#LAST UPDATED 2/16/2010

#UNCOMMENT TO BE MORE SPECIFIC (LESS STRICT)
#TESTSFAILED	END	NOTCONTAINS	FILTER-NOSENDER

#OWN SERVER IP
BODY		END	CONTAINS	216.144.195.81

BODY	20	PCRE	(?i:You've received a (postcard|greeting e?card) from a ((Class|school).mate|Neighbour))
BODY	10	PCRE	(?i:The following addresses had (delivery problems|permanent fatal errors))
BODY	10	PCRE	(?i:mailbox (has exceeded the limit|is full: retry timeout exceeded|unknown or not accepting mail))

BODY	10	CONTAINS	A message you have sent has been detected as Spam
BODY	10	CONTAINS	A message could not be delivered to:
BODY	10	CONTAINS	Bad destination mailbox address
BODY	10	CONTAINS	blocked by our Spam Firewall
BODY	10	CONTAINS	Delivery attempts will continue to be made for
BODY	10	CONTAINS	Delivery to the following recipients failed
BODY	10	CONTAINS	did not reach the following recipient(s):
BODY	10	CONTAINS	I was unable to deliver your message to
BODY	10	CONTAINS	I'm protecting myself from receiving junk mail
BODY	10	CONTAINS	Message from InterScan Messaging Security Suite
BODY	10	CONTAINS	No tienes permiso para enviar mensajes al grupo
BODY	10	CONTAINS	Recipient address rejected:
BODY	10	CONTAINS	Recipient no longer on server
BODY	10	CONTAINS	Recipient's maiilbox is full
BODY	10	CONTAINS	Reporting-MTA: dns; barracuda.
BODY	10	CONTAINS	Sorry, no mailbox here by that name
BODY	10	CONTAINS	The following recipient(s) could not be reached:
BODY	10	CONTAINS	The recipient name is not recognized
BODY	10	CONTAINS	This address no longer accepts mail
BODY	10	CONTAINS	This is a permanent error; I've given up. Sorry it didn't work out.
BODY	10	CONTAINS	This message was created automatically by mail delivery software (Exim).
BODY	10	CONTAINS	This Message was undeliverable due to the following reason:
BODY	10	CONTAINS	this recipient does not exist or not yet activated
BODY	10	CONTAINS	Unable to deliver message to the following recipients
BODY	10	CONTAINS	was considered as an unsolicited message (spam) by the receiving mail
BODY	10	CONTAINS	was considered unsolicited bulk e-mail (UBE)
BODY	10	CONTAINS	X-Spam-Flag: YES
BODY	10	CONTAINS	You do not have permission to post to group
BODY	10	CONTAINS	Your message cannot be delivered to the following recipients:
BODY	10	CONTAINS	Your message to the following recipients cannot be delivered:
BODY	10	CONTAINS	Your message could not be sent
BODY	10	CONTAINS	Your message did not reach some or all of the intended recipients
BODY	10	CONTAINS	Could not deliver in a reasonable time
BODY	10	CONTAINS	e-mail account does not exist at the organization
BODY	10	CONTAINS	Delivery Status Notification
BODY	10	CONTAINS	we are unable to deliver your fax because
BODY	10	CONTAINS	Delivery to the following recipient failed permanently:

BODY	10	CONTAINS	McAfee GroupShield discovered a problem
BODY	10	CONTAINS	MDaemon has detected restricted attachments within an email message
BODY	10	CONTAINS	Symantec Mail Security detected 
BODY	10	CONTAINS	MailEnable: Message delivery has been delayed.
BODY	10	CONTAINS	MailMarshal (an automated content monitoring gateway)

BODY	10	CONTAINS	Dies ist eine automatisch erstellte Benachrichtigung ber den Zustellstatus.
BODY	10	CONTAINS	chec de la remise aux destinataires suivants
BODY	10	CONTAINS	Cette notification d'tat de remise est gnre automatiquement

BODY	10	CONTAINS	Thunderbird 1.5.0.12
BODY	10	CONTAINS	5.1.0 - Unknown address error
BODY	10	CONTAINS	SMTP diagnostic: 550 RCPT TO:
BODY	10	CONTAINS	(user not found)
BODY	10	CONTAINS	not listed in Domino Directory

BODY	10	PCRE		(?i:5.1.1 (User unknown|- Bad destination email address 'reject'))
BODY	10	PCRE		(?i:550 (Mailbox (unavailable|not found)|Bulk Email by DCC|unknown user|No such recipient|5\.7\.1 Message content rejected, UBE|Invalid recipient))

BODY	10	CONTAINS 	554 Sorry, message looks like SPAM to me
BODY	10	CONTAINS 	Email was sent to [Invalid User]
BODY	10	CONTAINS 	MTA Response :553
BODY	10	CONTAINS 	Message bounced by administrator
BODY	10	CONTAINS 	MIMEsweeper Analysis Results

