projects / proxmox-spamassassin.git / blame
| Commit | Line | Data |
|---|---|---|
| b780ea8d SI |
1 | # SpamAssassin rules file: fake-HELO tests |
| 2 | # | |
| 3 | # Please don't modify this file as your changes will be overwritten with | |
| 4 | # the next update. Use /etc/mail/spamassassin/local.cf instead. | |
| 5 | # See 'perldoc Mail::SpamAssassin::Conf' for details. | |
| 6 | # | |
| 7 | # We should write a new ruletype for these, to save typing. | |
| 8 | # | |
| 9 | # <@LICENSE> | |
| 10 | # Licensed to the Apache Software Foundation (ASF) under one or more | |
| 11 | # contributor license agreements. See the NOTICE file distributed with | |
| 12 | # this work for additional information regarding copyright ownership. | |
| 13 | # The ASF licenses this file to you under the Apache License, Version 2.0 | |
| 14 | # (the "License"); you may not use this file except in compliance with | |
| 15 | # the License. You may obtain a copy of the License at: | |
| 16 | # | |
| 17 | # http://www.apache.org/licenses/LICENSE-2.0 | |
| 18 | # | |
| 19 | # Unless required by applicable law or agreed to in writing, software | |
| 20 | # distributed under the License is distributed on an "AS IS" BASIS, | |
| 21 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| 22 | # See the License for the specific language governing permissions and | |
| 23 | # limitations under the License. | |
| 24 | # </@LICENSE> | |
| 25 | # | |
| 26 | ########################################################################### | |
| 27 | ||
| 21dcadbf | 28 | require_version 4.000000 |
| b780ea8d SI |
29 | |
| 30 | #--------------------------------------------------------------------------- | |
| 31 | # Handle hosts that look like HELO_DYNAMIC hosts | |
| 32 | ||
| 33 | # cmr-208-124-139-194.cr.net.cable.rogers.com) [208.124.139.194] | |
| 34 | # cmr-208-97-119-114.cr.net.cable.rogers.com) [208.97.119.114] | |
| 35 | header __HELO_STATIC_ROGERS X-Spam-Relays-External =~ /^[^\]]+ helo=cmr-\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}\S+\.rogers\.com[^\]]+ auth= /i | |
| 36 | ||
| 37 | # o167-89-97-77.outbound-mail.sendgrid.net (bug 7592) | |
| 38 | header __HELO_STATIC_SENDGRID X-Spam-Relays-External =~ /^[^\]]+ helo=o\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}\.outbound-mail\.sendgrid\.net\s[^\]]+ auth= /i | |
| 39 | ||
| 40 | # 50-203-126-142-static.hfc.comcastbusiness.net | |
| 41 | header __HELO_STATIC_COMCAST X-Spam-Relays-External =~ /^[^\]]+ helo=\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}-static\.hfc\.comcastbusiness\.net\s[^\]]+ auth= /i | |
| 42 | ||
| 151f49fd SI |
43 | # smtp-0f95944d4245d0b2c.core1.sfdc-58ktaz.mta.salesforce.com |
| 44 | header __HELO_STATIC_SALESFORCE X-Spam-Relays-External =~ /^[^\]]+ helo=smtp\-\w+\.core\d\.sfdc\-\w+\.mta\.salesforce\.com\s[^\]]+ auth= /i | |
| 45 | ||
| b780ea8d | 46 | describe HELO_STATIC_HOST Relay HELO'd using static hostname |
| 151f49fd | 47 | meta HELO_STATIC_HOST (__HELO_STATIC_ROGERS || __HELO_STATIC_SENDGRID || __HELO_STATIC_COMCAST || __HELO_STATIC_SALESFORCE) |
| b780ea8d SI |
48 | |
| 49 | # --------------------------------------------------------------------------- | |
| 50 | ||
| 51 | # Suresh says: these will never be used as HELOs from real mail.com relays. | |
| 52 | # Just check the most recent handover; the connection to a internal host. | |
| 53 | # This way a legit sender can send to their MSA using that HELO (quite a few | |
| 54 | # MUAs will do that), but a spammer gets caught. (List of domains comes from | |
| 55 | # the drop-down list on the Mail.com signup page.) | |
