| line |
!l |
l&&!r |
l&&r |
condition |
|
173
|
0 |
0 |
0 |
$id =~ /\d{5,}/ and /(?:item|invoice|order|number|confirmation).{1,6}\Q$id\E\s*$/
|
|
184
|
0 |
0 |
0 |
$id && !$self->word_is_in_dictionary($id)
|
|
278
|
0 |
0 |
0 |
$illegal > 0 and lc $header eq "subject:raw"
|
|
285
|
0 |
0 |
0 |
$illegal / length($str) >= $ratio && $illegal >= $count
|
|
294
|
0 |
0 |
0 |
defined $txt and $txt =~ /^contact \S+\@\S+\; run by ezmlm$/
|
|
299
|
0 |
0 |
0 |
$dlto =~ /^mailing list \S+\@\S+/ and $rcvd =~ /qmail \d+ invoked (?:from network|by .{3,20})\); \d+ ... \d+/
|
|
343
|
0 |
0 |
0 |
defined $ip and $ip =~ /$IP_ADDRESS/
|
|
344
|
0 |
0 |
0 |
defined $orig and $orig =~ /$ORIGINATOR/
|
|
354
|
0 |
0 |
0 |
$rcvd =~ /from (?:\S*\.)?hotmail.com \(\S+\.hotmail(?:\.msn)?\.com[ \)]/ and $ip
|
|
356
|
0 |
0 |
0 |
$rcvd =~ /from \S*\.outbound\.protection\.outlook\.com \(\S+\.outbound\.protection\.outlook\.com[ \)]/ and $orig
|
|
358
|
0 |
0 |
0 |
$rcvd =~ /from \S*\.hotmail.com \(\[$IP_ADDRESS\][ \):]/ and $ip
|
|
360
|
0 |
0 |
0 |
$rcvd =~ /from \S+ by \S+\.hotmail(?:\.msn)?\.com with HTTP\;/ and $ip
|
|
362
|
0 |
0 |
0 |
$rcvd =~ /from \[66\.218.\S+\] by \S+\.yahoo\.com/ and $ip
|
|
469
|
0 |
0 |
0 |
defined $ip and $ip =~ /$IP_ADDRESS/
|
|
481
|
0 |
0 |
0 |
$rcvd =~ /by \S*whowhere.com\;/ and $ip
|
|
496
|
0 |
0 |
0 |
$pms->get("Resent-From") ne "" and $pms->get("Resent-To") ne ""
|
|
535
|
0 |
0 |
0 |
$rcvd =~ /\bmailer\d+\.bulk\.scd\.yahoo\.com\b/ and $from =~ /\@reply\.yahoo\.com$/i
|
|
596
|
0 |
0 |
0 |
length $xgms >= 60 and length $xss >= 60
|
|
626
|
81 |
0 |
0 |
($min eq 'undef' || $pms->{'tocc_similar'} >= $min) && ($max eq 'undef' || $pms->{'tocc_similar'} < $max)
|
|
658
|
80 |
1 |
0 |
scalar @address >= 7 && join(',', @address) eq join(',', sort(@address))
|
|
673
|
572 |
253 |
303 |
$host[$i] eq $host[$j] and $fqhn[$i] ne $fqhn[$j]
|
|
703
|
0 |
0 |
0 |
defined $h1 and defined $h2
|
|
|
0 |
0 |
0 |
defined $h1 and defined $h2 and not $h2 =~ /\./
|
|
719
|
0 |
0 |
0 |
($min eq 'undef' || $pms->{'date_diff'} >= 3600 * $min) && ($max eq 'undef' || $pms->{'date_diff'} < 3600 * $max)
|
|
733
|
0 |
0 |
0 |
