# # 2007-2018 Victor Ustugov # header __ORANGE_FR_Exim Received =~ /from smtp(\d+[a-z]?|-out)\.orange\.fr \(\[\d+\.\d+\.\d+\.\d+]\)/ header __ORANGE_FR_Sendmail Received =~ /from smtp(\d+[a-z]?|-out)\.orange\.fr \(smtp(\d+[a-z]?|-out)\.orange\.fr \[\d+\.\d+\.\d+\.\d+]\)/ meta ORANGE_FR __ORANGE_FR_Exim || __ORANGE_FR_Sendmail describe ORANGE_FR Message received from orange.fr relay score ORANGE_FR 3.5 header __ORANGE_NL_Exim Received =~ /from smtp-\d+\.orange\.nl \(\[\d+\.\d+\.\d+\.\d+]\)/ header __ORANGE_NL_Sendmail Received =~ /from smtp-\d+\.orange\.nl \(smtp-\d+\.orange\.nl \[\d+\.\d+\.\d+\.\d+]\)/ meta ORANGE_NL __ORANGE_NL_Exim || __ORANGE_NL_Sendmail describe ORANGE_NL Message received from orange.nl relay score ORANGE_NL 2.0 header __TUT_BY_Exim Received =~ /from mail\.tut\.by \(\[\d+\.\d+\.\d+\.\d+\] helo=speedy\.tutby\.com\)/ header __TUT_BY_Sendmail Received =~ /from speedy\.tutby\.com \(mail\.tut\.by \[\d+\.\d+\.\d+\.\d+\]\)/ meta TUT_BY __TUT_BY_Exim || __TUT_BY_Sendmail describe TUT_BY Message received from mail.tut.by relay score TUT_BY 2.5 header __POCHTALIST_DP_UA_Exim Received =~ /from \[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\] \(helo=pochtalist\.dp\.ua\)/ header __POCHTALIST_DP_UA_Sendmail Received =~ /from pochtalist\.dp\.ua \(may be forget \[\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\]\)/ meta POCHTALIST_DP_UA __POCHTALIST_DP_UA_Exim || __POCHTALIST_DP_UA_Sendmail describe POCHTALIST_DP_UA Message received from pochtalist.dp.ua spam service score POCHTALIST_DP_UA 5.0 header __TITAN_TIMEWEB_RU_Exim Received =~ /from titan\.timeweb\.ru \(\[\d+\.\d+\.\d+\.\d+\]\)/ header __TITAN_TIMEWEB_RU_Sendmail Received =~ /from mail\.tutby\.com \(titan\.timeweb\.ru \[\d+\.\d+\.\d+\.\d+\]\)/ meta TITAN_TIMEWEB_RU __TITAN_TIMEWEB_RU_Exim || __TITAN_TIMEWEB_RU_Sendmail describe TITAN_TIMEWEB_RU Message received from titan.timeweb.ru relay score TITAN_TIMEWEB_RU 3.5 header RECEIVED_OWNEROR_3NJLA1V Received =~ /\bOWNEROR-3NJLA1V\b/ describe RECEIVED_OWNEROR_3NJLA1V Received from OWNEROR-3NJLA1V, already_read score RECEIVED_OWNEROR_3NJLA1V 5.0 header RECEIVED_TELEMOST_DP_UA Received =~ /mail\.telemost\.dp\.ua/ #describe RECEIVED_TELEMOST_DP_UA Received via mail.telemost.dp.ua (DSPAM_autolearn, already_read) describe RECEIVED_TELEMOST_DP_UA Received via mail.telemost.dp.ua score RECEIVED_TELEMOST_DP_UA 3.0 header RECEIVED_SUSPICIOUS_HELO Received =~ /(speedtouch\.lan|dsldevice\.lan|device\.lan)/ describe RECEIVED_SUSPICIOUS_HELO Suspicious HELO in header Received (DSPAM_autolearn, already_read) score RECEIVED_SUSPICIOUS_HELO 3.0 header RECEIVED_SUSP_HELO_DermedicaTS03 Received =~ /DermedicaTS03/ describe RECEIVED_SUSP_HELO_DermedicaTS03 Suspicious HELO DermedicaTS03 in header Received (DSPAM_autolearn, already_read) score RECEIVED_SUSP_HELO_DermedicaTS03 3.0 header RECEIVED_HELO_WANADOO_FR Received =~ /(HELO wanadoo\.fr|helo=wanadoo\.fr|from wanadoo\.fr)/ describe RECEIVED_HELO_WANADOO_FR There is HELO wanadoo.fr in header Received (DSPAM_autolearn, already_read) score RECEIVED_HELO_WANADOO_FR 3.0 header RECEIVED_STELS_NET_HELO_SERVER Received =~ /from \[\d+\.\d+\.\d+\.