# # 2007-2014 Victor Ustugov # meta CT_8BIT_CTE_7BIT_Thunderbird CT_8BIT_CTE_7BIT && __BODY_8BITS && (__User_Agent_Mozilla5_Thunderbird || __User_Agent_Thunderbird || __User_Agent_Mozilla_Thunderbird || __X_Mailer_Thunderbird) && __NONEMPTY_RAWBODY describe CT_8BIT_CTE_7BIT_Thunderbird 8-bit header Content-Type found with 7-bit header Content-Transfer-Encoding in message from Thunderbird (DSPAM_autolearn) score CT_8BIT_CTE_7BIT_Thunderbird 3.5 meta CT_8BIT_CTE_7BIT_Thunderbird_DSPAM_00_01 CT_8BIT_CTE_7BIT_Thunderbird && DSPAM_CHECK_00_01 describe CT_8BIT_CTE_7BIT_Thunderbird_DSPAM_00_01 CT_8BIT_CTE_7BIT DSPAM compensation score CT_8BIT_CTE_7BIT_Thunderbird_DSPAM_00_01 3.5 meta MIME_CT_8BIT_CTE_7BIT_Thunderbird MIME_CT_8BIT_CTE_7BIT && __BODY_8BITS && (__User_Agent_Mozilla5_Thunderbird || __User_Agent_Thunderbird || __User_Agent_Mozilla_Thunderbird || __X_Mailer_Thunderbird) && __NONEMPTY_RAWBODY describe MIME_CT_8BIT_CTE_7BIT_Thunderbird 8-bit header Content-Type found with 7-bit header Content-Transfer-Encoding in message from Thunderbird (DSPAM_autolearn) score MIME_CT_8BIT_CTE_7BIT_Thunderbird 2.0 meta MIME_CT_8BIT_CTE_7BIT_Thunderbird_DSPAM_00_01 MIME_CT_8BIT_CTE_7BIT_Thunderbird && DSPAM_CHECK_00_01 describe MIME_CT_8BIT_CTE_7BIT_Thunderbird_DSPAM_00_01 MIME_CT_8BIT_CTE_7BIT DSPAM compensation score MIME_CT_8BIT_CTE_7BIT_Thunderbird_DSPAM_00_01 3.5 header __FORGED_MUA_Thunderbird_CT Content-Type =~ /^\s*multipart\/related;[\r\n\s]*boundary="\d{6,9}==\.REL"$/ meta FORGED_MUA_Thunderbird_CT __User_Agent_Mozilla_Thunderbird && __FORGED_MUA_Thunderbird_CT describe FORGED_MUA_Thunderbird_CT Message pretends to be send from Mozilla Thunderbird but has suspicious header Content-Type score FORGED_MUA_Thunderbird_CT 2.0 header __FORGED_THUNDERBIRD_User_Agent User-Agent =~ /^\s*Thunderbird 1\.5\.0\.12 \(Windows\/20070509\)$/ meta FORGED_THUNDERBIRD __FORGED_THUNDERBIRD_User_Agent && __CUST_Content_Type_multipart_mixed_any && !__TEXT_MILTIPART_MESSAGE describe FORGED_THUNDERBIRD Fake Thunderbird MUA score FORGED_THUNDERBIRD 3.5 meta __Thunderbird_MSGID_UNKNOWN !__Mozilla_Message_ID && !__Mozilla_Message_ID_Common && !__MAILMAN && !__UNUSABLE_MSGID meta FORGED_MUA_Thunderbird_MSGID_UNKNOWN __Thunderbird_MSGID_UNKNOWN && (__User_Agent_Thunderbird || __User_Agent_Mozilla_Thunderbird || __User_Agent_Mozilla5_Thunderbird) describe FORGED_MUA_Thunderbird_MSGID_UNKNOWN Message pretends to be send from Mozilla Thunderbird but has forged Message-ID score FORGED_MUA_Thunderbird_MSGID_UNKNOWN 2.5 #meta FORGED_MUA_Thunderbird_MSGID_UNKNOWN __Thunderbird_MSGID_UNKNOWN && (__User_Agent_Thunderbird || __User_Agent_Mozilla_Thunderbird || __User_Agent_Mozilla5_Thunderbird) && !__User_Agent_Mozilla5_Thunderbird_Macintosh && !__User_Agent_Mozilla5_Thunderbird_Linux #describe FORGED_MUA_Thunderbird_MSGID_UNKNOWN Message pretends to be send from Mozilla Thunderbird but has forged Message-ID #score FORGED_MUA_Thunderbird_MSGID_UNKNOWN 2.5 # #meta FORGED_MUA_Thunderbird_Macintosh_MSGID_UNKNOWN __Thunderbird_MSGID_UNKNOWN && __User_Agent_Mozilla5_Thunderbird_Macintosh #describe FORGED_MUA_Thunderbird_Macintosh_MSGID_UNKNOWN Message pretends to be send from Mozilla Thunderbird but has forged Message-ID #score FORGED_MUA_Thunderbird_Macintosh_MSGID_UNKNOWN 2.5 # #meta FORGED_MUA_Thunderbird_Linux_MSGID_UNKNOWN __Thunderbird_MSGID_UNKNOWN && __User_Agent_Mozilla5_Thunderbird_Linux #describe FORGED_MUA_Thunderbird_Linux_MSGID_UNKNOWN Message pretends to be send from Mozilla Thunderbird but has forged Message-ID #score FORGED_MUA_Thunderbird_Linux_MSGID_UNKNOWN 2.5 meta FORGED_MUA_Thunderbird_MSGID (__User_Agent_Thunderbird || __User_Agent_Mozilla_Thunderbird || __User_Agent_Mozilla5_Thunderbird) && !__Mozilla_Message_ID && __Mozilla_Message_ID_Common && !__MAILMAN && !__UNUSABLE_MSGID describe FORGED_MUA_Thunderbird_MSGID Message pretends to be send from Mozilla Thunderbird but has forged Message-ID (DSPAM_autolearn) score FORGED_MUA_Thunderbird_MSGID 4.0 meta FORGED_MUA_Thunderbird_charset_quoted (__User_Agent_Thunderbird || __User_Agent_Mozilla_Thunderbird || __User_Agent_Mozilla5_Thunderbird) && __CUST_Content_Type_text_charset_quoted describe FORGED_MUA_Thunderbird_charset_quoted Message pretends to be send from Mozilla Thunderbird but has forged charset definition in header Content-Type score FORGED_MUA_Thunderbird_charset_quoted 2.0 meta FORGED_MUA_Thunderbird_MS_BOUNDARY (__User_Agent_Thunderbird || __User_Agent_Mozilla_Thunderbird || __User_Agent_Mozilla5_Thunderbird) && __CUST_Content_Type_multipart_OE_boundary describe FORGED_MUA_Thunderbird_MS_BOUNDARY Message pretends to be send from Mozilla Thunderbird but has forged boundary in header Content-Type score FORGED_MUA_Thunderbird_MS_BOUNDARY 4.0 meta X_Mailer_Thunderbird __X_Mailer_Thunderbird describe X_Mailer_Thunderbird X-Mailer: Thunderbird (DSPAM_autolearn) score X_Mailer_Thunderbird 2.0