# Tuerkei Spam, based on
# Air Antalya Spam Regeln von andreas@dunkl.net

#
# Spammer name
#
rawbody 	__GERM_ANT_NAM	/(?:Air Antalya|Anafor Turizm|Smyrna Toursitik|\bSI[ \*\~_\:\.\,\^\_\-\/\s\'\`]{0,3}GROUP|\bSI[ \*\~_\:\.\,\^\_\-\/\s\'\`]{0,3}}REISEN)/i

#
# Travel Location
#
body 		__GERM_ANT_LOC	/\b(?:T(?:ue|ü)rkei|Alanya|Antalya|Deutschland|Schweiz|(?:Oe|Ö)sterr?eich)/i

# Body
rawbody 	__GERM_ANT_A1	/T(?:ue|ü)rkeifluege/i
rawbody 	__GERM_ANT_A2	/(?:Vollchartermiete|Fr(?:ue|ü)hbucher-?Rabatte)/i
rawbody 	__GERM_ANT_A3	/(?:Hotelwuensche|All Inclusiv Hotels)/i
rawbody 	__GERM_ANT_A4	/(?:Grundstücke|Reiseveranstalter)/i
rawbody 	__GERM_ANT_A5	/(?:smyrnagroup\.net|anaforturizm\.com|airantalya\.(?:de|com))/i

# Header
header		__GERM_ANT_A6	Subject =~ /(?:Air Antalya|T(?:ue|ü)rkeifluege|Sonnenfinsternis)/i

# mail domains 
header   __ANT_ISP_HDR    ALL =~ /[.@](web\.de|gmx\.(de|net)|t-online\.de|ttnet.net\.tr|superonline\.com)/i
uri      __ANT_ISP_URI           /[.@](web\.de|gmx\.(de|net)|t-online\.de|ttnet.net\.tr|superonline\.com)/i

meta     __ANT_ISP  __ANT_ISP_HDR || __ANT_ISP_URI

meta	__GERM_ANT_BASE_A3	= (__GERM_ANT_A1 + __GERM_ANT_A2 + __GERM_ANT_A3 + __GERM_ANT_A4 + __GERM_ANT_A5 + __GERM_ANT_A6 == 2)
meta	__GERM_ANT_BASE_A4	= (__GERM_ANT_A1 + __GERM_ANT_A2 + __GERM_ANT_A3 + __GERM_ANT_A4 + __GERM_ANT_A5 + __GERM_ANT_A6 == 3)
meta	__GERM_ANT_BASE_A5	= (__GERM_ANT_A1 + __GERM_ANT_A2 + __GERM_ANT_A3 + __GERM_ANT_A4 + __GERM_ANT_A5 + __GERM_ANT_A6 >= 4)

meta	GERMAN_ANT_SPAM_A1	= (__GERM_ANT_NAM + __GERM_ANT_LOC + __GERM_ANT_BASE_A3 - GERMAN_ANT_SPAM_A4 == 3)
meta	GERMAN_ANT_SPAM_A2	= (__GERM_ANT_NAM + __GERM_ANT_LOC + __GERM_ANT_BASE_A4 - GERMAN_ANT_SPAM_A5 == 3)
meta	GERMAN_ANT_SPAM_A3	= (__GERM_ANT_NAM + __GERM_ANT_LOC + __GERM_ANT_BASE_A5 - GERMAN_ANT_SPAM_A6 == 3)
meta	GERMAN_ANT_SPAM_A4	= (__GERM_ANT_NAM + __GERM_ANT_LOC + __GERM_ANT_BASE_A3 + __ANT_ISP == 4)
meta	GERMAN_ANT_SPAM_A5	= (__GERM_ANT_NAM + __GERM_ANT_LOC + __GERM_ANT_BASE_A4 + __ANT_ISP == 4)
meta	GERMAN_ANT_SPAM_A6	= (__GERM_ANT_NAM + __GERM_ANT_LOC + __GERM_ANT_BASE_A5 + __ANT_ISP == 4)


describe	GERMAN_ANT_SPAM_A1	Looks like Air Antalya spam (3+)
describe	GERMAN_ANT_SPAM_A2	Looks like Air Antalya spam (4+)
describe	GERMAN_ANT_SPAM_A3	Looks like Air Antalya spam (5+)
describe	GERMAN_ANT_SPAM_A4	Looks like Air Antalya spam (6+)
describe	GERMAN_ANT_SPAM_A5	Looks like Air Antalya spam (7+)
describe	GERMAN_ANT_SPAM_A6	Looks like Air Antalya spam (8+)


score GERMAN_ANT_SPAM_A1		2.000
score GERMAN_ANT_SPAM_A2		3.000
score GERMAN_ANT_SPAM_A3		4.000
score GERMAN_ANT_SPAM_A4		7.000
score GERMAN_ANT_SPAM_A5		8.000
score GERMAN_ANT_SPAM_A6		9.000