Initial commit.

rspamd/scores.d/surbl_group.conf

@@ -0,0 +1,228 @@
+# URIBL rules scores
+#
+# Please don't modify this file as your changes might be overwritten with
+# the next update.
+#
+# You can modify '$LOCAL_CONFDIR/rspamd.conf.local.override' to redefine
+# parameters defined on the top level
+#
+# You can modify '$LOCAL_CONFDIR/rspamd.conf.local' to add
+# parameters defined on the top level
+#
+# For specific modules or configuration you can also modify
+# '$LOCAL_CONFDIR/local.d/file.conf' - to add your options or rewrite defaults
+# '$LOCAL_CONFDIR/override.d/file.conf' - to override the defaults
+#
+# See https://rspamd.com/doc/tutorials/writing_rules.html for details
+
+description = "URL DNS lists";
+
+max_score = 12.5;
+
+symbols = {
+    "SURBL_BLOCKED" {
+        weight = 0.0;
+        description = "SURBL: blocked by policy/overusage";
+        groups = ["surblorg", "blocked"];
+    }
+    "PH_SURBL_MULTI" {
+        weight = 5.5;
+        description = "SURBL: Phishing sites";
+        groups = ["surblorg", "phishing"];
+    }
+    "MW_SURBL_MULTI" {
+        weight = 5.5;
+        description = "SURBL: Malware sites";
+        groups = ["surblorg"];
+    }
+    "ABUSE_SURBL" {
+        weight = 5.5;
+        description = "SURBL: ABUSE";
+        groups = ["surblorg"];
+    }
+    "CRACKED_SURBL" {
+        weight = 4.0;
+        description = "SURBL: cracked site";
+        groups = ["surblorg"];
+    }
+    "RSPAMD_URIBL" {
+        weight = 4.5;
+        description = "Rspamd uribl, bl.rspamd.com";
+        one_shot = true;
+        groups = ["rspamdbl"];
+    }
+
+    "RSPAMD_EMAILBL" {
+        weight = 2.5;
+        description = "Rspamd emailbl, bl.rspamd.com";
+        one_shot = true;
+        groups = ["rspamdbl"];
+    }
+
+    "MSBL_EBL" {
+        weight = 7.5;
+        description = "MSBL emailbl";
+        one_shot = true;
+        groups = ["ebl"];
+    }
+
+    "MSBL_EBL_GREY" {
+        weight = 0.5; # TODO: test it
+        description = "MSBL emailbl grey list";
+        one_shot = true;
+        groups = ["ebl"];
+    }
+
+    "SEM_URIBL_UNKNOWN" {
+        weight = 0.0;
+        description = "Spameatingmonkey uribl: unknown result";
+        groups = ["sem"];
+    }
+    "SEM_URIBL" {
+        weight = 3.5;
+        description = "Spameatingmonkey uribl";
+        groups = ["sem"];
+    }
+
+    "SEM_URIBL_FRESH15_UNKNOWN" {
+        weight = 0.0;
+        description = "Spameatingmonkey Fresh15 uribl: unknown result";
+        groups = ["sem"];
+    }
+    "SEM_URIBL_FRESH15" {
+        weight = 3.0;
+        description = "Spameatingmonkey uribl. Domains registered in the last 15 days (.AERO,.BIZ,.COM,.INFO,.NAME,.NET,.PRO,.SK,.TEL,.US)";
+        groups = ["sem"];
+    }
+
+    "DBL" {
+        weight = 0.0;
+        description = "DBL unknown result";
+        groups = ["spamhaus"];
+    }
+    "DBL_SPAM" {
+        weight = 6.5;
+        description = "DBL uribl spam";
+        groups = ["spamhaus"];
+    }
+    "DBL_PHISH" {
+        weight = 6.5;
+        description = "DBL uribl phishing";
+        groups = ["spamhaus"];
+    }
+    "DBL_MALWARE" {
+        weight = 6.5;
+        description = "DBL uribl malware";
+        groups = ["spamhaus"];
+    }
+    "DBL_BOTNET" {
+        weight = 5.5;
