# -*- mode: spamassassin -*- # Added some rules from Rule du Jour that I've been testing for a while #Monotone (from airmax.cf) body MONOTONE_WORDS_2_15 /^([a-z]{2,20}[\s\.]+){15}/ describe MONOTONE_WORDS_2_15 Lines with many (long) lowercase words (15+ words, 2+ letters) body MONOTONE_WORDS_2_30 /^([a-z]{2,20}[\s\.]+){30}/ describe MONOTONE_WORDS_2_30 Lines with many (long) lowercase words (30+ words, 2+ letters) body MONOTONE_WORDS_3_20 /^([a-z]{3,20}[\s\.]+){20}/ describe MONOTONE_WORDS_3_20 Lines with many (long) lowercase words (20+ words, 3+ letters) body MONOTONE_WORDS_5_8 /^([a-z]{5,20}[\s\.]+){8}/ describe MONOTONE_WORDS_5_8 Lines with many (long) lowercase words (8+ words, 5+ letters) body MONOTONE_WORDS_5_12 /^([a-z]{5,20}[\s\.]+){12}/ describe MONOTONE_WORDS_5_12 Lines with many (long) lowercase words (12+ words, 5+ letters) body MONOTONE_WORDS_5_20 /^([a-z]{5,20}[\s\.]+){20}/ describe MONOTONE_WORDS_5_20 Lines with many (long) lowercase words (20+ words, 5+ letters) # Lots of auto-responders seem to have this body MDO_AUTORESP1 /online form/i score MDO_AUTORESP1 0.1 body MDO_AUTORESP2 /large amount of (spam|virus)/i score MDO_AUTORESP2 0.1 body MDO_AUTORESP3 /(electronically|automatically) (generated|created) (email|ack)/i score MDO_AUTORESP3 0.1 body MDO_AUTORESP4 /(respond|answer) your enquiry/i score MDO_AUTORESP4 0.1 body MDO_AUTORESP5 /(email|enquiry) has been received/i score MDO_AUTORESP5 0.1 body MDO_AUTORESP6 /will be answered within/i score MDO_AUTORESP6 0.1 body MDO_AUTORESP7 /the e-mail address to which you have written does not support incoming messages/i score MDO_AUTORESP7 0.1 meta MDO_AUTORESP_META1 (MDO_AUTORESP1 + MDO_AUTORESP2 + MDO_AUTORESP3 + MDO_AUTORESP4 + MDO_AUTORESP5 + MDO_AUTORESP6 + MDO_AUTORESP7) > 1 score MDO_AUTORESP_META1 2.0 body MURPHY_DIPLOMA /dip[l1]omas?/i describe MURPHY_DIPLOMA No Diploma score MURPHY_DIPLOMA 1 body MURPHY_CALORIES /calories/ describe MURPHY_CALORIES No Calories score MURPHY_CALORIES 1 header MURPHY_CONTENT_GIF Content-Type =~ /image\/gif/ describe MURPHY_CONTENT_GIF Content contains image/gif score MURPHY_CONTENT_GIF 1 # cable tv spam -- pasc 04/05/11-12 body MDO_CABLE_TV1 /pay.?per.?view/i score MDO_CABLE_TV1 0.5 body MDO_CABLE_TV2 /mature.?channel/i score MDO_CABLE_TV2 0.5 body MDO_CABLE_TV3 /c(\@|a)ble/i score MDO_CABLE_TV3 0.5 body MDO_CABLE_TV4 /rem(o|0)te.?control/i score MDO_CABLE_TV4 0.5 meta MDO_CABLE_META1 (MDO_CABLE_TV1 || MDO_CABLE_TV2 || MDO_CABLE_TV4) && (MDO_CABLE_TV3) describe MDO_CABLE_META1 Too much cable stuff score MDO_CABLE_META1 3 header MDO_TAGSPAM1 Subject =~ /Unknown Tag *free* Please Fix/ score MDO_TAGSPAM1 4 body MDO_BAD_WORD1 /PORTFOLIO/i score MDO_BAD_WORD1 2.8 # blarson, 2004-04-30 -> lists --pasc 04/05/11 body AFFILIATEID /affiliate.?id/i describe AFFILIATEID affiliate id score AFFILIATEID 3 # blarson 2007-07-13 header REFWD subject =~ /\b(?:RE|FWD?|AW)(?:\[\d+\])?\:\s*$/i describe REFWD re or fwd nothing score REFWD 3.5 # blarson 2005-11-11 header ONEWORD subject =~ /^(?:Fw:|re:)?