# spamblock Version 2026-06-15 # -*- perl -*- #
# 
# © 1997-2026 Ullrich Horlacher <framstag@belwue.de>
#
# Diese Software unterliegt der Perl Artistic Licence
# 
# Mechanismus: 
# ------------
#
# Zuerst wird nur der Header mit Hilfe von procmail-Regeln ausgewertet und auf
# Spam-Indizien untersucht. Wenn dies erfolgreich war, wird ein Perl-
# Programm gestartet (haengt unten mit an), das den Body inspiziert.
#
# Alle Indizien werden in der Variable SI gesammelt in Form von Scoring-Punkten
# und dazugehoerigen Kommentaren, die am Schluss entweder zu einer 
# X-Spamblock-maybe (SI < SPAMLEVEL) oder einer X-Spamblock (SI >= SPAMLEVEL)
# Header-Zeile zusammengefasst werden. SPAMLEVEL hat den Default-Wert 100, kann
# aber beliebig geaendert werden.
# 
# Dieses zweistufige procmail/perl-Konzept dient der Effizienz.
# 
# Als letzte Stufe wird noch ein Gegen-Check gemacht ob es sich um Antworten
# auf Spambeschwerden oder mails an den Admin handelt. Diese werden natuerlich 
# durchgelassen (X-Spamblock: ignored).
# 
# Installation:
# -------------
# procmail installieren, falls noch nicht vorhanden. Dann dieses File als 
# $HOME/.spamblock ablegen und in $HOME/.procmailrc die Zeile:
#	INCLUDERC=$HOME/.spamblock
# einfuegen.
# ACHTUNG: *Nicht* ins system-procmailrc (/etc/procmailrc) schreiben! 
#          Das fuehrt zu unangenehmen Seiteneffekten (wrong ownership)!
#
# "touch $HOME/.spamblock.local" ausfuehren.
#
# Konfiguration:
# --------------
# Die lokale Konfiguration sollte in $HOME/.spamblock.local stehen und
# kann die folgende Variablen enthalten:
#	SPAMBLOCK
#	MYDOMAIN
#	MYTOKEN
#	SPAMLEVEL
#	FULLCHECK
#	HTML
#	ASIANCHARSET
#	CHINANET
#	KORNET
#	SEEDNET
#	HINET
#	HTHKNET
# Defaultwerte und Erklaerungen stehen am Ende dieses Kommentarblocks. 
# !!Insbesondere sollte *UNBEDINGT* MYDOMAIN gesetzt werden!!
#
# Die Syntax fuer eigene Konfigurationsvariablen ist VARIABLE=WERT, z.B.:
#	SPAMLEVEL=150
#	MYDOMAIN="belwue.de|uni-stuttgart.de"
#
# (Achtung: nicht die Initialisierungs-Syntax VARIABLE=${VARIABLE:-WERT} 
# verwenden! Das funktioniert nicht fuer die lokalen Konfigurationsvariablen!)
#
# Die Variable SPAMBLOCK definiert wohin Spam abgelegt werden soll. Bei
# "SPAMBLOCK=-" (Minus) wird nur gefiltert, aber nicht gespeichert, d.h.
# es werden nur X-Spamblock-Headerzeilen hinzugefuegt und ansonsten die
# Mail normal ausgeliefert.
#
# Die Variable MYTOKEN definiert einen String, der einen "Passierschein" 
# darstellt, sollte er im Body der zu untersuchenden Mail auftauchten. 
# Sehr gut geeignet dafuer ist ein String aus der eigenen Signature, der dann
# bei TOFUs im Reply wieder auftaucht.
#
# Alternativ zu $HOME/.spamblock.local koennen die oben genannten Variablen
# auch in $HOME/.procmailrc vor der INCLUDERC-Anweisung stehen. 
#
# Zusaetzlich koennen Site-spezifische Anpassungen in einem extra File
# stehen, z.B. in /usr/local/etc/spamblock.site
# Damit dieses File fuer alle User geladen wird (passiert vor dem Laden von
# $HOME/.spamblock.local), muss im System-procmailrc stehen:
#	SPAMBLOCK_DEFAULTS=/usr/local/etc/spamblock.site
# Dieses System-procmailrc liegt normalerweise in /etc/procmailrc oder
# /usr/local/etc/procmailrc
#
# Bestimmte Adressen, die aussehen wie Spam, aber keiner sind, muessen in
# $HOME/.spamblock.local (oder $HOME/.procmailrc oder $SPAMBLOCK_DEFAULTS) 
# extra gekennzeichnet werden mit einer "X-Spamblock: ignore" Headerzeile. 
# Beispiele:
#
#   :0 fw
#   * ^Subject: Einladung
#   | formail -A 'X-Spamblock: ignored by MY rule "Einladung"'
#
#   :0 fw
#   * ^From:.*(uni-stuttgart\.de|dfn\.de)
#   | formail -A 'X-Spamblock: ignored by MY rule "decent domains"'
#
#
# spamblock unterstuetzt auch eine Sender whitelist. Diese muss als
# Berkeley DB in $HOME/.spamblock_wl.db vorliegen. Erzeugen kann man sie mit:
#  
# perl -x spamblock -w add Adresse     # hinzufuegen einzelner E-Mail Adresse
# perl -x spamblock -w delete Adresse  # loeschen einer E-Mail Adresse
# perl -x spamblock -w extract Mailbox # hinzufuegen aller To/Cc Adressen aus
#                                      # Mailbox
# perl -x spamblock -w show            # anzeigen aller whitelist Adressen
#
# Weiterhin kann man $HOME/.spamblock_wl.db staendig automatisch erweitern
# indem man sich den MTA proxy sendmail_wldb installiert:
#
# perl -x spamblock -w proxy > sendmail_wldb && chmod 755 sendmail_wldb
#
# sendmail_wldb entnimmt ausgehenden E-Mails die Adressen aus den To und
# Cc Header und fuegt sie in $HOME/.spamblock_wl.db ein.
#
# Danach muss man sendmail_wldb als MTA in seinen MUA eintragen. Bei mutt
# geht das zB durch die Anweisung:
#
# set sendmail=/pfad/zu/sendmail_wldb
# 
# Fehler:
# -------
# Ich entwickle spamblock staendig weiter, kann aber prinzipiell nicht
# garantieren, dass er fehlerfrei arbeitet.
# Da spamblock nicht zu meinem Hauptjob gehoert, bitte ich darum Spam, der 
# nicht erkannt wird, nicht an mich weiterzuleiten. Ich habe fuer fremde 
# Headeranlyse leider keine Zeit. 
# 
# Support:
# --------
# Gibts keinen (mehr). Sorry, keine Zeit!

# gefundener Muell wird im Folder $MAIL/spamblock abgelegt
SPAMBLOCK=${SPAMBLOCK:-"spamblock"}

# eigene Domain(s)
MYDOMAIN=${MYDOMAIN:-"belwue\.de|uni-stuttgart\.de|hlrs\.de"}

# ab wann eine Mail Spam ist
SPAMLEVEL=${SPAMLEVEL:-100}

# alle checks aktivieren (sonst wird bei erreichen von SPAMLEVEL abgebrochen)
FULLCHECK=${FULLCHECK:-"ok"}

# Mails aus diversen asiatischen Adressbereichen durchlassen
#CHINANET=${CHINANET:-"ok"}
#KORNET=${KORNET:-"ok"}
#HINET=${HINET:-"ok"}
#SEEDNET=${SEEDNET:-"ok"}
#HTHKNET=${HTHKNET:-"ok"}

# asiatische Zeichensaetze durchlassen
#ASIANCHARSET=$(ASIANCHARSET:-"ok"}

# HTML durchlassen
#HTML=${HTML:-"ok"}

# Idioten, die keine vernuenftige Mails hinkriegen
STUPIDS=${STUPIDS:-"amazon[a-z]*\.(com|de)|pearl\.de|conrad\.de|pollin\.de|dhl\.de|plus\.de|web\.de|gmx\.de|norma24\.de|stackexchange\.com|godaddy\.com|smtp2go|letsencrypt\.org"}

# Header-Signaturen von Mailinglisten
MAILINGLIST=(${MAILINGLIST:-"^Received.*(LISTSERV.*with spool|ecircle|with netnews)|^List-ID.*<|^(X-)?Mailing-|^X-eGroups-Return|^X-ML:|^X-Unity|^X-Loop:|^X-Resent-By:|^Message-ID:.*BeroList|^Sender:.*(owner|request|errors|bounce|-return-).*@|^In-Reply-To: <mailman|^From:.*(-announce|-admin|-request|lists?|ecartis)@"})

# Mailinglisten Robot Adressen
LISTROBOT=(subscribe|join|leave|request)

# dialup hostnamen
DIALUP="^ip-?[0-9-]+\.|^[0-9]+-[0-9]+\.|^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\.|[0-9]+[\.\-][0-9]+[\.\-][0-9]+[\.\-][0-9]+\.[a-z]|dialup|dslnet|pppoe|dsl-|dial-|ppp-|cable[\.-]|^host[0-9-]|(^|\.)(reverse|static|dynamic-|pool-|broadband|bredband|.?dsl)|t-dialin|dhcp|\.clients\.|client[0-9]|klient-|^cust|\.dip[0-9]\."

# spamblock-Skript mit Pfad
SPAMBLOCK_SCRIPT=${SPAMBLOCK_SCRIPT:-$INCLUDERC}

# whitespace regexp (tab+space)
WS="[	 ]"

# init spamindex
SI=""

# spamblock record separator
RS=""
	
# Konsonanten
CONS="[bcdfghjklmnpqrstvwxz]"

# Vokale
VOCS="[aeiou]"

# whitespace
WS=" 	"

## alte X-Spamblock Headerzeilen loeschen
:0 fw
* ^X-Spamblock
* !^X-Spamblock: ignore
| formail -I X-Spamblock

# Site-lokale Konfiguration
INCLUDERC=$SPAMBLOCK_DEFAULTS

# User-lokale Konfiguration
INCLUDERC=${SPAMBLOCK_LOCAL:-"$HOME/.spamblock.local"}


# fuer Test-Zwecke
:0 f
* ^Subject: spam-test
| formail -A 'X-Spamblock: caught by rule test'

#VERBOSE=on

# Stupid HTML mailers
:0 
* ^From:.*@aol\.com
* ^Received:.*\.aol\.com
{ HTML="ok" }

:0 E
* ^X-Mailer: Lotus Notes
{ HTML="ok" }

#
## bekannte Spam-Relays
#

# zuerst mal die Asiaten

:0
* !CHINANET ?? ok
* $!$MAILINGLIST
{
	:0 
	* 1^0 ^Received:.*\.cn .
	* 1^0 ^From:.*\.cn>
	{ SI="$SI$RS 200 .cn" }

	:0
	* ^(From|Received|Reply-To):.*[12]63\.(com|net)
	{ SI="$SI$RS 30 163.net" }

	:0 E
	* ^(From|Received|Reply-To).*\etang\.com
	{ SI="$SI$RS 1000 etang.com" }
	
	:0 E
    	* ^Reply-To.*@..cn
	{ SI="$SI$RS 1000 Reply-To. ..cn" }
  
	:0 E
	* ^(From|Received).*chinabiz
	{ SI="$SI$RS 1000 chinabiz" }

	:0 E
	* ^(From|Received).*prettylong\.com
	{ SI="$SI$RS 1000 prettylong.com" }

	:0 E
	* ^(From|Received|Sender|Reply-To):.*21cn\.com
	{ SI="$SI$RS 200 21cn.com" }

	:0 E
	* ^(From|To|Received):.*exp\.com\.cn
	{ SI="$SI$RS 1000 exp.com.cn" }

	:0 E
	* ^(From|To|Received|Sender|Reply-To):.*china\.com
	{ SI="$SI$RS 200 china.com" }

	:0 E
	* ^(From|To|Received|Sender|Reply-To):.*[@\.]sina\.com
	{ SI="$SI$RS 200 sina.com" }

	:0 E
	* 1^0 ^Received.*\[58\.(1[4-9]|[2-5].|6[0-7])\.
	* 1^0 ^Received.*\[59\.(3[2-9]|4[012])\.
	* 1^0 ^Received.*\[59\.(4[4-9]|[567].|8[0-3])\.
	* 1^0 ^Received.*\[60\.(.|[12].|3[01])\.
	* 1^0 ^Received.*\[61\.(12[89]|1[3-8].|19[01])
	* 1^0 ^Received.*\[121\.37
	* 1^0 ^Received.*\[122\.([4-9]|1[0-5])\.
	* 1^0 ^Received.*\[124\.20[0-7]\.
	* 1^0 ^Received.*\[125\.(6[4-9]|[7-9].|11[2-9]|12[0-5])\.
	* 1^0 ^Received.*\[202\.(9[6-9]|10.|111)\.
	* 1^0 ^Received.*\[210\.12\.
	* 1^0 ^Received.*\[211\.9[67]\.
	* 1^0 ^Received.*\[211\.101\.2(2[4-9]|[34][0-9]|5[0-5])
	* 1^0 ^received.*\[211\.(13[6-9]|14[01])\.
	* 1^0 ^Received.*\[218\.(.|[12].|3[01]|5[6-9]|[6-9].)\.
	* 1^0 ^received.*\[218\.20[0-5]\.
	* 1^0 ^Received.*\[219.(12[89]|1[345].)\.
	* 1^0 ^Received.*\[220\.(1[6-9].|20[0-7])
	* 1^0 ^Received.*\[221.([0-9]|1[0-5])\.
	* 1^0 ^Received.*\[221.(19[2-9]|2[0-3].)
	* 1^0 ^Received.*\[222.(1[6-9]|[2-8].|9[0-5]|12[89]|13.|14[0-3])\.
	* 1^0 ^Received.*\[222.(16[5-9]|1[7-9].|2[01].|22[012])\.
	* 1^0 ^Received.*\.cn \(
	* 1^0 ^Received.*\.cndata\.com \(
	{ SI="$SI$RS 200 CHINANET" }
}
  
:0
* !HINET ?? ok
* $!$MAILINGLIST
{
	:0 
	* ^(From|Received).*(ethome\.net|enews\.com)
	{ SI="$SI$RS 100 ethome/enews" }

	:0 
	* ^Received:.*\[(61\.(21[6-9]|22[0-7])|211\.2[0-3]|211\.72|218\.(16[0-9]|17[0-5]))\.
	{ SI="$SI$RS 30 HINET" }
}

# inetnum:      210.0.128.0 - 210.0.255.255
# inetnum:      210.3.0.0 - 210.3.255.255
# netname:      HTHKNET
# descr:        Hutchison Telecommunications (Hong Kong) Limited
# country:      HK
# admin-c:      IH17-AP
# tech-c:       IH17-AP
# mnt-by:       APNIC-HM
# mnt-lower:    MAINT-HK-HGCADMIN
# source:       APNIC
# 
:0 
* !HTHKNET ?? ok
* ^Received.*\[(210\.0\.(12[89]|1[3-9][0-9]|2[0-5][0-9])|210\.3\.)
{ SI="$SI$RS 100 HTHKNET" }

:0 
* !HTHKNET ?? ok
* ^Received.*hkcable\.com\.hk
{ SI="$SI$RS 100 hkcable.com.hk" }

:0 
* !SEEDNET ?? ok
* ^Received.*\.seed\.net
{ SI="$SI$RS 100 seed.net" }

# http://www.apnic.net/apnic-bin/ipv4-by-country.pl?country=kr
:0 
* !KORNET ?? ok
* 1^0 ^Received.*\[59.([0-9]|2[0-9]|3[01])\.
* 1^0 ^Received.*\[61\.2(4[89]|5[0-5])\.
* 1^0 ^Received.*\[121.(12[89]|1[3-8].|19[01])\.
* 1^0 ^Received.*\[124.(4[89]|5.|6[0-3])\.
* 1^0 ^Received.*\[203\.192\.162
* 1^0 ^Received.*\[210\.(9.|1[01].|12[0-7]|17[89]|18[0-3]|20[4-7]|21[6-9]|22[0-3])\.
* 1^0 ^Received.*\[211\.(3[2-9]|[45].|6[0-3]|10[4-9]|11.|16[89]|1[789].|2[0-5].)\.
* 1^0 ^Received.*\[218\.(14[4-9]|15.|23[4-9]|4[89]|5[0-5])\.
* 1^0 ^Received.*\[219\.(24[89]|25.)\.
* 1^0 ^Received.*\[220\.(6[4-9]|7[01])\.
* 1^0 ^Received.*\[221\.1(3[89]|[45].|6[0-8])\.
* 1^0 ^Received.*\[222\.23[2-9]\.
* 1^0 ^Received.*\.kr \(
{ SI="$SI$RS 100 KORNET" }

#
## Spammer-Provider
#

:0 
* ^Received:.*google\.com
{
  :0
  * ^Reply-To:.*@\/hotmail\.com
  { SI="$SI$RS 200 google.com and $MATCH" }
  
  :0
  * ^From:.*\/noreply
  { SI="$SI$RS 200 google.com and $MATCH" }
  
  :0 E
  * ^From:.*\/amazon
  { SI="$SI$RS 1000 google.com and $MATCH" }
  
  :0 E
  { SI="$SI$RS 10 google.com" }
}

:0 
* ^From:.*freemail\.hu
{ SI="$SI$RS 100 freemail.hu" }

:0 
* ()yandex\.com
{ SI="$SI$RS 30 yandex.com" }

#:0 
#* ^Received:.*websitewelcome
#{ SI="$SI$RS 100 websitewelcome" }

:0 
* ^Received:.*\/contaboserver
{ SI="$SI$RS 10 $MATCH" }

:0 
* ^Received:.*xrea\.com
{ SI="$SI$RS 100 xrea.com" }

:0 
* ^Received:.*\/inmotionhosting
{ SI="$SI$RS 10 $MATCH" }

:0 
* ^Received:.*\/mta2\.net
{ SI="$SI$RS 100 mta2.net" }

:0 
* ^Received:.*\/hostpapavps
{ SI="$SI$RS 100 $MATCH" }

:0 
* ^Received:.*\[192\.3\.
{ SI="$SI$RS 100 hostpapa" }

:0 
* ^Received:.*\[162\.21[45]
{ SI="$SI$RS 100 bluehost" }

:0 
* ^Received:.*infomaniak\.ch
{ SI="$SI$RS 50 infomaniak.ch" }

:0 
* ^Received:.*vservers\.es
{ SI="$SI$RS 30 vservers.es" }

:0 
* ^Received:.*gob\.mx
{ SI="$SI$RS 30 gob.mx" }

:0 
* ^Received:.*nifty\.com
{ SI="$SI$RS 30 nifty.com" }

:0 
* ^Received:.*ntesmail\.com
{ SI="$SI$RS 200 ntesmail.com" }

:0 
* ^Received:.*\/beehiivmail
{ SI="$SI$RS 200 $MATCH" }

:0 
* ^Received:.*kagoya\.net
{ SI="$SI$RS 100 kagoya.net" }

:0 
* ^Received:.*rootlayer\.net
{ SI="$SI$RS 200 rootlayer.net" }

:0 
* ^Received:.*plala\.or\.jp
{ SI="$SI$RS 100 plala.or.jp" }

:0 
* ^Received:.*\/sparkpostmail
{ SI="$SI$RS 100 $MATCH" }

# kein abuse handling!
:0 
* ^Received:.*linkedin\.com
{ SI="$SI$RS 200 linkedin.com" }

:0 
* ^Received:.*sakura\.ne\.jp
{ SI="$SI$RS 200 sakura.ne.jp" }

:0 
* ^Received:.*xserver\.jp
{ SI="$SI$RS 200 xserver.jp" }

:0 
* ^Received:.*members\.linode\.com
{ SI="$SI$RS 30 members.linode.com" }

:0 
* ^Received:.*hostwinds(dns)?\.com
{ SI="$SI$RS 100 hostwinds.com" }

:0 
* ^Received:.*\.had\.wf
{ SI="$SI$RS 100 had.wf" }

:0 
* ^Received:.*websitewelcome\.com
{ SI="$SI$RS 30 websitewelcome.com" }

:0 
* ^Received:.*nazwa\.pl
{ SI="$SI$RS 100 nazwa.pl" }

:0 
* ^Received:.*messagelabs\.com
{ SI="$SI$RS 50 messagelabs.com" }

:0 
* ^Received:.*\.tom\.com
{ SI="$SI$RS 100 tom.com" }

:0 
* ^Received:.*\.cloudapp\.azure\.com
{ SI="$SI$RS 30 cloudapp.azure.com" }

:0 
* ^Received:.*cloudfilter\.net
{ SI="$SI$RS 30 cloudfilter.net" }

:0 
* ^Received:.*be-mail\.it
{ SI="$SI$RS 1000 be-mail.it" }

:0 
* ^Received:.*robotrealms\.net
{ SI="$SI$RS 1000 robotrealms" }

:0 
* 1^0 ^Received:.*sendgrid\.net
* 1^0 ^X-SG-
{ SI="$SI$RS 10 sendgrid.net" }

:0 
* ^Received:.*emailsrvr.com
{ SI="$SI$RS 50 emailsrvr.com" }

:0 
* ^Received:.*shaw\.ca
{ SI="$SI$RS 50 shaw.ca" }

:0 
* ^Received:.*mail2world\.com
{ SI="$SI$RS 30 mail2world.com" }

#:0 
#* ^Received:.*phx3\.secureserver\.net
#{ SI="$SI$RS 200 phx3.secureserver.net" }

:0 
* ^Received:.*consultorpc\.com
{ SI="$SI$RS 200 consultorpc.com" }

:0 
* ^Received:.*hotmail\.com
{ SI="$SI$RS 10 hotmail.com" }

:0 
* ^Received:.*protection\.outlook
{ SI="$SI$RS 10 protection.outlook" }

:0 
* ^Received:.*mailout-us\.gmx
{ SI="$SI$RS 100 mailout-us.gmx" }

:0 
* ^Received:.*numericable\.fr
{ SI="$SI$RS 100 numericable.fr" }

:0 
* ^Received:.*dedibox\.fr
{ SI="$SI$RS 100 dedibox.fr" }

# pollin letsencrypt
#:0 
#* ^Received:.*mandrillapp\.com
#{ SI="$SI$RS 200 mandrillapp.com" }

:0 
* ^Received:.*lws-hosting\.com
{ SI="$SI$RS 100 lws-hosting.com" }

:0 
* ^Received:.*\/okiomailserver
{ SI="$SI$RS 100 $MATCH" }

:0 
* ^Received:.*\/marketing
{ SI="$SI$RS 50 $MATCH" }

:0 
* ^Received:.*mailgun\.(info|net)
{ SI="$SI$RS 50 mailgun" }

:0 
* ^Received:.*euromsg\.net
{ SI="$SI$RS 1000 euromsg.net" }

:0 
* ^Received:.*bluehost\.com
{ SI="$SI$RS 10 bluehost.com" }

# no abuse handling
:0
* ^Received:.*192\.163\.(19[2-9]|2[0-5][0-9])
{ SI="$SI$RS 100 bluehost" }

:0 
* ^Received:.*cantv\.net
{ SI="$SI$RS 100 cantv.net" }

:0 
* ^Received:.*\[202\.61\.2[45].\.
{ SI="$SI$RS 100 netcup.de" }

:0 
* ^Received:.*\[81\.28\.10[0-3]
{ SI="$SI$RS 200 IMINGO" }

# no abuse handling!
:0 
* ^Received:.*\[(46\.101|68\.183|128\.199|134\.122|137\.184|138\.(68|197)|139\.59|142\.93|143\.198|159\.89|165\.22|167\.99|178\.62|188\.166)\.
{ SI="$SI$RS 50 digitalocean.com" }

# no abuse handling!
:0 
* ^Received:.*aliyun\.com.*\[47\.90\.
{ SI="$SI$RS 100 alibaba cloud" }

# no abuse handling!
:0 
* ^Received:.*\[(45\.130\.138|79\.110\.62|185\.102\.17[01])
{ SI="$SI$RS 100 Serverion" }

# no abuse handling!
:0 
* ^Received:.*\[107\.189.(12[89]|1[3-8][0-9]|19[01])
{ SI="$SI$RS 100 IOFLOOD" }

# no abuse handling!
:0
* ^Received:.*\[(50\.6[23]|92\.204\.71|182\.50\.13[23])
{ SI="$SI$RS 50 godaddy" }
  
:0 E
* ^Received:.*secureserver\.net
{ SI="$SI$RS 50 secureserver.net (godaddy)" }
  
# no abuse handling!
:0 
* ^Received:.*\[45\.141\.56
{ SI="$SI$RS 500 IP-Connect Seychelles" }

:0 
* ^Received:.*\[170\.130
{ SI="$SI$RS 100 EONIX" }
  
:0 
* ^Received:.*attcompute\.com
{ SI="$SI$RS 100 attcompute.com" }

:0 E
* ^Received:.*dotmailer\.co\.uk
{ SI="$SI$RS 200 dotmailer.co.uk" }

# SWR
#:0 E
#* ^Received:.*mailjet\.com
#{ SI="$SI$RS 100 mailjet.com" }

:0 E
* ^Received:.*mkt4080\.com
{ SI="$SI$RS 1000 mkt4080.com!" }

:0 E
* ^Received:.*arvixe\.com
{ SI="$SI$RS 1000 arvixe.com!" }

:0 E
* ^Received:.*vmle-rts\.com
{ SI="$SI$RS 1000 vmle-rts.com!" }

:0 E
* ^Received:.*ymlpsrv
{ SI="$SI$RS 1000 ymlpsrv!" }

:0 E
* ^Received:.*register\.it
* $!$MAILINGLIST
{ SI="$SI$RS 1000 register.it!" }

:0 E
* ^Received:.*mx83\.fr
{ SI="$SI$RS 1000 mx83.fr!" }

:0 E
* ^Received:.*mailer-service\.de
{ SI="$SI$RS 1000 mailer-service.de!" }

:0 E
* ^Received:.*startdedicated\.com
{ SI="$SI$RS 1000 startdedicated.com!" }

:0 E
* ^Received:.*hq-mail\.org
{ SI="$SI$RS 1000 hq-mail.org!" }

:0 E
* ^Received:.*constantcontact\.com
{ SI="$SI$RS 1000 constantcontact.com!" }

#:0 
#* ^Received:.*obsmtp\.com
#{ SI="$SI$RS 1000 obsmtp.com!" }

:0 
* ^Received:.*\.smtp\.com
{ SI="$SI$RS 100 smtp.com" }

:0 E
* ^Received:.*\mail\.kz
{ SI="$SI$RS 200 mail.kz" }

:0 E
* ^Received:.*\iol\.cz
{ SI="$SI$RS 10 iol.cz" }

:0 E
* ^Received:.*eonet\.ne\.jp
{ SI="$SI$RS 100 eonet.ne.jp" }

#:0 E
#* ^Received:.*\frontbridge\.com
#{ SI="$SI$RS 200 frontbridge.com" }

:0 E
* ^(From|Reply-To):.*yahoo\.com\.hk
{ SI="$SI$RS 200 yahoo.com.hk" }

:0 E
* ^From:.*yahoo\.com
{ SI="$SI$RS 10 yahoo.com" }

:0 E
* ^(From|Reply-To):.*qq\.com
* $!$MAILINGLIST
{ SI="$SI$RS 200 qq.com" }

:0 E
* yahoo\.co\.uk
* $!$MAILINGLIST
{ SI="$SI$RS 10 yahoo.co.uk" }

:0 E
* yahoo\.co\.jp
* $!$MAILINGLIST
{ SI="$SI$RS 200 yahoo.co.jp" }

:0 E
* ^Received:.*bullet.*\.yahoo\.com
* $!$MAILINGLIST
{ SI="$SI$RS 10 bullet*.yahoo.com" }

:0 E
* ^From: Yahoo
{ SI="$SI$RS 100 From: Yahoo" }

#:0 E
#* ^(From|Received):.*yahoo\.
#* $!$MAILINGLIST
#{ SI="$SI$RS 100 yahoo" }

:0 E
* ^Received:.*eircom\.net
{ SI="$SI$RS 100 eircom.net" }

:0 E
* live\.co\.(za|uk)
{ SI="$SI$RS 30 live.co" }

:0 E
* ^Received:.*kimsufi\.com
* $!$MAILINGLIST
{ SI="$SI$RS 200 kimsufi.com" }

:0 E
* ^Received:.*keko\.net
{ SI="$SI$RS 100 keko.net" }

:0 E
* ^Received:.*scommcenter.*\.asp\.att\.net
{ SI="$SI$RS 100 scommcenter*.asp.att.net" }

:0 E
* ^(From|Received).*serverkompetenz\.net
{ SI="$SI$RS 100 serverkompetenz.net" }

:0 E
* ^(From|Received).*\.ru.com
{ SI="$SI$RS 100 ru.com" }

:0 E
* ^(From|Received).*alice\.it
{ SI="$SI$RS 10 alice.it" }

:0 E
* ^(From|Received).*servage\.net
{ SI="$SI$RS 50 servage.net" }

#:0 E
#* ^Received:.*kasserver\.com
#{ SI="$SI$RS 200 kasserver.com" }

:0 E
* ^Received:.*skanova\.net
{ SI="$SI$RS 200 skanova.net" }

:0 E
* ^(From|Received).*centrum\.cz
{ SI="$SI$RS 100 centrum.cz" }

:0 E
* ^(From|Received).*hospedagemdesite\.com
{ SI="$SI$RS 1000 hospedagemdesite.com" }

:0 E
* ^(From|Received).*stocksnut\.com
{ SI="$SI$RS 1000 stocksnut.com" }

:0 E
* ^(From|Received).*hi5\.com
{ SI="$SI$RS 1000 hi5.com" }

:0 E
* ^(From|Received).*\.forthnet\.gr .
{ SI="$SI$RS 1000 forthnet.gr" }

:0 E
* ^(From|Received).*asianet\.co\.th
{ SI="$SI$RS 1000 asianet.co.th" }

:0 E
* ^(From|Received).*\.inter-news\.net
{ SI="$SI$RS 1000 inter-news.net" }

:0 E
* ^(From|Received).*\.newsletter-mail\.com
{ SI="$SI$RS 1000 newsletter-mail.com" }

:0 E
* ^(From|Received).*loxinfo
{ SI="$SI$RS 1000 loxinfo" }

:0 E
* ^Received.*\.dreamhost\.com
{ SI="$SI$RS 10 dreamhost.com" }

:0 E
* ^Received.*safesecureweb\.com
{ SI="$SI$RS 1000 safesecureweb.com" }

:0 E
* ^Received.*altanusprivatemedia\.com
{ SI="$SI$RS 1000 altanusprivatemedia.com" }

:0 E
* ^Received.*\.onlinetrs\.com
{ SI="$SI$RS 1000 onlinetrs.com" }

:0 E
* ^Received.*(\.aruba\.it|\[212\.237)
{ SI="$SI$RS 100 aruba.it" }

:0 E
* ^Received.*\.libero\.it
{ SI="$SI$RS 30 libero.it" }

:0 E
* ^Received.*intelnet\.net\.gt
{ SI="$SI$RS 200 intelnet.net.gt" }

:0 E
* ^Received.*\.tstt\.net\.tt
{ SI="$SI$RS 200 tstt.net.tt" }

:0 E
* ^Received.*\.dhivehinet
{ SI="$SI$RS 200 dhivehinet" }

:0 E
* ^Received.*\.sls-hosting\.com
{ SI="$SI$RS 1000 sls-hosting.com" }

:0 E
* ^Received.* \[165\.227
{ SI="$SI$RS 100 digitalocean" }

:0 E
* ^Received.*\[84\.246\.24[0-7]\.
{ SI="$SI$RS 1000 DK-RACKSERV" }

:0 E
* ^Received.*\[72\.13\.(1[6-9]|2.|3[01])\.
{ SI="$SI$RS 1000 HOSTBLAZER " }

:0 E
* ^(Received|X-Originating-IP).*\[85\.17\.
* $!$MAILINGLIST
{ SI="$SI$RS 1000 LEASEWEB" }

#:0 E
#* ^Received.*\[91\.199\.51\.
#{ SI="$SI$RS 1000 DHMS-NET" }

:0 E
* ^Received.*\[51\.254\.70\.
{ SI="$SI$RS 1000 elasticemail" }

:0 E
* ^Received.*\vps\.ovh
{ SI="$SI$RS 100 vps.ovh" }

:0 E
* 1^0 ^Received.*\.ovh\.net
* 1^0 ^Received.*\[5\.135
* 1^0 ^Received.*\[37\.59
* 1^0 ^Received.*\[37\.187
* 1^0 ^Received.*\[46\.105
* 1^0 ^Received.*\[51\.68\.21[2345]
* 1^0 ^Received.*\[51\.83
* 1^0 ^Received.*\[51\.89
* 1^0 ^Received.*\[51\.195
* 1^0 ^Received.*\[54\.3[6-9]
* 1^0 ^Received.*\[91\.121
* 1^0 ^Received.*\[91\.134
* 1^0 ^Received.*\[92\.222
* 1^0 ^Received.*\[135\.125
* 1^0 ^Received.*\[139\.99
* 1^0 ^Received.*\[147\.135
* 1^0 ^Received.*\[149\.56
* 1^0 ^Received.*\[149\.202
* 1^0 ^Received.*\[158\.69
* 1^0 ^Received.*\[176\.31
* 1^0 ^Received.*\[178\.3[23]
* 1^0 ^Received.*\[192\.99
{ SI="$SI$RS 20 ovh.net" }

#:0 E
#* 1^0 ^Received.*\[83\.141\.4[23]\.
#* 1^0 ^Received.*\[82\.149\.(251|244)
#{ SI="$SI$RS 1000 adventskalender-online.net" }

#:0 E
#* ^Received.*\[217\.173\.(12[89]|1[345][0-9])
#{ SI="$SI$RS 1000 Titan Networks" }

#:0 E
#* ^Received.*\[67\.96\.7[2-5]
#{ SI="$SI$RS 1000 T1 Marketing" }

:0 E
* ^Received.*\[80\.249\.(11[2-9]|12[0-7])\.
{ SI="$SI$RS 200 ip69" }

:0 E
* ^Received.*\[193.124.(17[6-9]|18[0-3])\.
{ SI="$SI$RS 200 marosnet.ru" }

:0 E
* ^Received:.*(datapipe\.net|\[64\.27\.(6[4-9]|[789][0-9]|1[01][0-9]|12[0-7])\.)
{ SI="$SI$RS 200 datapipe.net" }

:0 E
* 1^0 ^Received:.*\[69.16.(19[2-9]|2..)
* 1^0 ^Received:.*\[209.59.(12[89]|1[3-8].|19[01])
* $!$MAILINGLIST
{ SI="$SI$RS 200 liquidweb.com" }

:0 E
* ^Received:.*\[69\.64\.(3[2-8]|[45].|6[0-4])\.
{ SI="$SI$RS 200 server4you.net" }

#:0 E
#* ^Received:.*phpwebhosting\.com
#{ SI="$SI$RS 200 phpwebhosting.com" }

:0 E
* ^Received:.*nuvox\.net
{ SI="$SI$RS 200 nuvox.net" }

#:0 E
#* ^Received:.*ims-firmen\.de
#{ SI="$SI$RS 200 ims-firmen.de" }

:0 E
* ^Received:.*netvigator\.com
{ SI="$SI$RS 200 netvigator.com" }

:0 E
* ^Received:.*insightbb\.com
* $!$MAILINGLIST
{ SI="$SI$RS 200 insightbb.com" }

