home *** CD-ROM | disk | FTP | other *** search
/ ftp.f-secure.com / 2014.06.ftp.f-secure.com.tar / ftp.f-secure.com / support / hotfix / fsis / IS-SpamControl.fsfix / iufssc / rules / 20_fake_helo_tests.cf < prev    next >
Text File  |  2006-11-29  |  11KB  |  195 lines
  1. # SpamAssassin rules file: fake-HELO tests
  2. #
  3. # Please don't modify this file as your changes will be overwritten with
  4. # the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead.
  5. # See 'perldoc Mail::SpamAssassin::Conf' for details.
  6. #
  7. # We should write a new ruletype for these, to save typing.
  8. #
  9. # <@LICENSE>
  10. # Copyright 2004 Apache Software Foundation
  11. # 
  12. # Licensed under the Apache License, Version 2.0 (the "License");
  13. # you may not use this file except in compliance with the License.
  14. # You may obtain a copy of the License at
  15. # 
  16. #     http://www.apache.org/licenses/LICENSE-2.0
  17. # 
  18. # Unless required by applicable law or agreed to in writing, software
  19. # distributed under the License is distributed on an "AS IS" BASIS,
  20. # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  21. # See the License for the specific language governing permissions and
  22. # limitations under the License.
  23. # </@LICENSE>
  24. #
  25. ###########################################################################
  26.  
  27. #require_version @@VERSION@@
  28.  
  29. ###########################################################################
  30.  
  31. header FAKE_HELO_MSN        eval:check_for_rdns_helo_mismatch("msn\.com","msn\.com")
  32. describe FAKE_HELO_MSN        Host HELO did not match rDNS: msn.com
  33. header FAKE_HELO_MAIL_COM    eval:check_for_rdns_helo_mismatch("mail\.com","mail\.com")
  34. describe FAKE_HELO_MAIL_COM    Host HELO did not match rDNS: mail.com
  35. header FAKE_HELO_EMAIL_COM    eval:check_for_rdns_helo_mismatch("email\.com","email\.com")
  36. describe FAKE_HELO_EMAIL_COM    Host HELO did not match rDNS: email.com
  37. header FAKE_HELO_EUDORAMAIL    eval:check_for_rdns_helo_mismatch("eudoramail\.com","eudoramail\.com")
  38. describe FAKE_HELO_EUDORAMAIL    Host HELO did not match rDNS: eudoramail.com
  39. header FAKE_HELO_EXCITE        eval:check_for_rdns_helo_mismatch("excite\S*","excite\.com")
  40. describe FAKE_HELO_EXCITE    Host HELO did not match rDNS: excite.com
  41. header FAKE_HELO_LYCOS        eval:check_for_rdns_helo_mismatch("lycos\S*","lycos\.com")
  42. describe FAKE_HELO_LYCOS    Host HELO did not match rDNS: lycos.com
  43. header FAKE_HELO_YAHOO_CA    eval:check_for_rdns_helo_mismatch("yahoo\.ca","yahoo\.ca")
  44. describe FAKE_HELO_YAHOO_CA    Host HELO did not match rDNS: yahoo.ca
  45.  
  46. # ---------------------------------------------------------------------------
  47.  
  48. # Suresh says: these will never be used as HELOs from real mail.com relays.
  49. # Just check the most recent handover; the connection to a trusted host.
  50. # This way a legit sender can send to their MSA using that HELO (quite a few
  51. # MUAs will do that), but a spammer gets caught.  (List of domains comes from
  52. # the drop-down list on the Mail.com signup page.)
