.000 - Moved to 60_welcomelist.cf #score USER_IN_WELCOMELIST -100.000 - Moved to 60_welcomelist.cf #score USER_IN_DEF_WELCOMELIST -15.000 - Moved to 60_welcomelist.cf #score USER_IN_BLOCKLIST_TO 10.000 - Moved to 60_welcomelist.cf #score URI_HOST_IN_BLOCKLIST 100.0 - Moved to 60_welcomelist.cf #score URI_HOST_IN_WELCOMELIST -100.0 - Moved to 60_welcomelist.cf #Removed in bug 7256 #score HEADER_HOST_IN_BLOCKLIST 100.0 #score HEADER_HOST_IN_WELCOMELIST -100.0 # not really false positives but the user wants spam! #score USER_IN_WELCOMELIST_TO -6.000 - Moved to 60_welcomelist.cf score USER_IN_MORE_SPAM_TO -20.000 score USER_IN_ALL_SPAM_TO -100.000 endif ifplugin Mail::SpamAssassin::Plugin::SPF score USER_IN_SPF_WELCOMELIST -100 # overridden in 60_welcomelist_spf.cf score USER_IN_SPF_WHITELIST -100 # overridden in 60_welcomelist_spf.cf score USER_IN_DEF_SPF_WL -7.500 score ENV_AND_HDR_SPF_MATCH -0.5 endif # Mail::SpamAssassin::Plugin::SPF # DKIM ifplugin Mail::SpamAssassin::Plugin::DKIM score USER_IN_DKIM_WELCOMELIST -100 # overridden in 60_welcomelist_dkim.cf score USER_IN_DKIM_WHITELIST -100 # overridden in 60_welcomelist_dkim.cf score USER_IN_DEF_DKIM_WL -7.500 score DKIM_SIGNED 0.1 score DKIM_VALID -0.1 score DKIM_INVALID 0.1 score DKIM_VALID_AU -0.1 if (version >= 3.004002) score DKIM_VALID_EF -0.1 endif if can(Mail::SpamAssassin::Plugin::DKIM::has_arc) score ARC_SIGNED 0.001 score ARC_VALID -0.1 score ARC_INVALID 0.1 endif score DKIM_VERIFIED 0 score DKIM_POLICY_SIGNALL 0 score DKIM_POLICY_SIGNSOME 0 score DKIM_POLICY_TESTING 0 score DKIM_ADSP_CUSTOM_LOW 0.001 score DKIM_ADSP_CUSTOM_MED 0.001 score DKIM_ADSP_CUSTOM_HIGH 0.001 score NML_ADSP_CUSTOM_LOW 0 0.7 0 0.7 score NML_ADSP_CUSTOM_MED 0 1.2 0 0.9 score NML_ADSP_CUSTOM_HIGH 0 2.6 0 2.5 # score DKIM_ADSP_ALL 0 1.1 0 0.8 score DKIM_ADSP_DISCARD 0 1.8 0 1.8 score DKIM_ADSP_NXDOMAIN 0 0.8 0 0.9 # endif # Mail::SpamAssassin::Plugin::DKIM ifplugin Mail::SpamAssassin::Plugin::AskDNS # score DKIMDOMAIN_IN_DWL 0 -3.5 0 -3.5 score DKIMDOMAIN_IN_DWL_UNKNOWN 0 -0.01 0 -0.01 # endif # SPF # Note that the benefit for a valid SPF record is deliberately minimal; it's # likely that more spammers would quickly move to setting valid SPF records # otherwise. The penalties for an *incorrect* record, however, are large. ;) ifplugin Mail::SpamAssassin::Plugin::SPF score SPF_NONE 0.001 score SPF_HELO_NONE 0.001 score SPF_PASS -0.001 score SPF_HELO_PASS -0.001 # score SPF_FAIL 0 0.919 0 0.001 # n=0 n=2 score SPF_HELO_FAIL 0 0.001 0 0.001 # n=0 n=2 score SPF_HELO_NEUTRAL 0 0.001 0 0.112 # n=0 n=2 score SPF_HELO_SOFTFAIL 0 0.896 0 0.732 # n=0 n=2 score SPF_NEUTRAL 0 0.652 0 0.779 # n=0 n=2 score SPF_SOFTFAIL 0 0.972 0 0.665 # n=0 n=2 # endif # Mail::SpamAssassin::Plugin::SPF # DMARC ifplugin Mail::SpamAssassin::Plugin::DMARC score DMARC_PASS -0.001 # score DMARC_REJECT 0.001 1.797 0.001 1.797 # n=0 n=2 score DMARC_QUAR 0.001 1.198 0.001 1.198 # n=0 n=2 score DMARC_NONE 0.001 0.898 0.001 0.898 # n=0 n=2 # score DMARC_MISSING 0.001 endif # Mail::SpamAssassin::Plugin::DMARC # URIDNSBL ifplugin Mail::SpamAssassin::Plugin::URIDNSBL # #score URIBL_AB_SURBL 0 4.499 0 4.499 # n=0 n=2 - removed bug 7279 #Changed below from JP to Abuse - bug 7279 score URIBL_ABUSE_SURBL 0 1.948 0 1.250 # n=0 n=2 score URIBL_PH_SURBL 0 0.001 0 0.610 # n=0 n=2 score URIBL_RHS_DOB 0 0.276 0 1.514 # n=0 n=2 score URIBL_SBL 0 0.644 0 1.623 # n=0 n=2 score URIBL_CSS 0 0.1 0 0.1 score URIBL_SBL_A 0 0.1 0 0.1 score URIBL_CSS_A 0 0.1 0 0.1 #score URIBL_SC_SURBL 0 0.001 0 0.568 # n=0 n=2 - removed bug 7279 #score URIBL_WS_SURBL 0 1.659 0 1.608 # n=0 n=2 - Removed bug 8093 score URIBL_MW_SURBL 0 1.263 0 1.263 score URIBL_CR_SURBL 0 1.263 0 1.263 score URIBL_BLACK 0 1.7 0 1.7 # n=0 n=2 score URIBL_GREY 0 1.084 0 0.424 # n=0 n=2 score URIBL_DBL_SPAM 0 2.5 0 2.5 score URIBL_DBL_PHISH 0 2.5 0 2.5 score URIBL_DBL_MALWARE 0 2.5 0 2.5 score URIBL_DBL_BOTNETCC 0 2.5 0 2.5 score URIBL_DBL_ABUSE_SPAM 0 2.0 0 2.0 score URIBL_DBL_ABUSE_REDIR 0 0.001 0 0.001 score URIBL_DBL_ABUSE_PHISH 0 2.5 0 2.5 score URIBL_DBL_ABUSE_MALW 0 2.5 0 2.5 score URIBL_DBL_ABUSE_BOTCC 0 2.5 0 2.5 # # score URIBL_GREY 0.25 score URIBL_RED 0 0.001 0 0.001 score URIBL_BLOCKED 0 0.001 0 0.001 score URIBL_DBL_ERROR 0 0.001 0 0.001 score URIBL_ZEN_BLOCKED_OPENDNS 0 0.001 0 0.001 score URIBL_ZEN_BLOCKED 0 0.001 0 0.001 score URIBL_DBL_BLOCKED_OPENDNS 0 0.001 0 0.001 score URIBL_DBL_BLOCKED 0 0.001 0 0.001 endif # Mail::SpamAssassin::Plugin::URIDNSBL # ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags # score FUZZY_AFFORDABLE 0 # n=0 n=1 n=2 n=3 #score FUZZY_AMBIEN 0.1 score FUZZY_BILLION 0 # n=0 n=1 n=2 n=3 score FUZZY_CPILL 0.001 0.001 0.001 0.001 score FUZZY_CREDIT 1.699 1.413 0.601 1.678 #score FUZZY_ERECT 0.1 score FUZZY_GUARANTEE 0 # n=0 n=1 n=2 n=3 score FUZZY_MEDICATION 0 # n=0 n=1 n=2 n=3 score FUZZY_MERIDIA 0 # n=0 n=1 n=2 n=3 score FUZZY_MILLION 0.1 score FUZZY_MONEY 0 # n=0 n=1 n=2 n=3 score FUZZY_MORTGAGE 0 # n=0 n=1 n=2 n=3 score FUZZY_OBLIGATION 0 # n=0 n=1 n=2 n=3 score FUZZY_OFFERS 0 # n=0 n=1 n=2 n=3 score FUZZY_PHARMACY 2.960 3.299 1.967 1.353 score FUZZY_PHENT 2.799 1.647 1.540 2.662 # n=0 score FUZZY_PRESCRIPT 0 # n=0 n=1 n=2 n=3 score FUZZY_PRICES 1.821 0.720 2.210 2.311 score FUZZY_REFINANCE 0 # n=0 n=1 n=2 n=3 score FUZZY_REMOVE 0 # n=0 n=1 n=2 n=3 #score FUZZY_ROLEX 0.1 score FUZZY_SOFTWARE 0 # n=0 n=1 n=2 n=3 score FUZZY_THOUSANDS 0 # n=0 n=1 n=2 n=3 score FUZZY_VLIUM 0 # n=0 n=1 n=2 n=3 score FUZZY_VIOXX 0 # n=0 n=1 n=2 n=3 score FUZZY_VPILL 0.001 0.494 0.796 1.014 score FUZZY_XPILL 0.1 score SUBJECT_FUZZY_CHEAP 0.641 1.831 0.833 0.001 # n=0 score SUBJECT_FUZZY_MEDS 0 # n=0 n=1 n=2 n=3 score SUBJECT_FUZZY_PENIS 0 # n=0 n=1 n=2 n=3 score SUBJECT_FUZZY_TION 0 # n=0 n=1 n=2 n=3 score SUBJECT_FUZZY_VPILL 0 # n=0 n=1 n=2 n=3 score TVD_FUZZY_DEGREE 0 # n=0 n=1 n=2 n=3 score TVD_FUZZY_FINANCE 0 # n=0 n=1 n=2 n=3 score TVD_FUZZY_FIXED_RATE 0 # n=0 n=1 n=2 n=3 score TVD_FUZZY_MICROCAP 0 # n=0 n=1 n=2 n=3 score TVD_FUZZY_PHARMACEUTICAL 0 # n=0 n=1 n=2 n=3 score TVD_FUZZY_SYMBOL 0 # n=0 n=1 n=2 n=3 # endif # Mail::SpamAssassin::Plugin::ReplaceTags # DCC ifplugin Mail::SpamAssassin::Plugin::DCC score DCC_CHECK 0 1.1 0 1.1 score DCC_REPUT_00_12 0 -0.8 0 -0.4 score DCC_REPUT_13_19 0 -0.1 0 -0.1 score DCC_REPUT_70_89 0 0.1 0 0.1 score DCC_REPUT_90_94 0 0.4 0 0.6 score DCC_REPUT_95_98 0 0.7 0 1.0 score DCC_REPUT_99_100 0 1.2 0 1.4 endif # Mail::SpamAssassin::Plugin::DCC # Pyzor ifplugin Mail::SpamAssassin::Plugin::Pyzor # score PYZOR_CHECK 0 1.985 0 1.392 # n=0 n=2 # endif # Mail::SpamAssassin::Plugin::Pyzor # Razor2 ifplugin Mail::SpamAssassin::Plugin::Razor2 # score RAZOR2_CHECK 0 1.729 0 0.922 # n=0 n=2 score RAZOR2_CF_RANGE_51_100 0 2.430 0 1.886 # n=0 n=2 # endif # Mail::SpamAssassin::Plugin::Razor2 # TextCat ifplugin Mail::SpamAssassin::Plugin::TextCat score UNWANTED_LANGUAGE_BODY 2.800 score BODY_8BITS 1.500 endif # Mail::SpamAssassin::Plugin::TextCat # AntiVirus ifplugin Mail::SpamAssassin::Plugin::AntiVirus score MICROSOFT_EXECUTABLE 0.1 score MIME_SUSPECT_NAME 0.1 endif # Mail::SpamAssassin::Plugin::AntiVirus # VBounce - anti-bounce message ruleset. All of these are informational, # and should not be scored as antispam rules; instead the user needs # to detect messages that hit ANY_BOUNCE_MESSAGE, and filter them aside # as spurious bounces. # ifplugin Mail::SpamAssassin::Plugin::VBounce score BOUNCE_MESSAGE 0.1 score CRBOUNCE_MESSAGE 0.1 score VBOUNCE_MESSAGE 0.1 score OOOBOUNCE_MESSAGE 0.1 score ANY_BOUNCE_MESSAGE 0.1 endif # Mail::SpamAssassin::Plugin::VBounce # another informational rule: this is for C/R responses to mail the user # really did sent -- the opposite of CRBOUNCE_MESSAGE. some users might # like to block all C/R bounces, or filter them separately. # score CHALLENGE_RESPONSE 0.1 # It's still quite common for non-spam senders to send mail from hosts with # no rDNS, or "dynamic-looking" rDNS. Lock these down to low values; # some sites can increase them as a matter of local policy, and they # make great fodder for meta rules, too. # # score RDNS_NONE 0 1.1 0 0.7 # score RDNS_DYNAMIC 0 0.5 0 0.5 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # score CTYPE_8SPACE_GIF 0 # n=0 n=1 n=2 n=3 # endif ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch # score HTTPS_HTTP_MISMATCH 0.1 # endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # score PART_CID_STOCK 0.001 0.001 0.001 0.000 # n=2 # endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # score PART_CID_STOCK_LESS 0.000 0.036 0.745 0.894 # n=2 # endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # score TVD_FW_GRAPHIC_NAME_LONG 0.001 0.648 0.836 1.293 # n=2 # endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # score TVD_FW_GRAPHIC_NAME_MID 0.600 0.001 0.389 0.095 # n=2 # endif # Bug 6155 c115 score KB_RATWARE_OUTLOOK_08 0 score KB_RATWARE_OUTLOOK_12 0 score KB_RATWARE_OUTLOOK_16 0 score KB_RATWARE_BOUNDARY 0 # MAILSPIKE RBL ENABLED FOR SA3.4 and above - BUG 6400 if (version >= 3.004000) # FLOATING SCORES FOR GA - adjust after GA to make L3 - L5 linear # Probably adjust up slightly to make up for the "reuse" imperfection # score RCVD_IN_MSPIKE_ZBI 2.7 score RCVD_IN_MSPIKE_L5 2.5 score RCVD_IN_MSPIKE_L4 1.7 score RCVD_IN_MSPIKE_L3 0.9 # # FIXED SCORES # TEMPORARILY LOWERED - adjust these higher after GA is done # (pending discussion: Welcomelists need scores, but they shouldn't effect the scoring of spam detection rules.) score RCVD_IN_MSPIKE_H2 -0.01 score RCVD_IN_MSPIKE_H3 -0.01 score RCVD_IN_MSPIKE_H4 -0.01 score RCVD_IN_MSPIKE_H5 -1.0 # FIXED SCORES - informational rules, useful only for statistical comparisons score RCVD_IN_MSPIKE_BL 0.01 score RCVD_IN_MSPIKE_WL -0.01 endif updates_spamassassin_org/30_text_fr.cf 0000644 00000046533 15114422154 0014146 0 ustar 00 # SpamAssassin translations: Franaise # # Written by Michel Bouissou for SpamAssassin 2.60 # Latest revision: 2003/11/14 # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # @LICENSE> # ########################################################################### # ...................................................................... lang fr clear-report-template lang fr report ------------------ Dbut de Rapport SpamAssassin --------------------- lang fr report Ce message est probablement du SPAM (message non sollicit envoy en lang fr report masse, publicit, escroquerie...). lang fr report lang fr report Cette notice a t ajoute par le systme d'analyse "SpamAssassin" sur lang fr report votre serveur de courrier "_HOSTNAME_", pour vous lang fr report aider identifier ce type de messages. lang fr report lang fr report Le systme SpamAssassin ajoute un en-tte "X-Spam-Flag: YES" aux lang fr report messages qu'il considre comme tant probablement du Spam. lang fr report Vous pouvez si vous le souhaitez utiliser cette caractristique lang fr report pour rgler un filtre dans votre logiciel de lecture de courrier, lang fr report afin de dtruire ou de classer part ce type de message. lang fr report lang fr report Si ce robot a classifi incorrectement un message qui vous tait lang fr report destin, ou pour toute question, veuillez contacter l'administrateur lang fr report du systme par e-mail _CONTACTADDRESS_ . lang fr report lang fr report Voir https://spamassassin.apache.org/tag/ pour plus de dtails (en anglais). lang fr report lang fr report Dtails de l'analyse du message: (_SCORE_ points, _REQD_ requis) lang fr report _SUMMARY_ lang fr report -------------------- Fin de Rapport SpamAssassin --------------------- # ...................................................................... # Vous devriez changer "report_contact" dans le fichier 10_misc.cf. # _CONTACTADDRESS_ est remplace par ce texte. # ...................................................................... # ...................................................................... lang fr clear-unsafe-report-template lang fr unsafe-report Le message original n'tant pas au format text brut, il est peut-tre lang fr unsafe-report dangereux de l'ouvrir avec votre logiciel e-mail ; en particulier il lang fr unsafe-report pourrait contenir un virus, ou confirmer l'expditeur que votre lang fr unsafe-report adresse e-mail est active, et peut recevoir du spam. Si vous voulez lang fr unsafe-report lire ce message, et n'tes pas certain de la scurit de votre logiciel lang fr unsafe-report e-mail, il est plus prudent d'enregistrer ce message sur votre disque lang fr unsafe-report dur, et de l'afficher ensuite avec un diteur de texte. # ...................................................................... ############# # 23_bayes.cf ifplugin Mail::SpamAssassin::Plugin::Bayes lang fr describe BAYES_00 L'algorithme Baysien a valu la probabilit de spam entre 0 et 1% lang fr describe BAYES_05 L'algorithme Baysien a valu la probabilit de spam entre 1 et 5% lang fr describe BAYES_20 L'algorithme Baysien a valu la probabilit de spam entre 5 et 20% lang fr describe BAYES_40 L'algorithme Baysien a valu la probabilit de spam entre 20 et 40% lang fr describe BAYES_50 L'algorithme Baysien a valu la probabilit de spam entre 40 et 60% lang fr describe BAYES_60 L'algorithme Baysien a valu la probabilit de spam entre 60 et 80% lang fr describe BAYES_80 L'algorithme Baysien a valu la probabilit de spam entre 80 et 95% lang fr describe BAYES_95 L'algorithme Baysien a valu la probabilit de spam entre 95 et 99% lang fr describe BAYES_99 L'algorithme Baysien a valu la probabilit de spam entre 99 et 100% lang fr describe BAYES_999 L'algorithme Baysien a valu la probabilit de spam entre 99.9 et 100% endif lang fr describe ACT_NOW_CAPS Demande d'agir immdiatement (en majuscules) lang fr describe BAD_CREDIT Contient "Eliminate Bad Credit" lang fr describe BANG_GUAR Quelque chose est "garanti" de manire emphatique lang fr describe BANG_OPRAH Parle d'Oprah avec point d'exclamation ! lang fr describe BILLION_DOLLARS Evoque des millions ou milliards de dollars lang fr describe BLANK_LINES_80_90 Le corps du message a 80 90% de lignes vides lang fr describe CHARSET_FARAWAY Message utilisant un jeu de caractres exotique lang fr describe CHARSET_FARAWAY_HEADER En-tte utilisant un jeu de caractres exotique lang fr describe CONFIRMED_FORGED Les en-ttes "Received:" ont t falsifis lang fr describe CUM_SHOT Pornographie probable, "gros plans d'jaculations" lang fr describe