#--------------------------------------------------
# Version 0.01
#--------------------------------------------------

#--------------------------------------------------
# top level domain matching, from a github gist
#--------------------------------------------------
	
header SPAMMY_TLD_IN_RCVD Received =~ /(\.net\.ae|\.net\.id|\.ro|\.cz|\.co\.ke|\.AC\.ZA|\.co\.in|\.com\.vn|\.vn|\.cc|\.ua|\.com\.br|\.gr|\.hr|\.dk|\.win|\.bid|\.tw|\.br|\.pk|\.top|\.club|\.date|\.stream|\.xyz|\.trade|\.icu|\.press|\.pro|\.pet|\.kim|\.red)\s/i
score SPAMMY_TLD_IN_RCVD 0.3
describe SPAMMY_TLD_IN_RCVD Spammy TLD used in Received line

header SPAMMY_TLD_IN_FROM From =~ /(\.net\.ae|\.net\.id|\.ro|\.co\.jp|\.co\.ke|\.AC\.ZA|\.co\.in|\.com\.vn|\.vn|\.cc|\.ua|\.com\.br|\.gr|\.hr|\.cz|\.win|\.bid|\.tw|\.br|\.pk|\.top|\.club|\.date|\.stream|\.xyz|\.trade|\.icu|\.press|\.pro|\.pet|\.kim|\.red)>$/i
score SPAMMY_TLD_IN_FROM 0.3
describe SPAMMY_TLD_IN_FROM Spammy TLD used in From line

header __HIGH_SPAMMY_TLD_RCVD Received =~ /\.(win|bid|top|club|date|stream|xyz|icu)\/.*/i
header __HIGH_SPAMMY_TLD_FROM From =~ /\.(win|bid|top|club|date|stream|xyz|icu)\/.*/i
uri __HIGH_SPAMMY_TLD_URI /\.(win|bid|top|club|date|stream|xyz)\/.+/i
meta HIGH_SPAMMY_TLD (__HIGH_SPAMMY_TLD_RCVD && __HIGH_SPAMMY_TLD_FROM && __HIGH_SPAMMY_TLD_URI)
score HIGH_SPAMMY_TLD 1.1
describe HIGH_SPAMMY_TLD HIGH spammy tld used in Received, From and link

#--------------------------------------------------
# no SPF fuck you score
#--------------------------------------------------
header NOSPF Received-SPF = /None/i
score NOSPF 3.0

header SOFTFAILSPF Received-SPF = /Softfail/i
score SOFTFAILSPF 3.0

#--------------------------------------------------
# uri matching
#--------------------------------------------------

# Something with ketoxplode.
uri SPAM_LINK_1 /ketoxplode/i
score SPAM_LINK_1 5
describe SPAM_LINK_1 Spam link

#--------------------------------------------------
# from matching
#--------------------------------------------------
header FROM_KETO From =~ /ketoxplode/i
score FROM_KETO 5.0

header FROM_ICS_ALERTS From =~ /icsmailing/i
score FROM_ICS_ALERTS 5.0

header FROM_KVK_HER From =~ /KVK-Herbevestiging/i
score FROM_KVK_HER 5.0

#--------------------------------------------------
# Subject matching
#--------------------------------------------------
header __SUBJECT_LUCHTBRUG Subject =~ /luchtbrug/i
header __SUBJECT_LUCHTBRUGVRAAG Subject =~ /vragenlijst/i
meta SUBJECT_LUCHTBRUG (__SUBJECT_LUCHTBRUG && __SUBJECT_LUCHTBRUGVRAAG)
score SUBJECT_LUCHTBRUG 5.0

header __SUBJECT_ICS_ALERTS Subject =~ /card alerts/i
score __SUBJECT_ICS_ALERTS 5.0

header __SUBJECT_MIKEBOS Subject =~/mikebos/i
score __SUBJECT_MIKEBOS 5.0

header __SUBJECT_UITROEPTEKENS =~ /!!!/i
score __SUBJECT_UITROEPTEKENS 2.5

header __SUBJECT_KVK =~ /u heeft recht op btw teruggave/i
score __SUBJECT_KVK 5