  53. header FAKE_HELO_MAIL_COM_DOM  X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=(?:\S+\.|)(?:(?:mail|email|iname|cheerful|consultant|europe|mindless|myself|post|techie|usa|writeme|2die4|artlover|bikerider|catlover|cliffhanger|cutey|doglover|gardener|hot-shot|inorbit|loveable|mad\.scientist|playful|poetic|popstar|saintly|seductive|soon|whoever|winning|witty|yours|africamail|arcticmail|asia|australiamail|europe|japan|samerica|usa|berlin|dublin|london|madrid|moscowmail|munich|nycmail|paris|rome|sanfranmail|singapore|tokyo|accountant|adexec|allergist|alumnidirector|archaeologist|chemist|clerk|columnist|comic|consultant|counsellor|deliveryman|diplomats|doctor|dr|engineer|execs|financier|geologist|graphic-designer|insurer|journalist|lawyer|legislator|lobbyist|minister|optician|pediatrician|presidency|priest|publicist|realtyagent|registerednurses|repairman|representative|rescueteam|scientist|sociologist|teacher|techietechnologist|umpire)\.com|(?:programmer|earthling|hairdresser)\.net|musician\.org) /i
  54. describe FAKE_HELO_MAIL_COM_DOM Relay HELO'd with suspicious hostname (mail.com)
  55.  
  56. # ---------------------------------------------------------------------------
  57. # Interesting new feature; spamware HELO'ing, from a dialup IP addr,
  58. # using that IP's rDNS entry.  We can catch this easily.  There aren't
  59. # many legit mailservers calling themselves
  60. # 'dhcp024-210-034-053.columbus.rr.com'. ;)
  61. #
  62. # Note the '^[^\]]+ ' stanza: this ensures that we only match spamware
  63. # connecting to a trusted relay; if a mail came from a dynamic addr but
  64. # was relayed through their smarthost, that's fine.
  65.  
  66. # dhcp024-210-034-053.columbus.rr.com [24.210.34.53]
  67. # c-66-176-16-108.se.client2.attbi.com [66.176.16.108]
  68. # c-67-168-174-61.client.comcast.net [67.168.174.61]
  69. # NNN-NNN-NNN-NNN.fibertel.com.ar
  70. # NN.NN.NNN.NNN.ap.yournet.ne.jp
  71. # NN.NNN.NN-NN.rev.gaoland.net
  72. # vaise-1-82-67-44-166.fbx.proxad.net [82.67.44.166]
  73. # lns-vlq-11-62-147-186-141.adsl.proxad.net [62.147.186.141]
  74. # dsl-200-95-109-107.prod-infinitum.com.mx [200.95.109.107]
  75. # port-212-202-77-203.reverse.qsc.de [212.202.77.203]
  76. # pool-151-203-32-68.bos.east.verizon.net [151.203.32.68]
  77. # c-67-164-133-216.client.comcast.net [67.164.133.216]
  78. # 200-171-228-6.customer.telesp.net.br [200.171.228.6]
  79. # modemcable090.28-201-24.mc.videotron.ca [24.201.28.90]
  80. # 80-218-47-160.dclient.hispeed.ch [80.218.47.160]
  81. # cdm-68-226-239-16.laft.cox-internet.com [68.226.239.16]
  82. # d53-64-35-171.nap.wideopenwest.com [64.53.171.35]
  83. # 74.67-201-80.adsl.skynet.be [80.201.67.74]
  84. # 12-218-225-223.client.mchsi.com [12.218.225.223]
  85. # (require an alpha first, as legit HELO'ing-as-IP-address is hit otherwise)
  86. header HELO_DYNAMIC_IPADDR X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]\S*\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+[^\]]+ auth= /i
  87. describe HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1)
  88.  
  89. # dhcp024-210-034-053.columbus.rr.com [24.210.34.53]
  90. # catv-506237d8.miskcatv.broadband.hu [80.98.55.216]
  91. # node-c-8b22.a2000.nl
  92. # cm89.omega139.maxonline.com.sg
  93. # cm114.gamma208.maxonline.com.sg
  94. header HELO_DYNAMIC_DHCP X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S*(?:cm|catv|docsis|cable|dsl|dhcp|cpe|node)\S*\d+[^\d\s]+\d+[^\]]+ auth= /i
  95. describe HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP)
  96.  
