header NO_REAL_NAME From =~ /^[\"\\s]*\\<?\\S+\\@\\S+\\>?\\s*$/ header FROM_ENDS_IN_NUMS From =~ /\\d\\d\\@/ header FROM_STARTS_WITH_NUMS From =~ /^\\d\\d/ header FROM_HAS_MIXED_NUMS From =~ /\\d+[a-z]+\\d+\\S*@/i header FROM_NO_USER From =~ /(?:^\\@|<\\@| \\@[^<]*$|<>)/ [if-unset: unset@unset.unset] header FROM_NAME_NO_SPACES From =~ /(^(?!=\\?)\\S+\\s*<\\S+\\@\\S+>|\\(\\S+\\)$)/ header TO_NO_USER To =~ /(?:^\\@|<\\@| \\@[^<]*$|<>)/ [if-unset: unset@unset.unset] header TO_MALFORMED To !~ /(?:(?:\\\"[^\\\"]+\\\"|\\S+)\\@\\S+\\.\\S+|undisclosed-recipients:|<\\S+(\\!\\S+){1,}>)/ [if-unset: unset@unset.unset] header TO_LOCALPART_EQ_REAL To =~ /^\\s*(\\\"?)([\\w%\\+\\-=_\\.]+)\\1\\s*<\\2\\@[\\w%\\+\\-=_\\.]+>/i header FROM_MALFORMED From !~ /(?:\\\"[^\\\"]+\\\"|\\S+)\\@\\S+\\.\\S+|<\\S+(\\!\\S+){1,}>/ [if-unset: unset@unset.unset] header PLING Subject =~ /!/ header PLING_PLING Subject =~ /!!!+/ header SUBJ_HAS_UNIQ_ID eval:check_for_unique_subject_id() header SUBJ_HAS_SPACES Subject =~ /(?:\\s{6,}|\\t)/ header UNDISC_RECIPS To =~ /^undisclosed-recipients?:\\s*;$/ header FAKED_UNDISC_RECIPS To =~ /Undisclosed.*Recipient(s[^:]|[^s])/i header TO_INVESTORS To =~ /\\bInvestors\\@/ header SUBJ_ALL_CAPS eval:subject_is_all_caps() header SUBJ_MISSING Subject !~ /\\S/ header MSGID_HAS_NO_AT Message-Id !~ /\\@/ [if-unset: NO@MSGID] header MSGID_SPAMSIGN_1 Message-Id =~ /^<[0-9a-f]{12,12}\\$[0-9a-f]{8,8}\\$[0-9a-f]{8,8}\\@>$/ header MSGID_CHARS_SPAM Message-Id =~ /[\\#:}{,!\\/]/ header MSGID_CHARS_WEIRD Message-Id =~ /[\"=\\\\~]/ header INVALID_MSGID Message-Id !~ /^<(?:\\\".+\\\"|[^\\s]+)\\@(?:\\[.+\\]|[^\\s]+)>$/ [if-unset: <NO@MSGID>] header INVALID_DATE Date !~ /^((Sun|Mon|Tue|Wed|Thu|Fri|Sat), )?([\\d ]?\\d) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\\d\\d|\\d\\d\\d\\d) \\d\\d:\\d\\d(:\\d\\d)? (UT|[A-Z]{3,5}|[+-]\\d\\d\\d\\d)(\\s+\\(.*\\))?\\s*$/ header INVALID_DATE_TZ_ABSURD Date =~ /[-+](?:1[4-9]\\d\\d|[2-9]\\d\\d\\d)$/ header DATE_YEAR_ZERO_FIRST Date =~ /[a-z]\\s+0\\d\\d\\d(\\s|$)/ header DATE_IN_PAST_03_06 eval:check_for_shifted_date('-6', '-3') header DATE_IN_PAST_06_12 eval:check_for_shifted_date('-12', '-6') header DATE_IN_PAST_12_24 eval:check_for_shifted_date('-24', '-12') header DATE_IN_PAST_24_48 eval:check_for_shifted_date('-48', '-24') header DATE_IN_PAST_48_96 eval:check_for_shifted_date('-96', '-48') header DATE_IN_PAST_96_XX eval:check_for_shifted_date('undef', '-96') header DATE_IN_FUTURE_03_06 eval:check_for_shifted_date('3', '6') header DATE_IN_FUTURE_06_12 eval:check_for_shifted_date('6', '12') header DATE_IN_FUTURE_12_24 eval:check_for_shifted_date('12', '18') header DATE_IN_FUTURE_24_48 eval:check_for_shifted_date('24', '48') header DATE_IN_FUTURE_48_96 eval:check_for_shifted_date('48', '96') header DATE_IN_FUTURE_96_XX eval:check_for_shifted_date('96', 'undef') header SUBJ_HAS_Q_MARK Subject =~ /\\?.{2,}$/ header SUBJ_ENDS_IN_Q_MARK Subject =~ /\\?+\\s*$/ header ADVERT_CODE Subject =~ /(^\\s*|\\s+)ADV([\\s:-]|$)/i header KOREAN_UCE_SUBJECT Subject =~ /[({[<] *(\\xbc\\xba\\xc0\\xce)?\\xb1\\xa4( *|\\x2e)\\xb0\\xed *[)}\\]>]/ header FRIEND_AT_PUBLIC To =~ /(yourdomain|you|your|public).(com|org|net)/i header DOMAIN_SUBJECT Subject =~ /(\\s(\\.