| 1 |
# -*- mode: spamassassin -*-
|
| 2 |
|
| 3 |
## This file contains rules which match various automatic responders
|
| 4 |
## which give us backscatter. The scores here are best guesses; and
|
| 5 |
## may need to be overridden for recipients which actually want these
|
| 6 |
## bounces.
|
| 7 |
|
| 8 |
# don 2009-02-05
|
| 9 |
body QMAILBOUNCE /This\s*is\s*the\s*qmail-send\s*program/i
|
| 10 |
describe QMAILBOUNCE Stupid qmail bounces; we don't want them
|
| 11 |
score QMAILBOUNCE 2
|
| 12 |
|
| 13 |
# don 2009-02-05 (the following are all for various stupid auto-repsonse things)
|
| 14 |
header RECEIVEDMAIL subject =~ /(?:received\s*your\s*mail|(?:respuesta|risposta) autom.tica)/i
|
| 15 |
describe RECEIVEDMAIL It's great that you've received our mail and automatically responded. We don't care
|
| 16 |
score RECEIVEDMAIL 4
|
| 17 |
|
| 18 |
header YOURMESSAGE subject =~ /your message/i
|
| 19 |
describe YOURMESSAGE It's great that our message did something; we don't care
|
| 20 |
score YOURMESSAGE 2.5
|
| 21 |
|
| 22 |
body NOTPROCBOUNCE /was not processed by our system/i
|
| 23 |
describe NOTPROCBOUNCE Bounce by system that was not processed
|
| 24 |
score NOTPROCBOUNCE 2
|
| 25 |
|
| 26 |
body ACCOUNTNOTEXIST /account\s+\S+\s+(does\s*not|doesn't)\s*exist/
|
| 27 |
describe ACCOUNTNOTEXIST It's not our problem if an account doesn't eixst
|
| 28 |
score ACCOUNTNOTEXIST 2
|
| 29 |
|
| 30 |
body CR_SYSTEM1 /sent by a human and not a computer/i
|
| 31 |
describe CR_SYSTEM1 Looks like a challenge/response system
|
| 32 |
score CR_SYSTEM1 2
|
| 33 |
|
| 34 |
body CR_SYSTEM2 /do not reply/i
|
| 35 |
describe CR_SYSTEM2 Body contains do not reply; likely a CR system
|
| 36 |
score CR_SYSTEM2 1.5
|
| 37 |
|
| 38 |
body CR_SYSTEM3 /confirm this request/i
|
| 39 |
describe CR_SYSTEM3 Body contains confirm this request; likely a CR system
|
| 40 |
score CR_SYSTEM3 1.5
|
| 41 |
|
| 42 |
header CR_SYSTEM4 subject =~ /challenge.*response/i
|
| 43 |
describe CR_SYSTEM4 Subject contains challenge/response
|
| 44 |
score CR_SYSTEM4 3
|
| 45 |
|
| 46 |
body CR_SYSTEM5 /confirmation of list posting/i
|
| 47 |
describe CR_SYSTEM5 Body asks us to confirm a list posting
|
| 48 |
score CR_SYSTEM5 3
|
| 49 |
|
| 50 |
header CR_SYSTEM6 subject =~ /^confirm\:/i
|
| 51 |
describe CR_SYSTEM6 Subject asks us to confirm something; we don't want to
|
| 52 |
score CR_SYSTEM6 2
|
| 53 |
|
| 54 |
body SUPPORTMAIL1 /assigned a ticket/
|
| 55 |
describe SUPPORTMAIL1 Message from an automated support/response system
|
| 56 |
score SUPPORTMAIL1 2
|
| 57 |
|
| 58 |
header SUPPORTMAIL2 subject =~ /^\[*(?:update\s*to\s*)?ticket/
|
| 59 |
describe SUPPORTMAIL2 Message with ticket leading it; probably a support mail
|
| 60 |
score SUPPORTMAIL2 1.5
|
| 61 |
|
| 62 |
body SUPPORTMAIL3 /the email address \S+ is not registered/i
|
| 63 |
describe SUPPORTMAIL3 We don't care if an e-mail address is not registered
|
| 64 |
score SUPPORTMAIL3 1.5
|
| 65 |
|
| 66 |
body SUPPORTMAIL4 /(reached an unmonitored e-mail address|no response will be given)/i
|
| 67 |
describe SUPPORTMAIL4 Yeay for dumb auto-response bots that don't want a response
|
| 68 |
score SUPPORTMAIL4 1.5
|
| 69 |
|
| 70 |
header SUPPORTMAIL5 from =~ /\bsupport\@/i
|
| 71 |
describe SUPPORTMAIL5 Message from an address that looks like support@
|
| 72 |
score SUPPORTMAIL5 1.5
|
| 73 |
|
| 74 |
|
| 75 |
header FROMAUTOREPLY from =~ /(autoreply|no-?repl(?:y|ies))/i
|
| 76 |
describe FROMAUTOREPLY Message from an autoreplier or something who doesn't seem to want a reply
|
| 77 |
score FROMAUTOREPLY 4
|
| 78 |
|
| 79 |
header FROMABUSE from =~ /\babbuse\@/i
|
| 80 |
describe FROMABUSE Message from abbuse@somedomain
|
| 81 |
score FROMEABUSE 1.5
|
| 82 |
|
| 83 |
header SUBJECTSPAM subject =~ /\*\*\s*spam\s*\*\*/i
|
| 84 |
describe SUBJECTPSAM Subject contains **spam**, so it's probably spam
|
| 85 |
score SUBJECTSPAM 3.5
|
| 86 |
|
| 87 |
header MESBLOCKED subject =~ /your message (?:is )?blocked/i
|
| 88 |
describe MESBLOCKED That's great that our message was blocked
|
| 89 |
score MESBLOCKED 2
|
| 90 |
|
| 91 |
header FAILDELIVERY subject =~ /failed to deliver/i
|
| 92 |
describe FAILDELIVERY Oh noes! You failed to deliver spam!
|
| 93 |
score FAILDELIVERY 2
|