  97. # fia83-8.dsl.hccnet.nl [62.251.8.83]
  98. # fia160-115-100.dsl.hccnet.nl [80.100.115.160]
  99. header HELO_DYNAMIC_HCC   X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S*\d+[^\d\s]+\d+\S*\.(?:docsis|cable|dsl|adsl|dhcp|cpe)\.[^\]]+ auth= /i
  100. describe HELO_DYNAMIC_HCC Relay HELO'd using suspicious hostname (HCC)
  101.  
  102. # h0002a5d76857.ne.client2.attbi.com [65.96.12.59]
  103. header HELO_DYNAMIC_ATTBI  X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\d+\S+\.client2\.attbi\.com[^\]]+ auth= /i
  104. describe HELO_DYNAMIC_ATTBI Relay HELO'd using suspicious hostname (ATTBI.com)
  105.  
  106. # CPE0004e2372711-CM000a73666706.cpe.net.cable.rogers.com
  107. # CPE00e0184f0eba-CM014490118324.cpe.net.cable.rogers.com [24.43.109.140]
  108. header HELO_DYNAMIC_ROGERS X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=CPE\d+\S+\.rogers\.com[^\]]+ auth= /i
  109. describe HELO_DYNAMIC_ROGERS Relay HELO'd using suspicious hostname (Rogers)
  110.  
  111. # ca-morpark-cuda1-zone7-b-159.vnnyca.adelphia.net[67.23.129.159]
  112. # tn-greenvillecuda1cable7a-36.atlaga.adelphia.net [68.171.113.36]
  113. # ky-richmond2a-123.rhmdky.adelphia.net [68.71.36.123]
  114. # ny-lackawannacadent4-chtwga3a-b-117.buf.adelphia.net [68.71.205.117]
  115. # fl-edel-u2-c3c-233.pbc.adelphia.net [68.64.89.233]
  116. header HELO_DYNAMIC_ADELPHIA X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}-\S+-\d{1,3}\.[a-z]{3,8}\.adelphia\.net[^\]]+ auth= /i
  117. describe HELO_DYNAMIC_ADELPHIA Relay HELO'd using suspicious hostname (Adelphia)
  118.  
  119. # pD9E4F89F.dip.t-dialin.net [217.228.248.159]
  120. header HELO_DYNAMIC_DIALIN X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z][A-F0-9]+\.dip\./
  121. describe HELO_DYNAMIC_DIALIN Relay HELO'd using suspicious hostname (T-Dialin)
  122.  
  123. # 0xd5aaf40b.dhcp.kabelnettet.dk
  124. # 0x50a46949.virnxx11.adsl-dhcp.tele.dk
  125. header HELO_DYNAMIC_HEXIP X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=0x[a-f0-9]{8}\./
  126. describe HELO_DYNAMIC_HEXIP Relay HELO'd using suspicious hostname (Hex IP)
  127.  
  128. # 118.Red-80-35-201.pooles.rima-tde.net
  129. header HELO_DYNAMIC_SPLIT_IP X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\d+\.\S+\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]/
  130. describe HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname (Split IP)
  131.  
  132. # YahooBB219173000034.bbtec.net [219.173.0.34]
  133. header HELO_DYNAMIC_YAHOOBB X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=YahooBB[^\]]+ auth= /i
  134. describe HELO_DYNAMIC_YAHOOBB Relay HELO'd using suspicious hostname (YahooBB)
  135.  
  136. # ool-18be1aaf.dyn.optonline.net [24.190.26.175]
  137. header HELO_DYNAMIC_OOL X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\.dyn\.optonline\.net/
  138. describe HELO_DYNAMIC_OOL Relay HELO'd using suspicious hostname (OptOnline)
  139.  
  140. header HELO_DYNAMIC_IPADDR2 X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+[^\]]+ auth= /i
  141. describe HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr 2)
  142.  
  143. # wiley-170-10231.roadrunner.nf.net [205.251.210.249]
  144. header HELO_DYNAMIC_RR2   X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]+-\d{1,3}-\d{1,5}\.roadrunner[^\]]+ auth= /i
  145. describe HELO_DYNAMIC_RR2 Relay HELO'd using suspicious hostname (RR 2)
  146.  
