# Local SA rules for Inder.Net # License: Artistic - see http://www.rulesemporium.com/license.txt # Current Maintainer: Mads Peter Bach # These rules are based on spam characteristics we have observed. # You'll probably wish to lower the score of these rules, until # you're comfortable with them. # # You'll need to change inder.net in the SPAM_SRC rule to your own mailserver header MSGID_DASH MESSAGEID =~ /\-\-.+/ describe MSGID_DASH Message ID contains multiple dashes score MSGID_DASH 0.5 header MSGID_DOLLAR MESSAGEID =~ /\$.+\$/ describe MSGID_DOLLAR Message ID contains $$ score MSGID_DOLLAR 0.5 meta MSGID_DASH_DOLLAR (MSGID_DASH + MSGID_DOLLAR) describe MSGID_DASH_DOLLAR Message ID contains multiple dashes and $$ score MSGID_DASH_DOLLAR 2 header MSGID_RAND MESSAGEID =~ /Pine.+\$rand.+\$rand/ describe MSGID_RAND Message ID contains $rand score MSGID_RAND 15 header SPAM_SRC Received =~ /(HSE[\w\.\-]+sympatico.ca|node[\w\.\-]+a2000.nl|c\-[\w\.\-]+client.comcast.net|A[\w\.\-]+abo.wanadoo.fr|dsl.telesp.net.br|c\-[\w\.\-]+attbi.com|cpe[\w\.\-]+rr.com|dsl-verizon.net|pcp[\w\.\-]+comcast.net|pool.*verizon.net|ipt.aol.com|dsl[\w\.\-]+ameritech.net|dyn.optonline.net|cable.mindspring.com|cliente[\w\.\-]+supercable.es|cable[\w\.\-]+blueyonder.co.uk|client2.attbi.com|pooles.rima-tde.net|veloxzone.com.br|dsl.cnc.net|exchng[\w\.\-]+reliablehosting.com).* by .*inder.net/ describe SPAM_SRC Received from a frequent spam source score SPAM_SRC 2