:0 E
* ^Received:.*\.go2\.pl
* $!$MAILINGLIST
{ SI="$SI$RS 100 go2.pl" }

:0 E
* ^Received:.*\.bp06\.net
{ SI="$SI$RS 200 bp06.net" }

:0 E
* ^(From|Received).*domeus.com
{ SI="$SI$RS 50 domeus.com" }

:0 E
* ^Received.*telenet-ops\.be
{ SI="$SI$RS 100 telenet-ops.be" }

:0 E
* ^Received.*singnet
{ SI="$SI$RS 30 singnet" }

:0 E
* ^Received.*\.bb\.online\.no
{ SI="$SI$RS 50 bb.online.no" }

:0 E
* ^Received.*affinity\.com
{ SI="$SI$RS 30 affinity.com" }

:0 E
* ^Received.*bb\.sky\.com
{ SI="$SI$RS 30 bb.sky.com" }

:0 E
* ^(From|Received).*hispeed\.ch
{ SI="$SI$RS 50 hispeed.ch" }

:0 E
* ^Received.*sunrise\.ch
{ SI="$SI$RS 50 sunrise.ch" }

:0 E
* ^(From|Received).*\/regiomontano
{ SI="$SI$RS 50 $MATCH" }

:0 E
* ^Received.*\.tin\.it
{ SI="$SI$RS 200 tin.it" }

:0 E
* 1^0 ^Received.*ttnet\.net\.tr
* 1^0 ^Received.*\[88\.242\.(6[4-9]|[7-9].|[12]..)\.
{ SI="$SI$RS 200 ttnet.net.tr" }

#:0 E
#* ^(From|Received).*\/shoppersville\.net
#{ SI="$SI$RS 1000 $MATCH" }

#:0 E
#* ^(From|Received).*\/link-builder\.com
#{ SI="$SI$RS 1000 $MATCH" }

#:0 E
#* ^(From|Received).*\/namehistory\.com
#{ SI="$SI$RS 1000 $MATCH" }

#:0 E
#* ^(From|Received).*\/tempdomainname\.com
#SI="$SI$RS 1000 $MATCH" }

#:0 E
#* ^(From|Received).*\.\/opmnet
#{ SI="$SI$RS 1000 $MATCH" }

#:0 E
#* ^(From|Received).*\/trackingclicks\.com
#{ SI="$SI$RS 1000 trackingclicks.com" }

#:0 E
#* ^(From|Received).*\/nettradingpost\.com
#{ SI="$SI$RS 1000 nettradingpost.com" }

#:0 E
#* ^(From|Received).*\/conveymedia\.com
#{ SI="$SI$RS 1000 conveymedia.com" }

#:0 E
#* ^(From|Received).*\/getresponse\.com
#{ SI="$SI$RS 1000 getresponse.com" }

:0 E
* ^Received.*host4u\.net
{ SI="$SI$RS 100 host4u.net" }

:0 E
* ^Received.*\.menta\.net .
{ SI="$SI$RS 100 menta.net" }

:0 E
* ^Received.*\.algx.net
{ SI="$SI$RS 50 algx.net" }

:0 E
* ^(From|Received).*vsnl\.(net|com)
{ SI="$SI$RS 100 vsnl" }

:0 E
* ^(From|Received).*bbtec\.net
{ SI="$SI$RS 100 bbtec.net" }

#:0 E
#* ^(From|Received).*\.cox\.net
#{ SI="$SI$RS 30 cox.net" }

#:0
#* ^Received:.*\.optonline\.net
#{ SI="$SI$RS 200 optonline.net" }
	

# 
## beliebte Spam To-Adressen
#

#:0 
#* ^TOrecipient list not shown
#* !^X-Mailing-List:
#* !^From.*postmaster@
#{ SI="$SI$RS 100 recipient list not shown" }

:0 
* ^To: @
{ SI="$SI$RS 100 To: @" }

:0 E
* ^\/To: Recipients
{ SI="$SI$RS 1000 $MATCH" }

:0 E
* ^\/To: Recipient
{ SI="$SI$RS 100 $MATCH" }

:0 E
* ^To:.*\/Subscribed,,,
{ SI="$SI$RS 1000 $MATCH" }

:0 E
* ^To:.*you@
{ SI="$SI$RS 100 you@" }

:0 E
* ^To: <>
{ SI="$SI$RS 100 To: <>" }

:0 E
* ^To: webmaster.*webmaster
{ SI="$SI$RS 100 To: webmaster.*webmaster" }

:0 E
* ^To:.*\.(ua|ru)>
{ SI="$SI$RS 50 spammer friendly C-TLD in To" }

:0 E
* ^(To|From):.*money\.com
{ SI="$SI$RS 100 money.com" }

:0 E
* ^From:.*\/(money|porn)
{ SI="$SI$RS 30 $MATCH in From" }

#:0 
#* ^(To|From):.*@post\.com
#{ SI="$SI$RS 100 post.com" }

:0 E
* ^To:.*public\.com
{ SI="$SI$RS 100 public.com" }

:0 DE
* ^To:.*Kunde
{ SI="$SI$RS 10 To: Kunde" }

:0
* ^To: "[a-z]+"
{
  :0
  * ^To: \"\/[a-z]+
  {
    :0
    * $ ^Subject: $MATCH
    { SI="$SI$RS 100 same short name in To&Subject" }

    :0 E
    { SI="$SI$RS 0 short real name in To" }
  }
}


# 
## bekannte Spam-Absender
#

#:0 
#* ^From:.*\/travel24\.com
#{ SI="$SI$RS 1000 from travel24.com" }

#:0 
#* ^From: FPP Travel
#{ SI="$SI$RS 1000 from FPP Travel" }

#:0
#* ^From: Erika <info
#{ SI="$SI$RS 100 from Erika-info" }

:0
* ^From: \/SumUp
{ SI="$SI$RS 100 from $MATCH" }

:0
* ^From:.*\/docusign
{ SI="$SI$RS 200 from $MATCH" }

:0
* ^From:.*\/trading
{ SI="$SI$RS 30 from $MATCH" }

:0
* ^From:.*\/Polizei
{ SI="$SI$RS 10 from $MATCH" }

:0
* ^From:.*domain\.invalid
{ SI="$SI$RS 1000 from domain.invalid" }

:0
* ^From:.*Cloud-Help-Desk#
{ SI="$SI$RS 1000 from Cloud-Help-Desk" }

:0
* ^From:.*\/illuminati
{ SI="$SI$RS 100 from $MATCH" }

:0
* ^From:.*domain\.invalid
{ SI="$SI$RS 30 from domain.invalid" }

:0
* ^From:.*sales[0-9]+@
{ SI="$SI$RS 50 from sales" }

:0
* ^From:.*\/funding
{ SI="$SI$RS 50 from $MATCH" }

:0
* ^From:.*\/ADAC
{ SI="$SI$RS 10 from $MATCH" }

:0
* ^From:.*\/accounting
{ SI="$SI$RS 10 from $MATCH" }

:0
* ^From:.*onmicrosoft\.com
{ SI="$SI$RS 10 from onmicrosoft.com" }

#:0 D
#* ^From: \/Hose Tr
#{ SI="$SI$RS 200 from $MATCH" }

:0 E
* ^From: \"bank
{ SI="$SI$RS 30 from bank" }

:0 E
* ^From: \/Notification
{ SI="$SI$RS 30 from $MATCH" }

:0 DE
* ^From: Mr
{ SI="$SI$RS 10 from Mr" }

:0
* ^From:.*\/targobank
{ SI="$SI$RS 100 from $MATCH" }

:0
* ^From:.*\/firebaseapp
{ SI="$SI$RS 100 from $MATCH" }

#:0
#* ^From: \/lNG DlBA
#{ SI="$SI$RS 200 from $MATCH" }

:0 E
* ^From:.*\/akbank\.com
{ SI="$SI$RS 100 from akbank.com" }

#:0 E
#* ^(From|Message-ID):.*runs88
#{ SI="$SI$RS 1000 from runs88" }

:0 E
* ^From:.*craigslist
{ SI="$SI$RS 1000 from craigslist" }

:0 E
* ^From:.*\/paypaI
{ SI="$SI$RS 100 from $MATCH" }

:0 E
* ^From:.*\/gutschein
{ SI="$SI$RS 100 from $MATCH" }

:0 E
* ^From:.*\/noreply\.com
{ SI="$SI$RS 100 from noreply.com" }

:0 E
* ^From:.*noreply@.*bank
* ! ^From:.*(F-I|bw-bank)\.de
{ SI="$SI$RS 10 from noreply@.*bank" }

:0 E
* ^From: "" <
{ SI="$SI$RS 50 empty real name in From" }

:0 E
* ^From: \"MR
{ SI="$SI$RS 10 From MR" }

:0 
* ^From:.*\.(ua|ru|kz|kg|dz|lb|site)(>|$)
* $!$MAILINGLIST
{ SI="$SI$RS 30 spammer friendly TLD in From" }

#:0
#* ^From:.*support@com\.com
#{ SI="$SI$RS 1000 from support@com.com" }

:0 E
* ^From:.*@support\.com
{ SI="$SI$RS 100 support.com" }

:0 E
* ^From:.*psk\.com
{ SI="$SI$RS 100 psk.com" }

:0 E
* ^From:.*k12\.[a-z]+\.us
{ SI="$SI$RS 50 k12.us" }

:0 E
* ^\/From: Webmail
{ SI="$SI$RS 100 $MATCH" }

:0 E
* ^\/From: T-online
{ SI="$SI$RS 100 $MATCH" }

:0 E
* ^From: \"www
{ SI="$SI$RS 100 From: www" }

:0 E
* ^From: "Support" <
{ SI="$SI$RS 50 From: Support" }

:0 E
* ^From: "sales"
{ SI="$SI$RS 100 From: sales" }

:0 E
* ^From:.*sales@
{ SI="$SI$RS 30 From: sales" }

:0 E
* ^From:.*loan
{ SI="$SI$RS 50 From: loan" }

:0 E
* ^From:.*\/Mastercard
{ SI="$SI$RS 100 From: $MATCH" }

:0 E
* ^From: \/Sparkasse
{ SI="$SI$RS 100 From: $MATCH" }

#:0 E
#* ^From:.*\/(Sparkasse|Deutsche Bank)
#{ SI="$SI$RS 10 From: $MATCH" }

:0 E
* ^From:.*\/FedEx
{ SI="$SI$RS 50 From: $MATCH" }

:0 E
* ^From: "?[a-z]+bank"?
{ SI="$SI$RS 20 From: [a-z]+bank" }

:0 E
* ^From:.*@cimb
{ SI="$SI$RS 100 From: cimb" }

:0 E
* ^From: Bank Of 
{ SI="$SI$RS 100 Bank Of" }

:0 E
* ^From: \"?ING DIBA
{ SI="$SI$RS 100 ING DIBA" }

:0 E
* ^From: [a-z -]* Bank .
{ SI="$SI$RS 30 Bank" }

:0 E
* ^From:.*Volksbank
{ SI="$SI$RS 30 Volksbank" }

:0 E
* ^From:.*[\. ]visa[\. ]
{ SI="$SI$RS 30 From visa" }

:0 E
* ^From:.*PayPal
{ SI="$SI$RS 100 PayPal" }

:0 E
* ^From:.*PayLife
{ SI="$SI$RS 100 PayLife" }

#:0 E
#* ^From: Doctor <
#{ SI="$SI$RS 100 From: Doctor" }

:0 E
* ^From: "[a-z]+" <
{ SI="$SI$RS 10 short real name in From" }

:0
* ^From:.*postcard\.com
{ SI="$SI$RS 1000 from postcard.com" }

#:0 E
#* ^From.*\/(Sese.?seko|MOBUTU|Kabila|Savimbi|Mbeki)
#{ SI="$SI$RS 1000 from $MATCH" }

#:0 E
#* ^From:.*\/fusionphp
#{ SI="$SI$RS 1000 from $MATCH" }

:0 E
* ^From:.*\/IQ.test
{ SI="$SI$RS 200 from IQ Test" }

#:0 E
#* ^From:.*\/anaforturizm
#{ SI="$SI$RS 1000 from $MATCH" }

:0 E
* ^From:.*4u@
{ SI="$SI$RS 100 from 4u" }

:0 E
* ^(From|Reply-To):.*kimo\.com
{ SI="$SI$RS 100 kimo.com" }

:0 E
* ^(From|Reply-To|Received):.*aliyun.com
{ SI="$SI$RS 10 aliyun.com" }

#:0 E
#* ^From:.*\/gouranga
#{ SI="$SI$RS 100 from $MATCH" }

#:0 E
#* ^From.*powerlist\.info
#{ SI="$SI$RS 1000 powerlist.info" }

:0 E
* ^From:.*\/Lottery
{ SI="$SI$RS 200 from $MATCH" }

:0 E
* ^From:.*\/LOTERIE
{ SI="$SI$RS 200 from $MATCH" }

:0 E
* ^From:.*\/Loc?teria
{ SI="$SI$RS 200 from Loteria" }

:0 E
* ^From:.*\/lotto
{ SI="$SI$RS 60 from $MATCH" }

:0 E
* ^From:.*\/Gewinn
{ SI="$SI$RS 100 from $MATCH" }

:0 
* ^From:.*\/facebook
{ SI="$SI$RS 50 From $MATCH" }

:0 
* ^From:.*\/travel
{ SI="$SI$RS 10 From $MATCH" }

:0 
* ^From:.*\/award
{ SI="$SI$RS 60 From $MATCH" }

:0 
* ^From:.*\/Kredit
{ SI="$SI$RS 100 From $MATCH" }

:0 
* ^From:.*\/bitcoin
{ SI="$SI$RS 1000 From $MATCH" }

:0
* ^From:.*\/gaming
{ SI="$SI$RS 50 from $MATCH" }

:0
* ^From:.*\/alert
{ SI="$SI$RS 30 from $MATCH" }

:0 
* ^From:.*\/invest
{ SI="$SI$RS 60 From $MATCH" }

:0 
* ^From:.*\/cheap
{ SI="$SI$RS 30 From $MATCH" }

:0 
* ^From:.*\/outlet
{ SI="$SI$RS 100 From $MATCH" }

:0 
* ^From:.*\/yesmail
{ SI="$SI$RS 100 From $MATCH" }

:0 
* ^From:.*\/direct
{ SI="$SI$RS 10 From $MATCH" }

:0 
* ^From.*mega.*(tv|web)
{ SI="$SI$RS 100 MEGATV" }

:0 
* ^From.*123india\.com
{ SI="$SI$RS 80 123india.com" }

:0 
* ^Received.*\/\.(ae|bg|br|bw|cc|co|cy|cz|ee|id|lv|my|pe|ph|pl|pt|pk|ro|th|tr|ua|ug|vn|kz|kg)( |\))
* $!$MAILINGLIST
{ SI="$SI$RS 30 spammer friendly country $MATCH in Received" }

:0 
* ^Received.*\/\.ru( |\))
* $!$MAILINGLIST
{ SI="$SI$RS 300 received from .ru" }

:0 
* ^Received: from [0-9]+.com
{ SI="$SI$RS 50 received from NUMBER.com" }

:0 
* ^Received.*wanadoo\.es
{ SI="$SI$RS 10 wanadoo.es" }

:0 
* ^Received.*amazonses\.com
{ SI="$SI$RS 10 amazonses.com" }

:0 
* ^Received.*\/cloudhost
{ SI="$SI$RS 100 $MATCH" }

# congstar
#:0 
#* ^Received.*salesforce\.com
#{ SI="$SI$RS 100 salesforce.com" }

:0
* ^Sender: <noreply@salesforce
{ SI="$SI$RS 100 salesforce" }
  
:0 
* ^Received.*plesk
{ SI="$SI$RS 10 plesk" }

:0 E
* ^Received.*bezeqint\.net
* $!$MAILINGLIST
{ SI="$SI$RS 100 bezeqint.net" }

:0
* ^X-.*\/bizmail
{ SI="$SI$RS 100 $MATCH" }

#:0 E
#* ^Received:.*mktomail\.com
#{ SI="$SI$RS 1000 mktomail.com" }

:0 E
* ^Received:.*\.webair\.com
{ SI="$SI$RS 1000 webair.com" }

:0 E
* ^Received:.*deltafins\.com
{ SI="$SI$RS 1000 deltafins.com" }

:0 E
* ^Received:.*\.dnsprotect\.com
{ SI="$SI$RS 1000 dnsprotect.com" }

# SBK
#:0 E
#* ^Received:.*\.srv2\.de
#{ SI="$SI$RS 1000 srv2.de" }

:0 E
* ^From:.*facebook\.com
{ SI="$SI$RS 200 facebook.com" }

:0 E
* ^(From|Received):.*umbb.dz
{ SI="$SI$RS 100 umbb.dz" }

:0 E
* ^(From|Received):.*hire.*labas
{ SI="$SI$RS 1000 hire-labas" }

:0 E
* ^(From|Reply-To):.*labas-g
{ SI="$SI$RS 1000 LABAS" }

:0 E
* ^(From|Received):.*\/marketingsolution
{ SI="$SI$RS 1000 $MATCH.com" }

#:0 E
#* ^Received.*everyware\.ch
#{ SI="$SI$RS 100 everyware.ch" }

:0 E
* ^Received.*abo\.net2000\.ch
{ SI="$SI$RS 100 net2000.ch" }

:0 E
* ^Received:.*\.dhhosted\.com
{ SI="$SI$RS 100 dhhosted.com" }

#:0
#* ^Received.*\/seventwentyfour
#{ SI="$SI$RS 1000 $MATCH" }
	
#:0 E
#* ^Received.*\/nachrichtendienst24
#{ SI="$SI$RS 1000 $MATCH" }
	
#:0 
#* ^(From|Received).*\/rapiddeal
#{ SI="$SI$RS 1000 $MATCH" }
	
#:0 E
#* ^(From|Received).*\/optinbargains
#{ SI="$SI$RS 1000 $MATCH" }

#:0 E
#* ^(From|Received).*aesop\.com
#{ SI="$SI$RS 1000 aesop.com" }

:0 E
* ^(From|Received).*\/smyrna
{ SI="$SI$RS 100 $MATCH" }

#:0 E
#* ^(From|Received).*\/globalusa
#{ SI="$SI$RS 1000 $MATCH" }

:0 E
* ^(From|Received).*\/cheerful\.com
{ SI="$SI$RS 1000 cheerful.com" }

#:0 E
#* ^(From|Received).*\/artmarket\.com
#{ SI="$SI$RS 1000 artmarket.com" }

:0 E
* ^(From|Received).*mantraonline\.com
{ SI="$SI$RS 100 mantraonline.com" }

#:0 E
#* ^(From|Received).*LittleCrazy\.com
#{ SI="$SI$RS 1000 LittleCrazy.com" }

#:0 E
#* ^(From|Received).*tpage\.(com|co.kr)
#{ SI="$SI$RS 100 tpage.com" }

:0 E
* ^(From|Received).*\.speedy\.(com|net)
{ SI="$SI$RS 100 speedy" }

:0 E
* ^(From|Received).*\.fibertel\.com\.ar
{ SI="$SI$RS 100 fibertel.com.ar" }

:0 E
* ^(From|Received).*jumpy\.it
{ SI="$SI$RS 30 jumpy.it" }

:0 E
* ^(From|Received).*\/outblaze\.com
{ SI="$SI$RS 50 outblaze.com" }

# ... while talking to smtp1.a2000.nl.:
# >>> RCPT To:<abuse@a2000.nl>
# <<< 550 relaying to <abuse@a2000.nl> prohibited by administrator
:0 E
* ^(From|Received).*\/a2000\.nl
{ SI="$SI$RS 100 $MATCH" }

# From: abuse@planet.nl
# "You can unsubscribe on the e-mailaddress. Probably someone else placed an
#  add in your 'name'."
:0 
* ^Received.*\.wxs\.nl
{ SI="$SI$RS 100 wxs.nl" }

:0 
* ^Received.*webport.*\.bt\.net
{ SI="$SI$RS 100 webport*.bt.net" }

:0 
* ^Received.*cable\.net\.co .
{ SI="$SI$RS 100 cable.net.co" }

:0
* ^Received.*biz\.mindspring\.com
{ SI="$SI$RS 10 biz.mindspring.com" }

#:0
#* ^From:.*[^a-z]biz[^a-z]
#{ SI="$SI$RS 50 From biz" }

:0
* ^(From|Received).*voila\.fr
* $!$MAILINGLIST
{ SI="$SI$RS 30 voila.fr" }

:0
* ^(From|Received).*abo\.wanadoo\.fr
* $!$MAILINGLIST
{ SI="$SI$RS 30 abo.wanadoo.fr" }

:0
* ^(From|Received).*club-internet\.fr
{ SI="$SI$RS 30 club-internet.fr" }

:0 
* ^(From|Received):.*direct[a-z0-9]*.com
{ SI="$SI$RS 80 direct*com" }

:0 
* ^(From|Received):.*\/(shoppin|greatdeals|optin@)
{ SI="$SI$RS 100 $MATCH" }

:0 
* ^Received.*\.\/comcast\.net
{ SI="$SI$RS 10 comcast.net" }

:0 
* ^Received.*\.\/rr\.com
{ SI="$SI$RS 30 rr.com" }

:0 
* ^Received.*\/concentric\.net
{ SI="$SI$RS 30 concentric.net" }

:0 
* ^Received.*(\.clara\.net|\[62\.80\.(.|[1-5].|6[0-3])\.)
{ SI="$SI$RS 30 clara.net" }

:0 E
* ^Received.*\[79\.133\.(32-9|[45].|6[0-3])\.
{ SI="$SI$RS 1000 First Colo" }

:0 E
* ^Received.*\[107.17[2345]
{ SI="$SI$RS 100 ColoCrossing" }

#:0 
#* ^Received.*\.\/vein.hu ()
#{ SI="$SI$RS 100 $MATCH" }

:0 E
* ^Received.*\/warsun\.com
{ SI="$SI$RS 1000 warsun.com" }

:0 E
* ^Received.*\/heigl-salomon\.at
{ SI="$SI$RS 1000 $MATCH" }

:0 E
* ^Received.*\/nessus\.at
{ SI="$SI$RS 1000 $MATCH" }

:0 E
* ^Received.*\/tele(ring|web)\.at
{ SI="$SI$RS 100 $MATCH" }

:0 
* ^(From|To|Received).*yeah\.net
{ SI="$SI$RS 1000 yeah.net" }

:0 
* ^From.*consultant\.com
{ SI="$SI$RS 1000 consultant.com" }

:0 
* ^From:.*\/consulting
{ SI="$SI$RS 30 $MATCH" }

# :0 
# * ^Received.*\.rima-tde\.net
# { SI="$SI$RS 100 rima-tde.net" }

:0 
* ^From.*money.*maker
{ SI="$SI$RS 100 moneymaker" }

:0 
* ^From:.*\/sex
{ SI="$SI$RS 20 '$MATCH' in From" }

:0 
* ^(From|Received).*hotbot\.com
{ SI="$SI$RS 1000 hotbot.com" }

:0 
* ^(From|Received).*smoozing\.com
{ SI="$SI$RS 1000 smoozing.com" }

:0 
* ^(From|Received).*\netease\.(com|net)
{ SI="$SI$RS 1000 netease" }

:0 
* ^Received.*codetel\.net\.do
{ SI="$SI$RS 200 codetel.net.do" }

:0 
* ^Received.*\.cas\.hol\.gr
{ SI="$SI$RS 100 cas.hol.gr" }

:0 
* ^Received.*svc\.ntlworld\.com
{ SI="$SI$RS 80 svc.ntlworld.com" }

:0 
* ^Received.*inter\.net\.il
{ SI="$SI$RS 50 inter.net.il" }

:0
* ^Received:.*barak\.net\.il
{ SI="$SI$RS 50 barak.net.il" }

:0 
* ^Received.*yourmailsource\.com
{ SI="$SI$RS 1000 yourmailsource.com" }

:0 
* 1^0 ^Received.*\.interbusiness\.it
* 1^0 ^Received.*\[212\.210\.251\.
* 1^0 ^Received.*\[217\.56\.27\.(20[89]|21[0-5])
* 1^0 ^Received.*\[217\.172\.(19[2-9]|2[01][0-9]|22[0-3])
{ SI="$SI$RS 200 interbusiness.it" }

:0 
* ^Received.*customer.*iplannetworks\.net
{ SI="$SI$RS 80 iplannetworks.net" }

:0 
* ^Received.*\.chello\... .
{ SI="$SI$RS 50 chello" }

:0 
* ^Received.*telepac\.pt
{ SI="$SI$RS 50 telepac.pt" }

:0 E
* ^Received.*wayinternet\.com\.br
{ SI="$SI$RS 200 wayinternet.com.br" }

:0 E
* ^Received.*locaweb\.com\.br
* $!$MAILINGLIST
{ SI="$SI$RS 200 locaweb.com.br" }

:0 E
* ^Received.*veloxzone\.com\.br
{ SI="$SI$RS 200 veloxzone.com.br" }

:0 E
* ^Received.*\/virtua\.com\.br
* $!$MAILINGLIST
{ SI="$SI$RS 200 virtua.com.br" }

:0 E
* ^(Received|From).*\/bol\.com\.br
{ SI="$SI$RS 100 bol.com.br" }

:0 E
* ()\/trackmail\.com\.br
{ SI="$SI$RS 1000 trackmail.com.br" }
  
:0 E
* ()\/impacta\.com\.br
{ SI="$SI$RS 1000 impacta.com.br" }
  
#:0 E
#* ()\.com\.br
#* $!$MAILINGLIST
#{ SI="$SI$RS 50 .com.br" }

:0 E
* ^Received.*aknamail
{ SI="$SI$RS 1000 aknamail" }
  
:0 
* ^Received.*\.pizur\.com
{ SI="$SI$RS 100 pizur.com" }

:0 
* ^Received.*candidhosting\.com
{ SI="$SI$RS 100 candidhosting.com" }

:0 
* ^Received.*\[(78\.178|81\.213\.240|85\.(9[6-9]|10.|11[01])|195\.17[45]|212\.156)\.
{ SI="$SI$RS 100 TurkTelekom" }

:0 E
* ^Received.*\[(217\.131|212\.253)\.
{ SI="$SI$RS 100 TR-SUPERONLINE" }

:0 E
* ^Received.*\[160\.116
{ SI="$SI$RS 100 AFFILIATEDCOMPUTING ZA" }

:0 E
* ^Received.*\[160\.122
{ SI="$SI$RS 100 TRED ZA" }

:0 E
* ^Received.*\[66\.216\.(6[4-9]|[789][0-9]|1[01][0-9]|12[0-7])\.
{ SI="$SI$RS 100 Rackspace.com" }

:0 E
* ^Received.*\[209\.223\.
{ SI="$SI$RS 100 SAVVIS" }

:0 E
* ^received.*62\.146\.(17|30|44|60)\.
{ SI="$SI$RS 100 leodom.net" }

:0 E
* ^received.*\[64\.55\.
{ SI="$SI$RS 100 HARVARD.NET" }

:0 E
* ^Received.*\[81\.18\.42\.
{ SI="$SI$RS 100 STE-MOD-NOC (Nigeria)" }

:0 E
* ^received.*\[212.96.[23]\.
{ SI="$SI$RS 100 IKEJA-Nigeria" }

:0 E
* ^received.*\[216\.133\.174
{ SI="$SI$RS 100 ISNL-Nigeria" }

:0 E
* ^received.*\[195\.166\.(22[4-9]|2[345][0-9])\.
{ SI="$SI$RS 100 Linkserve Nigeria" }

:0 E
* ^Received.*\[217.117\.(8|9|10|11)\.
{ SI="$SI$RS 100 CTL-RIPE (Nigeria)" }

:0 E
* ^Received.*\[209.159.166
{ SI="$SI$RS 100 DIRECTONPC (Nigeria)" }

:0 E
* ^Received.*\[202\.188\.127\.
{ SI="$SI$RS 100 Telekom Malaysia" }

:0 E
* 1^0 ^Received.*\[67\.15\.
* 1^0 ^Received.*\[216\.12\.(19[2-9]|2[01][0-9]|22[0-3])\.
* 1^0 ^Received.*\[216\.127\.(6[4-9]|[7-8][0-9]|9[0-5])\.
* 1^0 ^Received.*\[216\.40\.(19.|2..)\.
{ SI="$SI$RS 200 ev1.net" }

:0 E
* ^Received.*intercede\.it
{ SI="$SI$RS 100 intercede.it" }

:0 E
* ^Received.*bcentral\.com
{ SI="$SI$RS 100 bcentral.com" }

:0 E
* ^Received.*clanordns\.net
{ SI="$SI$RS 200 Clanotopia" }

:0 E
* ^Received.*\[62\.116\.1(2[89]|3[0-9]|4[0-3])\.
{ SI="$SI$RS 100 DENOC.DE/internetx.de" }

:0 E
* ^Received.*\/internetx\.de
{ SI="$SI$RS 100 internetx.de" }

:0 E
* ^Received.*\/ipxserver\.de
{ SI="$SI$RS 100 ipxserver.de" }

# :0 E
# * ^received.*\/vogelzucht\.com
# { SI="$SI$RS 100 vogelzucht.com" }

:0 E
* ^Received.*\[62\.75\.(12[89]|1[3-9][0-9]|2[0-5][0-9])\.
{ SI="$SI$RS 30 plusserver.de" }

:0 E
* ^Received.*plusserver\.de
{ SI="$SI$RS 30 plusserver.de" }

:0 E
* ^Received.*intersolute\.de
{ SI="$SI$RS 100 intersolute.de" }

:0 
* 1^0 195\.206\.86
* 1^0 domainnameservers\.net
* 1^0 worldcix\.net
* 1^0 ^From:.*(providerkit|netalyzer)\.de
* !^(Subject:.*(Re:|abuse)|In-Reply-To:)
{ SI="$SI$RS 1000 ibg.net" }

:0
* ^From.*@mail\.com
* !Received.*\.mail\.com( )
{
  :0 
  * 1^0 ^Message-Id.*@mail\.com
  * 1^0 ^TO@mail\.com
  { SI="$SI$RS 100 faked mail.com address" }
}

#:0 
#* ^From.*iname\.com
#* !Received.*\.iname\.com( )
#{ SI="$SI$RS 100 faked iname.com address" }

:0 
* ^From.* [0-9]+@aol\.com
{ SI="$SI$RS 100 faked aol From" }

#:0 
#* ^From: \"?DPD
#* ! ^List-Id:.*dpd
#{ SI="$SI$RS 200 faked DPD" }

:0 
* ^From: \"?\/(DHL|DPD|GLS)
* ! ^From:.*@.*(dhl|dpd|gls)
{ SI="$SI$RS 200 faked $MATCH" }

:0 
* ^From: \"?(Hermes|myhermes|Service.*hermes)
* ! ^From:.*@.*hermes
{ SI="$SI$RS 200 faked Hermes" }

#:0 
#* ^From: \/noreply-dhl@
#* ! ^From:.*@.*dhl
#{ SI="$SI$RS 200 faked $MATCH" }

:0 
* ^Subject: ID:.* \/GLS
* ! ^From:.*@.*gls
{ SI="$SI$RS 200 faked $MATCH" }

:0 
* ^From:.*dhl\.com
* ! ^List.*dhl\.de
{ SI="$SI$RS 200 DHL phishing (missing List header)" }

:0 
* ^Received: from aol\.com \(\[
{ SI="$SI$RS 50 faked aol.com in received" }

# CodeIgniter benutzen Apotheken via apotune-booking.de
:0 
* ^X-Mailer: \/(Sendinblue|HMail|Supmailer)
{ SI="$SI$RS 1000 $MATCH" }

:0 
* ^X-Mailer: \/(Alimail-Mailagent)
{ SI="$SI$RS 50 $MATCH" }

:0 E
* ^X-Mailer: AOL Webmail
{ SI="$SI$RS 30 AOL Webmail" }

:0 E
* ^X-Mailer: \/Microsoft CDO
{ SI="$SI$RS 30 $MATCH" }

:0 ED
* ^X-Mailer: \/WebService
{ SI="$SI$RS 10 $MATCH" }

:0 ED
* ^X-Mailer:.*\/Alimail-Mailagent
{ SI="$SI$RS 30 $MATCH" }

:0 ED
* ^X-Mailer: \/(GMS Sender|dmDroid|iGMail)
{ SI="$SI$RS 100 $MATCH" }

:0 E
* ^X-Mailer:.*\/PHPMailer
{ SI="$SI$RS 10 $MATCH" }

:0 E
* ^\/X-PHP
{ SI="$SI$RS 10 $MATCH" }

:0 
* ^From.*@hotmail
* ^To: <
{ SI="$SI$RS 50 from hotmail and no real name in To" }

:0 
* ^(Received|From).*hotmail
* ^(Received|From).*yahoo
{ SI="$SI$RS 100 hotmail & yahoo" }

:0 
* ^(Received|From).*hotmail\.com
* $!^(To|Cc):.*($MYDOMAIN)
* $!$MAILINGLIST
{ SI="$SI$RS 50 from hotmail and not for MYDOMAIN" }

:0 E
* ^From.* [0-9].*@hotmail\.com
{ SI="$SI$RS 100 faked hotmail address" }

:0 
* ^(From|To).*(4you|foryou)@
{ SI="$SI$RS 100 4you" }

:0 
* ^(From|Received|Message-ID).*@yours\.com
{ SI="$SI$RS 200 yours.com" }

:0 
* ^(Received|Message-ID).*yourdomain
{ SI="$SI$RS 100 yourdomain" }

:0 
* ^From.*massmail
{ SI="$SI$RS 100 From massmail" }

:0 
* ^From.*( promo|promo\.com)
{ SI="$SI$RS 100 From promo" }

:0 E
* ^From.*promo
{ SI="$SI$RS 30 From promo" }

:0 
* ^From.*( bulk|.*bulk .)
{ SI="$SI$RS 100 From bulk" }

:0 
* ^Message-Id:.*mailcity\.com
* !Received.*\.(mailcity|whowhere|lycos)\.com( )
{ SI="$SI$RS 100 faked mailcity.com" }

#:0 
#* ^Message-Id:.*@yahoo\.
#* !^Received.*yahoo\.[a-z\.]+ \[
#{ SI="$SI$RS 100 faked yahoo Message-Id" }

:0 
* ^(From|To).*business.*@
* $!^TO.*($MYDOMAIN)
{ SI="$SI$RS 80 business" }

#
## dialup spammers
#
:0 
* 1^1 $^Received: from \/.*by [a-z0-9\.-]*($MYDOMAIN)
* !^X-AMAZON
{
#  VERBOSE=on
  	# LTR=`echo $MATCH | sed 's/ .*//'`
  	LTR="$MATCH"
#  VERBOSE=off
  
	:0 D
	* LTR ?? ESMTP-TLS
	{ }

	:0 E
	* LTR ?? dslaccess\.aol\.com
        { SI="$SI$RS 200 direct from dslaccess.aol.com" }
	
	:0 E
	* LTR ?? adslplus\.ch
        { SI="$SI$RS 200 direct from adslplus.ch" }
	
	:0 E
	* LTR ?? centurytel\.net
        { SI="$SI$RS 200 direct from centurytel.net" }
	
