svn commit: r1933150 - spamassassin/trunk/rulesrc/sandbox/jhardin
[email protected] Sat, 18 Apr 2026 18:03:31 -0000
| Newsgroups | gmane.mail.spam.spamassassin.cvs |
|---|---|
| Message-ID | <177653541132.22024.2214599913616350688@svn03-he-fi> |
Author: jhardin
Date: Sat Apr 18 18:03:31 2026
New Revision: 1933150
Log:
Migrate X-Mailer rules to their own file and normalize.
Added:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_xmailer.cf
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_MIME_no_text.cf
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_MIME_no_text.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_MIME_no_text.cf Sat Apr 18 15:50:01 2026 (r1933149)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_MIME_no_text.cf Sat Apr 18 18:03:31 2026 (r1933150)
@@ -5,9 +5,6 @@
# These should be generally useful to other rules as well
header __CTYPE_MULTIPART_ANY Content-Type =~ /multipart\/\w+/i
-header __PHP_MUA_1 X-Mailer =~ /^PHP\s?v?\/?\d\./
-header __PHP_MUA_2 X-Mailer =~ /^PHP\d$/
-meta __PHP_MUA __PHP_MUA_1 || __PHP_MUA_2
ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
mimeheader __ANY_TEXT_ATTACH Content-Type =~ /text\/\w+/i
@@ -18,7 +15,7 @@ ifplugin Mail::SpamAssassin::Plugin::MIM
describe MIME_NO_TEXT No (properly identified) text body parts
tflags MIME_NO_TEXT publish
- meta MIME_PHP_NO_TEXT (MIME_NO_TEXT && __PHP_MUA)
+ meta MIME_PHP_NO_TEXT (MIME_NO_TEXT && __XM_PHP)
#score MIME_PHP_NO_TEXT 2.00
describe MIME_PHP_NO_TEXT No text body parts, X-Mailer: PHP
else
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sat Apr 18 15:50:01 2026 (r1933149)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Sat Apr 18 18:03:31 2026 (r1933150)
@@ -181,33 +181,19 @@ describe DEAR_EMAIL_USER
uri URI_NUMERIC_CCTLD m;^[a-z]+://(?:\d+\.){2,}[a-z][a-z]/;i
describe URI_NUMERIC_CCTLD CCTLD URI with multiple numeric subdomains
-# various MUAs
-header __PHP_NOVER_MUA X-Mailer =~ /^PHP$/
-header __PHPMAILER_MUA X-Mailer =~ /^PHPMailer\b/
-
-ifplugin Mail::SpamAssassin::Plugin::DKIM
- meta PHP_NOVER_MUA __PHP_NOVER_MUA && !__DKIM_DEPENDABLE && !__TO_NO_BRKTS_HTML_ONLY && !__MSGID_OK_DIGITS && !__UPPERCASE_25_50 && !__RP_MATCHES_RCVD && !__GIF_ATTACH
-else
- meta PHP_NOVER_MUA __PHP_NOVER_MUA && !__TO_NO_BRKTS_HTML_ONLY && !__MSGID_OK_DIGITS && !__UPPERCASE_25_50 && !__RP_MATCHES_RCVD && !__GIF_ATTACH
-endif
-describe PHP_NOVER_MUA Mail from PHP with no version number
-score PHP_NOVER_MUA 3.000 # limit
-tflags PHP_NOVER_MUA publish
-
# From should have whitespace between the comment and the address
# Better S/O, good enough for standalone rule
header __FROM_MISSPACED From =~ /^\s*"[^"]*"</
-# legit mailers known to misspace from
-header __MTLANDROID_MUA X-Mailer =~ /\bMotorola android mail \d+\.\d/
-header __XEROXWORKCTR_MUA X-Mailer =~ /^WorkCentre \D?\d[\d\.]\d+/
-header __AMADEUSMS_MUA X-Mailer =~ /^Amadeus Messaging Server/
