home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
ftp.f-secure.com
/
2014.06.ftp.f-secure.com.tar
/
ftp.f-secure.com
/
support
/
hotfix
/
fsis
/
IS-SpamControl.fsfix
/
iufssc
/
rules
/
97_fs-from-spf.cf
< prev
next >
Wrap
Text File
|
2006-11-29
|
11KB
|
254 lines
# rules/97_fs-from-spf.cf - Copyright (C) 2005-2006 F-Secure Corporation.
# $Id: 97_fs-from-spf.cf 4124 2006-11-09 11:21:29Z eriker $
loadplugin FS::FromSPF
header FS_SPF_FROM_PAYBAY eval:from_spf_fail("paypal.com", "ebay.com", "paypal.ca", "ebay.ca", "paypal.de", "ebay.de", "ebay.it", "ebay.com.au")
describe FS_SPF_FROM_PAYBAY From: PayPal/Ebay, but fails their SPF
score FS_SPF_FROM_PAYBAY 9
tflags FS_SPF_FROM_PAYBAY net
header FS_SPF_FROM_BOTW eval:from_spf_fail("bankofthewest.com")
describe FS_SPF_FROM_BOTW From: BankOfTheWest, but fails their SPF
score FS_SPF_FROM_BOTW 9
tflags FS_SPF_FROM_BOTW net
header FS_SPF_FROM_USBANK eval:from_spf_fail("usbank.com")
describe FS_SPF_FROM_USBANK From: US Bank, but fails their SPF
score FS_SPF_FROM_USBANK 9
tflags FS_SPF_FROM_USBANK net
######## FIXME: no SPF for citibank.com.au
header FS_SPF_FROM_CITI eval:from_spf_fail("citi.com", "citibank.com", "citibusinessonline.com", "citigroup.com", "citifinancial.com")
describe FS_SPF_FROM_CITI From: Citibank, but fails their SPF
score FS_SPF_FROM_CITI 9
tflags FS_SPF_FROM_CITI net
######## FIXME: no SPF for citizensbankonline.com
header FS_SPF_FROM_CB eval:from_spf_fail("citizensbank.com")
describe FS_SPF_FROM_CB From: Citizens Bank, but fails their SPF
score FS_SPF_FROM_CB 9
tflags FS_SPF_FROM_CB net
header FS_SPF_FROM_SKY eval:from_spf_fail("skyfi.com")
describe FS_SPF_FROM_SKY From: Sky Bank, but fails their SPF
score FS_SPF_FROM_SKY 9
tflags FS_SPF_FROM_SKY net
header FS_SPF_FROM_WAMU eval:from_spf_fail("wamu.com")
describe FS_SPF_FROM_WAMU From: Washington Mutual, but fails their SPF
score FS_SPF_FROM_WAMU 9
tflags FS_SPF_FROM_WAMU net
header FS_SPF_FROM_UNIONPLA eval:from_spf_fail("unionplanters.com")
describe FS_SPF_FROM_UNIONPLA From: Union Planters, but fails their SPF
score FS_SPF_FROM_UNIONPLA 9
tflags FS_SPF_FROM_UNIONPLA net
header FS_SPF_FROM_COLUS eval:from_spf_fail("columbusbankandtrust.com")
describe FS_SPF_FROM_COLUS From: Columbus / Synovus, but fails their SPF
score FS_SPF_FROM_COLUS 9
tflags FS_SPF_FROM_COLUS net
header FS_SPF_FROM_REGIONS eval:from_spf_fail("regions.com", "regionsbank.com", "regionsnet.com", "rgbk.com")
describe FS_SPF_FROM_REGIONS From: Regions Bank, but fails their SPF
score FS_SPF_FROM_REGIONS 9
tflags FS_SPF_FROM_REGIONS net
header FS_SPF_FROM_CHARTER1 eval:from_spf_fail("charterone.com")