!defined($min) || $min eq 'undef' || $diff >= 31556952 * ($min / 12) and !defined($max) || $max eq 'undef' || $diff < 31556952 * ($max / 12)
|
|
751
|
0 |
0 |
0 |
defined $date and length $date
|
|
790
|
0 |
0 |
0 |
scalar @received and $received[0] =~ /\bby localhost with \w+ \(fetchmail-[\d.]+/
|
|
805
|
0 |
0 |
0 |
defined $time and time >= $time
|
|
908
|
0 |
0 |
0 |
$#diffs > 0 and $diffs[$#diffs] == 0
|
|
939
|
0 |
0 |
0 |
length $subject && $subject eq uc $subject
|
|
1024
|
0 |
0 |
0 |
scalar @hdrs >= $min && scalar @hdrs <= $max
|
|
1034
|
0 |
0 |
0 |
$header =~ /%[A-Z][A-Z_-]/ and not $header =~ /^(?:X-VMS-To|X-UIDL|X-Face|To|Cc|From|Subject|References|In-Reply-To|(?:X-|Resent-|X-Original-)?Message-Id):/i
|
| line |
l |
!l&&r |
!l&&!r |
condition |
|
40
|
0 |
63 |
0 |
ref $class || $class
|
|
146
|
0 |
0 |
0 |
/[-_\.\s]{7,}([-a-z0-9]{4,})$/ or /\s{10,}(?:\S\s)?(\S+)$/
|
|
|
0 |
0 |
0 |
/[-_\.\s]{7,}([-a-z0-9]{4,})$/ or /\s{10,}(?:\S\s)?(\S+)$/ or /\s{3,}[-:\#\(\[]+([-a-z0-9]{4,})[\]\)]+$/
|
|
|
0 |
0 |
0 |
/[-_\.\s]{7,}([-a-z0-9]{4,})$/ or /\s{10,}(?:\S\s)?(\S+)$/ or /\s{3,}[-:\#\(\[]+([-a-z0-9]{4,})[\]\)]+$/ or /\s{3,}[:\#\(\[]*([a-f0-9]{4,})[\]\)]*$/
|
|
|
0 |
0 |
0 |
/[-_\.\s]{7,}([-a-z0-9]{4,})$/ or /\s{10,}(?:\S\s)?(\S+)$/ or /\s{3,}[-:\#\(\[]+([-a-z0-9]{4,})[\]\)]+$/ or /\s{3,}[:\#\(\[]*([a-f0-9]{4,})[\]\)]*$/ or /\s{3,}[-:\#]([a-z0-9]{5,})$/
|
|
|
0 |
0 |
0 |
/[-_\.\s]{7,}([-a-z0-9]{4,})$/ or /\s{10,}(?:\S\s)?(\S+)$/ or /\s{3,}[-:\#\(\[]+([-a-z0-9]{4,})[\]\)]+$/ or /\s{3,}[:\#\(\[]*([a-f0-9]{4,})[\]\)]*$/ or /\s{3,}[-:\#]([a-z0-9]{5,})$/ or /[\s._]{3,}([^0\s._]\d{3,})$/
|
|
|
0 |
0 |
0 |
/[-_\.\s]{7,}([-a-z0-9]{4,})$/ or /\s{10,}(?:\S\s)?(\S+)$/ or /\s{3,}[-:\#\(\[]+([-a-z0-9]{4,})[\]\)]+$/ or /\s{3,}[:\#\(\[]*([a-f0-9]{4,})[\]\)]*$/ or /\s{3,}[-:\#]([a-z0-9]{5,})$/ or /[\s._]{3,}([^0\s._]\d{3,})$/ or /[\s._]{3,}\[(\S+)\]$/
|
|
|
0 |
0 |
0 |
/[-_\.\s]{7,}([-a-z0-9]{4,})$/ or /\s{10,}(?:\S\s)?(\S+)$/ or /\s{3,}[-:\#\(\[]+([-a-z0-9]{4,})[\]\)]+$/ or /\s{3,}[:\#\(\[]*([a-f0-9]{4,})[\]\)]*$/ or /\s{3,}[-:\#]([a-z0-9]{5,})$/ or /[\s._]{3,}([^0\s._]\d{3,})$/ or /[\s._]{3,}\[(\S+)\]$/ or /\(([-\w]{7,}\@\d+)\)$/
|
|
|
0 |
0 |
0 |
