# Aureate Group Mail (Free Edition)
#
#  This software appears to be intended for legitimate purposes, but so many
#   spammers are using the free edition, which is clearly too easy to get
#   and abuse, that I am treating the free edition as a spam mail program.
#
:0
* ^X-Mailer:.*Aureate Group Mail Free Edition
{ AUREATE=yes }

:0 BH
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*  -600^1    ^Subject:.*spam
*  -200^1    UCE
*   300^1   ^\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-\-$
*   500^1   ^This message was sent to you by$
*   800^1   Aureate Group Mail.*Free Edition
*   500^1   ^group-mail\.com([^a-z0-9\.]|$)
{ AUREATE=yes }

:0
* AUREATE ?? yes
{
:0 f
| ${FORMAIL} -A"X-SBRule: Mass Mailer/Aureate (Free Edition)"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# formmail.pl script
#
#  Several versions of the formmail.pl script are highly insecure, and
#  spammers use them to send spam.
#
:0 BH
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*  -600^1   ^Subject:.*spam
*  1100^0   Below is the result of your feedback form\.
*   600^0   It was submitted by
*  1100^0   Hieronder het resultaat van het Strafschop-boek-bestel formulier\.
*   600^0   Het is opgestuurd
*  1100^0   Folgendes wurde am (Montag|\
                                Dienstag|\
                                Mittwoch|\
                                Donnerstag|\
                                Freitag|\
                                Samstag|\
                                Sonntag), [0-9]+\. (Januar|\
                                Februar|\
                                März|\
                                April|\
                                Mai|\
                                Juni|\
                                Juli|\
                                August|\
                                September|\
                                Oktober|\
                                November|\
                                Dezember)[ ]|\
                                20[0-1][0-9] um [1-2]?[0-9]:[0-6][0-9] Uhr von [ ]?\(.*@.*\.[a-z]+\) |\
                                per Formular an Sie geschickt:
*  1100^0   ^The following form contents were entered on ([0-9]|[1-2][0-9]|3[0-1])(nd|th) |\
             (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) [0-9]+$
*  1100^0   Date = (.*$)+subject = (.*$)+email = (.*$)+message = (.*$)+
*  1100^0   Az alabbi Ajanlatkero nyomtatvany erkezett\:
*  1100^0   Jemand hat das Feedback-Formular Ihrer Website benutzt
*  1100^0   Das Ergebnis der eMail Abfrage\.( )*Es wurde gesendet am:
*  1100^0   ^Form Results:$^$^=============================================================$^Referring URL:$
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: formmail.pl"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# X-EM Mailer
:0
* ^X-EM-Version:
* ^X-EM-Registration:
{ XEM=yes }

:0
* LEANTAG ?? no
* !XEM ?? yes
{
 :0 BH
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 * -1000^0   ^Subject: Re:
 *  -200^1   ^[:;#>]
 *   500^0   ^\<\!\-\- Please Read! If you are reading this then that means
 *   500^0   an HTML capable e-mail client
 *   500^0   you are not viewing this message as(.*$)+it should be
 *   500^0   Please send an email to services@maxir(\.|=2E)com with Remove(.*$)+as the subject
 *   500^0   ^\<base href=.?.?\"http://.*\"\>(.*$)+(.*$)+^\<\!\-\- Start Top Banner \-\-\>$
 { XEM=yes }
}

:0
* XEM ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Mass Mailer/XEM"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Other Blocked eMail Programs
:0
* ^X-Mailer: (.*Allaire Cold[ ]?Fusion([^a-z0-9\.]|$)|\
              .*Msend([^a-z0-9\.]|$)|\
              .*Netmailer([^a-z0-9\.]|$)|\
              .*Worldmerge([^a-z0-9\.]|$))
* !^Subject: .*\(fwd\)
{ MASSMAIL2=yes }

:0 BH
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
* -1000^0   ^Subject: Re:
*  -200^1   ^[:;#>]
* 1000^1    WorldMerge
* 1100^1    http://www\.coloradosoft\.com
* 1100^1    http://www\.phplist\.com
{ MASSMAIL2=yes }

:0
* MASSMAIL2 ?? yes
{
:0 f
| ${FORMAIL} -A"X-SBRule: Mass Mailer/Possibly OK"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}

# Generic Mail-Merge Spam Software
:0 BH
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* !^(Received|Message-ID):.*pocketmail\.com([^a-z0-9\.]|$)
* !^X-Mailer:.*Microsoft (Internet|Outlook)
* !^X-Mailer:.*Novell GroupWise
* !^X-Lotus
* !^X-Mimeole:
* -1000^0
* -1000^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*  1100^0   ^To: <[-_0-9a-z]*>$
{ MAILMERGESPAM=yes }

:0 BH
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
* -1000^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*  1100^0   ^To: [a-z][-_0-9a-z]@[0-9a-z][-_0-9a-z]\.[a-z][a-z][a-z]?$
*  1100^0   ^Dear [a-z][-_0-9a-z]@[0-9a-z][-_0-9a-z]\.[a-z][a-z][a-z]?[,;:]$
*  1100^0   ^[a-z][-_0-9a-z]@[0-9a-z][-_0-9a-z]\.[a-z][a-z][a-z]?$
{ MAILMERGESPAM=yes }

:0
* MAILMERGESPAM ?? yes
{
:0 f
| ${FORMAIL} -A"X-SBRule: Mail-Merge Spam Software (Generic)"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}

