1863 header NO_REAL_NAME From =~ /^[\"\\s]*\\?\\s*$/ header FROM_ENDS_IN_NUMS From =~ /\\d\\d\\@/ header FROM_STARTS_WITH_NUMS From =~ /^\\d\\d/ header FROM_HAS_MIXED_NUMS From =~ /\\d+[a-z]+\\d+\\S*@/i header FROM_NO_USER From =~ /(?:^\\@|<\\@| \\@[^<]*$|<>)/ [if-unset: unset@unset.unset] header FROM_NAME_NO_SPACES From =~ /(^(?!=\\?)\\S+\\s*<\\S+\\@\\S+>|\\(\\S+\\)$)/ header TO_NO_USER To =~ /(?:^\\@|<\\@| \\@[^<]*$|<>)/ [if-unset: unset@unset.unset] header TO_MALFORMED To !~ /(?:(?:\\\"[^\\\"]+\\\"|\\S+)\\@\\S+\\.\\S+|undisclosed-recipients:|<\\S+(\\!\\S+){1,}>)/ [if-unset: unset@unset.unset] header TO_LOCALPART_EQ_REAL To =~ /^\\s*(\\\"?)([\\w%\\+\\-=_\\.]+)\\1\\s*<\\2\\@[\\w%\\+\\-=_\\.]+>/i header FROM_MALFORMED From !~ /(?:\\\"[^\\\"]+\\\"|\\S+)\\@\\S+\\.\\S+|<\\S+(\\!\\S+){1,}>/ [if-unset: unset@unset.unset] header PLING Subject =~ /!/ header PLING_PLING Subject =~ /!!!+/ header SUBJ_HAS_UNIQ_ID eval:check_for_unique_subject_id() header SUBJ_HAS_SPACES Subject =~ /(?:\\s{6,}|\\t)/ header UNDISC_RECIPS To =~ /^undisclosed-recipients?:\\s*;$/ header FAKED_UNDISC_RECIPS To =~ /Undisclosed.*Recipient(s[^:]|[^s])/i header TO_INVESTORS To =~ /\\bInvestors\\@/ header SUBJ_ALL_CAPS eval:subject_is_all_caps() header SUBJ_MISSING Subject !~ /\\S/ header MSGID_HAS_NO_AT Message-Id !~ /\\@/ [if-unset: NO@MSGID] header MSGID_SPAMSIGN_1 Message-Id =~ /^<[0-9a-f]{12,12}\\$[0-9a-f]{8,8}\\$[0-9a-f]{8,8}\\@>$/ header MSGID_CHARS_SPAM Message-Id =~ /[\\#:}{,!\\/]/ header MSGID_CHARS_WEIRD Message-Id =~ /[\"=\\\\~]/ header INVALID_MSGID Message-Id !~ /^<(?:\\\".+\\\"|[^\\s]+)\\@(?:\\[.+\\]|[^\\s]+)>$/ [if-unset: ] header INVALID_DATE Date !~ /^((Sun|Mon|Tue|Wed|Thu|Fri|Sat), )?([\\d ]?\\d) (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (\\d\\d|\\d\\d\\d\\d) \\d\\d:\\d\\d(:\\d\\d)? (UT|[A-Z]{3,5}|[+-]\\d\\d\\d\\d)(\\s+\\(.*\\))?\\s*$/ header INVALID_DATE_TZ_ABSURD Date =~ /[-+](?:1[4-9]\\d\\d|[2-9]\\d\\d\\d)$/ header DATE_YEAR_ZERO_FIRST Date =~ /[a-z]\\s+0\\d\\d\\d(\\s|$)/ header DATE_IN_PAST_03_06 eval:check_for_shifted_date('-6', '-3') header DATE_IN_PAST_06_12 eval:check_for_shifted_date('-12', '-6') header DATE_IN_PAST_12_24 eval:check_for_shifted_date('-24', '-12') header DATE_IN_PAST_24_48 eval:check_for_shifted_date('-48', '-24') header DATE_IN_PAST_48_96 eval:check_for_shifted_date('-96', '-48') header DATE_IN_PAST_96_XX eval:check_for_shifted_date('undef', '-96') header DATE_IN_FUTURE_03_06 eval:check_for_shifted_date('3', '6') header DATE_IN_FUTURE_06_12 eval:check_for_shifted_date('6', '12') header DATE_IN_FUTURE_12_24 eval:check_for_shifted_date('12', '18') header DATE_IN_FUTURE_24_48 eval:check_for_shifted_date('24', '48') header DATE_IN_FUTURE_48_96 eval:check_for_shifted_date('48', '96') header DATE_IN_FUTURE_96_XX eval:check_for_shifted_date('96', 'undef') header SUBJ_HAS_Q_MARK Subject =~ /\\?.{2,}$/ header SUBJ_ENDS_IN_Q_MARK Subject =~ /\\?+\\s*$/ header ADVERT_CODE Subject =~ /(^\\s*|\\s+)ADV([\\s:-]|$)/i header KOREAN_UCE_SUBJECT Subject =~ /[({[<] *(\\xbc\\xba\\xc0\\xce)?