describe RATWARE_ZERO_TZ Bulk email fingerprint (+0000) found
header RCVD_BONUS_SPC_DATE Received =~ /with SMTP; \d\d \S\S\S /
describe RCVD_BONUS_SPC_DATE Bulk email fingerprint (bonus space) found
header X_MESSAGE_INFO exists:X-Message-Info
describe X_MESSAGE_INFO Bulk email fingerprint (X-Message-Info) found
# case-sensitive rule
# only significant rules with no FPs, hit recently, on 2+ corpuses
header HEADER_SPAM ALL =~ /^(Alternate-Recipient|Antivirus|Approved|Delivery-Notification|Disclose-Recipients|Error-path|Language|Location|Mime-Subversion|Newsletter-ID|PID|Rot|UID|X-BounceTrace|X-CS-IP|X-Company-Address|X-Company-City|X-Company-Country|X-Company-State|X-Company-Zip|X-E(?:[Mm]ail)?|X-Encoding|X-Originating-Company|X-RMD-Text|X-SG4|X-SP-Track-ID|X-Webmail-Time|X-bounce-to):/m
describe HEADER_SPAM Bulk email fingerprint (header-based) found
header RATWARE_RCVD_PF Received =~ / \(Postfix\) with ESMTP id [^;]+\; \S+ \d+ \S+ \d+ \d+:\d+:\d+ \S+$/s
describe RATWARE_RCVD_PF Bulk email fingerprint (Received PF) found
header RATWARE_RCVD_AT Received =~ / by \S+\@\S+ with Microsoft SMTPSVC/
describe RATWARE_RCVD_AT Bulk email fingerprint (Received @) found
meta RATWARE_OUTLOOK_NONAME __MSGID_DOLLARS_OK && !__HAS_X_MAILER
describe RATWARE_OUTLOOK_NONAME Bulk email fingerprint (Outlook no name) found