sb_isip_blockheaders.rc

这是一个从音频信号里提取特征参量的程序

# Headers which usually indicate spam, but not always.

# Subject: line with too many blank spaces
:0
*  ^Subject:.*[ ][ ][ ][ ][ ][ ][ ][ ]
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Subject w/too many blanks"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Subject: line with too many periods in a row
:0
*  ^Subject:.*\.[ ]?\.[ ]?\.[ ]?\.[ ]?\.[ ]?
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Subject w/too many periods"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Subject: line with too many question marks in a row
:0
*  ^Subject:.*\?[ ,.!]?\?[ ,.!]?\?[ ,.!]?\?
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Subject w/too many question marks"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Malformed Content-Type: header
:0
*  ^Content-Type:[ ].*;.*;.*;.*;.*;.*;
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Malformed Content-Type: header"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Spammy From:/Reply-To:
:0
* ^(From.|Reply-To:).*[^0-9a-z](255\.255\.255\.|\
          ad(vertise)?(r|ment)?(s)?@|\
          anon(ymous)?@|\
          x[0-9][0-9]x@|\
          [^a-z]friend.*@|\
          .*@.*friend|\
          InternetEx@Picture\.scan\.com|\
          make@.*money.com|\
          no@reply([^a-z0-9\.]|$)|\
          noreply@([^a-z0-9\.]|$)|\
          noone@nowhere\.net([^a-z0-9\.]|$)|\
          noreply@([^a-z0-9\.]|$)|\
          .*offer.*@([^a-z0-9\.]|$)|\
          .*@proxy?.\.ba\.best\.com([^a-z0-9\.]|$)|\
          info(rmation)?@.*internet\.net([^a-z0-9\.]|$)|\
          Reply@By\.Mail([^a-z0-9\.]|$)|\
          usethe800number@|\
          waiting@thephone\.now([^a-z0-9\.]|$)|\
          Weight Loss|\
          Worldwide\.Network\.Association([^a-z0-9\.]|$)|\
          yourdomain\.com([^a-z0-9\.]|$)|\
          .*@[a-z]*\.[a-z]*\.earthlink\.net([^a-z0-9\.]|$)|\
          .*@.Cust..?\.[0-9a-z]*\.[0-9a-z]*\.[0-9a-z][0-9a-z]\.uu\.net([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spammy From/Reply-To"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Unqualified recipient (no @ sign in To: field) from outside sender
:0
{ RUNCHECK=yes }

#:0
#* ? ${TEST} -f ${LOCALHOSTFILE} && (${FORMAIL} -zxFrom: -zxReply-To: | ${GREP} -i -f ${LOCALHOSTFILE})
#{ RUNCHECK=no }

:0
* !^To:
{ RUNCHECK=no }

:0
* RUNCHECK ?? yes
* !^To:.*@
* !^To:.*undisclosed.*recipients?
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Unqualified Recipient Address/Outside Sender"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Other headers typical of spam
:0
* !^From:.*[e-mail]([^a-z0-9\.]|$)
* !^Received.*stealth\.net([^a-z0-9\.]|$)
* (^Content-type: .*boundary=.?\#MYBOUNDARY\#|\
   ^Status: MC|\
   ^Subject:.*% (discount|off)|\
   ^Subject: \[ a d v \]|\
   ^To: @|\
   ^To: you$|\
   ^To.*(any|no|some)(one|body)@|\
   ^X-#:|\
   ^X-Set:)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Other Spammy Headers"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}