File manager - Edit - /home/ferretapmx/public_html/spamassassin.zip
Back
PK SI�\f�_� � $ 3.004004/updates_spamassassin_org.cfnu �[��� # UPDATE version 1907694 include updates_spamassassin_org/10_default_prefs.cf include updates_spamassassin_org/10_hasbase.cf include updates_spamassassin_org/20_advance_fee.cf include updates_spamassassin_org/20_aux_tlds.cf include updates_spamassassin_org/20_body_tests.cf include updates_spamassassin_org/20_compensate.cf include updates_spamassassin_org/20_dnsbl_tests.cf include updates_spamassassin_org/20_drugs.cf include updates_spamassassin_org/20_dynrdns.cf include updates_spamassassin_org/20_fake_helo_tests.cf include updates_spamassassin_org/20_freemail.cf include updates_spamassassin_org/20_freemail_domains.cf include updates_spamassassin_org/20_freemail_mailcom_domains.cf include updates_spamassassin_org/20_head_tests.cf include updates_spamassassin_org/20_html_tests.cf include updates_spamassassin_org/20_imageinfo.cf include updates_spamassassin_org/20_mailspike.cf include updates_spamassassin_org/20_meta_tests.cf include updates_spamassassin_org/20_net_tests.cf include updates_spamassassin_org/20_pdfinfo.cf include updates_spamassassin_org/20_phrases.cf include updates_spamassassin_org/20_porn.cf include updates_spamassassin_org/20_ratware.cf include updates_spamassassin_org/20_uri_tests.cf include updates_spamassassin_org/20_vbounce.cf include updates_spamassassin_org/23_bayes.cf include updates_spamassassin_org/25_accessdb.cf include updates_spamassassin_org/25_antivirus.cf include updates_spamassassin_org/25_asn.cf include updates_spamassassin_org/25_dcc.cf include updates_spamassassin_org/25_dkim.cf include updates_spamassassin_org/25_dmarc.cf include updates_spamassassin_org/25_dnswl.cf include updates_spamassassin_org/25_pyzor.cf include updates_spamassassin_org/25_razor2.cf include updates_spamassassin_org/25_replace.cf include updates_spamassassin_org/25_spf.cf include updates_spamassassin_org/25_textcat.cf include updates_spamassassin_org/25_uribl.cf include updates_spamassassin_org/25_url_shortener.cf include updates_spamassassin_org/30_text_de.cf include updates_spamassassin_org/30_text_fr.cf include updates_spamassassin_org/30_text_it.cf include updates_spamassassin_org/30_text_nl.cf include updates_spamassassin_org/30_text_pl.cf include updates_spamassassin_org/30_text_pt_br.cf include updates_spamassassin_org/50_scores.cf include updates_spamassassin_org/60_adsp_override_dkim.cf include updates_spamassassin_org/60_awl.cf include updates_spamassassin_org/60_bayes_stopwords.cf include updates_spamassassin_org/60_shortcircuit.cf include updates_spamassassin_org/60_txrep.cf include updates_spamassassin_org/60_welcomelist.cf include updates_spamassassin_org/60_welcomelist_auth.cf include updates_spamassassin_org/60_welcomelist_dkim.cf include updates_spamassassin_org/60_welcomelist_spf.cf include updates_spamassassin_org/60_welcomelist_subject.cf include updates_spamassassin_org/72_active.cf include updates_spamassassin_org/72_scores.cf include updates_spamassassin_org/73_sandbox_manual_scores.cf include updates_spamassassin_org/local.cf include updates_spamassassin_org/regression_tests.cf PK SI�\a�� , 3.004004/updates_spamassassin_org/20_porn.cfnu �[��� # SpamAssassin rules file: porn tests # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # Note: body tests are run with long lines, so be sure to limit the # size of searches; use /.{0,30}/ instead of /.*/ to avoid huge # search times. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### require_version 3.004004 ########################################################################### body FREE_PORN /\bfree (?:porn|xxx|adult)/i describe FREE_PORN Possible porn - Free Porn body CUM_SHOT /\bcum[ -]?shots?\b/i describe CUM_SHOT Possible porn - Cum Shot # "live cam" is a very common nonspam phrase, removed body LIVE_PORN /\blive .{0,9}(?:fuck(?:ing)?|sex|naked|girls?|virgins?|teens?|porno?)\b/i describe LIVE_PORN Possible porn - Live Porn header SUBJECT_SEXUAL Subject =~ /[s5][e3\xE8-\xEB]x[u\xB5\xF9-\xFC][a4\xE0-\xE6@][l!|1](?:[l!|1]y)?.{0,3}[e3\xE8-\xEB]xp[l!|1][i1!|l\xEC-\xEF]c[i1!