debian_pkg-listmaster/spamassassin_config/common/auto_response_spam

# -*- mode: spamassassin -*-

## This file contains rules which match various automatic responders
## which give us backscatter. The scores here are best guesses; and
## may need to be overridden for recipients which actually want these
## bounces.

# don 2009-02-05
body  QMAILBOUNCE	/This\s*is\s*the\s*qmail-send\s*program/i
describe QMAILBOUNCE	Stupid qmail bounces; we don't want them
score QMAILBOUNCE	2

# don 2009-02-05 (the following are all for various stupid auto-repsonse things)
header RECEIVEDMAIL	subject =~ /(?:received\s*your\s*mail|(?:respuesta|risposta|response) (?:autom.tica|automatic)|auto(?:matic|m.tica)?\s*(?:respuesta|risposta|response))/i
describe RECEIVEDMAIL	It's great that you've received our mail and automatically responded. We don't care
score RECEIVEDMAIL	4

body AUTOREBOD		/(?:received\s*your\s*mail|(?:(?:respuesta|risposta|response|message) auto(?:m.tica?|mated)?)|auto(?:m.tica?|mated)?\s*(?:respuesta|risposta|response|message))/i
describe AUTOREBOD	It's great that you've automatically responded
score AUTOREBOD		4

header YOURMESSAGE	subject =~ /your message/i
describe YOURMESSAGE	It's great that our message did something; we don't care
score YOURMESSAGE	2.5

body YOURMESSAGEBOD	/^Your message/i
describe YOURMESSAGEBOD	It's great that our message did something; we don't care
score YOURMESSAGEBOD	2.5

body NODELIVERY		/(?:could not be|has not been) delivered/i
describe NODELIVERY	We don't care if it could be or has not been delivered
score NODELIVERY	1.5

body NORESEND		/do not resend your original message/i
describe NORESEND	If you don't want us to resend our message, why tell us?
score NORESEND		2

header PROOFPOINT	from =~ /proofpoint/
describe PROOFPOINT	Automatic mail from proofpoint (some MTA thingie)
score PROOFPOINT	3.5

body  NOTPROCBOUNCE	/was not processed by our system/i
describe NOTPROCBOUNCE	Bounce by system that was not processed
score NOTPROCBOUNCE	2

body ACCOUNTNOTEXIST	/(?:account\s+\S+\s+(does\s*not|doesn't)\s*exist|(?:invalid|not a valid) e-?mail address)/i
describe ACCOUNTNOTEXIST	It's not our problem if an account doesn't exist
score ACCOUNTNOTEXIST		2

body CR_SYSTEM1		/sent by a human and not a computer/i
describe CR_SYSTEM1	Looks like a challenge/response system
score CR_SYSTEM1	2

body CR_SYSTEM2		/do not reply/i
describe CR_SYSTEM2	Body contains do not reply; likely a CR system
score CR_SYSTEM2	1.5

body CR_SYSTEM3		/confirm this request/i
describe CR_SYSTEM3	Body contains confirm this request; likely a CR system
score CR_SYSTEM3	1.5

header CR_SYSTEM4	subject =~ /challenge.*response/i
describe CR_SYSTEM4	Subject contains challenge/response
score CR_SYSTEM4	3

body CR_SYSTEM5		/confirmation of list posting/i
describe CR_SYSTEM5	Body asks us to confirm a list posting
score CR_SYSTEM5	3

header CR_SYSTEM6	subject =~ /^confirm\:/i
describe CR_SYSTEM6	Subject asks us to confirm something; we don't want to
score CR_SYSTEM6	2

header CR_SYSTEM7	x-cr-puzzleid =~ /./i
describe CR_SYSTEM7	Has a X-cr-puzzleid: header
score CR_SYSTEM7	5

body CR_SYSTEM8		/reply to this message/i
describe CR_SYSTEM8	Reply to this message? are you crazy?
score CR_SYSTEM8	3

body SUPPORTMAIL1	/assigned a ticket/
describe SUPPORTMAIL1	Message from an automated support/response system
score SUPPORTMAIL1	2

header SUPPORTMAIL2	subject =~ /^\[*(?:update\s*to\s*)?ticket/
describe SUPPORTMAIL2	Message with ticket leading it; probably a support mail
score SUPPORTMAIL2	1.5

body SUPPORTMAIL3	/the email address \S+ is not registered/i
describe SUPPORTMAIL3	We don't care if an e-mail address is not registered
score SUPPORTMAIL3	1.5

body SUPPORTMAIL4	/(reached an unmonitored e-mail address|no response will be given)/i
describe SUPPORTMAIL4	Yeay for dumb auto-response bots that don't want a response
score SUPPORTMAIL4	1.5

header SUPPORTMAIL5	from =~ /\b(?:support|info)\@/i
describe SUPPORTMAIL5	Message from an address that looks like support@ or info@
score SUPPORTMAIL5	2

header FROMAUTOREPLY 	from =~ /(autoreply|no-?repl(?:y|ies))/i
describe FROMAUTOREPLY	Message from an autoreplier or something who doesn't seem to want a reply
score FROMAUTOREPLY	4

header FROMABUSE	from =~ /\babbuse\@/i
describe FROMABUSE	Message from abbuse@somedomain
score FROMABUSE		1.5

header FROMSPAMCOP	from =~ /spamcop\@/i
describe FROMSPAMCOP	Message from spamcop@somedomain
score FROMSPAMCOP	3.5

header SUBJECTSPAM	subject =~ /(?:\*\*|\[)\s*spam\s*(?:\*\*|\])/i
describe SUBJECTSPAM	Subject contains **spam** or [spam], so it's probably spam
score SUBJECTSPAM	3.5

header MESBLOCKED	subject =~ /your message (?:is )?blocked/i
describe MESBLOCKED	That's great that our message was blocked
score	 MESBLOCKED	2

header FAILDELIVERY	subject =~ /failed to deliver/i
describe FAILDELIVERY	Oh noes! You failed to deliver spam!
score FAILDELIVERY	2

header NEWADDRESS	subject =~ /(?:new e-?mail address|deaktivierung der mailadresse)/i
describe NEWADDRESS	We don't care that you have a new e-mail address
score NEWADDRESS	4

header VACATIONMAIL1	user-agent =~ /vacation/i
describe VACATIONMAIL1	Mail from the vacation user agent
score VACATIONMAIL1	0.1

header VACATIONMAIL2	X-Vacation =~ /./
describe VACATIONMAIL2	Has an X-Vacation header
score VACATIONMAIL2	0.1

meta  VACATIONMAIL	(VACATIONMAIL1 || VACATIONMAIL2)
describe VACATIONMAIL	Looks like a vacation message
score VACATIONMAIL	1