DATE_IN_PAST_03_06 Date: est 3 6 heures avant la date de l'en-tte Received: lang fr describe DATE_IN_PAST_06_12 Date: est 6 12 heures avant la date de l'en-tte Received: lang fr describe DATE_IN_PAST_12_24 Date: est 12 24 heures avant la date de l'en-tte Received: lang fr describe DATE_IN_PAST_24_48 Date: est 24 48 heures avant la date de l'en-tte Received: lang fr describe DATE_IN_PAST_96_XX Date: est plus de 96 heures avant la date de l'en-tte Received: lang fr describe DATE_IN_FUTURE_03_06 Date: est 3 6 heures aprs la date de l'en-tte Received: lang fr describe DATE_IN_FUTURE_06_12 Date: est 6 12 heures aprs la date de l'en-tte Received: lang fr describe DATE_IN_FUTURE_12_24 Date: est 12 24 heures aprs la date de l'en-tte Received: lang fr describe DATE_IN_FUTURE_24_48 Date: est 24 48 heures aprs la date de l'en-tte Received: lang fr describe DATE_IN_FUTURE_48_96 Date: est 48 96 heures aprs la date de l'en-tte Received: lang fr describe DATE_IN_FUTURE_96_XX Date: est plus de 96 heures aprs la date de l'en-tte Received: lang fr describe MISSING_DATE En-tte "Date:" absent lang fr describe DATE_SPAMWARE_Y2K L'en-tte date utilise un format Y2K inhabituel lang fr describe DEAR_FRIEND Contient la formule "Dear friend" lang fr describe DEAR_SOMETHING Le message contient "Dear... (quelqu'un)" lang fr describe DIET_1 Spam proposant une perte de poids lang fr describe EMAIL_ROT13 Corps contient une adresse mail encode en ROT13 lang fr describe EXCUSE_REMOVE Explique comment tre retir des listes de mailing (soi-disant...) lang fr describe EXCUSE_4 Prtend que vous pouvez vous faire supprimer de leur liste lang fr describe EXCUSE_24 Prtend que vous avez demand recevoir cette publicit lang fr describe FIN_FREE Parle de "libert financire" (Financial Freedom) lang fr describe FORGED_HOTMAIL_RCVD2 From hotmail.com, mais sans "Received:" lang fr describe FORGED_IMS_HTML IMS n'envoie pas de messages en HTML seul lang fr describe FORGED_IMS_TAGS IMS n'envoie pas de HTML dans ce format lang fr describe FORGED_MUA_EUDORA Message falsifi prtendant provenir du logiciel Eudora lang fr describe FORGED_MUA_IMS Message falsifi prtendant provenir du logiciel IMS lang fr describe FORGED_MUA_MOZILLA Message falsifi prtendant provenir du logiciel Mozilla lang fr describe FORGED_MUA_OIMO Message falsifi prtendant provenir du logiciel MS Outlook IMO lang fr describe FORGED_MUA_OUTLOOK Message falsifi prtendant provenir du logiciel MS Outlook lang fr describe FORGED_MUA_THEBAT_BOUN Mail prtendant provenir de The Bat! (boundary) lang fr describe FORGED_MUA_THEBAT_CS Mail pretendant provenir de The Bat! (charset) lang fr describe FORGED_OUTLOOK_HTML Outlook n'envoie pas de messages en HTML seul lang fr describe FORGED_OUTLOOK_TAGS Outlook n'envoie pas de HTML sous ce format lang fr describe FORGED_QUALCOMM_TAGS QUALCOMM mailers n'envoient pas de HTML sous ce format lang fr describe FORGED_TELESP_RCVD Contient un nom de machine falsifi chez un F.A.I. brsilien lang fr describe FORGED_THEBAT_HTML The Bat! n'envoie pas de messages en HTML seul lang fr describe FORGED_YAHOO_RCVD Contient un en-tte falsifi Received: yahoo.com lang fr describe FORWARD_LOOKING Contient un "Stock Disclaimer Statement" (bourse) lang fr describe FREE_PORN Pornographie probable "Free porn" lang fr describe FREE_QUOTE_INSTANT Contient formule type "Free express" ou "no obligation" lang fr describe FROM_ILLEGAL_CHARS From: contient trop de caractres bruts invalides lang fr describe FROM_NO_USER L'en-tte From: n'a pas de nom d'utilisateur avant le signe @ lang fr describe FROM_OFFERS L'adresse d'expditeur est "at something-offers" lang fr describe FROM_STARTS_WITH_NUMS L'en-tte From: commence par des chiffres lang fr describe GAPPY_SUBJECT L'en-tte Subject: contient du "t e x t e e s p a c " lang fr describe GTUBE Test gnrique de courrier non sollict en masse lang fr describe GUARANTEED_100_PERCENT Contient "One hundred percent guaranteed" (100% garanti) lang fr describe HEAD_ILLEGAL_CHARS En-tte contient trop de caractres bruts invalides lang fr describe HEADER_COUNT_CTYPE Plusieurs en-ttes Content-Type lang fr describe HIDE_WIN_STATUS Javascript destin camoufler une URL dans le navigateur lang fr describe HTML_CHARSET_FARAWAY Jeu de caractres exotique utilis pour le HTML lang fr describe HTML_COMMENT_SAVED_URL Le message HTML est une page web sauvegarde lang fr describe HTML_EMBEDS HTML: Inclusion d'objets lang fr describe HTML_FONT_FACE_BAD Le nom de la police HTML n'est pas un mot lang fr describe HTML_FONT_LOW_CONTRAST Police HTML de la mme couleur que le fond lang fr describe HTML_FORMACTION_MAILTO HTML inclut un formulaire d'envoi de mail lang fr describe HTML_IMAGE_ONLY_04 HTML contient images avec 200 400 octets de texte lang fr describe HTML_IMAGE_ONLY_08 HTML contient images avec 600 800 octets de texte lang fr describe HTML_IMAGE_ONLY_12 HTML contient images avec 1000 1200 octets de texte lang fr describe HTML_IMAGE_RATIO_02 HTML Faible ratio de texte par rapport aux images lang fr describe HTML_IMAGE_RATIO_04 HTML Faible ratio de texte par rapport aux images lang fr describe HTML_IMAGE_RATIO_06 HTML Faible ratio de texte par rapport aux images lang fr describe HTML_IMAGE_RATIO_08 HTML Faible ratio de texte par rapport aux images lang fr describe HTML_MESSAGE HTML inclus dans le message lang fr describe HTML_MIME_NO_HTML_TAG Message en HTML seul, mais sans tags HTML lang fr describe HTML_TAG_BALANCE_BODY Le tag de fermeture de "body" HTML est manquant lang fr describe HTML_TAG_BALANCE_HEAD Le tag de fermeture de "head" HTML est manquant lang fr describe HTTP_ESCAPED_HOST URI: Contient des %-escapes dans le nom de machine lang fr describe HTTP_EXCESSIVE_ESCAPES URI: Contient des %-escapes nombreux et superflus lang fr describe IMPOTENCE Prtend permettre de combattre l'impuissance lang fr describe MORE_SEX Parle d'augmenter le dsir sexuel lang fr describe INVALID_DATE L'en-tte Date: est incorrect (il contient AM/PM) lang fr describe INVALID_DATE_TZ_ABSURD L'en-tte Date: est incorrect (la zone de temps n'existe pas) lang fr describe INVALID_MSGID Le Message-ID est invalide, selon la RFC-2822 lang fr describe IP_LINK_PLUS Adresse IP en dcimal suivie d'un CGI lang fr describe JAPANESE_UCE_SUBJECT Sujet contient une marque japonaise de spam lang fr describe JOIN_MILLIONS Contient "Join Millions of Americans" lang fr describe KOREAN_UCE_SUBJECT Le sujet contient des caractres corens lang fr describe LIVE_PORN Pornographie probable: porno en direct-live lang fr describe SUBJECT_DIET Le sujet parle de perte de poids lang fr describe LOW_PRICE Contient "Lowest Price" (le prix le plus bas) lang fr describe MARKETING_PARTNERS Prtend que vous vous tes enregistr auprs d'un "partenaire" quelconque #lang fr describe MILLION_USD Phrase cl d'escroquerie nigrienne (millions of dollars) lang fr describe __MIME_BASE64 Inclut un attachement en BASE64 #lang fr describe MIME_BASE64_BLANKS Ligne blanches surnumraires dans l'encodage BASE64 lang fr describe MIME_BASE64_TEXT Texte du message camoufl par encodage en BASE64 lang fr describe MIME_BOUND_MANY_HEX Motif caractristique d'outil de spam dans les dlimiteurs MIME lang fr describe MIME_CHARSET_FARAWAY Jeu de caractres MIME exotique lang fr describe MIME_HEADER_CTYPE_ONLY En-tte "Content-Type" prsent sans les en-ttes MIME requis lang fr describe MIME_HTML_MOSTLY Message multipart principalement en MIME text/html lang fr describe MIME_HTML_ONLY Le message possde uniquement des parties MIME text/html lang fr describe MIME_HTML_ONLY_MULTI Message multipart uniquement en MIME text/html lang fr describe __MIME_QP Contient en attachement en quoted-printable lang fr describe MIME_QP_LONG_LINE Ligne quoted-printable de plus de 76 caractres lang fr describe MISSING_HEADERS Le message ne comporte pas l'en-tte To: lang fr describe MISSING_MIMEOLE Possde un en-tte X-MSMail-Priority, mais pas de X-MimeOLE lang fr describe MONEY_BACK Vous garantit un "remboursement si insatisfait" (en anglais) lang fr describe MSGID_FROM_MTA_HEADER Message-ID ajout par un relais lang fr describe MSGID_OUTLOOK_INVALID Message-ID falsifi (fortmat Outlook Express) lang fr describe MULTI_FORGED les en-ttes "Received" montrent de nombreuses falsifications #lang fr describe NA_DOLLARS Parle d'un million de dollars "nord-amricains" lang fr describe NONEXISTENT_CHARSET Message rdig dans un jeu de caractres inexistant lang fr describe NOT_ADVISOR Contient "Not registered investment advisor" lang fr describe NO_DNS_FOR_FROM Adresse From: inconnue en DNS (pas d'enregistrement MX) lang fr describe NO_MEDICAL Contient "No Medical Exams" (sans examen mdical) lang fr describe NO_RDNS_DOTCOM_HELO HELO de F.A.I. important, mais pas de rDNS lang fr describe NUMERIC_HTTP_ADDR Utilise une adresse IP, sans points, dans une URL lang fr describe OBFUSCATING_COMMENT Commentaires HTML inutiles destins camoufler le texte lang fr describe OBSCURED_EMAIL Le message semble contenir une adresse mail camoufle par rot13 lang fr describe ONLINE_PHARMACY Produits pharmaceutiques en ligne lang fr describe BODY_ENHANCEMENT Arnaque prtendant augmenter la taile de votre pnis lang fr describe BODY_ENHANCEMENT2 Arnaque prtendant augmenter la taile de votre pnis lang fr describe PLING_QUERY Le sujet a un point d'interrogation ET un point d'exclamation lang fr describe PREST_NON_ACCREDITED Fait rfrence a une "prestigieuse universit" non reconnue lang fr describe RATWARE_EGROUPS Trace de logiciel de mailing en masse (eGroups) dans les en-ttes lang fr describe RATWARE_HASH_DASH Contient un "hashbuster" au format Send-Safe lang fr describe RATWARE_OE_MALFORMED En-tte X-Mailer indique No de version Outlook Express malform lang fr describe RCVD_AM_PM En-tte Received: falsifi (AM/PM) lang fr describe RCVD_FAKE_HELO_DOTCOM En-tte Received contient nom d'hte falsifi dans le HELO lang fr describe RCVD_IN_BL_SPAMCOP_NET Relais list dans http://spamcop.net/bl.shtml lang fr describe RCVD_IN_MAPS_DUL Relais list dans DUL, http://www.mail-abuse.org/dul/ lang fr describe RCVD_IN_MAPS_NML Relais list dans NML, http://www.mail-abuse.org/nml/ lang fr describe RCVD_IN_MAPS_RBL Relais list dans RBL, http://www.mail-abuse.org/rbl/ lang fr describe RCVD_IN_MAPS_RSS Relais list dans RSS, http://www.mail-abuse.org/rss/ lang fr describe RCVD_IN_SBL Relais list dans https://www.spamhaus.org/sbl/ lang fr describe REFINANCE_NOW Offre de refinancement immobilier lang fr describe REFINANCE_YOUR_HOME Offre de refinancement immobilier lang fr describe SORTED_RECIPS La liste des destinataires est trie par ordre alphabtique lang fr describe STOCK_ALERT Contient la formule "stock alert" lang fr describe STRONG_BUY Contient la formule "strong buy" lang fr describe SUBJ_ALL_CAPS Le sujet est en majuscules lang fr describe SUBJ_AS_SEEN Le sujet contient "As Seen" (gnralement "vu la tl"...) lang fr describe SUBJ_BUY Le sujet commence par "Buy, Buying" (achetez, achat) lang fr describe SUBJ_DOLLARS Le sujet commence par une somme en dollars lang fr describe SUBJ_ILLEGAL_CHARS Subject: contient trop de caractres bruts invalides #lang fr describe SUBJ_YOUR_DEBT Le sujet contient "Your Bills" (vos factures) ou similaire lang fr describe SUBJ_YOUR_FAMILY Le sujet contient "Your Family" (votre famille) lang fr describe SUSPICIOUS_RECIPS L'en-tte To: contient plus de dix fois le mme nom de domaine lang fr describe TO_MALFORMED L'en-tte To: contient une adresse mal forme lang fr describe TRACKER_ID Contient un numro permettant de vous identifier lang fr describe UNCLAIMED_MONEY Argent non rclam: Chacun sait que c'est courant ;-) lang fr describe UPPERCASE_50_75 Message compos de 50 75% de majuscules lang fr describe UPPERCASE_75_100 Message compos de 75 100% de majuscules lang fr describe URG_BIZ Contient la formule "urgent business" lang fr describe USER_IN_ALL_SPAM_TO Destinataire sur la liste "all_spam_to" (config SA locale) lang fr describe USER_IN_BLOCKLIST Expditeur sur la liste noire (config SA locale) lang fr describe USER_IN_BLOCKLIST_TO Destinataire sur la liste "blocklist_to" (config SA locale) lang fr describe USER_IN_DEF_WELCOMELIST Expditeur dans la liste OK par dfaut de SpamAssassin lang fr describe USER_IN_MORE_SPAM_TO Destinataire sur la liste "more_spam_to" (config SA locale) lang fr describe USER_IN_WELCOMELIST Expditeur sur la liste blanche (OK) (config SA locale) lang fr describe USER_IN_WELCOMELIST_TO Destinataire sur la liste blanche (config SA) #lang fr describe US_DOLLARS_3 Escroq. nigrienne, version modifie, phrase cl ($NN,NNN,NNN.NN) lang fr describe DRUG_ED_ONLINE Vente de Viagra par correspondance lang fr describe WEIRD_PORT Lien HTTP vers un numro de port non standard lang fr describe WEIRD_QUOTING Utilisation trange de symboles de citations lang fr describe WITH_LC_SMTP Une ligne Received: contient un signe de spam ("smtp" en minuscules) ifplugin Mail::SpamAssassin::Plugin::AntiVirus lang fr describe MIME_SUSPECT_NAME Le nom du fichier joint MIME semble suspect (virus ?) endif ifplugin Mail::SpamAssassin::Plugin::DCC lang fr describe DCC_CHECK Message list par DCC: http://www.www.dcc-servers.net/dcc/ endif ifplugin Mail::SpamAssassin::Plugin::Pyzor lang fr describe PYZOR_CHECK Message list par Pyzor, voir https://pyzor.readthedocs.io/en/latest/ endif ifplugin Mail::SpamAssassin::Plugin::TextCat lang fr describe BODY_8BITS Contient plusieurs caractres 8-bits conscutifs lang fr describe UNWANTED_LANGUAGE_BODY Message dans une langue non dsire (config locale) endif ifplugin Mail::SpamAssassin::Plugin::AccessDB lang fr describe ACCESSDB Ce message aurait t bloqu par accessdb endif lang fr describe NORMAL_HTTP_TO_IP URI: Contient une adresse IP en notation dcimale updates_spamassassin_org/20_freemail_mailcom_domains.cf 0000644 00000010504 15114422154 0017456 0 ustar 00 # SpamAssassin - Mail.com Freemail domains file # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # @LICENSE> # ########################################################################### # List contains commonly abused end user mail providers # "freemail" is solely used for label purposes. # This dedicated list contains domains provided by mail.com # Updated 2014-09-17-axb ifplugin Mail::SpamAssassin::Plugin::FreeMail freemail_domains accountant.com acdcfan.com activist.com adexec.com africamail.com aircraftmail.com allergist.com alumni.com alumnidirector.com