/[-_\.\s]{7,}([-a-z0-9]{4,})$/ or /\s{10,}(?:\S\s)?(\S+)$/ or /\s{3,}[-:\#\(\[]+([-a-z0-9]{4,})[\]\)]+$/ or /\s{3,}[:\#\(\[]*([a-f0-9]{4,})[\]\)]*$/ or /\s{3,}[-:\#]([a-z0-9]{5,})$/ or /[\s._]{3,}([^0\s._]\d{3,})$/ or /[\s._]{3,}\[(\S+)\]$/ or /\(([-\w]{7,}\@\d+)\)$/ or /\b(\d{7,})\s*$/
|
|
|
0 |
0 |
0 |
/[-_\.\s]{7,}([-a-z0-9]{4,})$/ or /\s{10,}(?:\S\s)?(\S+)$/ or /\s{3,}[-:\#\(\[]+([-a-z0-9]{4,})[\]\)]+$/ or /\s{3,}[:\#\(\[]*([a-f0-9]{4,})[\]\)]*$/ or /\s{3,}[-:\#]([a-z0-9]{5,})$/ or /[\s._]{3,}([^0\s._]\d{3,})$/ or /[\s._]{3,}\[(\S+)\]$/ or /\(([-\w]{7,}\@\d+)\)$/ or /\b(\d{7,})\s*$/ or /[!\?]\s*(\d{4,}|\w+(-\w+)+)\s*$/
|
|
|
0 |
0 |
0 |
/[-_\.\s]{7,}([-a-z0-9]{4,})$/ or /\s{10,}(?:\S\s)?(\S+)$/ or /\s{3,}[-:\#\(\[]+([-a-z0-9]{4,})[\]\)]+$/ or /\s{3,}[:\#\(\[]*([a-f0-9]{4,})[\]\)]*$/ or /\s{3,}[-:\#]([a-z0-9]{5,})$/ or /[\s._]{3,}([^0\s._]\d{3,})$/ or /[\s._]{3,}\[(\S+)\]$/ or /\(([-\w]{7,}\@\d+)\)$/ or /\b(\d{7,})\s*$/ or /[!\?]\s*(\d{4,}|\w+(-\w+)+)\s*$/ or /(?:\w{2,3}:\s)?\w+\s+(\w{7,}-\w{7,}(-\w+)*)\s*$/
|
|
|
0 |
0 |
0 |
/[-_\.\s]{7,}([-a-z0-9]{4,})$/ or /\s{10,}(?:\S\s)?(\S+)$/ or /\s{3,}[-:\#\(\[]+([-a-z0-9]{4,})[\]\)]+$/ or /\s{3,}[:\#\(\[]*([a-f0-9]{4,})[\]\)]*$/ or /\s{3,}[-:\#]([a-z0-9]{5,})$/ or /[\s._]{3,}([^0\s._]\d{3,})$/ or /[\s._]{3,}\[(\S+)\]$/ or /\(([-\w]{7,}\@\d+)\)$/ or /\b(\d{7,})\s*$/ or /[!\?]\s*(\d{4,}|\w+(-\w+)+)\s*$/ or /(?:\w{2,3}:\s)?\w+\s+(\w{7,}-\w{7,}(-\w+)*)\s*$/ or /\s#\s*([a-f0-9]{4,})\s*$/
|
|
240
|
0 |
0 |
0 |
defined $_ or $! == 0
|
|
271
|
0 |
0 |
0 |
not defined $str or $str eq ""
|
|
514
|
0 |
0 |
0 |
$pms->{'relays_trusted_str'} =~ / rdns=\S+\.yahoo\.com / or $pms->{'relays_untrusted_str'} =~ /^[^\]]+ rdns=\S+\.yahoo\.com /
|
|
561
|
0 |
0 |
0 |
$rcvd =~ /from.*\b(?:juno|untd)\.com.*[\[\(]${IP_ADDRESS}[\]\)].*by/ or $rcvd =~ / cookie\.(?:juno|untd)\.com /
|
|
733
|
0 |
0 |
0 |
!defined($min) || $min eq 'undef' || $diff >= 31556952 * ($min / 12)
|
|
|
0 |
0 |
0 |
!defined($max) || $max eq 'undef' || $diff < 31556952 * ($max / 12)
|
|
785
|
0 |
0 |
0 |
$received[0] =~ /\bfrom (?:localhost\s|(?:\S+ ){1,2}\S*\b127\.0\.0\.1\b)/ or $received[0] =~ /qmail \d+ invoked by uid \d+/
|
|
1062
|
0 |
0 |
0 |
$from eq "" or $to eq ""
|