|l\xEC-\xEF]t/i describe SUBJECT_SEXUAL Subject indicates sexually-explicit content PK SI�\`���E �E / 3.004004/updates_spamassassin_org/30_text_pl.cfnu �[��� # SpamAssassin translations: Polish # Charset: ISO-8859-2 # # Polish translation based on work started by <radek at alter dot pl> # rewrite for version 2.60: Jerzy Szczud�owski <jerzy at jedwab dot net dot pl > # (v0.2) # # Prosz� nie modyfikowa� tego pliku, gdy� wszelkie zmiany zostan� nadpisane # podczas nast�pnego uaktualnienia. Zamiast tego, prosz� u�ywa� # /etc/mail/spamassassin/local.cf. Szczeg�y w 'perldoc Mail::SpamAssassin::Conf' # # Ten program jest darmowy; mo�na go rozprowadza� i/lub modyfikowa� na # warunkach Licencji Artystycznej lub Powszechnej Licencji Publicznej GNU # publikowanej przez Free Software Foundation; zar�wno w wersji 1 lub, # kt�rejkolwiek p�niejszej. Szczeg�y w pliku "License", znajduj�cym si� w # g��wnym katalogu ze �r�d�ami SpamAssassina. # # # U�ycie: # - ustaw w /etc/procmailrc (lub lokalnie w ~/.procmailrc) zmienn� LANG=pl_PL # - w konfiguracji SpamAssassina (globalnie local.cf, lokalnie user_prefs) # dodaj opcj�: report_charset iso-8859-2 # ########################################################################### ############## ........................................................................ lang pl clear_report_template lang pl report ----------------- AUTOMATYCZNY raport antySPAMowy ---------------------- lang pl report Oprogramowanie do wykrywania spamu, dzia�aj�ce na serwerze: lang pl report *** "_HOSTNAME_" ***, lang pl report zidentyfikowa�o ten email jako prawdopodobny spam. Oryginalna wiadomo�� lang pl report zosta�a do��czona do tej, aby mo�na by�o j� przejrze�, zweryfikowa� lub lang pl report zablokowa� na przysz�o��. Je�eli masz jakie� w�tpliwo�ci, to kieruj je pod lang pl report adres _CONTACTADDRESS_ lang pl report lang pl report Przegl�d zawarto�ci: _PREVIEW_ lang pl report lang pl report Szczeg�y analizy zawarto�ci: (_HITS_ zaliczonych, _REQD_ wymaganych) lang pl report lang pl report "pkt nazwa regu�y kr�tki opis" lang pl report ---- ---------------------- ------------------------------------------- lang pl report _SUMMARY_ ############## ........................................................................ ########################################################################### # szablon raportu wiadomo�ci niebezpieczne-do-wgl�du # ##################### ...................................................................... lang pl clear_unsafe_report_template lang pl unsafe_report Oryginalna wiadomo�� nie by�a w ca�o�ci tekstowa, w zwi�zku z tym otwarcie lang pl unsafe_report jej za pomoc� niekt�rych program�w pocztowych mo�e nie by� ca�kowicie lang pl unsafe_report bezpieczne; w szczeg�lno�ci, przesy�ka mo�e zawiera� wirusa lub kod lang pl unsafe_report informuj�cy spamera, �e tw�j adres pocztowy jest prawid�owy i mo�na na lang pl unsafe_report niego przysy�a� wi�cej spamu. Je�eli chcesz j� przejrze�, bezpieczniej lang pl unsafe_report b�dzie zapisa� j� najpierw na dysk, a nast�pnie otworzy� edytorem tekstu. ##################### ...................................................................... # t�umaczenia regu� lang pl describe ACT_NOW_CAPS Tekst 'ACTING NOW' lang pl describe BAD_CREDIT Likwidacja problem�w kredytowych lang pl describe BANG_GUAR Dobitna gwarancja czego� lang pl describe BANG_OPRAH Tre��: o Oprah z wykrzyknikiem! # 23_bayes.cf ifplugin Mail::SpamAssassin::Plugin::Bayes lang pl describe BAYES_00 Bayesowskie prawdopodobie�stwo spamu wynosi 0 do 1% lang pl describe BAYES_05 Bayesowskie prawdopodobie�stwo spamu wynosi 1 do 5% lang pl describe BAYES_20 Bayesowskie prawdopodobie�stwo spamu wynosi 5 do 20% lang pl describe BAYES_40 Bayesowskie prawdopodobie�stwo spamu wynosi 20 do 40% lang pl describe BAYES_50 Bayesowskie prawdopodobie�stwo spamu wynosi 40 do 60% lang pl describe BAYES_60 Bayesowskie prawdopodobie�stwo spamu wynosi 60 do 80% lang pl describe BAYES_80 Bayesowskie prawdopodobie�stwo spamu wynosi 80 do 95% lang pl describe BAYES_95 Bayesowskie prawdopodobie�stwo spamu wynosi 95 do 99% lang pl describe BAYES_99 Bayesowskie prawdopodobie�stwo spamu wynosi 99 do 100% lang pl describe BAYES_999 Bayesowskie prawdopodobie�stwo spamu wynosi 99.9 do 100% endif # lang pl describe BILLION_DOLLARS Tre��: o niesamowitej ilo�ci pieni�dzy lang pl describe BLANK_LINES_80_90 Tre�� zawiera 80-90% pustych linii lang pl describe CHARSET_FARAWAY_HEADER Obcoj�zyczny zestaw znak�w w nag��wkach lang pl describe CHARSET_FARAWAY List zawiera typ znak�w oznaczaj�cy j�zyk obcy lang pl describe CONFIRMED_FORGED Nag��wki Received: s� sfa�szowane lang pl describe CUM_SHOT Prawdopodobnie porno - 'Wytrysk nasienia' lang pl describe DATE_IN_FUTURE_03_06 Data: jest od 3 do 6 godzin po dacie z Received: lang pl describe DATE_IN_FUTURE_06_12 Data: jest od 6 do 12 godzin po dacie z Received: lang pl describe DATE_IN_FUTURE_12_24 Data: jest od 12 do 24 godzin po dacie z Received: lang pl describe DATE_IN_FUTURE_24_48 Data: jest od 24 do 48 godzin po dacie z Received: lang pl describe DATE_IN_FUTURE_48_96 Data: jest od 48 do 96 godzin po dacie z Received: lang pl describe DATE_IN_FUTURE_96_XX Data: jest od 96 lub wi�cej godzin po dacie z Received: lang pl describe DATE_IN_PAST_03_06 Data: jest od 3 do 6 godzin przed dat� z Received: lang pl describe DATE_IN_PAST_06_12 Data: jest od 6 do 12 godzin przed dat� z Received: lang pl describe DATE_IN_PAST_12_24 Data: jest od 12 do 24 godzin przed dat� z Received: lang pl describe DATE_IN_PAST_24_48 Data: jest od 24 do 48 godzin przed dat� z Received: lang pl describe DATE_IN_PAST_96_XX Data: jest od 96 lub wi�cej godzin przed dat� z Received: lang pl describe MISSING_DATE Brakuje nag��wka Data: lang pl describe DATE_SPAMWARE_Y2K Nag��wek Data: u�ywa podejrzanego formatowania Y2k lang pl describe DEAR_FRIEND 'Drogi Przyjacielu' (ang.) lang pl describe DEAR_SOMETHING Zawiera 'Drogi Kto�tam' (ang.) lang pl describe EMAIL_ROT13 Tre�� zawiera adres email zakodowany ROT13 lang pl describe EXCUSE_24 Twierdzi, �e chcia�e� t� reklam� lang pl describe EXCUSE_4 Twierdzi, �e mo�esz by� usuni�ty z listy lang pl describe EXCUSE_REMOVE Pisze, jak mo�na zosta� usuni�tym z listy lang pl describe FIN_FREE Wolno�� finansowa lang pl describe FORGED_HOTMAIL_RCVD2 Od: hotmail.com, lecz bez 'Received:' lang pl describe FORGED_IMS_HTML IMS nie potrafi wysy�a� wiadomo�ci ca�kowicie w HTML lang pl describe FORGED_IMS_TAGS Programy pocztowe IMS nie potrafi� wysy�a� HTMLa w tym formacie lang pl describe FORGED_MUA_EUDORA Podrobiony mail udaj�cy przesy�k� z programu Eudora lang pl describe FORGED_MUA_IMS Podrobiony mail udaj�cy przesy�k� z IMS lang pl describe FORGED_MUA_MOZILLA Podrobiony mail udaj�cy przesy�k� z Mozilli lang pl describe FORGED_MUA_OIMO Podrobiony mail udaj�cy przesy�k� z MS Outlook IMO lang pl describe FORGED_MUA_OUTLOOK Podrobiony mail udaj�cy przesy�k� z MS Outlook lang pl describe FORGED_MUA_THEBAT_BOUN Podrobiony mail udaj�cy przesy�k� z programu The Bat! (granica) lang pl describe FORGED_MUA_THEBAT_CS Podrobiony mail udaj�cy przesy�k� z programu The Bat! (zestaw znak�w) lang pl describe FORGED_OUTLOOK_HTML Outlook nie potrafi wysy�a� wiadomo�ci ca�kowicie w HTML lang pl describe FORGED_OUTLOOK_TAGS Outlook nie potrafi wysy�a� wiadomo�ci HTML w tym formacie lang pl describe FORGED_QUALCOMM_TAGS Programy pocztowe QUALCOMM nie potrafi� wysy�a� HTMLa w tym formacie lang pl describe FORGED_TELESP_RCVD Zawiera podrobion� nazw� hosta pod IP DSLa z Brazylii lang pl describe FORGED_THEBAT_HTML The Bat! nie potrafi wysy�a� wiadomo�ci ca�kowicie w HTML lang pl describe FORGED_YAHOO_RCVD Od: yahoo.com nie zgadza si� z nag��wkami Received: lang pl describe FORWARD_LOOKING O�wiadczenie rezygnuj�cego akcjonariusza lang pl describe FREE_PORN Prawdopodobnie porno - darmowe porno lang pl describe FREE_QUOTE_INSTANT Darmowe notowania (ekspresowe lub bez zobowi�za�) lang pl describe FROM_ILLEGAL_CHARS From: zawiera zbyt wiele niedozwolonych znak�w lang pl describe FROM_NO_USER Od: nie ma niczego przed znakiem @ lang pl describe FROM_OFFERS Od: adresu typu "@wspania�a-okazja" lang pl describe FROM_STARTS_WITH_NUMS Od: zaczyna si� cyframi lang pl describe GAPPY_SUBJECT Temat: zawiera D.z.i.u.r.a.w.y-T.e.k.s.t lang pl describe GTUBE Og�lny test na Niepo��dane Przesy�ki Email lang pl describe GUARANTEED_100_PERCENT 100% gwarancji lang pl describe HEADER_COUNT_CTYPE Znaleziono wielokrotne nag��wki Content-Type lang pl describe HEAD_ILLEGAL_CHARS Nag��wek zawiera zbyt wiele niedozwolonych znak�w lang pl describe HIDE_WIN_STATUS U�ywa Javascriptu by ukry� URLe w przegl�darce lang pl describe HTML_CHARSET_FARAWAY Obcy j�zyk u�ywany w znacznikach HTML lang pl describe HTML_COMMENT_SAVED_URL Wiadomo�� HTML jest stron� WWW lang pl describe HTML_EMBEDS HTML z osadzonym obiektem typu wtyczka lang pl describe HTML_FONT_FACE_BAD HTMLowy opis czcionki nie jest s�owem lang pl describe HTML_FONT_LOW_CONTRAST kolor czcionki w HTML jest podobny do t�a lang pl describe HTML_FORMACTION_MAILTO cz�� HTML zawiera formularz, kt�ry wysy�a poczt� lang pl describe HTML_IMAGE_ONLY_04 HTML: grafika i 200-400 bajt�w s��w lang pl describe HTML_IMAGE_ONLY_08 HTML: grafika i 600-800 bajt�w s��w lang pl describe HTML_IMAGE_ONLY_12 HTML: grafika i 1000-1200 bajt�w s��w lang pl describe HTML_IMAGE_RATIO_02 HTML posiada niski stosunek obj�to�ci tekstu do obrazu lang pl describe HTML_IMAGE_RATIO_04 HTML posiada niski