describe FS_SPF_FROM_CHARTER1 From: Charter One, but fails their SPF
score FS_SPF_FROM_CHARTER1 9
tflags FS_SPF_FROM_CHARTER1 net
header FS_SPF_FROM_BOA eval:from_spf_fail("bankofamerica.com")
describe FS_SPF_FROM_BOA From: Bank of America, but fails their SPF
score FS_SPF_FROM_BOA 9
tflags FS_SPF_FROM_BOA net
######## FIXME: mbna.us missing
header FS_SPF_FROM_MBNA eval:from_spf_fail("mbna.com","mbnanetaccess.com")
describe FS_SPF_FROM_MBNA From: MBNA, but fails their SPF
score FS_SPF_FROM_MBNA 9
tflags FS_SPF_FROM_MBNA net
header FS_SPF_FROM_CHASE eval:from_spf_fail("chase.com")
describe FS_SPF_FROM_CHASE From: JP Chase Manhattan Bank, but fails their SPF
score FS_SPF_FROM_CHASE 9
tflags FS_SPF_FROM_CHASE net
######## FIXME: no SPF for wells-fargo.com
header FS_SPF_FROM_WELLSFARGO eval:from_spf_fail("wellsfargo.com", "wf.com")
describe FS_SPF_FROM_WELLSFARGO From: Wells Fargo, but fails their SPF
score FS_SPF_FROM_WELLSFARGO 9
tflags FS_SPF_FROM_WELLSFARGO net
header FS_SPF_FROM_VISA eval:from_spf_fail("visa.com")
describe FS_SPF_FROM_VISA From: Visa, but fails their SPF
score FS_SPF_FROM_VISA 9
tflags FS_SPF_FROM_VISA net
header FS_SPF_FROM_MC eval:from_spf_fail("mastercard.com")
describe FS_SPF_FROM_MC From: Mastercard, but fails their SPF
score FS_SPF_FROM_MC 9
tflags FS_SPF_FROM_MC net
header FS_SPF_FROM_SCHWAB eval:from_spf_fail("schwab.com")
describe FS_SPF_FROM_SCHWAB From: Charles Schwab, but fails their SPF
score FS_SPF_FROM_SCHWAB 9
tflags FS_SPF_FROM_SCHWAB net
header FS_SPF_FROM_ROYALBANK eval:from_spf_fail("royalbank.com", "rbc.com")
describe FS_SPF_FROM_ROYALBANK From: Royal Bank, but fails their SPF
score FS_SPF_FROM_ROYALBANK 9
tflags FS_SPF_FROM_ROYALBANK net
header FS_SPF_FROM_SCOTIA eval:from_spf_fail("scotiabank.com")
describe FS_SPF_FROM_SCOTIA From: Bank of Nova Scotia, but fails their SPF
score FS_SPF_FROM_SCOTIA 9
tflags FS_SPF_FROM_SCOTIA net
header FS_SPF_FROM_1STTENNESSEE eval:from_spf_fail("firsttennessee.com")
describe FS_SPF_FROM_1STTENNESSEE From: First Tennessee, but fails their SPF
score FS_SPF_FROM_1STTENNESSEE 9
tflags FS_SPF_FROM_1STTENNESSEE net
header FS_SPF_FROM_OHIOSAVINGS eval:from_spf_fail("ohiosavings.com")
describe FS_SPF_FROM_OHIOSAVINGS From: Ohio Savings, but fails their SPF
score FS_SPF_FROM_OHIOSAVINGS 9
tflags FS_SPF_FROM_OHIOSAVINGS net
header FS_SPF_FROM_FULT eval:from_spf_fail("fult.com", "fultonbank.com", "fultonfinancialadvisors.com")
describe FS_SPF_FROM_FULT From: Fulton Bank, but fails their SPF
score FS_SPF_FROM_FULT 9
tflags FS_SPF_FROM_FULT net
######## FIXME: cuna.com / creditunion.coop should be covered too