BODY	10	CONTAINS	You are not allowed to post to this mailing list

SUBJECT	30	PCRE		(?:\*\*Message you sent blocked by our.*\*\*)
SUBJECT	30	CONTAINS	Benachrichtung
SUBJECT	30	CONTAINS	Considered UNSOLICITED BULK EMAIL
SUBJECT	30	CONTAINS	Delayed Mail (still being retried)
SUBJECT	30	PCRE		(?i:Delivery.{0,10}(Failure|status|notification|report).{0,25})
SUBJECT	30	PCRE		(?i:fail(ure|ed).(delivery|notice))
SUBJECT	30	CONTAINS	Lieferstatusbenachrichtigung
SUBJECT	30	CONTAINS	Mail could not be delivered
SUBJECT	30	PCRE		(?i:Mail delivery fail(ure|ed))
SUBJECT	30	CONTAINS	Mail System Error - Returned Mail
SUBJECT	30	CONTAINS	Message delayed (
SUBJECT	30	CONTAINS	Message you sent blocked by our bulk email filter
SUBJECT	30	CONTAINS	NDN:
SUBJECT	30	CONTAINS	Non remis :
SUBJECT	30	CONTAINS	Notifica sullo stato del recapito 
SUBJECT	30	CONTAINS	Notification d'tat de la distribution
SUBJECT	30	CONTAINS	Returned mail
SUBJECT	30	CONTAINS	Transient Delivery Failure
SUBJECT	30	PCRE		(?i:Unable to (deliver|process) your message)
SUBJECT	30	PCRE		(?i:Undeliver(able|ed):?.(Mail)?)
SUBJECT	30	CONTAINS	Unzustellbar:
SUBJECT	30	CONTAINS	Warning:
SUBJECT	30	CONTAINS	e-mail Content Alert

#SPAMASSASIN RULES

SUBJECT	10	CONTAINS	Yahoo! Auto Response
SUBJECT	10	PCRE	(?i:Returned mail.{0,5}(?:Error During Delivery|see transcript for details))

HEADERS	10	PCRE	(?im:X-Error-Status.*User unknown)

SUBJECT	10	CONTAINS	Returned mail: User unknown
SUBJECT	10	CONTAINS	Mail delivery failed:
SUBJECT	10	CONTAINS	Message Delivery Failure

BODY	10	CONTAINS	This messages was created automatically by mail delivery software

#OUT OF OFFICE

SUBJECT		5	PCRE	(?i:Mensaje de respuesta autom.tica)
SUBJECT		5	PCRE	(?i:R.ponse automatique d'absence du bureau)
SUBJECT		5	PCRE	(?i:away from the office)
SUBJECT		5	PCRE	(?i:Auto Resposta)
SUBJECT		5	PCRE	(?i:Automaattinen poissaolovastaus:)

BODY		2	PCRE	(?i:(i?:.m| am| will be|.ll be) (?:(?:out of|away from) the office|on vacation) (?:from|to|until|after)\b)
BODY		2	PCRE	(?i:away until .{10,20} and am unable to read your message\b)
BODY		2	PCRE	(?i:I am currently out of the office\b)

#AV BACKSCATTER

BODY		10	PCRE	(?i:prohibits the sending of executable files via email)

SUBJECT 	0 STARTSWITH Antigen found VIRUS= 
SUBJECT 	0 STARTSWITH ScanMail Message: To 
SUBJECT 	0 STARTSWITH Disallowed attachment type found in sent message
SUBJECT 	0 IS Mail status report

BODY 		0 CONTAINS destination server said: Message rejected due to possible virus
BODY 		0 CONTAINS Our virus detector has just been triggered by a message you sent:
BODY 		0 CONTAINS The virus detector said this about the message:
BODY 		0 CONTAINS Antigen for Exchange removed
BODY 		0 CONTAINS was found to match the FILE FILTER= *.pif file filter
BODY 		0 CONTAINS was found to match the FILE FILTER= *.exe file filter

#SENDER VERIFICATION 

BODY		7	CONTAINS	The message you sent requires that you verify that you are a real live human being and not a spam source
BODY		7	CONTAINS	To complete this verification, simply reply to this message and leave the subject line intact.
BODY		7	CONTAINS	protected against spam and viruses by MailInBlack
BODY		7	CONTAINS	For more information on email virus scanning, security and content management, visit http://www.marshalsoftware.com
BODY		7	CONTAINS	ChoiceMail sender verification:
BODY		7	CONTAINS	real live human being and not a spam source
BODY		7	CONTAINS	I am now using Vanquish to avoid spam
BODY		7	CONTAINS	This is a anti-spam measure. Thanks for understanding
BODY		7	CONTAINS	blocked by the Friends system
BODY		7	CONTAINS	This message was created automatically by mail delivery software (TMDA)
BODY		7	CONTAINS	100% spam-free email provided by Sendio
BODY		7	CONTAINS	protected against spam and viruses by MailInBlack
BODY		7	CONTAINS	protected by ChoiceMail One
BODY		7	CONTAINS	RADAR (Request And Delivery Authentication Response)
BODY		7	CONTAINS	100% spam-free email provided by Sendio
BODY		7	CONTAINS	This email system is protected to reduce the amount of unsolicited email (spam).

MAILFROM	7	CONTAINS	spamlion

SUBJECT		7	CONTAINS	Your email requires verification verify
SUBJECT		7	CONTAINS	MessageLabs Content Control service has identified that an email sent by you may contain inappropriate content
SUBJECT		7	CONTAINS	[Spam Challenge]

