# SpamAssassin rules file: known spam mailers
#
# Sometimes these leave 'sent by mailername' fingerprints in the
# headers, which provide a nice way for us to catch them.
#
# Please don't modify this file as your changes will be overwritten with
# the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead.
# See 'perldoc Mail::SpamAssassin::Conf' for details.
#
# Note that the tests which look at the "ALL" pseudoheader are quite
# the specific header, as that's much quicker.
#
###########################################################################

#   0.614    1.480    0.090    0.94    2.00  RATWARE_EGROUPS
#   0.347    0.904    0.010    0.99    2.00  RATWARE_HASH_2
#   0.141    0.366    0.004    0.99    2.00  RATWARE_JPFREE
#   0.149    0.366    0.018    0.95    2.00  RATWARE_GROUPMAIL
#   0.074    0.197    0.000    1.00    2.00  RATWARE_VC_IPA
#   0.064    0.168    0.001    0.99    2.00  RATWARE_GR
#   0.059    0.156    0.000    1.00    3.00  RATWARE_OE_PI
#   0.056    0.148    0.000    1.00    2.00  RATWARE_STORM
#   0.055    0.147    0.000    1.00    2.00  RATWARE_JIXING
#   0.054    0.143    0.000    1.00    2.00  RATWARE_SCREWUP_1
#   0.041    0.109    0.000    1.00    2.00  RATWARE_MMAILER
#   0.045    0.117    0.001    0.99    1.00  RATWARE_OE_MALFORMED
#   0.038    0.102    0.000    1.00    2.00  RATWARE_EVAMAIL
#   0.041    0.107    0.001    0.99    2.00  RATWARE_SCREWUP_2
#   0.026    0.070    0.000    1.00    2.00  RATWARE_IMKTG
#   0.025    0.067    0.000    1.00    2.00  RATWARE_XMAILER
#   0.013    0.035    0.000    1.00    2.00  RATWARE_POWERC
#   0.008    0.022    0.000    1.00    2.00  RATWARE_DIFFOND
#   0.005    0.012    0.000    1.00    2.00  RATWARE_CHARSET
#   0.004    0.010    0.000    1.00    2.00  RATWARE_CARETOP
#   0.002    0.006    0.000    1.00    2.00  RATWARE_LC_OUTLOOK
#   0.001    0.003    0.000    1.00    1.00  RATWARE_39
header RATWARE_EGROUPS		X-Mailer =~ /eGroups Message Poster/
describe RATWARE_EGROUPS	Bulk email software fingerprint (eGroups) found in headers
header RATWARE_HASH_2		X-Mailer =~ /^[A-Za-z0-9\._]{16,}$/
describe RATWARE_HASH_2		Bulk email software fingerprint (hash 2) found in headers
header RATWARE_JPFREE		X-Mailer =~ /jpfree Group Mail Express/
describe RATWARE_JPFREE		Bulk email software fingerprint (jpfree) found in headers
header RATWARE_GROUPMAIL	ALL =~ /Group Mail/
describe RATWARE_GROUPMAIL	Bulk email software fingerprint (Group Mail) found in headers
header RATWARE_VC_IPA		X-Mailer =~ /2\.0-b55-VC_IPA/
describe RATWARE_VC_IPA		Bulk email software fingerprint (VC_IPA) found in headers
header RATWARE_GROUPMAIL	ALL =~ /Group Mail/
describe RATWARE_GROUPMAIL	Bulk email software fingerprint (Group Mail) found in headers
header RATWARE_GR		X-Mailer =~ /GRMessageQueue/
describe RATWARE_GR		Bulk email software fingerprint (GRMessageQueue) found in headers
header RATWARE_OE_PI		X-Mailer =~ /Out[Ll]ook Express 3\.14159/
describe RATWARE_OE_PI		X-Mailer contains "OutLook Express 3.14159"
header RATWARE_STORM		X-Mailer =~ /StormPost/
describe RATWARE_STORM		Bulk email software fingerprint (StormPost) found in headers
header RATWARE_JIXING		X-Mailer =~ /JiXing .{0,30}Design By JohnnieHuang/
describe RATWARE_JIXING		Bulk email software fingerprint (JiXing) found in headers
header RATWARE_SCREWUP_1	X-Mailer =~ /^X-Mailer: /
describe RATWARE_SCREWUP_1	Bulk email software fingerprint (screwup 1) found in headers
header RATWARE_MMAILER		X-Mailer =~ /MMailer v3\.0/
describe RATWARE_MMAILER	Bulk email software fingerprint (MMailer) found in headers
header RATWARE_OE_MALFORMED	X-Mailer =~ /^Microsoft Outlook Express \d(?:\.\d+){3} \w+$/
describe RATWARE_OE_MALFORMED	X-Mailer contains malformed Outlook Express version
header RATWARE_EVAMAIL		X-Mailer =~ /EVAMAIL/
describe RATWARE_EVAMAIL	Bulk email software fingerprint (EVAMAIL) found in headers
header RATWARE_SCREWUP_2	X-Mailer =~ /^: /
describe RATWARE_SCREWUP_2	Bulk email software fingerprint (screwup 2) found in headers
header RATWARE_IMKTG		ALL =~ /Internet Marketing/
describe RATWARE_IMKTG		Bulk email software fingerprint (IMktg) found in headers
header RATWARE_XMAILER		X-Mailer =~ /{%xmailer%}/
describe RATWARE_XMAILER	Bulk email software fingerprint (xmailer tag) found in headers
header RATWARE_POWERC		X-Mailer =~ /PowerCampaign/
describe RATWARE_POWERC		Bulk email software fingerprint (PowerCampaign) found in headers
header RATWARE_DIFFOND		ALL =~ /DiffondiCool/
describe RATWARE_DIFFOND	Bulk email software fingerprint (DiffondiCool) found in headers
header RATWARE_CHARSET		X-Mailer =~ /\Qcharset(89)\E/
describe RATWARE_CHARSET	Bulk email software fingerprint (charset) found in headers
header RATWARE_CARETOP		X-Mailer =~ /Caretop 2604/
describe RATWARE_CARETOP	Bulk email software fingerprint (Caretop) found in headers
header RATWARE_LC_OUTLOOK	X-Mailer =~ /^outlook$/
describe RATWARE_LC_OUTLOOK	Bulk email software fingerprint ("outlook") found in headers
header RATWARE_V3161		ALL =~ /V3,1,6,1/
describe RATWARE_V3161		Bulk email software fingerprint (V3161) found in headers
header RATWARE_EMWAC		Received =~ /EMWAC SMTPRS/
describe RATWARE_EMWAC		Bulk email software fingerprint ("EMWAC SMTPRS") found in headers