	:0 E
	* LTR ?? tttmaxnet\.com
        { SI="$SI$RS 200 direct from tttmaxnet.com" }
	
	:0 E
	* LTR ?? alicedsl\.de
        { SI="$SI$RS 200 direct from alicedsl.de" }
	
	:0 E
	* LTR ?? arcor-ip\.net
        { SI="$SI$RS 200 direct from pools.arcor-ip.net" }
	
	:0 E
	* LTR ?? ipt\.aol\.com
        { SI="$SI$RS 60 direct from ipt.aol.com" }
	
	:0 E
	* LTR ?? client\.mchsi\.com
        { SI="$SI$RS 200 direct from client.mchsi.com" }
	
	:0 E
	* LTR ?? user.*sprint-hsd\.net
        { SI="$SI$RS 200 direct from sprint-hsd.net" }
	
#	:0 E
#	* LTR ?? verizon\.net
#	{ SI="$SI$RS 200 direct from verizon.net" }
	
	:0 E
	* LTR ?? pldt\.net
        { SI="$SI$RS 200 direct from pldt.net" }
	
	:0 E
	* LTR ?? business\.telecomitalia\.it
        { SI="$SI$RS 200 direct from business.telecomitalia.it" }
	
	:0 E
	* LTR ?? barak-online\.net
        { SI="$SI$RS 200 direct from barak-online.net" }
	
	:0 E
	* LTR ?? dsl-.*\.ameritech\.net
        { SI="$SI$RS 200 direct from dsl-*.ameritech.net" }
	
	:0 E
	* LTR ?? netvision\.net\.il
        { SI="$SI$RS 200 direct from netvision.net.il" }
	
	:0 E
	* LTR ?? dynamic\.hinet\.net
        { SI="$SI$RS 200 direct from dynamic.hinet.net" }
	
	:0 E
	* LTR ?? adsl-.*\.pacbell\.net
        { SI="$SI$RS 200 direct from adsl-*.pacbell.net" }
	
	:0 E
	* ^Received.*adsl.*\.skynet\.be
	{ SI="$SI$RS 200 direct from adsl*.skynet.be" }

	:0 E
	* ^Received.*direct-adsl\.nl
	{ SI="$SI$RS 200 direct from direct-adsl.nl" }

	:0 E 
	* LTR ?? dsl\..*\.swbell\.net
        { SI="$SI$RS 200 direct from dsl.*.swbell.net" }
	
	:0 E 
	* LTR ?? sdsl\.bell\.ca
        { SI="$SI$RS 200 direct from sdsl.bell.ca" }
	
	:0 E
	* LTR ?? proxad\.net
        { SI="$SI$RS 200 direct from proxad.net" }
	
	:0 E
	* LTR ?? i.*versanet\.de
        { SI="$SI$RS 200 direct from versanet.de" }
	
	:0 E
	* LTR ?? surfer\.at
        { SI="$SI$RS 200 direct from surfer.at" }
	
	:0 E
	* LTR ?? client\.dsl\.net
        { SI="$SI$RS 200 direct from client.dsl.net" }
	
#	:0 E
#	* LTR ?? hot\.rr\.com
#        { SI="$SI$RS 100 direct from hot.rr.com" }
	
#	:0 E
#	* LTR ?? [0-9]+-[0-9]+-[0-9]+\.[a-z]+\.rr\.com
#	{ SI="$SI$RS 200 direct from rr.com" }
	
	:0 E
	* LTR ?? [0-9]+-[0-9]+\.roadrunner\.nf\.net
        { SI="$SI$RS 200 direct from roadrunner.nf.net" }
	
	:0 E
	* LTR ?? host-[0-9][0-9a-z\.\-]*\.bellsouth\.net
        { SI="$SI$RS 200 direct from bellsouth.net" }
	
	:0 E
	* LTR ?? modemcable.*videotron\.ca
        { SI="$SI$RS 200 direct from modemcable.*videotron.ca" }
	
	:0 E
	* LTR ?? cable.*\.blueyonder\.co\.uk
        { SI="$SI$RS 200 direct from cable*blueyonder.co.uk" }
	
	:0 E
	* LTR ?? onocable\.ono\.com
        { SI="$SI$RS 200 direct from onocable.ono.com" }
	
	:0 E
	* LTR ?? cable\.mindspring\.com
        { SI="$SI$RS 200 direct from cable.mindspring.com" }
	
	:0 E
	* LTR ?? shawcable\.net
        { SI="$SI$RS 200 direct from shawcable.net" }
	
	:0 E
	* LTR ?? speed\.planet\.nl
        { SI="$SI$RS 200 direct from speed.planet.nl" }
	
#	:0 E
#	* LTR ?? \.pl
#	{ SI="$SI$RS 200 direct from dialup .pl" }
	
	:0 E
	* LTR ?? static\.theplanet\.com
        { SI="$SI$RS 200 direct from static.theplanet.com" }
	
	:0 E
	* LTR ?? ip[0-9-]+\.valornet\.com
        { SI="$SI$RS 200 direct from IP.valornet.com" }
	
	:0 E
	* LTR ?? dclient\.hispeed\.ch
        { SI="$SI$RS 200 direct from dclient.hispeed.ch" }
	
	:0 E
	* LTR ?? optonline\.net
        { SI="$SI$RS 200 direct from optonline.net" }
	
	:0 E
	* LTR ?? user\.auna\.net
        { SI="$SI$RS 200 direct from user.auna.net" }
	
	:0 E
	* LTR ?? home\.cgocable\.net
        { SI="$SI$RS 200 direct from home.cgocable.net" }
	
	:0 E
	* LTR ?? reverse\.theplanet\.com
        { SI="$SI$RS 200 direct from reverse.theplanet.com" }
	
	:0 E
	* LTR ?? prod-infinitum\.com\.mx
        { SI="$SI$RS 200 direct from prod-infinitum.com.mx" }
	
	:0 E
	* LTR ?? chello
        { SI="$SI$RS 200 direct from chello" }
	
#	:0 E
#	* LTR ?? chello.*\.chello\.pl
#       { SI="$SI$RS 200 direct from chello.pl" }
	
	:0 E
	* LTR ?? Cust.*\.uu\.net
        { SI="$SI$RS 30 direct from Cust*.uu.net" }
	
	:0 E
	* LTR ?? [0-9]\.customer\.alfanett\.no
        { SI="$SI$RS 200 direct from customer.alfanett.no" }
	
	:0 E
	* LTR ?? dialup\.pol\.co\.uk
        { SI="$SI$RS 200 direct from dialup.pol.co.uk" }
	
	:0 E
	* LTR ?? rev\.gaoland\.net
        { SI="$SI$RS 200 direct from rev.gaoland.net" }
	
	:0 E
	* LTR ?? broadband\.ntl\.com
        { SI="$SI$RS 200 direct from broadband.ntl.com" }
	
	:0 E
	* LTR ?? broadband\.hu
        { SI="$SI$RS 200 direct from broadband.hu" }
	
	:0 E
	* LTR ?? vnet\.hu
        { SI="$SI$RS 200 direct from vnet.hu" }
	
	:0 E
	* LTR ?? ip-.*\.evhr\.net
        { SI="$SI$RS 200 direct from evhr.net" }
	
	:0 E
	* LTR ?? adsl.*\.iomart\.com
        { SI="$SI$RS 200 direct from adsl*iomart.com" }
	
	:0 E
	* LTR ?? cable\.rogers\.com
        { SI="$SI$RS 200 direct from cable.rogers.com" }
	
	:0 E
	* LTR ?? dialsprint\.net
        { SI="$SI$RS 200 direct from dialsprint.net" }
	
	:0 E
	* LTR ?? (pub-ip|dialup)\.psi\.net
        { SI="$SI$RS 200 direct from (pub-ip|dialup).psi.net" }
	
	:0 E
	* LTR ?? dialup.*mci\.net
        { SI="$SI$RS 200 direct from dialup.*mci.net" }
	
        :0 E
	* LTR ?? (home|-[0-9]+-[0-9]+-[0-9]+).*\.charter\.com
        { SI="$SI$RS 200 direct from charter.com" }
	
        :0 E
	* LTR ?? prima\.net\.ar
        { SI="$SI$RS 200 direct from prima.net.ar" }
	
	:0 E
	* LTR ?? dsl\.telesp\.net\.br
        { SI="$SI$RS 200 direct from dsl.telesp.net.br" }
	
	:0 E
	* LTR ?? asianet\.co\.th
        { SI="$SI$RS 200 direct from asianet.co.th" }
	
	:0 E
	* LTR ?? client.?\.attbi\.com
        { SI="$SI$RS 200 direct from client*.attbi.com" }
	
	:0 E
	* LTR ?? in-addr\.btopenworld\.com
        { SI="$SI$RS 200 direct from in-addr.btopenworld.com" }
	
	:0 E
	* LTR ?? cable\.ntl\.com
        { SI="$SI$RS 200 direct from cable.ntl.com" }
	
	:0 E
	* LTR ?? cable\.rcn\.com
        { SI="$SI$RS 200 direct from cable.rcn.com" }
	
	:0 E
	* LTR ?? nombres\.ttd\.es
        { SI="$SI$RS 200 direct from nombres.ttd.es" }
	
	:0 E
	* LTR ?? dsl\.att\.net
        { SI="$SI$RS 200 direct from dsl.att.net" }
	
	:0 E
	* LTR ?? dial\.atlanet\.it
        { SI="$SI$RS 200 direct from dial.atlanet.it" }
	
	:0 E
	* LTR ?? -[0-9]+\.sasknet\.sk\.ca
        { SI="$SI$RS 200 direct from sasknet.sk.ca" }

	:0 E
	* LTR ?? go\.retevision\.es
        { SI="$SI$RS 200 direct from go.retevision.es" }

	:0 E
	* LTR ?? cablelynx\.com
        { SI="$SI$RS 200 direct from cablelynx.com" }

	:0 E
	* LTR ?? adsl\.snet\.net
        { SI="$SI$RS 200 direct from adsl.snet.net" }

	:0 E
	* LTR ?? cp[0-9].*\.home\.nl
        { SI="$SI$RS 200 direct from home.nl" }

	:0 E
	* LTR ?? cable\.012\.net\.il
        { SI="$SI$RS 100 direct from cable.012.net.il" }

	:0 E
	* LTR ?? isp\.belgacom\.be
        { SI="$SI$RS 100 direct from isp.belgacom.be" }

#VERBOSE=on
    
	:0 E
	* $ LTR ?? $DIALUP
	* $ ! LTR ?? ^[0-9a-z\-\.]+($MYDOMAIN)
	{ 
          
		:0
		* ^Received: from \[[0-9\.]+\] \(port=[0-9]+ helo=.*?\)
		{ SI="$SI$RS 200 received from dialup host with port/helo fake" }
		
		:0 EB
                * ()Content-Type: text/html
		{ SI="$SI$RS 50 received from dialup host and HTML body" }
          
		:0 EB
                * ()Content-Type: application/msword
		{ SI="$SI$RS 200 received from dialup host and word attachment" }
          
#		:0 E
#                * LTR ?? ^host
#		{ SI="$SI$RS 10 received from host host ($LTR)" }
          
		:0 E
		{ SI="$SI$RS 50 received from dialup host ($LTR)" }
	}
#VERBOSE=off
}

#
## Spam-Signatures
#

#:0
#* ^Reply-To: no-reply
#{ SI="$SI$RS 100 Reply-To no-reply" }

:0
* ^Return-Path: \/www-data
{ SI="$SI$RS 30 $MATCH" }

:0
* ^List-Unsubscribe:.*list-manage\.com
{ SI="$SI$RS 300 list-manage.com" }

:0
* ^List.*rch00.\.net
{ SI="$SI$RS 1000 rch00*.net" }

:0
* ^List-Unsubscribe: =\?us-ascii
{ SI="$SI$RS 100 List-Unsubscribe us-ascii" }

:0
* ^List-Unsubscribe:.*\.shop
{ SI="$SI$RS 300 list.*shop" }

:0
* ^In-Reply-To:.*@\/Insidefacebook
{ SI="$SI$RS 100 $MATCH" }

:0
* ^In-Reply-To: *$
{ SI="$SI$RS 10 empty In-Reply-To" }

:0
* ^Reply-To.*live\.fr
{ SI="$SI$RS 30 live.fr" }

:0
* ^References: *$
{ SI="$SI$RS 10 empty References" }

#:0 D
#* () \/zh-CN
#{ SI="$SI$RS 100 $MATCH" }

:0
* ()mailgraf\.net
{ SI="$SI$RS 100 mailgraf.net" }

:0 D
* ^Sender: \/Google Calendar
{ SI="$SI$RS 100 $MATCH" }

:0 D
* () \/SwiftMailer
{ SI="$SI$RS 100 $MATCH" }

:0 D
* ^\/X-COMMS-C
{ SI="$SI$RS 100 $MATCH" }

:0
* ^\/X-Mailster
{ SI="$SI$RS 100 $MATCH" }

:0
* ^\/X-Mailster
{ SI="$SI$RS 100 $MATCH" }

:0
* ^\/x-job
{ SI="$SI$RS 100 $MATCH" }

:0
* ^X-.*serveradd\.com 
{ SI="$SI$RS 100 serveradd.com" }

:0
* ^\/X-MailChannels
{ SI="$SI$RS 100 $MATCH" }

#:0
#* ^Reply-To:.*noreply
#{ SI="$SI$RS 100 Reply-To noreply" }

:0
* ^Received-SPF:.*discourages
{ SI="$SI$RS 10 SPF discouraged" }

:0
* ^X-ME-Auth
{ SI="$SI$RS 30 X-ME-Auth" }

:0
* ^\/X-Newsletter-Email-Id
{ SI="$SI$RS 100 $MATCH" }

#:0
#* ^\/X-SG-
#{ SI="$SI$RS 10 $MATCH" }

:0
* ^\/X-CSA-Complaints
{ SI="$SI$RS 10 $MATCH" }

:0
* ^Organization: *$
{ SI="$SI$RS 30 empty Organization" }
  
:0
* ^X-Source.*: \//opt/cpanel/
{ SI="$SI$RS 100 $MATCH" }

:0
* ^List-Unsubscribe-Post: \/List-Unsubscribe=One-Click
* ^Received:.*outlook\.com
{ SI="$SI$RS 100 $MATCH" }

# neomutt list
#:0
#* ^List-Unsubscribe:.*click
#{ SI="$SI$RS 100 List-Unsubscribe:.*click" }

# SBK, Radial, verdi.de
#:0
#* ^List-Unsubscribe-Post: \/List-Unsubscribe=One-Click
#{ SI="$SI$RS 10 $MATCH" }

:0
* ^List-Unsubscribe-Post: \/List-Unsubscribe=One-Click
* ^Message-Id:.*xt\.local
{ SI="$SI$RS 1000 $MATCH" }

:0
* ^List-Unsubscribe.*\/one_click_unsubscribe
{ SI="$SI$RS 1000 $MATCH" }

# DHL
#:0 E
#* ^List-Unsubscribe
#* ! ^List-ID
#{ SI="$SI$RS 100 List-Unsubscribe and no List-ID" }

# gitlab
#:0
#* ^\/X-Mailgun
#{ SI="$SI$RS 1000 $MATCH" }

# Amazon
#:0
#* ^\/Feedback-ID
#{ SI="$SI$RS 1000 $MATCH" }
  
:0
* ^List-Unsubscribe:.*/box.php\?nl=
{ SI="$SI$RS 1000 box.php" }
  
:0 E
* ^List-Unsubscribe:.*/unsubscribe/do\?hash
{ SI="$SI$RS 1000 unsubscribe/do" }

:0 E
* ^List-Unsubscribe:.*/index.php/lists/
{ SI="$SI$RS 1000 /index.php/lists/" }

# DHL
#:0 E
#* ^List-Unsubscribe:.*\//unsubscribe\.php
#{ SI="$SI$RS 1000 $MATCH" }
  
:0 ED
* ^List.*MIDRID=
{ SI="$SI$RS 1000 MIDRID" }
  
#:0
#* ^List-Unsubscribe-Post: \/List-Unsubscribe=One-Click
#{ SI="$SI$RS 1000 $MATCH" }
  
:0 D
* ^List-ID:.*xt\.local
{ SI="$SI$RS 1000 List-ID xt.local" }
  
:0
* ^List-ID: [a-z]+ of [0-9]+$
{ SI="$SI$RS 1000 List-ID-of" }
  
:0 E
* ^List-ID: [a-z0-9]+$
{ SI="$SI$RS 100 List-ID without <>" }
  
#:0
#* $ !^TO($MYDOMAIN)
#* $ !$MAILINGLIST
#{ SI="$SI$RS 20 no mailing-list and not to MYDOMAIN" }

:0
* ^Received: from \[.* by mx.\.hotmail.com;
{ SI="$SI$RS 200 Received by mx*.hotmail.com FAKE" }

:0
* $ ^Received: from [^ ]*($MYDOMAIN).*by [0-9\.]+ \([a-z]+\)
{ SI="$SI$RS 100 Received from MYDOMAIN by IP" }

:0
* ^To:[a-z]
{ SI="$SI$RS 100 no space after To:" }

:0 
* $ ^Received: .*\(unknown .*by [a-z0-9\.\-]*($MYDOMAIN)
{ SI="$SI$RS 10 directly Received from unknown" }
    
:0 E
* ^Received: .*\(unknown 
{ SI="$SI$RS 0 Received from unknown" }
    
:0 D
* ^\/X-Mailer-RecptId
{ SI="$SI$RS 1000 $MATCH in header!" }
  
:0 D
* ^\/X-UI-Out-Filterresults: junk
{ SI="$SI$RS 100 $MATCH in header" }
  
:0 D
* ^\/X-JID
{ SI="$SI$RS 100 $MATCH in header" }
  
:0 D
* ^\/X-Declude
{ SI="$SI$RS 100 $MATCH in header" }
  
:0 D
* ^\/X-Unsent
{ SI="$SI$RS 100 $MATCH in header" }
  
#:0 D
#* ^\/X-Coremail-Antispam
#{ SI="$SI$RS 100 $MATCH in header" }
  
:0 D
* ^\/X-BounceID
{ SI="$SI$RS 1000 $MATCH in header!" }
  
#:0
#* ^\/X-rpcampaign
#{ SI="$SI$RS 1000 $MATCH in header!" }
 
# Hafenhalle
#:0
#* ^\/X-CampaignID
#{ SI="$SI$RS 100 $MATCH in header" }
  
:0 D
* ^\/X-EMV
{ SI="$SI$RS 1000 $MATCH in header!" }
  
:0 D
* ^\/X-WUM
{ SI="$SI$RS 100 $MATCH in header" }
  
:0 D
* ^List.*/DmaOptOut
{ SI="$SI$RS 200 DmaOptOut" }
  
:0 D
* ^List-Unsubscribe.*p=unsubscribe
{ SI="$SI$RS 200 p=unsubscribe" }
  
#:0 DE
#* ^List-Unsubscribe.*http.*/u/
#{ SI="$SI$RS 200 List-Unsubscribe.*/u/" }
  
:0 D
* ^\/X-Proofpoint-Spam
{ SI="$SI$RS 10 $MATCH" }
  
:0 D
* ^\/X-Unsubscribe-Web
{ SI="$SI$RS 200 $MATCH" }
  
:0 
* ^Date:   .
{ SI="$SI$RS 50 Date-header with too many spaces" }
  
:0 
* ^From:.*\/\{SET:
{ SI="$SI$RS 1000 $MATCH in From" }
  
:0  
* ^From:\"
* ! ^From:.*(F-I|bw-bank)\.de
{ SI="$SI$RS 100 From: without space" }
  
:0
* ^Date:.* \/-0-100
{ SI="$SI$RS 300 $MATCH in Date" }
  
:0 
* ()\/mymailer\.it
{ SI="$SI$RS 1000 $MATCH!" }
  
:0 
* ()\/cogeco
{ SI="$SI$RS 10 $MATCH" }
  
:0 
* ()\/windows-1251
{ SI="$SI$RS 100 russian charset $MATCH in header" }
  
#:0 D
#* ! SI ?? port/helo
#* ! Exim
#* ^Received: from \[[0-9\.]+\] \(port=[0-9]+ helo=.*\)
#{ SI="$SI$RS 300 Exim port/helo fake" }

#:0 D
#* ^To:.*@\/[a-z0-9\.\-]+
#* $^Received:.*by [a-z0-9\.\-]*($MATCH) with esmtp \([^ ]+ [^ ]+\)
#{ SI="$SI$RS 300 Received by $MATCH with esmtp fake" }

:0 D
* ^Received: by [0-9\.]+ with SMTP id [a-zA-z]+;
{ SI="$SI$RS 300 Received by IP with SMTP id NoNsEnse" }
  
:0 E
* ^Received:.*	by [a-z0-9\.-]+ with ASMTP id [a-z0-9]+
{ SI="$SI$RS 200 Received with ASMTP id" }
  
:0 D
* ^Received: .* \/\[\$ipad\]
{ SI="$SI$RS 1000 $MATCH" }

:0 
* ^Received: .*<rfc822;.*%
{ SI="$SI$RS 100 rfc822%" }

:0 D
* ^Received: from .* \(-?[0-9]+ \[-?[0-9]+\]\)
{ SI="$SI$RS 1000 Received from (NUMBER [NUMBER])!" }

:0 D
* ^Received: from \[[0-9\.]+\] by .*; , [0-9]
{ SI="$SI$RS 1000 Received from [IP] by ; ," }

#:0 D
#* ^To:.*@\/[a-z0-9\.-]+    
#* $ ^Received: from \[?[0-9\.]+\]? \(HELO.*by $MATCH
#{ SI="$SI$RS 1000 Received from IP (HELO ...) by MYHOST (faked)!" }
  
:0 ED
* ^Received: from [0-9\.]+ \(HELO
{ SI="$SI$RS 60 Received from IP (HELO ...)" }
  
:0
* ()\/site90\.com
{ SI="$SI$RS 1000 $MATCH in header" }

#:0
#* ()\/superdeals
#{ SI="$SI$RS 1000 $MATCH in header" }

#:0
#* ()\/ekol@
#{ SI="$SI$RS 1000 $MATCH in header" }

#:0
#* atlas\.cz
#{ SI="$SI$RS 30 atlas.cz in header" }

:0
* do-not-reply
{ SI="$SI$RS 10 do-not-reply in header" }

:0
* indiatimes\.com
{ SI="$SI$RS 30 indiatimes.com in header" }

:0
* sunumail
{ SI="$SI$RS 80 sunumail in header" }

:0
* stocknews
{ SI="$SI$RS 100 stocknews in header" }

:0
* ^Received: .*-\.[a-z0-9\.]
{ SI="$SI$RS 10 -. in Received" }

:0
* ^Received: [a-z0-9]\.\.[a-z0-9]
{ SI="$SI$RS 200 .. in Received" }

:0
* ^List.*yahoogroups\.com
* !^Received: from .* \([0-9a-z\-\.]+yahoo
{ SI="$SI$RS 1000 faked yahoogroups" }

#:0
#* ^Received: from [a-z0-9\.-]*yahoo\.com \(?\[
#{ SI="$SI$RS 100 faked from yahoo.com" }

#:0 E
#* ^Received: from [a-z0-9\.-]*hotmail\.com \(?\[
#{ SI="$SI$RS 100 faked from hotmail.com" }

#:0 D
#* ^Received: \/from \[.* with [A-Z]+;
#{
#  	X=$MATCH
#    
#	:0 D
#    	* ! $X ?? yahoo|HTTP
#    	{ SI="$SI$RS 100 nonsense protocol ($MATCH)" }
#}
  
:0 
* ^Received: from QRJATYDI
{ SI="$SI$RS 1000 QRJATYDI" }

:0 E
* ^Received: from \.
{ SI="$SI$RS 200 received from ." }

:0 E
* ^Received: from \(HELO [a-z0-9]+\)
{ SI="$SI$RS 1000 Received from HELO" }

#:0 E
#* ^Received: from [a-z]+ \[[0-9\.]+\] \(
#{ SI="$SI$RS 1000 [ip] in HELO" }

:0 
* ^Received:.*\/<envelope from
{ SI="$SI$RS 1000 $MATCH" }

#:0
#* ^Received.*\/bulk_mailer
#{ SI="$SI$RS 30 $MATCH" }

:0
* ^Received.*\/webhosting
{ SI="$SI$RS 10 $MATCH" }

:0 
* ^Received:.*search.engine
{ SI="$SI$RS 100 search-engine" }

:0 
* ^Received:.*( promo|promo[\.@]|promotions)
{ SI="$SI$RS 50 received promo" }

:0 
* ^Received: from [0-9\.]+ by [0-9\.]+( with SMTP)?;
{ SI="$SI$RS 300 received from ip by ip" }

:0 E
* ^Received: from [0-9\.]+ by [a-z\.]+;
* ! ^Received:.*(webmail|http)
{ SI="$SI$RS 50 received without with/id" }

:0 
* ^Received: from \[[0-9\.]+\] by [0-9\.]+ .
{ SI="$SI$RS 100 from [number] by number" }

#:0 E
#* ^Received: from \[[0-9\.]+\]+ by.*smtp
#{ SI="$SI$RS 30 from [number]" }

:0 
* ^Comments?: \/[a-z0-9]+-[a-z0-9-]+
{
	:0 B
	* $ ^$MATCH
	{ SI="$SI$RS 100 spamsig comment in header+body" }
}

# :0
# * ^From: \"\/[a-z0-9_\.\-]+@[a-z0-9_\.\-]+\.[a-z]+
# {
#	:0
#	* $!^From: \"$MATCH.*$MATCH
#	{ SI="$SI$RS 100 wrong e-mail address as real name" }
# }

:0 D
* ^(From|To): .* .
* !^From:.*[A-Z]
* !^To:.*[A-Z]
* !^Cc:.*[A-Z]
* !webmail
{ SI="$SI$RS 10 no uppercase char in From+To+Cc" }

:0 ED
* ^To: "[^A-Z]+"
* !^To: ".+@.+"
{ SI="$SI$RS 10 no uppercase in real name To" }

:0 
* $ !^From:.*@($MYDOMAIN)
* $ ^To:.*@\/[a-z0-9\.\-]*($MYDOMAIN)
{ 
	TDP=$MATCH
	
	:0
	* $ ^Received: from $TDP \/\(.*\]\)
	{
		RDP=$MATCH
		
		:0
		* $ ! RDP ?? ($MYDOMAIN)
		* $ ! RDP ?? 127\.0\.0\.1|localhost
		{ SI="$SI$RS 50 faked Received: from $TDP $MATCH" }
	}
}

:0
* $!$MAILINGLIST
* $!From:.*($STUPIDS)
* !^Organization: http://freemail\.web\.de
* !^X-AMAZON
* !^From:.*MAILER-DAEMON
* !^To:.*(master|abuse|root)@
* !SI ?? no real name
{
	:0 E
	* ^To: [a-z][^ ]+ <
	{ SI="$SI$RS 10 real name without space in To:" }
	
	:0 E
	* ^Reply-To: <
	* ^From: <
	* ^To: <
	{ SI="$SI$RS 20 no real name in From+To+Reply-To" }

	:0 E
	* ^To: [^ ]*$
	* ^To: .*@
        {
		:0 B
	        * ()Content-Type: application/msword
		{ SI="$SI$RS 100 no real name in To and word attachment" }
          
		:0 E
		* !wwwrun@
		* $!^To:.*$LISTROBOT
		{ SI="$SI$RS 10 no real name in To:" }
	}
}

:0 D
* ^To: .* To:
{ SI="$SI$RS 100 To: To:" }

:0 D
* ^Cc: .* Cc:
{ SI="$SI$RS 100 Cc: Cc:" }

:0 
* -5^0
* 1^1 ^To:
{ SI="$SI$RS 100 too many To-fields" }

:0 
* -5^0
* 1^1 ^Cc:
{ SI="$SI$RS 100 too many Cc-fields" }

:0 
* !ASIANCHARSET ?? ok
* (charset=.*|=\?)koi8-[ru]
{ SI="$SI$RS 100 russian charset" }

#:0
#* ^Subject:.*           \#[0-9a-f]+$
#* ^In-Reply-To
#{ SI="$SI$RS 100 Spam-Counter" }

:0
* ^Subject:.*\([a-z].* \)$
* ^To:.*@.*@
{ SI="$SI$RS 100 (* ) at end of Subject" }

:0 
* ^Received.*\/hotgirl
{ SI="$SI$RS 100 $MATCH" }

:0 
* ^Received:.*\/MDaemon\.v2\.7
{ SI="$SI$RS 100 MDaemon.v2.7" }

:0 
* ^Received: from Chez\.com \(
{ SI="$SI$RS 1000 Chez.com" }

:0 
* ^Received: from .*\.\.\.
{ SI="$SI$RS 100 Received ..." }

:0 
* ^Received: .*\.yahou\.com
{ SI="$SI$RS 1000 yahou.com" }

:0 D
* ^Received: from GAL \(\[
{ SI="$SI$RS 1000 GAL" }

:0 
* ^Received: from \[[0-9\.]+\] \(helo=[a-z\-\.]+\)$
{ SI="$SI$RS 100 faked helo received" }

:0 D
* ^Received:.*NNFMP
* ^Received:.*QMQP
{ SI="$SI$RS 30 NNFMP/QMQP" }

:0 D
* ^Received:.* \/with LOCAL; 
{ SI="$SI$RS 200 $MATCH" }

#:0 D
#* ^References: <[0-9A-Z]+@
#* ^In-Reply-To: <[0-9A-Z]+@
#* ^Message-ID: <[0-9A-Z]+@
#{ SI="$SI$RS 30 [0-9A-Z]+@ References+In-Reply-To+Message-ID" }

#:0 
#* netscapw
#* !^Subject:.*netscapw
#{ SI="$SI$RS 1000 netscapw" }

:0 
* trafficmagnet|tm-magnet
* !^Subject:.*(trafficmagnet|tm-magnet)
{ SI="$SI$RS 1000 trafficmagnet" }

:0 
* di-ve\.com
{ SI="$SI$RS 30 di-ve.com" }

:0 
* .\/[@-]test\.com
{ SI="$SI$RS 100 test.com" }

:0 D
* RND_[a-zA-Z]
{ SI="$SI$RS 100 RND_ in header" }

:0 D
* .\/%[A-Z]+_[A-Z_]+
{ SI="$SI$RS 200 random variable ($MATCH)" }

:0 
* .\/anonymous@
{ SI="$SI$RS 50 $MATCH" }

:0 
* .\/@sex
{ SI="$SI$RS 50 $MATCH" }

:0 
* .\/@cash
{ SI="$SI$RS 50 $MATCH" }

:0 
* ^X-.*[¡-¿]
{ SI="$SI$RS 100 8 bit char in X-Header" }

#:0 
#* ^X-Optin
#{ SI="$SI$RS 1000 X-Optin" }

:0 
* ^X-Spam: Not detected
{ SI="$SI$RS 1000 X-Spam" }

:0 
* ^\/X-KWF
{ SI="$SI$RS 100 $MATCH" }

:0 
* ^\/X-Declude-Sender
{ SI="$SI$RS 30 $MATCH" }

#:0 
#* ^\/X-vmp-Text
#{ SI="$SI$RS 100 $MATCH" }

:0 
* ^X-Distribution: Mass
{ SI="$SI$RS 50 X-Distribution: Mass" }

#:0 
#* ^X-.*Invalid.*header.
#{ SI="$SI$RS 100 Invalid header" }

:0 
* ^\/(X-PMFLAGS|X-Precedence-Ref)
{ SI="$SI$RS 1000 $MATCH" }

# X-Library: Indy IncrediMail
# wird zB von reichelt.de und ftc.gov verwendet!
# X-Mailer: osCommerce
# wird verwendet von cnc-bike.de
:0 D
* 1^0 ^\/X-Mailer:.*(Allaire Cold Fusion|E-Mail Connection|Emailer Platinum|Extractor|FastMail|Floodgate|Marketing|Mass|NetMailer|RIME|sndb32|WorldMerge|eMerge|[dD]iffondi|V3,.,.,.|Stellar-X PostList|Bomber|Clansoft|FletMail|DMailer|PG-MAILINGLIST|Mailloop|Mihov|QuickSender|Direct Email|GOTO Software Sarbacane|MailWorkZ|StormPost|jpfree|OutLook|eGroups-EW|eGroups Message Poster|WorldWideCreations|Master-SMTP|Mediacomm Communicator|Rapid-Emailer|LetterIt|mLogic|Mail Class|Quality Web Email|SmartSend|The Bat.*Business|JRCG|OpenEMM)
* 1^0 ^\/X-Mailer: [a-z]+\.[0-9]+$
* 1^0 ^\/X-Mailer: [0-9A-F]+\.[0-9A-F]+\.[0-9a-f]+$
* 1^0 ^\/X-Mailer: [a-z]+ [a-z]+ ([a-z]+ )+- [0-9]\.[0-9]$
* 1^0 ^\/X-Mailer: (Web|WebMail|FreeBSD|Sendmail|Postfix|QMail|Exim|RMM|ESMTP|Gentoo|Google|HotmailVoxmail|Zmailer|CommuniGate Pro)$
* 1^0 ^\/X-Mailer: (Smart_Send_|OpenWebMail|AWeber|MessageFocus|EDMAIL|Dada Mail|Sendy|Email Sending System)
* 1^0 ^\/X-MAILER: (Active!)
* 1^0 ^\/X-Bulkmail:
{ SI="$SI$RS 1000 $MATCH" }
#* 1^0 ^\/X-Mailer: Webmail [0-9]+-STANDARD
#* 1^0 ^\/User-Agent: MOMENTUM \(3\.0 build\(25\) \[Asynch\]\)
#* 1^0 ^\/X-newsreader: BusinessExpress
#* 1^0 ^\/X-Server: Advanced Direct Remailer
#* 1^0 ^\/Mailing-List: opt in mailing list manager
#* 1^0 ^\/X-Library: (Trafficmagnet|SeekerCenter)

:0 ED
* ^X-Mailer: [a-z]+$
* !^X-Mailer: (smtpsend|fex)
{ SI="$SI$RS 50 X-Mailer [a-z]+" }

:0 ED
* ^X-Mailer: [a-z]+ [a-z]+$
{ SI="$SI$RS 100 X-Mailer [a-z]+ [a-z]+" }

:0 
* ^\/(X-See-Also|X-In-Response-To|X-Other-References): [0-9A-F]+$
{ SI="$SI$RS 100 faked $MATCH" }

:0 
* ^References: .[^@]+$
{ SI="$SI$RS 30 no @ in References" }

#:0 
#* ^From: [a-z]+ <
#* ^Subject: Re: in [0-9][0-9]\.[0-9][0-9]\.[0-9][0-9][0-9][0-9]$
#* ^References:
#* ^In-Reply-To:
#* ^Content-Type: multipart/related
#{ SI="$SI$RS 1000 nonsense subject date" }

:0 
* ^Comments: Authenticated sender is
* !^X-mailer: Pegasus Mail
* !^Resent-to:
{ SI="$SI$RS 100 Authenticated sender" }