\s*\S+\s*$/i describe ONEWORD one word subject score ONEWORD 2 # robot101, 2003-09-22 header CROSSWALK X-UnityUser =~ /^Crosswalk.com, Inc/ describe CROSSWALK Crosswalk bible mailing list score CROSSWALK 3 header CROSSWALK_SPAM From =~ /Crosswalk/ describe CROSSWALK_SPAM Crosswalk Spam score CROSSWALK_SPAM 1 # -- joy, 2003-06-28 header BOMDIA Subject =~ /Bom dia / describe BOMDIA Bom dia, usually some Romanic language spam score BOMDIA 2 header RCVD_FROM_UNCONF_HOST Received =~ /^from localhost.localdomain/ describe RCVD_FROM_UNCONF_HOST Mail comes from a host with unconfigured mailer daemon score RCVD_FROM_UNCONF_HOST 2 # joy, 2003/01/25 body ECOSPAM /Corridas de Toros para los turistas Ingleses en Barcelona/ describe ECOSPAM Eco-spam all right score ECOSPAM 5.0 # cjwatson, 2003/02/24 body SPANISH_FORM_CGI /Este formulario fue enviado por/ describe SPANISH_FORM_CGI "Below is the result of your feedback form", eh? score SPANISH_FORM_CGI 4.0 # joy, 2003-06-18 body TRAFFICMAGNET /Become a TrafficMagnet Reseller/ describe TRAFFICMAGNET SpamMagnet score TRAFFICMAGNET 4 # joy, 2003-06-27 header BKR Subject =~ /^bkr/ describe BKR bkr spam score BKR 4 # joy, 2003-06-27 header RISEANDSHINE Subject =~ /^Rise and Shine in 15 minutes/ describe RISEANDSHINE Rise and Shine in 15 minutes spam score RISEANDSHINE 4 # joy, 2003-09-20 header UNIVDIP Subject =~ /U N I V E R S I T Y . D I P L O M A S/i describe UNIVDIP university diplomas spam score UNIVDIP 4 # joy, 2003-09-21 header YOUTHERE Subject =~ /^(Re: )?You/i describe YOUTHERE Who, me? Likely spam score YOUTHERE 2 # cjwatson, 2003-11-20 header HOUSECLEANING Subject =~ /^Affordable Housecleaning Service/ describe HOUSECLEANING let's clean out the spam instead score HOUSECLEANING 3 # cjwatson, 2003-12-11 header OTC_FIRST Subject =~ /OTC FIRST ALERT/ describe OTC_FIRST OTC spam score OTC_FIRST 3 # joy, 2004-01-03 body AVAILABLENOW /available now/i describe AVAILABLENOW must be selling some shit score AVAILABLENOW 1 # cjwatson, 2004-01-16 body TEDIOUS_WITTER /If not i included it below so let me know if you like it/ describe TEDIOUS_WITTER annoying wittering spam, mypillsource.com I think score TEDIOUS_WITTER 2 # cjwatson, 2004-03-12 # blarson 2004-06-09 header UNI_DIPLOMA subject =~ /\b(?:university|college|doctora+te|bache+lor|maste+rs?)[\/\s]+(?:(dip[l1][o0]ma|cert|degree)|(?:university|college|doctora+te|bache+lor|maste+rs?))/i describe UNI_DIPLOMA Got a diploma, thanks score UNI_DIPLOMA 4 # blarson 2004-04-27 body UNI2 /university\s+(diploma|cert|degree)/i describe UNI2 Got one, thanks score UNI2 4 # don 2007-11-03 body UNI3 /(?:(?:maste+rs|batche+lor|m\s*b\s*a\s*|ph\.?\s*d|doctora+te)\s*[,.\/]?\s*){2,}/i describe UNI3 multiple types of degrees score UNI3 2 # cjwatson, 2004-03-12 header JOB_CONFIRM Subject =~ /Job confirmation/ describe JOB_CONFIRM Got one of these too, thanks score JOB_CONFIRM 3 # blarson 2005-09-20 header MESSAGESUB subject =~ /^\s*\(?message\s*(subject)?\)?$/i describe MESSAGESUB really descriptive subject score MESSAGESUB 3 # blarson 2006-03-16 2007-09-18 not working, replaced 2007-12-08 # body DEARDIGIT /^(?:well\s+)?(?:Dear|Hey|H[ea]y?ll?.?o|To|Attention|Hi+|Hey+a?|Bonjorno|(?:Yo\s*)+|(?:g[o0]+d\s*)?(?:d?ay|morning|evening?|afternoon|night)|what.?i?s\s+up|wa(?:s|z)+up|greetings?|Salutations|(Mail|News)\s+to|how(?:.?s|\s+is)?\s*(?:(?:it)?(?:\s+is)??\s*going|have\s+you\s+been|are you).?\s*(?:there|to\s+you)?|compliments|Regards|Adieu)\,?\s+(?:Account\s+\#?|\=?3d|)(?:bro|there|sir|Mr\.?)\s*?\d{3,}/i body DEARDIGIT /^\s*(?:Good\s*)?(?:evenin|night|day|hi|hello|greetin|Compliment|Wa[sz]+up|dear|Regard|Mornin|(?:yo\s*)+)[sg]?\s+(?:there\s+)?\d{3,}/i describe DEARDIGIT Dear number score DEARDIGIT 3.9 # blarson 2004-11-08 header SIZEMATTERS subject =~ /^S.ze matters$/i describe SIZEMATTERS Size matters spammer score SIZEMATTERS 3 # cjwatson 2005-01-02 header RNDMX subject =~ /^