\\xb1\\xa4( *|\\x2e)\\xb0\\xed *[)}\\]>]/ header FRIEND_AT_PUBLIC To =~ /(yourdomain|you|your|public).(com|org|net)/i header DOMAIN_SUBJECT Subject =~ /(\\s(\\.|dot\\s+)(info|biz|name)|domain)\\b.*(extension|info|regist(ry|ration|er)|submission)/i header TO_EMPTY To =~ /^(?:\\@|\\s*$)/ [if-unset: UNSET] header REPLY_TO_EMPTY Reply-To =~ /^(?:\\@|\\s*$)/ [if-unset: UNSET] header ALL_CAPS_HEADER ALL =~ /\\n(?:TO|FROM|SUBJECT|DATE):/s header X_UIDL_SPAMSIGN X-UIDL =~ /[^\\s\\x21-\\x7E]/ header NO_MX_FOR_FROM eval:check_for_from_mx() header KNOWN_BAD_DIALUPS eval:check_for_bad_dialup_ips() header FROM_AND_TO_SAME eval:check_for_from_to_equivalence() header BAD_HELO_WARNING eval:check_for_bad_helo() header SUBJ_FULL_OF_8BITS eval:check_subject_for_lotsa_8bit_chars() header MDAEMON_2_7_4 Received =~ /with SMTP .MDaemon.v2.7.SP4.R./ header FAKED_IP_IN_RCVD Received =~ /from [-0-9a-z\\._]+_\\[\\d+\\.\\d+\\.\\d+\\.\\d+\\] /i header SMTPD_IN_RCVD Received =~ /\\(SMTPD32-\\d+\\..+\\)/ header POST_IN_RCVD Received =~ / Post\\.(?:sk|cz)/ header RCVD_IN_OSIRUSOFT_COM rbleval:check_rbl('osirusoft', 'relays.osirusoft.com.') header X_OSIRU_SPAM_SRC rbleval:check_rbl_results_for('osirusoft', '127.0.0.4') header X_OSIRU_SPAMWARE_SITE rbleval:check_rbl_results_for('osirusoft', '127.0.0.6') header X_OSIRU_DUL_FH rbleval:check_rbl('osirusoft-dul-firsthop', 'dialups.mail-abuse.org.') header RCVD_IN_RELAYS_ORDB_ORG rbleval:check_rbl('relay', 'relays.ordb.org.') header RCVD_IN_VISI rbleval:check_rbl('relay', 'relays.visi.com.') header RCVD_IN_ORBS rbleval:check_rbl('relay', 'orbs.dorkslayers.com.') header RCVD_IN_DSBL rbleval:check_rbl('relay', 'list.dsbl.org') header RCVD_IN_MULTIHOP_DSBL rbleval:check_rbl('multihop', 'multihop.dsbl.org') header X_RCVD_IN_UNCONFIRMED_DSBL rbleval:check_rbl('relay', 'unconfirmed.dsbl.org') header RCVD_IN_RFCI rbleval:check_rbl('rfci', 'ipwhois.rfc-ignorant.org.') header RCVD_IN_BL_SPAMCOP_NET rbleval:check_rbl('spamcop', 'bl.spamcop.net.') header RCVD_IN_RBL rbleval:check_rbl('rbl', 'blackholes.mail-abuse.org.') header RCVD_IN_RSS rbleval:check_rbl('relay', 'relays.mail-abuse.org.') header RCVD_IN_DUL rbleval:check_rbl('dialup', 'dialups.mail-abuse.org.') header X_RCVD_IN_DUL_FH rbleval:check_rbl('dialup-firsthop', 'dialups.mail-abuse.org.') header FUDGE_DUL_MAPS_OSIRU rblreseval:check_two_rbl_results('osirusoft', \"127.0.0.3\", 'dialup', \"127.0.0.3\") header FUDGE_RELAY_OSIRU rblreseval:check_two_rbl_results('osirusoft', \"127.0.0.2\", 'relay', \"127.0.0.2\") header FUDGE_DUL_OSIRU_FH rblreseval:check_two_rbl_results('osirusoft-dul-firsthop', \"127.0.0.3\", 'dialup-firsthop', \"127.0.0.3\") header FUDGE_MULTIHOP_RELAY rblreseval:check_two_rbl_results('multihop', \"127.0.0.2\", 'relay', \"127.0.0.2\") header FORGED_RCVD_FOUND ALL =~ /\\n(?:To|Importance|Content-Transfer-Encoding|Content-Type|Subject|X-Mailer|X-MSMail-Priority|X-Sender):.*\\nReceived: /s header YR_MEMBERSHIP_EXCH Subject =~ /Your Membership Exchange/ header LOTS_OF_CC_LINES eval:check_lots_of_cc_lines() 0