if not first_delivery
then
  finish
endif

if ${length_80:$header_date:} is not $header_date:
then
  fail text "This message has been rejected because it has\n\
             an overlength date field which can be used\n\
             to subvert Microsoft mail programs\n\
             The following URL has further information\n\
             http://www.securityfocus.com/frames/?content=/templates/article.html%3Fid%3D61"
  seen finish
endif

if $header_from: contains "@sexyfun.net"
then
  fail text "This message has been rejected since it has\n\
             the signature of a known virus in the header."
  seen finish
endif
if error_message and $header_from: contains "Mailer-Daemon@"
then
  # looks like a real error message - just ignore it
  finish
endif


if "${if def:header_X-Spam-Subject: {there}}" is there
then
    headers remove Subject
    headers add "Subject: $h_X-Spam-Subject:"
    headers remove X-Spam-Subject
endif
if not first_delivery
then
  finish
endif

if $header_content-type: matches "(?:file)?name=(\"[^\"]+\\\\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc])\")"
then
  fail text "This message has been rejected because it has\n\
             potentially executable content $1\n\
             This form of attachment has been used by\n\
             recent viruses or other malware.\n\
             If you meant to send this file then please\n\
             package it up as a zip file and resend it."
  seen finish
endif
if $header_content-type: matches "(?:file)?name=(\\\\S+\\\\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc]))\\$"
then
  fail text "This message has been rejected because it has\n\
             potentially executable content $1\n\
             This form of attachment has been used by\n\
             recent viruses or other malware.\n\
             If you meant to send this file then please\n\
             package it up as a zip file and resend it."
  seen finish
endif

if ("$h_to:, $h_cc:, $h_bcc" contains "bradley8dc@hotmail.com")
then
 fail text "This message has been rejected"
 seen finish
endif

if ("$h_to:, $h_cc:, $h_bcc" contains "aelkhaddari@gmail.com")
then
 fail text "This message has been rejected"
 seen finish
endif

if
 $message_body contains "downloadm.zip"
 or $message_body contains "reg_pass-data.zip"
then
 save "/dev/null" 660
endif

if
 $header_message-id CONTAINS "boro-sbs.boro.local"
 then
 save "/dev/null" 660
endif

if $header_from: matches "((cobranca|financeiro)@srv[0-9][0-9][0-9].(info|teste|site))"
then
 fail text "Rejected: Phishing"
 seen finish
endif

if
 $header_subject CONTAINS "Investment Strategy"
 or $header_subject CONTAINS "o de seu iToken / iToken no aplicativo"
 or $header_subject CONTAINS "Online Casino"
 or $header_subject contains " viagra "
 or $header_subject contains " Levitra "
 or $header_subject contains " levitra "
 or $header_subject CONTAINS " Cialis "
 or $header_subject CONTAINS " cialis "
 or $header_subject contains " penis "
 or $header_subject contains "pen!s"
 or $header_subject contains " penile "
 or $header_subject CONTAINS " casino "
 or $header_subject IS "FDA Approved"
 or $header_subject CONTAINS " Erections "
 or $header_subject matches "Changes tariff plan.*A Small Orange Hosting"
 or $header_subject CONTAINS "Se atalho fosse bom o nome dele seria caminho"
 or $header_subject CONTAINS "Ganhar Dinheiro Na Internet Saiba Como"
 or $header_subject CONTAINS "Alerta Bradesco Data"
 or $header_subject CONTAINS "Kit Toldo Retr"
 or $header_subject CONTAINS "Sua conta foi comprometida"
 or $header_subject CONTAINS "Los hackers piratearon tu cuenta"
 or $header_subject CONTAINS "Conclua para continuar utilizando normalmente seu acesso."
 or $header_subject CONTAINS "Dyson V11"
 or $header_subject CONTAINS "Quickly write to this cutie"
 or $header_subject CONTAINS "Write soon hot beauty"
 or $header_subject CONTAINS "only real girl is waiting for you"
 or $header_subject CONTAINS "She is real girl"
 or $header_subject CONTAINS "real acquaintance with a beautiful girl"
 or $header_subject CONTAINS "Real girl"
 or $header_subject CONTAINS "Hot super girl"
 or $header_subject CONTAINS "Super girl"
 or $header_subject CONTAINS "Hot acquaintance with beauty"
 or $header_subject CONTAINS "Want to meet a hot beauty!"
 or $header_subject CONTAINS "Incredible girl"
 or $header_subject IS "Fwd: for all"
 or $header_subject IS "Re: for all"
 or $header_subject IS "Fw: for all"
 or $header_subject matches "Workshop on.*Energy Management"
 or $header_subject IS "Notification - Janmashtami Holidays"
 or $header_subject IS "Participation in Gandhi Global"
 or $header_from contains "750millionstrong.com"
 or $header_from contains "@newsletter.aol.com"
 or $header_from contains "billing@aol.com"
 or $header_from contains "bounce@candly.monster"
 or $header_from contains "280zxpilot@gmail.com"
 or $header_from contains "medicalfuturist.com"
 or $message_body matches "Your account contains more than [0-9]+ directories" and $message_headers does not contain "backupproxy1"
then
 save "/dev/null" 660
endif

if $h_subject: is "CAN LEAK EVERYTHING!"
then
  seen finish
endif

if $h_subject: contains "CAN LEAK EVERYTHING!"
then
  fail text "This message has been rejected since it\n\
             matches a known spam campain."
  seen finish
endif

if ("$h_subject:" matches "\\\\[ .* \\\\] WARNING The domain \".*\" has reached their disk quota.")
then
  fail text "This message has been rejected since it\n\
             matches a known phishing campaign."
  seen finish
endif