angelic.com appraiser.net archaeologist.com arcticmail.com artlover.com asia-mail.com asia.com atheist.com auctioneer.net australiamail.com freemail_domains bartender.net bellair.net berlin.com bikerider.com birdlover.com blader.com boardermail.com brazilmail.com brew-master.com brew-meister.com bsdmail.com freemail_domains californiamail.com cash4u.com catlover.com cheerful.com chef.net chemist.com chinamail.com clerk.com clubmember.org collector.org columnist.com comic.com computer4u.com consultant.com contractor.net coolsite.net counsellor.com cutey.com cyber-wizard.com cyberdude.com cybergal.com cyberservices.com freemail_domains dallasmail.com dbzmail.com deliveryman.com diplomats.com disciples.com discofan.com disposable.com doctor.com doglover.com doramail.com dr.com dublin.com dutchmail.com freemail_domains elvisfan.com email.com engineer.com englandmail.com europe.com europemail.com execs.com freemail_domains fastservice.com financier.com fireman.net freemail_domains galaxyhit.com gardener.com geologist.com germanymail.com graduate.org graphic-designer.com greenmail.net groupmail.com freemail_domains hackermail.com hairdresser.net hilarious.com hiphopfan.com homemail.com hot-shot.com housemail.com humanoid.net freemail_domains iname.acom iname.com innocent.com inorbit.com instruction.com instructor.net insurer.com irelandmail.com israelmail.com italymail.com freemail_domains job4u.com journalist.com freemail_domains keromail.com kissfans.com kittymail.com koreamail.com freemail_domains legislator.com linuxmail.org lobbyist.com lovecat.com freemail_domains madonnafan.com mail-me.com mail.com marchmail.com metalfan.com mexicomail.com minister.com moscowmail.com munich.com musician.org muslim.com myself.com freemail_domains net-shopping.com ninfan.com nonpartisan.com null.net nycmail.com freemail_domains oath.com optician.com orthodontist.net freemail_domains pacific-ocean.com pacificwest.com pediatrician.com petlover.com photographer.net physicist.net planetmail.com planetmail.net polandmail.com politician.com post.com presidency.com priest.com programmer.net protestant.com publicist.com freemail_domains qualityservice.com freemail_domains radiologist.net ravemail.com realtyagent.com reborn.com reggaefan.com registerednurses.com reincarnate.com religious.com repairman.com representative.com rescueteam.com rocketship.com freemail_domains safrica.com saintly.com salesperson.net samerica.com sanfranmail.com scientist.com scotlandmail.com secretary.net snakebite.com socialworker.net sociologist.com solution4u.com songwriter.net spainmail.com surgical.net swedenmail.com swissmail.com freemail_domains teachers.org tech-center.com techie.com technologist.com theplate.com therapist.net toke.com toothfairy.com torontomail.com tvstar.com freemail_domains umpire.com usa.com uymail.com freemail_domains webname.com worker.com workmail.com writeme.com endif updates_spamassassin_org/25_url_shortener.cf 0000644 00000026047 15114422154 0015370 0 ustar 00 # SpamAssassin - URL shortener rules # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # @LICENSE> # ########################################################################### ### ### Note that this file contains two separate lists, url_shortener and a ### backup regex generated from it. Both must updated and kept in sync. ### ### __URL_SHORTENER will always by set by either the plugin or regex ### # SpamAssassin 4.0 version required if can(Mail::SpamAssassin::Plugin::DecodeShortURLs::has_short_url_redir) body __URL_SHORTENER eval:short_url() body URL_SHORTENER_CHAINED eval:short_url_chained() describe URL_SHORTENER_CHAINED Message contains shortened URL chained to other shorteners tflags URL_SHORTENER_CHAINED net score URL_SHORTENER_CHAINED 0.01 uri URL_SHORTENER_DISABLED m,^https://(?:bitly\.com/a/blocked|tinyurl\.com/app/nospam), describe URL_SHORTENER_DISABLED Message contains shortened URL that has been disabled due to abuse tflags URL_SHORTENER_DISABLED net score URL_SHORTENER_DISABLED 2 # # Please only add entries that you manually verified as actual working # redirectors that can have abusable custom URLs. Adding non-abusable # services only generates unnecessary HTTP requests. # # After any changes, also update __URL_SHORTENER regex at end of file. # # generic list of likely active services - cleaned up 25.05.2022 url_shortener .ftn.app url_shortener .page.link url_shortener .short.gy url_shortener .shortz.me url_shortener 0rz.tw url_shortener 4sq.com url_shortener 4url.cc url_shortener afly.co url_shortener ai6.net url_shortener amzn.com url_shortener amzn.to url_shortener b.link url_shortener b23.ru url_shortener binged.it url_shortener bit.do url_shortener bit.ly url_shortener bitly.com url_shortener bizj.us url_shortener chilp.it url_shortener conta.cc url_shortener clck.ru url_shortener cli.re url_shortener crks.me url_shortener cutt.ly url_shortener cutwin.biz url_shortener dai.ly url_shortener db.tt url_shortener disq.us url_shortener dlvr.it url_shortener doi.org url_shortener doiop.com url_shortener eepurl.com url_shortener fb.me url_shortener fire.to url_shortener firsturl.de url_shortener firsturl.net url_shortener flic.kr url_shortener gdurl.com url_shortener go.ly url_shortener goo.gl url_shortener goolnk.com url_shortener gplinks.in url_shortener guest.link url_shortener gtly.link url_shortener gtly.net url_shortener hellotxt.com url_shortener hop.kz url_shortener hotshorturl.com url_shortener hub.am url_shortener huff.to url_shortener hurl.it url_shortener hyperurl.co url_shortener inx.lv url_shortener is.gd url_shortener it2.in url_shortener j.mp url_shortener kore.us url_shortener kurl.no url_shortener l.bestsellers.to url_shortener linkloom.link url_shortener lnk.sk url_shortener lnkd.in url_shortener lnkiy.in url_shortener lru.jp url_shortener mrte.ch url_shortener n9.cl url_shortener ndurl.com url_shortener onion.com url_shortener ouo.io url_shortener ow.ly url_shortener owl.li url_shortener qrcd.org url_shortener pduda.mobi url_shortener rb.gy url_shortener redir.ec url_shortener rotf.lol url_shortener s.apache.org url_shortener s.free.fr url_shortener s.id url_shortener shar.es url_shortener shorl.com url_shortener shortn.me url_shortener shorturl.at url_shortener shrink.in url_shortener simurl.net url_shortener slidesha.re url_shortener smarturl.it url_shortener smfu.in url_shortener smollq.cc url_shortener snip.ly url_shortener snkr.me url_shortener sprl.in url_shortener stpmvt.com url_shortener t.co url_shortener t.ly url_shortener tcrn.ch url_shortener tgr.ph url_shortener tiny.cc url_shortener tiny.one url_shortener tiny.pl url_shortener tinylink.in url_shortener tinyurl.com url_shortener to.ly url_shortener trib.al url_shortener twixar.me url_shortener u.nu url_shortener u.to url_shortener url.ie url_shortener urlcut.com url_shortener urlday.cc url_shortener urls.im url_shortener urlz.at url_shortener urlzs.com url_shortener utfg.sk url_shortener v.gd url_shortener wow.link url_shortener wp.me url_shortener x.co url_shortener x.hypem.com url_shortener xurl.es url_shortener yhoo.it url_shortener youtu.be url_shortener z23.ru url_shortener zurl.ws # www.shrunken.com - list validated 25.05.2022 url_shortener www.shrunken.com url_shortener 0.gp url_shortener 2.gp url_shortener 2.ly url_shortener 3.ly url_shortener 4.gp url_shortener 4.ly url_shortener 5.gp url_shortener 6.gp url_shortener 6.ly url_shortener 7.ly url_shortener 8.ly url_shortener 9.ly url_shortener g.asia url_shortener p.asia url_shortener ur3.us # shorturl.com - list validated 25.05.2022 url_shortener alturl.com url_shortener .1sta.com url_shortener .24ex.com url_shortener .2fear.com url_shortener .2fortune.com url_shortener .2freedom.com url_shortener .2hell.com url_shortener .2savvy.com url_shortener .2truth.com url_shortener .2tunes.com url_shortener .2ya.com url_shortener .alturl.com url_shortener .antiblog.com url_shortener .bigbig.com url_shortener .dealtap.com url_shortener .ebored.com url_shortener .echoz.com url_shortener .filetap.com url_shortener .funurl.com url_shortener .headplug.com url_shortener .hereweb.com url_shortener .hitart.com url_shortener .mirrorz.com url_shortener .mp3update.com url_shortener .shorturl.com url_shortener .spyw.com url_shortener .vze.com # iscool.net - list validated 25.05.2022 url_shortener .arecool.net url_shortener .iscool.net url_shortener .isfun.net url_shortener .tux.nu # kisa.link - list validated 25.05.2022 url_shortener kisa.link url_shortener www.kisa.link url_shortener bul.tc url_shortener cy.tc url_shortener fn.tc url_shortener ftp.tc url_shortener gr.tc url_shortener hbr.tc url_shortener heg.tc url_shortener ins.tc url_shortener ko.tc url_shortener kod.tc url_shortener lol.tc url_shortener m2.tc url_shortener ml.tc url_shortener mmo.tc url_shortener oy.tc url_shortener pc.tc url_shortener pubg.tc url_shortener pvp.tc url_shortener scanqris.me url_shortener sro.tc url_shortener tek.link url_shortener tw.tc # grabify.link - list validated 25.05.2022 url_shortener grabify.link url_shortener catsnthing.com url_shortener catsnthings.fun url_shortener cheapcinema.club url_shortener dateing.club url_shortener fortnight.space url_shortener fortnitechat.site url_shortener freegiftcards.co url_shortener gaming-at-my.best url_shortener gamingfun.me url_shortener headshot.monster url_shortener imageshare.best url_shortener joinmy.site url_shortener leancoding.co url_shortener ln.run url_shortener locations.quest url_shortener lovebird.guru url_shortener myprivate.pics url_shortener noodshare.pics url_shortener partpicker.shop url_shortener progaming.monster url_shortener screenshare.pics url_shortener screenshot.best url_shortener shhh.lol url_shortener shrekis.life url_shortener sportshub.bar url_shortener stopify.co url_shortener trulove.guru url_shortener yourmy.monster # additional url shorteners 2023 url_shortener .app.link url_shortener bitly.ws url_shortener han.gl url_shortener lukora.cz url_shortener shorturl.asia url_shortener m2.do url_shortener rebrand.ly # GET method required for some services, keep the same services in url_shortener also if can(Mail::SpamAssassin::Plugin::DecodeShortURLs::has_get) url_shortener_get bit.ly endif endif # has_short_url_redir ### ### Use a regex if DecodeShortURLs plugin is not loaded ### if !can(Mail::SpamAssassin::Plugin::DecodeShortURLs::has_short_url_redir) ## Generate __URL_SHORTENER with this command, to keep it in sync with url_shortener list: ## ## perl -pe 'while (<>) {/^\s*url_shortener\s+(\S+)/ or next;$s=quotemeta($1);$s=~s/^\\./\\w+\\./;push @a,$s} print "uri __URL_SHORTENER m,^https?://(?:".join("|",@a).")/,i\n"' < 25_url_shortener.cf ## uri __URL_SHORTENER m,^https?://(?:\w+\.ftn\.app|\w+\.page\.link|\w+\.short\.gy|\w+\.shortz\.me|0rz\.tw|4sq\.com|4url\.cc|afly\.co|ai6\.net|amzn\.com|amzn\.to|b\.link|b23\.ru|binged\.it|bit\.do|bit\.ly|bitly\.com|bizj\.us|chilp\.it|conta\.cc|clck\.ru|cli\.re|crks\.me|cutt\.ly|cutwin\.biz|dai\.ly|db\.tt|disq\.us|dlvr\.it|doi\.org|doiop\.com|eepurl\.com|fb\.me|fire\.to|firsturl\.de|firsturl\.net|flic\.kr|gdurl\.com|go\.ly|goo\.gl|goolnk\.com|gplinks\.in|guest\.link|gtly\.link|gtly\.net|hellotxt\.com|hop\.kz|hotshorturl\.com|hub\.am|huff\.to|hurl\.it|hyperurl\.co|inx\.lv|is\.gd|it2\.in|j\.mp|kore\.us|kurl\.no|l\.bestsellers\.to|linkloom\.link|lnk\.sk|lnkd\.in|lnkiy\.in|lru\.jp|mrte\.ch|n9\.cl|ndurl\.com|onion\.com|ouo\.io|ow\.ly|owl\.li|qrcd\.org|pduda\.mobi|rb\.gy|redir\.ec|rotf\.lol|s\.apache\.org|s\.free\.fr|s\.id|shar\.es|shorl\.com|shortn\.me|shorturl\.at|shrink\.in|simurl\.net|slidesha\.re|smarturl\.it|smfu\.in|smollq\.cc|snip\.ly|snkr\.me|sprl\.in|stpmvt\.com|t\.co|t\.ly|tcrn\.ch|tgr\.ph|tiny\.cc|tiny\.one|tiny\.pl|tinylink\.in|tinyurl\.com|to\.ly|trib\.al|twixar\.me|u\.nu|u\.to|url\.ie|urlcut\.com|urlday\.cc|urls\.im|urlz\.at|urlzs\.com|utfg\.sk|v\.gd|wow\.link|wp\.me|x\.co|x\.hypem\.com|xurl\.es|yhoo\.it|youtu\.be|z23\.ru|zurl\.ws|www\.shrunken\.com|0\.gp|2\.gp|2\.ly|3\.ly|4\.gp|4\.ly|5\.gp|6\.gp|6\.ly|7\.ly|8\.ly|9\.ly|g\.asia|p\.asia|ur3\.us|alturl\.com|\w+\.1sta\.com|\w+\.24ex\.com|\w+\.2fear\.com|\w+\.2fortune\.com|\w+\.2freedom\.com|\w+\.2hell\.com|\w+\.2savvy\.com|\w+\.2truth\.com|\w+\.2tunes\.com|\w+\.2ya\.com|\w+\.alturl\.com|\w+\.antiblog\.com|\w+\.bigbig\.com|\w+\.dealtap\.com|\w+\.ebored\.com|\w+\.echoz\.com|\w+\.filetap\.com|\w+\.funurl\.com|\w+\.headplug\.com|\w+\.hereweb\.com|\w+\.hitart\.com|\w+\.mirrorz\.com|\w+\.mp3update\.com|\w+\.shorturl\.com|\w+\.spyw\.com|\w+\.vze\.com|\w+\.arecool\.net|\w+\.iscool\.net|\w+\.isfun\.net|\w+\.tux\.nu|kisa\.link|www\.kisa\.link|bul\.tc|cy\.tc|fn\.tc|ftp\.tc|gr\.tc|hbr\.tc|heg\.tc|ins\.tc|ko\.tc|kod\.tc|lol\.tc|m2\.tc|ml\.tc|mmo\.tc|oy\.tc|pc\.tc|pubg\.tc|pvp\.tc|scanqris\.me|sro\.tc|tek\.link|tw\.tc|grabify\.link|catsnthing\.com|catsnthings\.fun|cheapcinema\.club|dateing\.club|fortnight\.space|fortnitechat\.site|freegiftcards\.co|gaming\-at\-my\.best|gamingfun\.me|headshot\.monster|imageshare\.best|joinmy\.site|leancoding\.co|ln\.run|locations\.quest|lovebird\.guru|myprivate\.pics|noodshare\.pics|partpicker\.shop|progaming\.monster|screenshare\.pics|screenshot\.best|shhh\.lol|shrekis\.life|sportshub\.bar|stopify\.co|trulove\.guru|yourmy\.monster|\w+\.app\.link|bitly\.ws|han\.gl|lukora\.cz|shorturl\.asia|m2\.do|rebrand\.ly)/,i endif updates_spamassassin_org/20_net_tests.cf 0000644 00000003530 15114422154 0014470 0 ustar 00 # SpamAssassin rules file: network tests # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # Note: body tests are run with long lines, so be sure to limit the # size of searches; use /.{0,30}/ instead of /.*/ to avoid huge # search times. # # Note: If you are adding a rule which looks for a phrase in the body # (as most of them do), please add it to rules/20_phrases.cf instead. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # @LICENSE> # ########################################################################### require_version 4.000001 # bug 2220. nice results meta DIGEST_MULTIPLE RAZOR2_CHECK + DCC_CHECK + PYZOR_CHECK > 1 describe DIGEST_MULTIPLE Message hits more than one network digest check tflags DIGEST_MULTIPLE net reuse DIGEST_MULTIPLE ifplugin Mail::SpamAssassin::Plugin::DNSEval header NO_DNS_FOR_FROM eval:check_dns_sender() describe NO_DNS_FOR_FROM Envelope sender has no MX or A DNS records tflags NO_DNS_FOR_FROM net reuse NO_DNS_FOR_FROM endif updates_spamassassin_org/72_scores.cf 0000644 00000073636 15114422154 0014003 0 ustar 00 score ACCT_PHISHING_MANY 2.999 2.999 2.999 2.999 score AC_BR_BONANZA 0.001 0.001 0.001 0.001 score AC_DIV_BONANZA 0.001 0.001 0.001 0.001 score AC_FROM_MANY_DOTS 2.500 2.499 2.500 2.499 score AC_HTML_NONSENSE_TAGS 1.999 1.999 1.999 1.999 score AC_POST_EXTRAS 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS1 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS10 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS11 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS12 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS2 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS3 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS4 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS8 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS9 1.000 1.000 1.000 1.000 score ADMAIL 0.001 0.001 0.001 0.001 score ADMITS_SPAM 1.999 1.999 1.999 1.999 score ADULT_DATING_COMPANY 10.000 10.000 10.000 10.000 score ADVANCE_FEE_2_NEW_FORM 1.999 1.999 1.999 1.999 score ADVANCE_FEE_2_NEW_FRM_MNY 1.000 1.000 1.000 1.000 score ADVANCE_FEE_2_NEW_MONEY 1.999 1.999 1.999 1.999 score ADVANCE_FEE_3_NEW 3.499 3.499 3.499 3.499 score ADVANCE_FEE_3_NEW_FRM_MNY 2.400 2.300 2.400 2.300 score ADVANCE_FEE_3_NEW_MONEY 2.699 2.500 2.699 2.500 score ADVANCE_FEE_4_NEW 2.199 2.299 2.199 2.299 score ADVANCE_FEE_4_NEW_FRM_MNY 2.374 1.830 2.374 1.830 score ADVANCE_FEE_4_NEW_MONEY 0.001 0.065 0.001 0.065 score ADVANCE_FEE_5_NEW 2.399 2.212 2.399 2.212 score ADVANCE_FEE_5_NEW_FRM_MNY 1.454 1.167 1.454 1.167 score ADVANCE_FEE_5_NEW_MONEY 1.733 3.099 1.733 3.099 score AD_PREFS 0.001 0.001 0.001 0.001 score ALIBABA_IMG_NOT_RCVD_ALI 1.000 1.000 1.000 1.000 score AMAZON_IMG_NOT_RCVD_AMZN 2.499 2.499 2.499 2.499 score APP_DEVELOPMENT_FREEM 1.000 1.000 1.000 1.000 score APP_DEVELOPMENT_NORDNS 1.000 1.000 1.000 1.000 score ARC_SIGNED 0.001 0.001 0.001 0.001 score ARC_VALID 0.001 0.001 0.001 0.001 score AXB_XMAILER_MIMEOLE_OL_024C2 0.001 3.094 0.001 3.094 score BEBEE_IMG_NOT_RCVD_BB 1.000 1.000 1.000 1.000 score BIGNUM_EMAILS_FREEM 2.999 2.123 2.999 2.123 score BIGNUM_EMAILS_MANY 1.763 2.127 1.763 2.127 score BITCOIN_BOMB 1.000 1.000 1.000 1.000 score BITCOIN_DEADLINE 1.000 1.000 1.000 1.000 score BITCOIN_EXTORT_01 3.571 1.286 3.571 1.286 score BITCOIN_EXTORT_02 1.000 1.000 1.000 1.000 score BITCOIN_IMGUR 1.000 1.000 1.000 1.000 score BITCOIN_MALWARE 1.000 1.000 1.000 1.000 score BITCOIN_OBFU_SUBJ 1.000 1.000 1.000 1.000 score BITCOIN_ONAN 1.000 1.000 1.000 1.000 score BITCOIN_PAY_ME 1.000 1.000 1.000 1.000 score BITCOIN_SPAM_01 1.000 1.000 1.000 1.000 score BITCOIN_SPAM_02 2.499 1.183 2.499 1.183 score BITCOIN_SPAM_03 2.499 2.500 2.499 2.500 score BITCOIN_SPAM_04 1.000 1.000 1.000 1.000 score BITCOIN_SPAM_05 0.001 1.000 0.001 1.000 score BITCOIN_SPAM_06 1.000 1.000 1.000 1.000 score BITCOIN_SPAM_07 1.965 2.641 1.965 2.641 score BITCOIN_SPAM_08 1.000 1.000 1.000 1.000 score BITCOIN_SPAM_09 1.499 0.556 1.499 0.556 score BITCOIN_SPAM_10 1.000 1.000 1.000 1.000 score BITCOIN_SPAM_11 1.000 1.000 1.000 1.000 score BITCOIN_SPAM_12 1.000 1.000 1.000 1.000 score BITCOIN_SPF_ONLYALL 0.001 1.000 0.001 1.000 score BITCOIN_TOEQFM 3.499 3.499 3.499 3.499 score BITCOIN_VISTA 2.728 1.589 2.728 1.589 score BITCOIN_XPRIO 0.932 1.451 0.932 1.451 score BITCOIN_YOUR_INFO 1.000 1.000 1.000 1.000 score BODY_SINGLE_WORD 0.001 0.101 0.001 0.101 score BODY_URI_ONLY 0.001 1.496 0.001 1.496 score BOGUS_MIME_VERSION 3.499 3.499 3.499 3.499 score BOGUS_MSM_HDRS 1.000 1.000 1.000 1.000 score BOMB_FREEM 1.000 1.000 1.000 1.000 score BOMB_MONEY 1.000 1.000 1.000 1.000 score BTC_ORG 1.000 1.000 1.000 1.000 score BULK_RE_SUSP_NTLD 1.000 1.000 1.000 1.000 score CANT_SEE_AD 1.495 0.639 1.495 0.639 score CN_PHISH_JP_01 2.999 2.234 2.999 2.234 score CN_PHISH_JP_02 2.499 0.001 2.499 0.001 score CN_PHISH_JP_03 1.000 1.000 1.000 1.000 score CN_PHISH_JP_04 2.499 2.499 2.499 2.499 score CN_PHISH_JP_06 2.499 1.639 2.499 1.639 score CN_PHISH_JP_07 1.000 1.000 1.000 1.000 score COMMENT_GIBBERISH 1.000 1.000 1.000 1.000 score CONTENT_AFTER_HTML 2.499 2.499 2.499 2.499 score CONTENT_AFTER_HTML_WEAK 1.499 1.499 1.499 1.499 score CTE_8BIT_MISMATCH 0.999 0.739 0.999 0.739 score DAY_I_EARNED 1.000 1.000 1.000 1.000 score DEAR_BENEFICIARY 1.841 1.974 1.841 1.974 score DEAR_EMAIL 1.499 1.499 1.499 1.499 score DKIMWL_BL 0.001 1.000 0.001 1.000 score DKIMWL_BLOCKED 0.001 0.001 0.001 0.001 score DKIMWL_WL_HIGH 0.001 -0.001 0.001 -0.001 score DKIMWL_WL_MED 0.001 -0.001 0.001 -0.001 score DKIMWL_WL_MEDHI 0.001 -1.000 0.001 -1.000 score DOS_BODY_HIGH_NO_MID 3.699 3.599 3.699 3.599 score DOTGOV_IMAGE 1.000 1.000 1.000 1.000 score DSN_NO_MIMEVERSION 1.999 1.999 1.999 1.999 score DYNAMIC_IMGUR 1.859 0.001 1.859 0.001 score EBAY_IMG_NOT_RCVD_EBAY 1.000 1.000 1.000 1.000 score ENCRYPTED_MESSAGE -0.999 -0.999 -0.999 -0.999 score END_FUTURE_EMAILS 1.999 1.999 1.999 1.999 score ENVFROM_GOOG_TRIX 1.000 1.000 1.000 1.000 score FACEBOOK_IMG_NOT_RCVD_FB 1.000 1.000 1.000 1.000 score FBI_MONEY 1.000 1.000 1.000 1.000 score FBI_SPOOF 1.000 1.000 1.000 1.000 score FILL_THIS_FORM 1.299 1.099 1.299 1.099 score FONT_INVIS_DIRECT 1.000 1.000 1.000 1.000 score FONT_INVIS_DOTGOV 1.000 1.000 1.000 1.000 score FONT_INVIS_HTML_NOHTML 1.000 1.000 1.000 1.000 score FONT_INVIS_LONG_LINE 1.580 1.947 1.580 1.947 score FONT_INVIS_MSGID 2.499 2.499 2.499 2.499 score FONT_INVIS_NORDNS 0.001 0.001 0.001 0.001 score FONT_INVIS_POSTEXTRAS 1.000 1.000 1.000 1.000 score FORM_FRAUD 0.999 0.999 0.999 0.999 score FORM_FRAUD_3 2.599 1.059 2.599 1.059 score FORM_FRAUD_5 0.001 2.310 0.001 2.310 score FOUND_YOU 1.000 1.000 1.000 1.000 score FREEMAIL_FORGED_FROMDOMAIN 0.249 0.001 0.249 0.001 score FREEM_FRNUM_UNICD_EMPTY 1.000 1.000 1.000 1.000 score FRNAME_IN_MSG_XPRIO_NO_SUB 1.000 1.000 1.000 1.000 score FROM_2_EMAILS_SHORT 1.186 2.999 1.186 2.999 score FROM_ADDR_WS 2.999 2.999 2.999 2.999 score FROM_BANK_NOAUTH 0.001 0.999 0.001 0.999 score FROM_FMBLA_NDBLOCKED 0.001 0.001 0.001 0.001 score FROM_FMBLA_NEWDOM 0.001 1.499 0.001 1.499 score FROM_FMBLA_NEWDOM14 0.001 0.001 0.001 0.001 score FROM_FMBLA_NEWDOM28 0.001 0.799 0.001 0.799 score FROM_GOV_DKIM_AU 0.001 -0.001 0.001 -0.001 score FROM_GOV_REPLYTO_FREEMAIL 0.001 1.000 0.001 1.000 score FROM_GOV_SPOOF 0.001 1.000 0.001 1.000 score FROM_IN_TO_AND_SUBJ 2.199 2.199 2.199 2.199 score FROM_LONG_DOM 1.499 1.499 1.499 1.499 score FROM_LONG_DOM_MINFP 0.023 0.001 0.023 0.001 score FROM_MISSP_DYNIP 2.135 1.742 2.135 1.742 score FROM_MISSP_FREEMAIL 2.899 2.799 2.899 2.799 score FROM_MISSP_MSFT 0.001 1.364 0.001 1.364 score FROM_MISSP_PHISH 3.134 3.438 3.134 3.438 score FROM_MISSP_REPLYTO 2.499 2.499 2.499 2.499 score FROM_MISSP_SPF_FAIL 0.001 0.001 0.001 0.001 score FROM_MISSP_USER 0.001 0.001 0.001 0.001 score FROM_MISSP_XPRIO 0.001 2.499 0.001 2.499 score FROM_MULTI_NORDNS 2.499 1.615 2.499 1.615 score FROM_NEWDOM_BTC 0.001 1.000 0.001 1.000 score FROM_NTLD_LINKBAIT 2.000 1.999 2.000 1.999 score FROM_NTLD_REPLY_FREEMAIL 0.907 0.469 0.907 0.469 score FROM_NUMBERO_NEWDOMAIN 0.001 1.000 0.001 1.000 score FROM_PAYPAL_SPOOF 0.001 1.000 0.001 1.000 score FROM_SUSPICIOUS_NTLD 0.499 0.499 0.499 0.499 score FROM_SUSPICIOUS_NTLD_FP 1.999 1.999 1.999 1.999 score FROM_UNBAL2 3.099 2.800 3.099 2.800 score FROM_WSP_LEAD 2.399 2.400 2.399 2.400 score FROM_WSP_TRAIL 2.799 2.699 2.799 2.699 score FSL_BULK_SIG 0.001 0.001 0.001 0.001 score FSL_CTYPE_WIN1251 0.001 0.250 0.001 0.250 score FSL_HAS_TINYURL 3.499 2.600 3.499 2.600 score FSL_NEW_HELO_USER 0.001 0.001 0.001 0.001 score FUZZY_BITCOIN 2.594 1.357 2.594 1.357 score FUZZY_SECURITY 2.199 2.199 2.199 2.199 score GAPPY_SALES_LEADS_FREEM 1.000 1.000 1.000 1.000 score GB_CUSTOM_HTM_URI 1.500 0.073 1.500 0.073 score GB_FAKE_RF_SHORT 1.000 1.000 1.000 1.000 score GB_FORGED_MUA_POSTFIX 1.000 1.000 1.000 1.000 score GB_FREEMAIL_DISPTO 0.499 0.499 0.499 0.499 score GB_FREEMAIL_DISPTO_NOTFREEM 0.499 0.499 0.499 0.499 score GB_GOOGLE_OBFUR 0.750 0.750 0.750 0.750 score GB_HASHBL_BTC 1.000 2.501 1.000 2.501 score GOOGLE_DOCS_PHISH 1.000 1.000 1.000 1.000 score GOOGLE_DOCS_PHISH_MANY 1.000 1.000 1.000 1.000 score GOOGLE_DOC_SUSP 1.000 1.000 1.000 1.000 score GOOGLE_DRIVE_REPLY_BAD_NTLD 1.000 1.000 1.000 1.000 score GOOG_MALWARE_DNLD 1.000 1.000 1.000 1.000 score GOOG_REDIR_FRAUD 1.000 1.000 1.000 1.000 score GOOG_REDIR_HTML_ONLY 0.001 0.001 0.001 0.001 score GOOG_REDIR_NORDNS 0.001 0.001 0.001 0.001 score GOOG_REDIR_NOTRDNS 1.499 1.500 1.499 1.500 score GOOG_REDIR_SHORT 1.000 1.000 1.000 1.000 score GOOG_REDIR_STATICRDNS 1.499 1.499 1.499 1.499 score GOOG_STO_EMAIL_PHISH 2.999 2.859 2.999 2.859 score GOOG_STO_HTML_PHISH 1.000 1.487 1.000 1.487 score GOOG_STO_HTML_PHISH_MANY 1.000 1.000 1.000 1.000 score GOOG_STO_IMG_HTML 2.999 2.999 2.999 2.999 score GOOG_STO_IMG_NOHTML 1.000 1.000 1.000 1.000 score GOOG_STO_NOIMG_HTML 2.999 2.999 2.999 2.999 score HAS_X_NO_RELAY 1.000 1.000 1.000 1.000 score HAS_X_OUTGOING_SPAM_STAT 1.000 1.000 1.000 1.000 score HDRS_MISSP 1.000 1.000 1.000 1.000 score HDR_ORDER_FTSDMCXX_DIRECT 0.001 0.001 0.001 0.001 score HDR_ORDER_FTSDMCXX_NORDNS 0.001 0.428 0.001 0.428 score HEADER_FROM_DIFFERENT_DOMAINS 0.001 0.001 0.001 0.001 score HELO_NO_DOMAIN 0.001 0.001 0.001 0.001 score HEXHASH_WORD 2.999 2.929 2.999 2.929 score HK_CTE_RAW 1.000 1.000 1.000 1.000 score HK_NAME_FM_MR_MRS 1.499 1.499 1.499 1.499 score HK_NAME_MR_MRS 0.999 0.999 0.999 0.999 score HK_RANDOM_ENVFROM 1.000 0.001 1.000 0.001 score HK_RANDOM_FROM 0.999 0.999 0.999 0.999 score HK_RANDOM_REPLYTO 0.999 0.001 0.999 0.001 score HK_RCVD_IP_MULTICAST 1.000 1.000 1.000 1.000 score HK_SCAM 0.653 1.999 0.653 1.999 score HOSTED_IMG_DIRECT_MX 1.000 1.000 1.000 1.000 score HOSTED_IMG_DQ_UNSUB 1.000 1.000 1.000 1.000 score HOSTED_IMG_FREEM 1.000 1.000 1.000 1.000 score HOSTED_IMG_MULTI 1.000 1.000 1.000 1.000 score HOSTED_IMG_MULTI_PUB_01 2.999 2.999 2.999 2.999 score HREF_EMPTY_NORDNS 2.487 0.001 2.487 0.001 score HREF_EMPTY_PHPMAIL 1.000 1.000 1.000 1.000 score HREF_EMPTY_XANTIABUSE 1.000 1.000 1.000 1.000 score HREF_EMPTY_XAUTHED 1.000 1.000 1.000 1.000 score HTML_BADATTR 1.000 1.000 1.000 1.000 score HTML_ENTITY_ASCII 0.001 0.001 0.001 0.001 score HTML_ENTITY_ASCII_TINY 2.999 2.552 2.999 2.552 score HTML_OFF_PAGE 1.000 1.000 1.000 1.000 score HTML_SHRT_CMNT_OBFU_MANY 1.000 1.000 1.000 1.000 score HTML_SINGLET_MANY 1.386 2.499 1.386 2.499 score HTML_TEXT_INVISIBLE_FONT 0.400 0.001 0.400 0.001 score HTML_TEXT_INVISIBLE_STYLE 2.498 3.499 2.498 3.499 score IMG_DIRECT_TO_MX 3.028 3.194 3.028 3.194 score IMG_ONLY_FM_DOM_INFO 1.000 2.499 1.000 2.499 score JH_SPAMMY_HEADERS 1.000 1.000 1.000 1.000 score JH_SPAMMY_PATTERN01 1.000 1.000 1.000 1.000 score JH_SPAMMY_PATTERN02 1.000 1.000 1.000 1.000 score KHOP_HELO_FCRDNS 0.400 0.399 0.400 0.399 score LINKEDIN_IMG_NOT_RCVD_LNKN 1.000 1.000 1.000 1.000 score LIST_PRTL_PUMPDUMP 1.000 1.000 1.000 1.000 score LIST_PRTL_SAME_USER 1.000 1.000 1.000 1.000 score LONGLN_LOW_CONTRAST 2.499 2.500 2.499 2.500 score LONG_HEX_URI 1.000 1.000 1.000 1.000 score LONG_IMG_URI 1.936 0.308 1.936 0.308 score LONG_INVISIBLE_TEXT 3.000 2.650 3.000 2.650 score LOTS_OF_MONEY 0.010 0.001 0.010 0.001 score LOTTO_AGENT 0.460 0.640 0.460 0.640 score LOTTO_DEPT 2.000 1.999 2.000 1.999 score LUCRATIVE 1.999 1.506 1.999 1.506 score MALF_HTML_B64 1.000 1.000 1.000 1.000 score MALWARE_NORDNS 1.000 1.000 1.000 1.000 score MALWARE_PASSWORD 1.000 1.000 1.000 1.000 score MILLION_EUR 1.042 0.001 1.042 0.001 score MILLION_HUNDRED 2.456 2.073 2.456 2.073 score MILLION_USD 1.999 1.999 1.999 1.999 score MIMEOLE_DIRECT_TO_MX 0.001 0.814 0.001 0.814 score MIME_NO_TEXT 1.999 1.034 1.999 1.034 score MIXED_AREA_CASE 1.000 1.000 1.000 1.000 score MIXED_CENTER_CASE 2.499 2.500 2.499 2.500 score MIXED_ES 2.199 1.714 2.199 1.714 score MIXED_FONT_CASE 1.000 1.000 1.000 1.000 score MIXED_HREF_CASE 2.000 1.999 2.000 1.999 score MIXED_IMG_CASE 1.901 1.620 1.901 1.620 score MONERO_DEADLINE 1.000 1.000 1.000 1.000 score MONERO_EXTORT_01 1.000 1.000 1.000 1.000 score MONERO_MALWARE 1.000 1.000 1.000 1.000 score MONERO_PAY_ME 1.000 1.000 1.000 1.000 score MONEY_ATM_CARD 0.001 0.303 0.001 0.303 score MONEY_FORM 2.858 2.600 2.858 2.600 score MONEY_FORM_SHORT 1.340 0.455 1.340 0.455 score MONEY_FRAUD_3 1.865 2.048 1.865 2.048 score MONEY_FRAUD_5 2.862 0.818 2.862 0.818 score MONEY_FRAUD_8 0.001 1.537 0.001 1.537 score MONEY_FREEMAIL_REPTO 1.499 1.499 1.499 1.499 score MONEY_FROM_41 1.999 1.999 1.999 1.999 score MONEY_FROM_MISSP 0.533 0.001 0.533 0.001 score MSGID_DOLLARS_URI_IMG 1.000 1.000 1.000 1.000 score MSGID_HDR_MALF 1.000 1.000 1.000 1.000 score MSM_PRIO_REPTO 1.000 1.000 1.000 1.000 score MXG_EMAIL_FRAG 0.099 0.100 0.099 0.100 score NA_DOLLARS 1.499 1.499 1.499 1.499 score NEWEGG_IMG_NOT_RCVD_NEGG 1.000 1.000 1.000 1.000 score NEW_PRODUCTS 1.249 1.250 1.249 1.250 score NICE_REPLY_A -2.644 -2.379 -2.644 -2.379 score NO_FM_NAME_IP_HOSTN 0.001 0.001 0.001 0.001 score NSL_RCVD_FROM_USER 0.001 0.001 0.001 0.001 score NSL_RCVD_HELO_USER 2.052 0.462 2.052 0.462 score OBFU_BITCOIN 2.664 2.796 2.664 2.796 score ODD_FREEM_REPTO 1.000 1.000 1.000 1.000 score PAYPAL_PHISH_07 1.000 1.000 1.000 1.000 score PDS_BTC_ID 0.500 0.500 0.500 0.500 score PDS_BTC_MSGID 0.700 0.696 0.700 0.696 score PDS_FROM_2_EMAILS 3.499 3.499 3.499 3.499 score PDS_HELO_SPF_FAIL 0.001 0.001 0.001 0.001 score PDS_NAKED_TO_NUMERO 1.999 1.999 1.999 1.999 score PDS_NO_FULL_NAME_SPOOFED_URL 0.749 0.720 0.749 0.720 score PDS_OTHER_BAD_TLD 2.000 1.999 2.000 1.999 score PDS_SHORT_SPOOFED_URL 2.000 1.854 2.000 1.854 score PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE 1.999 1.999 1.999 1.999 score PHISH_ATTACH 2.299 2.399 2.299 2.399 score PHISH_AZURE_CLOUDAPP 3.500 3.500 3.500 3.500 score PHISH_FBASEAPP 1.000 1.000 1.000 1.000 score PHP_NOVER_MUA 1.000 1.000 1.000 1.000 score PHP_ORIG_SCRIPT 1.403 1.633 1.403 1.633 score PHP_SCRIPT 2.499 2.499 2.499 2.499 score PHP_SCRIPT_MUA 1.000 1.000 1.000 1.000 score POSSIBLE_GMAIL_PHISHER 2.828 0.437 2.828 0.437 score POSSIBLE_PAYPAL_PHISH_02 1.000 1.000 1.000 1.000 score PP_CROSSTALK_GOOG_MSFT 2.499 2.499 2.499 2.499 score PP_MIME_FAKE_ASCII_TEXT 0.999 0.813 0.999 0.813 score PP_TOO_MUCH_UNICODE02 0.500 0.500 0.500 0.500 score PP_TOO_MUCH_UNICODE05 1.000 1.000 1.000 1.000 score PUMPDUMP 1.000 1.000 1.000 1.000 score