|dot\\s+)(info|biz|name)|domain)\\b.*(extension|info|regist(ry|ration|er)|submission)/i header TO_EMPTY To =~ /^(?:\\@|\\s*$)/ [if-unset: UNSET] header REPLY_TO_EMPTY Reply-To =~ /^(?:\\@|\\s*$)/ [if-unset: UNSET] header ALL_CAPS_HEADER ALL =~ /\\n(?:TO|FROM|SUBJECT|DATE):/s header X_UIDL_SPAMSIGN X-UIDL =~ /[^\\s\\x21-\\x7E]/ header NO_MX_FOR_FROM eval:check_for_from_mx() header KNOWN_BAD_DIALUPS eval:check_for_bad_dialup_ips() header FROM_AND_TO_SAME eval:check_for_from_to_equivalence() header BAD_HELO_WARNING eval:check_for_bad_helo() header SUBJ_FULL_OF_8BITS eval:check_subject_for_lotsa_8bit_chars() header MDAEMON_2_7_4 Received =~ /with SMTP .MDaemon.v2.7.SP4.R./ header FAKED_IP_IN_RCVD Received =~ /from [-0-9a-z\\._]+_\\[\\d+\\.\\d+\\.\\d+\\.\\d+\\] /i header SMTPD_IN_RCVD Received =~ /\\(SMTPD32-\\d+\\..+\\)/ header POST_IN_RCVD Received =~ / Post\\.(?:sk|cz)/ header RCVD_IN_OSIRUSOFT_COM rbleval:check_rbl('osirusoft', 'relays.osirusoft.com.') header X_OSIRU_SPAM_SRC rbleval:check_rbl_results_for('osirusoft', '127.0.0.4') header X_OSIRU_SPAMWARE_SITE rbleval:check_rbl_results_for('osirusoft', '127.0.0.6') header X_OSIRU_DUL_FH rbleval:check_rbl('osirusoft-dul-firsthop', 'dialups.mail-abuse.org.') header RCVD_IN_RELAYS_ORDB_ORG rbleval:check_rbl('relay', 'relays.ordb.org.') header RCVD_IN_VISI rbleval:check_rbl('relay', 'relays.visi.com.') header RCVD_IN_ORBS rbleval:check_rbl('relay', 'orbs.dorkslayers.com.') header RCVD_IN_DSBL rbleval:check_rbl('relay', 'list.dsbl.org') header RCVD_IN_MULTIHOP_DSBL rbleval:check_rbl('multihop', 'multihop.dsbl.org') header X_RCVD_IN_UNCONFIRMED_DSBL rbleval:check_rbl('relay', 'unconfirmed.dsbl.org') header RCVD_IN_RFCI rbleval:check_rbl('rfci', 'ipwhois.rfc-ignorant.org.') header RCVD_IN_BL_SPAMCOP_NET rbleval:check_rbl('spamcop', 'bl.spamcop.net.') header RCVD_IN_RBL rbleval:check_rbl('rbl', 'blackholes.mail-abuse.org.') header RCVD_IN_RSS rbleval:check_rbl('relay', 'relays.mail-abuse.org.') header RCVD_IN_DUL rbleval:check_rbl('dialup', 'dialups.mail-abuse.org.') header X_RCVD_IN_DUL_FH rbleval:check_rbl('dialup-firsthop', 'dialups.mail-abuse.org.') header FUDGE_DUL_MAPS_OSIRU rblreseval:check_two_rbl_results('osirusoft', \"127.0.0.3\", 'dialup', \"127.0.0.3\") header FUDGE_RELAY_OSIRU rblreseval:check_two_rbl_results('osirusoft', \"127.0.0.2\", 'relay', \"127.0.0.2\") header FUDGE_DUL_OSIRU_FH rblreseval:check_two_rbl_results('osirusoft-dul-firsthop', \"127.0.0.3\", 'dialup-firsthop', \"127.0.0.3\") header FUDGE_MULTIHOP_RELAY rblreseval:check_two_rbl_results('multihop', \"127.0.0.2\", 'relay', \"127.0.0.2\") header FORGED_RCVD_FOUND ALL =~ /\\n(?:To|Importance|Content-Transfer-Encoding|Content-Type|Subject|X-Mailer|X-MSMail-Priority|X-Sender):.*\\nReceived: /s header YR_MEMBERSHIP_EXCH Subject =~ /Your Membership Exchange/ header LOTS_OF_CC_LINES eval:check_lots_of_cc_lines() header FROM_NAME_EQ_FROM_ADDR eval:check_from_name_eq_from_address() header FORGED_HOTMAIL_RCVD eval:check_for_forged_hotmail_received_headers() header FORGED_EUDORAMAIL_RCVD eval:check_for_forged_eudoramail_received_headers() header FORGED_YAHOO_RCVD eval:check_for_forged_yahoo_received_headers() header FORGED_JUNO_RCVD eval:check_for_forged_juno_received_headers() header FORGED_GW05_RCVD eval:check_for_forged_gw05_received_headers() header NONEXISTENT_CHARSET Content-Type =~ /charset=.?DEFAULT/ header CHARSET_FARAWAY_HEADERS eval:check_for_faraway_charset_in_headers() header X_MAILER_GIBBERISH X-Mailer =~ /^[A-Fa-f0-9\\.]