-header __FLASHMAIL_MUA X-Mailer =~ /^NetEase Flash Mail \d/
-
+# legit mailers known to misspace From header
+# __XM_MTLANDROID
+# __XM_XEROXWORKCTR
+# __XM_AMADEUSMS
+# __XM_FLASHMAIL
# meta with some stuff to reduce FPs
-meta FROM_MISSPACED __FROM_MISSPACED && !__RCD_RDNS_MTA_MESSY && !__CTYPE_MULTIPART_ALT && !__REPTO_QUOTE && !__MIME_QP && !__UNSUB_LINK && !__TO___LOWER && !__BUGGED_IMG && !__DOS_HAS_LIST_UNSUB && !__TO_EQ_FROM_DOM && !__MAIL_LINK && !__MTLANDROID_MUA && !__XEROXWORKCTR_MUA && !__PHP_MUA && !__AMADEUSMS_MUA && !__FLASHMAIL_MUA
+meta FROM_MISSPACED __FROM_MISSPACED && !__RCD_RDNS_MTA_MESSY && !__CTYPE_MULTIPART_ALT && !__REPTO_QUOTE && !__MIME_QP && !__UNSUB_LINK && !__TO___LOWER && !__BUGGED_IMG && !__DOS_HAS_LIST_UNSUB && !__TO_EQ_FROM_DOM && !__MAIL_LINK && !__XM_MTLANDROID && !__XM_XEROXWORKCTR && !__XM_PHP && !__XM_AMADEUSMS && !__XM_FLASHMAIL
describe FROM_MISSPACED From: missing whitespace
score FROM_MISSPACED 2.00
@@ -227,13 +213,13 @@ ifplugin Mail::SpamAssassin::Plugin::SPF
endif
meta __FROM_MISSP_EH_MATCH __FROM_RUNON_UNCODED && __LCL__ENV_AND_HDR_FROM_MATCH
-meta FROM_MISSP_EH_MATCH __FROM_MISSP_EH_MATCH && !__RCD_RDNS_MTA_MESSY && !__UNSUB_LINK && !__COMMENT_EXISTS && !__TO___LOWER && !__MIME_QP && !__TO_EQ_FROM_DOM && !__BUGGED_IMG && !__DKIM_EXISTS && !__RCVD_ZIXMAIL && !__MTLANDROID_MUA && !__XEROXWORKCTR_MUA && !__PHP_MUA && !__AMADEUSMS_MUA && !__FLASHMAIL_MUA
+meta FROM_MISSP_EH_MATCH __FROM_MISSP_EH_MATCH && !__RCD_RDNS_MTA_MESSY && !__UNSUB_LINK && !__COMMENT_EXISTS && !__TO___LOWER && !__MIME_QP && !__TO_EQ_FROM_DOM && !__BUGGED_IMG && !__DKIM_EXISTS && !__RCVD_ZIXMAIL && !__XM_MTLANDROID && !__XM_XEROXWORKCTR && !__XM_PHP && !__XM_AMADEUSMS && !__XM_FLASHMAIL
describe FROM_MISSP_EH_MATCH From misspaced, matches envelope
score FROM_MISSP_EH_MATCH 2.00 # max
# most hits > 10 points already
#meta __FROM_MISSP_URI __FROM_RUNON_UNCODED && __HAS_ANY_URI
-#meta FROM_MISSP_URI __FROM_MISSP_URI && !__NOT_SPOOFED && !__RCD_RDNS_MTA_MESSY && !MISSING_MIMEOLE && !__REPTO_QUOTE && !__UNSUB_LINK && !__MSGID_OK_HEX && !__MAIL_LINK && !__MIME_QP && !__BUGGED_IMG && !MIME_BASE64_TEXT && !__CTYPE_MULTIPART_ALT && !__MTLANDROID_MUA && !__XEROXWORKCTR_MUA && !__PHP_MUA && !__AMADEUSMS_MUA && !__FLASHMAIL_MUA && !__DKIM_EXISTS && !__HAS_SENDER && !__RP_MATCHES_RCVD && !__THREADED && !__TAG_EXISTS_META
+#meta FROM_MISSP_URI __FROM_MISSP_URI && !__NOT_SPOOFED && !__RCD_RDNS_MTA_MESSY && !MISSING_MIMEOLE && !__REPTO_QUOTE && !__UNSUB_LINK && !__MSGID_OK_HEX && !__MAIL_LINK && !__MIME_QP && !__BUGGED_IMG && !MIME_BASE64_TEXT && !__CTYPE_MULTIPART_ALT && !__XM_MTLANDROID && !__XM_XEROXWORKCTR && !__XM_PHP && !__XM_AMADEUSMS && !__XM_FLASHMAIL && !__DKIM_EXISTS && !__HAS_SENDER && !__RP_MATCHES_RCVD && !__THREADED && !__TAG_EXISTS_META
#describe FROM_MISSP_URI From misspaced, has URI