PUMPDUMP_MULTI 1.000 1.000 1.000 1.000 score RAND_HEADER_LIST_SPOOF 1.000 1.000 1.000 1.000 score RAND_HEADER_MANY 1.000 1.000 1.000 1.000 score RAND_MKTG_HEADER 1.000 1.000 1.000 1.000 score RATWARE_NO_RDNS 1.184 1.592 1.184 1.592 score RCVD_DOTEDU_SHORT 1.000 1.000 1.000 1.000 score RCVD_DOTEDU_SUSP_URI 1.000 1.000 1.000 1.000 score RCVD_IN_IADB_DMARC 0.001 0.001 0.001 0.001 score RCVD_IN_IADB_ESP 0.001 -0.001 0.001 -0.001 score RCVD_IN_MSPIKE_BL 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_H2 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_H3 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_H4 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_H5 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_L2 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_L3 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_L4 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_L5 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_WL 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_ZBI 0.001 0.001 0.001 0.001 score RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 0.001 0.001 0.001 score RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 0.001 0.001 0.001 score RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 0.001 0.001 0.001 score RDNS_NUM_TLD_ATCHNX 1.000 1.000 1.000 1.000 score RDNS_NUM_TLD_XM 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD 2.999 2.999 2.999 2.999 score REPTO_419_FRAUD_AOL 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_AOL_LOOSE 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_CNS 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_GM 0.001 0.001 0.001 0.001 score REPTO_419_FRAUD_GM_LOOSE 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_HM 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_OL 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_PM 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_QQ 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_YH 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_YH_LOOSE 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_YJ 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_YN 1.000 1.000 1.000 1.000 score RISK_FREE 2.499 2.319 2.499 2.319 score SCC_CANSPAM_1 1.307 1.344 1.307 1.344 score SCC_CANSPAM_2 3.599 3.399 3.599 3.399 score SCC_ISEMM_LID_1 1.000 1.000 1.000 1.000 score SCC_ISEMM_LID_1A 1.000 1.000 1.000 1.000 score SCC_ISEMM_LID_1B 1.000 1.499 1.000 1.499 score SENDGRID_REDIR 0.001 0.001 0.001 0.001 score SENDGRID_REDIR_PHISH 1.000 1.000 1.000 1.000 score SEO_SUSP_NTLD 1.000 1.000 1.000 1.000 score SHOPIFY_IMG_NOT_RCVD_SFY 1.999 2.499 1.999 2.499 score SHORTENER_SHORT_IMG 1.000 1.000 1.000 1.000 score SHORT_IMG_SUSP_NTLD 0.358 0.128 0.358 0.128 score SHY_OBFU_EXPIRE 1.000 1.000 1.000 1.000 score SHY_OBFU_PASSWORD 1.000 1.000 1.000 1.000 score SPOOFED_FREEMAIL 0.001 0.001 0.001 0.001 score SPOOFED_FREEMAIL_NO_RDNS 0.242 0.001 0.242 0.001 score SPOOFED_FREEM_REPTO 0.001 2.499 0.001 2.499 score SPOOFED_FREEM_REPTO_CHN 0.001 1.000 0.001 1.000 score SPOOFED_FREEM_REPTO_RUS 0.001 1.000 0.001 1.000 score SPOOF_GMAIL_MID 1.499 1.499 1.499 1.499 score STATIC_XPRIO_OLE 1.999 1.999 1.999 1.999 score STOCK_TIP 1.000 1.000 1.000 1.000 score SUBJ_ATTENTION 0.499 0.499 0.499 0.499 score SUBJ_BRKN_WORDNUMS 1.000 1.000 1.000 1.000 score SURBL_BLOCKED 0.001 0.001 0.001 0.001 score SUSP_UTF8_WORD_FROM 1.999 1.210 1.999 1.210 score SUSP_UTF8_WORD_SUBJ 1.999 1.999 1.999 1.999 score SYSADMIN 1.000 1.000 1.000 1.000 score TAGSTAT_IMG_NOT_RCVD_TGST 1.000 1.000 1.000 1.000 score TARINGANET_IMG_NOT_RCVD_TN 1.000 1.000 1.000 1.000 score TEQF_USR_POLITE 1.999 1.999 1.999 1.999 score THIS_AD 1.999 0.579 1.999 0.579 score THIS_IS_ADV_SUSP_NTLD 1.000 1.000 1.000 1.000 score TONLINE_FAKE_DKIM 1.000 1.000 1.000 1.000 score TO_EQ_FM_DIRECT_MX 0.001 0.001 0.001 0.001 score TO_EQ_FM_DOM_HTML_ONLY 3.599 2.762 3.599 2.762 score TO_EQ_FM_DOM_SPF_FAIL 0.001 1.496 0.001 1.496 score TO_EQ_FM_HTML_DIRECT 2.424 3.499 2.424 3.499 score TO_EQ_FM_HTML_ONLY 3.599 2.995 3.599 2.995 score TO_EQ_FM_SPF_FAIL 0.001 2.088 0.001 2.088 score TO_IN_SUBJ 0.100 0.100 0.100 0.100 score TO_NAME_SUBJ_NO_RDNS 2.596 0.001 2.596 0.001 score TO_NO_BRKTS_HTML_IMG 0.001 0.001 0.001 0.001 score TO_NO_BRKTS_HTML_ONLY 1.999 1.999 1.999 1.999 score TO_NO_BRKTS_MSFT 1.695 1.618 1.695 1.618 score TO_NO_BRKTS_NORDNS_HTML 0.001 0.001 0.001 0.001 score TO_NO_BRKTS_PCNT 2.500 2.499 2.500 2.499 score TVD_DOLLARS_US 2.699 2.699 2.699 2.699 score TVD_SINGLE_SPAN_DIV 3.199 3.200 3.199 3.200 score TVD_SPACE_ENCODED 2.499 2.499 2.499 2.499 score TW_GIBBERISH_MANY 1.000 1.000 1.000 1.000 score UC_GIBBERISH_OBFU 1.000 1.000 1.000 1.000 score UNDISC_FREEM 2.899 2.799 2.899 2.799 score UNDISC_MONEY 3.000 2.999 3.000 2.999 score UNICODE_OBFU_ASC 2.499 2.500 2.499 2.500 score UNICODE_OBFU_ZW 1.000 1.000 1.000 1.000 score UNICODE_OBFU_ZW_MANY 0.018 1.025 0.018 1.025 score UNICODE_RTL_OBFU 1.000 1.000 1.000 1.000 score UNSUB_GOOG_FORM 1.000 1.000 1.000 1.000 score UPPERCASE_URI 2.899 2.570 2.899 2.570 score URIBL_CT_SURBL 0.001 1.999 0.001 1.999 score URIBL_DM_SURBL 0.001 0.001 0.001 0.001 score URI_ADOBESPARK 1.000 1.000 1.000 1.000 score URI_AZURE_CLOUDAPP 1.000 1.000 1.000 1.000 score URI_CLOUDFLAREIPFS 1.000 1.000 1.000 1.000 score URI_DASHGOVEDU 1.000 1.000 1.000 1.000 score URI_DATA 1.000 1.000 1.000 1.000 score URI_DOTCN_LOGIN 1.499 1.499 1.499 1.499 score URI_DOTCN_SPOOF 2.999 2.279 2.999 2.279 score URI_DOTEDU 1.830 0.691 1.830 0.691 score URI_DOTEDU_ENTITY 1.000 1.000 1.000 1.000 score URI_DOTTY_HEX 3.400 3.299 3.400 3.299 score URI_DWEBIPFS 1.000 1.000 1.000 1.000 score URI_EXCESS_SLASHES 2.999 2.999 2.999 2.999 score URI_FIREBASEAPP 2.999 2.999 2.999 2.999 score URI_FLKIPFSXYZIPFS 1.000 1.000 1.000 1.000 score URI_GLITCHME 1.000 1.000 1.000 1.000 score URI_GOOGDRAWPREVIEW 1.000 1.000 1.000 1.000 score URI_GOOGDRAWPREVIEW_MINFP 3.499 3.499 3.499 3.499 score URI_GOOGLE_PROXY 2.199 2.199 2.199 2.199 score URI_GOOG_STO_SPAMMY 2.999 2.999 2.999 2.999 score URI_HEX_IP 1.000 1.000 1.000 1.000 score URI_IMG_CWINDOWSNET 3.499 1.894 3.499 1.894 score URI_IMG_WP_REDIR 1.000 1.000 1.000 1.000 score URI_IPFS 3.404 2.683 3.404 2.683 score URI_IPFSIO 0.905 0.177 0.905 0.177 score URI_LONG_REPEAT 1.000 1.000 1.000 1.000 score URI_MALWARE_BH 0.999 0.999 0.999 0.999 score URI_ONLY_MSGID_MALF 1.000 1.000 1.000 1.000 score URI_OPTOUT_3LD 1.000 1.000 1.000 1.000 score URI_PHISH 3.999 3.999 3.999 3.999 score URI_PHP_REDIR 1.000 1.000 1.000 1.000 score URI_TRY_3LD 2.000 1.999 2.000 1.999 score URI_TRY_USME 1.000 1.000 1.000 1.000 score URI_W3SIPFS 1.000 1.000 1.000 1.000 score URI_WPADMIN 2.399 2.299 2.399 2.299 score URI_WP_DIRINDEX 3.500 3.499 3.500 3.499 score URI_WP_HACKED 0.719 0.001 0.719 0.001 score URI_WP_HACKED_2 2.499 2.499 2.499 2.499 score USB_DRIVES 1.000 1.000 1.000 1.000 score VFY_ACCT_NORDNS 2.499 2.392 2.499 2.392 score VISTA_COST 1.000 1.000 1.000 1.000 score VISTA_TONOM_EQ_TOLOC 1.000 1.000 1.000 1.000 score VPS_NO_NTLD 1.000 1.000 1.000 1.000 score WALMART_IMG_NOT_RCVD_WAL 1.000 1.000 1.000 1.000 score WORD_INVIS 1.000 1.000 1.000 1.000 score WORD_INVIS_MANY 1.000 1.000 1.000 1.000 score XFER_LOTSA_MONEY 0.999 0.999 0.999 0.999 score XM_DIGITS_ONLY 1.000 1.000 1.000 1.000 score XM_RANDOM 2.499 2.500 2.499 2.500 score XPRIO 1.760 0.001 1.760 0.001 score XPRIO_SHORT_SUBJ 1.000 1.000 1.000 1.000 score XPRIO_VISTA 0.001 2.499 0.001 2.499 score YOUR_DELIVERY_ADDRESS 1.249 1.249 1.249 1.249 updates_spamassassin_org/20_head_tests.cf 0000644 00000065525 15114422154 0014617 0 ustar 00 # SpamAssassin rules file: header tests # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # @LICENSE> # ########################################################################### require_version 4.000001 ########################################################################### # partial messages; currently-theoretical attack # unsurprisingly this hits 0/0 right now. header FRAGMENTED_MESSAGE Content-Type =~ /\bmessage\/partial/i describe FRAGMENTED_MESSAGE Partial message tflags FRAGMENTED_MESSAGE userconf ########################################################################### header FROM_BLANK_NAME From =~ /(?:\s|^)"" <\S+>/i describe FROM_BLANK_NAME From: contains empty name ########################################################################### # numeric address rules, these are written to avoid overlap with each other header __FROM_ENDS_IN_NUMS From:addr =~ /\D\d{8,}\@/i header FROM_STARTS_WITH_NUMS From:addr =~ /^\d{3,50}[^0-9\@]/ describe FROM_STARTS_WITH_NUMS From: starts with several numbers # don't match US/Canada phone numbers: 10 digits optionally preceded by a "1" header __FROM_ALL_NUMS From:addr =~ /^(?:\d{1,9}|[02-9]\d{10}|\d{12,})@/ ########################################################################### header FROM_OFFERS From:addr =~ /\@\S*offers(?![eo]n\b)/i describe FROM_OFFERS From address is "at something-offers" header FROM_NO_USER From =~ /(?:^\@|<\@| \@[^\)<]*$|<>)/ [if-unset: unset@unset.unset] describe FROM_NO_USER From: has no local-part before @ sign # also 100% valid # bug 6149: avoid common .jp false positives header __PLING_QUERY Subject =~ /\?.*!|!.*\?/ meta PLING_QUERY (__PLING_QUERY && !__ISO_2022_JP_DELIM) describe PLING_QUERY Subject has exclamation mark and question mark # A common spam idiosyncrasy describe FROMSPACE Idiosyncratic "From" header format header FROMSPACE From:raw =~ /^\s?\"\s/ header MSGID_SPAM_CAPS Message-ID =~ /^\s*[A-Z]+\@(?!(?:mailcity|whowhere)\.com)/ describe MSGID_SPAM_CAPS Spam tool Message-Id: (caps variant) header MSGID_SPAM_LETTERS Message-Id =~ /<[a-z]{5,}\@(?:\S+\.)+\S+>/ describe MSGID_SPAM_LETTERS Spam tool Message-Id: (letters variant) # negative lookahead exempts this MUA from circa 1997-2000 # X-Mailer: Microsoft Outlook Express 4.71.1712.3 # Message-ID: <01bd45da$2649cdc0$LocalHost@andrew> header __MSGID_DOLLARS_OK MESSAGEID =~ /<[0-9a-f]{4,}\$[0-9a-f]{4,}\$[0-9a-f]{4,}\@\S+>/ header __MSGID_DOLLARS_MAYBE MESSAGEID =~ /<\w{4,}\$\w{4,}\$(?!localhost)\w{4,}\@\S+>/i meta MSGID_DOLLARS_RANDOM __MSGID_DOLLARS_MAYBE && !__MSGID_DOLLARS_OK # bit of a ratware rule, but catches a bit more than just the one ratware header __MSGID_RANDY Message-ID =~ /<[a-z\d][a-z\d\$-]{10,29}[a-z\d]\@[a-z\d][a-z\d.]{3,12}[a-z\d]>/ # heuristic to eliminate most good Message-ID formats header __MSGID_OK_HEX Message-ID =~ /\b[a-f\d]{8}\b/ header __MSGID_OK_DIGITS Message-ID =~ /\d{10}/ header __MSGID_OK_HOST Message-ID =~ /\@(?:\D{2,}|(?:\d{1,3}\.){3}\d{1,3})>/ meta MSGID_RANDY (__MSGID_RANDY && !(__MSGID_OK_HEX || __MSGID_OK_DIGITS || __MSGID_OK_HOST)) describe MSGID_RANDY Message-Id has pattern used in spam # bug 3395 header MSGID_YAHOO_CAPS Message-ID =~ /<[A-Z]+\@yahoo.com>/ describe MSGID_YAHOO_CAPS Message-ID has ALLCAPS@yahoo.com ########################################################################### header __AT_AOL_MSGID MESSAGEID =~ /\@aol\.com\b/i header __FROM_AOL_COM From =~ /\@aol\.com\b/i meta FORGED_MSGID_AOL (__AT_AOL_MSGID && !__FROM_AOL_COM) describe FORGED_MSGID_AOL Message-ID is forged, (aol.com) header __AT_EXCITE_MSGID MESSAGEID =~ /\@excite\.com\b/i header __MY_RCVD_EXCITE Received =~ /\.excite\.com\b/i meta FORGED_MSGID_EXCITE (__AT_EXCITE_MSGID && !__MY_RCVD_EXCITE) describe FORGED_MSGID_EXCITE Message-ID is forged, (excite.com) header __AT_HOTMAIL_MSGID MESSAGEID =~ /\@hotmail\.com\b/i header __FROM_HOTMAIL_COM From =~ /\@hotmail\.com\b/i meta FORGED_MSGID_HOTMAIL (__AT_HOTMAIL_MSGID && (!__FROM_HOTMAIL_COM && !__FROM_MSN_COM && !__FROM_YAHOO_COM)) describe FORGED_MSGID_HOTMAIL Message-ID is forged, (hotmail.com) header __AT_MSN_MSGID MESSAGEID =~ /\@msn\.com\b/i header __FROM_MSN_COM From =~ /\@msn\.com\b/i meta FORGED_MSGID_MSN (__AT_MSN_MSGID && (!__FROM_MSN_COM && !__FROM_HOTMAIL_COM && !__FROM_YAHOO_COM)) describe FORGED_MSGID_MSN Message-ID is forged, (msn.com) header __AT_YAHOO_MSGID MESSAGEID =~ /\@yahoo\.com\b/i header __FROM_YAHOO_COM From =~ /\@yahoo\.com\b/i meta FORGED_MSGID_YAHOO (__AT_YAHOO_MSGID && !__FROM_YAHOO_COM) describe FORGED_MSGID_YAHOO Message-ID is forged, (yahoo.com) ########################################################################### header __MSGID_BEFORE_RECEIVED ALL =~ /^Message-Id:.*?^Received:/msi header __MSGID_BEFORE_OKAY Message-Id =~ /\@[a-z0-9.-]+\.(?:yahoo|wanadoo)(?:\.[a-z]{2,3}){1,2}>/ meta MSGID_FROM_MTA_HEADER (__MSGID_BEFORE_RECEIVED && !__MSGID_BEFORE_OKAY && !__FROM_HOTMAIL_COM) describe MSGID_FROM_MTA_HEADER Message-Id was added by a relay header MSGID_SHORT MESSAGEID =~ /^.{1,15}$|<.{0,4}\@/ describe MSGID_SHORT Message-ID is unusually short #DEMOTED TO SANDBOX - 2012-03-21 #header MSGID_MULTIPLE_AT MESSAGEID =~ /<[^>]*\@[^>]*\@/ #describe MSGID_MULTIPLE_AT Message-ID contains multiple '@' characters ########################################################################### header DATE_SPAMWARE_Y2K Date =~ /^[A-Z][a-z]{2}, \d\d [A-Z][a-z]{2} [0-6]\d \d\d:\d\d:\d\d [A-Z]{3}$/ describe DATE_SPAMWARE_Y2K Date header uses unusual Y2K formatting # as noted on the dev@ list, ":60" is valid for seconds when there's a leap # second (12/31/2005 for instance), so let's accept that as valid. ISO 8601 # apparently allows for it. # there were a few whitespace issues in the original RE, and I wanted to avoid my # two common, but yes invalid, date headers. specifically / \(GMT\)$/ and # / 0000 GMT$/. dos has / "GMT"$/ - tvd # 2.229 2.7267 0.0517 0.981 0.86 0.00 INVALID_DATE # 2.263 2.7486 0.1368 0.953 0.78 0.00 INVALID_DATE_OLD # # WRT the tests, remember that ok and fail are reversed -- so valid dates # should be "fail" and invalid dates should be "ok". header INVALID_DATE Date !~ /^\s*(?:(?i:Mon|Tue|Wed|Thu|Fri|Sat|Sun),\s)?\s*(?:[12]\d|3[01]|0?[1-9])\s+(?i:Jan|Feb|Ma[ry]|Apr|Ju[nl]|Aug|Sep|Oct|Nov|Dec)\s+(?:19[7-9]\d|2\d{3})\s+(?:[01]?\d|2[0-3])\:[0-5]\d(?::(?:[0-5]\d|60))?(?:\s+[AP]M)?(?:\s+(?:[+-][0-9]{4}|UT|[A-Z]{2,3}T|0000 GMT|"GMT"))?(?:\s*\(.*\))?\s*$/ [if-unset: Wed, 31 Jul 2002 16:41:57 +0200] describe INVALID_DATE Invalid Date: header (not RFC 2822) test INVALID_DATE fail Sat, 31 Dec 2005 23:59:60 -0500 test INVALID_DATE fail Wed, 31 Jul 2002 16:41:57 +0200 test INVALID_DATE fail Sat, 31 Dec 2005 23:00:00 test INVALID_DATE ok Sat, 31 Dec 2005 24:00:00 -0500 test INVALID_DATE ok Thurs, 31 Jul 2002 16:41:57 +0200 # allow +1300, NZ timezone header INVALID_DATE_TZ_ABSURD Date =~ /[-+](?!