:0
* ^Content-Language:.*CN$
{ SI="$SI$RS 30 Content-Language CN" }

:0 
* ^Content-Type: text/plain$
* !^X-rim
{ SI="$SI$RS 10 Content-Type text/plain without charset" }

:0 E
* ^Content-Type.*\/_NextPart_.*C5ABAF209EF376268C8
{ SI="$SI$RS 100 MIME-boundary $MATCH" }

:0 DE
* ^Content-type: multipart/alternative; boundary="_NextPart_[A-Za-z0-9]+_"
{ SI="$SI$RS 200 Content-type _NextPart_*_" }
  
:0 DE
* ^Content-Type.*\/"----=_NextPart_[a-z]+"
{ SI="$SI$RS 200 MIME-boundary _NextPart_smallletters" }

:0 DE
* ^Content-Type.*\/_NextPart_.*w3nerasdf
{ SI="$SI$RS 200 MIME-boundary $MATCH" }

:0 E
* ^Content-Type.*\/_separator_
{ SI="$SI$RS 50 MIME-boundary $MATCH" }

:0 E
* ^Content-Type.*\/_Dragon
{ SI="$SI$RS 200 MIME-boundary $MATCH" }

:0 E
* ^Content-Type.*\/--ALT--
{ SI="$SI$RS 50 MIME-boundary $MATCH" }

:0 E
* ^Content-Type.*\/=====[0-9]+=_
{ SI="$SI$RS 100 MIME-boundary =====[0-9]+=_" }

:0 E
* ^Content-Type.*--[0-9]+-[0-9]+-[0-9]+
{ SI="$SI$RS 100 MIME-boundary --[0-9]+-[0-9]+-[0-9]+" }

:0 E
* ^Content-Type.*"--[0-9]+"
{ SI="$SI$RS 30 MIME-boundary --[0-9]+" }

:0 
* ^X-Mailer:.* \/(6\.00\.2800\.1441|6\.0\.6001\.18000)
{ SI="$SI$RS 200 faked X-Mailer $MATCH" }

#:0 DE
#* ^Content-Type: multipart
#{
#	:0 DB
#	* src=.*cid.*@ 
#    	* ^Content-Type: image
#	{ SI="$SI$RS 10 cid@ image" }
#}
  
#:0
#* ^X-MimeOLE 
#* ^Content-Type: multipart/related
#* ! ^thread-index    
#{ SI="$SI$RS 50 X-MimeOLE multipart/related and no thread-index" }

#:0 E
#* ^Thread-Index: .*\/[^0-9a-zA-Z=/\+\t]
#{ SI="$SI$RS 100 illegal character '$MATCH' in Thread-Index" }

:0 E
* ^X-Mailer: Microsoft Outlook Express  .
{ SI="$SI$RS 200 faked Outlook Express with double-space in X-Mailer" }
  
:0 
* ^X-Mailer: Microsoft Outlook Express [0-9]
* !^X-MimeOLE
{ SI="$SI$RS 100 faked Microsoft Outlook Express" }

:0 E
* ^X-MimeOLE: Produced By Microsoft MimeOLE \/(V6\.00\.2900\.2869|V4\.71\.2730\.2)
* !^(X-MS|Thread-Index|X-Mailer: Microsoft)
{ SI="$SI$RS 200 faked MimeOLE $MATCH" }

:0 E
* X-MimeOLE: Produced By Microsoft MimeOLE \/(V4\.71\.1712\.3|V5\.50\.4133\.2499|V6\.00\.(2800\.1437|2900\.2905)|V6\.0\.6001\.18000)
{ SI="$SI$RS 100 faked MimeOLE $MATCH" }
  
:0 E
* ^X-Mailer: Microsoft Office Outlook, Build 11\.0\.5510
* ^X-MimeOLE: Produced By Microsoft MimeOLE V6\.00\.2800\.1106
{ SI="$SI$RS 30 suspicious Microsoft Office Outlook/MimeOLE version combination" }

:0 E
* ^X-Mailer: Microsoft Office Outlook, Build 12\.0\.4210
{ SI="$SI$RS 30 suspicious Microsoft Office Outlook Build 12.0.4210" }

:0
* ^X-Mailer: Microsoft Outlook Express \/6\.00\.(2462\.(1409|0000)|2720\.3000|2800\.1106)
{ SI="$SI$RS 30 suspicious Outlook Express version $MATCH" }
  
# SUSVERS='6\.00\.(2600\.0000|2900\.(2527|2962|3028))'
SUSVERS='(6\.00\.(2600\.0000|2720\.1081|2900\.(2527|2962)|3790\.4133)|5\.00\.(2314\.1300|2919\.(6600|6700))|5\.50\.(4133\.2578|4131\.1600|4927\.1200))'
  
:0 E
* $ ^X-Mailer: Microsoft Outlook Express \/$SUSVERS
* $ ^X-MimeOLE: Produced By Microsoft MimeOLE V$SUSVERS
{ SI="$SI$RS 30 suspicious Microsoft Outlook Express/MimeOLE version ($MATCH)" }
  
#:0 E
#* ^X-MimeOLE
#* !^(X-MS|X-Mailer: Microsoft)
#{ SI="$SI$RS 50 faked MimeOLE" }

:0
* ^User-Agent:.*\/(Gecko/200[123]|Netscape/7)
{ SI="$SI$RS 50 suspicious User-Agent $MATCH" }

:0 ED
* ^User-Agent: Roundcube
{ SI="$SI$RS 10 Roundcube" }

#:0 
#* ^X-.*bulk.*:
#* !^X-BULK-CHECK
#{ SI="$SI$RS 100 X-*Bulk" }

#:0 
#* ^X-UIDL
#{ SI="$SI$RS 100 X-UIDL" }

#:0 
#* ^X-Infomail
#{ SI="$SI$RS 100 X-Infomail" }

:0 
* ^Received.*CommuniGate
{
	:0 B
	* ()\/trial version of CommuniGate
	{ SI="$SI$RS 100 $MATCH" }
}


:0 
* ^Received: from 255\.255\.255\.255
{ SI="$SI$RS 100 from 255.255.255.255" }

:0 
* ^\/Received: from \[[0-9\.]+\] by [a-z0-9\.\-]+ id <.*>;
{ SI="$SI$RS 50 received from [ip] / <id>" }

:0 D
* !^Received:.*(WinRoute|SMTPSVC|with ESMTP via TCP|authenticated bits|Exim|CommuniGate)
* !^X-Mailer: (Kaufman Mail Warrior|DvISE)
* !^User-Agent: Mozilla
{
	:0 
	* ^Received: from [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+ \((unknown )?\[[0-9\.]+\]\).*with e?smtp
	{ SI="$SI$RS 50 received from number" }

#	:0 E
#	* ^Received: from \[[0-9\.]+\] (\(\[|by [a-z0-9\.\-]+;)
#	* !Received: from \[[0-9\.]+\] \(\[[0-9\.]+\] \[[0-9\.]+\]\)
#	{ SI="$SI$RS 80 received from [ip]" }

	:0 E
	* $^Received: from \/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+ \(.* by [0-9a-z\-\.]+($MYDOMAIN)
	{ 
		:0
		* !$MATCH ?? 127\.0\.0\.1
		{ SI="$SI$RS 20 received from ip" }
	}
}

:0 
* ^Received: from mydomain.com
{ SI="$SI$RS 100 from mydomain.com" }

:0 E
* ^Received: from plain .
{ SI="$SI$RS 100 from plain" }

:0 
* ^(From|To).*adult
{ SI="$SI$RS 50 adult" }

#:0 
#* ^Illegal-Object
#{ SI="$SI$RS 100 Illegal-Object" }


#
## verraeterische Message-Ids
#
  
:0 
* ^(DKIM-Signature|Message-Id):.*\/elasticemail
{ SI="$SI$RS 100 $MATCH" }

:0 
* ^Message-Id:.*@>
* !^Resent-Message-Id: 
{ SI="$SI$RS 100 Message-Id @>" }

#:0 
#* ^Message-Id:.*\.ru>
#* !^Resent-Message-Id: 
#{ SI="$SI$RS 100 Message-Id ru" }

:0 E
* ^Message-ID:.*>.*>
* !^Resent-Message-Id: 
{ SI="$SI$RS 1000 two > in MID" }

:0 E
* ^Message-Id: [^@]*$
* !^Resent-Message-Id: 
{ SI="$SI$RS 50 no @ in MID" }

:0 E
* ^Message-Id: <..* ..*>
* !^Resent-Message-Id: 
{ SI="$SI$RS 100 space in MID" }

:0 E
* ^Message-Id:
* !^Message-Id:.*<.+>
* !^Resent-Message-Id: 
{ SI="$SI$RS 50 MID not in <>" }

:0 E
* ^Message-Id:.*@unknown
* !^Resent-Message-Id: 
{ SI="$SI$RS 30 Message-Id @unknown" }
	
:0 E
* ^Message-Id:.*xt\.local
* !^Resent-Message-Id: 
{ SI="$SI$RS 10 MID xt.local" }

#:0 
#* ^Message-Id:.*@Default
#* !^Resent-Message-Id: 
#{ SI="$SI$RS 100 MID @Default" }

#:0 
#* ^Message-Id: .*@\[.*\]
#{ SI="$SI$RS 100 @[ip-address] in MID" }


#:0 
#* ^Received:.*\[.*[^0-9\.].*\]\)
#{ SI="$SI$RS 100 illegal character in ip-address" }


#
## sonstiges
#

:0
* ^Subject:.*Rechnung
* ^Received: from .*google\.com
{ SI="$SI$RS 100 Rechnung from google" }

:0
* ^To:.*@\/[a-z0-9\.\-]+
{
  :0
  * $ ^From: \"?$MATCH
  { SI="$SI$RS 200 To domain in From: $MATCH" }
  
  :0 E
  * $ ^From:.*$MATCH\"
  * $! ^From:.*$MATCH>
  { SI="$SI$RS 200 To domain $MATCH mismatch in From" }
}


:0
* ^From: "?INFO"? .*@outlook
{ SI="$SI$RS 200 INFO outlook" }

:0
* ^From:.*outlook
* ^Subject:.*DPD
{
  :0 B
  * 1^0 korrekte Zustellung des Pakets
  * 1^0 Ihr Paket zuzustellen
  { SI="$SI$RS 200 phishing via outlook" }
}

:0
* ^To: Undisclosed recipients
* ^Subject:$
{ SI="$SI$RS 100 undisclosed recipients and empty subject" }
  
:0 E
* ^To: undisclosed-recipients
* ^Subject: .*(bank|Sicherheit)
{ SI="$SI$RS 100 undisclosed-recipients + bank" }
  
:0 E
* ^To: undisclosed-recipients
* ^(From|Received):.*gmail\.com
{ SI="$SI$RS 100 undisclosed-recipients and from gmail.com" }

:0 E
* ^To: undisclosed.recipients
{ SI="$SI$RS 0 undisclosed-recipients" }
  
:0 D
* ^From:.*\/(DHL|Post-Bank)
{
  :0
  * $  ^From:.*$MATCH.*@
  * $! ^From:.*@.*$MATCH
  { SI="$SI$RS 200 fake $MATCH From" }
}

:0
* ^From: Google
* $! ^Received: from .*google.*by.*($MYDOMAIN)
{ SI="$SI$RS 100 From Google but not received from" }
  
:0
* ^List.*groups\.google\.com
{ SI="$SI$RS 100 groups.google.com" }

:0
* ^List-ID:.*\.(press|host|top|pw|club|website|site|icu|us)>
{ SI="$SI$RS 200 spammer domain List-ID" }
  
:0 
* ^(From|Received):.*\/\.(xyz|win|date)[ >]
{ SI="$SI$RS 100 spammer domain $MATCH" }

:0 E
* ^(From|Received):.*\/\.(biz|ninja|today|guru|live|press|host|top|pw|club|website|site|icu|shop)[ >]
{ SI="$SI$RS 30 spammer domain $MATCH" }
  
#:0 
#* ^Precedence: junk
#{ SI="$SI$RS 30 Precedence: junk" }

:0
* western.?union
{ SI="$SI$RS 100 Western Union" }

:0
* ()\/netsolutionserver
{ SI="$SI$RS 1000 $MATCH" }

:0
* ofertas
{ SI="$SI$RS 50 ofertas" }

:0
* newslettercmf
{ SI="$SI$RS 200 newslettercmf" }

#:0
#* ^Disposition-Notification-To
#{ SI="$SI$RS 10 Disposition-Notification-To" }

:0
* ^Reply-To: [a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z][a-z]
{ SI="$SI$RS 1000 too long Reply-To" }

:0
* ^Reply-To:.*financ
{ SI="$SI$RS 100 Reply-To financ" }

:0
* ^Reply-To:.*@gmail\.com
{ SI="$SI$RS 10 Reply-To gmail.com" }

:0
* ^From:.*[a-z]<
{ SI="$SI$RS 30 no space between realname and <address>" }

:0 
* ^To: <\/[a-z]+
{
  :0
  * $^From: \"$MATCH\"
  { SI="$SI$RS 30 From=To localpart" }
}

:0
* !^User-Agent:
* !^X-Mailer:
* !^X-MimeOLE
* !^X-MS
* !^X-AMAZON
* !^X-rim
* !^Thread
* !^Received: by .*google
* !webmail
* $!From:.*($STUPIDS)
{ SI="$SI$RS 10 no User-Agent and no X-Mailer" }

#:0
#* ^Received: from \[\/[0-9\.]+
#{
#	:0
#	* -1^0
#	* 1^1 $ ^Received: from \[$MATCH
#    	{ SI="$SI$RS 100 Received more than once from [$MATCH]" }
#}
  
:0 
* ^Received: from [a-z]+\.[a-z]+[0-9][a-z]+\.[a-z0-9]+ \[[0-9\.]+\].*for <.*>;
{ SI="$SI$RS 100 faked domain with number" }

:0 
* ^Received:.*env-from.*wwwrun@
{ SI="$SI$RS 10 env-from wwwrun" }

:0
* $ ^Received: from www.*($MYDOMAIN)
{ SI="$SI$RS 10 received from www" }

:0
* ^Received:.*casino
{ SI="$SI$RS 30 received from casino" }

#VERBOSE=on
#:0
#* ^Mailing-List:
#* ^List-Post:
#* ^List-Archive:
#* ^Delivered-To:
#* ^Received:.*by \/[a-z0-9\.\-]+\.[a-z]+
#{
#	MYHOST=$MATCH
#  
#	:0
#    	* $ ^List-Help:.*$MYHOST
#    	* $ ^To:.*$MYHOST.*$MYHOST
#    	* ! $ ^List-ID:.*$MYHOST
#    	* ! $ ^List-Archive:.*$MYHOST
#    	{ SI="$SI$RS 1000 faked mailinglist with $MYHOST" }
#}

:0 D
* ^List-ID
* ^Mailing-List:
* ^List-Post:.*@\/[a-z0-9\.\-]+\.[a-z]+
* ^List-Archive:
* ^Delivered-To:
{
	:0
    	* ! $^Received:.*env-from.*$MATCH
    	{ SI="$SI$RS 1000 faked mailinglist headers (containing $MATCH)!" }
}
#VERBOSE=off
  
# offene formmail CGI
:0 
* 1^0 ^To:.*>www
* 1^0 ^To:.*@.*@.*@
* 1^0 from www
* !^Cc
{
	:0 
	* ^To:.*www.*www.*www
	{ SI="$SI$RS 100 open formmail CGI" }
	
#	* 1^0 ^---------------------------------------------------------------------------
	:0 EB
	* 1^0 ^Below is the result of your
	* 1^0 ^This email was sent
	* 1^0 ^This .* was submitted by
	* 1^0 ^Ceci est le .* de votre envoi
	{ SI="$SI$RS 100 open formmail CGI" }
}

# Mehr als 6 binaer-Zeichen (non-NVT-ASCII) im Subject
:0 
* ^Subject:.*[^\ -~][^\ -~][^\ -~].*[^\ -~][^\ -~][^\ -~]
{ SI="$SI$RS 30 binary subject" }

## binary From oder To
#:0 
#* ^(From|TO).*[^
-~][^ ]*@
#{ SI="$SI$RS 100 binary address" }

:0 
* !^X-MD
* !^Received:.*via HTTP
* !^X-Mailer: IncrediMail 
* ()\/[€-ÿ]
{ SI="$SI$RS 10 8bit char ($MATCH) in header" }

#
## Diverses
#
:0 
* !^To:
* !^Cc:
* !^Newsgroups:
* !^From.*master@
{ SI="$SI$RS 30 no To&Cc-header line" }

:0 
* ^To: *$
{ SI="$SI$RS 30 empty To-header line" }

:0 
* ^From: *$
{ SI="$SI$RS 30 empty From-header line" }

:0 
* !^From:
{ SI="$SI$RS 30 no From-header line" }

:0 E
* ^From: .*<>
{ SI="$SI$RS 30 empty From-header line" }

:0 E
* $^From: .*$CONS$CONS$CONS$CONS$CONS$CONS$CONS$CONS$CONS$CONS
* ! $^From: .*\?B\?
{ SI="$SI$RS 30 10 following consonants in From line" }

:0 D
* ^From: [0-9A-Z]+@
* ^To: [0-9A-Z]+@
{ SI="$SI$RS 30 all uppercase From+To localpart" }

:0
* arvixevps\.com
{ SI="$SI$RS 200 arvixevps.com" }

:0 
* ^(From|Reply-To|Sender):.*@[0-9][0-9][0-9]\.(com|net)
{ SI="$SI$RS 30 3 digit domain" }

:0 E
* ^To:.*@.*@.*@.*@.*@.*@.*@.*@.*@.*@.*@
* ^From:.*gmail\.com
{ SI="$SI$RS 100 more than 10 To-addresses and from gmail.com" }

:0 E
* ^To:.*@.*@.*@.*@.*@.*@
{ 
	SI="$SI$RS 10 more than 5 To-addresses" 
	
	:0 
	* 1^1 ^Received: from \/[a-z0-9_\.\-]+
	{
		:0 D
		* $^To: $MATCH
		{ SI="$SI$RS 100 local part To appears in Received from ($MATCH)" }
	}
}

:0 
* ^Cc:.*@.*@.*@.*@.*@.*@.*@.*@.*@.*@.*@
{ SI="$SI$RS 30 more than 9 Cc-addresses" }

## spamsig subject

:0
* !^Subject:.*spam-complaint
{
  :0 D
  * ^Subject:.*\*SPAM\*
  { SI="$SI$RS 200 *SPAM* Subject" }
  
  :0 D
  * ^Subject:.*\/=EF=BB=BF
  { SI="$SI$RS 50 $MATCH Subject" }
  
  :0
  * ^Subject:.*[0-9][0-9][0-9][0-9][0-9]!$
  { SI="$SI$RS 50 Subject 5NUMMER" }
  
  :0 
  * !^Subject:
  * $!^To:.*$LISTROBOT
  { SI="$SI$RS 20 no subject" }
  
  :0 E
  * ^Subject: *$
  * $!^To:.*$LISTROBOT
  { SI="$SI$RS 30 empty subject" }
  
  :0 E
  * ^Subject: ID:.*!
  { SI="$SI$RS 100 subject ID:" }
  
  :0
  * ^Subject:
  {
  	# MIME decode subject ==> SSubject
	:0 fw
	| perl -wx $SPAMBLOCK_SCRIPT -M
  
    	:0
	* ^SSubject:.*\/(Gratis|Gutschein|kostenlos)
        {
          :0
	  * ^Received:.*google\.com
  	  { SI="$SI$RS 100 google.com and $MATCH Subject" }
  
	  :0 E
	  { SI="$SI$RS 30 '$MATCH' in subject" }
        }
	
	:0 
	* ^SSubject:.*\/collaboration
	{ SI="$SI$RS 30 $MATCH Subject" }
	
	:0 
	* ^SSubject:.*\/exklusiv
	{ SI="$SI$RS 10 $MATCH Subject" }
	
	:0 
	* ^SSubject:.*\/quote
	{ SI="$SI$RS 30 $MATCH Subject" }
	
	:0 
	* ^SSubject:.*\/Reaktivierung
	{ SI="$SI$RS 30 $MATCH Subject" }
	
	:0 
	* ^SSubject:.*\/Action Required
	{ SI="$SI$RS 30 $MATCH Subject" }
	:0 
      
	* ^SSubject:.* (in|via) \/onedrive
	{ SI="$SI$RS 100 $MATCH Subject" }
	
	:0 
	* ^SSubject:.*\/aktualisier
	{ SI="$SI$RS 30 $MATCH Subject" }
	
	:0 
	* ^SSubject:.*\/respond
	{ SI="$SI$RS 10 $MATCH Subject" }
	
	:0 
	* ^SSubject:.*\/Zahlung
	{ SI="$SI$RS 10 $MATCH Subject" }
	
	:0 
	* ^SSubject:.*\/Zinsen
	{ SI="$SI$RS 10 $MATCH Subject" }
	
	:0 
	* ^SSubject:.*\/FINANZIERUNG
	{ SI="$SI$RS 50 $MATCH Subject" }
	
	:0 
	* ^SSubject:.*\/Verifizieren
	{ SI="$SI$RS 30 $MATCH Subject" }
	
	:0 
	* ^SSubject:.*Notfall(set|koffer)
	{ SI="$SI$RS 50 Notfallkoffer" }
	
	:0 
	* ^SSubject:.*mein [a-z]+ (mann|herr)[,;:]
	{ SI="$SI$RS 50 mein...mann Subject" }
	
	:0 
	* ^SSubject:.*\/Luxury
	{ SI="$SI$RS 30 $MATCH Subject" }
	
	:0 
	* ^SSubject:.*\/Yahoo!
	{ SI="$SI$RS 100 $MATCH Subject" }
	
	:0 
	* ^SSubject:.*\/Final Warning
	{ SI="$SI$RS 30 $MATCH" }
	
	:0 
	* ^SSubject:.*\/ARE YOU INTERESTED
	{ SI="$SI$RS 30 $MATCH" }
	
	:0 
	* ^SSubject:.*\/Did you receive
	{ SI="$SI$RS 50 $MATCH" }
	
	:0 
	* ^SSubject:.*\/linkedin
	{ SI="$SI$RS 100 $MATCH" }
	
	:0 
	* ^SSubject:.*\/Wir haben versucht,
	{ SI="$SI$RS 100 $MATCH" }
	
	:0 
	* ^SSubject:.*\/Digitaler.*Einlieferungsbeleg
	{ SI="$SI$RS 100 Digitaler Einlieferungsbeleg" }
  
	:0 
	* ^SSubject: \[.*\] Paket DPD
        * ! ^From:.*dpd
	{ SI="$SI$RS 100 Fake Paket DPD" }
  
	:0 
	* ^SSubject:.*\/Factura
	{ SI="$SI$RS 100 $MATCH" }
  
	:0 
	* ^SSubject:.*Sie wurden.*ausgew
	{ SI="$SI$RS 100 Sie wurden ausgewaehlt" }
	
#	:0 D
#	* ^SSubject:.*:[0-9][0-9] [AP]M$
#	{ SI="$SI$RS 100 US date in Subject" }
	
	:0 
	* ^SSubject:.*\/(REQUEST FOR|Requested) QUOTATION
	{ SI="$SI$RS 200 $MATCH" }
	
	:0 E
	* ^SSubject:.*\/REQUEST
	{ SI="$SI$RS 10 $MATCH" }
	
	:0 
	* ^SSubject: \/RFQ
	{ SI="$SI$RS 200 $MATCH" }
	
	:0 
	* ^SSubject:.*\/invitation
	{ SI="$SI$RS 10 $MATCH subject" }
	
	:0 
	* ^SSubject:.*\/spende
	{ SI="$SI$RS 10 $MATCH subject" }
	
	:0 
	* ^SSubject:.* god .
	{ SI="$SI$RS 10 god subject" }
	
	:0 
	* ^SSubject:.*\/Password Ex
	{ SI="$SI$RS 100 $MATCH subject" }
	
	:0 
	* ^SSubject:.*\/Gluckwunsch
	{ SI="$SI$RS 200 $MATCH subject" }
	
	:0 
	* ^SSubject:.*\/(Sicherheitsupdate|Sicherheitswarnung)
	{ SI="$SI$RS 30 $MATCH subject" }
	
	:0 
	* ^SSubject:.*\/(hello|wichtig)!
	{ SI="$SI$RS 30 $MATCH subject" }
	
	:0 
	* ^SSubject:.*\/(thank you)
	{ SI="$SI$RS 10 $MATCH subject" }
	
	:0 
	* ^SSubject:.*\/(bitcoin|Kryptow)
	{ SI="$SI$RS 30 $MATCH subject" }
	
	:0 
	* ^SSubject:.*hotmail\.com
	{ SI="$SI$RS 100 hotmail.com subject" }
	
	:0 D
	* ^SSubject: [A-Z] [A-Z] [A-Z] [A-Z] [A-Z]
	{ SI="$SI$RS 50 subject starts with 4 single uppercase letters" }
	
	:0 E
	* ^SSubject: \/Greetings
	{ SI="$SI$RS 30 $MATCH" }
	
	:0 E
	* ^SSubject: \/Dear
	{ SI="$SI$RS 30 $MATCH subject" }
	
	:0 E
	* ^SSubject: FYI$
	{ SI="$SI$RS 30 FYI subject" }
	
#	:0 E
#	* ^SSubject: Ihr Paket [0-9]+\.\.\.  wird zugestellt
#	{ SI="$SI$RS 200 Ihr Paket...wird zugestellt subject" }
	
	:0 E
	* ^SSubject: Re:?$
	{ SI="$SI$RS 100 Re: without subject" }
	
	:0 ED
	* ^SSubject: Rwd: *$
	{ SI="$SI$RS 200 RWD subject" }
	
	:0 E
	* ^SSubject: \/Notification
	{ SI="$SI$RS 20 $MATCH" }
	
	:0 E
	* ^SSubject: .*\/Lieferung ist fehlgeschlagen
	{ SI="$SI$RS 30 $MATCH" }
	
	:0 E
	* ^SSubject: \/Twitter Notification
	{ SI="$SI$RS 100 $MATCH" }
	
	:0 E
	* ^SSubject: \/Achtung
	{ SI="$SI$RS 30 $MATCH" }
	
	:0 E
	* ^SSubject: \/Notice
	{ SI="$SI$RS 10 $MATCH" }
	
	:0 E
	* ^SSubject: \/From M
	{ SI="$SI$RS 30 $MATCH" }
	
	:0 E
	* ^SSubject: \/Your account has been
	{ SI="$SI$RS 100 $MATCH" }
	
	:0 E
	* ^SSubject.*\/CONTACT US
	{ SI="$SI$RS 30 $MATCH" }
	
	:0 E
	* ^SSubject.*\/Donation
	{ SI="$SI$RS 90 $MATCH" }
	
	:0 E
	* ^SSubject.*\/DocuSign
	{ SI="$SI$RS 100 $MATCH" }
	
	:0 E
	* ^SSubject:.*\/PayPal-Konto
	{ SI="$SI$RS 100 $MATCH" }
	
	:0 E
	* ^SSubject:.*\/Konto
	{ SI="$SI$RS 30 $MATCH" }
	
	:0 E
	* ^SSubject: \/message from
	{ SI="$SI$RS 50 $MATCH" }
	
	:0 E
	* ^SSubject:.*/Pending Messages
	{ SI="$SI$RS 50 $MATCH" }
	
	:0 DE
	* ^SSubject: .*\(ID[0-9]+\)$
	{ SI="$SI$RS 100 (ID*) at end of subject" }
	
	:0 DE
	* ^SSubject: RE:[A-Za-z]
	{ SI="$SI$RS 50 no space after RE:" }

	:0 E
	* ^SSubject: hi!?$
	{ SI="$SI$RS 40 'hi' subject" }
	
	:0 E
	* ^SSubject: hello
	{ SI="$SI$RS 20 'hello' subject" }
	
	:0 DE
	* ^SSubject: Hey
	{ SI="$SI$RS 20 'Hey' subject" }
	
	:0 E
	* ^SSubject: Please
	{ SI="$SI$RS 20 'Please' subject" }
	
	:0 E
	* ^SSubject: ((Re|Aw):)? *\/Hallo
	{ SI="$SI$RS 10 '$MATCH' subject" }
	
	:0 E
	* ^SSubject: \/From:Mr  
	{ SI="$SI$RS 100 '$MATCH' subject" }
	
	:0 DE
	* ^SSubject: From
	{ SI="$SI$RS 10 'From' subject" }
	
	:0 DE
	* ^SSubject: \/Sehr geehrter
	{ SI="$SI$RS 30 '$MATCH' subject" }
	
	:0 DE
	* ^SSubject: \/Lieber Freund
	{ SI="$SI$RS 30 '$MATCH' subject" }
	
	:0 DE
	* ^SSubject: \/Guten tag
	{ SI="$SI$RS 30 '$MATCH' subject" }
	
	:0 DE
	* ^SSubject:  *Message subject$
	{ SI="$SI$RS 100 'Message subject' subject" }
	
	:0 D
	* ^SSubject:.*\/ASSISTANCE
	{ SI="$SI$RS 30 '$MATCH' subject" }
	
	:0 
	* ^SSubject:.*\/Proposition
	{ SI="$SI$RS 30 '$MATCH' subject" }
	
	:0 
	* ^SSubject:.*\/Quotation
	{ SI="$SI$RS 30 '$MATCH' subject" }
	
	:0 
	* ^SSubject:.*\/proposal
	{ SI="$SI$RS 30 '$MATCH' subject" }
	
	:0 
	* ^SSubject:.*\/CAN YOU BE TRUSTED
	{ SI="$SI$RS 100 '$MATCH' subject" }
	
	:0 
	* ^SSubject:.*\/Award Notice
	{ SI="$SI$RS 100 '$MATCH' subject" }
	
	:0 D
	* ^SSubject:.*\/Affordable
	{ SI="$SI$RS 50 '$MATCH' subject" }
	
	:0 D
	* ^SSubject:.*\/Attn
	{ SI="$SI$RS 50 '$MATCH' subject" }
	
	:0 
	* ^SSubject:.*\/ATTENTION
	{ SI="$SI$RS 40 '$MATCH' subject" }
	
	:0 
	* ^SSubject:.*\/good news
	{ SI="$SI$RS 30 '$MATCH' subject" }
	
	:0 
	* ^SSubject:.*\/New Order
	{ SI="$SI$RS 30 '$MATCH' subject" }
	
	:0 
	* ^SSubject:.*\/Wholesale
	{ SI="$SI$RS 100 '$MATCH' subject" }
	
	:0 
	* ^SSubject:.* \/sale
	{ SI="$SI$RS 50 '$MATCH' subject" }
	
	:0 
	* ^SSubject:.*\/Tax Refund
	{ SI="$SI$RS 100 '$MATCH' subject" }
	
	:0 
	* ^SSubject:.*\/(STORAGE|MAIL).*(QUOTA|LIMIT|EXCEED)
	{ SI="$SI$RS 100 QUOTA|LIMIT|EXCEED subject" }
	
	:0 
	* ^SSubject:.*\/mail Verification
	{ SI="$SI$RS 100 $MATCH subject" }
	
	:0 
	* ^SSubject:.*\/FINAL NOTICE
	{ SI="$SI$RS 100 $MATCH" }
	
	:0
	* ^SSubject:.*\/Gesch.*ftsvorschlag
	{ SI="$SI$RS 100 $MATCH subject" }
	
#	:0
#	* ^SSubject:.*\/Rechnung
#	{ SI="$SI$RS 0 '$MATCH' subject" }
	
	:0
	* ^SSubject:.*\/lohnt sich
	{ SI="$SI$RS 30 '$MATCH' subject" }
	
	:0
	* ^SSubject:.*\/dringend
	{ SI="$SI$RS 30 '$MATCH' subject" }
	
	:0
	* ^SSubject:.*\/meine [a-z ]*mann
	{ SI="$SI$RS 100 meine mann subject" }
	
	:0
	* ^SSubject:.*\/Ihr Konto
	{ SI="$SI$RS 30 '$MATCH' subject" }
	
	:0
	* ^SSubject:.*Wichtige.*Mitteilung
	{ SI="$SI$RS 80 Wichtige Mitteilung subject" }
	
	:0 
	* ^SSubject:.*\/partner
	{ SI="$SI$RS 10 '$MATCH' subject" }
	
	:0
	* ^SSubject:.*\/watch
	{ SI="$SI$RS 20 $MATCH subject" }
	
	:0
	* ^SSubject:.*\/purchas
	{ SI="$SI$RS 30 $MATCH subject" }
	
	:0
	* ^SSubject:.*\/gift
	{ SI="$SI$RS 30 $MATCH subject" }
	
	:0 
	* ^SSubject:.*\/important message
	{ SI="$SI$RS 100 '$MATCH' subject" }
	
	:0 E
	* ^SSubject:.*\/important
	{ SI="$SI$RS 30 '$MATCH' subject" }
	
	:0 
	* ^SSubject:.*\/dating
	{ SI="$SI$RS 30 '$MATCH' subject" }
	
	:0 E
	* ^SSubject:.*\/cheating
	{ SI="$SI$RS 50 '$MATCH' subject" }
	
	#:0
	#* ^SSubject:.*[!@\*].+[!@\*@].
	#{ SI="$SI$RS 20 too many non-alphanum characters in subject" }
	
	:0 
	* ^SSubject:.*\/sexy
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/discount
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/[0-9]usd
	{ SI="$SI$RS 100 'USD' in subject" }
	
	:0 
	* ^SSubject:.* \/friend
	{ SI="$SI$RS 10 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Do not miss this
	{ SI="$SI$RS 50 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/(degree|masters|diploma)
	{ SI="$SI$RS 10 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\{\}
	{ SI="$SI$RS 20 '{}' in subject" }
	
	:0 
	* ^SSubject:.*\/!!!
	{ SI="$SI$RS 20 '$MATCH' in subject" }
	
	:0
	* ^SSubject:.*\/[a-z]+\*[a-z][a-z].*[a-z]+\*[a-z][a-z]
	{ SI="$SI$RS 50 multiple * inside word in subject" }
	
#	:0 E
#	* ^SSubject:.*\/[a-z][0!\|][a-z]*[g-z]
#	* !^SSubject:.*(Support|Request|Ticket|Confirm)
#	* !^SSubject:.*=
#	{ SI="$SI$RS 50 substitution character inside word in subject ($MATCH)" }
	
#	:0 E
#	* ^SSubject:.* \/[a-z]+[0-9!\*]+[a-z][a-z]+
#       * !^SSubject:.*(Support|Request|Ticket)
#	{ SI="$SI$RS 30 non-alpha character inside word in subject ($MATCH)" }
	
	:0 E
	* ^SSubject:.* [a-z]+\.[a-z].* [a-z]+\.[a-z]
	{ SI="$SI$RS 30 . inside words in Subject" }
	
#	:0
#	* ^SSubject:.*[^	 -~]
#	{ SI="$SI$RS 30 non-NVT-ASCII character in subject" }
	
#	:0
#	* ! ^SSubject: =\?
#	* $^SSubject:.*\/$CONS$CONS$CONS$CONS$CONS$CONS$CONS
#	{ SI="$SI$RS 30 word with more than 6 consonants in subject ($MATCH)" }
	