#score FROM_MISSP_URI 2.00 # max
@@ -251,7 +237,7 @@ describe FROM_MISSP_TO_UNDISC Fro
#ifplugin Mail::SpamAssassin::Plugin::DKIM
# meta __FROM_MISSP_DKIM (__FROM_RUNON_UNCODED && __DKIM_DEPENDABLE)
# tflags __FROM_MISSP_DKIM net
-# meta FROM_MISSP_DKIM __FROM_MISSP_DKIM && !__CTYPE_MULTIPART_ALT && !__MIME_QP && !__BUGGED_IMG && !__DOS_HAS_LIST_UNSUB && !__MIME_BASE64 && !__MTLANDROID_MUA && !__XEROXWORKCTR_MUA && !__PHP_MUA && !__AMADEUSMS_MUA && !__FLASHMAIL_MUA
+# meta FROM_MISSP_DKIM __FROM_MISSP_DKIM && !__CTYPE_MULTIPART_ALT && !__MIME_QP && !__BUGGED_IMG && !__DOS_HAS_LIST_UNSUB && !__MIME_BASE64 && !__XM_MTLANDROID && !__XM_XEROXWORKCTR && !__XM_PHP && !__XM_AMADEUSMS && !__XM_FLASHMAIL
# describe FROM_MISSP_DKIM From misspaced, DKIM dependable
#else
# meta __FROM_MISSP_DKIM 0
@@ -269,7 +255,7 @@ score FROM_MISSP_REPLYTO 2.5
ifplugin Mail::SpamAssassin::Plugin::FreeMail
meta __FROM_MISSP_FREEMAIL __FROM_RUNON && (FREEMAIL_FROM || FREEMAIL_REPLYTO)
- meta FROM_MISSP_FREEMAIL __FROM_MISSP_FREEMAIL && !__TO_EQ_FROM_DOM && !__MTLANDROID_MUA
+ meta FROM_MISSP_FREEMAIL __FROM_MISSP_FREEMAIL && !__TO_EQ_FROM_DOM && !__XM_MTLANDROID
describe FROM_MISSP_FREEMAIL From misspaced + freemail provider
#score FROM_MISSP_FREEMAIL 2.0
else
@@ -1136,17 +1122,6 @@ describe SUBJ_BRKN_WORDNUMS Subject
meta TVD_SUBJ_NUM_OBFU_MINFP __TVD_SUBJ_NUM_OBFU && !__RP_MATCHES_RCVD && !__RCD_RDNS_MAIL_MESSY && !__VIA_ML && !__ISO_2022_JP_DELIM && !__NOT_SPOOFED && !__X_CRON_ENV && !__NOT_A_PERSON && !__HAS_THREAD_INDEX && !__THREADED && !__NUMBERS_IN_SUBJ && !__URI_MAILTO
-# from spample on users list 7/20/2011
-header __XM_PHPMAILER_FORGED X-Mailer =~ /PHPMailer\s.*version\D+$/
-meta XM_PHPMAILER_FORGED __XM_PHPMAILER_FORGED
-describe XM_PHPMAILER_FORGED Apparently forged header
-tflags XM_PHPMAILER_FORGED publish
-
-# from spample on users list 7/24/2011
-header __XM_EC_MESSENGER X-Mailer =~ /\beC-Messenger\b/
-#meta XM_EC_MESSENGER __XM_EC_MESSENGER
-#describe XM_EC_MESSENGER eC-Messenger bulk mail service
-
header __SUBJ_OBFU_PUNCT Subject =~ /(?:[-~`"!@\#$%^&*()_+={}|\\\/?<>,.:;][a-z][-~`"!@\#$%^&*()_+={}|\\\/?<>,.:;\s]|(?:[a-z][~`"!@\#$%^&*()_+={}|\\?<>,.:;][a-z](?![a-z])))/i
tflags __SUBJ_OBFU_PUNCT multiple maxhits=4
meta __SUBJ_OBFU_PUNCT_NOEM __SUBJ_OBFU_PUNCT && !__SUBJ_HAS_ANY_EMAIL
@@ -1168,7 +1143,7 @@ score SUBJ_OBFU_PUNCT_MANY 2.000
# Xerox WorkCentre
# See http://isc.sans.edu/diary.html?storyid=11848#comment
body __SCANNED /\b(?:(?:document was scan+ed and sent ?to you using|Scan from)(?: an?)? (?:(?:Hewlet+-Packard |HP ){1,2}Officejet|Hewlet+-Packard Officejet Location: machine location not set)|Xerox\b)/i
-meta SCANNED_EXTERNAL __SCANNED && !ALL_TRUSTED && !__XEROXWORKCTR_MUA
+meta SCANNED_EXTERNAL __SCANNED && !ALL_TRUSTED && !__XM_XEROXWORKCTR
describe SCANNED_EXTERNAL "Scanned Document" email from external source - malware?