(?:0\d|1[0-4])(?:[03]0|[14]5))\d{4}$/ describe INVALID_DATE_TZ_ABSURD Invalid Date: header (timezone does not exist) header INVALID_TZ_CST ALL =~ /[+-]\d\d[30]0(?, see SpamAssassin-talk list 2003-03 # quinlan: 2003-03-23 here are more generic Japanese iso-2022-jp codes # ("not yet acceptance" or "email") + "announcement" # FWIW, according to Peter Evans, this should be sufficient to catch the # UCE tag and a common attempt at evasion (using the "sue" instead of # "mi" Chinese character). 2006-10-12: updated by bug 4021. header JAPANESE_UCE_SUBJECT Subject =~ /\e\$B.*(?:L\$>5Bz|EE;R%a!<%k)(?:8x|9-)9p/ describe JAPANESE_UCE_SUBJECT Subject contains a Japanese UCE tag # check body for "shou nin daku kou koku" UCE tag (bug 4021) body __JAPANESE_UCE_BODY /(?:L\$>5Bz|EE;R%a!<%k)(?:8x|9-)9p/ meta JAPANESE_UCE_BODY (__ISO_2022_JP_DELIM && __JAPANESE_UCE_BODY) describe JAPANESE_UCE_BODY Body contains Japanese UCE tag # quinlan: "advertisement" in Russian KOI8-R # (no longer common, but worth noting in future) #header RUSSIAN_UCE_SUBJECT Subject =~ /\xf0\xe5\xea\xeb\xe0\xec\xf3/ #describe RUSSIAN_UCE_SUBJECT Subject contains a Russian UCE tag # Korean UCE Subject: lines are usually 8-bit, but are occasionally encoded # with quoted-printable or base64. # # \xbc\xba\xc0\xce means "adult" # \xb1\xa4\xb0\xed means "advertisement" # \xc1\xa4\xba\xb8 means "information" # \xc8\xab\xba\xb8 means "publicity" # # Each two byte sequence is one Korean letter; the spaces and periods are # sometimes used to obscure the words. \xb1\xa4\xb0\xed is the most common # tag and is sometimes very obscured so we look harder. # header KOREAN_UCE_SUBJECT Subject =~ /[({[<][. ]*(?-i:\xbc\xba[. ]*\xc0\xce[. ]*)?(?-i:\xb1\xa4(?:[. ]*|[\x00-\x7f]{0,3})\xb0\xed|\xc1\xa4[. ]*\xba\xb8|\xc8\xab[. ]*\xba\xb8)[. ]*[)}\]>]/ describe KOREAN_UCE_SUBJECT Subject: contains Korean unsolicited email tag ########################################################################### # two reliable signatures header __DOUBLE_IP_SPAM_1 Received =~ /from \[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\] by \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3} with/ header __DOUBLE_IP_SPAM_2 Received =~ /from\s+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s+by\s+\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3};/ # loose match header __DOUBLE_IP_LOOSE Received =~ /(?:\b(?:from|by)\b.{1,4}\b\d{1,3}[._-]\d{1,3}[._-]\d{1,3}[._-]\d{1,3}(? 1) describe MULTI_FORGED Received headers indicate multiple forgeries header NONEXISTENT_CHARSET Content-Type =~ /charset=.?DEFAULT/ describe NONEXISTENT_CHARSET Character set doesn't exist header __HAS_MESSAGE_ID exists:Message-Id priority __HAS_MESSAGE_ID -2000 # Bug 8078 meta MISSING_MID !__HAS_MESSAGE_ID describe MISSING_MID Missing Message-Id: header header __HAS_DATE exists:Date priority __HAS_DATE -2000 # Bug 8078 meta MISSING_DATE !__HAS_DATE describe MISSING_DATE Missing Date: header header __HAS_SUBJECT exists:Subject priority __HAS_SUBJECT -2000 # Bug 8078 meta MISSING_SUBJECT !__HAS_SUBJECT describe MISSING_SUBJECT Missing Subject: header # bug 6353 header __HAS_FROM exists:From priority __HAS_FROM -2000 # Bug 8078 meta MISSING_FROM !__HAS_FROM describe MISSING_FROM Missing From: header # bug 6149: avoid common .jp false positives header __GAPPY_SUBJECT Subject =~ /\b(?:[a-z]([-_. =~\/:,*!\@\#\$\%\^&+;\"\'<>\\])\1{0,2}){4}/i meta GAPPY_SUBJECT (__GAPPY_SUBJECT && !__ISO_2022_JP_DELIM) describe GAPPY_SUBJECT Subject: contains G.a.p.p.y-T.e.x.t ### header existence tests (description is added automatically) # X-Fix example: NTMail fixed non RFC822 compliant EMail message # # X-PMFLAGS is all caps # # Headers that seem to only be used by a single spamming software and # are found together in the same message: # 1. X-MailingID and X-ServerHost # 2. X-Stormpost-To and X-List-Unsubscribe # # not spammish: X-EM-Registration, X-EM-Version, X-Antiabuse, X-List-Host, # X-Message-Id # bad FP rate: Comment, Date-warning header PREVENT_NONDELIVERY exists:Prevent-NonDelivery-Report describe PREVENT_NONDELIVERY Message has Prevent-NonDelivery-Report header header X_IP exists:X-IP describe X_IP Message has X-IP header header __HAS_MIMEOLE exists:X-MimeOLE header __HAS_MSMAIL_PRI exists:X-MSMail-Priority header __HAS_SQUIRRELMAIL_IN_MAILER X-Mailer =~ /SquirrelMail\b/ # Ever growing Office version list without X-MimeOLE, bug 6346, 7122, 7463. header __HAS_OFFICE1214_IN_MAILER X-Mailer =~ /^Microsoft (?:Office )?Outlook 1[2456]\.0/ # CGP MAPI module fingerprint, to protect from MISSING_MIMEOLE header __HAS_CGP_MAPI_IN_MAILER X-Mailer =~ /CommuniGate Pro MAPI/ meta MISSING_MIMEOLE (__HAS_MSMAIL_PRI && !__HAS_MIMEOLE && !__HAS_SQUIRRELMAIL_IN_MAILER && !__HAS_OFFICE1214_IN_MAILER && !__HAS_CGP_MAPI_IN_MAILER && !__HDR_RCVD_TONLINEDE && !__MIME_BASE64 && !__DKIM_EXISTS) describe MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE header __HAS_X_MAILER exists:X-Mailer header __IS_EXCH X-MimeOLE =~ /Produced By Microsoft Exchange V/ header SUBJ_AS_SEEN Subject =~ /\bAs Seen/i describe SUBJ_AS_SEEN Subject contains "As Seen" header SUBJ_DOLLARS Subject =~ /^\$[0-9.,]+\b/ describe SUBJ_DOLLARS Subject starts with dollar amount #DISABLING DUE TO POOR S/O 2012-09-27 #header SUBJ_YOUR_DEBT Subject =~ /Your (?:Bills|Debt|Credit)/i #describe SUBJ_YOUR_DEBT Subject contains "Your Bills" or similar header SUBJ_YOUR_FAMILY Subject =~ /Your Family/i describe SUBJ_YOUR_FAMILY Subject contains "Your Family" # the real services never HELO as 'foo.com', instead 'mail.foo.com' or # something like that. Note: be careful when expanding this... legit dotcom # HELOers include: hotmail.com, drizzle.com, lockergnome.com. header RCVD_FAKE_HELO_DOTCOM Received =~ /^from (?:msn|yahoo|yourwebsite|lycos|excite|cs|aol|localhost|koreanmail|allexecs|mydomain|juno|eudoramail|compuserve|desertmail|excite|caramail)\.com \(/m describe RCVD_FAKE_HELO_DOTCOM Received contains a faked HELO hostname header SUBJECT_DIET Subject =~ /\bLose .*(?:pounds|lbs|weight)/i describe SUBJECT_DIET Subject talks about losing pounds # MIME boundary tests; spam tools use distinctive patterns. header MIME_BOUND_DD_DIGITS Content-Type =~ /boundary=\"--\d+\"/ describe MIME_BOUND_DD_DIGITS Spam tool pattern in MIME boundary header MIME_BOUND_DIGITS_15 Content-Type =~ /boundary=\"\d{15,}\"/ describe MIME_BOUND_DIGITS_15 Spam tool pattern in MIME boundary header MIME_BOUND_MANY_HEX Content-Type =~ /boundary="[\da-f]{8}(?:-[\da-f]{4}){3}-[\da-f]{12}"/ describe MIME_BOUND_MANY_HEX Spam tool pattern in MIME boundary # note: the first alternation is anchored for speed header TO_MALFORMED To !~ /(?:^|[^\S"])(?:(?:\"[^\"]+\"|\S+)\@\S+\.\S+|^\s*.+:\s*;|^\s*\"[^\"]+\":\s*;|^\s*\([^\)]*\)\s*$|<\S+(?:\!\S+){1,}>|^\s*$)/ [if-unset: unset@unset.unset] describe TO_MALFORMED To: has a malformed address header __CD exists:Content-Disposition header __CT exists:Content-Type header __CTE exists:Content-Transfer-Encoding header __MIME_VERSION exists:MIME-Version header __CT_TEXT_PLAIN Content-Type =~ /^text\/plain\b/i meta MIME_HEADER_CTYPE_ONLY (!__CD && !__CTE && __CT && !__MIME_VERSION && !__CT_TEXT_PLAIN) describe MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required MIME headers header WITH_LC_SMTP Received =~ /\swith\ssmtp;\s/ describe WITH_LC_SMTP Received line contains spam-sign (lowercase smtp) header SUBJ_BUY Subject =~ /^buy/i describe SUBJ_BUY Subject line starts with Buy or Buying # seems to be ratware header RCVD_AM_PM Received =~ /; [A-Z][a-z][a-z], \d{1,2} \d{4} \d{1,2}:\d\d:\d\d [AP]M [+-]\d{4}/ describe RCVD_AM_PM Received headers forged (AM/PM) header __USER_AGENT_MSN X-Mailer =~ /^MSN Explorer / # host no longer exists according to administrator header FAKE_OUTBLAZE_RCVD Received =~ /\.mr\.outblaze\.com/ describe FAKE_OUTBLAZE_RCVD Received header contains faked 'mr.outblaze.com' # thanks to David Ritz for passing this on header UNCLOSED_BRACKET ALL =~ /\[\d+\r?\n/s describe UNCLOSED_BRACKET Headers contain an unclosed bracket header FROM_DOMAIN_NOVOWEL From =~ /\@\S*[bcdfgjklmnpqrstvwxz]{7}/i describe FROM_DOMAIN_NOVOWEL From: domain has series of non-vowel letters tflags FROM_DOMAIN_NOVOWEL userconf # lock scores low header FROM_LOCAL_NOVOWEL From =~ /[bcdfgjklmnpqrstvwxz]{7}\S*\@/i describe FROM_LOCAL_NOVOWEL From: localpart has series of non-vowel letters tflags FROM_LOCAL_NOVOWEL userconf # lock scores low header FROM_LOCAL_HEX From =~ /[0-9a-f]{11}\S*\@/i describe FROM_LOCAL_HEX From: localpart has long hexadecimal sequence header FROM_LOCAL_DIGITS From =~ /\d{11}\S*\@/i describe FROM_LOCAL_DIGITS From: localpart has long digit sequence header __TOCC_EXISTS exists:ToCc header X_PRIORITY_CC ALL =~ /^X-Priority:.*?^Cc:/msi describe X_PRIORITY_CC Cc: after X-Priority: (bulk email fingerprint) # catch non-RFC2047 compliant messages # Apple Mail has a bug where headers will have whitespace around the encoded # text, so try to ignore that header BAD_ENC_HEADER ALL:raw =~ /=\?[^?\s]+\?[^?\s]\?\s*[^?]+\s(?!\?=)/ describe BAD_ENC_HEADER Message has bad MIME encoding in the header header __ML1 Precedence =~ m{\b(?:list|bulk)\b}i meta __ML2 __HAS_LIST_ID header __ML3 exists:List-Post header __ML4 exists:Mailing-List header __ML5 Return-Path:addr =~ m{^(?:[^\@]+-(?:request|bounces|admin|owner)|owner-[^\@]+)(?:\@|\z)}i meta __VIA_ML __ML1 || __ML2 || __ML3 || __ML4 || __ML5 describe __VIA_ML Mail from a mailing list # some clueless mailing lists (like zmailer with an RFC822TABS option on) # are replacing a leading space by a TAB in header fields From, To, # Cc, Date (Bug 6429) header __ML_TURNS_SP_TO_TAB Received =~ /\(ORCPT = 4.000000) header __SUBJ_ILLEGAL_CHARS eval:check_illegal_chars('Subject','0.00','2') meta SUBJ_ILLEGAL_CHARS (__SUBJ_ILLEGAL_CHARS && !__FROM_YAHOO_COM) header FROM_ILLEGAL_CHARS eval:check_illegal_chars('From','0.20','2') header __HEAD_ILLEGAL_CHARS eval:check_illegal_chars('ALL','0.010','2') meta HEAD_ILLEGAL_CHARS __HEAD_ILLEGAL_CHARS && !__SUBJ_ILLEGAL_CHARS && !FROM_ILLEGAL_CHARS endif if (version < 4.000000) meta __SUBJ_ILLEGAL_CHARS 0 meta SUBJ_ILLEGAL_CHARS 0 meta FROM_ILLEGAL_CHARS 0 meta __HEAD_ILLEGAL_CHARS 0 meta HEAD_ILLEGAL_CHARS 0 endif describe SUBJ_ILLEGAL_CHARS Subject: has too many raw illegal characters describe FROM_ILLEGAL_CHARS From: has too many raw illegal characters describe HEAD_ILLEGAL_CHARS Headers have too many raw illegal characters ################################################################### # a forged Hotmail message; host HELO'd as hotmail.com, but it wasn't header __FORGED_HOTMAIL_RCVD eval:check_for_forged_hotmail_received_headers() # this, by comparison is more common: from was @hotmail.com, but it wasn't header FORGED_HOTMAIL_RCVD2 eval:check_for_no_hotmail_received_headers() describe FORGED_HOTMAIL_RCVD2 hotmail.com 'From' address, but no 'Received:' header __FORGED_EUDORAMAIL_RCVD eval:check_for_forged_eudoramail_received_headers() header FORGED_YAHOO_RCVD eval:check_for_forged_yahoo_received_headers() describe FORGED_YAHOO_RCVD 'From' yahoo.com does not match 'Received' headers if (version >= 3.004002) header FORGED_GMAIL_RCVD eval:check_for_forged_gmail_received_headers() describe FORGED_GMAIL_RCVD 'From' gmail.com does not match 'Received' headers endif header __FORGED_JUNO_RCVD eval:check_for_forged_juno_received_headers() header SORTED_RECIPS eval:sorted_recipients() describe SORTED_RECIPS Recipient list is sorted by address header SUSPICIOUS_RECIPS eval:similar_recipients('0.65','undef') describe SUSPICIOUS_RECIPS Similar addresses in recipient list # this is a quite common false positive, as it's legal to remove a To but leave # a CC. so don't score it high. header MISSING_HEADERS eval:check_for_missing_to_header() describe MISSING_HEADERS Missing To: header header DATE_IN_PAST_03_06 eval:check_for_shifted_date('-6', '-3') describe DATE_IN_PAST_03_06 Date: is 3 to 6 hours before Received: date header DATE_IN_PAST_06_12 eval:check_for_shifted_date('-12', '-6') describe DATE_IN_PAST_06_12 Date: is 6 to 12 hours before Received: date header DATE_IN_PAST_12_24 eval:check_for_shifted_date('-24', '-12') describe DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date header DATE_IN_PAST_24_48 eval:check_for_shifted_date('-48', '-24') describe DATE_IN_PAST_24_48 Date: is 24 to 48 hours before Received: date header DATE_IN_PAST_96_XX eval:check_for_shifted_date('undef', '-96') describe DATE_IN_PAST_96_XX Date: is 96 hours or more before Received: date header DATE_IN_FUTURE_03_06 eval:check_for_shifted_date('3', '6') describe DATE_IN_FUTURE_03_06 Date: is 3 to 6 hours after Received: date header DATE_IN_FUTURE_06_12 eval:check_for_shifted_date('6', '12') describe DATE_IN_FUTURE_06_12 Date: is 6 to 12 hours after Received: date header DATE_IN_FUTURE_12_24 eval:check_for_shifted_date('12', '24') describe DATE_IN_FUTURE_12_24 Date: is 12 to 24 hours after Received: date header DATE_IN_FUTURE_24_48 eval:check_for_shifted_date('24', '48') describe DATE_IN_FUTURE_24_48 Date: is 24 to 48 hours after Received: date header DATE_IN_FUTURE_48_96 eval:check_for_shifted_date('48', '96') describe DATE_IN_FUTURE_48_96 Date: is 48 to 96 hours after Received: date #header DATE_IN_FUTURE_96_XX eval:check_for_shifted_date('96', 'undef') meta DATE_IN_FUTURE_96_XX (0) describe DATE_IN_FUTURE_96_XX Date: is 96 hours or more after Received: date header UNRESOLVED_TEMPLATE eval:check_unresolved_template() describe UNRESOLVED_TEMPLATE Headers contain an unresolved template header SUBJ_ALL_CAPS eval:subject_is_all_caps() describe SUBJ_ALL_CAPS Subject is all capitals header LOCALPART_IN_SUBJECT eval:check_for_to_in_subject('user') describe LOCALPART_IN_SUBJECT Local part of To: address appears in Subject header MSGID_OUTLOOK_INVALID eval:check_outlook_message_id() describe MSGID_OUTLOOK_INVALID Message-Id is fake (in Outlook Express format) header HEADER_COUNT_CTYPE eval:check_header_count_range('Content-Type','2','999') describe HEADER_COUNT_CTYPE Multiple Content-Type headers found endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::MIMEEval # this is also mostly-theoretical, so allow 0 hits header HEAD_LONG eval:check_msg_parse_flags('truncated_header') describe HEAD_LONG Message headers are very long tflags HEAD_LONG userconf header MISSING_HB_SEP