| 56 | #header FAKE_HELO_MAIL_COM_DOM X-Spam-Relays-External =~ /^[^\]]+ helo=(?:\S+\.|)(?:(?:mail|email|iname|cheerful|consultant|europe|mindless|myself|post|techie|usa|writeme|2die4|artlover|bikerider|catlover|cliffhanger|cutey|doglover|gardener|hot-shot|inorbit|loveable|mad\.scientist|playful|poetic|popstar|saintly|seductive|soon|whoever|winning|witty|yours|africamail|arcticmail|asia|australiamail|europe|japan|samerica|usa|berlin|dublin|london|madrid|moscowmail|munich|nycmail|paris|rome|sanfranmail|singapore|tokyo|accountant|adexec|allergist|alumnidirector|archaeologist|chemist|clerk|columnist|comic|consultant|counsellor|deliveryman|diplomats|doctor|dr|engineer|execs|financier|geologist|graphic-designer|insurer|journalist|lawyer|legislator|lobbyist|minister|optician|pediatrician|presidency|priest|publicist|realtyagent|registerednurses|repairman|representative|rescueteam|scientist|sociologist|teacher|techietechnologist|umpire)\.com|(?:programmer|earthling|hairdresser)\.net|musician\.org) /i | |
| 57 | #describe FAKE_HELO_MAIL_COM_DOM Relay HELO'd with suspicious hostname (mail.com) | |
| 58 | ||
| 59 | ||
| 60 | # --------------------------------------------------------------------------- | |
| 61 | # Interesting new feature; spamware HELO'ing, from a dialup IP addr, | |
| 62 | # using that IP's rDNS entry. We can catch this easily. There aren't | |
| 63 | # many legit mailservers calling themselves | |
| 64 | # 'dhcp024-210-034-053.columbus.rr.com'. ;) | |
| 65 | # | |
| 66 | # Note the '^[^\]]+ ' stanza: this ensures that we only match spamware | |
| 67 | # connecting to a internal relay; if a mail came from a dynamic addr but | |
| 68 | # was relayed through their smarthost, that's fine. | |
| 69 | ||
| 70 | # See bug #5856, all references of trusted were changed to internal | |
| 71 | ||
| 72 | # dhcp024-210-034-053.columbus.rr.com [24.210.34.53] | |
| 73 | # c-66-176-16-108.se.client2.attbi.com [66.176.16.108] | |
| 74 | # c-67-168-174-61.client.comcast.net [67.168.174.61] | |
| 75 | # NNN-NNN-NNN-NNN.fibertel.com.ar | |
| 76 | # NN.NN.NNN.NNN.ap.yournet.ne.jp | |
| 77 | # NN.NNN.NN-NN.rev.gaoland.net | |
| 78 | # vaise-1-82-67-44-166.fbx.proxad.net [82.67.44.166] | |
| 79 | # lns-vlq-11-62-147-186-141.adsl.proxad.net [62.147.186.141] | |
| 80 | # dsl-200-95-109-107.prod-infinitum.com.mx [200.95.109.107] | |
| 81 | # port-212-202-77-203.reverse.qsc.de [212.202.77.203] | |
| 82 | # pool-151-203-32-68.bos.east.verizon.net [151.203.32.68] | |
| 83 | # c-67-164-133-216.client.comcast.net [67.164.133.216] | |
| 84 | # 200-171-228-6.customer.telesp.net.br [200.171.228.6] | |
| 85 | # modemcable090.28-201-24.mc.videotron.ca [24.201.28.90] | |
| 86 | # 80-218-47-160.dclient.hispeed.ch [80.218.47.160] | |
| 87 | # cdm-68-226-239-16.laft.cox-internet.com [68.226.239.16] | |
| 88 | # d53-64-35-171.nap.wideopenwest.com [64.53.171.35] | |
| 89 | # 74.67-201-80.adsl.skynet.be [80.201.67.74] | |
| 90 | # 12-218-225-223.client.mchsi.com [12.218.225.223] | |
| 91 | # (require an alpha first, as legit HELO'ing-as-IP-address is hit otherwise) | |
| 92 | header __HELO_DYNAMIC_IPADDR X-Spam-Relays-External =~ /^[^\]]+ helo=(?![^\s\]]+[-.]static[-.])[a-z]\S*\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+[^\]]+ auth= /i | |
| 93 | meta HELO_DYNAMIC_IPADDR (__HELO_DYNAMIC_IPADDR && !HELO_STATIC_HOST) | |
| 94 | describe HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1) | |
| 95 | ||
| 96 | # dhcp024-210-034-053.columbus.rr.com [24.210.34.53] | |
| 97 | # catv-506237d8.miskcatv.broadband.hu [80.98.55.216] | |
| 98 | # node-c-8b22.a2000.nl | |
| 99 | # cm89.omega139.maxonline.com.sg | |
| 100 | # cm114.gamma208.maxonline.com.sg | |
| 31955ede | 101 | header __HELO_DYNAMIC_DHCP X-Spam-Relays-External =~ /^[^\]]+ helo=\S*(?:(?<!smtp)(?<!a)cm|catv|docsis|cable|dsl|dhcp|cpe|node)\S*\d+[^\d\s]+\d+[^\]]+ auth= /i |
| b780ea8d SI |
