score QMAILBOUNCE 2
# don 2009-02-05 (the following are all for various stupid auto-repsonse things)
-header RECEIVEDMAIL subject =~ /received\s*your\s*mail/i
-describe RECEIVEDMAIL It's great that you've received our mail; we don't care
+header RECEIVEDMAIL subject =~ /(?:received\s*your\s*mail|(?:respuesta|risposta|response) (?:autom.tica|automatic)|auto(?:matic|m.tica)?\s*(?:respuesta|risposta|response))/i
+describe RECEIVEDMAIL It's great that you've received our mail and automatically responded. We don't care
score RECEIVEDMAIL 4
+body AUTOREBOD /(?:received\s*your\s*mail|(?:respuesta|risposta|response) (?:autom.tica|automatic)|auto(?:matic|m.tica)?\s*(?:respuesta|risposta|response))/i
+describe AUTOREBOD It's great that you've automatically responded
+score AUTOREBOD 2
+
header YOURMESSAGE subject =~ /your message/i
describe YOURMESSAGE It's great that our message did something; we don't care
score YOURMESSAGE 2.5
describe NOTPROCBOUNCE Bounce by system that was not processed
score NOTPROCBOUNCE 2
-body ACCOUNTNOTEXIST /account\s+\S+\s+(does\s*not|doesn't)\s*exist/
-describe ACCOUNTNOTEXIST It's not our problem if an account doesn't eixst
+body ACCOUNTNOTEXIST /(?:account\s+\S+\s+(does\s*not|doesn't)\s*exist|(?:invalid|not a valid) e-?mail address)/i
+describe ACCOUNTNOTEXIST It's not our problem if an account doesn't exist
score ACCOUNTNOTEXIST 2
body CR_SYSTEM1 /sent by a human and not a computer/i
score SUPPORTMAIL2 1.5
body SUPPORTMAIL3 /the email address \S+ is not registered/i
-describe SUPORTMAIL3 We don't care if an e-mail address is not registered
+describe SUPPORTMAIL3 We don't care if an e-mail address is not registered
score SUPPORTMAIL3 1.5
body SUPPORTMAIL4 /(reached an unmonitored e-mail address|no response will be given)/i
score SUPPORTMAIL5 1.5
-header FROMAUTOREPLY from =~ /(autoreply|no-?reply)/i
+header FROMAUTOREPLY from =~ /(autoreply|no-?repl(?:y|ies))/i
describe FROMAUTOREPLY Message from an autoreplier or something who doesn't seem to want a reply
score FROMAUTOREPLY 4
+header FROMABUSE from =~ /\babbuse\@/i
+describe FROMABUSE Message from abbuse@somedomain
+score FROMABUSE 1.5
+
+header FROMSPAMCOP from =~ /spamcop\@/i
+describe FROMSPAMCOP Message from spamcop@somedomain
+score FROMSPAMCOP 3.5
+
+header SUBJECTSPAM subject =~ /(?:\*\*|\[)\s*spam\s*(?:\*\*|\])/i
+describe SUBJECTSPAM Subject contains **spam** or [spam], so it's probably spam
+score SUBJECTSPAM 3.5
+
+header MESBLOCKED subject =~ /your message (?:is )?blocked/i
+describe MESBLOCKED That's great that our message was blocked
+score MESBLOCKED 2
+header FAILDELIVERY subject =~ /failed to deliver/i
+describe FAILDELIVERY Oh noes! You failed to deliver spam!
+score FAILDELIVERY 2