require ["body","fileinto","envelope"]; # rule:[SPAM - Flagged] if header :contains "X-Spam-Flag" "YES" { fileinto "INBOX.SPAM"; stop; } # rule:[known SPAM - SPF reply - from] if anyof (header :contains "from" ["alpoz.com","beycloud.net"], header :contains "subject" ["Undelivered Mail Returned to Sender","Delivery Status Notification"]) { fileinto "INBOX.SPAM"; stop; } # rule:[Mail was processed by an unknown host or a host that is often used for Spams] if header :matches "Received" ["from *otvk.pl (*?)","from localhost.localdomain (*?)","from shawcable.net (*?)"] { fileinto "INBOX.SPAM"; stop; } # rule:[Message-ID contains a dot and @] if not header :matches "Message-Id" "*?@*?.??*" { fileinto "INBOX.SPAM"; stop; } # rule:[Keywords that are contained in subject] if header :contains "subject" ["Mr.Sung Lee","datingfuhildo.ru","firsteuro-consulting.com","uvipeliterubypalace.pl","Top money making industry","Buy shares under","Hottest top stock is S CX N","worldofconsult.com","avipeliterubypalace.pl","Josef Nakladal","Profit Generating Industry","datinglisa.ru","josefnak@yahoo.de","Oil player","Who is Making Money"] { fileinto "INBOX.SPAM"; stop; } # rule:[Keywords that are contained in message text] if body :text :contains ["my intimate photos","viagra","cialis","Mr.Sung Lee","datingfuhildo.ru","firsteuro-consulting.com","uvipeliterubypalace.pl","Top money making industry","Buy shares under","Hottest top stock is S CX N","worldofconsult.com","avipeliterubypalace.pl","Josef Nakladal","Profit Generating Industry","datinglisa.ru","josefnak@yahoo.de","Oil player","Who is Making Money","ask that you keep this award away from public"] { fileinto "INBOX.SPAM"; stop; } # rule:[Keywords that matches] if anyof (header :matches "subject" ["S?C?X?N","GT?RL"], body :text :contains ["S?C?X?N","GT?RL"]) { fileinto "INBOX.SPAM"; stop; } # rule:[Field Message-ID is empty] if header :is "Message-Id" "" { fileinto "INBOX.SPAM"; stop; } # rule:[Received from unknown] if header :contains "Received" ["unknown","User"] { fileinto "INBOX.SPAM"; stop; } # rule:[well-known SPAM X-Mailer] if header :contains "X-Mailer" ["The Bat","Microsoft Outlook Express","JavaMailer"] { fileinto "INBOX.SPAM"; stop; } # rule:[known SPAM User-Agents] if header :contains "User-Agent" ["The Bat","Microsoft Outlook Express","JavaMailer"] { fileinto "INBOX.SPAM"; stop; } # rule:[well-known SPAM Newsletters] if header :contains "to" ["dasistgut.net"] { fileinto "INBOX.SPAM"; stop; }