#
# 2007 Victor Ustugov <victor+spamassasin@corvax.kiev.ua>
#


header		USER_AGENT_Postman_Professional		User-Agent =~ /^Postman Professional \d+\.\d+$/
describe	USER_AGENT_Postman_Professional		Spamware User-Agent
score		USER_AGENT_Postman_Professional		4.0


header		FORGED_MUA_OE_X_MAILER			X-Mailer =~ /^Microsoft Outlook Express V6/
describe	FORGED_MUA_OE_X_MAILER			Forged MUA Outlook Express (strange OE version number)
score		FORGED_MUA_OE_X_MAILER			3.0


header		__FORGED_THEBAT_NET_MESSAGE_MSGID	Message-ID =~ /\@thebat\.net>$/
header		__FORGED_THEBAT_NET_MESSAGE_From	From =~ /\@thebat\.net>?$/
meta		FORGED_THEBAT_NET_MESSAGE		__FORGED_THEBAT_NET_MESSAGE_MSGID && !__CUST_FROM_EMPTY && !__FORGED_THEBAT_NET_MESSAGE_From && __THEBAT_MUA_ANY
describe	FORGED_THEBAT_NET_MESSAGE		Forged thebat.net message
score		FORGED_THEBAT_NET_MESSAGE		3.5

meta		FORGED_MUA_THEBAT_X_MSMAIL_PRIORITY	(__THEBAT_MUA_V1 || __THEBAT_MUA_V2 || __THEBAT_MUA_V3) && __CUST_X_MSMAIL_PRIORITY_NOT_EMPTY
describe	FORGED_MUA_THEBAT_X_MSMAIL_PRIORITY	Mail pretending to be from The Bat! (X-MSMail-Priority)
score		FORGED_MUA_THEBAT_X_MSMAIL_PRIORITY	4.5
tflags		FORGED_MUA_THEBAT_X_MSMAIL_PRIORITY	mandatory_learn

rawbody		__FORGED_MUA_THEBAT_INVALID_TAG		/<img src='/
meta		FORGED_MUA_THEBAT_INVALID_TAG		__THEBAT_MUA_ANY && __FORGED_MUA_THEBAT_INVALID_TAG
describe	FORGED_MUA_THEBAT_INVALID_TAG		Mail pretending to be from The Bat! (invalid html tag)
score		FORGED_MUA_THEBAT_INVALID_TAG		3.5


meta		FORGED_MUA_QUALCOMM_Eudora		__QUALCOMM_Windows_Eudora_X_Mailer && !__X_Sender_Return_Path && __CUST_From_BASE64_windows_1251 && __CUST_Subject_QP_windows_1251
describe	FORGED_MUA_QUALCOMM_Eudora		Header Sender mismatch in message from QUALCOMM Windows Eudora
score		FORGED_MUA_QUALCOMM_Eudora		2.0


header 		__Whitelisted_Message_ID_01		Message-ID =~ /^<00[0-9a-f]{2}01c7[0-9a-f]{4}\$[0-9a-f]{7}0\$[0-9a-f]{4}a8c0\@/i
header 		__Whitelisted_Message_ID_02		Message-ID =~ /^<00[0-9a-f]{2}01c7[0-9a-f]{4}\$[0-9a-f]{7}0\$[0-9a-f]{6}a0\@/i

header		__FORGED_MUA_OUTLOOK_Message_ID_01	Message-ID =~ /^<00[0-9a-f]{2}01c7[0-9a-f]{4}\$[0-9a-f]{7}0\$[0-9a-f]{8}\@mtu-net\.ru>$/
meta		FORGED_MUA_OUTLOOK_Message_ID_01	__FORGED_MUA_OUTLOOK_Message_ID_01 && !__Whitelisted_Message_ID_01 && !__Whitelisted_Message_ID_02
describe	FORGED_MUA_OUTLOOK_Message_ID_01	Mail pretending to be from Outlook Express (Message-ID 01: fake mtu-net.ru)
score		FORGED_MUA_OUTLOOK_Message_ID_01	2.5
tflags		FORGED_MUA_OUTLOOK_Message_ID_01	mandatory_learn


header 		__Whitelisted_Message_ID_03		Message-ID =~ /^<00[0-9a-f]{2}01c7[0-9a-f]{4}\$[0-9a-f]{7}0\$0100007f\@localhost>$/i
meta		FORGED_MUA_OUTLOOK_Message_ID_02LH	__Whitelisted_Message_ID_03
describe	FORGED_MUA_OUTLOOK_Message_ID_02LH	Mail pretending to be from Outlook Express (Message-ID 02: localhost)
score		FORGED_MUA_OUTLOOK_Message_ID_02LH	0.5

header		__FORGED_MUA_OUTLOOK_Message_ID_02	Message-ID =~ /^<00[0-9a-f]{2}01c7[0-9a-f]{4}\$[0-9a-f]{7}0\$[0-9a-f]{8}\@localhost>$/i
meta		FORGED_MUA_OUTLOOK_Message_ID_02	__FORGED_MUA_OUTLOOK_Message_ID_02 && !__Whitelisted_Message_ID_03
describe	FORGED_MUA_OUTLOOK_Message_ID_02	Mail pretending to be from Outlook Express (Message-ID 02: localhost but not 127.0.0.1)
score		FORGED_MUA_OUTLOOK_Message_ID_02	2.5
tflags		FORGED_MUA_OUTLOOK_Message_ID_02	mandatory_learn

header		__FORGED_MUA_OUTLOOK_Message_ID_03	Message-ID =~ /^<00[0-9a-f]{2}01c7[0-9a-f]{4}\$[0-9a-f]{7}0\$0100007f\@/i
meta		FORGED_MUA_OUTLOOK_Message_ID_03	__FORGED_MUA_OUTLOOK_Message_ID_03 && !__Whitelisted_Message_ID_03
describe	FORGED_MUA_OUTLOOK_Message_ID_03	Mail pretending to be from Outlook Express (Message-ID 03: 127.0.0.1 bu not localhost)
score		FORGED_MUA_OUTLOOK_Message_ID_03	2.5
tflags		FORGED_MUA_OUTLOOK_Message_ID_03	mandatory_learn


#header		__FORGED_MUA_OUTLOOK_Message_ID_04	Message-ID =~ /\@\d+\.\d+\.\d+\.\d+/i
header		__FORGED_MUA_OUTLOOK_Message_ID_04	Message-ID =~ /\@\d+\./i
meta		FORGED_MUA_OUTLOOK_Message_ID_04	__FORGED_MUA_OUTLOOK_Message_ID_04 && __CUST_X_Mailer_OE
describe	FORGED_MUA_OUTLOOK_Message_ID_04	Mail pretending to be from Outlook Express (Message-ID 04: IP address)
score		FORGED_MUA_OUTLOOK_Message_ID_04	2.5
tflags		FORGED_MUA_OUTLOOK_Message_ID_04	mandatory_learn


header		__FORGED_MUA_BAT_Message_ID_01		Message-ID =~ /\@\d+\.\d+\.\d+\.\d+>$/i
meta		FORGED_MUA_BAT_Message_ID_01		__FORGED_MUA_BAT_Message_ID_01 && __THEBAT_MUA_ANY
describe	FORGED_MUA_BAT_Message_ID_01		Mail pretending to be from The Bat! (Message-ID: IP address)
score		FORGED_MUA_BAT_Message_ID_01		2.5
tflags		FORGED_MUA_BAT_Message_ID_01		mandatory_learn


header		__SUSPICIOUS_X_MAILER			X-Mailer =~ /^(Fantasy|The Weeds|The Mailer)$/
meta		SUSPICIOUS_X_MAILER			__SUSPICIOUS_X_MAILER && !__CUST_X_PRIORITY_EMPTY && !__CUST_X_MSMAIL_PRIORITY_EMPTY && !__CUST_Importance_EMPTY && __CUST_X_MimeOLE_OE_600
describe	SUSPICIOUS_X_MAILER			Suspecious X-Mailer
score		SUSPICIOUS_X_MAILER			4.0
tflags		SUSPICIOUS_X_MAILER			mandatory_learn