#	:0
#	* $^SSubject:.*$VOCS$VOCS$VOCS$VOCS.*$VOCS$VOCS$VOCS$VOCS
#	{ SI="$SI$RS 30 too many vocales in subject" }
	
	:0 E
	* ^SSubject: ..........
	* ^SSubject: [^a-z0-9]+$
	{ SI="$SI$RS 100 no alphanum chars in subject" }

	:0 ED
	* ^SSubject:................
	* ! ^SSubject:.*[a-z]
	{ SI="$SI$RS 10 no lowercase char in subject" }
	
	:0 ED
	* ^SSubject: [A-Z]+ [A-Z ]+$
	{ SI="$SI$RS 20 all uppercase subject" }
	
	:0 ED
	* ^SSubject:.*  [a-z][a-z][a-z]$
	{ SI="$SI$RS 30 3 letter lower case word at end of subject" }
	
	:0 E
	* ^SSubject:.*[a-z0-9]+[a-z][0-9][a-z0-9]+[a-z]$
        * !^SSubject:.*(Support|Request|Ticket|Confirm)
	{ SI="$SI$RS 30 garbage with number at end of subject" }

	:0 
	* ^SSubject:.*\/Confirm Now
	{ SI="$SI$RS 100 $MATCH" }
	
	:0 
	* ^SSubject:.*\/(low|bottom|best) price
	{ SI="$SI$RS 100 $MATCH" }
	
	:0 E
	* ^SSubject:.*\/price
	{ SI="$SI$RS 10 $MATCH" }
	
	:0 D
	* ^\/Subject: [\(\[]ADV[\)\]]
	{ SI="$SI$RS 100 $MATCH" }
	
	:0 ED
	* ^\/Subject: ADV:
	{ SI="$SI$RS 100 $MATCH" }
	
	:0 ED
	* ^SSubject: \/Re: (Hi|Hey)
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 ED
	* ^SSubject: \/Software$
	{ SI="$SI$RS 50 '$MATCH' subject" }
	
	:0 E
	* ^SSubject: \/Popular soft
	{ SI="$SI$RS 100 $MATCH" }
	
	:0 E
	* ^SSubject: \/save up
	{ SI="$SI$RS 50 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject: I am
	{ SI="$SI$RS 30 subject starts with 'I am'" }
	
	:0 E
	* ^SSubject: \/ADLT:
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 ED
	* ^SSubject: Re\[.\]: (talk|discussion)
	{ SI="$SI$RS 30 faked Re[] in subject" }
	
	:0 
	* ^SSubject:.*\/"Date Number"
	{ SI="$SI$RS 50 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/"Confirmation Num"
	{ SI="$SI$RS 50 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/FUND RELEASE
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/funds transfer
	{ SI="$SI$RS 1000 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.* \/fund
	{ SI="$SI$RS 10 '$MATCH' subject" }
	
	:0 
	* ^SSubject:.*( debt|debt )
	{ SI="$SI$RS 30 'debt' in subject" }
	
	:0 
	* ^SSubject:.*\/Kredit
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.* Lotter
	{ SI="$SI$RS 100 'Lotter' in subject" }
	
	:0 
	* ^SSubject:.*\/deal
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
        :0
        * ^SSubject:.*\/WINNER
        { SI="$SI$RS 50 '$MATCH' in subject" }

        :0
        * ^SSubject:.*\/LOTTO
        { SI="$SI$RS 50 '$MATCH' in subject" }

	:0 
	* ^SSubject:.*\/low cost
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/OEM software
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 ED
	* ^SSubject:.*\/OEM
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Preise ohne Konkurrenz
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 D
	* ^SSubject:.*\/Personal
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Video-Nachricht
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Botschaft
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Livecam
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/anti.aging
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/as seen on
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/check it
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/great
	{ SI="$SI$RS 20 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/lose weight
	{ SI="$SI$RS 50 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/weight loss
	{ SI="$SI$RS 50 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/weight
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/casino
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Jackpot
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 D
	* ^SSubject:.*\/Micro-Cap
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
#	:0 ED
#	* ^SSubject:.*\/InverZ
#	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 ED
	* ^SSubject:.*\/Tel.*(Nummer|Auskunft)
	{ SI="$SI$RS 10 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/Gewinnbenachrichtigung
	{ SI="$SI$RS 100 '$MATCH' in subject" }
  
	:0 E
	* ^SSubject:.*\/GEWINNMITTEILUNG
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject: \/GEWINN
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/GEWINN
	{ SI="$SI$RS 10 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/Sie haben gewonnen
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/gewonnen
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/YOU HAVE WON
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/ win ()
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.* grant
	{ SI="$SI$RS 30 grant in subject" }
	
	:0 
	* ^SSubject:.*\/claim
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/award
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Nigeria
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/( |_)loan
	{ SI="$SI$RS 50 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/Darlehen
	{ SI="$SI$RS 50 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/try this
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/marketing
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/mortgage
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Part time job
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Job Vacanc
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/(JOB|Bussiness|incredible) OFFER
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.* \/offer
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/business proposal
	{ SI="$SI$RS 300 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/business
	{ SI="$SI$RS 10 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Congratulation
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Company
	{ SI="$SI$RS 10 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/opt-in
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/million
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 D
	* ^SSubject:.*[0-9][0-9]M .
	{ SI="$SI$RS 100 xxM in subject" }
	
	:0 
	* ^SSubject:.*\/Replica
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/hottest
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.* \/fuck
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.* \/girl
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.* \/teen
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.* \/blonde
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/enlarge
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/(so|with) small
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/penis
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.* \/porn
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/p0rn
	{ SI="$SI$RS 200 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.* \/improve
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.* \/your refill
	{ SI="$SI$RS 200 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.* \/refill
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/ficken
	{ SI="$SI$RS 100 $MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/v.?i.?a.?g.?r.?a
	{ SI="$SI$RS 100 '$MATCH' (viagra) in subject" }
	
	:0 E
	* ^SSubject:.*\/v.agra
	{ SI="$SI$RS 100 '$MATCH' (viagra) in subject" }
	
	:0 E
	* ^SSubject:.*\/CIALIS
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.* \/vigra
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.* \/pi11
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 DE
	* ^SSubject:.*\/V.AGR
	{ SI="$SI$RS 70 '$MATCH' in subject" }
	
	:0 DE
	* ^SSubject: =\?iso-8859-1\?Q.*\/GRRA
	{ SI="$SI$RS 70 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Rolex
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0
	* ^SSubject:.*\/pills
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0
	* ^SSubject:.* \/size
	{ SI="$SI$RS 10 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/opportunity
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Potenz
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/im Bett
	{ SI="$SI$RS 50 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/impotence
	{ SI="$SI$RS 200 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Pharma
	{ SI="$SI$RS 10 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/online.*pharm
	{ SI="$SI$RS 300 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Online.Banking
	{ SI="$SI$RS 10 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Barclays
	{ SI="$SI$RS 10 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/health
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/prescription
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/credit
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Euro
	{ SI="$SI$RS 10 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/cigarette 
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/cheap
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/you save
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/paying
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/GUARANTEED
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\$\$
	{ SI="$SI$RS 30 '\$\$' in subject" }
	
	:0 D
	* ^SSubject:.*[a-z] \. [a-z]
	{ SI="$SI$RS 30  ' . ' between words in subject" }
	
	:0 E
	* ^SSubject:.*turn \$.*into.*\$
	{ SI="$SI$RS 50 'turn \$' in subject" }
	
	:0 E
	* ^SSubject:.*\/only.\$
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\$
	{ SI="$SI$RS 10 '\$' in subject" }
	
	:0
	* ^SSubject:.*\/% OFF
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 E 
	* ^SSubject:.*\/100%
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/%
	{ SI="$SI$RS 20 '%' in subject" }
	
	:0 
	* ^SSubject:.*\/Nebenverdienst
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/verdienen
	{ SI="$SI$RS 50 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/money
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/cash
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 D
	* ^SSubject:.*\/MLM
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Find Out
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/earn( )
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/low.*rates
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Entrepreneur
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/commerc
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/more traffic
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Rates DROPPED
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/ geile
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/ sex ()
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Check This Out
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/read this
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/Offshore
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/payment
	{ SI="$SI$RS 10 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/swift
	{ SI="$SI$RS 10 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/invoice
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/withdrawal
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/reduce
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/really work
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/amazing
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 D
	* ^SSubject:.* \/OTC
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/stock alert
	{ SI="$SI$RS 100 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/ stock
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/trading
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/(Boerse|Aktien)
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/confidential
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/refinance
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*[^ ]     .
	{ SI="$SI$RS 30 more than 4 spaces in subject" }
	
	:0 
	* ^SSubject:.*\/\*\*\*
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/\.\.\.\.\.\.
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 
	* ^SSubject:.*\/foreign residents
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/AGING PROCESS
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/search engine
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/CABLE.*DESCRAMBLER
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*\/ ATM[ -].*(Karte|Card)
	{ SI="$SI$RS 100 'ATM' in subject" }
	
	:0 E
	* ^SSubject: .*\/internet.spy
	{ SI="$SI$RS 30 '$MATCH' in subject" }
	
	:0 E
	* ^SSubject:.*   [0-9][0-9][0-9][0-9]+$
	{ SI="$SI$RS 30 random number at end of subject" }
	
	:0 E
	* ^SSubject:.*   \[[a-zA-Z]+\]$
	{ SI="$SI$RS 30 "[garbage]" at end of subject" }
	
	:0 E
	* ^SSubject:.* -\[[ a-zA-Z]+\]-$
	{ SI="$SI$RS 30 "-[garbage]-" at end of subject" }
	
	:0 E
	* ^SSubject:.*   -[a-z][a-z][a-z]+$
	{ SI="$SI$RS 30 "-garbage" at end of subject" }
  
  	:0 fw
	* !SPAMBLOCKTEST ?? .
    	| formail -I SSubject
  }
}


## misc

:0 D
* ^SUBJECT
* ^DATE
{ SI="$SI$RS 30 uppercase SUBJECT+DATE" }

:0 
* ^Content-Type:.*html
* $!^From:.*($STUPIDS)
{ 
	:0
	* ^Content-Transfer-Encoding: base64
	{ SI="$SI$RS 10 Content-Type HTML+base64" }
  
	:0 E
	* 1^0 HTML ?? ok
	* 1^0 ^Received:.*with HTTP
	{ SI="$SI$RS 0 Content-Type HTML" }
	
	:0 E
	{ SI="$SI$RS 10 Content-Type HTML" }
}

#:0 E
#* ! ^From:.*@(aol|cs)\.com
#* $!^From:.*($STUPIDS)
#* ^Content-Type: \/multipart/alternative
#{ SI="$SI$RS 0 Content-Type $MATCH" }
#
#:0 E
#* ^Content-Type: \/multipart/related
#* ! $SI ?? $MATCH    
#{ SI="$SI$RS 0 Content-Type $MATCH" }

#:0 
#* ^X-Content
#{ SI="$SI$RS 30 X-Content" }

:0 
* ^\/X-Library
{ SI="$SI$RS 10 $MATCH" }

:0 
* ^\/X-Message-Info
{ SI="$SI$RS 1000 $MATCH" }

:0
* ^\/X-Antiabuse
{ SI="$SI$RS 10 $MATCH" }

#:0
#* ^\/X-Filter-ID
#{ SI="$SI$RS 100 $MATCH" }

# Hafenhalle
#:0
#* ^\/X-Report-Abuse.*campaign
#{ SI="$SI$RS 1000 X-Report-Abuse campaign" }

:0 E
* ^\/X-Report-Abuse
{ SI="$SI$RS 10 $MATCH" }

#:0 
#* ^\/X-EM-Version
#{ SI="$SI$RS 30 $MATCH" }

:0 
* ()\/Advertising
{ SI="$SI$RS 30 '$MATCH'" }

:0 
* ()\/remove@
{ SI="$SI$RS 30 '$MATCH'" }

#:0 
#* ^Message-Id:.*localhost.localdomain
#{ SI="$SI$RS 30 MID localhost.localdomain" }

:0 
* ^From:.*@
* $ ^Message-Id:.*($MYDOMAIN)
* $ !^From:.*($MYDOMAIN)
{ SI="$SI$RS 20 local MID but MYDOMAIN not in From" }

    
# Anmerkung: Operator 1^1 matcht letzte aller moeglichen Zeilen!
:0
* $ 1^1 ^\/Received: from .*[$WS]by[$WS].*[$WS](E?SMTP.*|id <.*> for <.*>);.*
{
	:0 D
	* !$MATCH ?? WinRoute
	* !$MATCH ?? LSMTP for Windows
	* !$MATCH ?? AIX4.3/UCB
	* !$MATCH ?? OUTLOOK|outlook
	* !$MATCH ?? aol.com
	* !$MATCH ?? from \[[0-9\.]+\] \(\[[0-9\.]+\] \[[0-9\.]+\]\)
	* !$MATCH ?? (  )
	* !$MATCH ?? (	)
	{ SI="$SI$RS 30 no TAB or double-space in '$MATCH'" }
}

:0
* ^To: [a-z_-]+@
* ^Subject: [a-z]+:?$
{
	:0 B
	* ^Content-Type: application/pdf;$
    	{ SI="$SI$RS 100 PDF, short Subject and no real name in To" }
}
  
:0 E
* ^To: <?\/[a-z_-][a-z_-][a-z_-][a-z_-]+
* $!$MAILINGLIST
{
	:0
	* $^Subject:.*${MATCH}_report.pdf
	{ SI="$SI$RS 300 PDF with local-part To in Subject (${MATCH}_report.pdf)" }
  
	:0 E
        * ! ^List-Id
        * ! ^Mailing-List
	* $^Subject:.*$MATCH
	{ SI="$SI$RS 30 local-part To ($MATCH) in Subject" }
}

:0
* ^Subject:.*report_.*\.pdf
{ SI="$SI$RS 30 report*.pdf in Subject" }
  
#:0 E
#* ^Subject: Emailing: .*\.\/(pdf|xls|zip)
#{ SI="$SI$RS 200 Emailing-$MATCH in Subject" }
  
:0 D
* ^Subject: Emailing: IMG
{ SI="$SI$RS 100 Emailing IMG" }
  
:0 D
* ^Subject: Re: *$
{ SI="$SI$RS 10 Re: only subject" }

#:0
#* ^Subject: \/[a-z][a-z\.\-]+[a-z][a-z]
#{
#	:0 
#	* $^To: .*$MATCH.*($MYDOMAIN)
#	{ SI="$SI$RS 50 Subject starts with recipient address ($MATCH)" }
#}

## letzte Received-Zeile untersuchen
# :0 
# * !^X-Mailer: Mozilla
# * !^Received: from mail pickup service
# * 1^1 ^Received: from [a-z0-9]+\.[a-z][a-z][a-z]? \(
# {
# 	:0
# 	* ^To: [^ ]*$
# 	* ^From: [^ ]*$
# 	{ 
# 		# :0 BD
# 		# * 1^0 Lese selbst:
# 		# * 1^0 Weiter auf:
# 		# { SI="$SI$RS 200 Sober Nazi-spam" }
# 		
# 		:0 
# 		{ SI="$SI$RS 100 short domain in last received line and no real names" }
# 	}
# 	
# 	:0 E
#     	* ^Received: from [a-z]+\.[a-z][a-z][a-z]? \(\[
#         * !^Received:.*Exim
# 	{ SI="$SI$RS 100 short domain in last received line and no DNS" }
#   
# 	:0 E
# 	{ SI="$SI$RS 10 short domain in last received line" }
# }

:0 
* ^Received.*\/JetMail
{ SI="$SI$RS 30 $MATCH" }

# http://www.apnic.net/db/RIRs.html
:0 
* ! SI ?? CHINANET
* ^Received.*\[(20[23]|21[01])\.
* $!$MAILINGLIST
{ SI="$SI$RS 10 APNIC2" }

# http://www.apnic.net/db/RIRs.html
:0 E
* ! SI ?? CHINANET
* ^Received.*\[61\.
* $!$MAILINGLIST
{ SI="$SI$RS 10 APNIC3" }

# http://www.apnic.net/db/RIRs.html
:0 E
* ! SI ?? CHINANET
* ! SI ?? KORNET
* ^Received.*\[21[89]\.
* $!$MAILINGLIST
{ SI="$SI$RS 10 APNIC4" }

# http://www.apnic.net/db/RIRs.html
:0 E
* ! SI ?? CHINANET
* ^Received.*\[220\.
* $!$MAILINGLIST
{ SI="$SI$RS 10 APNIC6" }

:0 
* ^(From|Received).*secret
{ SI="$SI$RS 30 secret" }

#:0 
#* ^From:.*direct[a-z0-9-]*\.com
#{ SI="$SI$RS 30 direct*.com" }

:0 
* ^(From|Received).*terra\.es
{ SI="$SI$RS 30 terra.es" }

:0 E
* ^(From|Received).*terra\.cl
{ SI="$SI$RS 50 terra.cl" }

:0 E
* ^(From|Received).*terra\.com\.br
{ SI="$SI$RS 50 terra.com.br" }

:0 E
* ^(From|Received).*ig\.com\.br
{ SI="$SI$RS 200 ig.com.br" }

:0 E
* ^Received.*\.tpnet\.pl
{ SI="$SI$RS 50 tpnet.pl" }

:0 E
* ^Received.*\[83\.(0-9|[12].|3[01].)\.
{ SI="$SI$RS 50 telekomunikacja.pl" }
  
:0 E
* ^Received.*\.noos\.fr
{ SI="$SI$RS 30 noos.fr" }

:0 E
* ^Received.*\.adelphia\.net
{ SI="$SI$RS 30 .adelphia.net" }

:0 E
* ^Received.*\.sympatico\.ca
{ SI="$SI$RS 30 sympatico.ca" }

:0 
* ^(From|To|Sender|Organization).*\/(friend|advertise|everyone|marketing|business)
* $!From:.*($STUPIDS)
{ SI="$SI$RS 10 $MATCH" }

:0 
* ^(From|Subject):.*\/WINNING NOTICE
{ SI="$SI$RS 100 $MATCH" }

:0 
* Received.*AppleShare IP Mail Server
{ SI="$SI$RS 30 AppleShare open relay" }

:0 
* ^received.*\[(80\.190|62\.146)\.
{ SI="$SI$RS 50 ip-exchange.de" }

:0 E
* ^Received.*\.demon\.(co\.uk|net)
{ SI="$SI$RS 30 demon" }

#whois -h whois.arin.net 208.227.137.24
#
#   Netname: UUNET1996B
#   Netblock: 208.192.0.0 - 208.255.255.255
#:0 E
#* ^received.*\[208\.(19[2-9]|2..\.)
#{ SI="$SI$RS 30 UUNET1996B" }
#
#:0 E
#* ^received.*\[216\.9[45]\.
#{ SI="$SI$RS 30 UUNETCA6-A" }

# whois -h whois.arin.net 63.120.37.97
# UUNET Technologies, Inc. (NETBLK-UUNET63) UUNET63   63.64.0.0 - 63.127.255.255
#:0 E
#* ^received.*\[63\.(6[4-9]|[789][0-9]|1[01][0-9]|12[0-7])
#{ SI="$SI$RS 30 UUNET63" }

# whois -h whois.arin.net 65.196.202.111
# UUNET Technologies, Inc. (NETBLK-UUNET65) UUNET65  65.192.0.0 - 65.223.255.255
#:0 E
#* ^received.*\[65\.(19[2-9]|2[01][0-9]|22[0-3])\.
#{ SI="$SI$RS 30 UUNET65" }

:0 E
* ^Received.*\[(20[01]\.|166\.114)
* $!$MAILINGLIST
{ SI="$SI$RS 30 LACNIC" }

:0 
* ^Received.*\[196
{ SI="$SI$RS 50 AFRINIC" }

#:0 E
#* ^Received.*\.cn( )
#{ SI="$SI$RS 30 received from *.cn" }

#:0 E
#* ^(From|To|Received):.*\.cn[a-z\-]*\.net
#{ SI="$SI$RS 30 cn*.net" }

#:0 E
#* ^Received.*\.kundenserver.de
#{ SI="$SI$RS 30 received from kundenserver.de" }

:0 E
* ^Received.*\.ispchannel\.com
{ SI="$SI$RS 30 received from ispchannel.com" }

:0 E
* ^Received.*\.is\.net\.tw
{ SI="$SI$RS 30 received from is.net.tw" }


#
## "vielleicht" Spam ohne Mailinglisten
#
:0
* !^X-Spamblock:
* $!$MAILINGLIST
* $!From:.*($STUPIDS)
{
	## Gleiche From und To Adresse bei nicht-lokalem Absender
	:0
	* $!^TO($MYDOMAIN)
	* $!^From:.*$LOGNAME
	* !^Cc
	* ^From:.*@
	* ^To:.*@
	{
		:0 
		* ^From: \/..*
		* $^To:.*$MATCH
		{ SI="$SI$RS 10 from-to" }
	
		:0 E
		* ^To: \/..*
		* $^From:.*$MATCH
		{ SI="$SI$RS 10 from-to" }
	
		:0 E
		* ^From:.*<\/.*
		* $^To:.*$MATCH
		{ SI="$SI$RS 10 from-to" }
	
		:0 E
		* ^To:.*<\/.*
		* $^From:.*$MATCH
		{ SI="$SI$RS 10 from-to" }
	}
	
	# Anmerkung: Operator 1^1 matcht letzte aller moeglichen Zeilen!
	:0
	* !^X-Lotus
	* !Internet Mail Service
	* $ 1^1 Received:.*\/\(\[[0-9\.]+\]\).*by [a-z0-9\.\-]*($MYDOMAIN).*id
	{
		:0 D
		* !MATCH ?? Exim
		* !MATCH ?? Smail
		* !MATCH ?? 127\.0\.0\.1
		* MATCH ?? ..\/[0-9\.]+
		{
			:0
			* 1^0 ^To: [a-z<]
			* 1^0 ^To: "[a-z][^ ]+"
			{ SI="$SI$RS 30 no DNS for $MATCH and no real name in To" }
			
			:0 E
			{ SI="$SI$RS 30 no DNS for $MATCH" }
		}
	}

	:0
	* 1^1 Received: from\/ [a-z0-9\.]*\.[a-z]+[0-9]+[a-z0-9\.]+\.[a-z]+ \[
	{
		:0
		* MATCH ?? .\/[a-z0-9\.]+
		{ SI="$SI$RS 20 number in domain name ($MATCH)" }
	}

	:0 
	* !X-Mailer: SMRmail
	* ^To:\/.*@.*
	* $^Reply-to:$MATCH
	* $!^From:$MATCH
	* $! MATCH ?? $MYDOMAIN
	{ SI="$SI$RS 30 To=Reply-To" }

	:0 
	* ^From: \/.*
	* $^Reply-To: $MATCH
	* $!^TO($MYDOMAIN)
	* !^From.*(support|service)
	{ SI="$SI$RS 10 From=Reply-To" }
	
	:0 
	* ^(To|Cc):.*@
	* $!^From:.*($MYDOMAIN)
	* $!^TO($MYDOMAIN)
	* !^Subject:.*(ticket|complaint)
	* !SI ?? from-to
	{ SI="$SI$RS 20 not for MYDOMAIN" }
	
	:0 E
	* ^(To|Cc): \/recipient list not shown
	{ SI="$SI$RS 30 $MATCH" }
	
	:0 
	* ^Received.*bulkmail
	{ SI="$SI$RS 30 bulkmail" }

	:0 D
	* ^Subject:.*\/NOW!
	{ SI="$SI$RS 30 '$MATCH' in subject" }

	:0 
	* ^Subject:.*\/urgent
	{ SI="$SI$RS 30 '$MATCH' in subject" }

	:0 
	* ^Subject:.*\/Work at HOME
	{ SI="$SI$RS 100 '$MATCH' in subject" }

	:0 
	* ^Subject:.*\/get paid
	{ SI="$SI$RS 30 '$MATCH' in subject" }

	:0 
	* ^Subject:.*\/Be Your Own Boss
	{ SI="$SI$RS 50 '$MATCH' in subject" }

	:0 
	* ^Subject:.*\/invest
	{ SI="$SI$RS 30 '$MATCH' in subject" }

	:0 
	* ^Subject:.*( free|free )
	{ SI="$SI$RS 20 "free" in subject" }

	:0 
	* ^Subject:.*( cable|cable )
	{ SI="$SI$RS 20 "cable" in subject" }

	:0 
	* ^From:.*cash
	{ SI="$SI$RS 30 cash" }

	:0 
	* ^From:.* \(\)$
	{ SI="$SI$RS 30 From ()" }

	:0 
	* ^From:.*[0-9][0-9]@
	{ SI="$SI$RS 10 From [0-9][0-9]@" }

	:0 
	* ^Reply-To:.*[0-9][0-9]@
	{ SI="$SI$RS 10 Reply-To [0-9][0-9]@" }

	:0 
	* ^From:.*china
	{ SI="$SI$RS 30 china" }

	:0 
	* ^From:.*rechtsabteilung
	{ SI="$SI$RS 30 rechtsabteilung" }

	:0 E
	* ^Received.*mediaone\.net
	{ SI="$SI$RS 30 mediaone.net" }

#	:0 E
#	* ^Message-Id:.*@.*\.
#	* !^Message-Id:.*@.*\/[0-9a-z\-]+\.([a-z][a-z]|com|org|edu|mil|net|gov|int|info)>
#	* !^Message-Id:.*@\[?[0-9\.]+\]?>
#	* $!^TO($MYDOMAIN)
#	{ SI="$SI$RS 30 bad Message-ID and not for MYDOMAIN" }

	#:0 
	#* may be forged
	#{ SI="$SI$RS 30 may be forged" }

	#:0 
	#* Received.*unverified
	#{ SI="$SI$RS 30 may be unverified-Received" }

	#:0 E
	#* ^Subject: Re:
	#* !^In-Reply-To
	#* !^References
	#* !^X-Mailer:.*(AK-Mail|Internet Mail Service)
	#{ SI="$SI$RS 30 "Re:" but no In-Reply-To or References" }

	:0 
	* ^Received.*InterScan
	{ SI="$SI$RS 30 InterScan" }

	#:0 
	#* ^Received.* spam
	#{ SI="$SI$RS 30 " spam"" }

	:0 
	* ^Received.*\(dns.*\.jp .
	{ SI="$SI$RS 30 dns*.jp relay?" }

	:0 
	* ^Received:.*\.jp( )
	* !^From:.*\.jp
	{ SI="$SI$RS 10 .jp relay" }

	:0 E
	* ^Received.*\.sg( )
	* !^From:.*\.sg
	{ SI="$SI$RS 30 .sg relay" }

	:0 E
	* ^Received.*\.es( )
	* !^From:.*\.es
	{ SI="$SI$RS 30 .es relay" }

	:0 E
	* ^Received.*\.pt( )
	* !^From:.*\.pt
	{ SI="$SI$RS 30 .pt relay" }

	:0 E
	* ^Received.*\.kr( )
	* !^From:.*\.kr
	{ SI="$SI$RS 30 .kr relay" }

	:0 E
	* ^Received.*\.tw( )
	* !^From:.*\.tw
	{ SI="$SI$RS 30 .tw relay" }

	:0 E
	* ^Received.*\.jo( )
	* !^From:.*\.jo
	{ SI="$SI$RS 30 .jo relay" }
}


:0
* ^Content-Transfer-Encoding: base64
* !^Content-Type:.*html                                                                                                                                                 
* !^X-MS
* < 999999
{ SI="$SI$RS 10 base64 body" }


:0 
* !ASIANCHARSET ?? ok
* (charset=.*|=\?)(big5|gb.?2312|euc-kr|ks_c|ISO-2022-JP|windows-874)
{ SI="$SI$RS 100 asian charset" }

:0 E
* SI ?? .
* !ASIANCHARSET ?? ok
* < 999999
{
	:0 B
	* charset=.*(big5|gb.?2312|euc-kr|ks_c|ISO-2022-JP|windows-874)
	{ SI="$SI$RS 100 asian charset declaration in body" }
	
	# mehr als 2 Zeilen Binaerschrott ?
	# (ACHTUNG: Unten stehen Control-A, nicht ^A !)
	:0 EB
	* -2^0
	* 1^1 ()\/[^
-~ ·][^
-~ ·][^
-~ ·][^
-~ ·][^
-~ ·][^
-~ ·]
	{ SI="$SI$RS 50 binary body ($MATCH)" }

	:0 EDB
	* -2^0
	* 1^1 ()=[A-F][0-9A-F]=[A-F][0-9A-F]=[A-F][0-9A-F].=[A-F][0-9A-F]=[A-F][0-9A-F]=[A-F][0-9A-F]
	{ SI="$SI$RS 50 quoted-printable binary body" }
	
}

:0
* SI ?? .
* < 999999
{
	:0 B
	* charset=.*koi8-r
	{ SI="$SI$RS 100 charset koi8-r in body" }
}
  
## downscore
:0
* SI ?? .
* ^X-FEX
{ SI="$SI$RS -200 X-FEX" }

#VERBOSE=on
:0 
* $ ^From:.*\/($STUPIDS)
{ SI="$SI$RS -100 From STUPIDS ($MATCH)" }
#VERBOSE=off

:0
* ^From:.*sourceforge
{ SI="$SI$RS -100 sourceforge" }
  
## Idiotenmailer und Dummbatz-Webmailer
# :0
# * SI ?? .
# * !SI ?? !
# {
#	:0
#	* $^Received: from web[0-9]+\.mail\.yahoo\.com.*($MYDOMAIN)
#	{ SI="$SI$RS -100 stupid Yahoo webmail" }
# }

## trotzdem durchlassen?
:0
* SI ?? .
* !SI ?? !
* !^Content-Transfer-Encoding: base64
{
	:0 Df
	* ^From:.*\/Cron Daemon
	| formail -A "X-Spamblock: ignored by rule $MATCH"
	
	:0 EDf
	* ^\/RT-Ticket
	| formail -A "X-Spamblock: ignored by rule $MATCH"
	
	# abuse-Meldungen immer durchlassen
	:0 EDf
	* ^From:.*@.*spamcop\.net
	* ^Subject: \[SpamCop
	| formail -A 'X-Spamblock: ignored by rule spamcop.net'

	# abuse-reply durchlassen
	:0 Ef
	* !SI ?? direct
	* !SI ?? dialup
	* !SI ?? \!
	* !^Content-Type: text/html
	* $^To:.*($MYDOMAIN|$LOGNAME)
	* ^(Subject:.*(Re:|reply|abuse|complaint|ticket)|In-Reply-To:)
	* 1^0 ^From:.*(abuse.*|anti-?spam|postmaster|support|autoreply|policy|report_spam)@
	* 1^0 ^From:.*Customer Support
	* 1^0 ^From:.*@support
	* 1^0 ^From:.*spamcop\.net
	* 1^0 env-from .sysop@uswest
	| formail -A 'X-Spamblock: ignored by rule abuse/support-reply'

	# Abuse-Deppen
	:0 Ef
	* ^From: abuse@wanadoo\.fr
	| formail -A 'X-Spamblock: ignored by rule stupid abuse-reply'
	
	:0 Ef
	* ^X-Mailer: Fbm Communication Server
	| formail -A 'X-Spamblock: ignored by rule web.de staff MTA'
	
	# Mails an den Admin (fast) immer durchlassen
	:0 Ef
	* !SI ?? direct
	* !SI ?? dialup
	* !^To: "?(Abuse|Postmaster)"? .
	* !^X-AntiAbuse
	* $^((Resent-)?To|Cc).*((postmaster|abuse)@.*($MYDOMAIN)|($MYDOMAIN)@abuse.net)
	| formail -A 'X-Spamblock: ignored by rule abuse/postmaster'

	# echte replies durchlassen
	#:0 Ef
	#* ^Subject: Re:
	#* $^(In-Reply-To|References):.*<[a-z0-9].*@.*($MYDOMAIN)
	#| formail -A 'X-Spamblock: ignored by rule reply'
	
	:0 Ef
	* ^Subject: Re:.*complaint
	| formail -A 'X-Spamblock: ignored by rule complaint-reply'
	
	:0 Ef
	* ^X-Mailer: AutoReply
	| formail -A 'X-Spamblock: ignored by rule AutoReply'
	
	#:0 Ef
	#* $^Received.*($STUPIDS)
	#| formail -A 'X-Spamblock: ignored by rule STUPIDS'

	# abuse reply von den Doofen, die keine vernuenftigen Header hinkriegen
	# Muss aber realname mit space enthalten!
	:0 E
	* $^To: .* .* .*($MYDOMAIN)
	* ^Subject:.*:
	* !^Content-Type: (multipart|.*html)
	{
		:0 B
		* --- ?(Original|forwarded) Message
		{ SI="$SI$RS -100 maybe reply or forward" }
	}
}

:0 Df
* ^Subject: F\*EX
| formail -A "X-Spamblock: ignored by rule F*EX"

# leere Mails wegwerfen
:0
* ^From foo@bar
* !^TO
* !^Subject:
/dev/null

# VERBOSE=off
:0 
* SI ?? .
* ! SI ?? \!
* !^Content-Type.*(html|binary)
* !^List.*groups\.google\.com
* $ ()\/$MAILINGLIST
{ SI="$SI$RS -100 mailinglist extra check ($MATCH)" }
# VERBOSE=off

:0 
* SI ?? .
* ^Resent-From:
* ^Resent-To:
{ SI="$SI$RS -200 bounce extra check" }

:0 
* $^From:.*($MYDOMAIN)
* $^To:.*($MYDOMAIN)
* $^Message-Id:.*($MYDOMAIN)
* $1^1 ^Received:\/.*
* !SI ?? dialup
{ 
	:0
	* $MATCH ?? by [a-z0-9\.\-]*($MYDOMAIN)
	{ SI="$SI$RS -200 probably internal" }
}

:0 E
* SI ?? .
* !SI ?? !
* !SI ?? dialup
{
	:0
	* $^To:.*($MYDOMAIN)
	{ SI="$SI$RS -20 to MYDOMAIN" }
  
	:0
	* $^From:.*($MYDOMAIN)
	* $^Message-Id:.*($MYDOMAIN)
	{ SI="$SI$RS -50 from MYDOMAIN" }
}


# Wenn Spamanzeichen gefunden, dann weiter mit Perl
:0 fw
* SI ?? .
| perl -wx $SPAMBLOCK_SCRIPT

# im Testmodus nach STDOUT pipen
:0 D
* 1^0 SPAMBLOCK ?? TEST
* 1^0 SPAMBLOCKTEST ?? .
{
	:0
	|
	
	:0
	/dev/null
}

#
## und jetzt alles was als Muell gekennzeichnet worden ist aufsammeln
#

# hau wech die Scheisse!
# (Bei SPAMBLOCK="-" wird nichts weiter gemacht)
:0
* ^X-Spamblock: caught
* !^X-Spamblock: ignore
* !SPAMBLOCK ?? ^-$
$SPAMBLOCK

# einzelne "X-Spamblock: ignored" Zeile entfernen
:0 fw
* !^X-Spamblock: caught
* ^X-Spamblock: ignored
| formail -I X-Spamblock:


