projects / proxmox-spamassassin.git / blame
| Commit | Line | Data |
|---|---|---|
| b780ea8d SI |
1 | # SpamAssassin rules file: dynamic-ish rDNS tests |
| 2 | # | |
| 3 | # Please don't modify this file as your changes will be overwritten with | |
| 4 | # the next update. Use /etc/mail/spamassassin/local.cf instead. | |
| 5 | # See 'perldoc Mail::SpamAssassin::Conf' for details. | |
| 6 | # | |
| 7 | # We should write a new ruletype for these, to save typing. | |
| 8 | # | |
| 9 | # <@LICENSE> | |
| 10 | # Licensed to the Apache Software Foundation (ASF) under one or more | |
| 11 | # contributor license agreements. See the NOTICE file distributed with | |
| 12 | # this work for additional information regarding copyright ownership. | |
| 13 | # The ASF licenses this file to you under the Apache License, Version 2.0 | |
| 14 | # (the "License"); you may not use this file except in compliance with | |
| 15 | # the License. You may obtain a copy of the License at: | |
| 16 | # | |
| 17 | # http://www.apache.org/licenses/LICENSE-2.0 | |
| 18 | # | |
| 19 | # Unless required by applicable law or agreed to in writing, software | |
| 20 | # distributed under the License is distributed on an "AS IS" BASIS, | |
| 21 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| 22 | # See the License for the specific language governing permissions and | |
| 23 | # limitations under the License. | |
| 24 | # </@LICENSE> | |
| 25 | # | |
| 26 | ########################################################################### | |
| 27 | ||
| cabe596e | 28 | require_version 3.004006 |
| b780ea8d SI |
29 | |
| 30 | # --------------------------------------------------------------------------- | |
| 31 | ||
| 32 | # Note the '^[^\]]+ ' stanza: this ensures that we only match spamware | |
| 33 | # connecting to a internal relay; if a mail came from a dynamic addr but | |
| 34 | # was relayed through their smarthost, that's fine. | |
| 35 | ||
| 36 | # See bug #5856, all references of "trusted" were changed to "external" | |
| 37 | ||
| 38 | # All of the RDNS_DYNAMIC rules require that the last external relay | |
| 39 | # did not use SMTP authentication. These rules should not be firing on | |
| 40 | # friendlies! | |
| 41 | header __LAST_UNTRUSTED_RELAY_NO_AUTH X-Spam-Relays-Untrusted =~ /^[^\]]+ auth= / | |
| 42 | header __LAST_EXTERNAL_RELAY_NO_AUTH X-Spam-Relays-External =~ /^[^\]]+ auth= / | |
| 43 | ||
| 44 | # dhcp024-210-034-053.columbus.rr.com [24.210.34.53] | |
| 45 | # c-66-176-16-108.se.client2.attbi.com [66.176.16.108] | |
| 46 | # c-67-168-174-61.client.comcast.net [67.168.174.61] | |
| 47 | # NNN-NNN-NNN-NNN.fibertel.com.ar | |
| 48 | # NN.NN.NNN.NNN.ap.yournet.ne.jp | |
| 49 | # NN.NNN.NN-NN.rev.gaoland.net | |
| 50 | # vaise-1-82-67-44-166.fbx.proxad.net [82.67.44.166] | |
| 51 | # lns-vlq-11-62-147-186-141.adsl.proxad.net [62.147.186.141] | |
| 52 | # dsl-200-95-109-107.prod-infinitum.com.mx [200.95.109.107] | |
| 53 | # port-212-202-77-203.reverse.qsc.de [212.202.77.203] | |
| 54 | # pool-151-203-32-68.bos.east.verizon.net [151.203.32.68] | |
| 55 | # c-67-164-133-216.client.comcast.net [67.164.133.216] | |
| 56 | # 200-171-228-6.customer.telesp.net.br [200.171.228.6] | |
| 57 | # modemcable090.28-201-24.mc.videotron.ca [24.201.28.90] | |
| 58 | # 80-218-47-160.dclient.hispeed.ch [80.218.47.160] | |
| 59 | # cdm-68-226-239-16.laft.cox-internet.com [68.226.239.16] | |
| 60 | # d53-64-35-171.nap.wideopenwest.com [64.53.171.35] | |
| 61 | # 74.67-201-80.adsl.skynet.be [80.201.67.74] | |