  147. # pcp04024417pcs.toresd01.pa.comcast.net [68.86.206.126]
  148. # bgp542174bgs.ewndsr01.nj.comcast.net[68.38.144.91]
  149. # Computer-udp135632uds.union01.nj.comcast.net [68.39.99.32]
  150. header HELO_DYNAMIC_COMCAST X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z-]+\d+[a-z]{3}\.[a-z0-9]+\...\.comcast[^\]]+ auth= /i
  151. describe HELO_DYNAMIC_COMCAST Relay HELO'd using suspicious hostname (Comcast)
  152.  
  153. # h234n2fls32o895.telia.com [217.208.73.234]
  154. # h53n2fls32o828.telia.com
  155. # h116n2fls32o1111.telia.com
  156. # h29n1fls306o1003.telia.com
  157. header HELO_DYNAMIC_TELIA X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=h\d+n\d+fls\S+\.telia\.com[^\]]+ auth= /i
  158. describe HELO_DYNAMIC_TELIA Relay HELO'd using suspicious hostname (Telia)
  159.  
  160. # CM-vina5-168-207.cm.vtr.net [200.104.168.207]
  161. # CM-anto1-98-153.cm.vtr.net [200.104.98.153]
  162. header HELO_DYNAMIC_VTR X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=cm-[a-z]+\d+-\d+-\d+\.cm\.vtr[^\]]+ auth= /i
  163. describe HELO_DYNAMIC_VTR Relay HELO'd using suspicious hostname (VTR)
  164.  
  165. # ec9z5l.cm.chello.no
  166. header HELO_DYNAMIC_CHELLO_NO  X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\.cm\.chello\.no[^\]]+ auth= /i
  167. describe HELO_DYNAMIC_CHELLO_NO Relay HELO'd using suspicious hostname (Chello.no)
  168.  
  169. # g225174.upc-g.chello.nl
  170. # a151145.upc-a.chello.nl
  171. # a96134.upc-a.chello.nl
  172. header HELO_DYNAMIC_CHELLO_NL  X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]\d+\.upc-[a-z]\.chello\.nl[^\]]+ auth= /i
  173. describe HELO_DYNAMIC_CHELLO_NL Relay HELO'd using suspicious hostname (Chello.nl)
  174.  
  175. # MG001182.user.veloxzone.com.br
  176. # ba199058073.user.veloxzone.com.br
  177. header HELO_DYNAMIC_VELOX  X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}\d+\.user\.veloxzone\.[^\]]+ auth= /i
  178. describe HELO_DYNAMIC_VELOX Relay HELO'd using suspicious hostname (Veloxzone)
  179.  
  180. # public4-seve6-5-cust173.lond.broadband.ntl.com
  181. # spr1-bolt5-5-0-cust9.manc.broadband.ntl.com
  182. # spc1-lewi4-6-0-cust190.lond.broadband.ntl.com
  183. header HELO_DYNAMIC_NTL  X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+\d+-\d+-cust\d+\.[a-z]{4,6}\.broadband\.ntl\.com[^\]]+ auth= /i
  184. describe HELO_DYNAMIC_NTL Relay HELO'd using suspicious hostname (NTL)
  185.  
  186. # cp160000-a.mill1.nb.home.nl
  187. # cp341468-b.venra1.lb.home.nl
  188. header HELO_DYNAMIC_HOME_NL  X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=[a-z]{2}\d+-\S\.\S+\d\.[a-z]{2}\.home\.nl[^]]+ auth= /i
  189. describe HELO_DYNAMIC_HOME_NL Relay HELO'd using suspicious hostname (Home.nl)
  190.  
  191. # (I'm quite sure these may be a good spamsign in future)
  192. # nwblwi-nrp3-l10-a671.nwblwi.tds.net
  193. #header HELO_DYNAMIC_TDS X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S+-[a-z]\d+\.[a-z]{6}\.tds\.net/i
  194. #header HELO_DYNAMIC_VIRTUA  X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\d+\.cps\./i
  195.