# Ende von procmail
SWITCHRC=
# ab hier beginnt der Perl-Teil
}

#!perl

# @M=<>; @M=(); foreach $v (keys %ENV) { print "$v = $ENV{$v}\n" }

BEGIN { $Xdomain = '' }
# BEGIN {
## wird nicht mehr verwendet, da zu unsicher
#   eval "use DB_File" if ($ENV{URIBLACKLIST}||'') eq 'ok';
#   if ($DB_HASH) {
#     $uridb = $ENV{HOME}.'/.spamblock_URI.db';
#     $Xdomain = join '|',map {quotemeta} (@_=qw(
# 	  w3.org w3c.org 
# 	  altavista.com hotmail.com macromedia.com yahoo.com
# 	  paypal.com ebay.de ebay.com ebaystatic.com
# 	  msn.com microsoft.com aol.com akamai.net apple.com ibm.com
# 	  adobe.com bbc.co.uk cnn.com target.com usatoday.com
#           xing.com gulp.de
# 	  unwire.org geocities.com imageshack.us
#           codehaus.org
#           ripe.net
# 	  google.com google.de amazon.com amazon.de
# 	  t-online.de telekom.de gmx.de gmx.net web.de
#           spamcop.net
# 	  spiegel.de zdf.de heise.de
# 	  aldi-sued.de aldi-nord.de
#     ));
#     $Xdomain .= '|uni-[a-z]+\.de';
#   }
# }
use Fcntl qw(:DEFAULT :flock);
use Getopt::Std;
  
$opt_I = $opt_X = $opt_D = $opt_n = $opt_v = $opt_M = $opt_w = 0;
getopts('IXDMnvw');

$wldb = $ENV{HOME}."/.spamblock_wl.db";
if (-f $wldb) {
  eval "use DB_File";
  tie %WL,'DB_File',$wldb,O_RDONLY,0644,$DB_HASH;
} else {
  %WL = ();
}
  
if ($opt_X) {
  # &exclude_URIdb; 
  exit;
}

if ($opt_M) {
  &mimedecode;
  exit;
}

if ($opt_D) {
  # &dump_URIdb; 
  foreach $a (keys %WL) { print "$a\n" }
  exit;
}

if ($opt_w) {
  my $a;
  $opt_w = shift || '';
  eval "use DB_File" unless $DB_HASH;
  tie %WL,'DB_File',$wldb,O_RDWR|O_CREAT,0644,$DB_HASH;
  if ($opt_w eq 'show') {
    foreach $a (keys %WL) {
      print "$a\n";
    }
  } elsif ($opt_w eq 'add' and $a = shift) {
    $a = lc $a;
    $WL{$a} = $a;
  } elsif ($opt_w eq 'extract') {
    while (<>) {
      if (/^(To|Cc|):.*\@/i) {
        $_ = lc $_;
        if (s/([\w_.+-]+\@[\w.-]+)//) {
          $WL{$1} = $1;
        }
      }
    }
  } elsif ($opt_w eq 'delete' and $a = shift) {
    $a = lc $a;
    delete $WL{$a};
  } elsif ($opt_w eq 'proxy') {
    print &sendmail_wldb;
  } else {
    print "usage: perl -x $0 -w show\n",
          "usage: perl -x $0 -w add address\n",
          "usage: perl -x $0 -w extract [mailbox]\n",
	'attached quot' => 30,
          "usage: perl -x $0 -w delete address\n";
  }
  exit;
}

if ($opt_I) {
  if ($DB_HASH) {
    # &init_URIdb; 
    exit;
  } else {
    die "$0: no DB_File available\n";
  }
}

&init;
# if ($ENV{SBT}) { die "[$body]" }

&end if not $FULLCHECK and $sis >= $SPAMLEVEL;
&end if length($body_complete) > 10**7 and grep /$MYDOMAIN/i,@{$H{'To'}};
&end if grep /MAILER-DAEMON\@/,@{$H{'From'}};
&end unless @{$H{'Received'}};
# &end if grep /ignored/,@{$H{'X-Spamblock'}};

if ($body_complete =~ /^\s*$/i) {
    unless (grep /($ENV{LISTROBOT}|confirm)/,@{$H{'To'}}) {
      add(50,"empty body");
    }
    &end;
}

# echtes Reply?
if (grep /^Re: /i,@{$H{'Subject'}}) {
  if (grep /$MYDOMAIN/i,(@{$H{'References'}},@{$H{'In-Reply-To'}}) and
      grep /.* .* </,@{$H{'To'}}) {
    add(-100,"reply with MYDOMAIN-reference and real name")
#  } elsif (!(@{$H{'Thread-Index'}} or
#    	     @{$H{'References'}} or
#             grep /HTTP/,@{$H{'Received'}} or
#             grep /aol\.com/,@{$H{'From'}} or
#             grep /\n>/,$body or
#             grep /Content-Transfer-Encoding: base64/,$body or
#             grep /(Original|forwarded) Message/i,$body)
#            ) {
#    add(10,"Re: in Subject but no quoted text");
  } elsif ($si !~ /maybe reply/ and $si !~ /HTML/ and
           grep /.+ .+ .+$MYDOMAIN/i,@{$H{'To'}}) {
    add(-10,"maybe reply")
  }
}

# doofe Firmenmails
if (grep /$MYDOMAIN/i,@{$H{'To'}} and (
    $body =~ /proprietary information/ or $body =~ /may ?be confidential/)) {
  add(-50,"stupid company disclaimer");
}

if ($body_complete =~ /\n(Content-.*|\s+)(file)?name=\"From /) {
  add(100,"Content filename From");
}
  
if ($body_complete =~ /\n(Content-Type: application\/java-archive)/) {
  add(200,"Content java-archive");
}
  
if ($body_complete =~ /\n(Content-.*|\s+)(file)?name=\".*Rechnung.*\.zip\"/) {
  add(100,"Rechnung.zip");
}

if ($body_complete =~ /\n(Content-.*|\s+)(file)?name=\".*\.cab\"/) {
  add(100,"name=*.cab");
}
 
if ($body_complete =~ /\n(Content-.*|\s+)(file)?name=\".*\.rar\"/) {
  add(100,"name=*.rar");
}
 
if ($body_complete =~ /\n(Content-.*|\s+)(file)?name=\".*\.tbz\"/) {
  add(100,"name=*.tbz");
}
 
if ($body_complete =~ /\n(Content-.*|\s+)(file)?name=\".*\.shtml\"/) {
  add(100,"name=*.shtml");
}

if ($body_complete =~ /\n(Content-.*|\s+)(file)?name=\".*\.iso\"/) {
  add(100,".iso attachment");
}

if ($body_complete =~ /filename\*(..)?=\"?utf-8''/i) {
  add(20,"filename*=UTF-8");
}

#	'name="(Photo|Picture).jpg"' => 100,
#	'name=".*pdf\.htm' => 100,
#        'filename="photo.*\.zip"' => 30,


foreach my $r (qw'google.com') {
  if (grep /$r/,@{$H{'Received'}}) {
    if (length($body) < 256 and $body_complete =~ /^http/) {
      add(200,"short mail from $r with URL");
    }
  }
}

if ($body_complete =~ /\n(Content-Type:.*|\t)name=".*\.pdf"\n/) {
  if (grep /report/i,@{$H{'Subject'}}) {
    add(30,"report PDF attachment");
  } elsif (etp() and length($body_complete) < 99999) {
    if (grep /[a-z] [a-z]/i,@{$H{'To'}}) {
      add(100,"PDF with empty text MIME part");
    } else {
      add(200,"PDF with empty text MIME part and no real name");
    }
  } elsif (grep /$MYDOMAIN/i,@{$H{'To'}} and $si !~ /(dialup|PDF)/) {
    add(-100,"PDF attachment");
  }
}

# whitelist DB
if (%WL) {
  foreach my $a (keys %WL) {
    if (grep /\Q$a/i,@{$H{'From'}}) {
      $header .= "X-Spamblock: ignored by rule WLDB ($a)\n";
    }
  }
}

$sig = '';

if ($body =~ /\n-- \n(.+)/s) {
  $sig = $1;
  if ($sig =~ /^([a-z]* ?[a-z]{40,})/) {
    my (%c,$c);
    foreach $c (split(//,$1)) {
      $c{$c}++;
    }
    if (scalar(keys %c) > 9) {
      add(200,"signature begins with long dummy character string");
      $sig = 'bad';
    }
  }
}

if ($sig ne 'bad' and $body =~ /\n(> *)?-- \n(.+)/s) {
  $sig = $2;
#warn $sig;
#warn ($sig =~ tr/\n//);
#warn ($sig =~ tr/ //);
  if (($sig =~ tr/\n//) <10 and ($sig =~ tr/ //) >3) {
    add(-100,"body contains signature with correct separator");
  }
}

##if ($header =~ /\n((Received:|[ \t]).*\n)+(.+\n)+Received:/) {
#if ($header =~ /\nReceived:.*\n[A-QS-Z].*\nReceived:/s) {
#  add(30,"Received out of order");
#}

#if ($header !~ /HTTP/ and $header =~ /\nMessage-Id:.*\nReceived:/is) {
#  add(30,"Received after Message-Id");
#}

while ($header =~ /\n(X-[a-z]{8,}: [a-z]{7,})\n/g) {
  add(30,"X-nonsense ($1)");
}

# letzte received line
$LR = $H{'Received'}->[-1];

# letzte verlaessliche received line
$ltr = "\n";
foreach (@{$H{'Received'}}) {
  $ltr = $_;
  last if $ltr =~ /\sby [\w\.\-]+$MYDOMAIN/i and
          $ltr !~ /^from [\w\.\-]+ \([\w\.\-]+$MYDOMAIN/i;
}

if (@{$H{'Message-Id'}}) {
  
  if ($si !~ /local MID/ and @{$H{'From'}} and
    $H{'From'}->[0] !~ /$MYDOMAIN/i and
    $H{'Message-Id'}->[0] =~ /$MYDOMAIN/i) 
  {
    if ($ltr =~ /^from [\w\.\-]+ \(([\w\.\-]+)/i) {
      my $x = $1;
      add(20,"received from $x but local MID") if $x !~ /$MYDOMAIN|localhost/i;
    } elsif ($ltr =~ /^from ([\w\.\-]+\.[a-z]+) \(/i) {
      my $x = $1;
      add(50,"received from $x (SMTP HELO) but local MID") if $x !~ /$MYDOMAIN|localhost/i;
    }  
  }  

  # if ($ltr =~ /^from ([a-z0-9\-\.]*\.$MYDOMAIN) \(\[[\d\.]+\]\)/i) {
  #   add(30,"received from $1 but no DNS");
  # }

  # faked local MID
  if ($H{'Message-Id'}->[0] =~ /$MYDOMAIN/) {
  #  if ($ltr !~ /^from [a-z0-9\-\.]*\.$MYDOMAIN/) {
  #    if ($ltr =~ /^from (\S+)/) {
  #      add(200,"received from $1 but local MID");
  #    }
  #  }
    if (grep /from.*\bunknown /,@{$H{'Received'}} and 
      not grep /directly.*unknown/,$ENV{SI}) 
    {
      add(30,"received from unknown with local MID");
    }
  }

}

if ($H{'From'}->[0] =~ /"(.*@.*)"/ and $H{'To'}->[0] =~ /\Q<$1>/) {
  add(10,"Realname From == <To>");
}
  
# SMTP HELO fakes?
test_HELO($ltr) || test_HELO($LR);

if ($ltr =~ /^from [\w\.\-]*$MYDOMAIN/ and 
    $ltr =~ / \(([\w\.\-]+\.[a-z]+) \[[\d\.]+\]\)/i) {
  my $h = $1;
  if ($h !~ /$MYDOMAIN/i and not grep /$MYDOMAIN/,@{$H{'From'}}) {
    add(200,"$1 fakes our domain in SMTP HELO") 
  }
} elsif ($ltr =~ /^from (\d+.\d+.\d+.\d+) \(\[([\d\.]+)\]\)\s+by\s([\w\.\-]*$MYDOMAIN)/i) {
  my $n1 = $1;
  my $n2 = $2;
  my $m = $3;
  if ($n1 ne $n2 and grep /$m\s\[$n1\]/,@{$H{'Received'}}) {
    add(200,"$n2 fakes our IP ($n1) in SMTP HELO");
  }
}

# if ($ltr =~ /from ([a-z]+) \(\[[\d\.]+\]\)/) {
#   add(50,"no domain in SMTP HELO and no DNS for $1");
# }

if (grep { /(\w{20,})@/ and $llp = $1 } @{$H{'From'}}
    and not grep /$llp@/,@{$H{'Reply-To'}}) { 
  add(10,"too long localpart in From ($llp)");
}

# bei forward body nicht weiter untersuchen
&end if grep /$MYDOMAIN/i,(@{$H{'To'}},@{$H{'Cc'}}) and
	$body =~ /^Received:/ and $body =~ /^From:/ and 
        $body =~ /^Subject:/ and $body =~ /^Date:/;

if (grep /multipart.alternative/i,@{$H{'Content-Type'}}) {
  if ($body_complete !~ /\nContent-Type:$M+text\/plain/i) {
    add(10,"multipart/alternative but no text/plain");
  } elsif (etp() and not grep(/($ENV{LISTROBOT}|confirm)/,@{$H{'To'}})) {
    add(10,"multipart/alternative with empty text/plain");
  }    
} elsif ($si !~ /empty text/
         and grep /multipart.mixed/i,@{$H{'Content-Type'}} 
         and not grep /Fwd/,@{$H{'Subject'}} 
         and etp()) {
  add(50,"multipart/mixed with empty text/plain");
} elsif (grep /text.plain/i,@{$H{'Content-Type'}}) {
  if ($body =~ /[a-z]![a-z].*[a-z]![a-z].*[a-z]![a-z]/si) {
    add(50,"multiple exclamation marks in text");
  }
  if ($body =~ / [a-z]+[0-9][a-z]+ .*[a-z]+[0-9][a-z]+ .*[a-z]+[0-9][a-z]/i) {
    add(50,"numbers inside words in text");
  }
#  if ($body =~ /([a-z])\1\1.* [a-z]*([a-z])\2\2.* [a-z]*([a-z])\3\3/i) {
#    add(50,"too many multiple characters in text");
#  }
  if ($body =~ m{http://}) {
    my $t = 0;
    $t++ while ($body =~ /\n.*\w/g);
    if ($t<4) {
      if ($body =~ m{http://[\w.-]+\.(pl|tr|ru|cz|cn|kr)/}) {
        add(100,"URL from spammer friendly country and less than 4 text lines");
      } elsif ($body =~ m{\nhttp://}) {
        add(50,"URL at BOL and less than 4 text lines ($t)");
#        if (grep / /,@{$H{'To'}}) {
#          add(50,"URL at BOL and less than 4 text lines");
#        } else {
#          add(200,"URL at BOL and less than 4 text lines and no real name in To");
#        }
      }
    }
  }
  if ($body =~ /\n{9}/) {
    add(30,"too many empty lines");
  }
  if ($body !~ /[a-z]/) {
    add(30,"no lowercase chars in body");
  }
} elsif (grep /multipart/i,@{$H{'Content-Type'}} 
         and not grep /JavaMail/,@{$H{'Content-Type'}}) {
  if ($body_complete !~ /\nContent-Type:.*\nContent-Type:/si) {
    add(30,"multipart with only one part");
  }
  if ($body_complete =~ /\nContent-Type:.*text\/plain.*\n(\s+.*\n)*Content-Transfer-Encoding: base64/i) {
    add(10,"base64 text/plain attachment");
  }
}

unless (grep /$ENV{STUPIDS}/i,@{$H{'From'}} or ($ENV{'HTML'}||'') eq 'ok' or
        $header =~ /From:.*utf-8\?B\?/ and $header =~ /To:.*utf-8\?B\?/) {
#  if (grep /html/i,@{$H{'Content-Type'}} and
#      grep /base64/i,@{$H{'Content-Transfer-Encoding'}} or
#      grep /multipart/i,@{$H{'Content-Type'}} and
#      $body_complete =~ /\nContent-Type:.*html.*\n(\s+.*\n)*Content-Transfer-Encoding: base64/i) {
#    add(20,"base64 HTML body");
#  }

  if ($si =~ /HTML/) {
    if ($body =~ /(http:.*\.(gif|jpg))/ and 
        !(grep /HTTP/,@{$H{'Received'}})) {
      add(30,"HTTP-HTML inline picture ($1)");
    }
#    if ($body !~ /<html/i) {
#      add(30,"HTML-Mail without <html> tag");
#    }
    if ($body =~ /[a-z](<\/?[BCDFGHJKLMNPQRSTVWXYZ]{5}>)[a-z]/) {
      add(80,"pseudo HTML tag with 5 consonants $1");
    }
    if ($body =~ /[a-z](<\w{10,}>)[a-z]/i) {
      add(80,"pseudo HTML tag $1");
    }
    if ($body =~ /[a-z]<(\w+)>[a-z]/i) {
      my $m = $1;
      add(80,"pseudo HTML tag with number <$m>") if $m =~ /[a-z]/i and $m =~ /\d/;
    }
    if ($body =~ /[a-z]<!--.*-->[a-z].*[a-z]<!--.*-->[a-z]/i) {
      add(80,"HTML comments stegano");
    }
    if ($body =~ /[a-z]<![a-z ]+>([a-z]|\n)/i) {
      add(80,"pseudo HTML comment");
    }
    if ($body =~ /<!\w.*<!\w.*<!\w.*/) {
      add(80,"pseudo HTML ! comment");
    }
    if ($body =~ /(<!--\w+--><\w.*>){3}/i) {
      add(30,"random HTML comment");
    }
    if ($body =~ /<!--(\w{12,})-->/i and lcucnum($1)) {
      add(30,"junk HTML comment");
    }
    if ($body =~ /<\/html>\n?[a-z]+/i) {
      add(80,"text after </html>");
    }
    if ($body =~ m:\w(<a href=[^<]+></a>)\w:i) {
      add(200,"bogus link $1");
    }
    if ($body =~ /<BR><BR><BR><BR><BR><BR><BR><BR>/) {
      add(100,"multiple <BR> tags");
    }
    if ($body =~ /http:/ and $body_complete !~ /(\n.*){9}/) {
      add(30,"HTML body with less than 9 lines");
    }
    if ($body =~ /((&\#\d\d\d?;){9})/) {
      add(50,"too many HTML entities ($1)");
    }
#    if ($body !~ /Content-Transfer-Encoding: quoted-printable/ and
#        $body =~ /\b([BCDFGHJKLMNPQRSTVWXYZ]{7,})\b/i) {
#      my $m = $1;
#      add(30,"pseudo word with more than 6 consonants ($m)")
#        if $m =~ /[a-z]/;
#    }
  }
}

if (not grep /base64/i,@{$H{'Content-Transfer-Encoding'}}
    and $body =~ /^\s*(\w{30,})\n/ and lcucnum($1)) {
  add(100,"first line in body is garbage");
}

if ($body =~ /^Content-Type:/) {
  add(200,"body starts with Content-Type:");
}

if ($body =~ /\n(\w{30,})\n*$/ and lcucnum($1)) {
  add(100,"last line in body is garbage");
}

if (length($body) > 999 and $body =~ /[\201-\377]/ and $body !~ /[a-z]{5}/) {
  add(100,"body contains no ASCII-word");
}

# Beginning of mail
%R = (
	'Ich bin die ' => 50,
	'(Lieber|Hallo) Freund' => 40,
	'Attn Sir' => 40,
	'Attn?:' => 40,
	'Want a ' => 40,
	'Would you like' => 40,
	'Hi!' => 40,
	'Hi this is ' => 40,
	'Good [Dd]ay[,:!]' => 40,
	'YO [Ss]ir' => 200,
	'[A-Z][a-z][a-z], [0-9][0-9] [A-Z][a-z][a-z] 200[5-9] [0-9:]+ -[0-9]+' => 100,
);

while (($r,$n) = each %R) {
  if ($body =~ /^\n*($r)/s) {
    my $x = $1;
    if ($r =~ /\Q$x/i) {
      add($n,"'$x' at beginning of body");
    } else {
      add($n,"'$x' ($r) at beginning of body");
    }
  }
}