stosunek obj�to�ci tekstu do obrazu lang pl describe HTML_IMAGE_RATIO_06 HTML posiada niski stosunek obj�to�ci tekstu do obrazu lang pl describe HTML_IMAGE_RATIO_08 HTML posiada niski stosunek obj�to�ci tekstu do obrazu lang pl describe HTML_MESSAGE Wiadomo�� zawiera kod HTML lang pl describe HTML_MIME_NO_HTML_TAG Wiadomo�� ca�kowicie w HTML, lecz bez odpowiedniego oznaczenia lang pl describe HTML_TAG_BALANCE_BODY HTML posiada niepozamykane znaczniki w "body" lang pl describe HTML_TAG_BALANCE_HEAD HTML posiada niepozamykane znaczniki w "head" lang pl describe HTTP_ESCAPED_HOST U�ywa % wewn�trz nazwy hosta w URL lang pl describe HTTP_EXCESSIVE_ESCAPES Ca�kowicie zb�dne % wewn�trz URL lang pl describe IMPOTENCE Lekarstwo na impotencj� lang pl describe INVALID_DATE Nieprawid�owa data (RFC 2822) lang pl describe INVALID_DATE_TZ_ABSURD Nieprawid�owa data (nieistniej�ca strefa czasowa) lang pl describe INVALID_MSGID Zgodnie z RFC 2822, Message-Id jest nieprawid�owe lang pl describe IP_LINK_PLUS CGI poprzedzone kropkowo-dziesi�tnym adresem IP lang pl describe JAPANESE_UCE_SUBJECT Temat: zawiera japo�ski znacznik UCE lang pl describe JOIN_MILLIONS Do��cz do Milion�w Amerykan lang pl describe KOREAN_UCE_SUBJECT Temat: zawiera korea�ski znacznik UCE lang pl describe LIVE_PORN Prawdopodobnie porno - Porno na �ywo lang pl describe LOW_PRICE Najni�sza cena lang pl describe MARKETING_PARTNERS Twierdzi, �e jeste� zarejestrowany jako partner #lang pl describe MILLION_USD O milionach dolar�w #lang pl describe MIME_BASE64_BLANKS Dodatkowe puste linie kodowane w Base64 lang pl describe MIME_BASE64_TEXT Tekst wiadomo�ci zakamuflowany przy u�yciu kodowania Base64 lang pl describe __MIME_BASE64 Zawiera za��cznik kodowany w Base64 lang pl describe MIME_BOUND_MANY_HEX Na granicy MIME wida� �lad narz�dzia spamerskiego lang pl describe MIME_CHARSET_FARAWAY zestaw znak�w MIME wskazuje na j�zyk obcy lang pl describe MIME_HEADER_CTYPE_ONLY Znaleziono nag��wek 'Content-Type' lecz bez nag��wk�w MIME lang pl describe MIME_HTML_MOSTLY Wiadomo�� wielocz�ciowa, g�ownie tekst/html MIME lang pl describe MIME_HTML_ONLY_MULTI Wiadomo�� wielocz�ciowa posiada tylko cz�ci tekstowe/html MIME lang pl describe MIME_HTML_ONLY Wiadomo�� posiada tylko cz�ci tekstowe/html MIME lang pl describe MIME_QP_LONG_LINE Linia QP d�u�sza ni� 76 znak�w lang pl describe __MIME_QP Zawiera za��cznik kodowany w Quoted-Printable lang pl describe MISSING_HEADERS Brakuje jednego z nag��wk�w: Od, Dd lub Data lang pl describe MISSING_MIMEOLE Wiadomo�� zawiera X-MSMail-Priority, lecz bez X-MimeOLE lang pl describe MONEY_BACK Gwarancja zwrotu pieni�dzy lang pl describe MSGID_FROM_MTA_HEADER Message-Id zosta� dodany przez relay lang pl describe MSGID_OUTLOOK_INVALID Sfa�szowany Message-Id (w formacie Outlook Express) lang pl describe MULTI_FORGED Nag��wki Received: wykazuj� wielokrotne fa�szowanie #lang pl describe NA_DOLLARS O milionie P�nocno Ameryka�skich dolar�w lang pl describe NO_DNS_FOR_FROM Domena w nag��wku Do: nie posiada wpisu w DNS (MX lub A) lang pl describe NO_MEDICAL Bez bada� medycznych lang pl describe NONEXISTENT_CHARSET Nieznany zestaw znak�w (j�zyk). lang pl describe NO_RDNS_DOTCOM_HELO Odpowied� HELO hosta pokazuje wielkiego ISP, lecz brakuje rDNS lang pl describe NOT_ADVISOR Niezarejestrowany doradca inwestycyjny lang pl describe NUMERIC_HTTP_ADDR U�ywa kropkowo-dziesi�tnego adresu IP w URL lang pl describe OBFUSCATING_COMMENT Komentarze HTML zaciemniaj� tekst lang pl describe OBSCURED_EMAIL Wiadomo�� zdaje si� zawiera� zrotowany (rot13) adres lang pl describe ONE_TIME Jednokrotna grabie� lang pl describe ONLINE_PHARMACY Apteka on-line lang pl describe PLING_QUERY Temat zawiera wykrzyknik i pytajnik lang pl describe PREST_NON_ACCREDITED 'Presti�owe nieakredytowane uniwersytety' lang pl describe RATWARE_EGROUPS Znaleziono oznaczenie przesy�ki masowej (eGroups) lang pl describe RATWARE_HASH_DASH Zawiera zabezpieczenia przeciwko detekcji spamu w formacie Send-Safe lang pl describe RATWARE_OE_MALFORMED Nag��wek X-Mailer podaje z�� wersj� Outlook Express lang pl describe RCVD_AM_PM Sfa�szowane nag��wki Received (AM/PM) lang pl describe RCVD_FAKE_HELO_DOTCOM Nag��wek Received zawiera sfa�szowan� nazw� hosta HELO lang pl describe RCVD_IN_BL_SPAMCOP_NET Odebrane od systemu klasy RELAY w/g: bl.spamcop.net lang pl describe RCVD_IN_MAPS_DUL "open relay" wed�ug DUL, http://www.mail-abuse.org/dul/ lang pl describe RCVD_IN_MAPS_NML "open relay" wed�ug NML, http://www.mail-abuse.org/nml/ lang pl describe RCVD_IN_MAPS_RBL "open relay" wed�ug