score SCANNED_EXTERNAL 3.00 # limit
@@ -1653,7 +1628,7 @@ header __DATE_LOWER ALL =~ /d
# duplicates __XPRIO
#header __FH_HAS_XPRIORITY exists:X-Priority
-meta __XPRIO_MINFP __XPRIO && !__CT_ENCRYPTED && !ALL_TRUSTED && !__HAS_ERRORS_TO && !__HAS_IMG_SRC && !__RCD_RDNS_MAIL_MESSY && !__VIA_ML && !__PHPMAILER_MUA && !__AC_TINY_FONT && !__HAS_PHP_SCRIPT && !__DOS_HAS_LIST_UNSUB && !__HAS_IMG_SRC_ONECASE && !__NAKED_TO && !__HAS_THREAD_INDEX && !__HAS_TNEF && !__HAS_SENDER && !__UNPARSEABLE_RELAY_COUNT && !__PDS_RDNS_MTA && !__RCD_RDNS_SMTP_MESSY && !__RCD_RDNS_MX_MESSY && !__TO___LOWER && !__FROM_WORDY && !__RP_MATCHES_RCVD && !__DKIM_EXISTS && !__FROM_WEB_DAEMON && !__RDNS_SHORT && !__L_BODY_8BITS && !__HAS_X_SENDER
+meta __XPRIO_MINFP __XPRIO && !__CT_ENCRYPTED && !ALL_TRUSTED && !__HAS_ERRORS_TO && !__HAS_IMG_SRC && !__RCD_RDNS_MAIL_MESSY && !__VIA_ML && !__XM_PHPMAILER && !__AC_TINY_FONT && !__HAS_PHP_SCRIPT && !__DOS_HAS_LIST_UNSUB && !__HAS_IMG_SRC_ONECASE && !__NAKED_TO && !__HAS_THREAD_INDEX && !__HAS_TNEF && !__HAS_SENDER && !__UNPARSEABLE_RELAY_COUNT && !__PDS_RDNS_MTA && !__RCD_RDNS_SMTP_MESSY && !__RCD_RDNS_MX_MESSY && !__TO___LOWER && !__FROM_WORDY && !__RP_MATCHES_RCVD && !__DKIM_EXISTS && !__FROM_WEB_DAEMON && !__RDNS_SHORT && !__L_BODY_8BITS && !__HAS_X_SENDER
ifplugin Mail::SpamAssassin::Plugin::DKIM
ifplugin Mail::SpamAssassin::Plugin::SPF
@@ -2277,7 +2252,7 @@ else
endif
meta __EXTORT_MANY (__MY_MALWARE + __PAY_ME + __MY_VICTIM + __YOUR_WEBCAM + __YOUR_ONAN + __YOUR_PERSONAL + __HOURS_DEADLINE + __YOUR_PASSWORD + LOCALPART_IN_SUBJECT + __DESTROY_ME + __DESTROY_YOU + __EXPLOSIVE_DEVICE + __PAXFUL + __HUSH_HUSH) > 3
-meta BITCOIN_EXTORT_01 (__BITCOIN_ID && __EXTORT_MANY) && !( __FROM_FULL_NAME && __SENDER_BOT && __SINGLE_WORD_LINE && __MIME_HTML && __PHPMAILER_MUA )
+meta BITCOIN_EXTORT_01 (__BITCOIN_ID && __EXTORT_MANY) && !( __FROM_FULL_NAME && __SENDER_BOT && __SINGLE_WORD_LINE && __MIME_HTML && __XM_PHPMAILER )
describe BITCOIN_EXTORT_01 Extortion spam, pay via BitCoin
score BITCOIN_EXTORT_01 5.000 # limit
tflags BITCOIN_EXTORT_01 publish
@@ -2808,8 +2783,6 @@ describe MSM_PRIO_REPTO M
score MSM_PRIO_REPTO 2.500 # limit
tflags MSM_PRIO_REPTO publish
-header __XM_YAMAIL X-Mailer =~ /^Yamail/
-
# __GATED_THROUGH_RCVD_REMOVER includes messages with no Received headers *at all*.
# Don't consider those, only consider the ones where *some* Received headers may have been removed
@@ -2861,18 +2834,10 @@ score HDR_CASE_REV_HELO_IP 2
header __HAS_CAMPAIGN exists:X-Campaign
header __HAS_CAMPAIGNID exists:X-Campaignid
header __HAS_CID exists:X-CID
-header __HAS_XM_LID exists:X-Mailer-LID
-header __HAS_XM_RECPTID exists:X-Mailer-RecptId
-header __HAS_XM_SID exists:X-Mailer-SID
-header __HAS_XM_SENTBY exists:X-Mailer-Sent-By
header __HAS_DOMAINKEY_SIG exists:DomainKey-Signature
header __HAS_PHP_SCRIPT exists:X-PHP-Script
header __HAS_PHP_ORIG_SCRIPT exists:X-PHP-Originating-Script