| 62 | # 12-218-225-223.client.mchsi.com [12.218.225.223] | |
| 63 | # pptp-81-30-186-139.ufanet.ru [81.30.186.139] | |
| 64 | # (require an alpha first, as legit HELO'ing-as-IP-address is hit otherwise) | |
| 65 | header __RDNS_DYNAMIC_IPADDR X-Spam-Relays-External =~ /^[^\]]+ rdns=(?![^\s\]]+[-.]static[-.])\S*\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+\S*\.\S+\.\S/i | |
| 66 | describe __RDNS_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1) | |
| 67 | ||
| 68 | # dhcp024-210-034-053.columbus.rr.com [24.210.34.53] | |
| 69 | # catv-506237d8.miskcatv.broadband.hu [80.98.55.216] | |
| 70 | # node-c-8b22.a2000.nl | |
| 71 | # cm89.omega139.maxonline.com.sg | |
| 72 | # cm114.gamma208.maxonline.com.sg | |
| 73 | header __RDNS_DYNAMIC_DHCP X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*(?:cm|catv|docsis|cable|dsl|dhcp|cpe|node)\S*\d+[^\d\s]+\d/i | |
| 74 | describe __RDNS_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP) | |
| 75 | ||
| 76 | # fia83-8.dsl.hccnet.nl [62.251.8.83] | |
| 77 | # fia160-115-100.dsl.hccnet.nl [80.100.115.160] | |
| 78 | header __RDNS_DYNAMIC_HCC X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*\d+[^\d\s]+\d+\S*\.(?:docsis|cable|dsl|adsl|dhcp|cpe)\./i | |
| 79 | describe __RDNS_DYNAMIC_HCC Relay HELO'd using suspicious hostname (HCC) | |
| 80 | ||
| 81 | # h0002a5d76857.ne.client2.attbi.com [65.96.12.59] | |
| 82 | header __RDNS_DYNAMIC_ATTBI X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+\d+\S+\.client2\.attbi\.com/i | |
| 83 | describe __RDNS_DYNAMIC_ATTBI Relay HELO'd using suspicious hostname (ATTBI.com) | |
| 84 | ||
| 85 | # CPE0004e2372711-CM000a73666706.cpe.net.cable.rogers.com | |
| 86 | # CPE00e0184f0eba-CM014490118324.cpe.net.cable.rogers.com [24.43.109.140] | |
| 87 | header __RDNS_DYNAMIC_ROGERS X-Spam-Relays-External =~ /^[^\]]+ rdns=CPE\d+\S+\.rogers\.com/i | |
| 88 | describe __RDNS_DYNAMIC_ROGERS Relay HELO'd using suspicious hostname (Rogers) | |
| 89 | ||
| 90 | # ca-morpark-cuda1-zone7-b-159.vnnyca.adelphia.net[67.23.129.159] | |
| 91 | # tn-greenvillecuda1cable7a-36.atlaga.adelphia.net [68.171.113.36] | |
| 92 | # ky-richmond2a-123.rhmdky.adelphia.net [68.71.36.123] | |
| 93 | # ny-lackawannacadent4-chtwga3a-b-117.buf.adelphia.net [68.71.205.117] | |
| 94 | # fl-edel-u2-c3c-233.pbc.adelphia.net [68.64.89.233] | |
| 95 | header __RDNS_DYNAMIC_ADELPHIA X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z]{2}-\S+-\d{1,3}\.[a-z]{3,8}\.adelphia\.net/i | |
| 96 | describe __RDNS_DYNAMIC_ADELPHIA Relay HELO'd using suspicious hostname (Adelphia) | |
| 97 | ||
| 98 | # pD9E4F89F.dip.t-dialin.net [217.228.248.159] | |
| 99 | header __RDNS_DYNAMIC_DIALIN X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z][A-F0-9]+\.dip\./ | |
| 100 | describe __RDNS_DYNAMIC_DIALIN Relay HELO'd using suspicious hostname (T-Dialin) | |
| 101 | ||
| 102 | # 0xd5aaf40b.dhcp.kabelnettet.dk | |
| 103 | # 0x50a46949.virnxx11.adsl-dhcp.tele.dk | |
| 104 | header __RDNS_DYNAMIC_HEXIP X-Spam-Relays-External =~ /^[^\]]+ rdns=0x[a-f0-9]{8}\./ | |
| 105 | describe __RDNS_DYNAMIC_HEXIP Relay HELO'd using suspicious hostname (Hex IP) | |
| 106 | ||
| 107 | # 118.Red-80-35-201.pooles.rima-tde.net | |
| 108 | header __RDNS_DYNAMIC_SPLIT_IP X-Spam-Relays-External =~ /^[^\]]+ rdns=\d+\.\S+\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]/ | |
| 109 | describe __RDNS_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname (Split IP) | |
| 110 | ||