RBL, http://www.mail-abuse.org/rbl/ lang pl describe RCVD_IN_MAPS_RSS "open relay" wed�ug RSS, http://www.mail-abuse.org/rss/ lang pl describe RCVD_IN_SBL Otrzymano przez relay listowany w Spamhaus Block List lang pl describe RCVD_IN_SORBS_BLOCK SORBS: nadawca nie pozwala si� testowa� lang pl describe RCVD_IN_SORBS_HTTP SORBS: nadawca jest otwartym serwerem HTTP lang pl describe RCVD_IN_SORBS_MISC SORBS: nadawca jest otwartym serwerem proxy lang pl describe RCVD_IN_SORBS_SMTP SORBS: nadawca posiada otwarty serwer (Open Relay) lang pl describe RCVD_IN_SORBS_SOCKS SORBS: nadawca jest otwartym serwerem SOCKS proxy lang pl describe RCVD_IN_SORBS_WEB SORBS: nadawca posiada nadu�ywany serwer WWW lang pl describe RCVD_IN_SORBS_ZOMBIE SORBS: nadawca jest z sieci bez kontroli lang pl describe REFINANCE_NOW Refinansowanie dom�w lang pl describe REFINANCE_YOUR_HOME Refinansowanie dom�w lang pl describe SORTED_RECIPS Lista odbiorc�w posortowana wed�ug adresu lang pl describe STOCK_ALERT Oferuje powiadomienie o kursach akcji lang pl describe STRONG_BUY M�wi o mocnym zakupie lang pl describe SUBJ_ALL_CAPS Temat zawiera same du�e litery lang pl describe SUBJ_AS_SEEN Temat: zawiera "Jak pokazywano" lang pl describe SUBJ_BUY Temat: zaczyna si� od Kup/Kupowanie lang pl describe SUBJ_DOLLARS Temat: zaczyna si� od kwoty dolar�w lang pl describe SUBJ_ILLEGAL_CHARS Temat: zawiera zbyt wiele niedozwolonych znak�w #lang pl describe SUBJ_YOUR_DEBT Temat: zawiera "Twoje rachunki" lub podobnie lang pl describe SUBJ_YOUR_FAMILY Temat: zawiera "Twoja rodzina" lang pl describe SUSPICIOUS_RECIPS Do: zawiera t� sam� domen� przynajmniej 10 razy. lang pl describe TO_MALFORMED Do: zawiera uszkodzony adres lang pl describe TRACKER_ID Zawiera numer identyfikacyjny lang pl describe UNCLAIMED_MONEY (ludzie po prostu rozrzucaj� pieni�dze dooko�a) lang pl describe UPPERCASE_50_75 Tre�� jest w 50-75% wielkimi literami lang pl describe UPPERCASE_75_100 Tre�� jest w 75-100% wielkimi literami lang pl describe URG_BIZ Pilna sprawa #lang pl describe US_DOLLARS_3 Wspomina miliony $ ($NN,NNN,NNN.NN) lang pl describe USER_IN_ALL_SPAM_TO U�ytkownik jest wymieniony w 'all_spam_to' lang pl describe USER_IN_BLOCKLIST Od: zawiera adres z Twojej "czarnej listy" lang pl describe USER_IN_BLOCKLIST_TO U�ytkownik jest wymieniony w 'blocklist_to' lang pl describe USER_IN_DEF_WELCOMELIST U�ytkownik jest wymieniony w domy�lnej welcome-list (bia�ej li�cie) lang pl describe USER_IN_MORE_SPAM_TO U�ytkownik jest wymieniony w 'more_spam_to' lang pl describe USER_IN_WELCOMELIST Od: zawiera adres z welcome-list (bia�ej listy) lang pl describe USER_IN_WELCOMELIST_TO U�ytkownik jest wymieniony w 'welcomelist_to' lang pl describe WEIRD_PORT U�ywa niestandardowego numeru portu dla HTTP lang pl describe WEIRD_QUOTING Dziwne, powtarzaj�ce si� znaki podw�jnego cytowania lang pl describe WITH_LC_SMTP Linia 'Received' zawiera spamerski podpis (smtp) ifplugin Mail::SpamAssassin::Plugin::AntiVirus lang pl describe MIME_SUSPECT_NAME Nazwa pliku MIME nie zgadza si� z zawarto�ci� endif ifplugin Mail::SpamAssassin::Plugin::DCC lang pl describe DCC_CHECK Na li�cie DCC (http://www.dcc-servers.net/dcc/) endif ifplugin Mail::SpamAssassin::Plugin::Pyzor lang pl describe PYZOR_CHECK Na li�cie Pyzor (https://pyzor.readthedocs.io/en/latest/) endif ifplugin Mail::SpamAssassin::Plugin::TextCat lang pl describe BODY_8BITS Tre�� zawiera 8 kolejnych 8mio bitowych znak�w lang pl describe UNWANTED_LANGUAGE_BODY Wiadomo�� napisana w niepo��danym j�zyku endif ifplugin Mail::SpamAssassin::Plugin::AccessDB lang pl describe ACCESSDB Wiadomo�� zosta�aby przechwycona przez accessdb endif lang pl describe NORMAL_HTTP_TO_IP U�ywa kropkowo-dziesi�tnego adresu IP w URL PK SI�\)r5�E E / 3.004004/updates_spamassassin_org/30_text_it.cfnu �[��� # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### # character set used in the following texts #lang it report_charset iso-8859-1 # ........................................................................ #lang it clear_unsafe_report_template #lang it unsafe_report Attenzione: il messaggio originale non testo puro, e potrebbe essere #lang it unsafe_report pericoloso da aprire con alcuni programmi di posta. Ad esempio, potrebbe #lang it unsafe_report contenere un virus, o confermare ad un mittente di spam che il messaggio #lang it unsafe_report stato letto. Un modo sicuro per visualizzarne il testo (ma non le #lang it unsafe_report immagini o gli allegati) salvarlo in un file e aprirlo con un editor. # ........................................................................ PK SI�\���z, z, / 3.004004/updates_spamassassin_org/20_dynrdns.cfnu �[��� # SpamAssassin rules file: dynamic-ish rDNS tests # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # We should write a new ruletype for these, to save typing. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### require_version 3.004004 # --------------------------------------------------------------------------- # Note the '^[^\]]+ ' stanza: this ensures that we only match spamware # connecting to a internal relay; if a mail came from a dynamic addr but # was relayed through their smarthost, that's fine. # See bug #5856, all references of "trusted" were changed to "external" # All of the RDNS_DYNAMIC rules require that the last external relay # did not use SMTP authentication. These rules should not be firing on # friendlies! header __LAST_UNTRUSTED_RELAY_NO_AUTH X-Spam-Relays-Untrusted =~ /^[^\]]+ auth= / header __LAST_EXTERNAL_RELAY_NO_AUTH X-Spam-Relays-External =~ /^[^\]]+ auth= / # dhcp024-210-034-053.columbus.rr.com [24.210.34.53] # c-66-176-16-108.se.client2.attbi.com [66.176.16.108] # c-67-168-174-61.client.comcast.net [67.168.174.61] # NNN-NNN-NNN-NNN.fibertel.com.ar # NN.NN.NNN.NNN.ap.yournet.ne.jp # NN.NNN.NN-NN.rev.gaoland.net # vaise-1-82-67-44-166.fbx.proxad.net [82.67.44.166] # lns-vlq-11-62-147-186-141.adsl.proxad.net [62.147.186.141] # dsl-200-95-109-107.prod-infinitum.com.mx [200.95.109.107] # port-212-202-77-203.reverse.qsc.de [212.202.77.203] # pool-151-203-32-68.bos.east.verizon.net [151.203.32.68] # c-67-164-133-216.client.comcast.net [67.164.133.216] # 200-171-228-6.customer.telesp.net.br [200.171.228.6] # modemcable090.28-201-24.mc.videotron.ca [24.201.28.90] # 80-218-47-160.dclient.hispeed.ch [80.218.47.160] # cdm-68-226-239-16.laft.cox-internet.com [68.226.239.16] # d53-64-35-171.nap.wideopenwest.com [64.53.171.35] # 74.67-201-80.adsl.skynet.be [80.201.67.74] # 12-218-225-223.client.mchsi.com [12.218.225.223] # pptp-81-30-186-139.ufanet.ru [81.30.186.139] # (require an alpha first, as legit HELO'ing-as-IP-address is hit otherwise) header __RDNS_DYNAMIC_IPADDR X-Spam-Relays-External =~ /^[^\]]+ rdns=(?![^\s\]]+[-.]static[-.])\S*\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+\S*\.\S+\.\S/i describe __RDNS_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1) # dhcp024-210-034-053.columbus.rr.com [24.210.34.53] # catv-506237d8.miskcatv.broadband.hu [80.98.55.216] # node-c-8b22.a2000.nl # cm89.omega139.maxonline.com.sg # cm114.gamma208.maxonline.com.sg header __RDNS_DYNAMIC_DHCP X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*(?:cm|catv|docsis|cable|dsl|dhcp|cpe|node)\S*\d+[^\d\s]+\d/i describe __RDNS_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP) # fia83-8.dsl.hccnet.nl [62.251.8.83] # fia160-115-100.dsl.hccnet.nl [80.100.115.160] header __RDNS_DYNAMIC_HCC X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*\d+[^\d\s]+\d+\S*\.(?:docsis|cable|dsl|adsl|dhcp|cpe)\./i describe __RDNS_DYNAMIC_HCC Relay HELO'd using suspicious hostname (HCC) # h0002a5d76857.ne.client2.attbi.com [65.96.12.59] header __RDNS_DYNAMIC_ATTBI X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+\d+\S+\.client2\.attbi\.com/i describe __RDNS_DYNAMIC_ATTBI Relay HELO'd using suspicious hostname (ATTBI.com) # CPE0004e2372711-CM000a73666706.cpe.net.cable.rogers.com # CPE00e0184f0eba-CM014490118324.cpe.net.cable.rogers.com [24.43.109.140] header __RDNS_DYNAMIC_ROGERS X-Spam-Relays-External =~ /^[^\]]+ rdns=CPE\d+\S+\.rogers\.com/i describe __RDNS_DYNAMIC_ROGERS Relay HELO'd using suspicious hostname (Rogers) # ca-morpark-cuda1-zone7-b-159.vnnyca.adelphia.net[67.23.129.159] # tn-greenvillecuda1cable7a-36.atlaga.adelphia.net [68.171.113.36] # ky-richmond2a-123.rhmdky.adelphia.net [68.71.36.123] # ny-lackawannacadent4-chtwga3a-b-117.buf.adelphia.net [68.71.205.117] # fl-edel-u2-c3c-233.pbc.adelphia.net [68.64.89.233] header __RDNS_DYNAMIC_ADELPHIA X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z]{2}-\S+-\d{1,3}\.[a-z]{3,8}\.adelphia\.net/i describe __RDNS_DYNAMIC_ADELPHIA Relay HELO'd using suspicious hostname (Adelphia) # pD9E4F89F.dip.t-dialin.net [217.228.248.159] header __RDNS_DYNAMIC_DIALIN X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z][A-F0-9]+\.dip\./ describe __RDNS_DYNAMIC_DIALIN Relay HELO'd using suspicious hostname (T-Dialin) # 0xd5aaf40b.dhcp.kabelnettet.dk # 0x50a46949.virnxx11.adsl-dhcp.tele.dk header __RDNS_DYNAMIC_HEXIP X-Spam-Relays-External =~ /^[^\]]+ rdns=0x[a-f0-9]{8}\./ describe __RDNS_DYNAMIC_HEXIP Relay HELO'd using suspicious hostname (Hex IP) # 118.Red-80-35-201.pooles.rima-tde.net header __RDNS_DYNAMIC_SPLIT_IP X-Spam-Relays-External =~ /^[^\]]+ rdns=\d+\.