# # 2003-2023 Victor Ustugov # # проверка полей Content-Type и Content-Transfer-Encoding # meta CT_7BIT_QP __Content_Type_text_7bit && __Content_Transfer_Encoding_qp && !__MAILMAN describe CT_7BIT_QP Content type text with strange Content-Transfer-Encoding quoted-printable score CT_7BIT_QP 2.5 ifplugin Mail::SpamAssassin::Plugin::DSPAM meta CT_7BIT_QP_DSPAM CT_7BIT_QP && DSPAM_CHECK_00_01 describe CT_7BIT_QP_DSPAM DSPAM compensation for CT_7BIT_QP score CT_7BIT_QP_DSPAM 3.5 endif meta CT_7BIT_BASE64 __Content_Type_text_7bit && __Content_Transfer_Encoding_base64 describe CT_7BIT_BASE64 Content type text with strange Content-Transfer-Encoding base64 score CT_7BIT_BASE64 2.5 ifplugin Mail::SpamAssassin::Plugin::DSPAM meta CT_7BIT_BASE64_DSPAM CT_7BIT_BASE64 && DSPAM_CHECK_00_01 describe CT_7BIT_BASE64_DSPAM DSPAM compensation for CT_7BIT_BASE64 score CT_7BIT_BASE64_DSPAM 3.5 endif meta CT_WITHOUT_CHARSET_CTE_8BIT __CUST_Content_Type_text_withowt_charset && __Content_Transfer_Encoding_8bit && !(__UKR_NET_auto_generated || __UKR_NET_auto_replied) describe CT_WITHOUT_CHARSET_CTE_8BIT Content-Type without charset with 8-bit header Content-Transfer-Encoding score CT_WITHOUT_CHARSET_CTE_8BIT 1.5 meta CT_7BIT_CTE_8BIT __Content_Type_text_7bit && !__CUST_Content_Type_text_UTF && __Content_Transfer_Encoding_8bit describe CT_7BIT_CTE_8BIT 7-bit header Content-Type found with 8-bit header Content-Transfer-Encoding score CT_7BIT_CTE_8BIT 2.0 ##### # при 8-битном charset в поле Content-Type указано 7-битное поле Content-Transfer-Encoding # # Content-Type: text/html; charset=windows-1251 # Content-Transfer-Encoding: 7bit # meta CT_8BIT_CTE_7BIT __CUST_Content_Type_text_8bit && !__CUST_Content_Type_text_UTF && __CUST_Content_Transfer_Encoding_7bit describe CT_8BIT_CTE_7BIT 8-bit header Content-Type found with 7-bit header Content-Transfer-Encoding score CT_8BIT_CTE_7BIT 2.6 #meta __MIME_CT_8BIT_CTE_7BIT __MIME_Content_Type_text_8bit && !__MIME_Content_Type_text_UTF && __MIME_Content_Transfer_Encoding_7bit full __MIME_CT_8BIT_CTE_7BIT /--.+?\r?\nContent-Type: text\/(plain|html)\b\s*;[\n\r\s]*charset="?(koi8-r|koi8-u|koi-8|koi8r|koi8u|koi8|windows-1251|windows-1252|cp1251|iso-8859-5|866|cp866|cp-866|x-cp866|csibm866|ibm866|x-mac-cyrillic|maccyrillic|mac-cyrillic|msmaccyrillic|ms-mac-cyrillic)"?\r?\nContent-Transfer-Encoding: 7bit/ meta MIME_CT_8BIT_CTE_7BIT __MIME_CT_8BIT_CTE_7BIT && !EMPTY_MESSAGE describe MIME_CT_8BIT_CTE_7BIT 8-bit header Content-Type found with 7-bit header Content-Transfer-Encoding score MIME_CT_8BIT_CTE_7BIT 2.0 ##### # при 8-битном charset в поле Content-Type не указано поле Content-Transfer-Encoding # # Content-Type: text/html; charset=windows-1251 # Content-Transfer-Encoding: отсутствует # meta CT_TEXT_WITHOUT_CTE __CUST_Content_Type_text_8bit && !__CTE && !(__User_Agent_Mutt && __CUST_Content_Type_text_plain && __Content_Disposition_inline) && !HotMail_COM && !__NewMail_RU && !__Lotus_Notes5 && !__QUALCOMM_Windows_Eudora_X_Mailer && !__OZONRU && !AUTOCONSULT && !UKRTELECOM_INFORM && !__SMARTRESPONDER_RU describe CT_TEXT_WITHOUT_CTE header Content-Type found without required header Content-Transfer-Encoding score CT_TEXT_WITHOUT_CTE 2.0 ##### # при отсутствующем Content-Transfer-Encoding два раза указано поле Content-Type # # Content-Type: text/html;charset="windows-1251" # Content-Type: multipart/alternative; # boundary="----=_NextPart_000_E03_410D1A93.62576A47" # header __DOUBLE_CT_WOUT_CTE Content-Type =~ /text\/html;charset="windows-1251"[.