72 lines
2.8 KiB
CFEngine3
72 lines
2.8 KiB
CFEngine3
#--------------------------------------------------
|
|
# Version 0.01
|
|
#--------------------------------------------------
|
|
|
|
#--------------------------------------------------
|
|
# top level domain matching, from a github gist
|
|
#--------------------------------------------------
|
|
|
|
header SPAMMY_TLD_IN_RCVD Received =~ /(\.net\.ae|\.net\.id|\.ro|\.cz|\.co\.ke|\.AC\.ZA|\.co\.in|\.com\.vn|\.vn|\.cc|\.ua|\.com\.br|\.gr|\.hr|\.dk|\.win|\.bid|\.tw|\.br|\.pk|\.top|\.club|\.date|\.stream|\.xyz|\.trade|\.icu|\.press|\.pro|\.pet|\.kim|\.red)\s/i
|
|
score SPAMMY_TLD_IN_RCVD 0.3
|
|
describe SPAMMY_TLD_IN_RCVD Spammy TLD used in Received line
|
|
|
|
header SPAMMY_TLD_IN_FROM From =~ /(\.net\.ae|\.net\.id|\.ro|\.co\.jp|\.co\.ke|\.AC\.ZA|\.co\.in|\.com\.vn|\.vn|\.cc|\.ua|\.com\.br|\.gr|\.hr|\.cz|\.win|\.bid|\.tw|\.br|\.pk|\.top|\.club|\.date|\.stream|\.xyz|\.trade|\.icu|\.press|\.pro|\.pet|\.kim|\.red)>$/i
|
|
score SPAMMY_TLD_IN_FROM 0.3
|
|
describe SPAMMY_TLD_IN_FROM Spammy TLD used in From line
|
|
|
|
header __HIGH_SPAMMY_TLD_RCVD Received =~ /\.(win|bid|top|club|date|stream|xyz|icu)\/.*/i
|
|
header __HIGH_SPAMMY_TLD_FROM From =~ /\.(win|bid|top|club|date|stream|xyz|icu)\/.*/i
|
|
uri __HIGH_SPAMMY_TLD_URI /\.(win|bid|top|club|date|stream|xyz)\/.+/i
|
|
meta HIGH_SPAMMY_TLD (__HIGH_SPAMMY_TLD_RCVD && __HIGH_SPAMMY_TLD_FROM && __HIGH_SPAMMY_TLD_URI)
|
|
score HIGH_SPAMMY_TLD 1.1
|
|
describe HIGH_SPAMMY_TLD HIGH spammy tld used in Received, From and link
|
|
|
|
#--------------------------------------------------
|
|
# no SPF fuck you score
|
|
#--------------------------------------------------
|
|
header NOSPF Received-SPF = /None/i
|
|
score NOSPF 3.0
|
|
|
|
header SOFTFAILSPF Received-SPF = /Softfail/i
|
|
score SOFTFAILSPF 3.0
|
|
|
|
#--------------------------------------------------
|
|
# uri matching
|
|
#--------------------------------------------------
|
|
|
|
# Something with ketoxplode.
|
|
uri SPAM_LINK_1 /ketoxplode/i
|
|
score SPAM_LINK_1 5
|
|
describe SPAM_LINK_1 Spam link
|
|
|
|
#--------------------------------------------------
|
|
# from matching
|
|
#--------------------------------------------------
|
|
header FROM_KETO From =~ /ketoxplode/i
|
|
score FROM_KETO 5.0
|
|
|
|
header FROM_ICS_ALERTS From =~ /icsmailing/i
|
|
score FROM_ICS_ALERTS 5.0
|
|
|
|
header FROM_KVK_HER From =~ /KVK-Herbevestiging/i
|
|
score FROM_KVK_HER 5.0
|
|
|
|
#--------------------------------------------------
|
|
# Subject matching
|
|
#--------------------------------------------------
|
|
header __SUBJECT_LUCHTBRUG Subject =~ /luchtbrug/i
|
|
header __SUBJECT_LUCHTBRUGVRAAG Subject =~ /vragenlijst/i
|
|
meta SUBJECT_LUCHTBRUG (__SUBJECT_LUCHTBRUG && __SUBJECT_LUCHTBRUGVRAAG)
|
|
score SUBJECT_LUCHTBRUG 5.0
|
|
|
|
header __SUBJECT_ICS_ALERTS Subject =~ /card alerts/i
|
|
score __SUBJECT_ICS_ALERTS 5.0
|
|
|
|
header __SUBJECT_MIKEBOS Subject =~/mikebos/i
|
|
score __SUBJECT_MIKEBOS 5.0
|
|
|
|
header __SUBJECT_UITROEPTEKENS =~ /!!!/i
|
|
score __SUBJECT_UITROEPTEKENS 2.5
|
|
|
|
header __SUBJECT_KVK =~ /u heeft recht op btw teruggave/i
|
|
score __SUBJECT_KVK 5 |