-meta XM_RECPTID __HAS_XM_RECPTID && !__TAG_EXISTS_SCRIPT && !__REPLYTO_NOREPLY && !__ENVFROM_AMAZONSES && !__DOS_DIRECT_TO_MX && !__FRAUD_PTX
-describe XM_RECPTID Has spammy message header
-score XM_RECPTID 3.000 # limit
-
header __FROM_WORDY From:addr =~ /^(?:(?:[A-Z][A-Za-z]+|or|&)\.)+[A-Z][A-Za-z]+\@/
#header __FROM_WORDY From:addr =~ /^(?:(?:[A-Z][A-Za-z]+|or|&)\.)+[A-Z][A-Za-z]+(?<!Customer\.S(?:ervice|upport))\@/
header __FROM_WORDY_3 From:addr =~ /(?:(?:[A-Z][A-Za-z]+|or|&)\.){2,}[A-Z][A-Za-z]+\@/
@@ -2889,12 +2854,12 @@ header __FROM_WORDY_3 F
#score FROM_WORDY_SHORT 2.500 # limit
#tflags FROM_WORDY_SHORT publish
-meta PHP_SCRIPT __HAS_PHP_SCRIPT && !ALL_TRUSTED && !__PHP_NOVER_MUA && !__TO___LOWER && !__MIME_BASE64 && !__HAS_ANY_EMAIL && !__L_CTE_7BIT
+meta PHP_SCRIPT __HAS_PHP_SCRIPT && !ALL_TRUSTED && !__XM_PHP_NOVER && !__TO___LOWER && !__MIME_BASE64 && !__HAS_ANY_EMAIL && !__L_CTE_7BIT
describe PHP_SCRIPT Sent by PHP script
score PHP_SCRIPT 2.500 # limit
tflags PHP_SCRIPT publish
-meta PHP_SCRIPT_MUA __HAS_PHP_SCRIPT && __PHP_NOVER_MUA
+meta PHP_SCRIPT_MUA __HAS_PHP_SCRIPT && __XM_PHP_NOVER
describe PHP_SCRIPT_MUA Sent by PHP script, no version number
score PHP_SCRIPT_MUA 2.000 # limit
tflags PHP_SCRIPT_MUA publish
@@ -2917,9 +2882,6 @@ score PHP_ORIG_SCRIPT_EVAL 3
#header __FROM_AUTHORITY_COMPANY From:name =~ /\b(?:court|fed-?ex|dhl|e-?zpass|invoice)\b/i
#meta __PHP_MALWARE_ATTACH __HAS_PHP_SCRIPT && __FROM_AUTHORITY_COMPANY && __ZIP_ATTACH_MT
-meta __XMSID __HAS_XM_SID && !__CTYPE_MULTIPART_MIXED
-meta __XMSID_SONLY __HAS_XM_SID && (INVALID_MSGID || __XPRIO || __HAS_X_MAILER)
-
header __UNSUB_MAILTO_BOGUS List-Unsubscribe =~ /mailto:[^@">]*[?">]/i
meta __MIMEOLE_DIRECT_TO_MX __HAS_MIMEOLE && __DOS_DIRECT_TO_MX
@@ -3114,10 +3076,6 @@ describe FROM_ADDR_WS M
score FROM_ADDR_WS 3.000 # limit
tflags FROM_ADDR_WS publish
-header __XM_MSWINLIVE X-Mailer =~ /^Microsoft Windows Live Mail \d+\.\d+\.\d+\.\d+/
-header __XM_IPADMAIL X-Mailer =~ /^iPad Mail \([0-9A-F]{4,8}\)/
-header __XM_IPHONEMAIL X-Mailer =~ /^iPhone Mail \([0-9A-F]{4,8}\)/
-
meta __ANY_EXTERNAL __FSL_COUNT_EXTERN > 0
@@ -3602,7 +3560,7 @@ meta SUSP_UTF8_WORD_MANY _
describe SUSP_UTF8_WORD_MANY Many words using only suspicious UTF-8 characters
score SUSP_UTF8_WORD_MANY 3.000 # limit
-meta SUSP_UTF8_WORD_COMBO __4BYTE_UTF8_WORD && ( __LIST_PARTIAL || __RDNS_NONE || __CLICK_HERE || __PHPMAILER_MUA || __STY_INVIS_3 || __TO___LOWER || __MSGID_OK_DIGITS || __HTML_IMG_ONLY )
+meta SUSP_UTF8_WORD_COMBO __4BYTE_UTF8_WORD && ( __LIST_PARTIAL || __RDNS_NONE || __CLICK_HERE || __XM_PHPMAILER || __STY_INVIS_3 || __TO___LOWER || __MSGID_OK_DIGITS || __HTML_IMG_ONLY )
describe SUSP_UTF8_WORD_COMBO Words using only suspicious UTF-8 characters + other signs
score SUSP_UTF8_WORD_COMBO 3.000 # limit
@@ -4025,54 +3983,6 @@ header REPTO_SPOTTY R
header MIXED_CTYPE_CASE Content-Type =~ m;^(?i:text/)(?!html|HTML)[Hh][Tt][Mm][Ll];
-header __XM_ONE_WORD X-Mailer =~ /^\s*\w+\s*$/
