# # 2009-2011 Victor Ustugov # header SUSPICIOUS_Opera_MUA User-Agent =~ /^\s*Opera Mail\/10\.\d+ \(Windows\)$/ describe SUSPICIOUS_Opera_MUA Suspicious header X-Mailer score SUSPICIOUS_Opera_MUA 1.0 header SUSPICIOUS_Opera_MUA_MSGID From|Message-Id =~ /<(\S+)>[\s\r\n]*\|<20[01]\d{9}\.\d+\.\1>$/ meta SUSPICIOUS_Opera_10w_MSGID SUSPICIOUS_Opera_MUA && SUSPICIOUS_Opera_MUA_MSGID describe SUSPICIOUS_Opera_10w_MSGID Message pretends to be send from Opera Mail 10.x but has forged Message-ID (DSPAM_autolearn) score SUSPICIOUS_Opera_10w_MSGID 3.5 # # op.u3xv7xcp1gkd7p@lougovsky.avp.ru # op.u3xq5oo1pw3fr2@bug # op.u3xx7kilzwy559@localhost # op.u3wxkwp6r3857z@corvax-book.home.corvax.kiev.ua # header __Opera_1X_MSGID Message-ID:case =~ /^\s*$/ meta FORGED_MUA_Opera_1X_MSGID (__User_Agent_Opera_10 || __User_Agent_Opera_11) && !MISSING_MID && !__Opera_1X_MSGID && !SUSPICIOUS_Opera_10w_MSGID && !__UNUSABLE_MSGID describe FORGED_MUA_Opera_1X_MSGID Message pretends to be send from Opera Mail 10.x/11.x but has forged Message-ID (DSPAM_autolearn) score FORGED_MUA_Opera_1X_MSGID 4.0 meta MUA_Opera_1X_MISSING_MSGID (__User_Agent_Opera_10 || __User_Agent_Opera_11) && (MISSING_MID || MSGID_FROM_MTA_HEADER) describe MUA_Opera_1X_MISSING_MSGID Message pretends to be send from Opera Mail 10.x/11.x but has forged Message-ID (DSPAM_autolearn) score MUA_Opera_1X_MISSING_MSGID 2.0