home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
ftp.f-secure.com
/
2014.06.ftp.f-secure.com.tar
/
ftp.f-secure.com
/
support
/
hotfix
/
fsis
/
IS-SpamControl.fsfix
/
iufssc
/
rules
/
96_fs-massmail.cf
< prev
next >
Wrap
Text File
|
2006-11-29
|
2KB
|
53 lines
# 96_fs-massmail.cf -- era Tue May 17 14:52:20 2005
# Copyright (C) 2005 F-Secure Corporation
# $Id: 96_fs-massmail.cf 2346 2005-12-09 13:59:39Z $
ifplugin FS::MsgStructure
# rule: MASSMAIL_SOBER_Q
# created 2005-05-17
# test: spam-2005-05-17/df-2005-05-17-000055.txt
# test: spam-2005-05-17/df-2005-05-17-001835.txt
# test: spam-2005-05-17/df-2005-05-17-005991.txt
# test: spam-2005-05-17/df-2005-05-17-006683.txt
# test: spam-2005-05-17/df-2005-05-17-007247.txt
# test: spam-2005-05-17/df-2005-05-17-007394.txt
define_structure MASSMAIL_SOBER_Q
structure (?:^)
structure (?:[A-Za-z0-9].{0,1023}\n(?:[ \t].{0,1023}\n){0,50}){0,50}
# Telltale sign #1: From To Date Subject Importance etc in exactly this order
# Telltale sign #2: just plain email address, no real name or <>
structure From: [-A-Za-z0-9._%=]{1,50}\@[-A-Za-z0-9.]{5,64}\n
structure To: [-A-Za-z0-9._%=]{1,50}\@[-A-Za-z0-9.]{5,64}\n
# Telltale sign #3: date is in UTC or GMT, no numeric time zone
structure Date:
structure (?: )(?:Mon|T(?:ue|hu)|Wed|Fri|S(?:at|un)), [ 0-3][0-9]
structure (?: )(?:J(?:an|u[nl])|Feb|Ma[ry]|A(?:pr|ug)|Sep|Oct|Nov|Dec)
structure (?: )[12][0-9]{3} [012][0-9](?::[0-5][0-9]){2}
structure (?: )(?:UTC|GMT)\n
######## TODO: maybe limit to just relevant Subject lines
structure Subject: .{1,1024}\n
structure Importance: Normal\n
structure (?:X-Mailer: .{1,1014}\n)?
structure X-Priority: 3 \(Normal\)\n
structure (?:X-MSMail-Priority: Normal\n)?
structure MIME-Version: 1\.0\n
# Telltale sign #4: Message-ID in between MIME-Version and Content-xxx
# (Message-ID often in sender's, and sometimes in recipient's, domain)
structure Message-ID: <[a-z0-9.]{4,64}\@[-A-Za-z0-9.]{5,64}>\n
# Telltale sign #5: 7bit us-ascii even for German-language messages
structure Content-Transfer-Encoding: 7bit\n
structure Content-Type: text/plain; charset="us-ascii"\n
describe MASSMAIL_SOBER_Q Massmail generated by the Sober.Q worm
score MASSMAIL_SOBER_Q 9
######## TODO: bounces
# test: spam-2005-05-17/df-2005-05-17-003126.txt
endif