-
Notifications
You must be signed in to change notification settings - Fork 2
/
Copy path99_misc.cf
85 lines (64 loc) · 2.58 KB
/
99_misc.cf
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
#
# Misc rules
#
describe LOCAL_DEAR_TAXPAYER Detect phishing mails for taxpayers
body LOCAL_DEAR_TAXPAYER /Lieve belastingbetaler,/
score LOCAL_DEAR_TAXPAYER 1.5
describe LOCAL_X_CCMID X-CcmId header
header LOCAL_X_CCMID X-CcmId =~ /.+/
score LOCAL_X_CCMID 1.0
describe LOCAL_X_REPORT_ABUSE X-Report-Abuse header
header LOCAL_X_REPORT_ABUSE X-Report-Abuse =~ /Please report abuse of this campaign/
score LOCAL_X_REPORT_ABUSE 1.0
describe LOCAL_LIST_UNSUBSCRIBE Known list-unsubscribe for marketeers
header LOCAL_LIST_UNSUBSCRIBE List-Unsubscribe =~ /(news\.lead-er\.nl|marketing-email\.info|nailchimp\.com)/
score LOCAL_LIST_UNSUBSCRIBE 0.5
describe LOCAL_MARKETEERSITE Known list-unsubscribe for marketeers
header LOCAL_MARKETEERSITE rawbody =~ /(news\.lead-er\.nl|www\.serc\.nl)/
score LOCAL_MARKETEERSITE 0.5
describe LOCAL_SCAM_1 Keyword used of scams
body LOCAL_SCAM_1 /overleden/
score LOCAL_SCAM_1 0.1
describe LOCAL_SCAM_2 Keyword used of scams
body LOCAL_SCAM_2 /buitenlandse investeerder/
score LOCAL_SCAM_2 0.1
describe LOCAL_SCAM_3 Keyword used of scams
body LOCAL_SCAM_3 /SugarCRM/
score LOCAL_SCAM_3 0.1
describe LOCAL_SCAM_4 Keyword used of scams
body LOCAL_SCAM_4 /jackpot/
score LOCAL_SCAM_4 0.3
describe LOCAL_SCAM_5 Keyword used of scams
body LOCAL_SCAM_5 /gefeliciteerd/
score LOCAL_SCAM_5 0.1
describe LOCAL_SCAM_6 Keyword used of scams
body LOCAL_SCAM_6 /gratis/
score LOCAL_SCAM_6 0.1
describe LOCAL_SCAM_7 Keyword used of scams
body LOCAL_SCAM_7 /bonus/
score LOCAL_SCAM_7 0.1
describe LOCAL_SCAM_8 Keyword used of scams
body LOCAL_SCAM_8 /gewonnen/
score LOCAL_SCAM_8 0.1
describe LOCAL_SCAM_9 Keyword used of scams
body LOCAL_SCAM_9 /kraskaarten/
score LOCAL_SCAM_9 0.3
describe LOCAL_SCAM_10 Keyword used of scams
body LOCAL_SCAM_10 /3V/
score LOCAL_SCAM_10 0.1
describe LOCAL_SCAM_11 Keyword used of scams
body LOCAL_SCAM_11 /3V Payment Group/
score LOCAL_SCAM_11 0.5
describe LOCAL_SCAM_12 Keyword used of scams
body LOCAL_SCAM_12 /3V Card/
score LOCAL_SCAM_12 0.5
describe LOCAL_NEWSLETTER Escalate certain newsletters
describe LOCAL_NEWSLETTER Escalate certain newsletters
header __LOCAL_NEWSLETTER_1 X-Priority =~ /3/
header __LOCAL_NEWSLETTER_2 X-Mailer =~ /PHPMailer/
body __LOCAL_NEWSLETTER_3 /nieuwsbrief/
meta LOCAL_NEWSLETTER ( __LOCAL_NEWSLETTER_1 && __LOCAL_NEWSLETTER_2 && __LOCAL_NEWSLETTER_3 )
score LOCAL_NEWSLETTER 0.5
describe LOCAL_NEWSLETTER_SPF Escalate certain newsletters
meta LOCAL_NEWSLETTER_SPF ( __LOCAL_NEWSLETTER_1 && __LOCAL_NEWSLETTER_2 && __LOCAL_NEWSLETTER_3 && SPF_PASS )
score LOCAL_NEWSLETTER_SPF 0.5