# # 2007-2022 Victor Ustugov # header __GMAIL_COM_Received Received =~ /^(.*\n)*\s*by 10\.\d{1,3}.\d{1,3}.\d{1,3} with (HTTP|SMTP id [\da-z]+\.\d+\.\d+);[\s\r\n]*(Mon|Tue|Wed|Thu|Fri|Sat|Sun), ([12]\d|3[01]|0?[1-9]) (Jan|Feb|Ma[ry]|Apr|Ju[nl]|Aug|Sep|Oct|Nov|Dec) (19[7-9]\d|2\d{3}) ([01]?\d|2[0-3]):[0-5]\d:[0-5]\d -0[78]00 \((PDT|PST)\)/ header __GMAIL_COM_HEADER_From From =~ /\@(gmail\.com|googlemail\.com|bigmir\.net)>$/ header __GMAIL_COM_Message_ID Message-ID:case =~ /^\s*<[\dA-Za-z\-\+=_]{27,51}\@mail\.gmail\.com>$/ header __GMAIL_COM_CT_multipart_alt Content-Type:case =~ /^\s*multipart\/alternative;[\s\r\n]*boundary="----=_Part_\d{3,5}_\d{7,8}\.\d{13}"$/ #meta GMAIL_COM __GMAIL_COM_Received && __GMAIL_COM_Message_ID && __GMAIL_COM_HEADER_From && (__CUST_X_Envelope_From_From || __CUST_Return_Path_From || __CUST_Return_path_From) && __CUST_Mime_Version_1_0 meta GMAIL_COM (__GMAIL_COM_CT_multipart_alt || __CUST_Content_Type_text) && __GMAIL_COM_Received && __GMAIL_COM_Message_ID && __GMAIL_COM_HEADER_From && (__CUST_X_Envelope_From_From || __CUST_Return_Path_From || __CUST_Return_path_From) && (__CUST_Mime_Version_1_0 || __CUST_MIME_Version_1_0) describe GMAIL_COM Message from gmail.com score GMAIL_COM -0.01 header __GMAIL_COM_WEB_RCVD_FIRST Received =~ /\nby 10\.\d+\.\d+\.\d+ with HTTP; \w{3},\s+\d+ \w{3} 20\d\d \d\d:\d\d:\d\d (-0700 \(PDT\)|-0800 \(PST\))$/ header __GMAIL_COM_WEB_RCVD_LAST Received =~ /\bmail-\S+\.google\.com\b/ meta GMAIL_COM_WEB __GMAIL_COM_Message_ID && __GMAIL_COM_WEB_RCVD_FIRST && __GMAIL_COM_WEB_RCVD_LAST describe GMAIL_COM_WEB Message sent from gmail.com with HTTP score GMAIL_COM_WEB -0.01 header __GMAIL_COM_API_Message_ID Message-ID:case =~ /^\s*$/ #header __GMAIL_COM_API_RCVD_FIRST Date|Received =~ /^\s*((?:Mon|Tue|Wed|Thu|Fri|Sat|Sun),\s+\d+ (?:Jan|Feb|Ma[ry]|Apr|Ju[nl]|Aug|Sep|Oct|Nov|Dec) 20\d\d \d\d:\d\d:\d\d [\-\+]\d\d00)[\s\r\n]*\|(.*\n)+from \d+ named unknown by gmailapi\.google\.com with HTTPREST; \1$/ header __GMAIL_COM_API_RCVD_FIRST Date|Received =~ /^\s*((?:Mon|Tue|Wed|Thu|Fri|Sat|Sun),\s+\d+ (?:Jan|Feb|Ma[ry]|Apr|Ju[nl]|Aug|Sep|Oct|Nov|Dec) 20\d\d) \d\d:\d\d:\d\d ([\-\+]\d\d00)[\s\r\n]*\|(.*\n)+from \d+ named unknown by gmailapi\.google\.com with HTTPREST; \1 \d\d:\d\d:\d\d \2$/ header __GMAIL_COM_API_X_RCVD_FIRST X-Received =~ /^\s*by (?:10\.\d+\.\d+\.\d+|2002(:[\da-f]*){4,7}) with SMTP id \S+; (?:Mon|Tue|Wed|Thu|Fri|Sat|Sun), ([12]\d|3[01]|0?[1-9]) (?:Jan|Feb|Ma[ry]|Apr|Ju[nl]|Aug|Sep|Oct|Nov|Dec) (19[7-9]\d|2\d{3}) ([01]?\d|2[0-3]):[0-5]\d:[0-5]\d -0[78]00 \((PDT|PST)\)[\r\n]*$/ meta GMAIL_COM_API __GMAIL_COM_API_Message_ID && __GMAIL_COM_API_RCVD_FIRST && __GMAIL_COM_WEB_RCVD_LAST && __HAS_X_Google_DKIM_Signature && __HAS_X_Gm_Message_State && __HAS_X_Google_Smtp_Source && __GMAIL_COM_API_X_RCVD_FIRST describe GMAIL_COM_API Message sent from gmail.com with HTTPREST #score GMAIL_COM_API -0.01 score GMAIL_COM_API 0.5 #header __GMAIL_COM_DIGITS From =~ /^\s*[a-z\.]+\d+\@gmail\.com$/ header __GMAIL_COM_DIGITS From =~ /\b?$/ meta GMAIL_COM_API_TO_UNDISCLOSED GMAIL_COM_API && TO_UNDISCLOSED && !__GMAIL_COM_DIGITS describe GMAIL_COM_API_TO_UNDISCLOSED Message sent from gmail.com with HTTPREST to undisclosed recipients (sa-learn_candidate) score GMAIL_COM_API_TO_UNDISCLOSED 1.0 meta GMAIL_COM_API_TO_UNDISCLOSED_FROM_DIGITS GMAIL_COM_API && TO_UNDISCLOSED && __GMAIL_COM_DIGITS describe GMAIL_COM_API_TO_UNDISCLOSED_FROM_DIGITS Message sent from gmail.com with HTTPREST from mailbox ended by digits to undisclosed recipients (DSPAM_autolearn, sa-learn_candidate) score GMAIL_COM_API_TO_UNDISCLOSED_FROM_DIGITS 3.5 tflags GMAIL_COM_API_TO_UNDISCLOSED_FROM_DIGITS mandatory_learn meta GMAIL_COM_API_FROM_DIGITS GMAIL_COM_API && !TO_UNDISCLOSED && __GMAIL_COM_DIGITS describe GMAIL_COM_API_FROM_DIGITS Message sent from gmail.com with HTTPREST from mailbox ended by digits (sa-learn_candidate) score GMAIL_COM_API_FROM_DIGITS 2.0 header __GMAIL_COM_SMTP_OTHER_DOMAIN_RCVD1_4 Received =~ /^(.*\n)*\s*by 10\.\d+\.\d+\.\d+ with SMTP id \S+;\r?\n\s+(Mon|Tue|Wed|Thu|Fri|Sat|Sun), ([12]\d|3[01]|0?[1-9]) (Jan|Feb|Ma[ry]|Apr|Ju[nl]|Aug|Sep|Oct|Nov|Dec) (19[7-9]\d|2\d{3}) ([01]?\d|2[0-3]):[0-5]\d:[0-5]\d -0[78]00 \((PDT|PST)\)[\r\n]*$/ header __GMAIL_COM_SMTP_OTHER_DOMAIN_RCVD1_6 X-Received =~ /^(.*\n)*\s*by 2002:[\da-f]+:[\da-f]+:: with SMTP id [a-z\d]+\.\d+\.\d+;[\r\n\s]+(Mon|Tue|Wed|Thu|Fri|Sat|Sun), ([12]\d|3[01]|0?[1-9]) (Jan|Feb|Ma[ry]|Apr|Ju[nl]|Aug|Sep|Oct|Nov|Dec) 2\d{3} ([01]?\d|2[0-3]):[0-5]\d:[0-5]\d -0[78]00 \((PDT|PST)\)[\r\n]*$/ header __GMAIL_COM_SMTP_OTHER_DOMAIN_RCVD2 Received =~ /^(.*\n)*\s*by mail-\w+\d+-\w+\d+\.google\.com with SMTP id/ meta __GMAIL_COM_SMTP_OTHER_DOMAIN_RCVD (__GMAIL_COM_SMTP_OTHER_DOMAIN_RCVD1_4 || (__GMAIL_COM_SMTP_OTHER_DOMAIN_RCVD1_6 && __HAS_X_Google_Smtp_Source)) && __GMAIL_COM_SMTP_OTHER_DOMAIN_RCVD2 header __GMAIL_COM_MSGID Message-ID =~ /^\s*<[\da-f]{32}\@mail\.gmail\.com>$/ header __GMAIL_COM_Return_Path Return-path =~ /^\s*<.+\@gmail\.com>$/ header __GMAIL_COM_X_Envelope_From X-Envelope-From =~ /^\s*<.+\@gmail\.com>$/ header __GMAIL_COM_Sender Sender =~ /^\s*.+\@gmail\.com$/ header __GMAIL_COM_From From =~ /\@gmail\.com>?$/ header __GMAIL_COM_Received_HELO Received =~ /from gmail\.com \(/ meta __CMAIL_COM_OTHER_FROM (__GMAIL_COM_Return_Path || __GMAIL_COM_X_Envelope_From) && __GMAIL_COM_Sender && __HAS_X_Google_Sender_Auth && __GMAIL_COM_Message_ID && !__GMAIL_COM_From header __GOOGLE_DOCS_Return_path Return-path =~ /^\s*<.+\@doclist\.bounces\.google\.com>/ header __GOOGLE_DOCS_X_Envelope_From X-Envelope-From =~ /^\s*<.+\@doclist\.bounces\.google\.com>/ header __GOOGLE_CALENDAR_Return_path Return-path =~ /^\s*<.+\@calendar-server\.bounces\.google\.com>/ header __GOOGLE_CALENDAR_X_Envelope_From X-Envelope-From =~ /^\s*<.+\@calendar-server\.bounces\.google\.com>/ header __GOOGLE_APPS_Message_ID Message-ID:case =~ /^\s*<[\da-z]{8}\.[\da-z]{8}\.[\da-z]{4,8}\.[\da-z]{4,8}\@mx\.google\.com>$/