sb-spamheaders.rc

这是一个从音频信号里提取特征参量的程序

# Headers that always indicate that email is spam.

# SMTP overflow bug exploit
:0
*  ^Received:....................\
......................................................................\
......................................................................\
......................................................................\
......................................................................\
......................................................................\
......................................................................\
......................................................................
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: SMTP overflow bug exploit"

 :0
 { SPAMTAG=yes }
}

# Missing From:
:0
* !^From:
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Missing From:"

 :0
 { SPAMTAG=yes }
}


# Empty From:
:0
* ^From:([ ]$|<[ ]?>$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Empty From:"

 :0
 { SPAMTAG=yes }
}

# Ridiculously Overlong Message-ID:
:0
* ^Message-ID:.*<......................................................................\
                 ......................................................................\
                 ......................................................................*>$
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Ridiculously Overlong Message-ID:"

 :0
 { SPAMTAG=yes }
}


# Fake Pegasus Mail Headers
:0
* ^(Comments:.*Authenticated Sender|\
    X-PMFLAGS:.*)
* !^X-Mailer: Pegasus
{ BOGUSPEGASUS=yes }

:0
* (Errors-To|Return-Path): Pegasus Mail for Win32 (v3.11)
{ BOGUSPEGASUS=yes }

:0
* BOGUSPEGASUS ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Bogus Pegasus Headers"

 :0
 { SPAMTAG=yes }
}

# ISIP modification: this filters out checkin mail and other useful
# mail
#
# Spam Subject Tags
#:0 BH
#* -1000^0
#*  -500^0   ^Subject: Re:
#*  -500^0   ^Subject:.*\(fwd\)$
#*  -500^0   ^Subject:.*\(EOM\)$
#*  -500^0   --.*forwarded message --
#*  -500^0   ^forwarded message:$
#*  -500^0   ^-----BEGIN PGP SIGNED MESSAGE-----
#*  1100^0   ^Subject:.*\([a-z][a-z][a-z][a-z]?[a-z]?[a-z]?[a-z]?\)$
#*  1100^0   ^Subject:.*\([0-9][0-9][0-9]?[0-9]?[0-9]?[0-9]?[0-9]?\)$
#*  1100^0   ^Subject:.*[ ]\-[0-9][0-9][0-9]?[0-9]?[0-9]?[0-9]?[0-9]?$
#*  1100^0   ^Subject:.*[ ]\-[a-z][a-z][a-z]?[a-z]?[a-z]?[a-z]?[a-z]?$
#*   800^0   ^------------------Headers-----------------------$^$^Received:
#{
# :0 f
# | ${FORMAIL} -A"X-SBRule: Spam Subject Tags"
#
# :0
# { SPAMTAG=yes }
#}


# Spam To/CC Headers
:0 BH
* -1000^0
*  -500^0   ^Subject: Re:
*  -500^0   ^Subject:.*\(fwd\)$
*  -500^0   ^Subject:.*\(EOM\)$
*  -500^0   --.*forwarded message --
*  -500^0   ^forwarded message:$
*  -500^0   ^-----BEGIN PGP SIGNED MESSAGE-----
*  -500^0   ^To:.*@
*  1100^0   ^To: ([1-9][0-9][0-9]|\
                  friend|\
                  hk[-0-9][-0-9]*|\
                  user|\
                  you)$
*  1100^0   ^To: (friend@public\.com|\
                  user@[a-z][-_a-z0-9]*\.?(com|net|org)?)([^a-z0-9\.]|$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spam To/CC"

 :0
 { SPAMTAG=yes }
}


# Other Spam Headers
:0 BH
* -1000^0
*  -500^0   ^Subject: Re:
*  -500^0   ^Subject:.*\(fwd\)$
*  -500^0   ^Subject:.*\(EOM\)$
*  -500^0   --.*forwarded message --
*  -500^0   ^forwarded message:$
*  -500^0   ^-----BEGIN PGP SIGNED MESSAGE-----
*  1100^0   ^------------------Headers-----------------------$^$^Received:
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Other Spam Headers"

 :0
 { SPAMTAG=yes }
}


# Ybecker.net stuff
#
#   The domain "ybecker.net" was used by an obsolete spamware
#   package that hasn't been used much for years.  It was later
#   registered by Steve Sobol and company to educate people 
#   about spam, but has since been taken down as well.  There
#   is no outgoing email from this domain, so anything that
#   appears to be from ybecker.net is bogus.
:0
*  ^(From.|Message-ID:|Received:|Reply-To:).*ybecker\.net([^a-z0-9\.]|$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Ybecker/Spam Software"

 :0
 { SPAMTAG=yes }
}


# Nuke Invalid IP
:0
* ^Received.*\[[0-9\.]*([03-9][0-9][0-9]|2[6-9][0-9]|25[6-9])\]([^a-z0-9\.]|$)
* !^Received.*\[[0-9\.]*([03-9][0-9][0-9]|2[6-9][0-9]|25[6-9])\.4[0-9][0-9][0-9][0-9]\] ident=root
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Invalid IP"

 :0
 { SPAMTAG=yes }
}