# Headers which usually indicate spam, but not always.

# Empty Message-ID:
:0
* ^Message-ID: ([ ]|<>|< >)$
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Empty Message-ID:"

 :0
{ BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Missing To:
:0
* !^To:
* !^Subject: .*\(fwd\)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Missing To:"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Empty To:
:0
* ^To:[ ]?<?[ ]?>?$
* !^Subject: .*\(fwd\)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Empty To:"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Ridiculously overlong To: or Cc: headers
:0
*  ^(To|Cc):.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?\
            .*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?\
            .*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?\
            .*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?\
            .*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?\
            .*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?\
            .*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?\
            .*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?\
            .*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?\
            .*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?\
            .*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?\
            .*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?.*@.*,$?\
            .*@.*,$?.*@.*
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Overlong To: or Cc:"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Multiple To: headers
:0
*  ^To:(.*$)+To:
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Multiple To: Headers"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# TO: Headers which almost always indicate spam.
:0
* ^TO(friends?@([^a-z0-9\.]|$)|\
    fulldatabase@([^a-z0-9\.]|$)|\
    nobody@.*([^a-z0-9\.]|$)|\
    one@time\.com([^a-z0-9\.]|$)|\
    outmail@([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spammy To: Header"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}

# Received: headers after Subject
:0
*  ^Subject:(.*$)+Received:
* !^received: by Apple.Mailer
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Received after Subject"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Multiple Received: headers after Date
:0
*  ^Date:(.*$)+Received:(.*$)+Received:
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Multiple Received after Date"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Subject: line with too many blank spaces
:0
*  ^Subject:.*[ ][ ][ ][ ][ ]
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Subject w/too many blanks"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Subject: line with too many periods in a row
:0
*  ^Subject:.*\.[ ]?\.[ ]?\.[ ]?\.[ ]?\.[ ]?
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Subject w/too many periods"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Subject: line with too many underscores in a row
:0
*  ^Subject:.*_____
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Subject w/too many underscores"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Malformed Content-Type: header
:0
*  ^Content-Type:[ ].*;.*;.*;.*;.*;.*;
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Malformed Content-Type: header"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Spammy From:/Reply-To:
:0
* ^(From.|Reply-To:).*[^0-9a-z](255\.255\.255\.|\
          @(email)?[0-9]+\.cc|\
          ad(vertise)?(r|ment)?(s)?@|\
          anon(ymous)?@|\
          x[0-9][0-9]x@|\
          [^a-z]friend.*@|\
          .*@.*friend|\
          InternetEx@Picture\.scan\.com|\
          make@.*money.com|\
          no@reply([^a-z0-9\.]|$)|\
          noreply@([^a-z0-9\.]|$)|\
          noone@nowhere\.net([^a-z0-9\.]|$)|\
          noreply@([^a-z0-9\.]|$)|\
          .*offer.*@([^a-z0-9\.]|$)|\
          .*@proxy?.\.ba\.best\.com([^a-z0-9\.]|$)|\
          info(rmation)?@.*internet\.net([^a-z0-9\.]|$)|\
          Reply@By\.Mail([^a-z0-9\.]|$)|\
          usethe800number@|\
          waiting@thephone\.now([^a-z0-9\.]|$)|\
          Weight Loss|\
          Worldwide\.Network\.Association([^a-z0-9\.]|$)|\
          yourdomain\.com([^a-z0-9\.]|$)|\
          .*@[a-z]*\.[a-z]*\.earthlink\.net([^a-z0-9\.]|$)|\
          .*@.Cust..?\.[0-9a-z]*\.[0-9a-z]*\.[0-9a-z][0-9a-z]\.uu\.net([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Spammy From/Reply-To"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Unqualified recipient (no @ sign in To: field) from outside sender
:0
{ RUNCHECK=yes }

:0
* ? ${TEST} -f ${LOCALHOSTFILE} && (${FORMAIL} -zxFrom: -zxReply-To: | ${GREP} -i -f ${LOCALHOSTFILE})
{ RUNCHECK=no }

:0
* !^To:
{ RUNCHECK=no }

:0
* RUNCHECK ?? yes
* !^To:.*@
* !^To:.*undisclosed.*recipients?
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Unqualified Recipient Address/Outside Sender"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Other headers typical of spam
:0
* !^From:.*user@unknown.nu([^a-z0-9\.]|$)
* !^Received.*stealth\.net([^a-z0-9\.]|$)
* (^Content-type: .*boundary=.?\#MYBOUNDARY\#|\
   ^Date:.*____|\
   ^Status: MC|\
   ^Subject:.*% (discount|off)|\
   ^Subject: \[ a d v \]|\
   ^To: @|\
   ^To: you$|\
   ^To.*(any|no|some)(one|body)@|\
   ^X-#:|\
   ^X-Set:)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Other Spammy Headers"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}

