sb-spamsw.rc

这是一个从音频信号里提取特征参量的程序

* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
* -1000^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*   500^1   composed using NICErsPRO Total Solution Email
*   500^1   http://www\.nicers\.com
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spam Mailer/NicersPro"

 :0
 { SPAMTAG=yes }
}


# Product Link bulk emailer
:0 BH
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
* -1000^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*   500^0   ^From:.*product link
*   500^1   we are product link
*   200^1   805[-\. )]*654[-\. ]*4042
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spam Mailer/Product Link"

 :0
 { SPAMTAG=yes }
}


# QuickSMTP
:0
* ^X-Mailer:.*QuickSMTP
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: QuickSMTP"

 :0
 { SPAMTAG=yes }
}


# Rapid Fire Mail Server (RFMS)
:0 BH
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
* -1000^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*  1000^0   !^From:
*  1000^0   ^From:[ ]?$
*   500^0   !^To:
*   500^0   ^To:[ ]?$
*   800^1   Rapid Fire Mail Server
*   600^1   RFMS
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spam Mailer/RFMS"

 :0
 { SPAMTAG=yes }
}


# Safeguard
:0 BH
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
* -1000^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*   500^0   ^From:[ ]safeguard[0-9]*@
*   500^0   ^X-MDRemoteIP:
*   500^0   ^X-MDaemon-Deliver-To:
*   800^1   Source Code 2002 Safeguard
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spam Mailer/Safeguard"

 :0
 { SPAMTAG=yes }
}


# Stealth Mailer Classic :(
:0
*  ^Received:.*(SMTP id GAA.*-0600 \(EST\)([^a-z0-9\.]|$)|\
               \(8\.8\.5\/8\.6\.5\))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spam Mailer/Stealth Classic"

 :0
 { SPAMTAG=yes }
}


# Stealth mailer -- New & "Improved" :( :<
:0
*  ^Received:.*-0700 \(EDT\)([^a-z0-9\.]|$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spam Mailer/Stealth New"

 :0
 { SPAMTAG=yes }
}


# TDS Mailer (TO/DATE/SUBJECT)
:0 D
* ^(TO:)
* ^(DATE:)
* ^(SUBJECT:)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spam Mailer/TDS"

 :0
 { SPAMTAG=yes }
}


# DS Mailer (DATE/SUBJECT)
:0 D
* !^(T[Oo]:)
* ^(DATE:)
* ^(SUBJECT:)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spam Mailer/DS"

 :0
 { SPAMTAG=yes }
}


# X-EM Mailer
:0
* ^X-EM-Version:
* ^X-EM-Registration:
{ XEM=yes }

:0
* LEANTAG ?? no
* !XEM ?? yes
{
 :0 BH
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 * -1000^0   ^Subject: Re:
 *  -200^1   ^[:;#>]
 *   500^0   ^\<\!\-\- Please Read! If you are reading this then that means
 *   500^0   an HTML capable e-mail client
 *   500^0   you are not viewing this message as(.*$)+it should be
 *   500^0   Please send an email to services@maxir(\.|=2E)com with Remove(.*$)+as the subject
 *   500^0   ^\<base href=.?.?\"http://.*\"\>(.*$)+(.*$)+^\<\!\-\- Start Top Banner \-\-\>$
 { XEM=yes }
}

:0
* XEM ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spam Mailer/XEM"

 :0
 { SPAMTAG=yes }
}


# Zenith Bulk Emailer (RFMS)
:0 BH
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
* -1000^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*  1000^0   ^X-Info:.*Zenith Bulk Emailer
*   500^1   Zen Bulk Emailer
*   500^1   212[-\. )]*208[-\. ]*2904
*   500^1   +44[-\. (]*01[-\. )]*772[-\. ]*492507
*   300^1   FireFox Freeware
*   200^1   RFMS
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spam Mailer/Zenith"

 :0
 { SPAMTAG=yes }
}


# Mailer with Random X-Mailer Header string
:0
* ^X-Mailer: [a-z0-9][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.][a-z0-9\.]
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spam Mailer/Random X-Mailer"

 :0
 { SPAMTAG=yes }
}


# Mailer with "This is an HTML message" text section...
:0 B
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
* -1000^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*  1100^0   ^..... This is an HTML Message \! .....$
*  1100^0   ^这是一个HTML格式的邮件/This is a html format mail$
*  1100^0   $^$^Please use MIME-capable reader\.$
*   800^0   ^If you are reading this message, your email browser does not support$
*   800^0   ^HTML formatting\.  Please disregard the HTML code below this message\.$
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spam Mailer/Body Text"

