#LAST UPDATED 04.09.2020

#UNCOMMENT TO BE MORE SPECIFIC (LESS STRICT)
#TESTSFAILED	END	NOTCONTAINS	FILTER-NOSENDER

#FOWARDED BOUNCES
BODY	END	PCRE	(?i:---------- Forwarded message ---------)

#OWN SERVER IP
#BODY		END	CONTAINS	216.144.210.169
#BODY		END	CONTAINS	216.144.210.170

BODY	20	PCRE	(?i:You've received a (postcard|greeting e?card) from a ((Class|school).mate|Neighbou?r))
BODY	10	PCRE	(?i:The following addresses had (delivery problems|permanent fatal errors))
BODY	10	PCRE	(?i:mailbox (has exceeded the limit|is full: retry timeout exceeded|unknown or not accepting mail))

BODY	10	PCRE		(?i:A message could not be delivered to)
BODY	10	PCRE		(?i:A message you have sent has been detected as Spam)
BODY	10	PCRE		(?i:Bad destination mailbox address)
BODY	10	PCRE		(?i:blocked by our Spam Firewall)
BODY	10	PCRE		(?i:Could not deliver in a reasonable time)
BODY	10	PCRE		(?i:Delivery attempts will continue to be made for)
BODY	10	CONTAINS	Delivery Status Notification
BODY	10	CONTAINS	Delivery to the following recipient failed permanently:
BODY	10	CONTAINS	Delivery to the following recipients failed
BODY	10	CONTAINS	did not reach the following recipient(s):
BODY	10	CONTAINS	e-mail account does not exist at the organization
BODY	10	CONTAINS	I was unable to deliver your message to
BODY	10	CONTAINS	I'm protecting myself from receiving junk mail
BODY	10	CONTAINS	Message from InterScan Messaging Security Suite
BODY	10	CONTAINS	MAILER-DAEMON@
BODY	10	CONTAINS	No tienes permiso para enviar mensajes al grupo
BODY	10	CONTAINS	original message was rejected
BODY	10	CONTAINS	Recipient address rejected:
BODY	10	CONTAINS	Recipient no longer on server
BODY	10	CONTAINS	Recipient's mailbox is full
BODY	10	CONTAINS	Reporting-MTA: dns; barracuda.
BODY	10	CONTAINS	Sorry, no mailbox here by that name
BODY	10	CONTAINS	The following recipient(s) could not be reached:
BODY	10	CONTAINS	The recipient name is not recognized
BODY	10	CONTAINS	This address no longer accepts mail
BODY	10	CONTAINS	This is a permanent error; I've given up. Sorry it didn't work out.
BODY	10	CONTAINS	This message was created automatically by mail delivery software (Exim).
BODY	10	CONTAINS	This Message was undeliverable due to the following reason:
BODY	10	CONTAINS	this recipient does not exist or not yet activated
BODY	10	CONTAINS	Unable to deliver message to the following recipients
BODY	10	CONTAINS	Unfortunately, your mail was not delivered to the following address:
BODY	10	CONTAINS	was considered as an unsolicited message (spam) by the receiving mail
BODY	10	CONTAINS	was considered unsolicited bulk e-mail (UBE)
BODY	10	CONTAINS	we are unable to deliver your fax because
BODY	10	CONTAINS	X-Spam-Flag: YES
BODY	10	CONTAINS	You do not have permission to post to group
BODY	10	CONTAINS	Your message cannot be delivered to the following recipients:
BODY	10	CONTAINS	Your message could not be sent
BODY	10	CONTAINS	Your message did not reach some or all of the intended recipients
BODY	10	CONTAINS	Your message to the following recipients cannot be delivered:


BODY	10	CONTAINS	McAfee GroupShield discovered a problem
BODY	10	CONTAINS	MDaemon has detected restricted attachments within an email message
BODY	10	CONTAINS	Symantec Mail Security detected 
BODY	10	CONTAINS	MailEnable: Message delivery has been delayed.
BODY	10	CONTAINS	MailMarshal (an automated content monitoring gateway)

BODY	10	CONTAINS	Dies ist eine automatisch erstellte Benachrichtigung über den Zustellstatus.
BODY	10	CONTAINS	Échec de la remise aux destinataires suivants
BODY	10	CONTAINS	Cette notification d'état de remise est générée automatiquement

BODY	10	CONTAINS	5.1.0 - Unknown address error
BODY	10	CONTAINS	SMTP diagnostic: 550 RCPT TO:
BODY	10	CONTAINS	(user not found)
BODY	10	CONTAINS	not listed in Domino Directory

BODY	10	PCRE		(?i:5.1.1 (User unknown|- Bad destination email address 'reject'))
BODY	10	PCRE		(?i:550 (Mailbox (unavailable|not found)|Bulk Email by DCC|unknown user|No such recipient|5\.7\.1 Message content rejected, UBE|Invalid recipient))

BODY	10	CONTAINS 	554 Sorry, message looks like SPAM to me
BODY	10	CONTAINS 	Email was sent to [Invalid User]
BODY	10	CONTAINS 	MTA Response :553
BODY	10	CONTAINS 	Message bounced by administrator
BODY	10	CONTAINS 	MIMEsweeper Analysis Results
BODY	10	CONTAINS 	Recipient unknown
BODY	10	CONTAINS 	Delivery has failed to these recipients
BODY	10	CONTAINS 	message could not be delivered to the recipients

