#
# 2007-2009 Victor Ustugov <victor+spamassasin@corvax.kiev.ua>
#


header		__FORGED_MUA_Thunderbird_CT	Content-Type =~ /^\s*multipart\/related;[\r\n\s]*boundary="\d{6,9}==\.REL"$/
meta		FORGED_MUA_Thunderbird_CT	__User_Agent_Mozilla_Thunderbird && __FORGED_MUA_Thunderbird_CT
describe	FORGED_MUA_Thunderbird_CT	Forged mail pretending to be from Mozilla Thunderbird (suspicious header Content-Type)
score		FORGED_MUA_Thunderbird_CT	2.0

header		__FORGED_THUNDERBIRD_User_Agent	User-Agent =~ /^\s*Thunderbird 1\.5\.0\.12 \(Windows\/20070509\)$/
meta		FORGED_THUNDERBIRD		__FORGED_THUNDERBIRD_User_Agent && __CUST_Content_Type_multipart_mixed_any && !__TEXT_MILTIPART_MESSAGE
describe	FORGED_THUNDERBIRD		Fake Thunderbird MUA
score		FORGED_THUNDERBIRD		3.5

meta		FORGED_MUA_Thunderbird_MSGID	(__User_Agent_Thunderbird || __User_Agent_Mozilla_Thunderbird) && !__Mozilla_Message_ID && !__Mozilla_Message_ID_Common
describe	FORGED_MUA_Thunderbird_MSGID	Forged mail pretending to be from Mozilla Thunderbird (suspicious Message-ID)
score		FORGED_MUA_Thunderbird_MSGID	2.5

meta		FORGED_MUA_Thunderbird_MSGID_l	(__User_Agent_Thunderbird || __User_Agent_Mozilla_Thunderbird) && !__Mozilla_Message_ID && __Mozilla_Message_ID_Common
describe	FORGED_MUA_Thunderbird_MSGID_l	Forged mail pretending to be from Mozilla Thunderbird (suspicious Message-ID) (DSPAM autolearn)
score		FORGED_MUA_Thunderbird_MSGID_l	3.5

meta		X_Mailer_Thunderbird		__X_Mailer_Thunderbird && !Likis_SPN_Price_list && !__FROM_BADM
describe	X_Mailer_Thunderbird		X-Mailer: Thunderbird (DSPAM autolearn)
score		X_Mailer_Thunderbird		2.0