# junkfilter
# a junk e-mail filter system for procmail
# Copyright 1997-98, Gregory Sutter <gsutter@pobox.com>
#
# $Id: junkfilter.one,v 2.8 1999/03/28 09:06:06 gsutter Exp $
#
# Please read the file "junkfilter.readme" and the page
# http://www.pobox.com/~gsutter/junkfilter/ before using
# junkfilter.  junkfilter is copyright 1997-98 Gregory
# Sutter and is licensed under the terms of the GNU
# General Public License, version 2.  See the file
# junkfilter.readme for details.

# This is junkfilter.one, 100% certainty spam catchers.

JFSEC=1

# Kills anything from an impossible IP address
:0
* ()\/^Received.*\[[0-9\.]*([03-9][0-9][0-9]|2[6-9][0-9]|25[6-9])
{ JFMATCH="$JFSEC: Forged Received header: $MATCH" INCLUDERC=$JFDIR/junkfilter.match }

# Mail needs to have certain headers.
:0
* ! ()\/^(From|Date):[ 	]*.*
{ JFMATCH="$JFSEC: Missing necessary header: $MATCH" INCLUDERC=$JFDIR/junkfilter.match }

# junk mail / mail bomb software
:0D
* ()\/^X-(Mailer|Sender):.*(Aristotle|Avalanche|Blaster|Bomber|DejaVu|eMerge|Extractor|Floodgate|friendlymail|fusion|GeoList|Group|Mach10|MegaPro|RAF|RIME|TURBO)\>
{ JFMATCH="$JFSEC: Junkmail software: $MATCH" INCLUDERC=$JFDIR/junkfilter.match }

:0D
* ()\/^(Received|Message-Id|X-(Mailer|Sender)):.*(AutoMail|E-Broadcaster|Emailer Platinum|eMarksman|Extractor|e-Merge|Global Messenger|GroupMaster|List-X|Mailcast|MAILGOD|MailKing|Match10|MassE-Mail|massmail\.pl|NetContact|NetMailer|News Breaker|Powermailer|Quick Shot|Ready Aim Fire|WindoZ|WinNT\'s Blat|WorldMerge|Yourdora)\>
{ JFMATCH="$JFSEC: Junkmail Software: $MATCH" INCLUDERC=$JFDIR/junkfilter.match }

# Pegasus mailer is the only mailer which legitimately generates 
# "Comments: Authenticated sender is ..." so kill anything else.
# This works for versions 2.54 and below only.
:0
* ^Comments:.*Authenticated sender
* !^X-Mailer:.*Pegasus Mail
* !^Resent-To:
* !^Return-Path:.*owner-
{ JFMATCH="$JFSEC: Forged Pegasus Mail authentication" INCLUDERC=$JFDIR/junkfilter.match }

# "unknown host" is not a valid Received: header
:0
* ()\/^Received:.*unknown host
{ JFMATCH="$JFSEC: Forged Received header: $MATCH" INCLUDERC=$JFDIR/junkfilter.match }

# Check to see if they're trying to exploit a security fault in
# Sendmail 8.8, like MailGod does.
:0
* ^Received:.....................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................
{ JFMATCH="$JFSEC: Received line longer than 1023 characters" INCLUDERC=$JFDIR/junkfilter.match }

# Stop the happy.exe / Spanska email worm
:0
* ^X-Span(ks|sk)a:
{ JFMATCH="$JFSEC: Happy.exe email worm present" INCLUDERC=$JFDIR/junkfilter.match }

# Stop the Melissa virus.  Damn these things!  
:0
* ^Subject:[ 	]*important message from
{
	:0 B
	* Here is that document you asked for
	* ^Content-[a-z]+:.*\.do[ct]
	{ JFMATCH="$JFSEC: Melissa email virus" INCLUDERC=$JFDIR/junkfilter.match }
}


JFSEC

# EOF junkfilter.one