eval:check_msg_parse_flags('missing_head_body_separator') describe MISSING_HB_SEP Missing blank line between message header and body tflags MISSING_HB_SEP userconf endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::RelayEval header __UNPARSEABLE_RELAY_COUNT eval:check_relays_unparseable() tflags __UNPARSEABLE_RELAY_COUNT userconf meta UNPARSEABLE_RELAY (__UNPARSEABLE_RELAY_COUNT >= 1) tflags UNPARSEABLE_RELAY userconf describe UNPARSEABLE_RELAY Informational: message has unparseable relay lines header RCVD_HELO_IP_MISMATCH eval:helo_ip_mismatch() describe RCVD_HELO_IP_MISMATCH Received: HELO and IP do not match, but should # not used directly right now due to FPs; but CONFIRMED_FORGED turns it # into a 1.0 S/O rule anyway, so that's not a problem ;) # 2.626 3.6340 1.5251 0.704 0.34 1.44 FORGED_RCVD_TRAIL # 0.956 3.3890 0.0000 1.000 0.98 4.30 CONFIRMED_FORGED header __FORGED_RCVD_TRAIL eval:check_for_forged_received_trail() header NO_RDNS_DOTCOM_HELO eval:check_for_no_rdns_dotcom_helo() describe NO_RDNS_DOTCOM_HELO Host HELO'd as a big ISP, but had no rDNS endif ifplugin Mail::SpamAssassin::Plugin::HeaderEval header __ENV_AND_HDR_FROM_MATCH eval:check_for_matching_env_and_hdr_from() endif updates_spamassassin_org/user_prefs.template 0000644 00000003570 15114422154 0015563 0 ustar 00 # SpamAssassin user preferences file. See 'perldoc Mail::SpamAssassin::Conf' # for details of what can be tweaked. #* #* Note: this file is not read by SpamAssassin until copied into the user #* directory. At runtime, if a user has no preferences in their home directory #* already, it will be copied for them, allowing them to perform personalised #* customisation. If you want to make changes to the site-wide defaults, #* create a file in /etc/spamassassin or /etc/mail/spamassassin instead. ########################################################################### # How many points before a mail is considered spam. # required_score 5 # Welcomelist and blocklist addresses are now file-glob-style patterns, so # "friend@somewhere.com", "*@isp.com", or "*.domain.net" will all work. # welcomelist_from someone@somewhere.com # welcomelist_to someone@mydomain.com # Add your own customised scores for some tests below. The default scores are # read from the installed spamassassin rules files, but you can override them # here. To see the list of tests and their default scores, go to # https://spamassassin.apache.org/tests.html . # # score SYMBOLIC_TEST_NAME n.nn # Speakers of Asian languages, like Chinese, Japanese and Korean, will almost # definitely want to uncomment the following lines. They will switch off some # rules that detect 8-bit characters, which commonly trigger on mails using CJK # character sets, or that assume a western-style charset is in use. # # score HTML_COMMENT_8BITS 0 # score UPPERCASE_25_50 0 # score UPPERCASE_50_75 0 # score UPPERCASE_75_100 0 # score OBSCURED_EMAIL 0 # Speakers of any language that uses non-English, accented characters may wish # to uncomment the following lines. They turn off rules that fire on # misformatted messages generated by common mail apps in contravention of the # email RFCs. # score SUBJ_ILLEGAL_CHARS 0 updates_spamassassin_org/25_textcat.cf 0000644 00000003353 15114422154 0014144 0 ustar 00 # SpamAssassin rules file: language tests # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # Note: body tests are run with long lines, so be sure to limit the # size of searches; use /.{0,30}/ instead of /.*/ to avoid huge # search times. # # Note: If you are adding a rule which looks for a phrase in the body # (as most of them do), please add it to rules/20_phrases.cf instead. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # @LICENSE> # ########################################################################### ifplugin Mail::SpamAssassin::Plugin::TextCat body UNWANTED_LANGUAGE_BODY eval:check_language() describe UNWANTED_LANGUAGE_BODY Message written in an undesired language tflags UNWANTED_LANGUAGE_BODY userconf body BODY_8BITS eval:check_body_8bits() describe BODY_8BITS Body includes 8 consecutive 8-bit characters tflags BODY_8BITS userconf endif updates_spamassassin_org/25_url_redirectors.cf 0000644 00000010504 15114422154 0015673 0 ustar 00 # SpamAssassin - URL redirector rules # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # @LICENSE> # ########################################################################### # SpamAssassin 4.0.2 version required ifplugin Mail::SpamAssassin::Plugin::Redirectors uri __FACEBOOK_SHARER m;https?://(?:www\.)?facebook\.com/sharer/sharer\.php;i body __GEN_REDIR_URLB eval:redir_url() meta __GEN_REDIR_URL __GEN_REDIR_URLB && !__FACEBOOK_SHARER describe __GEN_REDIR_URL Message has one or more redirected URLs body REDIR_URL_CHAINED eval:redir_url_chained() describe REDIR_URL_CHAINED Message has redirected URL chained to other redirectors score REDIR_URL_CHAINED 0.01 body REDIR_URL_MAXCHAIN eval:redir_url_maxchain() describe REDIR_URL_MAXCHAIN Message has redirected URL that causes too many redirections score REDIR_URL_MAXCHAIN 0.01 body REDIR_URL_LOOP eval:redir_url_loop() describe REDIR_URL_LOOP Message has redirected URL that loops back to itself score REDIR_URL_LOOP 0.01 # # Please only add entries that you manually verified as actual working # redirectors that can have abusable custom URLs. Adding non-abusable # services only generates unnecessary HTTP requests. # url_redirector .allaincemh.com url_redirector .australia4wdrentals.com url_redirector .awstrack.me url_redirector .benchurl.com url_redirector .blob.core.windows.net url_redirector .cc.rs6.net url_redirector .exactag.com url_redirector .hosted.phplist.com url_redirector .href.li url_redirector .maverickcrm.com url_redirector .msn.com url_redirector .msn.com.br url_redirector .yandex.net url_redirector .yandex.ru url_redirector auctiva.com url_redirector bing.com url_redirector cqbbs.cc url_redirector cdn.dragon.cere.network url_redirector channelchief.varindia.com url_redirector clickeu.crmact.com url_redirector email.mail.bloom.io url_redirector email.mg.evista.hu url_redirector flac24bitsearch.com url_redirector iplogger.com url_redirector .ittihad-institute.com url_redirector link.sowl.to url_redirector linklock.titanhq.com url_redirector links.e.shopmyexchange.com url_redirector mccarthysearch.com url_redirector mandrillapp.com url_redirector notifications.googleapis.com url_redirector post.spmailtechnolo.com url_redirector secure-web.cisco.com url_redirector trk.thesiden.com url_redirector_get .pstmrk.it url_redirector_get .defend.egress.com url_redirector_get .protection.sophos.com url_redirector_get .trustyshopping.su url_redirector_get app.getresponse.com url_redirector_get docsend.com url_redirector_get email.double.serviceautopilot.com url_redirector_get email.idxhome.co url_redirector_get flowcode.com url_redirector_get followup.cc url_redirector_get google.ae url_redirector_get google.al url_redirector_get google.be url_redirector_get google.ca url_redirector_get google.co.ls url_redirector_get google.co.uk url_redirector_get google.com url_redirector_get google.com.af url_redirector_get google.com.ag url_redirector_get google.cz url_redirector_get google.fr url_redirector_get google.de url_redirector_get google.es url_redirector_get google.it url_redirector_get google.mu url_redirector_get googleadservices.com url_redirector_get hdaud.io url_redirector_get linksmail.geosolinc.com url_redirector_get main.comweb.com url_redirector_get main.plieo.eu url_redirector_get t.nypost.com # generic list of likely active services endif updates_spamassassin_org/20_html_tests.cf 0000644 00000024762 15114422154 0014660 0 ustar 00 # SpamAssassin rules file: HTML tests # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # @LICENSE> # ########################################################################### require_version 4.000001 # HTML parser tests # # please sort these by eval type then name meta HTML_SHORT_LINK_IMG_1 __HTML_LENGTH_0000_1024 && __HTML_LINK_IMAGE meta HTML_SHORT_LINK_IMG_2 __HTML_LENGTH_1024_1536 && __HTML_LINK_IMAGE meta HTML_SHORT_LINK_IMG_3 __HTML_LENGTH_1536_2048 && __HTML_LINK_IMAGE describe HTML_SHORT_LINK_IMG_1 HTML is very short with a linked image describe HTML_SHORT_LINK_IMG_2 HTML is very short with a linked image describe HTML_SHORT_LINK_IMG_3 HTML is very short with a linked image meta HTML_SHORT_CENTER (__HTML_LENGTH_384 && __TAG_EXISTS_CENTER) describe HTML_SHORT_CENTER HTML is very short with CENTER tag meta HTML_TITLE_SUBJ_DIFF __HTML_TITLE_SUBJ_DIFF && !__MIME_ATTACHMENT meta HTML_CHARSET_FARAWAY (__HTML_CHARSET_FARAWAY && __HIGHBITS) describe HTML_CHARSET_FARAWAY A foreign language charset used in HTML markup tflags HTML_CHARSET_FARAWAY userconf meta HTML_MIME_NO_HTML_TAG MIME_HTML_ONLY && !__TAG_EXISTS_HTML describe HTML_MIME_NO_HTML_TAG HTML-only message, but there is no HTML tag meta HTML_MISSING_CTYPE (!__MIME_HTML && HTML_MESSAGE) describe HTML_MISSING_CTYPE Message is HTML without HTML Content-Type ########################################################################### # rawbody HTML tests rawbody HIDE_WIN_STATUS /<[^>]{1,1000}onMouseOver=[^>]{1,1000}window\.status=/i describe HIDE_WIN_STATUS Javascript to hide URLs in browser rawbody __OBFUSCATING_COMMENT_A /\w(?:]*>)+\w/ rawbody __OBFUSCATING_COMMENT_B /[^\s>](?:]*>)+[^\s<]/ ifplugin Mail::SpamAssassin::Plugin::HTMLEval ifplugin Mail::SpamAssassin::Plugin::MIMEEval meta OBFUSCATING_COMMENT ((__OBFUSCATING_COMMENT_A && HTML_MESSAGE) || (__OBFUSCATING_COMMENT_B && MIME_HTML_ONLY)) && !__ISO_2022_JP_DELIM describe OBFUSCATING_COMMENT HTML comments which obfuscate text endif endif # spams that are assembled from a Javascript array # look for the XOR op rawbody __JS_FROMCHARCODE /String\.fromCharCode\s*\(\s*\S+\s*\[\s*\S+\s*\]\s*\^/ rawbody __JS_DOCWRITE /document\.write/ meta JS_FROMCHARCODE (__JS_FROMCHARCODE && __JS_DOCWRITE) describe JS_FROMCHARCODE Document is built from a Javascript charcode array # a good possible rule that may resurface # ! $ % ' ( ) , - . / : ; = ? @ _ #rawbody ENTITY_DEC_OTHER /\&\#0*(?:3[3679]|4[014567]|5[89]|6[134]|95)\;/ #describe ENTITY_DEC_OTHER HTML contains needlessly encoded punctuation body __HIGHBITS /(?:[\x80-\xff].?){4}/ # note: __HIGHBITS is used by HTML_CHARSET_FARAWAY ########################################################################### ifplugin Mail::SpamAssassin::Plugin::HTMLEval # HTML control test, HTML spam rules should all have better S/O than this body HTML_MESSAGE eval:html_test('html') describe HTML_MESSAGE HTML included in message # HTML comment tests body HTML_COMMENT_SHORT eval:html_text_match('comment', '') describe HTML_COMMENT_SHORT HTML comment is very short body HTML_COMMENT_SAVED_URL eval:html_text_match('comment', '\w/ tflags __HTML_SHRT_CMNT_OBFU multiple maxhits=10 endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta __HTML_SHRT_CMNT_OBFU_MANY __HTML_SHRT_CMNT_OBFU > 5 && HTML_MESSAGE endif rawbody __HTML_SINGLET />\s*(?:[a-z"]|&\#(?:\d+|x[0-9a-f]+);)\s* 20 ifplugin Mail::SpamAssassin::Plugin::HTMLEval body __HTML_TAG_BALANCE_CENTER eval:html_tag_balance('center', '!= 0') endif body __HUSH_HUSH /\b(?:confiden[tc]i[ae]l(?:\b|ity\b|it(?:=E9|[\xe9]|[\xc3][\xa9]))|private\b|secr[e\xe8](?:te?|cy)\b|sensitive\b|concealed\b|obscured?\b|discre(?:et|tion)\b|very\sdiscrete|top\ssecret|vertraulich(?:en)?\b|geheim\b|priv(?:e|=E9|[\xe9]|[\xc3][\xa9]))/i uri __IMGUR_IMG m,^https?://(?:[^.]+\.)?imgur\.com/[a-z0-9]{7}\.(?:png|gif|jpe?g|webp)$,i tflags __IMGUR_IMG multiple maxhits=4 meta __IMGUR_IMG_2 __IMGUR_IMG == 2 meta __IMGUR_IMG_3 __IMGUR_IMG == 3 if !plugin(Mail::SpamAssassin::Plugin::ImageInfo) meta __IMG_LE_300K 0 endif ifplugin Mail::SpamAssassin::Plugin::ImageInfo body __IMG_LE_300K eval:pixel_coverage('all',62500,300000) endif uri __IMG_S3_AWS m;https://(?:[a-z0-9-]+)\.s3\.amazonaws\.com/uploads/[^./]{1,256}\.(?:jpe?g|gif|png|webp);i body __INHERIT_PMT /\binheritance\spayment\s/i body __INTL_BANK /\b(?:international\s(?:\w+\s)?bank|banque\sinternationale)\b/i body __INVEST_COUNTRY /\binvest\sin\syour?\scountry\b/i body __INVEST_MONEY /\binvest(?:ir)?\s(?:this|ces|d[ae]s|sur ce|de ces)\s(?:money|f[ou]nds?)\b/i header __IP_IN_RELAY X-Spam-Relays-External =~ /^\[ ip=(\d+)\.(\d+)\.(\d+)\.(\d+) (?:[^\]]* )?(?:rdns|helo)=\S*(?:\1\D\2\D\3\D\4|\4\D\3\D\2\D\1)/ if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader) meta __ISO_ATTACH 0 endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __ISO_ATTACH Content-Disposition =~ m,\bfilename="?[^"]+\.iso[";$],i endif if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader) meta __ISO_ATTACH_MT 0 endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __ISO_ATTACH_MT Content-Type =~ m,\bapplication/x-iso9660-image\b,i endif body __IS_LEGAL /\b(?:(?:(?:this|esta)\s(?:deal|offer|transac[tc]i(?:o|[\xc3][\xb3])n|proposal|exchange|arrangement|work)|it)?\s[ie]s\s(?:(?:guaranteed|completely|absolutely|perfectly|100%|very|fully)\s)?(?:legal|hitch-free|seguro|legitimate)|legitimate\sarrangement|toute?\sl(?:e|=E9|[\xe9]|[\xc3][\xa9])gale)\b/i body __IVORY_COAST /\b(?:Cote\s?D.Ivoire|Ivory\s?Coast|Costa\sde\sMarfil)\b/i body __I_INHERIT /\b(?:I|eu)\s[a-z\s]{0,30}(?:inherited|herdei)\b/i body __I_WILL_YOU /\bwill(?:ed)?