header FS_SPF_FROM_CUNA eval:from_spf_fail("cuna.org", "cuna.coop")
describe FS_SPF_FROM_CUNA From: Credit Union National Assoc, but fails SPF
score FS_SPF_FROM_CUNA 9
tflags FS_SPF_FROM_CUNA net
######## FIXME: ?all
header FS_SPF_FROM_LACAP eval:from_spf_fail("lacapfcu.org")
describe FS_SPF_FROM_LACAP From: La Capitol Federal Credit Union, but fails SPF
score FS_SPF_FROM_LACAP 9
tflags FS_SPF_FROM_LACAP net
header FS_SPF_FROM_NCUA eval:from_spf_fail("ncua.gov")
describe FS_SPF_FROM_NCUA National Credit Union Administration, but fails SPF
score FS_SPF_FROM_NCUA 9
tflags FS_SPF_FROM_NCUA net
######## FIXME: ?all
header FS_SPF_FROM_MTNAM eval:from_spf_fail("mtnamerica.org")
describe FS_SPF_FROM_MTNAM From: Mountain America, but fails their SPF
score FS_SPF_FROM_MTNAM 9
tflags FS_SPF_FROM_MTNAM net
header FS_SPF_FROM_AMERITRADE eval:from_spf_fail("ameritrade.com")
describe FS_SPF_FROM_AMERITRADE From: Ameritrade, but fails their SPF
score FS_SPF_FROM_AMERITRADE 9
tflags FS_SPF_FROM_AMERITRADE net
header FS_SPF_FROM_HSBC eval:from_spf_fail("hsbc.com", "hsbc.co.uk")
describe FS_SPF_FROM_HSBC From: HSBC, but fails their SPF
score FS_SPF_FROM_HSBC 9
tflags FS_SPF_FROM_HSBC net
header FS_SPF_FROM_BANCORP eval:from_spf_fail("bancorpsouth.com", "bancorpsouthonline.com")
describe FS_SPF_FROM_BANCORP From: BancorpSouth, but fails their SPF
score FS_SPF_FROM_BANCORP 9
tflags FS_SPF_FROM_BANCORP net
header FS_SPF_FROM_O2 eval:from_spf_fail("02bancorp.com", "o2bancorp.com")
describe FS_SPF_FROM_O2 From: Old Second Bancorp, but fails their SPF
score FS_SPF_FROM_O2 9
tflags FS_SPF_FROM_O2 net
header FS_SPF_FROM_PCB eval:from_spf_fail("pcbancorp.com", "sbbt.com")
describe FS_SPF_FROM_PCB From: SBBT / Pacific Capital Bancorp, but fails SPF
score FS_SPF_FROM_PCB 9
tflags FS_SPF_FROM_PCB net
######### FIXME: no SPF for capital1.com
header FS_SPF_FROM_CAP1 eval:from_spf_fail("capitalone.com")
describe FS_SPF_FROM_CAP1 From: Capital One Services, but fails SPF
score FS_SPF_FROM_CAP1 9
tflags FS_SPF_FROM_CAP1 net
header FS_SPF_FROM_DOWNEY eval:from_spf_fail("downeysavings.com")
describe FS_SPF_FROM_DOWNEY From: Downey Savings, but fails their SPF
score FS_SPF_FROM_DOWNEY 9
tflags FS_SPF_FROM_DOWNEY net
header FS_SPF_FROM_ANBTX eval:from_spf_fail("anbtx.com")
describe FS_SPF_FROM_ANBTX From: American National Bank of Texas, but fails SPF
score FS_SPF_FROM_ANBTX 9
tflags FS_SPF_FROM_ANBTX net
header FS_SPF_FROM_BBK eval:from_spf_fail("bbkonline.com")
describe FS_SPF_FROM_BBK From: Bank of Bahrain and Kuwait, but fails their SPF
score FS_SPF_FROM_BBK 9
tflags FS_SPF_FROM_BBK net
######## FIXME: no SPF for unesco.org, undp.org, unhcr.org, etc.