\d+\] \(helo=server\)[\s\r\n]*by mail\.stels\.net/ describe RECEIVED_STELS_NET_HELO_SERVER Message from mail.stels.net with helo=server in header Received (DSPAM_autolearn, already_read) score RECEIVED_STELS_NET_HELO_SERVER 3.0 header RECEIVED_VOILA_FR Received =~ /smtp\d\.voila\.fr/ describe RECEIVED_VOILA_FR Message thru SMTP server voila.fr score RECEIVED_VOILA_FR 1.0 header RECEIVED_bitrixin_net Received =~ /(gw|secure)\.bitrixin\.net/ describe RECEIVED_bitrixin_net Received via bitrixin.net (DSPAM_autolearn, already_read) score RECEIVED_bitrixin_net 3.0 header RECEIVED_mdp2_net Received =~ /\.mdp2\.net/ describe RECEIVED_mdp2_net Received via .mdp2.net (DSPAM_autolearn, already_read) score RECEIVED_mdp2_net 4.0 header RECEIVED_zercustoms_com Received =~ /zercustoms\.com/ describe RECEIVED_zercustoms_com Received via zercustoms.com (DSPAM_autolearn, already_read) score RECEIVED_zercustoms_com 3.0 header RECEIVED_defezeder_ru Received =~ /defezeder\.ru/ describe RECEIVED_defezeder_ru Received via defezeder.ru (DSPAM_autolearn, already_read) score RECEIVED_defezeder_ru 3.0 ######################################## header RCVD_info_box_kiev_ua Received =~ /info-box\.kiev\.ua/ describe RCVD_info_box_kiev_ua Received thru info-box.kiev.ua (DSPAM_autolearn, already_read) score RCVD_info_box_kiev_ua 4.0 tflags RCVD_info_box_kiev_ua mandatory_learn header RCVD_infohost_com_ua Received =~ /infohost\.com\.ua/ describe RCVD_infohost_com_ua Received thru infohost.com.ua (DSPAM_autolearn, already_read) score RCVD_infohost_com_ua 4.0 tflags RCVD_infohost_com_ua mandatory_learn header RCVD_emfirm_com_ua Received =~ /emfirm\.com\.ua/ describe RCVD_emfirm_com_ua Received thru emfirm.com.ua (DSPAM_autolearn, already_read) score RCVD_emfirm_com_ua 4.0 tflags RCVD_emfirm_com_ua mandatory_learn header RECEIVED_anvil_ukrnic_com Received =~ /anvil\.ukrnic\.com/ describe RECEIVED_anvil_ukrnic_com Received via anvil.ukrnic.com (DSPAM_autolearn, already_read) score RECEIVED_anvil_ukrnic_com 4.0 header RECEIVED_server1_nwd_org_ua Received =~ /server1\.nwd\.org\.ua/ describe RECEIVED_server1_nwd_org_ua Received via server1.nwd.org.ua (DSPAM_autolearn, already_read) score RECEIVED_server1_nwd_org_ua 4.0 header RECEIVED_albo_com_ua Received =~ /albo\.com\.ua/ describe RECEIVED_albo_com_ua Received via albo.com.ua (DSPAM_autolearn, already_read) score RECEIVED_albo_com_ua 3.0 header RECEIVED_bizit_com_ua Received =~ /bizit\.com\.ua/ describe RECEIVED_bizit_com_ua Received via bizit.com.ua (DSPAM_autolearn, already_read) score RECEIVED_bizit_com_ua 3.0 header RECEIVED_pr_host_kiev_ua Received =~ /pr-host\.kiev\.ua/ describe RECEIVED_pr_host_kiev_ua Received via pr-host.kiev.ua (DSPAM_autolearn, already_read) score RECEIVED_pr_host_kiev_ua 3.0 header RECEIVED_atilos_td_com_ua Received =~ /atilos-td\.com\.ua/ describe RECEIVED_atilos_td_com_ua Received via atilos-td.com.ua (DSPAM_autolearn, already_read) score RECEIVED_atilos_td_com_ua 3.0 header RECEIVED_www_100mb_ru Received =~ /www9\.100mb\.ru/ describe RECEIVED_www_100mb_ru Received via www9.100mb.ru (DSPAM_autolearn, already_read) score RECEIVED_www_100mb_ru 3.0 header RECEIVED_k9_kiev_ua Received =~ /k9\.kiev\.ua/ describe RECEIVED_k9_kiev_ua Received via k9.kiev.ua (DSPAM_autolearn, already_read) score RECEIVED_k9_kiev_ua 3.0 header RECEIVED_server_p_host_biz Received =~ /server\.p-host\.biz/ describe RECEIVED_server_p_host_biz Received via server.p-host.biz (DSPAM_autolearn, already_read) score RECEIVED_server_p_host_biz 3.0 ######################################## header FROM_WWW_SURBIS_RU Received =~ /by www\.surbis\.ru \(Postfix\)/ describe FROM_WWW_SURBIS_RU Message received from smtp.surbis.ru (www.surbis.ru) relay score FROM_WWW_SURBIS_RU 2.8 header RECEIVED_mhXX_mobyhost_ru Received =~ /mh\d\d\.mobyhost\.ru/ describe RECEIVED_mhXX_mobyhost_ru Received via mhXX.mobyhost.ru (DSPAM_autolearn, already_read) score RECEIVED_mhXX_mobyhost_ru 4.0 ######################################## header RCVD_ex17_eea_de Received =~ /\bex17-eea\.de\b/ describe RCVD_ex17_eea_de Received thru ex17-eea.de (DSPAM_autolearn, already_read) score RCVD_ex17_eea_de 5.5 tflags RCVD_ex17_eea_de mandatory_learn ifplugin Mail::SpamAssassin::Plugin::DSPAM meta RCVD_ex17_eea_de_DSPAM RCVD_ex17_eea_de && DSPAM_CHECK_00_01 describe RCVD_ex17_eea_de_DSPAM DSPAM compensation for RCVD_ex17_eea_de score RCVD_ex17_eea_de_DSPAM 3.5 endif ######################################## #header RECEIVED_e_postNN_km_ru Received =~ /e-post\d\d\.km\.ru/ #describe RECEIVED_e_postNN_km_ru Received via e-post03.km.ru/e-post06.km.ru (DSPAM_autolearn, already_read) #score RECEIVED_e_postNN_km_ru 3.0 header RECEIVED_e_postNN_km_ru Received =~ /e-post\d\d\.km\.ru/ describe RECEIVED_e_postNN_km_ru Received via e-post03.km.ru/e-post06.km.ru score RECEIVED_e_postNN_km_ru 3.0 ifplugin Mail::SpamAssassin::Plugin::DSPAM meta RECEIVED_e_postNN_km_ru_DSPAM_compensation RECEIVED_e_postNN_km_ru && DSPAM_CHECK_00_01 describe RECEIVED_e_postNN_km_ru_DSPAM_compensation Received via e-post03.km.ru/e-post06.km.ru DSPAM compensation score RECEIVED_e_postNN_km_ru_DSPAM_compensation 3.5 endif meta e_postNN_km_ru_FORGED_MUA_OE RECEIVED_e_postNN_km_ru && FORGED_MUA_OE_boundary describe e_postNN_km_ru_FORGED_MUA_OE Forged MUA Outlook Express from e-postNN.km.ru (DSPAM_autolearn, already_read) score e_postNN_km_ru_FORGED_MUA_OE 2.0 tflags e_postNN_km_ru_FORGED_MUA_OE mandatory_learn meta e_postNN_km_ru_FORGED_MUA_MSO_boundary RECEIVED_e_postNN_km_ru && FORGED_MUA_MSO_boundary_boundary describe e_postNN_km_ru_FORGED_MUA_MSO_boundary Forged MUA Outlook Express from e-postNN.km.ru (DSPAM_autolearn, already_read) score e_postNN_km_ru_FORGED_MUA_MSO_boundary 2.0 tflags e_postNN_km_ru_FORGED_MUA_MSO_boundary mandatory_learn meta e_postNN_km_ru_FORGED_MS_HEADERS RECEIVED_e_postNN_km_ru && FORGED_MS_HEADERS_boundary describe e_postNN_km_ru_FORGED_MS_HEADERS Forged MUA Outlook Express from e-postNN.km.ru (DSPAM_autolearn, already_read) score e_postNN_km_ru_FORGED_MS_HEADERS 2.0 tflags e_postNN_km_ru_FORGED_MS_HEADERS mandatory_learn ######################################## header RECEIVED_mail6_freehost_com_ua Received =~ /by mail6\.freehost\.com\.ua with esmtpa/ describe RECEIVED_mail6_freehost_com_ua Message thru SMTP server mail5.freehost.com.ua score RECEIVED_mail6_freehost_com_ua 2.0 header RECEIVED_mail5_freehost_com_ua Received =~ /by mail5\.freehost\.com\.ua with esmtpa/ describe RECEIVED_mail5_freehost_com_ua Message thru SMTP server mail5.freehost.com.ua score RECEIVED_mail5_freehost_com_ua 2.0 header RECEIVED_mail4_freehost_com_ua Received =~ /by mail4\.freehost\.com\.ua with esmtpa/ describe RECEIVED_mail4_freehost_com_ua Message thru SMTP server mail4.freehost.com.ua score RECEIVED_mail4_freehost_com_ua 2.0 header RECEIVED_clio_freehost_com_ua Received =~ /by clio\.freehost\.com\.ua with esmtpa/ describe RECEIVED_clio_freehost_com_ua Message thru SMTP server clio.freehost.com.ua score RECEIVED_clio_freehost_com_ua 2.0