# case sensitiv : regexp starts with "|"
%R = (
#  	'charset="gb2312"' => 30,
  	'|charset=GBK' => 100,
  	'{email}' => 100,
	'get a capable html e-mailer' => 100,
	'seu cliente de email' => 300,
#	'[a-z]+\.[a-z]+ [a-z]+\.[a-z]+ [a-z]+\.[a-z]+' => 30,
#  	'([a-z][\'`]){4,}[a-z]' => 50,
	'<script' => 30,
	'|R E M O V E' => 100,
	'|^Ref: \w+$' => 30,
	'|MC_PREVIEW_TEXT' => 100,
	'|\bEOI\b' => 30,
	'|BestSign' => 100,
	'|^Aufrichtig[.,]?$' => 100,
	'docusign' => 100,
	'|Handelsregister' => 10,
	'|Kontaktaufnahme' => 10,
	'|Unternehmensdaten' => 50,
	'| ROI ' => 30,
	'si vous ne souhaitez plus' => 100,
	'you must complete (our|this)' => 60,
	'you must update your' => 60,
	'we are sorry for any inconvenience' => 20,
	'Date of Birth' => 30,
	'|Passwor[dt]:' => 10,
#	'Your MRTG process' => 100,
#	'You have been pre-approved' => 100,
#	'You have therefore been approved' => 100,
	'|CONGRATULATION' => 10,
	'\bgeile?\b' => 10,
	'video' => 0,
	'Erotik' => 20,
	'ficken' => 30,
	'fickgeil' => 100,
	'gefikkt' => 30,
	'cumshot' => 60,
	'brunette' => 30,
	'callgirl' => 100,
	'(make|satisfy) their desire' => 100,
	'Hobbynutte' => 300,
	'\bteen\b' => 10,
	'\bSlut\b' => 30,
	'\bSEX\b' => 10,
#       '\bS[\W_]E[\W_]X\b' => 100,
  	'\bgirls\b' => 10,
	'\bCASH\b' => 20,
	'\bnaked\b' => 30,
	'\bpenetration\b' => 30,
	'your cock\b' => 100,
	'hottest' => 30,
	'|BREAKING NEWS' => 30,
	'H0T NEWS' => 30,
	'simply click' => 10,
	'Click Below' => 10,
	'|CLICK HERE' => 20,
	'KLICK HIER' => 20,
	'klicken SIe hier' => 10,
	'CLIQUEZ ICI' => 60,
	'clisk here' => 200,
	'klikken' => 30,
	'\bhaga clic' => 100,
	'(a|the) secure link' => 50,
	'sicheren link' => 50,
	'follow this link' => 10,
	'Click The Link' => 10,
	'>Your link!<' => 200,
	'use this link to' => 20,
	'visit th(e|is) (site|link)' => 30,
	'visit our website' => 30,
	'visited your website' => 30,
	'investimento' => 100,
	'pagamento' => 100,
	'Return On Investment' => 100,
	'interested in investing' => 100,
	'investissement' => 100,
	'investitionen' => 10,
	'like to invest' => 30,
	'Investor' => 20,
	'INVESTMENT' => 20,
	'investment (capital|partner|consultant)' => 100,
	'investieren sie' => 50,
	'INVESTIR' => 60,
	'OPPORTUNITY' => 10,
	'OPORTUNIDAD' => 40,
	'oferta de' => 30,
	'via whatsapp' => 30,
	'Email.?Campaign' => 60,
	'records.*email' => 30,
	'(private|business) e-?mail' => 10,
	'privet email' => 300,
	'is your email' => 10,
	'letzte e-mail erhalten' => 30,
	'your email address' => 10,
	'contact me on this.*?mail' => 30,
	'nliche e-?mail' => 30,
	'through (my|this) email' => 30,
	'my alternative email' => 20,
	'prompt response' => 30,
	'respond promptly' => 30,
	'mail: responder' => 100,
	'your details were' => 10,
	'(respond|reply).*? for more details' => 30,
	'weitere (informationen|details)' => 10,
	'waiting for your response' => 30,
	'positive response' => 30,
	'awaits your response' => 30,
	'await your swift' => 30,
	'swift response' => 30,
	'your quick response' => 30,
	'respond ONLY to the email' => 40,
	'offer is only valid' => 30,
	'offers you' => 30,
	'vous offrir' => 60,
	'microsoft outlook team' => 100,
	'mail.kontingent' => 30,
	'|Wir migrieren alle E-Mail' => 100,
	'validieren sie' => 30,
	'erneut validieren' => 100,
	'validieren Ihre mailbox' => 100,
	'outlook.*validieren' => 100,
	'mailbox memory is.*full' => 100,
	'ihre e-mail-adresse' => 30,
	'ihre e-mail-konto' => 100,
	'mailbox.*active' => 10,
	'mailbox.*active' => 10,
	'kontostatus' => 30,
	'zugriff auf ihr konto' => 30,
	'zugriff.*eingeschr' => 50,
	'sicherheit.*konto' => 30,
	'kontosicherheit' => 10,
	're-validate' => 30,
	'validate your' => 30,
	'OFFERING YOU' => 30,
	'karriere' => 10,
	'teilzeit-' => 10,
	'employment:' => 10,
	'salary:' => 30,
	'PART TIME JOB' => 100,
	'JOB OFFER' => 40,
	'incredible *offer' => 100,
	'request.*your.* (catalog|product)' => 30,
	'request for quotation' => 30,
	'requested information' => 10,
	'submit.*?quotation' => 30,
	'for quotes' => 30,
	'get a quote' => 30,
	'send a quote' => 30,
	'attached quot' => 30,
	'quote.*product' => 30,
	'purchase your product' => 100,
	'procurement' => 30,
	'you have unread messages.*from' => 30,
	'you have .* unreceived emails' => 50,
	'you have requested' => 30,
	'big news.*expected' => 30,
	'ABC News' => 20,
	'joint venture' => 30,
	'vendor registration' => 100,
	'falun.gong' => 100,
	'greencard' => 50,
	'percent off' => 30,
	'ink.*cartridge' => 20,
	'\$\d+(\.\d\d)? Windows' => 20,
	'\$\d+(\.\d\d)? Microsoft' => 20,
	'\$\d+(\.\d\d)? Adobe' => 20,
	'\$\d+(\.\d\d)? Macromedia' => 20,
	'Microsoft Gold' => 20,
	'\n\$ *\d+\.\d+\n' => 50,
#	'\n(Microsoft|Windows|[a-z ]+Office).* [\$\d]+\.?\d+\n' => 40,
	'\n(Adobe|Borland|Macromedia|PageMaker|Dreamweaver).* [\$\d\.]+\n' => 40,
	'for as little as' => 100,
#	'"Lowest_' => 100,
#	'low.*?rates' => 100,
	'Rates as low as' => 100,
	'(very low|lowest) rate' => 50,
	'(LOW(EST|ER)?|CURRENT|BOTTOM|competitive).(RATES|PRICE)' => 20,
	'(Opening|Our|Last|Projected) Price' => 100,
        'competitive pricing' => 100,
	'Current:\s+\$[\d.]+' => 60,
	'Currently priced at:' => 100,
	'Opening Price:' => 100,
	'\nPrice:' => 60,
	'\d.day price:' => 100,
	'SPECIAL PRICE' => 100,
	'affordable.*price' => 20,
	'auto-notfallset' => 100,
	'WATCHLIST' => 30,
	'SET TO RISE' => 100,
	'Letzter (Preis|Kurs):' => 100,
	'Get IN (Before|TOMORROW)' => 20,
	'\nKurzel' => 100,
	'\nk,\?rzel' => 200,
	'\nSYmb?-' => 100,
	'\bSymbol ?:' => 30,
	'TICKER SYMBOL' => 30,
	'ST0CK' => 30,
	'(ST.CK|MARKET) *ALERT' => 100,
	'SCORE ONE' => 40,
	'\@[\w-]+\.by\s' => 100,
	'\$[\d\.]+ UP [\d\.]+ *%' => 200,
	'Up over \d+%' => 50,
	'% (profit|commission|per jaar)' => 40,
	'profitab' => 20,
	'\([a-z]{4}\)\n\$\d+\.\d+( |\n)' => 200,
	'incredible share' => 100,
	'call your broker' => 100,
	'Stock (Market|Exchange)' => 60,
	'new stock' => 50,
	'STOCK IS GOING' => 60,
	'(on|to) your radar' => 100,
	'Going To Explode' => 100,
	'WEEK PROJECTION' => 100,
	'TRADE (OUT|DATE)' => 30,
	'trading company' => 30,
	'esteemed company' => 30,
	'Last Trade:' => 100,
	'Currently Trading' => 50,
	'online-transaktionen' => 100,
	'Online.Trading' => 100,
	'(Online|Google) Promo' => 40,
	'e-Promotion' => 100,
	'short.term.target' => 50,
	'Kursziel' => 20,
	'OTC Bulletin' => 100,
	'\(OTC:' => 100,
	'ClickandBuy' => 100,
	'buy or sell' => 30,
	'e-commerce' => 30,
	'BUY!!' => 100,
	'interested to buy' => 50,
	'Str.ng Buy' => 100,
	'votre abonnement' => 100,
	'kindly confirm' => 30,
	'order confirmation' => 30,
	'purchase order' => 50,
	'purchasing' => 10,
	'(purchasing|finance) department' => 50,
	'|HR Department' => 100,
	'departamento' => 10,
	'COMPANY NAME' => 10,
	'claim your prize' => 100,
	'diplomatic agent' => 30,
	'claims? (application|officer|agent)' => 100,
	'financial portfolio' => 100,
	'FINANC.*(CONSULTANT|BROKER|ADVISOR|AGENT|HELP|PROBLEM|CONTROLLER|DEPARTMENT|CRIS)' => 100,
	'finanz.*(freiheit|unterst)' => 50,
	'finanzportal' => 10,
	'finanzberater' => 10,
	'(FINANCE|FUNDS|CREDIT|ASSURANCE|DELIVERY|PURCHASE|PURCHASING|LOTTERY|PROCUREMENT|MARKETING|RELATIONS) MANAGER' => 100,
  	'Financial Management' => 100,
  	'FINANCEIR' => 100,
  	'financiering' => 100,
	'sales (engineer|manager|director|co.?ordinator)' => 100,
  	'send us your catalog' => 100,
  	'look forward to receive' => 10,
  	'did you receive' => 30,
  	'my previous email' => 30,
	'national[a-z]+ sekret' => 100,
	'(account|business) ?[a-z]* ?manager' => 50,
	'supervisor' => 10,
	'senior.*manager' => 20,
	'Customer Service Manager' => 100,
#	'Customer Care Team' => 100,
#	'customer care' => 10,
	'new customers' => 30,
	'happy customers' => 100,
	'customs duties' => 50,
	'finan[zc].* operation' => 30,
	'finanzmarkt' => 30,
	'o[fn] the market' => 30,
	'reliable supplier' => 100,
	'ich habe ein.*portfolio' => 100,
	'Ich habe versucht,' => 30,
	'portfolio' => 10,
	'(amount|lot) of money' => 30,
	'money transfer' => 30,
	'remittance' => 10,
	'swift.*amount' => 30,
	'to transfer \$' => 100,
	'your tax' => 100,
	'total .*tax' => 100,
	'receive (USD|\$)' => 100,
	'receive your.*(cheque|check|cash|payment)' => 100,
	'withdrawal' => 100,
	'paysafecard' => 100,
	'tan2go' => 30,
	'debit card' => 50,
	'atm-karte' => 10,
	'|Karte vorsorglich' => 100,
	'(Cheque|Bank) Payment' => 100,
	'payment to your account' => 100,
	'payment.*(confirmation|advice)' => 50,
	'payment document' => 30,
	'update your billing' => 100,
	'your billing' => 30,
	'Billing Department' => 20,
	'attached payment' => 30,
	'update your payment' => 30,
	'kindly update' => 30,
	'\b(Owa|web)\b.*update' => 100,
	'OVERDUE PAYMENT' => 100,
	'compensating you' => 100,
	'you will be entitled to' => 100,
	'UNITED NATION COMPENSATION' => 100,
	'UNITED NATION.*PROGRAM' => 30,
	'COMPENSATION PAYMENT' => 100,
	'(receive|outstanding) payment' => 100,
	'money on my behalf' => 30,
	'on behalf of' => 10,
	'i have deposited ' => 20,
	'huge deposit ' => 30,
	'(receive|manag).*the fund' => 100,
	'Monetary Fund' => 100,
	'(international|deposit).*fund' => 30,
	'deposit to you' => 30,
	'the only money' => 30,
	'making money' => 30,
	'MONEY ORDER' => 30,
	'money back' => 30,
	'MONEY BACK GU?ARANTEE' => 100,
	'entrust.*in your care' => 100,
	'(kein|ohne) risiko' => 20,
	'absolut legal' => 30,
	'100% [\w\s]*risiko' => 100,
	'100% legal' => 30,
	'100% Verifiable' => 100,
	'100% (RISK.*FREE|GU?ARANTEE|Money Back)' => 100,
	'FREE (OFFER|REPORT|MEMBERSHIP)' => 100,
	'FREE OF CHARGE' => 10,
	'FREE TRIAL' => 20,
	'updating is free' => 50,
	'GU?ARANTEE 100%' => 100,
	'kapitalanlage' => 10,
	'um ihr geld zu erhalten.' => 50,
	'geld verdienen' => 10,
	'frisches geld' => 100,
	'nebeneinkommen' => 30,
	'jackpot' => 50,
	'\$.*bonus' => 50,
	' debt[!\?]' => 100,
	'% discount' => 100,
	'overpay' => 30,
	'(fast|worldwide) (shipping|delivery)' => 30,
	'Shipping Documents' => 40,
	'discreet.*shipping' => 100,
#	'REGISTER (NOW|AT)' => 30,
	'Voucher' => 20,
	'proforma.(invoice|rechnung)' => 100,
	'exklusiv.*rabatt' => 30,
	'RABATT (SICHERN|AKTIVIEREN)' => 40,
	'JETZT (TEILNEHMEN|AKTIVIEREN|AKTUALISIEREN)' => 20,
	'zahlungsmethode aktualisieren' => 100,
	'zahlungsinformation' => 10,
	'daten aktualisieren' => 20,
	'(absolut|100%|jetzt) kostenlos' => 20,
	'kostenlos erhalten' => 20,
	'neue kostenlose sicherheit' => 100,
	'sicherheitssystem' => 10,
	'sicherheit ihres kontos' => 30,
	'|Paket konnte nichtzugestellt' => 100,
	'|Wir haben versucht, Ihr Paket zuzustellen' => 100,
	'korrekte zustellung des pakets' => 30,
	'discover.*abandoned' => 100,
	'letzte mahnung' => 50,
	'wir beide profitieren' => 30,
	'dringende nachricht' => 10,
	'eingehenden? nachrichten' => 30,
	'meine private e-?mail' => 10,
	'kontaktieren sie' => 10,
	'ich mit ihnen kontakt' => 50,
	'UBERWEISUNG' => 100,
	'in der hoffnung' => 10,
	'folgen sie den anweisungen' => 20,
	'private sector' => 10,
	'you are required' => 10,
	'you are.*eligible' => 100,
	'\bagieren sie\b' => 10,
	'urgently (contact|required)' => 20,
	'REPLY (URGENT|ASAP)' => 20,
	'reply to this email' => 10,
	'urgent matter' => 30,
	'Kindly (Reply|Contact|Indicate)' => 20,
	'antworten sie sofort' => 20,
	'antworten sie.*auf meine' => 20,
	'Kindly permit me' => 40,
	'reply for further details' => 30,
	'for more details.*(contact|reply)' => 30,
	'get back to me for details' => 30,
	'please contact me' => 10,
	'\bkontakta\b' => 30,
	'\bcontatos\b' => 30,
	'contact me on my private' => 30,
	'to my private email' => 30,
	'freundlichen GruBen' => 200,
	'winning details' => 100,
	'selected winner' => 100,
	'randomly selected' => 30,
	'qualifikationsnummer' => 100,
	'(PRIZE|WINNING).NOTIFICATION' => 100,
	'your \S+ address was' => 30,
	'your email.* won' => 100,
	'your email id' => 50,
	'your WINNING' => 100,
	'(GRANT|CHARITY).DONATION' => 100,
	'recipient.*?donation' => 100,
	'donation.*?for you' => 100,
	'(receive|donation).*foundation' => 100,
	'receive a donation' => 100,
	'grant.*for you' => 100,
	'charity work' => 100,
	'donate \$' => 100,
	'donate the sum' => 100,
	'donation (for|to you)' => 50,
	'donated to you' => 50,
	'decided to donate' => 30,
	'you have been compensated' => 100,
	'you have been given' => 30,
	'Notification Alert:' => 100,
	'attention[!:]' => 10,
	'^achtung:' => 10,
	'aufmerksamkeit[,:]' => 30,
	'atenciosament' => 100,
	'offizielle Mitteilung' => 20,
	'Kind Attention' => 20,
	'Toner Cartridge' => 20,
	'TONER-EXPRESS' => 200,
	'EU-Neuwagen' => 20,
	'wie versprochen' => 10,
	'your quotation' => 10,
	'to whom it may concern' => 30,
  	'Prospective (Partner|overseas)' => 40,
	'dear(est)? ([a-z]+ )?(friend|partner|one)' => 20,
	'Dear.*Sir[ /]+(Ma|Ms)' => 20,
	'Dear Sirs?,' => 20,
#	'dear \S+,' => 10,
	'Dear Subscriber,' => 20,
	'dear researcher' => 40,
	'Dear (manager|supplier|Consignee)' => 100,
	'dear (\w+mail|Counsel|Google|E.?mail)' => 100,
	'(dear|hello|hola) +\S+@' => 50,
	'dear (custom|user|valued|web)' => 50,
	'dear, friend' => 50,
	'\nDear ,' => 20,
	'Dear( All)?,' => 10,
	'your webmail' => 20,
	'your webmail account' => 100,
	'update notice' => 30,
	'|>System Administrator<' => 50,
	'webmail admin' => 50,
	'webmail.*alle rechte' => 100,
	'aktualisierung.*?konto' => 100,
	'WEBMAIL AKTUALISIERUNG' => 100,
#	'aktualisieren' => 10,
	'profil aktualisieren' => 30,
	'kont.*zu aktualisieren' => 30,
	'aktualisieren sie' => 30,
	'Your Account Will Be' => 40,
	'Account Verification' => 40,
	'(confirm|verify) your' => 10,
	'immediate action' => 30,
	'CONFIRM YOUR EMAIL' => 20,
	'please login' => 30,
	'Account Status' => 20,
	'(temporarily|account) suspended' => 100,
	'die(se)? summe von' => 30,
	'konto wurde.*gesperrt' => 30,
	'sicheres konto' => 30,
	'authentifizierungsdienst' => 100,
	'kontogesperrt' => 100,
	'deaktivierung ihres kontos' => 60,
	'ihr konto wieder' => 30,
	'status ihres kontos' => 40,
	'(konto|speicher).?limit' => 40,
	'kontoinformationen' => 30,
	'exceeded the storage limit' => 100,
	'pending.*messages' => 30,
	'kontobewegungen' => 10,
	'Online-Konto' => 20,
	'Zugang zu Ihrem Konto' => 40,
	'passwort behalten' => 100,
	'expires today' => 50,
	'password.*expir' => 50,
	'keep.*password' => 50,
	'auf ihr konto zugreifen' => 40,
	'sie haben die speichergrenze' => 100,
	'speicher.*berschritten' => 30,
	'blackboard.*learning' => 200,
	'ihr postfach hat' => 100,
	'elektronischen postfach' => 10,
	'your profile' => 10,
	'I came across your' => 20,
	'I humbly ask' => 20,
	'your parcel' => 30,
	'United Parcel Service' => 20,
	'Your Mailbox Has Exceeded' => 100,
	'mail.*is almost full' => 100,
	'you have exceeded' => 50,
	'email quota' => 30,
	're-activate' => 30,
	'(upgrade|update) your account' => 50,
	'Email Account Owner' => 40,
#	'\nSystem Administrator\n' => 40,
	'\nYou won ' => 100,
	'board of trustees' => 100,
	'email have won' => 100,
	'mail.*has been selected' => 100,
	'have been selected' => 30,
	'you were picked' => 100,
	'you were selected' => 30,
	'you were listed as' => 30,
	'you are (a|the)( \w+)? winner' => 80,
	'winner of \$' => 100,
	'Lucky Winner' => 40,
	'Dear Winner' => 40,
	'dear client' => 10,
	'Bonjour Mon' => 60,
	'bonjour,' => 10,
	'mon nom est' => 60,
	'cordialement' => 30,
	'Dear in Christ' => 100,
	'in christus' => 30,
	'devoted christian' => 100,
	'Dear (Entrepreneur|Beloved)' => 100,
	'about you or no\?' => 200,
	"My Name's" => 60,
	"(\n|>)my name is" => 10,
	"my name is" => 10,
	'mein name ist' => 20,
	'mein \S+ (mann|herr)[,;]' => 50,
	'deutche (freund|herr|mann)' => 200,
	'|Hallo! Wie geht es Ihnen' => 200,
	'wie geht es.*mein name' => 100,
	'Hi, I am' => 20,
	'|I am .* from' => 10,
	'\nI am Mr' => 20,
	'hello[\w\s]+\.de' => 50,
	'Hello. My name is' => 20,
	'hallo,? mein freund' => 30,
	'mein [a-z]+ freund' => 30,
	'ich bin eine [a-z]+ frau' => 30,
	'suche einen [a-z]+ mann' => 30,
	'hello.? my good friend' => 40,
	'hello, i am' => 30,
	'hello (dear|friend),' => 30,
	'municipality' => 10,
	'je suis' => 30,
	'Muslim woman' => 60,
	'I am .*(President|Manager)' => 60,
	'we are searching for' => 40,
	'we are.*manufact' => 30,
	'we are currently upgrading' => 30,
	'we are deleting' => 30,
	'we represent' => 30,
	'have to update' => 10,
	'Major Search Engines' => 40,
	'search engine optimization' => 300,
	'page optimization' => 100,
	'optimierung' => 10,
	'is a STEAL' => 30,
	't miss this' => 30,
	'learn more' => 10,
	'left you a message' => 30,
	'has invited you to join' => 30,
	'you are receiving this' => 10,
	'this message is from' => 10,
	'this email grants access' => 50,
	'UNSUBSCRIBE (ME|HERE)' => 30,
	'unsubscribe.*or write' => 50,
	'unsubscribe from my emails' => 100,
	'no longer want to receive' => 50,
	'no longer receive these' => 50,
	'if you receive this message' => 30,
	'to be taken off' => 50,
	'beautiful women' => 30,
	'success with women' => 100,
	'live.*?cam' => 10,
	'webcam' => 10,
	'/teen' => 30,
#	'spam' => 10,
	'anti-spam-version' => 30,
	'all-natural' => 30,
	'Altiris' => 40,
	'Litigation' => 40,
#	'Content-Type: application/octet-stream; name=".*\.hta"' => 200,
#	'Gouranga' => 100,
	'naturvalencia' => 1000,
	'rem0ve\b' => 1000,
	'/please' => 50,
	'ple@se\b' => 1000,
	'DISC0UNT' => 1000,
	'\b0RDER ' => 1000,
	'as seen on' => 100,
	'Replic[\w\s]+Watch' => 100,
	'(premium|luxury) watch' => 200,
	'\boffshore' => 10,
	'\bopt.?(in|out)\b' => 10,
	'opted in via our website' => 200,
#	'/optout' => 10,
#	'optout\.' => 10,
	'chain.letter' => 100,
	'future mai.ing' => 30,
	'future emails' => 30,
	'C0ntact us' => 100,
#	'mai\|ing' => 100,
	'ShenZhen' => 10,
	'unsolicited' => 30,
	'no risk' => 30,
	'Turnaround time( is)? fast' => 20,
	'mail Ballot' => 100,
	'time mailing' => 100,
	'YouSave:' => 200,
	'Save (Up ?To|over|money)' => 100,
	'your chance' => 30,
	'direct phone' => 20,
	'YOUR TELEPHONE NUMBER' => 20,
	'YOUR OCCUPATION' => 40,
	'it is your last chance' => 60,
	'change your life' => 100,
	'personalleiter' => 20,
	'personalvermittlung' => 30,
	'marketing' => 10,
	'online.*marketing' => 100,
	'target[\w ]*marketing' => 100,
	'(mail|video).?marketing' => 10,
	'(Procurement|Marketing) Officer' => 100,
	'Multi.*Level.Marketing' => 200,
	'for your business' => 100,
	'(invest|business)[\w\s]+(opport|proposal|offer)' => 100,
	'Business (Directory|Deal|Venture|Transaction|Guide|Idea)' => 60,
	'handling this transaction' => 60,
	'transaction for you' => 100,
	'important transaction' => 100,
	'GESCH.*FT.*VORSCHLAG' => 100,
	'vertraulich.*gesch' => 30,
	'gegenseitigen nutzen' => 30,
	'lukrativ.*gesch' => 60,
	'if this proposal is' => 50,
	'i have a proposal' => 50,
	'Project Proposal' => 60,
	'get back to me' => 30,
	'full proposal' => 50,
	'(Very|Highly) confidential' => 50,
	'confidential business propos' => 100,
	'home based business' => 100,
#	'home.?office' => 10,
	'nebenberuflich' => 30,
	'.NVEST.R ALERT' => 100,
	'\bS.1618' => 100,
	'\(a\)\(2\)\(C\)' => 100,
	'Section 301' => 100,
	'in full compliance with' => 100,
	'further transmissions to you' => 100,
	'are receiving this (special|solicitation)' => 100,
	'received this.* in error' => 10,
	'reached you in error' => 30,
	'send your reply' => 10,
	'senden.*@gmail' => 30,
	'gmail-yui' => 30,
	've been warned' => 10,
	'do not reply' => 10,
	'you do not want' => 50,
	'this e.?mail was sent to' => 30,
	'Diese Email wurde von einem unserer Email Roboter erstellt' => 200,
	'any more e.?mails' => 100,
	'unsolicited e.?mail' => 50,
	'CONTINUE READING' => 60,
	'read this letter' => 50,
	'Ihre Partnerschaft' => 20,
	'partner sites' => 100,
	'your partnership' => 20,
	'partnership is needed' => 30,
	'partnership.*contact' => 30,
	'are you interested' => 30,
	'this is [a-z]+ from' => 10,
	'not spam' => 30,
	'This is .*\n?.* (spam|UCE)' => 60,
	'(sobre|considerado) SPAM' => 200,
	'FFA (page|site)' => 100,
	'(Remove|Replace).*in the above link' => 100,
	'Remove Here' => 20,
	'Important: Replace' => 100,
	'Important message' => 20,
	'Wichtige Mitteilung' => 20,
	'Replace "?."? with "?."?' => 30,
	'\nImportant!\n' => 100,
	'\ntake off list:?\n' => 300,
	'we will remove' => 30,
	'Get off this list by writing' => 300,
	'R.?e.?m.?o.?v.?e *m.?e' => 100,
	'Reply with off' => 100,
	'stopped at no cost' => 100,
	'stop receiving' => 10,
	'stop receiving advertisements' => 100,
	'emails from this advertiser' => 100,
	'resultsadv' => 1000,
	'|(Mitarbeiter|Personal) aus Litauen' => 1000,
	'hirelabas' => 1000,
	'labas-?(gr|bau)' => 1000,
	'online advert' => 50,
	'your ad ' => 10,
	'shopify' => 20,
	'shopping' => 20,
	'shop now' => 30,
	'free.*?gift' => 50,
	'Xmas gift' => 100,
	'Do You know that soon' => 100,
	'contact us at' => 20,
	'act today' => 30,
	'Call us TODAY' => 100,
	'Call Toll Free' => 100,
	'Call 24 hours' => 100,
	'24hours' => 10,
	'CALL.*?1-800-' => 100,
	'CALL 888-' => 100,
	'call[0-9 -]*now' => 100,
	'C A L L' => 30,
	'einkaufserlebnis' => 10,
	'jetzt bestellen' => 10,
	'jetzt (ein)?kaufen' => 30,
	'bestellen sie jetzt' => 10,
	'einmalige gelegenheit' => 10,
	'exklusives angebot' => 30,
	'angebot.*produkte' => 30,
	'inquir.*order' => 30,
	'place an order' => 30,
	'trial order' => 30,
	'Order today' => 40,
	'order ?now' => 100,
	'order your med' => 100,
	'Sales ?Rank:' => 100,
	'increased sales' => 100,
	'for sale' => 30,
	'selling point' => 30,
	'DIRECT SELLER' => 100,
	'Average Customer Review:' => 100,
	'Increase your' => 10,
	'Get your own' => 50,
	'get (your|a) free' => 10,
	'go for it' => 10,
	' efax' => 10,
	'Faxabruf' => 100,
#	'[ \-]0190' => 100,
	'Future reference options' => 60,
	'miles.*more' => 20,
	'Apple ID' => 20,
	'real estate' => 100,
	'Refill' => 20,
	'DO YOU.*(CREDIT|LOAN)' => 100,
	'% loan' => 300,
	'\bloan\b' => 30,
	'(accept|bad) credit' => 100,
	'credit instruction' => 100,
#	'creditcarddebt' => 200,
	'method of payment' => 10,
	'credit card-app' => 100,
	'credit card' => 10,
	'Credit History' => 100,
	'\bcredito\b' => 100,
	'(personal|urgent|private|business).*loan' => 100,
	'(rate|apply for) loan' => 100,
	'loan at \d%' => 100,
	'% zins' => 60,
	'zins.*laufzeit' => 60,
	'\bloans\b' => 100,
	'loan service' => 100,
	'(for|get|need( of)?) a loan' => 100,
	'we offer.*loan' => 100,
	'LOAN.?(FIRM|COMPANY|OFFER)' => 100,
        'loan.*(gmail|yahoo)' => 100,
        'financeloan' => 100,
	'Savings and Loan' => 100,
	'funding' => 10,
	'pay off' => 100,
	'pay \$' => 20,
	'Why pay more' => 100,
	'celebrity' => 100,
	'fat burn' => 100,
	'ab-zu-nehmen' => 200,
	'Wunschgewicht' => 60,
	'bergewicht' => 30,
	'Gewichts.?Abnahme' => 30,
	'schlank werden' => 30,
	'Debt Consolidation' => 100,
	'must be.*?(resident| 21)' => 100,
	'erhalten \w+ Dosen umsonst' => 100,
	'\barztliche\b' => 100,
	'Sie leben nur einmal' => 100,
	'Das Leben ist (zu )?kurz' => 100,
	'\bherbal' => 30,
	'medications' => 30,
	'your medications' => 100,
	'Rx[_-]MeDs' => 100,
	'No.Prescr' => 50,
	'Drug Store' => 50,
	'sildenafil' => 100,
	'Generic V' => 30,
#	'V.?.?.?.?A.G.R.A' => 100,
	'V.AGG?RA' => 100,
#	'V ?A ?L ?. ?U ?M' => 100,
#	'L ?E ?V ?. ?T ?R ?A' => 100,
#	'under your tongue' => 100,
#	'stamina' => 50,
#	'disolve half a pil' => 100,
	'\bp0rn\b' => 100,
	'\bpe+ni+s\b' => 30,
	'\bpi11s\b' => 100,
	'ejaculation' => 100,
	'Gewinn(chance|spiel)' => 20,
	'GEWINNBENACHRI' => 100,
	'ihr gewinn' => 50,
	'gewinn.*dollar' => 100,
	'euro.*gewonnen' => 50,
	'euro million' => 30,
	'\d miljoen' => 100,
	'gewinner' => 0,
	'gewinner ausgew' => 200,
	'sie wurden .*ausgew' => 100,
	'|ausgew\S+hlt wurden' => 50,
	'gewinnzahl' => 100,
	'im wert von' => 10,
	'Lucky Number' => 100,
	'preisgeld' => 30,
	'Lotterie' => 100,
	'LOTTO PROGRAM' => 100,
	'INTERNATIONAL LOTTO' => 100,
	'won.*lottery' => 100,
	'lottery' => 10,
	'LOTT?ERIA' => 100,
	'r\S+ckzahlung' => 10,
	'Sweepstakes' => 100,
	'Award Sum ' => 60,
	'ihre e-mail-adresse wurde ' => 30,
	'you have been awarded ' => 200,
	'you have an urgent message' => 100,
	'AWARD (PRIZE|NOTIFICATION|WINNER)' => 100,
	'Notification Award' => 60,
	'Anti.Aging' => 100,
	'fettverbrennung' => 100,
	'weight.loss' => 100,
	'best (deal|pr.ce)' => 30,
	'BARGAIN' => 30,
	'HUGE SAVINGS' => 100,
	'start saving' => 100,
	'start making' => 30,
	'Start-Bonus' => 100,
	'(TREUE|BONUS).?PROGRAMM' => 100,
	'please be advised' => 100,
	'please i need' => 30,
#	'|e-?Card' => 10,
	'CHECK (IT|THIS) OUT' => 30,
	'if you are okay' => 10,
	'get paid to' => 100,
	'get.rich' => 100,
	'(adult|sex|porn).*?(site|video|movie)' => 100,
	'\bMoviez\b' => 100,
	'sex life' => 100,
	'meine liebste mann' => 1000,
	'ernsthafte beziehung' => 20,
	'Hallo (Liebe)?,' => 20,
	'^Lieber\s*,' => 30,
	'Lieber geliebter' => 100,
	'Liebes.?kontakt' => 100,
	'heisse.*Single' => 100,
	'erotische' => 50,
	'tabulos' => 50,
	'Sex(kontakt|treff)' => 100,
	'live (strip|cam)' => 100,
	'strip show' => 100,
	'wanna see\b' => 10,
	'See ya .-\)' => 20,
	'attached Quotation' => 200,
	'check the attached' => 30,
	'see attached file' => 30,
	'see my picture' => 100,
	'(18|21).year' => 50,
	'an orphan' => 30,
	'i am \d+ years' => 30,
	'years old girl' => 30,
	'L0lita' => 100,
	'young girls' => 50,
	'big tits\b' => 100,
	'perverse' => 30,
	'hardcore' => 10,
	'\bf.cking' => 30,
	'Adults Only' => 100,
	'free adult' => 100,
	'XXX video' => 100,
	'Increase.*\n?.*Libido' => 100,
	'b.?lowjob' => 100,
	'Erection' => 100,
	'bequem und diskret' => 200,
	'diskret online' => 200,
	'diskret.*verpack' => 200,
	'Potenz(mittel|problem)' => 200,
	'Potenz(mittel|problem|pille)' => 200,
	'orgasm' => 50,
	'online pharm' => 100,
	'Pharmaceutical' => 20,
	'Urology' => 40,
	'\d+ tabletten.*euro' => 100,
	'online.apotheke' => 100,
	'Lose Weight' => 100,
	'to be (excluded|eliminated)' => 50,
	'(University|College) Degree' => 50,
	'University Diploma' => 50,
	'No Study Required' => 100,
	'experience required' => 10,
#	'u.n.i.v.e.r.s.i.t.y.*d.i.p.l.o.m.a' => 100,
	'Cable Descrambler' => 100,
	'inflector' => 100,
	'recruitment' => 100,
	'Bulk.E.?Mail' => 100,
	'fire.*?boss ' => 100,
	'(Technical|Webmail|Customer) Support Team' => 20,
	'Finan[cz].?Manager' => 100,
	'Operations.Manager' => 40,
	'privatkunde' => 10,
	'kundenmanager' => 100,
	'versandmanager' => 100,
	'Position:.*Manager' => 100,
	'(CAREER|MANAGER) POSITION' => 100,
	'career growth' => 100,
	'freelance' => 30,
	'Work from Home' => 100,
	'you (will|can) earn' => 30,
	'earn \$' => 100,
	'\bearn (more|up to|income)' => 100,
	'huge profit' => 100,
	'amount of funds' => 100,
	'benefit.*funds' => 50,
	'BENEFITS OF ATTENDING' => 100,
	'funds to you' => 30,
	'FUND RELEASE' => 100,
	'funds on my behalf' => 200,
	'transfer fund' => 100,
	'th[eo]se funds' => 30,
	'\bclaim\b.*(funds|money)' => 30,
	'funds.*claim' => 30,
	'procedures of claim' => 30,
	'quick claim' => 100,
	'your fund' => 30,
	'unclaimed inheritance' => 200,
	'inherit the fund' => 100,
	'fund.*transfer' => 30,
	'invest.*fund' => 50,
	'business.*fund' => 50,
	'profiling funds' => 200,
	'Contract.Fund' => 100,
	'foreign (contractors|remittance)' => 100,
	'Federal Reserve' => 50,
	'kreditbank' => 20,
	'Bank Transfer' => 20,
	'Bank Draft' => 60,
	'Bank Limited' => 60,
	'BANK DETAILS' => 20,
	'\nihre \w+bank' => 10,
	'(online|telefon).banking' => 10,
	'Private Banking' => 100,
	'Chase Online Banking' => 100,
	'Banking Client' => 100,
	'deceased client' => 200,
	'related[\w\s]*client' => 30,
	'i write to solicit' => 50,
	'pleasure to write' => 30,
	'mutual benefit' => 30,
	'make.*?(money|profit|annually|monthly)' => 100,
	'\$.* (annually|monthly)' => 100,
	'den button tun' => 30,
	'easy.*?money' => 30,
	'MONEY MAKING' => 100,
	'e-gold' => 30,
	'beg\S+nstigter' => 50,
	'treuh\S+nder' => 20,
	'(you|have) won \d' => 100,
	'I HAVE A.*DEAL' => 40,
	'deal with you' => 30,
	'like to tell you' => 30,
	'wanted to reach' => 10,
	'(like|wish|want) to discuss' => 30,
	'discuss with you' => 30,
	'VOTRE GAIN' => 60,
	'|Sie haben eine Spende' => 50,
	'000,00 (â|euro)' => 30,
#	'000 euro' => 10,
	'spende.*euro' => 50,
	'spende.*von \d' => 100,
	'spende.*erhalten' => 30,
	'millionen euro' => 30,
	'EUROMILLION' => 100,
	'deal.*million' => 50,
	'Summe.*Million' => 20,
	'\dMillion' => 20,
	'Million (USD|EUR)' => 20,
	'USD.*million' => 20,
	'\d[\d,.]+ (USD|GBP)' => 20,
	'Million GBP' => 60,
	'US\$.*?Million' => 20,
	'\$\d+m' => 30,
	'\$[\d.]+million' => 30,
	'\$[\d,]+000.00' => 30,
	'(the|total|worth) sum of.*(Dollar|MILLION|USD|GBP|£|\$)' => 60,
	'la somme de' => 200,
	'\d (UK )?Pounds' => 20,
	'Million.*\n?.*Pounds' => 60,
	'pfund sterling' => 60,
	'Million.*\n?.*dollar' => 20,
	'tausend dollar' => 20,
	'\d+ Mio.*Dollar' => 40,
	'up to \$' => 40,
	'made over \$' => 40,
	'ATM CARD' => 60,
	'Western.?Union' => 100,
	'Money Gram' => 100,
	'need your private' => 30,
	'need your assistance.*transfer' => 100,
	'require your assistance' => 50,
	'I NEED YOUR (URGENT|ASSISTANCE)' => 40,
	'if you agree to assist' => 100,
	'assist.*transfer' => 40,
	'TRANSFER OF \d' => 40,
	'geld.*transfer' => 40,
	'weiterhin.*bargeld.*abheben' => 100,
	'worth \$' => 50,
	'for only \$' => 100,
	'bundeszentralamt.*steuern' => 300,
	'buy bitcoin' => 30,
	'Bitcoin.*Wallet' => 20,
	'brieftaschenadresse' => 100,
	'UNZUREICHENDE ODER FEHLERHAFTE' => 100,
	'Euro/Min' => 0,
	'Euro pro Monat' => 20,
	'Euro monatlich' => 20,
	'Euro.*Kredit' => 50,
	'kreditangebot' => 50,
	'privatkredit' => 100,
	'kreditbetr' => 30,
	'finanziell.*problem' => 100,
	'schuldenkonsolidierung' => 200,
	'\bSCHUFA' => 20,
	'europol' => 30,
	'vorladung' => 30,
	'verstarkung' => 60,
	'vergutung' => 100,
	'r\S+ckerstattung' => 30,
	'bestatigen' => 100,
	'best\S+tigen sie' => 30,
	'wir suchen.*Mitarbeiter' => 40,
	'confirm your identity' => 30,
	'identity check' => 30,
	'online.ca..no' => 100,
	'Online.Kasino' => 100,
	'CASINO' => 20,
	'Roulette' => 20,
	'POKER' => 20,
	'Brand Name' => 20,
	'cheap[\w\s]+soft' => 30,
	'OEM software' => 40,
	'quality products' => 50,
	'interested in ([a-z]+ )?your product' => 100,
	'high-quality software' => 50,
	'executive (officer|director)' => 10,
	'sales executive' => 30,
	'human resource' => 20,
	'directeur des' => 30,
	'Financial (Officer|Director)' => 10,
	'\n<style>[ a-z]+</style>\n<a href="http' => 100,
	'<font style=.*?font-size: *1(;|p.)"?>' => 50,
	'span><span.*font-size:99' => 10,
#	'</span></span></span>' => 10,
#	'span.*font.*span.*font.*span.*font.*span.*font.*span.*font' => 30,
#	'#ff0000' => 30,
#	'#ffffff' => 20,
	'!!!!!' => 10,
#	'\bR0LE.?X\b' => 200,
#	'R\|O\|L\|E\|X' => 200,
#	'Vom Orginal nicht? zu unterscheiden' => 200,
#	'Replica.*Rolex' => 300,
#	'Bvlgari.*Cartier' => 100,
#	'Cartier.*Bvlgari' => 100,
	'Rolex|Cartier|Breitling|Bvlgari' => 20,
	'Louis Vuitton' => 100,
#	'replicaworld' => 300,
	'(best|deal)\s.*?\.biz' => 50,
	'CBS NEWS' => 20,
	'FORBES' => 20,
	'!http:' => 30,
	'cloud-speicher' => 10,
	'/wp-content/' => 50,
  	'digitaloceanspaces' => 100,
  	'clck\.ru' => 100,
  	'klclick\.com' => 100,
  	'stopsending\.com' => 300,
  	'beehiiv\.com' => 300,
  	'consultant\.com' => 200,
	'https?://[\w.-]+_[\w.-]+' => 100,
	'://[\w\-\.]+(casino|gambling)' => 100,
#	'http://[\w\-\.]+generic' => 50,
#	'http://[\w\-\.]+replica' => 50,
	'://[\w\-\.]+\.(biz|guru|shop|store|xyz|top|ru|ar|br|cc|ag|ws|tf)["/]' => 50,
	'://[\w\-\.]+\.(cloud)["/]' => 10,
#	'(http://|www\.)[\w\.-]+\.cn\b' => 200,
#	'@[\w\.\-]+\.(cn|ru)\b' => 200,
	'w w w \. ' => 50,
	'http://[0-9%\.]+[:/ "]' => 30,
  	'|http\S+/\.\./' => 100,
#	'http://(www\.)?[a-z]+[0-9][a-z]+\.[a-z]+/' => 30,
	'\nhttp://[\w.-]+/de/\?id' => 200,
	'://bit\.(ly|do)/' => 50,
	'://bitly\.com/' => 50,
	'://shorturl' => 50,
	'://tinyurl' => 50,
	'/rb\.gy/' => 300,
	'byethost\d' => 300,
	'imgur\.com/' => 100,
	'r2\.dev/' => 100,
	'ipfs\.io/ipfs' => 100,
	'fanlink\.tv/' => 100,
	'https://\S+\.amazonaws\.com' => 200,
	'www\.linkedin\.com' => 10,
	'https://t\.co/' => 50,
	'>https://t\.co/' => 50,
	'\n\nhttps://t\.co/\w+\n\n' => 200,
	'://.*\.sa\.com/' => 100,
	'://.*\.ru\.com/' => 100,
	'://.*\.su/' => 100,
	'http://(www\.)?[bcdfghjklmnpqrstvwxyz0-9]{7,}\.' => 30,
#	'http://www\.\w+\.[\w-]+\.[a-z]+/[a-z][a-z]$' => 30,
#	'http://[a-z0-9\.]+[0-9][a-z0-9\.]+/[0-9]+/' => 30,
	'http://[a-z]\.' => 10,
	'http://[a-z][a-z]\.[a-z]\.' => 20,
	'http://www\.[a-z]{20,}\.[a-z][a-z][a-z][\n"]' => 10,
#	'http://[a-z]+\.(com|net)\.[a-z0-9]+\.[a-z]+/\?' => 100,
	'(www\.|http://)[^/\n]*(sex|horny|fuck|adult|porn|erotic)' => 30,
#	'(www\.|http://)[^/\n]*(generic|replica|great|discount)' => 30,
#	'http://[a-z][a-z]\.geocities.com/[a-z]+\d{4}' => 200,
#	'http://\.' => 30,
	'http://[^ ]&#\d+;' => 200,
	'http://[^/\s]+@[^/\s]+' => 100,
	'http://[^\s]*\.exe' => 50,
	'http://g\.msn\.com/' => 100,
	'http://x\.co/' => 100,
#	'http://[\w.-]+[!_&\|\*]' => 200,
	'http://[\w.-]+(date|win|faith|xyz)/' => 100,
	'http://[\w.-]+\.bid\b' => 100,
	'http://[\w.-]+/\?\d+\b' => 30,
	'http://[\w.-]+info/\?\w' => 10,
	'http://[\w.-]+info/\d+/' => 10,
	'http://[\w.-]+info/index.php\?' => 100,
	'http://[\w.-]+/\d+.php' => 30,
	'http://[\w.-]+/go.php' => 100,
#	'https?://[\w.-]+\.app/' => 30,
	'https?://[\w.-]+\.link/' => 30,
#	'\nhttp://[\w.-]+\.hk/' => 100,
	'http.*cloudfront\.net' => 100,
	'http://www\.[a-z]+\.\w+-[\w-]+\.(net|org)(/[a-z]+)?\n' => 50,
	'\nhttp://www\.[a-z][a-z]+\.[a-z0-9]+\.[a-z]+/[a-z][a-z]\n' => 100,
	'\n([a-z]+ [a-z]+ )?http://www\.[a-z]+\.[\w-]+\.[a-z]+/[a-z][a-z]\n' => 100,
#	'\n\s*http://[a-z0-9\.]*[/ ]*\n' => 0,
#	'rds?\.yahoo\.com' => 10,
	'http.*labas' => 100,
	'yahoo\.com\.hk' => 100,
	'yahoo\.co\.uk' => 100,
	'mailjet\.com' => 10,
	'myshopify\.com' => 100,
	'wixsite\.com' => 100,
	'000webhostapp\.com' => 100,
	'embluemail\.com' => 100,
	'reach360\.net' => 1000,
#	'\bqq\.com\b' => 1000,
	'googleusercontent\.com/' => 200,
#	'fonts\.googleapis\.com' => 100,
	'www\.google\.com.*q=http' => 20,
	'docs\.google\.com/forms' => 100,
	'www\.bing\.com/ck' => 100,
	'spmailtechno\.com' => 100,
	'://goo\.gl/' => 30,
	'appleid\.apple\.com' => 10,
	'aproxtrack2\.com' => 100,
	'track\.pstmrk\.it' => 100,
	'mail.yahoo.com/mc/compose' => 100,
	'groups\.yahoo\.com' => 100,
#	'yahoo\.de' => 30,
        'live\.co\.(za|uk)' => 30,
	'spaces\.live\.com' => 100,
	'geocities\.com/' => 30,
	'spokemotion\.com' => 100,
	'weebly\.com' => 100,
	'appspot\.com' => 10,
	'hotmail\.co\.uk' => 100,
	'ads\.msn\.com/ads/' => 200,
	'\d\d\d\d\.blogspot\.' => 100,
#	'sendgrid\.org' => 100,
	'libinaes06\.com' => 1000,
	'madmimi\.com' => 1000,
	'proof-reading-service\.com' => 1000,
#	'bcentral\.com' => 200,
#	'redlightemail\.com' => 100,
#	'newsletter-off\.com' => 100,
	'newsletters\.sendmsg\.co\.il' => 100,
	'www.*greatoffer' => 100,
#	'www\.netmails\.com' => 100,
#	'www\.inverz\.' => 300,
#	'www\.reverz\.' => 300,
	'www\.[0-9]+[a-z]+\.' => 10,
	'tripod\.com\.(ar|br|ve)' => 100,
	'trackmail\.com\.br' => 1000,
	'jmcserv\.com' => 1000,
	'yeah\.net' => 1000,
	'constantcontact\.com' => 1000,
	'123contactform' => 1000,
	'acymailing' => 200,
#	'\.de\.vu' => 30,
	'\.ig\.com\.br' => 100,
#	'net-click.net' => 1000,
        'craigslist' => 100,
#	'list-manage\.com' => 200,
#	'getresponse\.com' => 200,
#	'netfirms\.com' => 200,
#	'powppdd\.com' => 200,
#	'hitbox\.com' => 200,
#	'Inetekk\.com' => 200,
#	'port5\.com' => 200,
#	'aktion2004\.net' => 1000,
#	'24hhosting\.com' => 1000,
#	'12freehost\.com' => 1000,
#	'126\.com' => 200,
#	'50megs\.com' => 200,
#	'5xx\.net' => 200,
#	'yeah\.net' => 200,
#	'hinet\.net' => 200,
#	'nease\.net' => 200,
#	'emailspecialz' => 200,
#	'frankhostsnetworks' => 200,
#	'nachrichtendienst24' => 200,
#	'privatseitennetz' => 200,
#	'cashmailer' => 200,
	'cashreport' => 30,
	'cashback' => 30,
#	'Dello Makabo' => 100,
#	'SESE.SEKO' => 100,
#	'PRESIDENT (MOBUTU|KABILA)' => 100,
#	' KUAMA' => 100,
#	'Savimbi' => 100,
	'Khodorkovsky' => 100,
	'From Syria' => 20,
	'From Hong Kong' => 20,
	'Nigeria' => 20,
	'Burkina Faso' => 20,
	'REPUBLIC OF GHANA' => 20,
	'Bank Ghana' => 100,
	'from ghana' => 30,
	'IVORY COAST' => 60,
	'cote d\'Ivoire' => 100,
	'I work with the.*bank' => 100,
	'from Bank of' => 40,
	'bank of china' => 200,
	'leading Banks' => 40,
	'verified by visa' => 100,
	'verifizierung' => 10,
#	'Ihre Bank' => 10,
	'bankofamerica' => 100,
	'akbank\.com' => 100,
	'\bbonit' => 10,
	'wetransfer' => 10,
	'PayPal-Konto' => 20,
	'PayLife' => 40,
  	'finanzierung' => 10,
	'internet-banking-konto' => 30,
	'|Bankkonto eingezahlt' => 60,
	'sparkasse kundendienst' => 60,
	'|IHR\w* SPARKASSE' => 60,
	'wir entdeckten unregelm' => 100,
	'wir haben.*festgestellt' => 30,
	'Banking Corporation' => 40,
	'honest co-operation' => 100,
	'confirm back' => 50,
	'all confirmable documents' => 50,
	'Bank.*Nigeria' => 100,
	'Holy (Spirit|Bible)' => 20,
	'Lord Jesus' => 20,
	'Yours In (Service|Christ)' => 100,
	'spirit of god' => 30,
	'mercey of god' => 30,
	'God be with you' => 20,
	'I leave you in God' => 20,
	'(God|Allah) bless' => 20,
	'gottes segen' => 30,
	'grace of God' => 30,
	'Please I am' => 40,
	'enjoy your day' => 20,
	'sincerely hope' => 10,
	'have a great day' => 20,
	'you in good health' => 30,
	'how are you doing' => 30,
	'hope you are (fine|doing)' => 30,
	'hope everything' => 10,
	'hope this message (finds|reaches)' => 10,
#	'hope.*finds? you well' => 10,
	'hope this email' => 30,
	'ich hoffe, es geht ihnen gut' => 50,
	'hope you.*doing well' => 10,
	'hope you are well' => 10,
	'we look forward' => 30,
	'introduce myself' => 40,
	'send you my pictures' => 10,
	'Compl.ments? Of The Day' => 100,
	'Compliments[!.]' => 20,
	'Top of the day to you' => 100,
	'IN GOOD FAITH' => 40,
	'good day[!,]' => 20,
	'good [a-z]+ to you' => 20,
#	'Good Day Sir' => 20,
	'lieber kunde' => 20,
	'sehr geehrte.*?(user|mitglied|nutzer|kunde)\b' => 10,
	'sehr geehrte herr,' => 10,
	'sehr geehrte kundin' => 30,
	'|^Geehrte Damen und Herren' => 100,
  	'gentile cliente' => 200,
  	'\behr geehrte' => 50,
	'good day to you' => 40,
	'provide a quote' => 50,
	'we provide.*service' => 50,
	'write me at' => 10,
	'CAN WE TALK' => 20,
	'how are you today' => 40,
	'(Greetings|Good Day),[\s\n]+I am' => 40,
	'greetings [a-z]+,' => 30,
	'greeting to you' => 10,
	'greetings of the day' => 30,
	'atentamente' => 10,
	'|Greetings,$' => 10,
	'HOW IS YOUR FAMILY' => 20,
	'i am writing (this letter|you|to)' => 20,
	'I AM CONTACTING YOU (BECAUSE|REGARDING|TO)' => 20,
	'Bank Ltd' => 10,
	'(bank|foreign|credit) account' => 30,
	'dormant account' => 100,
	'Chief Accountant' => 100,
	'Chief.*Officer' => 20,
	'Account(ant)? (officer|General)' => 100,
	'Trust Account' => 100,
	'Attn[:;] ?(Sir|PLEASE|Good|Representative)' => 100,
  	'|ATTN:' => 40,
	'ATTENTION: ?Sir' => 100,
	'Notification of Bequest' => 100,
	'purpose of.*contacting' => 20,
	'name.*address.*(status|occupation|phone)' => 30,
	'Mailadresse.*aus offenen Quellen' => 100,
	'1.*Full Names' => 30,
	'Full Name:' => 20,
	'Full Name, Address' => 20,
	'Nombre completo' => 100,
	'Contact Phone numbers:' => 20,
	'COUNTRY OF ORIGIN' => 20,
	'Ich vermute das diese E-Mail' => 60,
	'URGENT ASSISTANCE' => 40,
	'seek your assistance' => 20,
	'back urgent' => 10,
	'please write me back' => 30,
	'about myself' => 10,
	'we can share' => 10,
	'if you are interested' => 10,
	'Clearing House' => 20,
	'Attorney' => 20,
	'lawfirm' => 20,
	'bequeathed' => 20,
	'beneficiar' => 100,
	'establish.*relationship' => 100,
	'trustworthy (person|relationship)' => 100,
	'trust and confidence' => 30,
	'personal assistant' => 30,
	'Personal Attorney' => 100,
	'Family Inheritance' => 100,
	'(her|his) last wish' => 100,
	'estate of late' => 100,
	'your late relative' => 100,
	'deceased relative' => 100,
	'I am .* of( the)? late' => 100,
	'verstorbene.? (kunden|klient|herr|mann|ehe|verwandt)' => 100,
	'mein verstorben' => 30,
	'des verstorbenen' => 30,
	'bin eine witwe' => 100,
	'die einzige tochter' => 30,
	'weniger privileg' => 30,
	'attorney to Late' => 100,
	'late (husband|general|client)' => 100,
	'former president' => 100,
	'herzlichen gl\S+ckwunsch' => 10,
	'GLUCKWUNSCH' => 100,
	'personlich' => 50,
	'zu konnen' => 50,
	'Sie konnen' => 50,
	'schonen Tag' => 20,
	'|Illuminaten' => 50,
	'beneficiario' => 100,
	'cancer patient' => 50,
	'diagnosed for cancer' => 100,
	'i have .*cancer' => 100,
	'|^Ich bin.*geil' => 30,
	'|^Ich bin.*Rechtsanwalt' => 30,
	'|^Ich bin Mr' => 30,
	'|^Ich bin (Herr|Frau) ' => 30,
	'|Ich bin [\w ]+, ein' => 30,
	'|Ich bin \d+ Jahre alt' => 30,
	'|Wie geht es Ihnen heute' => 30,
	'|Mein Name ist Herr' => 30,
	'|Hallo, mein Name ist' => 30,
	'|Hallo, ich bin' => 30,
	'|>Hallo ,<' => 100,
	'|Guten Tag,' => 10,
	'|Guten Tag, mein Name ist' => 50,
	'|Guten Tag.*@' => 50,
	'|[Tt]his is [A-Z][a-z]+ [A-Z][a-z]+ from' => 50,
	'|\bSEO\b' => 30,
	'|SEO (audit|Specialist)' => 100,
	'|NIGERIA' => 50,
	'|NLNG' => 50,
	'|LIBERIA' => 50,
	'|TESTAMENT' => 50,
	'|GRATIS' => 10,
	'|DATING' => 20,
	'|Darlehen' => 10,
	'|Schulden' => 10,
	'|nliche Darlehen' => 200,
	'|den Betrag von' => 30,
	'|Darlehensbetrag' => 300,
	'|Zinssatz' => 30,
	'|Ihrer Firma' => 100,
	'|Firmenadressen' => 100,
	'|Datenbank.*Adressen' => 30,
	'|4free' => 80,
	'|BUY .*?NOW' => 50,
#	'|AppID [0-9]+' => 100,
#	'|InverZ' => 100,
	'|\nRespectfully' => 20,
	'|\bCIA.?.?LIS' => 100,
	'|\bVIA.?.?GRA' => 100,
	'|\bV.C.D.N' => 100,
	'|I represent' => 30,
	'|Direct Media' => 100,
	'|LOTT.*GEWINN' => 100,
	'|Anfangskurs: \d' => 100,
	'|\b[lI]SIN:? [A-Z][A-Z]' => 100,
	'|\bWKN\b' => 30,
	'|\bTecDax\b' => 30,
	'|Dividende' => 30,
	'|NASDAQ' => 30,
	'|Market Cap' => 100,
	'|NNPC' => 100,
	'|F.R.E.E' => 100,
	'|Ubag Tech AG' => 1000,
	'|URGENT' => 30,
	'|LOAN' => 30,
	'|DOWNLOAD' => 20,
	'|OPEN ATTACHED FILE' => 100,
	'|AMAZING' => 20,
	'|CONFIDENTIAL' => 30,
	'|ASSISTANCE' => 30,
	'|PARTNERSHIP' => 30,
	'|MARKETING' => 30,
	'|FINANCE' => 30,
	'|REFINANCE' => 100,
	'|INSURANCE' => 30,
	'|SEARCH ENGINE' => 30,
	'|ADVERTISEMENT' => 30,
	'|PROMOTION' => 30,
#	'|Ihren? Kredit' => 100,
	'|Kreditantrag' => 50,
	'|Kreditkarte' => 10,
	'|Kreditkartendaten' => 20,
	'aus sicherheitsgr' => 20,
	'|sicherheitsabteilung' => 20,
#	'|PRIVATE' => 80,
	'|STRICTLY CONFIDENTIAL' => 100,
	'|INTRODUCTION OF MY SELF' => 200,
	'|DEAR SIR/MADAM' => 50,
	'|YOUR ASSISTANCE' => 100,
	'|GOOD LUCK' => 100,
	'|WATCH OUT' => 100,
	'|TOP SECRET' => 100,
	'|GET YOUR FREE' => 100,
	'|VIEW THIS ATTACHMENT' => 100,
	'|\bMLM\b' => 10,
	'|\$[\d,.]+ ?USD' => 20,
	'|000USD' => 100,
        '|\n_[A-Z]__[A-Z]__[A-Z]_\n' => 100,
	'|Vorkenntnisse nicht erforderlich' => 200,
	'|Werbemail' => 30,
	'|Werbekampagne' => 30,
	'|Bewerbung bitte an' => 100,
	'|BEWERBEN SIE SICH' => 60,
	'|senden Sie Ihre Bewerbung' => 40,
	'|Schn.*ppchen-?Jagd' => 100,
	'|Wie ist Ihr Tag\?' => 100,
	'|Verstandnis' => 100,
	'|Mit (angenehmen|frohen|netten) Grue?ssen' => 200,
  	'|Recent News:' => 100,
#	'|DISPLAY: none' => 50,
        '|owaTempEditStyle' => 100,
	'|Acct. Rep. [a-z]+\d+' => 300,
	'|(£|=A3)[ \d+,]+GBP' => 100,
	'|Oxfam.GB' => 200,
	'|html\?[a-z]+"><b style="' => 200,
	'|Grussen' => 200,
	'|Helpdesk Support Webmail Centre' => 300,
	'|\nIT.*[Dd]esk' => 20,
	'Admin.Helpdesk' => 20,
	'Service.Desk' => 20,
	'information technology service' => 10,
        '|mkt\d\d+\.com' => 1000,
	'cgi-bin/unsub.cgi' => 100,
	'tracking/unsubscribe' => 100,
	'|sendgrid.net/asm/unsubscribe' => 200,
	'|p=unsubscribe' => 100,
	'|Unsubscribe.*/link.php' => 100,
	'|/b/unsub/\d' => 100,
	'|com/b/click/\d' => 100,
	'/ls/click\?' => 100,
#	'/click\?' => 10,
	'/cl\.aspx' => 10,
#	'\?upn=' => 100,
#	'|\n(Quit|Drop me|Give up|No more|No thanks): *http:' => 200,
#	'|No thanks: http:' => 200,
#	'|No more( -)? http:' => 200,
#	'|No more ad[sz]' => 200,
	'|no more (email|offers)' => 100,
	'|Nein vielen Dank:' => 200,
	'|get me off' => 100,
	'|/unsub' => 10,
	'|/track' => 10,
	'|tracker\?smart_link_id' => 200,
	'|/off_list' => 100,
	'|/out\.html' => 100,
	'|/off\.html' => 100,
	'|/rms\.html' => 100,
#	'|%3A%2F%2F' => 30,
	'src="data:image' => 30,
	'class="container' => 30,
	'data-saferedirecturl' => 30,
	'redirecturl=' => 30,
	'/dereferrer/' => 30,
	'|/redir\.html' => 100,
	'|/nomore\.html' => 100,
	'|/nothanks' => 100,
	'|/[aoh]\.html"' => 50,
	'|/form1\.html' => 100,
#	'|html\?\w' => 50,
	'|/rm\.php\?' => 100,
	'|/redir\.php\?' => 100,
	'|/chair\.php' => 100,
	'|/gone.(php|asp)' => 100,
	'|/z ?\.php' => 100,
	'|http://[\w\.-]+/rid/' => 100,
	'|http://bit\.ly/' => 20,
	'app\.qq.link/' => 100,
	'|/u\.php' => 100,
	'|/d/[0-9]\.php' => 100,
	'|/loan\.php' => 100,
	'|php\?id=' => 10,
#	'|/gate\.php\?sid=' => 100,
#	'|cgi-bin/view\.cgi' => 100,
	'|/index\.php\?pid=' => 100,
	'|/index\.php\?ID=affil' => 100,
	'|/index_o\.php\?' => 100,
	'|/rep(lica)?/sales/' => 300,
	'|/tp/default\.asp\?id=s' => 200,
	'|/r/sales/' => 200,
	'|/atrack\.php\?id' => 100,
	'|\?AFF_ID=' => 100,
	'|affiliate_id=' => 100,
	'|urlpassed=' => 100,
	'|/\?partid=' => 100,
	'|/anti.asp\?' => 100,
#	'|">Stop' => 50,
	'|/ES001/' => 100,
	'|/download1/' => 100,
#	'|href=.*java' => 100,
#	'|clickthru' => 50,
	'|subject=(delete|remove)' => 50,
        '|filename="Data.htm"' => 100,
);