| 111 | # YahooBB219173000034.bbtec.net [219.173.0.34] | |
| 112 | header __RDNS_DYNAMIC_YAHOOBB X-Spam-Relays-External =~ /^[^\]]+ rdns=YahooBB/i | |
| 113 | describe __RDNS_DYNAMIC_YAHOOBB Relay HELO'd using suspicious hostname (YahooBB) | |
| 114 | ||
| 115 | # ool-18be1aaf.dyn.optonline.net [24.190.26.175] | |
| 116 | header __RDNS_DYNAMIC_OOL X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+\.dyn\.optonline\.net/ | |
| 117 | describe __RDNS_DYNAMIC_OOL Relay HELO'd using suspicious hostname (OptOnline) | |
| 118 | ||
| 119 | # wiley-170-10231.roadrunner.nf.net [205.251.210.249] | |
| 120 | header __RDNS_DYNAMIC_RR2 X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z]+-\d{1,3}-\d{1,5}\.roadrunner/i | |
| 121 | describe __RDNS_DYNAMIC_RR2 Relay HELO'd using suspicious hostname (RR 2) | |
| 122 | ||
| 123 | # pcp04024417pcs.toresd01.pa.comcast.net [68.86.206.126] | |
| 124 | # bgp542174bgs.ewndsr01.nj.comcast.net[68.38.144.91] | |
| 125 | # Computer-udp135632uds.union01.nj.comcast.net [68.39.99.32] | |
| 126 | header __RDNS_DYNAMIC_COMCAST X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z-]+\d+[a-z]{3}\.[a-z0-9]+\...\.comcast/i | |
| 127 | describe __RDNS_DYNAMIC_COMCAST Relay HELO'd using suspicious hostname (Comcast) | |
| 128 | ||
| 129 | # h234n2fls32o895.telia.com [217.208.73.234] | |
| 130 | # h53n2fls32o828.telia.com | |
| 131 | # h116n2fls32o1111.telia.com | |
| 132 | # h29n1fls306o1003.telia.com | |
| 133 | header __RDNS_DYNAMIC_TELIA X-Spam-Relays-External =~ /^[^\]]+ rdns=h\d+n\d+fls\S+\.telia\.com/i | |
| 134 | describe __RDNS_DYNAMIC_TELIA Relay HELO'd using suspicious hostname (Telia) | |
| 135 | ||
| 136 | # CM-vina5-168-207.cm.vtr.net [200.104.168.207] | |
| 137 | # CM-anto1-98-153.cm.vtr.net [200.104.98.153] | |
| 138 | header __RDNS_DYNAMIC_VTR X-Spam-Relays-External =~ /^[^\]]+ rdns=cm-[a-z]+\d+-\d+-\d+\.cm\.vtr/i | |
| 139 | describe __RDNS_DYNAMIC_VTR Relay HELO'd using suspicious hostname (VTR) | |
| 140 | ||
| 141 | # ec9z5l.cm.chello.no | |
| 142 | header __RDNS_DYNAMIC_CHELLO_NO X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+\.cm\.chello\.no/i | |
| 143 | describe __RDNS_DYNAMIC_CHELLO_NO Relay HELO'd using suspicious hostname (Chello.no) | |
| 144 | ||
| 145 | # g225174.upc-g.chello.nl | |
| 146 | # a151145.upc-a.chello.nl | |
| 147 | # a96134.upc-a.chello.nl | |
| 148 | header __RDNS_DYNAMIC_CHELLO_NL X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z]\d+\.upc-[a-z]\.chello\.nl/i | |
| 149 | describe __RDNS_DYNAMIC_CHELLO_NL Relay HELO'd using suspicious hostname (Chello.nl) | |
| 150 | ||
| 151 | # MG001182.user.veloxzone.com.br | |
| 152 | # ba199058073.user.veloxzone.com.br | |
| 153 | header __RDNS_DYNAMIC_VELOX X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z]{2}\d+\.user\.veloxzone\./i | |
| 154 | describe __RDNS_DYNAMIC_VELOX Relay HELO'd using suspicious hostname (Veloxzone) | |
| 155 | ||
| 156 | # public4-seve6-5-cust173.lond.broadband.ntl.com | |
| 157 | # spr1-bolt5-5-0-cust9.manc.broadband.ntl.com | |
| 158 | # spc1-lewi4-6-0-cust190.lond.broadband.ntl.com | |
| 159 | header __RDNS_DYNAMIC_NTL X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+\d+-\d+-cust\d+\.[a-z]{4,6}\.broadband\.ntl\.com/i | |
| 160 | describe __RDNS_DYNAMIC_NTL Relay HELO'd using suspicious hostname (NTL) | |
| 161 | ||
| 162 | # (I'm quite sure these may be a good spamsign in future) | |
| 163 | # nwblwi-nrp3-l10-a671.nwblwi.tds.net | |
| 164 | header __RDNS_DYNAMIC_TDS X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+-[a-z]\d+\.[a-z]{6}\.tds\.net/i | |