{48,}$/ header X_PRIORITY_HIGH X-Priority =~ /^1/ header X_MSMAIL_PRIORITY_HIGH X-Msmail-Priority =~ /^High/ header MAY_BE_FORGED Received =~ /\\(may be forged\\)/i header SHORT_RECEIVED_LINE Received =~ /\\S{120,}/s header CORRUPT_MSGID Message-Id =~ /\\@Received: / header MSG_ID_ADDED_BY_MTA Message-Id =~ / \\(added by / header MSG_ID_ADDED_BY_MTA_2 eval:check_for_mta_message_id_later() header MSG_ID_ADDED_BY_MTA_3 eval:check_for_mta_message_id_first() header YAHOO_MSGID_ADDED ALL =~ /Message-Id: <\\S+\\.mail.yahoo.com>\\nReceived: .*by \\S+mail.yahoo.com via HTTP;/s header MANY_FROMS From =~ /^[^\\\"\\<\\(]+, [^\\\"\\<\\(]+$/ header FROM_BTAMAIL From =~ /\\@btamail.net.cn/i header FROM_UGETMORE From =~ /\\@ugetmore4less.net/i header FROM_TOPICA From =~ /\\@(?:\\w\\.)*email-publisher.com/i header USER_IN_BLACKLIST eval:check_from_in_blacklist() header USER_IN_WHITELIST eval:check_from_in_whitelist() header FROM_MISSING From =~ /^UNSET$/ [if-unset: UNSET] header DATE_MISSING Date =~ /^UNSET$/ [if-unset: UNSET] header CTYPE_JUST_HTML eval:check_for_content_type_just_html() header ROUND_THE_WORLD eval:check_for_round_the_world_received() header MISSING_HEADERS eval:check_for_missing_to_header() header RATWARE ALL =~ /(?:4\\.\\.72\\.1712\\.3|ACE Contact Manager|Aristotle Mail|Avalanche|Calypso|clansoft|Cognigen|Cyber-Bomber|Crescent|DiffondiCool|Dynamic Mail Server|CTMailer|E-Broadcaster|E-mail Magnet|Ellipse Bulk Emailer|EmailBlaster|Emailer.Platinum|eMerge|Extractor|Floodgate|FlashSend|Goldrush|Group Mail|Internet Marketing|Mailcast|MailKing|MassE-Mail|massmail\\.pl|Matchmaker|NetMailer|News Breaker|pop3.report|RamoMail|Ready Aim|Shopping.Planet|Stalker.s|TBBS\\/TIGER|TOO BAD|TotalMailTURBO Mail|V3,1,6,1|V3,1,2,0|V3,2,2,0|V.null.\\.1712\\.3|WindoZ|WinNT.s.Blat|WorldMerge|YMR)/ header SUSPICIOUS_RECIPS To =~ /(@[-a-z0-9_.]{2,}).*(?:\\1.*){9,}/is header SUSPICIOUS_CC_RECIPS Cc =~ /(@[-a-z0-9_.]{2,}).*(?:\\1.*){9,}/is header VERY_SUSP_RECIPS To =~ /\\b([a-z][a-z])[^@,]{0,20}(@[-a-z0-9_\\.]{0,3}).{0,40}?(?:\\1[^@]*\\2.{0,20}?){4,}/is header VERY_SUSP_CC_RECIPS Cc =~ /\\b([a-z][a-z])[^@,]{0,20}(@[-a-z0-9_\\.]{0,3}).{0,40}?(?:\\1[^@]*\\2.{0,20}?){4,}/is header Q_FOR_SELLER Subject =~ /Question.*(for|to|from eBay).*(seller|Member)/ header USER_IN_WHITELIST_TO eval:check_to_in_whitelist() header USER_IN_MORE_SPAM_TO eval:check_to_in_more_spam() header USER_IN_ALL_SPAM_TO eval:check_to_in_all_spam() header ORDER_STATUS Subject =~ / order\\b/i header GAPPY_SUBJECT Subject =~ /\\b(?:[a-z][-_\\.\\,\\:\\;\\'\\~\\s]{1,3}){4,}/i header BUGZILLA_BUG Subject =~ /\\[Bug \\d+\\]/ header MAJORDOMO Subject =~ /Majordomo (?:request )?results/ header PLEASE_READ Subject =~ /please read/i header MIME_ODD_CASE ALL =~ /\\nMiME-Version: /s header OE_PI X-Mailer =~ /OutLook Express 3\\.14159/ header PGP_SIGNATURE_2 Content-Type =~ /protocol=.?application\\/pgp-signature.?;/i
[home | help | who | search | setup | code]