if ($si !~ /mailinglist/ 
    and not grep /Newsletter|no-reply/,@{$H{'From'}} 
    and not @{$H{'List-Id'}} 
    and not @{$H{'Mailing-List'}}) {
  foreach $r (
	'REMOVER',
	'"REMOVE"',
	'remove@',
	'remove at',
	'to remove',
	'if you do not wish',
	'to be removed',
	'to leave list',
	'unsubscribe@',
	'to unsubscribe',
	'remove.*(list|instructions|address)',
#	'message in error',
	'ignore this',
	'check out') 
  { $R{$r} = 10 }
}

while (($r,$n)=each %R) {
  $r =~ s/\\n/\n/g; # echte newlines
  if ($r =~ s/^\|//) {
    # case sensitiv
    if ($body =~ /($r)/m) {
      add($n,"'$1' ($r) in body");
    }
  } else {
    if ($body =~ /($r)/im) {
      my $x = $1;
      # case sensitiv match
      $n *= 1.5 if $x =~ /$r/ and $r =~ /[A-Z]/;
#      $x =~ s/^\s+//s; 
#      $x =~ s/\s+$//s; 
      if ($r =~ /\Q$x/i) {
        add($n,"'$x' in body");
      } else {
        add($n,"'$x' ($r) in body");
      }
    }
  }
}

# special fill chars inside
%R = (
	'mortgage' => 100,
	'refinance' => 100,
	'lenders' => 100,
	'credit' => 100,
	'approved' => 100,
	'guaranteed' => 100,
	'rates' => 100,
	'Pfizer' => 30,
);

$fc = '[ .0,;=\*\-\+]';
while (($r,$n)=each %R) {
  $x = join $fc.'*',split(//,$r);
  if ($body =~ /\b($x)\b/) {
    $x = $1;
    add($n,"'$x' ($r) in body") if $x =~ /$fc/;
  }
}


# any chars inside
%R = (
	'mortgage' => 100,
	'refinance' => 100,
	'approve' => 50,
);

$fc = '[a-z-]';
while (($r,$n)=each %R) {
  $x = join $fc.'?',split(//,$r);
  if ($body =~ /\b($x)\b/) {
    $x = $1;
    add($n,"'$x' ($r) in body") if $x =~ /$fc/;
  }
}


if (length($body)<1000) {
      
  # 2nd char is fill char
  %R = (
  	'HOTGIRLS' => 30,
  	'Flashing' => 30,
  	'Public' => 30,
  	'Teens' => 30,
  	'Lesbian' => 30,
  	'Hardcore' => 30,
  	'Orgasm' => 30,
  	'Erotic' => 30,
  	'Redhead' => 30,
  	'Haired' => 30,
  	'Sucking' => 30,
  	'Stockings' => 30,
  	'Titted' => 30,
  	'Fucking' => 30,
  	'Posing' => 30,
  	'Dildo' => 30,
  	'Tits' => 30,
  	'Nude' => 30,
  	'Teen' => 30,
  	'Suck' => 30,
  );

  my $subject = "@{$H{'Subject'}}";
  
  while (($r,$n)=each %R) {
    $r =~ s/^(.)/$1./;
    if ($body =~ /\b($r)\b/) {
      $x = $1;
      add($n,"'$x' ($r) in body");
    }
    if ($subject =~ /\b($r)\b/) {
      $x = $1;
      add($n,"'$x' ($r) in Subject");
    }
  }
}

sub nmatch {
  $n = shift;
  $p = shift;
  my $c;
  my @R;
  
  foreach $r (@_) {
    push @R,"'$r'" if $body =~ /\b$r\b/;
  }
  $c = scalar @R;
  if ($c >= $n) {
    add($p,"nmatch: @R");
  }
}

nmatch(2,50,qw(
  Teen Porno Sex Pimmel Luder Nutte Geilheit Erotik Piercing Video Arsch Fick
  verdorben hemmungslos geile naturgeil ficken fickt blutjung
  knallhart devot tabulos potent
));

nmatch(3,10,qw(Name Telefon Adresse Land Beruf Alter));

nmatch(3,30,
  'Windows 7 Ultimate',
  'Office Professional',
  'Adobe Photoshop',
  'Adobe Creative',
  'Adobe Acrobat',
);
  
## specials

if (($body =~ tr/\n//) < 12) {
  if ($body =~ m((^|\n)http://img\d+\.imageshack\.us/)) {
    add(200,"imageshack.us");
  }
}
  
if ($ENV{MYTOKEN}) {
  # my $mytoken = quotemeta $ENV{MYTOKEN};
  if ($body_complete =~ /$ENV{MYTOKEN}/) {
    $header .= "X-Spamblock: ignored by rule MYTOKEN ($ENV{MYTOKEN})\n";
  }
}

# warn "### URIBLACKLIST=$ENV{URIBLACKLIST\n";

# wird nicht mehr verwendet, da zu unsicher
if ($uridb and $DB_HASH and $Xdomain and $ENV{URIBLACKLIST} eq 'ok' and
    $header !~ /\nX-Spamblock: ignored/) {
  my ($u,$n,%U);
  
  # letzte 5 Zeilen koennte Werbe-footer vom Webmailer sein
  if (($body =~ tr/\n//) > 20) {
    $body =~ s/(\n.*?){5}$//;
  } elsif (length($body)>2000) {
    $body =~ s/.{200}$//;
  }
    
  while ($body =~ m{((http://|www\.).*?)[<>!\*\&\'\"\s\?\)\n\200-\377]}g) {
    next if $' =~ m:^>?</[aA]>:; #'
    # warn "found URI $1\n" if $ENV{SPAMBLOCK} eq 'TEST';
    $u = URI_normalize($1) || next;
    if ($u =~ m:(\w[\w\.\-]*\.\w+)[^/]*(/.+/.+|/.{14,})?:) {
      $U{$1} = 1;
      $U{$2} = 1 if $2;
    }
  }
  if (%U) {
    # dbmopen %URI,$uridb,0644;
    if (-f $uridb) {
      tie %URI,'DB_File',$uridb,O_RDWR|O_CREAT,0644,$DB_HASH or &end;
      untie %URI;
    }
    open U,">>$uridb" and flock U,2;
    tie %URI,'DB_File',$uridb,O_RDWR,0644,$DB_HASH or &end;
    foreach $u (keys %U) {
      $d = '';
      $n = 0;
      ($n,$time) = split ' ',$URI{$u} if $URI{$u};
      next if $n<0;
      if ($n>0) {
        add($n*0,"$u in URI-blacklist ($n [".isodate($time)."])");
      }
      if ($ENV{SPAMBLOCK} ne 'TEST' and $sis > $SPAMLEVEL) {
        $URI{$u}++;
        $URI{$u} .= ' '.time();
        if ($d) {
          $URI{$d}++;
          $URI{$d} .= ' '.time();
	}
      }
    }
    #dbmclose %URI;
  }
}

&end;

# wird nicht mehr verwendet, da zu unsicher
sub init_URIdb {
  my ($u,$n,%U);
  
  $/ = "\nFrom ";
  $| = 1;
  $mn = 1;
  
  print "processing mail:\n" unless $opt_v;
  while (<>) {
    unless ($opt_v) {
      print $mn,"\r"; 
      $mn++;
    }
    s/From $//;
    s/(.*?)\n\n//s or next;
    $H = $1;
    $B = $_;
    
    next if $H =~ /\nTo:.*abuse(@|\.net)/i;
    next if $H =~ /\nX-Spamblock: ignored/;
    
    if ($H =~ /\nContent-Transfer-Encoding: base64/) {
      $B = _decode_B($B);
    } elsif ($H =~ /\nContent-Transfer-Encoding: quoted-printable/) {
      $B = _decode_Q($B);
    }
    $B =~ s/=\n//g;

    # letzte 5 Zeilen koennte Werbe-footer vom Webmailer sein
    if (($B =~ tr/\n//) > 20) {
      $B =~ s/((\n.*?){5})$//;
      # $ll = $1; die $B.('='x80).$ll if $ll =~ /\w/;
    } 
    
    while ($B =~ m{((http://|www\.).+?)[<>!\*\&\'\"\s\?\)\n\200-\377]}g) {
      next if $' =~ m:^>?</[aA]>:; #'
      # print ".";
      $u = URI_normalize($1) || next;
      # warn "($u)\n";
      warn "found URI $u\n" if $opt_v;
      if ($u =~ m:(\w[\w\.\-]*\.\w+)[^/]*(/.+/.+|/.{14,})?:) {
        $U{$1}++;
        $U{$2}++ if $2;
      }
    }
  }
  print $mn,"\n" unless $opt_v;
  unless ($opt_n) {
    #  dbmopen %URI,$uridb,0644;
    print "writing $uridb\n";
    unlink $uridb;
    tie %URI,'DB_File',$uridb,O_RDWR|O_CREAT,0644,$DB_HASH or die "$0: $uridb - $!\n";
    open U,">>$uridb" and flock U,2 or die "$0: $!\n";
    $utime = time();
    while (($k,$v) = each %U) {
      $URI{$k} = $v.' '.$utime;
    }
    untie %URI;
    #  dbmclose %URI;
    close U;
  }
}


sub URI_normalize {
  my $u = lc shift;
  return '' if $u !~ /[\w-]+\.\w/ or $u =~ /\b($MYDOMAIN|$Xdomain)(\/|:|$)/o;
  $u =~ s!^http://!!;
  $u =~ s!^[^/]+@!!;
  $u =~ s/[=%]([a-f0-9]{2})/ord($1)/ge;
  $u =~ s/[\w.-]+\.([\w-]+\.($TLD)(\/|:|$))/$1/;
  $u =~ s/[\/\.]$//;
  $u =~ s/^\.//;
  return $u;
}


sub exclude_URIdb {
  open U,">>$uridb" and flock U,2;
  tie %URI,'DB_File',$uridb,O_RDWR,0644,$DB_HASH 
    or die "$0: cannot tie $uridb - $!\n";
  while (<>) {
    chomp;
    $URI{$_} = '-1 '.time();
  }
}


sub dump_URIdb {
  tie %URI,'DB_File',$uridb,O_RDONLY,0644,$DB_HASH 
    or die "$0: cannot tie $uridb - $!\n";
  while (($u,$v) = each %URI) {
    ($n,$t) = split ' ',$v;
    printf "%6d %s %s\n",$n,isodate($t),$u;
  }
}

  
sub init {
  local $_;
  my ($line,$tag);
  
  $TLD = 'org|com|edu|gov|mil|net|info|biz|name|[a-z][a-z]';

  $MYDOMAIN = $ENV{MYDOMAIN} || die "\$MYDOMAIN not set!\n";
  $MYDOMAIN = '('.$MYDOMAIN.')' unless $MYDOMAIN =~ /^\(.*\)$/;;
  
  # Zeitlimit
  $SIG{ALRM} = sub { exit };
  alarm($ENV{TIMEOUT}||60);

  # notfalls anlegen, falls user es vergessen hat
  $local = $ENV{HOME}.'/.spamblock.local';
  unless (-e $local) {
    open $local,">>$local";
    close $local;
  }
  
  $sis = 0;
  $si = '';
  foreach (split($ENV{RS},$ENV{SI})) {
    if (/^\s*([\+\-]?\d+)\s*/) {
      $sis += $1;
      s/\n/ /g;
      $si .= "\t$_\n";
    }    
  }
  
  $FULLCHECK = ($ENV{FULLCHECK}||'') eq 'ok';
  $SPAMLEVEL = $ENV{SPAMLEVEL}||100;
  $MYDOMAIN = $ENV{MYDOMAIN};
  $MYDOMAIN = '('.$MYDOMAIN.')' unless $MYDOMAIN =~ /^\(.*\)$/;;
  $M = '[^\n]';

  foreach $tag (qw(From To X-Mailer Reply-To Message-Id Subject Received
                   Content-Type Content-Transfer-Encoding
		   References In-Reply-To Thread-Index
  		   Mailing-List List-Id List-ID)) {
    @{$H{$tag}} = ();
  }

  $header = $line = <>;
  while (<>) {
    if (/^\s./) {
      $line .= $_;
    } else {
      if ($line =~ s/(.*?):\s//) {
        $tag = lc($1);
        $tag =~ s/\b(.)/uc($1)/eg;
        $line = decode_mimewords($line) if $line =~ /=\?.*\?=/;
        push @{$H{'tags'}},$tag;
        push @{$H{$tag}},$line;
        #print "\n$tag:$line";
      }
      last if /^$/;
      $line = $_;
    }
    $header .= $_;
  }

  push @{$H{'Content-Type'}},'text/plain' unless @{$H{'Content-Type'}};

  undef $/;
  $body_complete = $body = (<>||'');
  $body =~ s/&nbsp;/ /g;
  $body =~ s/^This is a multi-part message.*\n\n--/--/;
#  if ($ENV{SBT}) { die "[$body]" }
  # decode 1. text attachment
  if ($body =~ s/.*?\n?(--......*?)\nContent-Type: text.*?\nContent-Transfer-Encoding: (base64|quoted)//s) {
    my $mb = quotemeta $1;
    my $cte = $2;
    $body =~ s/.*?\n\n//s;
    $body =~ s/$mb(.*)//s and
    $body_rest = $1;
    if ($cte eq 'base64') {
      $body = _decode_B($body);
    } else {
      $body =~ s/=([\dA-F][\dA-F])/chr(hex($1))/ge;
      $body =~ s/=\n//g;
    }
    $body =~ s/&nbsp;/ /g;
    # remove binary data
    $body =~ s/(src=\"data:.*?base64,).*?>/$1***>/g;
    if ($body_rest) {
      $body_rest =~ s/\nContent-Type: (application|image|video).*/\n/s;
      $body .= "\n".$body_rest;
    }
  }
  # binary attachments nicht untersuchen
  $body =~ s/\nContent-Transfer-Encoding: base64.*/\n/is;
  $body =~ s/\nContent-Type: application.*/\n/is;
  
  # forwards nicht untersuchen
  $body =~ s/^(\s?----.*(Forwarded|Original) Message)/$1\n/is;
  
  # Idioten-Signatures abtrennen
  $body =~ s/\n(CONFIDENTIALITY NOTICE|Please consider the environment).*//s;
  
  # base64/qp dekodieren
  if      ($header =~ /\nContent-Transfer-Encoding: base64/i) {
    $body = _decode_B($body);
  } elsif ($header =~ /\nContent-Transfer-Encoding: quoted-printable/i) {
    $body = _decode_Q($body);
    $body =~ s/=\n//g;
  } elsif ($body   =~ /\nContent-Transfer-Encoding: quoted-printable/i) {
    $body =~ s/=([\dA-F][\dA-F])/chr(hex($1))/ge;
    $body =~ s/=\n//g;
  }
  
  # Fuellzeichen rausschmeissen
  # $body =~ s/ ([a-z])[,'`]+([a-z]) /$1$2/igs;
  # $body =~ s/([a-z]+([,`\'\.][a-z]+)+[a-z])/defill($1).$2/igse;
  
  # whitespaces reduzieren
  $body =~ s/\xC2?\xA0/ /g;
}

sub defill {
  local $_ = shift;
  unless (/.+\..+\.($TLD)$/) { 
    # warn $_ if s/[,`\'\.]//g;
    s/[,\`\'\.]//g;
  }
  return $_;
}


# empty text/plain test
sub etp {  
  return ($body =~ m/
        (^|\n)
	--\S+\n
	Content-Type:\stext\/plain.*\n
	(Content-Transfer-Encoding:.*\n)?
        \s*\n
	(\s*(=20)*\n)*
	\n--\S+\n
		 /ix);
}
  
sub end {
  my $n = 0;
  $n++ while ($si =~ /\t \d/g);
  if ($n > 5) {
    add($n*10,"extra penalty because of too many spam indices");
  }
  if ($sis >= $SPAMLEVEL) {
    $header .= "X-Spamblock: caught by spamindex=$sis\n".$si;
  } elsif ($si =~ /\t +?\d+ /) {  
    $header .= "X-Spamblock-maybe: spamindex=$sis\n".$si;
  }
  #print "=====================================================================================\n";
  print $header;
  #print "=====================================================================================\n";
  print "\n";
  print $body_complete;
  exit;
}

sub add { 
  my ($n,$r) = @_;
  $sis += $n;
  $r =~ s/\n/ /g;
  $si .= "\t $n $r \n";
  &end if not $FULLCHECK and $sis >= $SPAMLEVEL;
}

sub test_HELO {
  local $_ = shift;
  my $x = '';
  my $lp = '';

  $lp = $1 if defined($H{'To'}->[0]) and $H{'To'}->[0] =~ /([^ ]{3,})@/;
  if (m/^from\s\Q$lp\E\s\(/) {
    add(100,"faked SMTP HELO $lp");
    return $lp;
  }
  
  if (m/^from\s(
        [0-9a-z\-]+\.[a-z]+|
	(mail\.)?worldnet\.att\.net|
	yahoo\.[a-z\.]+|
      )\s\(([\w\.\-]+\s)*\[.*by .*($MYDOMAIN)/x) {
    $x = $1;
    add(60,"faked SMTP HELO $x") unless /$x \([\w\.\-]*$x/;
  }
  return $x;
}

# test for uppercase and lowercase and numeric
sub lcucnum {
  local $_ = shift;
  return (/\d/ and /[a-z]/ and /[A-Z]/);
}

sub isodate {
  my @d = localtime shift;
  return sprintf('%d-%02d-%02d %02d:%02d:%02d',
                 $d[5]+1900,$d[4]+1,$d[3],$d[2],$d[1],$d[0]);
}

sub _decode_B {
    local($^W) = 0;
    my $str = shift;
    $str =~ tr:A-Za-z0-9+=/::cd;
    $str =~ s/=+$//;
    $str =~ tr:A-Za-z0-9+/: -_:;
    if ($str) {
      return unpack("u",join('',map(chr(32+length($_)*3/4) . $_,
                                $str =~ /(.{1,60})/gs)));
    } else {
      return '';
    }
}

sub _decode_Q {
    my $str = shift;
    $str =~ s/=([\da-fA-F]{2})/pack("C", hex($1))/ge;  # RFC-1522, Q rule 1
    $str =~ s/_/\x20/g;                                # RFC-1522, Q rule 2
    return $str;
}

sub decode_mimewords {
    my $encstr = shift;
    my %params = @_;
    my @tokens;
    $@ = '';           # error-return

    # Collapse boundaries between adjacent encoded words:
    $encstr =~ s{(\?\=)\r?\n[ \t](\=\?)}{$1$2}gs;
    pos($encstr) = 0;
    ### print STDOUT "ENC = [", $encstr, "]\n";

    # Decode:
    my ($charset, $encoding, $enc, $dec);
    while (1) {
	last if (pos($encstr) >= length($encstr));
	my $pos = pos($encstr);               # save it

	# Case 1: are we looking at "=?..?..?="?
	if ($encstr =~    m{\G                # from where we left off..
			    =\?([^?]+)        # "=?" + charset +
			     \?([bq])         #  "?" + encoding +
			     \?([^?]+)        #  "?" + data maybe with spcs +
			     \?=              #  "?="
			    }xgi) {
	    ($charset, $encoding, $enc) = ($1, lc($2), $3);
	    $dec = (($encoding eq 'q') ? _decode_Q($enc) : _decode_B($enc));
	    push @tokens, [$dec, $charset];
	    next;
	}

	# Case 2: are we looking at a bad "=?..." prefix? 
	# We need this to detect problems for case 3, which stops at "=?":
	pos($encstr) = $pos;               # reset the pointer.
	if ($encstr =~ m{\G=\?}xg) {
	    $@ .= qq|unterminated "=?..?..?=" in "$encstr" (pos $pos)\n|;
	    push @tokens, ['=?'];
	    next;
	}

	# Case 3: are we looking at ordinary text?
	pos($encstr) = $pos;               # reset the pointer.
	if ($encstr =~ m{\G                # from where we left off...
			 ([\x00-\xFF]*?    #   shortest possible string,
			  \n*)             #   followed by 0 or more NLs,
		         (?=(\Z|=\?))      # terminated by "=?" or EOS
			}xg) {
	    length($1) or die "MIME::Words: internal logic err: empty token\n";
	    push @tokens, [$1];
	    next;
	}

	# Case 4: bug!
	die "MIME::Words: unexpected case:\n($encstr) pos $pos\n\t".
	    "Please alert developer.\n";
    }
    return (wantarray ? @tokens : join('',map {$_->[0]} @tokens));
}

  
sub sendmail_wldb {

  return q(#!/usr/bin/perl -w

use DB_File;
use Fcntl qw(:DEFAULT :flock);

$wldb = $ENV{HOME}."/.spamblock_wl.db";

if (open $wldb,">>$wldb" and flock $wldb,2) {
  tie %WL,'DB_File',$wldb,O_RDWR|O_CREAT,0600,$DB_HASH;
  foreach $a (@ARGV) {
    $a = lc $a;
    $WL{$a} = $a if $a =~ /@/;
  }
  untie %WL;
}

$sendmail = '/usr/sbin/sendmail -oem -oi';
open $sendmail,"|$sendmail @ARGV" or die $!;

print {$sendmail} $_ while <STDIN>;
);
}


sub mimedecode {
  use Encode;
  use I18N::Langinfo qw'langinfo CODESET'; 

  no warnings 'utf8';

  $ctype = langinfo(CODESET());

  $line = <STDIN>;
  while (<STDIN>) {
    if (/^\s./) {
      $line .= $_;
    } else {
      print $line;
      $line =~ s/\n\s+//gs;
      if ($line =~ /^Subject: (.*)/i) {
        $ss = sprintf("SSubject: %s",decode("MIME-Header",$1));
        $ss =~ s/[\r\n]//g;
        if ($ctype =~ /ISO-8859/) {
          printf "%s\n",utf8decode(encode("utf8",$ss));
        } else {
          printf "%s\n",$ss;
        }
      }
      last if /^$/;
      $line = $_;
    }
  }
  
  print;
  print while <STDIN>;
}

sub utf8decode {
  local $_ = shift;
  s/([\xC0-\xDF])([\x80-\xBF])/chr(ord($1)<<6&0xC0|ord($2)&0x3F)/eg;
  return $_;
}