BODY	10	CONTAINS	You are not allowed to post to this mailing list

SUBJECT	30	CONTAINS	Benachrichtung
SUBJECT	30	CONTAINS	Considered UNSOLICITED BULK EMAIL
SUBJECT	30	CONTAINS	Delayed Mail (still being retried)
SUBJECT	30	CONTAINS	e-mail Content Alert
SUBJECT	30	CONTAINS	Lieferstatusbenachrichtigung
SUBJECT	30	CONTAINS	Mail could not be delivered
SUBJECT	30	CONTAINS	Mail Not Delivered
SUBJECT	30	CONTAINS	Mail System Error - Returned Mail
SUBJECT	30	CONTAINS	Message delayed (
SUBJECT	30	CONTAINS	Message you sent blocked by our bulk email filter
SUBJECT	30	CONTAINS	NDN:
SUBJECT	30	CONTAINS	Non remis :
SUBJECT	30	CONTAINS	Notifica sullo stato del recapito 
SUBJECT	30	CONTAINS	Notification d'état de la distribution
SUBJECT	30	CONTAINS	Returned mail
SUBJECT	30	CONTAINS	Transient Delivery Failure
SUBJECT	30	CONTAINS	Unzustellbar:
SUBJECT	30	CONTAINS	Warning:

SUBJECT	30	PCRE	(?:\*\*Message you sent blocked by our.*\*\*)
SUBJECT	30	PCRE	(?i:Delivery.{0,10}(Failure|status|notification|report).{0,25})
SUBJECT	30	PCRE	(?i:fail(ure|ed).(delivery|notice))
SUBJECT	30	PCRE	(?i:Mail delivery fail(ure|ed))
SUBJECT	30	PCRE	(?i:Unable to (deliver|process) your message)
SUBJECT	30	PCRE	(?i:Undeliver(able|ed):?.(Mail)?)


#SPAMASSASIN RULES

SUBJECT	10	CONTAINS	Yahoo! Auto Response
SUBJECT	10	PCRE	(?i:Returned mail.{0,5}(?:Error During Delivery|see transcript for details))

HEADERS	10	PCRE	(?im:X-Error-Status.*User unknown)

SUBJECT	10	PCRE	(?i:Returned mail: User unknown)
SUBJECT	10	PCRE	(?i:Mail delivery failed:)
SUBJECT	10	PCRE	(?i:Message Delivery Failure)

BODY	10	CONTAINS	This messages was created automatically by mail delivery software

#OUT OF OFFICE

SUBJECT		5	PCRE	(?i:Mensaje de respuesta autom.tica)
SUBJECT		5	PCRE	(?i:R.ponse automatique d'absence du bureau)
SUBJECT		5	PCRE	(?i:away from the office)
SUBJECT		5	PCRE	(?i:Auto Resposta)
SUBJECT		5	PCRE	(?i:Automaattinen poissaolovastaus:)

BODY		2	PCRE	(?i:(i?:.m| am| will be|.ll be) (?:(?:out of|away from) the office|on vacation) (?:from|to|until|after)\b)
BODY		2	PCRE	(?i:away until .{10,20} and am unable to read your message\b)
BODY		2	PCRE	(?i:I am currently out of the office\b)

#AV BACKSCATTER

BODY		10	PCRE	(?i:prohibits the sending of executable files via email)

SUBJECT 	0 STARTSWITH Antigen found VIRUS= 
SUBJECT 	0 STARTSWITH ScanMail Message: To 
SUBJECT 	0 STARTSWITH Disallowed attachment type found in sent message
SUBJECT 	0 IS Mail status report

BODY 		0 CONTAINS destination server said: Message rejected due to possible virus
BODY 		0 CONTAINS Our virus detector has just been triggered by a message you sent:
BODY 		0 CONTAINS The virus detector said this about the message:
BODY 		0 CONTAINS Antigen for Exchange removed
BODY 		0 CONTAINS was found to match the FILE FILTER= *.pif file filter
BODY 		0 CONTAINS was found to match the FILE FILTER= *.exe file filter

#SENDER VERIFICATION 

BODY		7	CONTAINS	The message you sent requires that you verify that you are a real live human being and not a spam source
BODY		7	CONTAINS	To complete this verification, simply reply to this message and leave the subject line intact.
BODY		7	CONTAINS	protected against spam and viruses by MailInBlack
BODY		7	CONTAINS	For more information on email virus scanning, security and content management, visit http://www.marshalsoftware.com
BODY		7	CONTAINS	ChoiceMail sender verification:
BODY		7	CONTAINS	real live human being and not a spam source
BODY		7	CONTAINS	I am now using Vanquish to avoid spam
BODY		7	CONTAINS	This is a anti-spam measure. Thanks for understanding
BODY		7	CONTAINS	blocked by the Friends system
BODY		7	CONTAINS	This message was created automatically by mail delivery software (TMDA)
BODY		7	CONTAINS	100% spam-free email provided by Sendio
BODY		7	CONTAINS	protected against spam and viruses by MailInBlack
BODY		7	CONTAINS	protected by ChoiceMail One
BODY		7	CONTAINS	RADAR (Request And Delivery Authentication Response)
BODY		7	CONTAINS	100% spam-free email provided by Sendio
BODY		7	CONTAINS	This email system is protected to reduce the amount of unsolicited email (spam).

MAILFROM	7	CONTAINS	spamlion

SUBJECT		7	CONTAINS	Your email requires verification verify
SUBJECT		7	CONTAINS	MessageLabs Content Control service has identified that an email sent by you may contain inappropriate content
SUBJECT		7	CONTAINS	[Spam Challenge]