\n\r]+multipart\/alternative/ meta DOUBLE_CT_WOUT_CTE __DOUBLE_CT_WOUT_CTE && __CUST_Content_Transfer_Encoding_EMPTY describe DOUBLE_CT_WOUT_CTE Double header Content-Type without Content-Transfer-Encoding score DOUBLE_CT_WOUT_CTE 2.0 ##### # при 7-битном Content-Transfer-Encoding два раза указано поле Content-Type # # Content-Type: text/HTML; charset = windows-1251 # Content-Transfer-Encoding: 7bit # Content-Type: multipart/related; # boundary="----=_NextPart_000_0000_01C4379A.2926DAC0"; # type="text/html" # header __DOUBLE_CT Content-Type =~ /text\/HTML; charset = windows-1251[.\n\r]+multipart\/related;.+type="text\/html"/ meta DOUBLE_CT __DOUBLE_CT && __CUST_Content_Transfer_Encoding_7bit describe DOUBLE_CT Double header Content-Type with wrong type score DOUBLE_CT 4.0 ##### # при 7-битном Content-Transfer-Encoding в поле Content-Type указан charset windows-1251 # # Content-Type: text/HTML; charset = windows-1251 # Content-Transfer-Encoding: 7bit # header __CT_1251_WITH_SB Content-Type =~ /text\/(HTML|plain); charset = windows-1251/ meta CT_1251_WITH_SB __CT_1251_WITH_SB && __CUST_Content_Transfer_Encoding_7bit && !DOUBLE_CT describe CT_1251_WITH_SB Content-Type with charset windows-1251 and space bars and 8bit Content-Transfer-Encoding score CT_1251_WITH_SB 4.0 ##### # при Content-Transfer-Encoding: base64 в поле Content-Type указан charset windows-1251 # # Content-Type: text/HTML; charset = windows-1251 # Content-Transfer-Encoding: base64 # header __CTE7_CT_1251_WITH_SB Content-Type =~ /text\/(HTML|plain); charset = windows-1251/ meta CTE7_CT_1251_WITH_SB __CTE7_CT_1251_WITH_SB && __CUST_Content_Transfer_Encoding_base64 && !DOUBLE_CT describe CTE7_CT_1251_WITH_SB Content-Type with charset windows-1251 and space bars and base64 Content-Transfer-Encoding score CTE7_CT_1251_WITH_SB 4.0 ##### # при Content-Type: multipart есть поле Content-Transfer-Encoding: # # Content-Type: multipart/alternative; boundary="0-1069095558-1092238248=:56716" # Content-Transfer-Encoding: 8bit # #meta __CT_MULTIPART_CTE __CUST_Content_Type_multipart && __CTE && !(__CUST_Content_Type_multipart_report && __CUST_From_MAILER_DAEMON) #meta __CT_MULTIPART_CTE __CUST_Content_Type_multipart && __CTE && !(__CUST_Content_Type_multipart_report && __CUST_From_Mail_Delivery_System) meta __CT_MULTIPART_CTE __CUST_Content_Type_multipart && __CTE && !__CUST_Content_Transfer_Encoding_binary && !(__CUST_Content_Type_multipart_report && (__CUST_From_Mail_Delivery_System || __CUST_From_Daemon)) && !__CUST_Content_Type_multipart_signed && !__Content_Disposition_inline && !__ELM_MUA_Multipart_Mixed && !LIST_RU && !__YAHOO && !__RAMBLER_Multipart && !__MS_CDO && !__MS_Exchange && !POCHTARU && !__INBOXLV && !WORKCOMUA && !VORKCOMUA && !(__USER_AGENT_IMP && (__CUST_Content_Type_multipart_alternative || __CUST_Content_Type_multipart_mixed)) && !__APPLE && !RADIO_PRAGUE && !RAPIDNEWS && !CREDITDNEPR && !UZ_GOV_UA && !MINFIN_GOV_UA && !MAILBG && !Likis_SPN_Price_list && !UKRTELECOM_INFO_KV && !PHARMA_NET_UA && !__iPhone && !__iPad && !__X_Mailer_Redmine meta __CT_MULTIPART_CTE_NO_MUA __CT_MULTIPART_CTE && __CUST_User_Agent_EMPTY && (__CUST_X_MAILER_EMPTY || __CUST_X_Mailer_MIME_Lite) && !UKRTELECOM_INFO_KV meta CT_MULTIPART_CTE_NO_MUA __CT_MULTIPART_CTE_NO_MUA && !AVAL && !DHL && !BALANCE_CLUB && !EXIST_UA describe CT_MULTIPART_CTE_NO_MUA Multipart message with header Content-Transfer-Encoding and without header X-Mailer/User-Agent score CT_MULTIPART_CTE_NO_MUA 0.5 meta CT_MULTIPART_CTE __CT_MULTIPART_CTE && !CT_MULTIPART_CTE_NO_MUA && !AVAL && !DHL && !PS && !BALANCE_CLUB && !EXIST_UA && !__iPad && !