-header __XM_ONE_WORD_UNKNOWN X-Mailer =~ /^\s*(?!php|msgsend|send(?:html|inblue|mail)|liveagent|(?:cheetah|xyz|swift|power)mailer|dmdroid|codeigniter|peppered|host(?:odo|edsimply)|smart_send_\d|postfix|contactlab|communigator|magnews|(?:as2|manta|be|mikatiminge|web)mail|edelivery|sellware|WHMCS$|CR$|EMS$|SM[EF]$|ACEM$|RMM\d?|EOW\d|FM$|ZIMACS$|oempro\d|typo\d|drupal|mail(?:eon|ingwork|er|spring|force)|onlineoffice|oscommerce|redmine|m1mailmessage_v\d)\w+\s*$/i
-header __XM_ALNUM_STARTS_DIGIT X-Mailer =~ /^\s*\d+[\s\d]*[^\s\d]/
-header __XM_DIGITS_ONLY X-Mailer =~ /^\s*\d+\s*$/
-header __XM_UC_ONLY X-Mailer =~ /^[^a-z]+$/
-header __XM_UC_ONLY_UNKNOWN X-Mailer =~ /^(?!SM[EF]$|ACEM$|CR$|PHP(?:BB)?[\/\d.]*$|EMS$|TYPO\d$|WHMCS$|RMM\d?$|GURU$|SMTP(?:\sCLIENT)?$|ZIMACS$|EOW\d|FM$|EDMAIL\sR[\d.]+$|HPPWS)[^a-z]+$/
-header __XM_LC_ONLY X-Mailer =~ /^[^A-Z]+$/
-header __XM_LC_ONLY_UNKNOWN X-Mailer =~ /^(?!php|mailer$|sendhtml$)[^A-Z]+$/
-header __XM_RANDOM X-Mailer =~ /q(?!(?:q|box|i\s)?mail|\d|[-\w]*=+;)[^u]/i
-header __XM_LIGHT_HEAVY X-Mailer =~ /\b(?:light|(?<!::)lite|standard|business|pro(?:fessional)?|educational|personal)\b/i
-header __XM_VERY_LONG X-Mailer =~ /.{50}/
-
-header __XM_SMART_SEND X-Mailer =~ /^Smart_Send(?:_\d+)+$/
-header __XM_SQLANYW X-Mailer =~ /^SQL Anywhere/
-header __XM_CHEETAHMAILER X-Mailer =~ /^CheetahMailer$/
-header __XM_XYZMAILER X-Mailer =~ /^XyzMailer$/
-header __XM_DMDROID X-Mailer =~ /^dmDroid$/
-header __XM_DRUPAL X-Mailer =~ /^Drupal$/
-header __XM_ASPQMAIL X-Mailer =~ /^AspQMail/
-
-meta XM_DIGITS_ONLY __XM_DIGITS_ONLY
-describe XM_DIGITS_ONLY X-Mailer malformed
-score XM_DIGITS_ONLY 3.000 # limit
-tflags XM_DIGITS_ONLY publish
-
-# just a check
-header __XM_QBOXMAIL X-Mailer =~ /qboxmail/i
-
-
-meta XM_RANDOM __XM_RANDOM && !__STY_INVIS_3 && !__HAS_IN_REPLY_TO && !__XM_UC_ONLY && !__XM_ASPQMAIL && !__XM_VERY_LONG && !__XM_SQLANYW
-describe XM_RANDOM X-Mailer apparently random
-score XM_RANDOM 2.500 # limit
-tflags XM_RANDOM publish
-
-meta XM_UC_ONLY __XM_UC_ONLY_UNKNOWN && !__STY_INVIS_MANY && !__HAS_X_REF && !__RCVD_DOTGOV_EXT && !__XM_RANDOM && !__HDRS_LCASE_KNOWN && !__HAS_THREAD_INDEX && !__HAS_X_LOOP
-describe XM_UC_ONLY X-Mailer all uppercase
-score XM_UC_ONLY 2.500 # limit
-
-meta XM_ONE_WORD __XM_ONE_WORD_UNKNOWN && !__L_CTE_7BIT && !__HAS_X_MAILING_LIST
-describe XM_ONE_WORD X-Mailer only one word
-score XM_ONE_WORD 2.000 # limit
-
-meta XM_LIGHT_HEAVY __XM_LIGHT_HEAVY && !__HAS_X_BEEN_THERE
-describe XM_LIGHT_HEAVY Special edition of a MUA
-score XM_LIGHT_HEAVY 2.500 # limit
-
-meta XM_LONG_DUP_TO __XM_VERY_LONG && __DUPLICATE_HEADER_TO
-
# public PDF hosting abused for phishing redirects
uri __OPENTEXT_PDF m;://core.opentext.com/pdfjs/web/viewer.html?shortLink=;i
@@ -4258,7 +4168,7 @@ describe HREF_EMPTY_NORDNS E
score HREF_EMPTY_NORDNS 2.500 # limit
tflags HREF_EMPTY_NORDNS publish
-meta __HREF_EMPTY_PHPMAIL __HREF_EMPTY && (__PHPMAILER_MUA || __XMAIL_PHPMAIL)
+meta __HREF_EMPTY_PHPMAIL __HREF_EMPTY && (__XM_PHPMAILER || __XMAIL_PHPMAIL)