| 165 | header __RDNS_DYNAMIC_VIRTUA X-Spam-Relays-External =~ /^[^\]]+ rdns=\d+\.cps\./i | |
| 166 | ||
| 167 | # sp1-c700-131.spacelan.ne.jp | |
| 168 | header __RDNS_DYNAMIC_SPACELAN X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+-[a-z]\d+-\d+\./i | |
| 169 | ||
| 170 | # rDNS host-type indicators, as per | |
| 171 | # https://tools.ietf.org/id/draft-msullivan-dnsop-generic-naming-schemes-00.txt | |
| 172 | header __RDNS_INDICATOR_DYN X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.]dyn(?:amic)?[\-\.]/i | |
| 173 | ||
| 174 | # surprisingly large ham hitrate | |
| 175 | header __RDNS_INDICATOR_TYPE X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.](?:dial|modem|isdn|dov|\S?dsl|cable|wireless)[\-\.]/i | |
| 176 | ||
| 177 | # this hits a little ham, not too much though | |
| 178 | header __RDNS_INDICATOR_RES X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.](?:res|resnet|client)[\-\.]/i | |
| 179 | ||
| 180 | # these are non-standard, but common in the field; 100% spam correlation! | |
| 181 | # (I think that's a fluke) | |
| 182 | header __RDNS_INDICATOR_TYPE2 X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.](?:docsis|dhcp|cpe|catv)[\-\.]/i | |
| 183 | ||
| 184 | # dsl.dynamic8510023760.ttnet.net.tr | |
| 185 | header __RDNS_DYNAMIC_TTNET X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.]dyn(?:amic)?\d/i | |
| 186 | ||
| 187 | # c221106.ppp.asahi-net.or.jp | |
| 188 | # i253064.ppp.asahi-net.or.jp | |
| 189 | # u035201.ppp.asahi-net.or.jp | |
| 190 | # w158034.ppp.asahi-net.or.jp | |
| 191 | header __RDNS_DYNAMIC_ASAHI X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z][0-9]+\.ppp\.asahi-net\.or\.jp/i | |
| 192 | ||
| 193 | # exceptions (bug 5397): | |
| 194 | # exceptions: 66-220-155-151.mail-mail.facebook.com | |
| 195 | # exceptions: o167-89-97-77.outbound-mail.sendgrid.net (bug 7592) | |
| 31955ede | 196 | header __RDNS_STATIC X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*(?:fix|static|fixip|dedicated|mail\-mail|outbound-mail|smtp)/i |
| b780ea8d SI |
197 | |
| 198 | # bug 5586: | |
| 199 | header __CGATE_RCVD Received =~ /by \S+ \(CommuniGate Pro/ | |
| 200 | # bug 5926: | |
| 201 | header __DOMINO_RCVD Received =~ /by \S+ \(Lotus Domino / | |
| 202 | ||
| 203 | header __RDNS_NONE X-Spam-Relays-External =~ /^[^\]]+ rdns= / | |
| 204 | ||
| 205 | ########################################################################### | |
| 206 | ||
| 207 | meta RDNS_DYNAMIC (__LAST_EXTERNAL_RELAY_NO_AUTH && !__RDNS_STATIC && (__RDNS_DYNAMIC_IPADDR || __RDNS_DYNAMIC_DHCP || __RDNS_DYNAMIC_HCC || __RDNS_DYNAMIC_ATTBI || __RDNS_DYNAMIC_ROGERS || __RDNS_DYNAMIC_ADELPHIA || __RDNS_DYNAMIC_DIALIN || __RDNS_DYNAMIC_HEXIP || __RDNS_DYNAMIC_SPLIT_IP || __RDNS_DYNAMIC_YAHOOBB || __RDNS_DYNAMIC_OOL || __RDNS_DYNAMIC_RR2 || __RDNS_DYNAMIC_COMCAST || __RDNS_DYNAMIC_TELIA || __RDNS_DYNAMIC_VTR || __RDNS_DYNAMIC_CHELLO_NO || __RDNS_DYNAMIC_CHELLO_NL || __RDNS_DYNAMIC_VELOX || __RDNS_DYNAMIC_NTL || __RDNS_DYNAMIC_TDS || __RDNS_DYNAMIC_VIRTUA || __RDNS_DYNAMIC_SPACELAN || __RDNS_INDICATOR_DYN || __RDNS_INDICATOR_RES || __RDNS_INDICATOR_TYPE2 || __RDNS_DYNAMIC_TTNET || __RDNS_DYNAMIC_ASAHI)) | |
| 208 | describe RDNS_DYNAMIC Delivered to internal network by host with dynamic-looking rDNS | |
| 209 | ||
| 210 | meta RDNS_NONE (__RDNS_NONE && !__CGATE_RCVD && !__DOMINO_RCVD) | |
| 211 | describe RDNS_NONE Delivered to internal network by a host with no rDNS | |
| 212 | ||
| 213 |