__iPhone && !RAMBLER_Multipart describe CT_MULTIPART_CTE Multipart message with header Content-Transfer-Encoding score CT_MULTIPART_CTE 1.1 ##### # дважды упоминаемый charset в поле Content-Type # # Content-Type: text/html; # charset="windows-1251"; charset=windows-1251 # header CT_DOUBLE_CHARSET Content-Type =~ /text\/(plain|html);\s*charset="windows-1251"; charset=windows-1251/ describe CT_DOUBLE_CHARSET Double charset in header Content-Type score CT_DOUBLE_CHARSET 1.5 ##### # фильтровать два Type в Content-Type: # Content-Type: multipart/related; # Type="multipart/alternative"; # boundary="----=_NextPart_000_0023_01C2A75B.6A694E1A" # или # Content-Type: multipart/related; # boundary="----_=_NextPart_001_01C3CE0C.49C89EA4"; # type="multipart/alternative" # #header CT_DOUBLE_TYPE_MULTI Content-Type =~ /multipart\/related;\s*(boundary=".+?";)?\s*type="multipart\/alternative"/i #describe CT_DOUBLE_TYPE_MULTI Double multipart type in header Content-Type #score CT_DOUBLE_TYPE_MULTI 0.5 ##### # фильтровать Content-Type: multipart/related с последующим type="text/html": # Content-Type: multipart/related; # boundary="----=_NextPart_000_0000_01C4379A.2926DAC0"; # type="text/html" # #header CT_DOUBLE_TYPE_TEXT Content-Type =~ /multipart\/related;\s*(boundary=".+?";)?\s*type="text\/html"/i #describe CT_DOUBLE_TYPE_TEXT Double type in header Content-Type #score CT_DOUBLE_TYPE_TEXT 0.5 ##### # фильтровать чарсет в Content-Type: multipart: # Content-Type: multipart/mixed; boundary="x0x0x0x0x0x0x0x0x0x0x0x0x"; # charset="Windows-1251" # или # Content-Type: multipart/alternative; # boundary="=_NextPart_2rfkindysadvnqw3nerasdf"; # charset="ISO-8859-1" # header __CT_MULTIPART_CHARSET Content-Type =~ /multipart\/(mixed|alternative);\s*(boundary=".+?";)?\s*charset="?.+?"?/ meta CT_MULTIPART_CHARSET __CT_MULTIPART_CHARSET && !__CALLSINFO_KS && !__CALLSINFO_KS2 && !__PhTrd_UTF8 && !__PhTrd9_X_Library && !ZEND && !__MifMailer_MUA_Multipart_Mixed && !__ABONENTS_VOLIACABLE_NET && !RAPIDNEWS && !PROCONSULTING && !AROMAT && !ZEND && !AVAL && !PS && !BALANCE_CLUB && !EXIST_UA && !COMPANION_UA && !UKRTELECOM_INFO_KV && !PHARMA_NET_UA && !ARTUR && !__X_Mailer_Redmine describe CT_MULTIPART_CHARSET Field charset found in multipart header Content-Type score CT_MULTIPART_CHARSET 0.5 ##### # Content-Type: text/plain; # format=flowed; # charset="windows-1251"; # reply-type=original # Content-Transfer-Encoding: 7bit header __CT_PLAIN_FLOWED_CHARSET8_CTE7 Content-Type =~ /text\/plain;[\r\n\s]*format=flowed;[\r\n\s]*charset="?windows-1251"?;[\r\n\s]*reply-type=original/ meta CT_PLAIN_FLOWED_CHARSET8_CTE7 __CT_PLAIN_FLOWED_CHARSET8_CTE7 && __CUST_Content_Transfer_Encoding_7bit && !CT_8BIT_CTE_7BIT describe CT_PLAIN_FLOWED_CHARSET8_CTE7 8-bit header Content-Type found with 7-bit header Content-Transfer-Encoding score CT_PLAIN_FLOWED_CHARSET8_CTE7 2.0 ##### # Content-type: text/html; charset=windows-1251 # Content-Transfer-Encoding: quoted-printable # Content-Type: text/html; charset="windows-1251" header CT_DOUBLED ALL =~ /(?is)^(.*\r?\n)?Content-type:.*?\r?\nContent-Type:/ describe CT_DOUBLED Two headers Content-Type found score CT_DOUBLED 5.0 ##### # Content-Type: multipart/related; charset="windows-1251"; boundary="rK4dF5QQEWkUgJCT=_oDLybsX4MgjXRmwx" # Content-Transfer-Encoding: 8bit header __CT_MPART_CHARSET_CT Content-Type =~ /\s*multipart\/(related|alternative); charset="[Ww]indows-1251"; boundary="[a-zA-Z\d]+=_[a-zA-Z\d]+"$/ meta __CT_MULTIPART_CHARSET_CTE __CT_MPART_CHARSET_CT && __Content_Transfer_Encoding_8bit meta CT_MULTIPART_CHARSET_CTE __CT_MULTIPART_CHARSET_CTE && !BALANCE_CLUB && !EXIST_UA && !DHL describe CT_MULTIPART_CHARSET_CTE Suspicious multipart Content-Type with charset and 8bit Content-Transfer-Encoding 8bit score CT_MULTIPART_CHARSET_CTE 0.5