meta HREF_EMPTY_PHPMAIL __HREF_EMPTY_PHPMAIL
describe HREF_EMPTY_PHPMAIL Empty href + PHP Mailer
score HREF_EMPTY_PHPMAIL 2.500 # limit
Added: spamassassin/trunk/rulesrc/sandbox/jhardin/20_xmailer.cf
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_xmailer.cf Sat Apr 18 18:03:31 2026 (r1933150)
@@ -0,0 +1,119 @@
+
+# exists tests
+header __HAS_XM_LID exists:X-Mailer-LID
+header __HAS_XM_RECPTID exists:X-Mailer-RecptId
+header __HAS_XM_SID exists:X-Mailer-SID
+header __HAS_XM_SENTBY exists:X-Mailer-Sent-By
+
+# exists metas
+meta __XMSID __HAS_XM_SID && !__CTYPE_MULTIPART_MIXED
+meta __XMSID_SONLY __HAS_XM_SID && (INVALID_MSGID || __XPRIO || __HAS_X_MAILER)
+
+meta XM_RECPTID __HAS_XM_RECPTID && !__TAG_EXISTS_SCRIPT && !__REPLYTO_NOREPLY && !__ENVFROM_AMAZONSES && !__DOS_DIRECT_TO_MX && !__FRAUD_PTX
+describe XM_RECPTID Has spammy message header
+score XM_RECPTID 3.000 # limit
+
+
+# known x-mailer values
+header __XM_SMART_SEND X-Mailer =~ /^Smart_Send(?:_\d+)+$/
+header __XM_SQLANYW X-Mailer =~ /^SQL Anywhere/
+header __XM_CHEETAHMAILER X-Mailer =~ /^CheetahMailer$/
+header __XM_XYZMAILER X-Mailer =~ /^XyzMailer$/
+header __XM_DMDROID X-Mailer =~ /^dmDroid$/
+header __XM_DRUPAL X-Mailer =~ /^Drupal$/
+header __XM_ASPQMAIL X-Mailer =~ /^AspQMail/
+header __XM_MSWINLIVE X-Mailer =~ /^Microsoft Windows Live Mail \d+\.\d+\.\d+\.\d+/
+header __XM_IPADMAIL X-Mailer =~ /^iPad Mail \([0-9A-F]{4,8}\)/
+header __XM_IPHONEMAIL X-Mailer =~ /^iPhone Mail \([0-9A-F]{4,8}\)/
+header __XM_YAMAIL X-Mailer =~ /^Yamail/
+header __XM_QBOXMAIL X-Mailer =~ /qboxmail/i
+header __XM_PHP_V1 X-Mailer =~ /^PHP\s?v?\/?\d\./
+header __XM_PHP_V2 X-Mailer =~ /^PHP\d$/
+meta __XM_PHP __XM_PHP_V1 || __XM_PHP_V2
+header __XM_PHP_NOVER X-Mailer =~ /^PHP$/
+header __XM_PHPMAILER X-Mailer =~ /^PHPMailer\b/
+header __XM_MTLANDROID X-Mailer =~ /\bMotorola android mail \d+\.\d/
+header __XM_XEROXWORKCTR X-Mailer =~ /^WorkCentre \D?\d[\d\.]\d+/
+header __XM_AMADEUSMS X-Mailer =~ /^Amadeus Messaging Server/
+header __XM_FLASHMAIL X-Mailer =~ /^NetEase Flash Mail \d/
+
+# don't break rules using the old names
+meta __PHP_NOVER_MUA __XM_PHP_NOVER
+meta __PHPMAILER_MUA __XM_PHPMAILER
+meta __MTLANDROID_MUA __XM_MTLANDROID
+meta __XEROXWORKCTR_MUA __XM_XEROXWORKCTR
+meta __AMADEUSMS_MUA __XM_AMADEUSMS
+meta __FLASHMAIL_MUA __XM_FLASHMAIL
+meta __PHP_MUA_1 __XM_PHP_V1
+meta __PHP_MUA_2 __XM_PHP_V2
+meta __PHP_MUA __XM_PHP
+
+# from spample on users list 7/20/2011
+header __XM_PHPMAILER_FORGED X-Mailer =~ /PHPMailer\s.*version\D+$/
+
+# from spample on users list 7/24/2011
+header __XM_EC_MESSENGER X-Mailer =~ /\beC-Messenger\b/
+
+
+# x-mailer patterns
+header __XM_ONE_WORD X-Mailer =~ /^\s*\w+\s*$/
+header __XM_ONE_WORD_UNKNOWN X-Mailer =~ /^\s*(?!php|msgsend|send(?:html|inblue|mail)|liveagent|(?:cheetah|xyz|swift|power)mailer|dmdroid|codeigniter|peppered|host(?:odo|edsimply)|smart_send_\d|postfix|contactlab|communigator|magnews|(?:as2|manta|be|mikatiminge|web)mail|edelivery|sellware|WHMCS$|CR$|EMS$|SM[EF]$|ACEM$|RMM\d?|EOW\d|FM$|ZIMACS$|oempro\d|typo\d|drupal|mail(?:eon|ingwork|er|spring|force)|onlineoffice|oscommerce|redmine|m1mailmessage_v\d)\w+\s*$/i