 :0
 { SPAMTAG=yes }
}


# Other Spam Software X-Mailer: headers
:0
* ^X-(Mailer|Server): (.*\{\%xmailer\%\}|\
              .*[0-9]+KingInfo_Mailer|\
              .*6.0 sub|\
              .*Accucast|\
              .*ArGoSoft MX Mailer|\
              .*Aristotle|\
              .*BallSacMailer|\
              .*BulkMailer|\
              .*cgiemail|\
              .*CSM[ ]|\
              .*dd <[0-9][0-9]>|\
              .*Direct Email|\
              .*eBizmailer|\
              .*E-Mail Connection|\
              .*eMerge|\
              .*Envex|\
              .*FletMail|\
              .*GoldMine|\
              .*Jackpot|\
              .*JBH Msender|\
              .*jfmailer|\
              .*Kaufman Mail Warrior|\
              .*KingInfo_Mailer|\
              .*Mach5|\
              .*Mail Bomber|\
              .*Mailchute|\
              .*Mailer Signature|\
              .*MailKing|\
              .*MailWorkZ|\
              .*MailXSender|\
              .*MassE-Mail|\
              .*massmail\.pl|\
              .*Mega-Mailer|\
              .*Millennium Mailer|\
              .*Mindcast|\
              .*MMailer|\
              .*Mozzila|\
              .*Multimailer|\
              .*Odulo BulkMail Master|\
              .*QuickSender|\
              .*RIME|\
              .*Robot-Mail|\
              .*RoryMAILER|\
              .*Sir Mail-A-Lot|\
              .*StormPost|\
              .*Telesale|\
              .*The HARVESTER|\
              .*V3,1,6,1|\
              .*WC Mail __ty__|\
              .*WinNT\'s Blat|\
              .*X-Mailer|\
              .*YDH_optin_v[0-9].[0-9]|\
              .*yougotit)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spam X-Mailer"

 :0
 { SPAMTAG=yes }
}

# Spam Software -- other header stigmata
:0
* (^Content-Type: Commercial E-Mail|\
   ^Content-type: .*boundary=.?\#MYBOUNDARY\#|\
   ^Message-ID: <private\.company\.and\.not\.an\.ISP>|\
   ^Received:.*ALLINTERNETUSERS|\
   ^Received:.*CLOAKED|\
   ^Received: from bulkserver|\
   ^Received:.*spam\.master|\
   ^Received:.*(^|[^-_0-9a-z])stealth([ ]|$)|\
   ^Received:.*--- unknown host ---|\
   ^Received:.*Wakeup|\
   ^Received:.*young-crook-|\
   ^Status: MC|\
   ^To: friends?@public\.com([^a-z0-9\.]|$)|\
   ^To.*(^|[^-_0-9a-z])user@|\
   ^To.*(^|[^-_0-9a-z])your?@|\
   ^To.*yourdomain\.com([^a-z0-9\.]|$)|\
   ^To.*WebSiteOwner@|\
   ^To: XXXXXX|\
   ^X-Advertisement:|\
   ^X-Distribution: Mass|\
   ^X-#:|\
   ^X-Info: Antro Promotions|\
   ^X-Info: mailto:.* in case of spamming!|\
   ^X-visit: http://www\.WebPromote\.com/|\
   ^X-IdiRosNa: |\
   ^X-UtuBasAga: |\
   ^X-HrAga: |\
   ^X-BasUtuNaTeg: )
* !^Received.*stealth\.net([^a-z0-9\.]|$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spam Software Header Stigmata"

 :0
 { SPAMTAG=yes }
}


# Spam Software -- body stigmata
#
:0 BH
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*  -600^1    ^Subject:.*spam
*   800^0    (^|[^-_0-9a-z])This message has been sent using a trial-run version([^a-z0-9\.]|$)
*   800^0    (^|[^-_0-9a-z])TSmtpRelayServer([^a-z0-9\.]|$)
*   800^0    (^|[^-_0-9a-z])TSmtpRelayServer([^a-z0-9\.]|$)
*   800^0    ()<!-- iServe\.com\.hk \.\.\. This page is encripted
*   800^0    ()<!-- Written by Chris Chan
*   800^0    ()<!-- All Rights Reserved by iServe Worldwide Ltd\. -->
*   800^0    ()\(This safeguard is not inserted when using the registered version\)
*   500^0    (^|[^-_0-9a-z])This message contains an HTML formatted message but your email([^a-z0-9\.]|$)
*   500^0    (^|[^-_0-9a-z])client does not support the display of HTML\. Please view this message in a([^a-z0-9\.]|$)
*   500^0    (^|[^-_0-9a-z])different mail client or forward this email to a web-based mail system([^a-z0-9\.]|$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spam Software Body Stigmata"

 :0
 { SPAMTAG=yes }
}