Merge pull request #4915 from twesterhever/temp-freemail-mdn

Add detection for freemail and disposable e-mail usage for message delivery notification

diff --cc conf/composites.conf
index c1b603e51812075a02e62b6ad95e7e69d4d3189c,d3c4f073bfac14df37af9dd1327a279f99611ee9..b1bff1c1a8baea7dd797212bb55637bea23fd06f
--- 1/conf/composites.conf
--- 2/conf/composites.conf
+++ b/conf/composites.conf
@@@ -169,8 -167,14 +169,15 @@@ composites 
      score = 4.0;
      policy = "leave";
      description = "Message exhibits strong characteristics of advance fee fraud (AFF a/k/a '419' spam) involving freemail addresses";
 +    group = "scams";
    }
+   SUSPICIOUS_MDN {
+     expression = "(FREEMAIL_MDN | DISPOSABLE_MDN) & !(FREEMAIL_FROM | FREEMAIL_ENVFROM)";
+     score = 2.0;
+     policy = "leave";
+     description = "Message delivery notification should go to freemail or disposable e-mail, but message was not sent from a freemail address";
+     group = "scams";
+   }
    REDIRECTOR_URL_ONLY {
      expression = "HFILTER_URL_ONLY & REDIRECTOR_URL";
      score = 1.0;