\S+\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]/ describe __RDNS_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname (Split IP) # YahooBB219173000034.bbtec.net [219.173.0.34] header __RDNS_DYNAMIC_YAHOOBB X-Spam-Relays-External =~ /^[^\]]+ rdns=YahooBB/i describe __RDNS_DYNAMIC_YAHOOBB Relay HELO'd using suspicious hostname (YahooBB) # ool-18be1aaf.dyn.optonline.net [24.190.26.175] header __RDNS_DYNAMIC_OOL X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+\.dyn\.optonline\.net/ describe __RDNS_DYNAMIC_OOL Relay HELO'd using suspicious hostname (OptOnline) # wiley-170-10231.roadrunner.nf.net [205.251.210.249] header __RDNS_DYNAMIC_RR2 X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z]+-\d{1,3}-\d{1,5}\.roadrunner/i describe __RDNS_DYNAMIC_RR2 Relay HELO'd using suspicious hostname (RR 2) # pcp04024417pcs.toresd01.pa.comcast.net [68.86.206.126] # bgp542174bgs.ewndsr01.nj.comcast.net[68.38.144.91] # Computer-udp135632uds.union01.nj.comcast.net [68.39.99.32] header __RDNS_DYNAMIC_COMCAST X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z-]+\d+[a-z]{3}\.[a-z0-9]+\...\.comcast/i describe __RDNS_DYNAMIC_COMCAST Relay HELO'd using suspicious hostname (Comcast) # h234n2fls32o895.telia.com [217.208.73.234] # h53n2fls32o828.telia.com # h116n2fls32o1111.telia.com # h29n1fls306o1003.telia.com header __RDNS_DYNAMIC_TELIA X-Spam-Relays-External =~ /^[^\]]+ rdns=h\d+n\d+fls\S+\.telia\.com/i describe __RDNS_DYNAMIC_TELIA Relay HELO'd using suspicious hostname (Telia) # CM-vina5-168-207.cm.vtr.net [200.104.168.207] # CM-anto1-98-153.cm.vtr.net [200.104.98.153] header __RDNS_DYNAMIC_VTR X-Spam-Relays-External =~ /^[^\]]+ rdns=cm-[a-z]+\d+-\d+-\d+\.cm\.vtr/i describe __RDNS_DYNAMIC_VTR Relay HELO'd using suspicious hostname (VTR) # ec9z5l.cm.chello.no header __RDNS_DYNAMIC_CHELLO_NO X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+\.cm\.chello\.no/i describe __RDNS_DYNAMIC_CHELLO_NO Relay HELO'd using suspicious hostname (Chello.no) # g225174.upc-g.chello.nl # a151145.upc-a.chello.nl # a96134.upc-a.chello.nl header __RDNS_DYNAMIC_CHELLO_NL X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z]\d+\.upc-[a-z]\.chello\.nl/i describe __RDNS_DYNAMIC_CHELLO_NL Relay HELO'd using suspicious hostname (Chello.nl) # MG001182.user.veloxzone.com.br # ba199058073.user.veloxzone.com.br header __RDNS_DYNAMIC_VELOX X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z]{2}\d+\.user\.veloxzone\./i describe __RDNS_DYNAMIC_VELOX Relay HELO'd using suspicious hostname (Veloxzone) # public4-seve6-5-cust173.lond.broadband.ntl.com # spr1-bolt5-5-0-cust9.manc.broadband.ntl.com # spc1-lewi4-6-0-cust190.lond.broadband.ntl.com header __RDNS_DYNAMIC_NTL X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+\d+-\d+-cust\d+\.[a-z]{4,6}\.broadband\.ntl\.com/i describe __RDNS_DYNAMIC_NTL Relay HELO'd using suspicious hostname (NTL) # (I'm quite sure these may be a good spamsign in future) # nwblwi-nrp3-l10-a671.nwblwi.tds.net header __RDNS_DYNAMIC_TDS X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+-[a-z]\d+\.[a-z]{6}\.tds\.net/i header __RDNS_DYNAMIC_VIRTUA X-Spam-Relays-External =~ /^[^\]]+ rdns=\d+\.cps\./i # sp1-c700-131.spacelan.ne.jp header __RDNS_DYNAMIC_SPACELAN X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+-[a-z]\d+-\d+\./i # rDNS host-type indicators, as per # https://tools.ietf.org/id/draft-msullivan-dnsop-generic-naming-schemes-00.txt header __RDNS_INDICATOR_DYN X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.]dyn(?:amic)?[\-\.]/i # surprisingly large ham hitrate header __RDNS_INDICATOR_TYPE X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.](?:dial|modem|isdn|dov|\S?dsl|cable|wireless)[\-\.]/i # this hits a little ham, not too much though header __RDNS_INDICATOR_RES X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.](?:res|resnet|client)[\-\.]/i # these are non-standard, but common in the field; 100% spam correlation! # (I think that's a fluke) header __RDNS_INDICATOR_TYPE2 X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.](?:docsis|dhcp|cpe|catv)[\-\.]/i # dsl.dynamic8510023760.ttnet.net.tr header __RDNS_DYNAMIC_TTNET X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.]dyn(?:amic)?