102 | meta HELO_DYNAMIC_DHCP (__HELO_DYNAMIC_DHCP && !HELO_STATIC_HOST) |
| 103 | describe HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP) | |
| 104 | ||
| 105 | # fia83-8.dsl.hccnet.nl [62.251.8.83] | |
| 106 | # fia160-115-100.dsl.hccnet.nl [80.100.115.160] | |
| 107 | header __HELO_DYNAMIC_HCC X-Spam-Relays-External =~ /^[^\]]+ helo=\S*\d+[^\d\s]+\d+\S*\.(?:docsis|cable|dsl|adsl|dhcp|cpe)\.[^\]]+ auth= /i | |
| 108 | meta HELO_DYNAMIC_HCC (__HELO_DYNAMIC_HCC && !HELO_STATIC_HOST) | |
| 109 | describe HELO_DYNAMIC_HCC Relay HELO'd using suspicious hostname (HCC) | |
| 110 | ||
| 111 | # h0002a5d76857.ne.client2.attbi.com [65.96.12.59] | |
| 112 | ||
| 113 | # CPE0004e2372711-CM000a73666706.cpe.net.cable.rogers.com | |
| 114 | # CPE00e0184f0eba-CM014490118324.cpe.net.cable.rogers.com [24.43.109.140] | |
| 115 | header HELO_DYNAMIC_ROGERS X-Spam-Relays-External =~ /^[^\]]+ helo=CPE\d+\S+\.rogers\.com[^\]]+ auth= /i | |
| 116 | describe HELO_DYNAMIC_ROGERS Relay HELO'd using suspicious hostname (Rogers) | |
| 117 | ||
| 118 | # pD9E4F89F.dip.t-dialin.net [217.228.248.159] | |
| 119 | header HELO_DYNAMIC_DIALIN X-Spam-Relays-External =~ /^[^\]]+ helo=[a-z][A-F0-9]+\.dip\./ | |
| 120 | describe HELO_DYNAMIC_DIALIN Relay HELO'd using suspicious hostname (T-Dialin) | |
| 121 | ||
| 122 | # 0xd5aaf40b.dhcp.kabelnettet.dk | |
| 123 | # 0x50a46949.virnxx11.adsl-dhcp.tele.dk | |
| 124 | header HELO_DYNAMIC_HEXIP X-Spam-Relays-External =~ /^[^\]]+ helo=0x[a-f0-9]{8}\./ | |
| 125 | describe HELO_DYNAMIC_HEXIP Relay HELO'd using suspicious hostname (Hex IP) | |
| 126 | ||
| 127 | # 118.Red-80-35-201.pooles.rima-tde.net | |
| 128 | header HELO_DYNAMIC_SPLIT_IP X-Spam-Relays-External =~ /^[^\]]+ helo=\d+\.\S+\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]/ | |
| 129 | describe HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname (Split IP) | |
| 130 | ||
| 131 | # YahooBB219173000034.bbtec.net [219.173.0.34] | |
| 132 | ||
| 133 | # 10-35-124-91.pool.ukrtel.net [91.124.35.10] | |
| 134 | # 89-215-186-91.2073241113.ddns-lan.rakovski.ekk.bg [217.18.240.147] | |
| 135 | # 200.109.193-29.dyn.dsl.cantv.net [200.109.193.29] | |
| 136 | # 113x35x70x11.ap113.ftth.ucom.ne.jp [113.35.70.11] | |
| 137 | # 98x9x3p5siouq.kvknv3sv1quk.3ejp4xzv.com [213.250.20.156] | |
| 138 | # 1.0/24.137.95.202.in-addr.arpa [202.95.137.1] | |
| 139 | header __HELO_DYNAMIC_IPADDR2 X-Spam-Relays-External =~ /^[^\]]+ helo=(?![^\s\]]+[-.](?:static|mail|smtp|mx)\d*[-.])\d{1,3}(?:[\Wx_]\d{1,3}){3}[^\d\s][^\s.]*\.\S+\.\S+[^\]]+ auth= /i | |
| 140 | meta HELO_DYNAMIC_IPADDR2 (__HELO_DYNAMIC_IPADDR2 && !HELO_DYNAMIC_SPLIT_IP) | |
| 141 | describe HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr 2) | |
| 142 | ||
| 143 | # h234n2fls32o895.telia.com [217.208.73.234] | |
| 144 | # h53n2fls32o828.telia.com | |
| 145 | # h116n2fls32o1111.telia.com | |
| 146 | # h29n1fls306o1003.telia.com | |
| 147 | ||
| 148 | # CM-vina5-168-207.cm.vtr.net [200.104.168.207] | |
| 149 | # CM-anto1-98-153.cm.vtr.net [200.104.98.153] | |
| 150 | ||
| 151 | # ec9z5l.cm.chello.no | |
| 152 | ||
| 153 | # g225174.upc-g.chello.nl | |
| 154 | # a151145.upc-a.chello.nl | |
| 155 | # a96134.upc-a.chello.nl | |
| 156 | header HELO_DYNAMIC_CHELLO_NL X-Spam-Relays-External =~ /^[^\]]+ helo=[a-z]\d+\.upc-[a-z]\.chello\.nl[^\]]+ auth= /i | |
| 157 | describe HELO_DYNAMIC_CHELLO_NL Relay HELO'd using suspicious hostname (Chello.nl) | |
| 158 | ||
| 159 | # cp160000-a.mill1.nb.home.nl | |
| 160 | # cp341468-b.venra1.lb.home.nl | |
| 161 | header HELO_DYNAMIC_HOME_NL X-Spam-Relays-External =~ /^[^\]]+ helo=[a-z]{2}\d+-\S\.\S+\d\.[a-z]{2}\.home\.nl[^]]+ auth= /i | |
| 162 | describe HELO_DYNAMIC_HOME_NL Relay HELO'd using suspicious hostname (Home.nl) | |
| 163 |