+        description = "DBL uribl botnet C&C domain";
+        groups = ["spamhaus"];
+    }
+    "DBL_ABUSE" {
+        weight = 6.5;
+        description = "DBL uribl abused legit spam";
+        groups = ["spamhaus"];
+    }
+    "DBL_ABUSE_REDIR" {
+        weight = 1.5;
+        description = "DBL uribl abused spammed redirector domain";
+        groups = ["spamhaus"];
+    }
+    "DBL_ABUSE_PHISH" {
+        weight = 7.5;
+        description = "DBL uribl abused legit phish";
+        groups = ["spamhaus"];
+    }
+    "DBL_ABUSE_MALWARE" {
+        weight = 7.5;
+        description = "DBL uribl abused legit malware";
+        groups = ["spamhaus"];
+    }
+    "DBL_ABUSE_BOTNET" {
+        weight = 5.5;
+        description = "DBL uribl abused legit botnet C&C";
+        groups = ["spamhaus"];
+    }
+    "DBL_PROHIBIT" {
+        weight = 0.0;
+        description = "DBL uribl IP queries prohibited!";
+        groups = ["spamhaus"];
+    }
+    "DBL_BLOCKED_OPENRESOLVER" {
+      weight = 0.0;
+      description = "You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/";
+      groups = ["spamhaus"];
+    }
+    "DBL_BLOCKED" {
+      weight = 0.0;
+      description = "You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/";
+      groups = ["spamhaus"];
+    }
+    "URIBL_MULTI" {
+        weight = 0.0;
+        description = "uribl.com: unrecognised result";
+        groups = ["uribl"];
+    }
+    "URIBL_BLOCKED" {
+        weight = 0.0;
+        description = "uribl.com: query refused";
+        groups = ["uribl", "blocked"];
+    }
+    "URIBL_BLACK" {
+        weight = 7.5;
+        description = "uribl.com black url";
+        groups = ["uribl"];
+    }
+    "URIBL_RED" {
+        weight = 3.5;
+        description = "uribl.com red url";
+        groups = ["uribl"];
+    }
+    "URIBL_GREY" {
+        weight = 1.5;
+        description = "uribl.com grey url";
+        one_shot = true;
+        groups = ["uribl"];
+    }
+    #"SPAMHAUS_ZEN_URIBL" {
+    #    weight = 0.0;
+    #    description = "Spamhaus ZEN URIBL: Filtered result";
+    #    groups = ["spamhaus"];
+    #}
+    #"URIBL_SBL" {
+    #    weight = 6.5;
+    #    description = "A domain in the message body resolves to an IP listed in Spamhaus SBL";
+    #    one_shot = true;
+    #    groups = ["v"];
+    #}
+    #"URIBL_SBL_CSS" {
+    #   weight = 6.5;
+    #    description = "A domain in the message body resolves to an IP listed in Spamhaus SBL CSS";
+    #    one_shot = true;
+    #    groups = ["spamhaus"];
+    #}
+    #"URIBL_XBL" {
+    #    weight = 1.5;
+    #    description = "A domain in the message body resolves to an IP listed in Spamhaus XBL";
+    #    one_shot = true;
+    #    groups = ["spamhaus"];
+    #}
+    #"URIBL_PBL" {
+    #    weight = 0.01;
+    #    description = "A domain in the message body resolves to an IP listed in Spamhaus PBL";
+    #    groups = ["spamhaus"];
+    #}
+    #"URIBL_DROP" {
+    #    weight = 5.0;
+    #    description = "A domain in the message body resolves to an IP listed in Spamhaus DROP";
+    #    one_shot = true;
+    #    groups = ["spamhaus"];
+    #}
+    #"RBL_SARBL_BAD" {
+    #    weight = 2.5;
+    #    description = "A domain in the message body is blacklisted in SARBL";
+    #    one_shot = true;
+    #}
+}