\s(?:[a-z\s]{0,20}(?:fortune|money|\$[\d,]+[a-z]{0,9})\s)?to\syou\b/i header __JM_REACTOR_DATE Date =~ / \+0000$/ ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __JPEG_ATTACH Content-Type =~ /image\/jpe?g/i endif body __JP_INVOICE /\xE9\x80\x81\xE3\x82\x8A\xE7\x8A\xB6/ body __JP_MASTERCARD /\xE3\x83\x9E\xE3\x82\xB9\xE3\x82\xBF\xE3\x83\xBC\xE3\x82\xAB\xE3\x83\xBC\xE3\x83\x89/ body __JP_PASSWORD /\xE3\x83\x91\xE3\x82\xB9\xE3\x83\xAF\xE3\x83\xBC\xE3\x83\x89/ body __JP_PAYMENT /\xE6\x94\xAF\xE6\x89\x95\xE3\x81\x84/ body __JP_UPDATE_PAYMENT_INFO /\xE6\xB1\xBA\xE6\xB8\x88\xE6\x83\x85\xE5\xA0\xB1\xE3\x81\xAE\xE6\x9B\xB4\xE6\x96\xB0/ ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __KAM_BLOCK_UTF7_2 Content-Type =~ /charset=(?:unicode-\d+-\d+-)?utf-7/i endif ifplugin Mail::SpamAssassin::Plugin::BodyEval if can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length) body __KAM_BODY_LENGTH_LT_1024 eval:check_body_length('1024') describe __KAM_BODY_LENGTH_LT_1024 The length of the body of the email is less than 1024 bytes. endif endif ifplugin Mail::SpamAssassin::Plugin::BodyEval if can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length) body __KAM_BODY_LENGTH_LT_128 eval:check_body_length('128') describe __KAM_BODY_LENGTH_LT_128 The length of the body of the email is less than 128 bytes. endif endif ifplugin Mail::SpamAssassin::Plugin::BodyEval if can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length) body __KAM_BODY_LENGTH_LT_256 eval:check_body_length('256') describe __KAM_BODY_LENGTH_LT_256 The length of the body of the email is less than 256 bytes. endif endif ifplugin Mail::SpamAssassin::Plugin::BodyEval if can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length) body __KAM_BODY_LENGTH_LT_512 eval:check_body_length('512') describe __KAM_BODY_LENGTH_LT_512 The length of the body of the email is less than 512 bytes. endif endif if !plugin(Mail::SpamAssassin::Plugin::HTMLEval) meta __KAM_HTML_FONT_INVALID 0 endif ifplugin Mail::SpamAssassin::Plugin::HTMLEval body __KAM_HTML_FONT_INVALID eval:html_test('font_invalid_color') endif body __KAM_LOTTO2 /(?:(?:ticket|serial|lucky) number|secret pin ?code|batch number|reference number|promotion date)/is header __KB_DATE_CONTAINS_TAB Date:raw =~ /^\t/ header __KB_MSGID_OUTLOOK_888 Message-Id =~ /^<[0-9a-f]{8}(?:\$[0-9a-f]{8}){2}\@/ meta __KHOP_NO_FULL_NAME !(__NOT_A_PERSON || __FROM_ENCODED_QP || __FROM_NEEDS_MIME || __FROM_FULL_NAME) if !(can(Mail::SpamAssassin::Conf::feature_bug6558_free)) meta __LARGE_PERCENT_AFTER 0 endif if can(Mail::SpamAssassin::Conf::feature_bug6558_free) body __LARGE_PERCENT_AFTER /\d{3}% after/i tflags __LARGE_PERCENT_AFTER multiple maxhits=4 endif if !plugin(Mail::SpamAssassin::Plugin::HeaderEval) meta __LCL__ENV_AND_HDR_FROM_MATCH 0 endif ifplugin Mail::SpamAssassin::Plugin::HeaderEval meta __LCL__ENV_AND_HDR_FROM_MATCH __ENV_AND_HDR_FROM_MATCH endif if !plugin(Mail::SpamAssassin::Plugin::BodyEval) meta __LCL__KAM_BODY_LENGTH_LT_1024 0 endif ifplugin Mail::SpamAssassin::Plugin::BodyEval if !(can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length)) meta __LCL__KAM_BODY_LENGTH_LT_1024 0 endif endif ifplugin Mail::SpamAssassin::Plugin::BodyEval if can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length) meta __LCL__KAM_BODY_LENGTH_LT_1024 __KAM_BODY_LENGTH_LT_1024 endif endif if !plugin(Mail::SpamAssassin::Plugin::BodyEval) meta __LCL__KAM_BODY_LENGTH_LT_128 0 endif ifplugin Mail::SpamAssassin::Plugin::BodyEval if !(can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length)) meta __LCL__KAM_BODY_LENGTH_LT_128 0 endif endif ifplugin Mail::SpamAssassin::Plugin::BodyEval if can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length) meta __LCL__KAM_BODY_LENGTH_LT_128 __KAM_BODY_LENGTH_LT_128 endif endif if !plugin(Mail::SpamAssassin::Plugin::BodyEval) meta __LCL__KAM_BODY_LENGTH_LT_512 0 endif ifplugin Mail::SpamAssassin::Plugin::BodyEval if !(can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length)) meta __LCL__KAM_BODY_LENGTH_LT_512 0 endif endif ifplugin Mail::SpamAssassin::Plugin::BodyEval if can(Mail::SpamAssassin::Plugin::BodyEval::has_check_body_length) meta __LCL__KAM_BODY_LENGTH_LT_512 __KAM_BODY_LENGTH_LT_512 endif endif meta __LINKED_IMG_NOT_RCVD_LINK __URI_IMG_LINKEDIN && !__HDR_RCVD_LINKEDIN meta __LIST_PARTIAL __DOS_HAS_LIST_UNSUB && !__DOS_HAS_LIST_ID meta __LIST_PRTL_PUMPDUMP __LIST_PARTIAL && __PD_CNT_1 meta __LIST_PRTL_SAME_USER __LIST_PARTIAL && __TO_EQ_FROM_USR body __LITECOIN_ID /\b(?[^<\s]{1400}/i if can(Mail::SpamAssassin::Conf::feature_bug6558_free) meta __LONG_STY_INVIS __STY_INVIS_2 && __LONGLINE endif if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags) meta __LOTSA_MONEY_00 0 endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __LOTSA_MONEY_00 /[\s\.]?[\dOo][,\.][\dOo]{3}(?:(?!\d)|\b)/ endif if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags) meta __LOTSA_MONEY_01 0 endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __LOTSA_MONEY_01 /(?:(?i:sum\sof\s)[\(\[]?|\s?)[\s\.]?[\d.,\sOo]{5,20}[\dOo](?[\d.,\sOo]{5,20}[\dOo][\)\]\(]?\s?(?:|Pounds|(?i:dollars?|bucks))[\s\b]/ endif if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags) meta __LOTSA_MONEY_03 0 endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __LOTSA_MONEY_03 /(?:(?i:sum\sof\s)[\(\[]?|\s?)[\d.,\sOo]{0,5}[\)\]]?\s?(?i:M(?i:il+)?\b|mil+(?i:io|)n|hund?[re]+a?[dt]|thousand|tausend|milh[\xf5]es)/ endif if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags) meta __LOTSA_MONEY_04 0 endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __LOTSA_MONEY_04 /(?:(?[\d\.,]{0,4}(?:M|\smilli?one?s|\s?mln)|million(?!s)|milln|hund?rea?d(?!s)[^\.]{1,25}thousand(?!s)|cents?[^\.]{1,25}mille|hundert[^\.]{1,30}tausend|ientos?[^\.]{1,20}mil|cent[a-z\s]{1,20}mil\s[a-z]{1,20}centos)[^\.\$]{0,50}?(?:(?:U\.?\s?S\.?\s?(?:A\.?\s?)?|united\s?states\s|E\.\s?U\.\s|canad(?:ian|a)\s|(?:ia\s)?de\s)?d(?:[o\xf3]|[\xc3][\xb3])l+are?s?|\bbucks|U\s?S\s?D|G\s?B\s?P|\spounds?|(?:\s)?pounds?\ssterling|pounds(?!\sof)|(?:d'\s?)?euros?|francs?)\b/i endif if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags) meta __LOTSA_MONEY_05 0 endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __LOTSA_MONEY_05 /(?:(?:sum|value|amount)\sof\s)[\d.,\sO]{7,20}[\dO\.][\)\]\(\s]{0,3}(?:pounds?|dollars?|euros?|bucks)\b/i endif meta __LOTTO_ADMITS __LOTTO_ADMITS_1 || __LOTTO_ADMITS_2 || __LOTTO_ADMITS_3 || __LOTTO_ATTACH_1 || __LOTTO_ATTACH_2 body __LOTTO_ADMITS_1 /\b(?:on-?line|e-?mail|ballot|(?:inter)?national|state|(?:UK|euro)[- ]?(?:mil+ions?|PW)|Canada|Microsoft|MSN|internet|mega|jackpot+|Royal Heritage|foundation|cash\sgrant|mercato|univers|staatsloterij|bill\s?gates|Olympics?|swiss|this|est[ea]|internationaux de gagnants de)(?:\s(?!lot|swe|prom)\w{1,20}){0,3}\s?(?:lot(?:to|t+ery|eri[ea])|sweepstakes?|promo(?:tion|cao|cion)?|jackpot+)\b/i body __LOTTO_ADMITS_2 /\b(?:free)?(?:lot(?:to|tery|erie)|sweepstakes)\s(?:(?:inter)?na[tz]ional|department|bureau|group|award|microsoft)/i uri __LOTTO_ADMITS_3 /lott+ery/i meta __LOTTO_AGENT __LOTTO_AGENT_01 || __LOTTO_AGENT_02 body __LOTTO_AGENT_01 /\b(?:(?:(?:the|y?our)(?:\s\w{1,20})?|contact|accredited|listed)\sclaim(?:s|ing)?(?:\sprocessing)?|fiducia\w+|reimbursement|(?:prize|international|intl|foreign|win+ing)(?:[\s,.]+(?:rem+it+ance|settlement|payment|payout|award|transfer))+|payment|payout|immunity|(? 1 meta __MANY_SPAN_IN_TEXT (__SPAN_BEG_TEXT > 4) && (__SPAN_END_TEXT > 4) header __MID_START_001C Message-ID =~ /^<000001c/ body __MILLIONS /\bmillions\sof\s(?:dollar|euro|pound)/i header __MIMEOLE_1106 X-MimeOLE =~ /^Produced By Microsoft MimeOLE V6.00.2800.1106$/ meta __MIMEOLE_DIRECT_TO_MX __HAS_MIMEOLE && __DOS_DIRECT_TO_MX header __MIME_BDRY_0D0D Content-Type =~ /boundary="-{12}(?:0[1-9]){12}/ if !((version >= 3.004000)) meta __MIME_CTYPE_IN_BODY 0 endif if (version >= 3.004000) body __MIME_CTYPE_IN_BODY /^Content-Type:\s/ endif if !((version >= 3.004000)) meta __MIME_MALF 0 endif if (version >= 3.004000) meta __MIME_MALF __CTYPE_MULTIPART_ANY && __MIME_CTYPE_IN_BODY endif if !plugin(Mail::SpamAssassin::Plugin::MIMEHeader) meta __MIME_NO_TEXT 0 endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader meta __MIME_NO_TEXT (__CTYPE_MULTIPART_ANY && !__ANY_TEXT_ATTACH) endif ifplugin Mail::SpamAssassin::Plugin::MIMEEval rawbody __MIME_QPC eval:check_for_mime('mime_qp_count') endif header __MISSING_REF References =~ /^UNSET$/ [if-unset: UNSET] header __MISSING_REPLY In-Reply-To =~ /^UNSET$/ [if-unset: UNSET] rawbody __MIXED_AREA_CASE /<(?!AREA|area)[Aa][Rr][Ee][Aa]\s/ rawbody __MIXED_CENTER_CASE /<(?!CENTER|center)[Cc][Ee][Nn][Tt][Ee][Rr]>/ rawbody __MIXED_FONT_CASE /<(?!FONT|font)[Ff][Oo][Nn][Tt]\s/ describe __MIXED_HREF_CASE Has anchor tags with mixed-up cases in non-quoted lines meta __MIXED_HREF_CASE __HAS_HREF - __HAS_HREF_ONECASE > 0 rawbody __MIXED_IMG_CASE_JH /<(?!IMG|img)[Ii][Mm][Gg]\s/ header __MOLE_2962 X-MimeOLE =~ /^Produced\ By\ Microsoft\ MimeOLE\ V6\.00\.2900\.2962$/ meta __MONERO (__MONERO_ID || __MONERO_CURNCY || __URI_MONERO || __FUZZY_MONERO) body __MONERO_CURNCY /Monero \(XMR\)/ body __MONERO_ID /\b4[0-9AB][1-9A-HJ-NP-Za-km-z]{93,104}\b/ meta __MONEY_ATM_CARD LOTS_OF_MONEY && __ATM_CARD meta __MONEY_FORM LOTS_OF_MONEY && __FILL_THIS_FORM meta __MONEY_FORM_SHORT LOTS_OF_MONEY && __FILL_THIS_FORM_SHORT meta __MONEY_FRAUD_3 LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX + __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 3) meta __MONEY_FRAUD_5 LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX + __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 5) meta __MONEY_FRAUD_8 LOTS_OF_MONEY && (__FRAUD_VQE + __FRAUD_KJV + __FRAUD_IRJ + __FRAUD_NEB + __FRAUD_XJR + __FRAUD_DPR + __FRAUD_BEP + __FRAUD_TDP + __FRAUD_GAN + __FRAUD_IRT + __FRAUD_AON + __FRAUD_WNY + __FRAUD_IPK + __FRAUD_QXX + __FRAUD_IOV + __FRAUD_MLY + __FRAUD_ULK + __FRAUD_BGP + __FRAUD_YWW + __FRAUD_JYG + __FRAUD_XWW + __FRAUD_UUY + __FRAUD_SNT + __FRAUD_JNB + __FRAUD_QFY + __FRAUD_WDR + __FRAUD_WFC + __FRAUD_AUM + __FRAUD_MCQ + __FRAUD_PVN + __FRAUD_FVU + __FRAUD_CKF + __FRAUD_MQO + __FRAUD_TCC + __FRAUD_GBW + __FRAUD_AXF + __FRAUD_THJ + __FRAUD_YQV + __FRAUD_YJA + __FRAUD_YPO + __FRAUD_UOQ + __AFRICAN_STATE + __AGREED_RATIO + __AM_DYING + __ATM_CARD + __BACK_SCRATCH + __BARRISTER + __BENEFICIARY + __COMPENSATION + __CONTACT_ATTY + __CONTACT_YOU + __COURIER + __DEAD_PARENT + __DEAL + DEAR_BENEFICIARY + DEAR_WINNER + __DECEASED + __DESTROY_ME + __DIED_IN + __DIPLOMATIC + __DORMANT_ACCT + __EARLY_DEMISE + EMRCP + __EX_CUSTOMER + __FEES + __FIFTY_FIFTY + __FOUND_YOU + __FRAUD + __FRAUD_PTX + __HUSH_HUSH + __I_INHERIT + __INHERIT_PMT + __INTL_BANK + __INVEST_COUNTRY + __INVEST_MONEY + __IS_LEGAL + __I_WILL_YOU + __KAM_LOTTO2 + __LOTTO_ADMITS + LOTTO_AGENT + __LOTTO_DEPT + __LOTTO_RELATED + __LOTTO_VERIFY + T_LOTTO_URI + __LOTTO_WIN_01 + __LOTTO_WINNINGS + __LUCKY_WINNER + __LUCRATIVE + __MILLIONS + __MY_FORTUNE + __NEXT_OF_KIN + __NOT_DEAD_YET + __NOT_SCAM + __OUR_BEHALF + __SCAM + __SHARE_IT + __SUM_OF_FUND + __SURVIVORS + __THEY_INHERIT + __TRTMT_DEFILED + __TRUNK_BOX + __UN + UNCLAIMED_MONEY + __WIDOW + __WILL_LEGAL + __XFER_MONEY + __YOU_ASSIST + __YOU_INHERIT + __YOUR_BANK + __YOUR_FUND + __YOUR_PERM + __YOUR_PROFIT + __YOU_WON + T_LOTTO_AGENT_FM + T_LOTTO_AGENT_RPLY + __PCT_FOR_YOU + __PCT_OF_PMTS + __RANDOM_PICK + __CHARITY > 8) ifplugin Mail::SpamAssassin::Plugin::FreeMail meta __MONEY_FREEMAIL_REPTO LOTS_OF_MONEY && __freemail_hdr_replyto endif meta __MONEY_FROM_41 __NSL_RCVD_FROM_41 && LOTS_OF_MONEY body __MOVE_MONEY /\b(?:(?:receive|re-?profile|transfer(?:ring|ir|t)?|release|repatriat(?:e|ion)|rapatrier|secure|r(?:e|=E9|[\xe9]|[\xc3][\xa9])clamation|possession|virer|dona(?:te|r)|depositante|dep[\xc3][\xb3]sito)\s(?:th(?:e(?:se)?|is)|d[ae]s|sur ce|de ce[st]|cet|est[eao]s?|del?)|re-?profiling|receive|re-?locat(?:e|ing)(?:\s\w{1,15})?)\s(?:of\s|your\s|the\s){0,2}(?:sums?\sof\s|inheritance\s)?(?:proceeds|funds?|money|balance|account|g[eo]ld|compte|fond[so]{1,2}|dinero|argent)\b/i meta __MSGID_DOLLARS_URI_IMG __MSGID_DOLLARS_MAYBE && __HAS_ANY_URI && __HTML_LINK_IMAGE header __MSGID_GUID Message-ID =~ /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}\@/i header __MSGID_HEXISH Message-ID =~ /^/m meta __MSM_PRIO_REPTO __HAS_MSMAIL_PRI && __HAS_REPLY_TO && __SUBJ_SHORT header __MSOE_MID_WRONG_CASE ALL =~ /\nMessage-Id: / ifplugin Mail::SpamAssassin::Plugin::MIMEHeader mimeheader __MSO_THEME_MT Content-Type =~ m,\bapplication/vnd.ms-officetheme\b,i endif header __MTLANDROID_MUA X-Mailer =~ /\bMotorola android mail \d+\.\d/ header __MUA_TBIRD User-Agent =~ /^Mozilla\/.* Thunderbird/ uri __MXG_HAS_PHONE04 /^tel:/ ifplugin Mail::SpamAssassin::Plugin::URIDetail header __MXG_LOWER_HDR ALL:raw =~ /^(from|to|subject):\s/m # score __MXG_LOWER_HDR 0.1 describe __MXG_LOWER_HDR lower case header endif body __MXG_PHONE_OBFU /(?!(1\W*)?\d{3}\W+\d{3}\W+\d{4})\b([1I][^a-zA-Z0-9]*)?[\dOIl]{3}[^a-zA-Z0-9]+[\dOIl]{3}[^a-zA-Z0-9]+[\dOIl]{4}\b/ describe __MXG_PHONE_OBFU Has an obfuscated phone number ifplugin Mail::SpamAssassin::Plugin::URIDetail meta __MXG_UNSUB_LINK __MXG_UNSUB_LINK01 || __MXG_UNSUB_LINK02 || __MXG_UNSUB_LINK03 describe __MXG_UNSUB_LINK Contains an unsubscribe link endif ifplugin Mail::SpamAssassin::Plugin::URIDetail uri __MXG_UNSUB_LINK02 /\b(?:unsub|opt(?:ing)?.?out)\b/i endif ifplugin Mail::SpamAssassin::Plugin::URIDetail rawbody __MXG_UNSUB_LINK03 /click here<\/a> to unsubscribe/i endif body __MY_FORTUNE /\b(?:my|his|her)\s(?:fortune|heritage)\b/i if !plugin(Mail::SpamAssassin::Plugin::ReplaceTags) body __MY_MALWARE /\b(?:(?:I(?:'ve|\shave)?\s(?:put|set\s?up|installed|buil[td]\sin|placed)\s(?:a\s)?|my\s(?:personal\s|background\s|hidden\s)?)(?:mal+ware|virus|spy\s?ware|trojan|program\srecorded|expl[o0]it|backdoor|(?:sneaky\s|hidden\s|malicious\s)+(?:app|stuff))|(?:application|mal+ware)[^\.]{1,30}(?:enable[sd]|allow(?:s|ed))\sme\sto\s(?:access|control)|I\s(?:contaminated|infected|hacked|toxified|poisoned)\s(?:your|this)\s(?:machine|computer|gadget|(?:smart\s?)?phone|device|email)|Anwendung\s[^\.]{1,50}\sich\sauf\salle\sIhre\sdarauf\sgespeicherten\sDateien\szugreifen\skann|mein\shinterhältiges\sProgramm|I\s?am\s?a\s?hacker|(?:(?:trojan|virus|spyware|mal+ware)\s)+giv(?:es|ing)\sme)\b/i endif ifplugin Mail::SpamAssassin::Plugin::ReplaceTags body __MY_MALWARE /(?:^|\s)(?:(?:(?:'|\s)?\s(?:<|>\s?||(?:|)\s|)\s(?:\s)?|\s(?:\s|\s|\s)?)(?:+||\s?||\s|(?:|0)||(?:\s|\s|\s)+(?:|))|(?:|+)[^\.]{1,30}(?:(?:|)|(?:|))\s\s\s(?:|)|\s(?:||||)\s(?:
<|>\s?||(?:|)\s|)\s(?:\s)?|\s(?:\s|\s|\s)?)(?:+||\s?||\s|(?:|0)||(?:\s|\s|\s)+(?:|))|(?:|+)[^\.]{1,30}(?:(?:|)|(?:|))\s\s\s(?:|)|\s(?:||||)\s(?:
||(?:|)\s|)\s(?:\s)?|\s(?:\s|\s|\s)?)(?:+||\s?||\s|(?:|0)||(?:\s|\s|\s)+(?:|))|(?:|+)[^\.]{1,30}(?:(?:|)|(?:|))\s\s\s(?:|)|\s(?:||||)\s(?:
)\s(?:\s)?|\s(?:\s|\s|\s)?)(?:+||\s?||\s|(?:|0)||(?:\s|\s|\s)+(?:|))|(?:|+)[^\.]{1,30}(?:(?:|)|(?:|))\s\s\s(?:|)|\s(?:||||)\s(?:
\s|\s|\s)?)(?:+||\s?||\s|(?:|0)||(?:\s|\s|\s)+(?:|))|(?:|+)[^\.]{1,30}(?:(?:|)|(?:|))\s\s\s(?:|)|\s(?:||||)\s(?:
\s?||\s|(?:|0)||(?:\s|\s|\s)+(?:|))|(?:|+)[^\.]{1,30}(?:(?:|)|(?:|))\s\s\s(?:|)|\s(?:||||)\s(?:
\s|(?:|0)||(?:\s|\s|\s)+(?:|))|(?:|+)[^\.]{1,30}(?:(?:|)|(?:|))\s\s\s(?:|)|\s(?:||||)\s(?:
(?:|0)||(?:\s|\s|\s)+(?:|))|(?:|+)[^\.]{1,30}(?:(?:|)|(?:|))\s\s\s(?:|)|\s(?:||||)\s(?:
|))|(?:|+)[^\.]{1,30}(?:(?:|)|(?:|))\s\s\s(?:|)|\s(?:||||)\s(?:
|+)[^\.]{1,30}(?:(?:|)|(?:|))\s\s\s(?:|)|\s(?:||||)\s(?:
)\s(?: