#
# 2007 Victor Ustugov <victor+spamassasin@corvax.kiev.ua>
#


#
# UNIXTIME:
# 36F17760	1999-03-19 00:00:00
# 4FFFFFFF	2012-07-13 14:01:19
#
# 1999		368BF3E0 - 386D275F
# 2000		386D2760 - 3A4FAC5F
# 2001		3A4FAC60 - 3C30DFDF
# 2002		3C30DFE0 - 3E12135F
# 2003		3E121360 - 3FF346DF
# 2004		3FF346E0 - 41D5CBDF
# 2005		41D5CBE0 - 43B6FF5F
# 2006		43B6FF60 - 459832DF
# 2007		459832E0 - 4779665F
# 2008		47796660 - 495BEB5F
# 2009		495BEB60 - 4B3D1EDF
# 2010		4B3D1EE0 - 4D1E525F
# 2011		4D1E5260 - 4EFF85DF
# 2012		4EFF85E0 - 50E20ADF
#
header		__Mozilla_Message_ID		Message-ID:case =~ /^\s*<(3[3-9A-F]|4[\dA-F])[\dA-F]{6}\.(\d0){0,3}\d\@([^>\.]+\.)+[^>\.]+>$/
header		__Mozilla_Message_ID_Common	Message-ID =~ /^\s*<[\dA-F]{8}\.\d{1,7}\@([^>\.]+\.)+[^>\.]+>$/

meta		FORGED_MUA_Mozilla_Mail_MSGID	__User_Agent_Mozilla && !__Mozilla_Message_ID && !__Mozilla_Message_ID_Common
describe	FORGED_MUA_Mozilla_Mail_MSGID	Forged mail pretending to be from Mozilla Mail (suspicious Message-ID)
score		FORGED_MUA_Mozilla_Mail_MSGID	2.5

meta		FORGED_MUA_Mozilla_Mail_MSGID_l	__User_Agent_Mozilla && !__Mozilla_Message_ID && __Mozilla_Message_ID_Common
describe	FORGED_MUA_Mozilla_Mail_MSGID_l	Forged mail pretending to be from Mozilla Mail (suspicious Message-ID) (DSPAM autolearn)
score		FORGED_MUA_Mozilla_Mail_MSGID_l	3.5