+header __XM_ALNUM_STARTS_DIGIT X-Mailer =~ /^\s*\d+[\s\d]*[^\s\d]/
+header __XM_DIGITS_ONLY X-Mailer =~ /^\s*\d+\s*$/
+header __XM_UC_ONLY X-Mailer =~ /^[^a-z]+$/
+header __XM_UC_ONLY_UNKNOWN X-Mailer =~ /^(?!SM[EF]$|ACEM$|CR$|PHP(?:BB)?[\/\d.]*$|EMS$|TYPO\d$|WHMCS$|RMM\d?$|GURU$|SMTP(?:\sCLIENT)?$|ZIMACS$|EOW\d|FM$|EDMAIL\sR[\d.]+$|HPPWS)[^a-z]+$/
+header __XM_LC_ONLY X-Mailer =~ /^[^A-Z]+$/
+header __XM_LC_ONLY_UNKNOWN X-Mailer =~ /^(?!php|mailer$|sendhtml$)[^A-Z]+$/
+header __XM_RANDOM X-Mailer =~ /q(?!(?:q|box|i\s)?mail|\d|[-\w]*=+;)[^u]/i
+header __XM_LIGHT_HEAVY X-Mailer =~ /\b(?:light|(?<!::)lite|standard|business|pro(?:fessional)?|educational|personal)\b/i
+header __XM_VERY_LONG X-Mailer =~ /.{50}/
+
+# scored
+
+# from spample on users list 7/20/2011
+meta XM_PHPMAILER_FORGED __XM_PHPMAILER_FORGED
+describe XM_PHPMAILER_FORGED Apparently forged header
+tflags XM_PHPMAILER_FORGED publish
+
+# from spample on users list 7/24/2011
+#meta XM_EC_MESSENGER __XM_EC_MESSENGER
+#describe XM_EC_MESSENGER eC-Messenger bulk mail service
+
+meta XM_DIGITS_ONLY __XM_DIGITS_ONLY
+describe XM_DIGITS_ONLY X-Mailer malformed
+score XM_DIGITS_ONLY 3.000 # limit
+tflags XM_DIGITS_ONLY publish
+
+meta XM_UC_ONLY __XM_UC_ONLY_UNKNOWN && !__STY_INVIS_MANY && !__HAS_X_REF && !__RCVD_DOTGOV_EXT && !__XM_RANDOM && !__HDRS_LCASE_KNOWN && !__HAS_THREAD_INDEX && !__HAS_X_LOOP
+describe XM_UC_ONLY X-Mailer all uppercase
+score XM_UC_ONLY 2.500 # limit
+
+meta XM_ONE_WORD __XM_ONE_WORD_UNKNOWN && !__L_CTE_7BIT && !__HAS_X_MAILING_LIST
+describe XM_ONE_WORD X-Mailer only one word
+score XM_ONE_WORD 2.000 # limit
+
+meta XM_LIGHT_HEAVY __XM_LIGHT_HEAVY && !__HAS_X_BEEN_THERE
+describe XM_LIGHT_HEAVY Special edition of a MUA
+score XM_LIGHT_HEAVY 2.500 # limit
+
+meta XM_LONG_DUP_TO __XM_VERY_LONG && __DUPLICATE_HEADER_TO
+
+
+ifplugin Mail::SpamAssassin::Plugin::DKIM
+ meta PHP_NOVER_MUA __PHP_NOVER_MUA && !__DKIM_DEPENDABLE && !__TO_NO_BRKTS_HTML_ONLY && !__MSGID_OK_DIGITS && !__UPPERCASE_25_50 && !__RP_MATCHES_RCVD && !__GIF_ATTACH
+else
+ meta PHP_NOVER_MUA __PHP_NOVER_MUA && !__TO_NO_BRKTS_HTML_ONLY && !__MSGID_OK_DIGITS && !__UPPERCASE_25_50 && !__RP_MATCHES_RCVD && !__GIF_ATTACH
+endif
+describe PHP_NOVER_MUA Mail from PHP with no version number
+score PHP_NOVER_MUA 3.000 # limit
+tflags PHP_NOVER_MUA publish
+
+
+# When adding FP exclusions: list XM exclusions _first_, then masscheck-based non-XM FP Avoidance exclusions.
+# Please do not add XM exclusions on the end. They are much more tightly bound than exclusions based on "no spam hits" in ruleqa.
+meta XM_RANDOM __XM_RANDOM && !__XM_UC_ONLY && !__XM_VERY_LONG && !__XM_ASPQMAIL && !__XM_SQLANYW && !__STY_INVIS_3 && !__HAS_IN_REPLY_TO
+describe XM_RANDOM X-Mailer apparently random
+score XM_RANDOM 2.500 # limit
+tflags XM_RANDOM publish
+
+