header FS_SPF_FROM_UN eval:from_spf_fail("un.org", "unicef.org")
describe FS_SPF_FROM_UN From: UN.org or a member organization, but fails SPF
score FS_SPF_FROM_UN 9
tflags FS_SPF_FROM_UN net
header FS_SPF_FROM_POSTBANK_DE eval:from_spf_fail("postbank.de")
describe FS_SPF_FROM_POSTBANK_DE From: Deutsche Postbank, but fails their SPF
score FS_SPF_FROM_POSTBANK_DE 9
tflags FS_SPF_FROM_POSTBANK_DE net
######## FIXME: ?all
header FS_SPF_FROM_DRESDNER eval:from_spf_fail("dresdner-bank.de")
describe FS_SPF_FROM_DRESDNER From: Dresdner Bank, but fails their SPF
score FS_SPF_FROM_DRESDNER 9
tflags FS_SPF_FROM_DRESDNER net
header FS_SPF_FROM_ABBBVB eval:from_spf_fail("abb-bvb.be")
describe FS_SPF_FROM_ABBBVB From: abb-bvb.be, but fails their SPF
score FS_SPF_FROM_ABBBVB 9
tflags FS_SPF_FROM_ABBBVB net
######## FIXME: ?all
header FS_SPF_FROM_EPASSPORTE eval:from_spf_fail("epassporte.com")
describe FS_SPF_FROM_EPASSPORTE From: ePassporte N.V., but fails their SPF
score FS_SPF_FROM_EPASSPORTE 9
tflags FS_SPF_FROM_EPASSPORTE net
header FS_SPF_FROM_FINECO eval:from_spf_fail("fineco.it")
describe FS_SPF_FROM_FINECO From: Fineco.it, but fails their SPF
score FS_SPF_FROM_FINECO 9
tflags FS_SPF_FROM_FINECO net
header FS_SPF_FROM_ALPHA_GR eval:from_spf_fail("alpha.gr")
describe FS_SPF_FROM_ALPHA_GR From: Alpha.gr, but fails their SPF
score FS_SPF_FROM_ALPHA_GR 9
tflags FS_SPF_FROM_ALPHA_GR net
######## FIXME: santander.com, santander.es, gruposantander.com, ... etc too
header FS_SPF_FROM_SANTANDER eval:from_spf_fail("santander.com.mx")
describe FS_SPF_FROM_SANTANDER From: Banco Santander, but fails their SPF
score FS_SPF_FROM_SANTANDER 9
tflags FS_SPF_FROM_SANTANDER net
header FS_SPF_FROM_BRADESCO eval:from_spf_fail("bradesco.com.br")
describe FS_SPF_FROM_BRADESCO From: Bradesco.com.br, but fails their SPF
score FS_SPF_FROM_BRADESCO 9
tflags FS_SPF_FROM_BRADESCO net
header FS_SPF_FROM_TRADEME eval:from_spf_fail("trademe.co.nz")
describe FS_SPF_FROM_TRADEME From: Trade Me, but fails their SPF
score FS_SPF_FROM_TRADEME 9
tflags FS_SPF_FROM_TRADEME net
meta FS_PHISH_SPF_FROM (FS_SPF_FROM_PAYBAY || FS_SPF_FROM_BOTW || FS_SPF_FROM_USBANK || FS_SPF_FROM_CITI || FS_SPF_FROM_CB || FS_SPF_FROM_SKY || FS_SPF_FROM_WAMU || FS_SPF_FROM_UNIONPLA || FS_SPF_FROM_COLUS || FS_SPF_FROM_REGIONS || FS_SPF_FROM_CHARTER1 || FS_SPF_FROM_BOA || FS_SPF_FROM_MBNA || FS_SPF_FROM_CHASE || FS_SPF_FROM_WELLSFARGO || FS_SPF_FROM_VISA || FS_SPF_FROM_MC || FS_SPF_FROM_SCHWAB || FS_SPF_FROM_ROYALBANK || FS_SPF_FROM_SCOTIA || FS_SPF_FROM_1STTENNESSEE || FS_SPF_FROM_OHIOSAVINGS || FS_SPF_FROM_FULT || FS_SPF_FROM_CUNA || FS_SPF_FROM_NCUA || FS_SPF_FROM_AMERITRADE || FS_SPF_FROM_HSBC || FS_SPF_FROM_BANCORP || FS_SPF_FROM_O2 || FS_SPF_FROM_PCB || FS_SPF_FROM_CAP1 || FS_SPF_FROM_DOWNEY || FS_SPF_FROM_ANBTX || FS_SPF_FROM_BBK || FS_SPF_FROM_UN || FS_SPF_FROM_POSTBANK_DE || FS_SPF_FROM_ABBBVB || FS_SPF_FROM_FINECO || FS_SPF_FROM_ALPHA_GR || FS_SPF_FROM_BRADESCO || FS_SPF_FROM_TRADEME)
# ?all: FS_SPF_FROM_MTNAM || FS_SPF_FROM_EPASSPORTE || FS_SPF_FROM_LACAP || FS_SPF_FROM_DRESDNER
describe FS_PHISH_SPF_FROM Phishing: One of the FS_SPF_FROM_* tests fired
score FS_PHISH_SPF_FROM 1
tflags FS_PHISH_SPF_FROM net