\d/i # c221106.ppp.asahi-net.or.jp # i253064.ppp.asahi-net.or.jp # u035201.ppp.asahi-net.or.jp # w158034.ppp.asahi-net.or.jp header __RDNS_DYNAMIC_ASAHI X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z][0-9]+\.ppp\.asahi-net\.or\.jp/i # exceptions (bug 5397): # exceptions: 66-220-155-151.mail-mail.facebook.com # exceptions: o167-89-97-77.outbound-mail.sendgrid.net (bug 7592) header __RDNS_STATIC X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*(?:fix|static|fixip|dedicated|mail\-mail|outbound-mail|smtp)/i # bug 5586: header __CGATE_RCVD Received =~ /by \S+ \(CommuniGate Pro/ # bug 5926: header __DOMINO_RCVD Received =~ /by \S+ \(Lotus Domino / header __RDNS_NONE X-Spam-Relays-External =~ /^[^\]]+ rdns= / ########################################################################### meta RDNS_DYNAMIC (__LAST_EXTERNAL_RELAY_NO_AUTH && !__RDNS_STATIC && (__RDNS_DYNAMIC_IPADDR || __RDNS_DYNAMIC_DHCP || __RDNS_DYNAMIC_HCC || __RDNS_DYNAMIC_ATTBI || __RDNS_DYNAMIC_ROGERS || __RDNS_DYNAMIC_ADELPHIA || __RDNS_DYNAMIC_DIALIN || __RDNS_DYNAMIC_HEXIP || __RDNS_DYNAMIC_SPLIT_IP || __RDNS_DYNAMIC_YAHOOBB || __RDNS_DYNAMIC_OOL || __RDNS_DYNAMIC_RR2 || __RDNS_DYNAMIC_COMCAST || __RDNS_DYNAMIC_TELIA || __RDNS_DYNAMIC_VTR || __RDNS_DYNAMIC_CHELLO_NO || __RDNS_DYNAMIC_CHELLO_NL || __RDNS_DYNAMIC_VELOX || __RDNS_DYNAMIC_NTL || __RDNS_DYNAMIC_TDS || __RDNS_DYNAMIC_VIRTUA || __RDNS_DYNAMIC_SPACELAN || __RDNS_INDICATOR_DYN || __RDNS_INDICATOR_RES || __RDNS_INDICATOR_TYPE2 || __RDNS_DYNAMIC_TTNET || __RDNS_DYNAMIC_ASAHI)) describe RDNS_DYNAMIC Delivered to internal network by host with dynamic-looking rDNS meta RDNS_NONE (__RDNS_NONE && !__CGATE_RCVD && !__DOMINO_RCVD) describe RDNS_NONE Delivered to internal network by a host with no rDNS PK SI�\%^��� � / 3.004004/updates_spamassassin_org/25_textcat.cfnu �[��� # SpamAssassin rules file: language tests # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # Note: body tests are run with long lines, so be sure to limit the # size of searches; use /.{0,30}/ instead of /.*/ to avoid huge # search times. # # Note: If you are adding a rule which looks for a phrase in the body # (as most of them do), please add it to rules/20_phrases.cf instead. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### ifplugin Mail::SpamAssassin::Plugin::TextCat body UNWANTED_LANGUAGE_BODY eval:check_language() describe UNWANTED_LANGUAGE_BODY Message written in an undesired language tflags UNWANTED_LANGUAGE_BODY userconf body BODY_8BITS eval:check_body_8bits() describe BODY_8BITS Body includes 8 consecutive 8-bit characters tflags BODY_8BITS userconf endif PK SI�\��?�� � - 3.004004/updates_spamassassin_org/25_pyzor.cfnu �[��� # SpamAssassin rules file: pyzor rules # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### ## ## SpamAssassin 4.0.0 note: ## PYZOR rule priorities are automatically adjusted to -100 when pyzor_fork ## option is enabled (async lookup) ## ifplugin Mail::SpamAssassin::Plugin::Pyzor full PYZOR_CHECK eval:check_pyzor() describe PYZOR_CHECK Listed in Pyzor (https://pyzor.readthedocs.io/en/latest/) tflags PYZOR_CHECK net autolearn_body priority PYZOR_CHECK 30 reuse PYZOR_CHECK endif PK SI�\���^ � � 0 3.004004/updates_spamassassin_org/20_aux_tlds.cfnu �[��� # SpamAssassin - Auxiliary TLD Definitions # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### # This file replaces the SARE http://www.rulesemporium.com/rules/90_2tld.cf # which will be deprecated as from 2010-05-01 # File updated 2014-09-17 to contain complete TLD lists, they are no longer # hardcoded into SA codebase and Util/RegistrarBoundaries.pm is deprecated # in favor of Mail::SpamAssassin::RegistryBoundaries. # Let's clear the internal TLD list, we only want to read from this config # file and ignore possible old hardcoded lists. if can(Mail::SpamAssassin::Conf::feature_registryboundaries) clear_util_rb endif # # 1st level TLD list # # Basic list can be obtained with the following command: # wget https://data.iana.org/TLD/tlds-alpha-by-domain.txt -q -O - | tail -n+2 | perl -ne 'print lc' # Current list may include more or less.. TODO easier maintenance? # util_rb_tld only accepts alpha (a-z) input before RegistryBoundaries was # implemented in 3.4.1(?), put IDN TLDs with numeric, hyphen (0-9-) etc in # this block # # For an up to date list of IDN TLDs that can be pasted into this block, run this command: # wget https://data.iana.org/TLD/tlds-alpha-by-domain.txt -q -O - | grep -i '^xn--' | tr '\n' ' ' | fold -w 80 -s | perl -pe 's/\s+$//; s/.*/util_rb_tld \L$_\n/' # Since version 4.0 the util_rb_tld also accepts Unicode IDN labels (encoded as UTF-8), e.g.: # wget https://data.iana.org/TLD/tlds-alpha-by-domain.txt -q -O - | grep -i '^xn--' | idn -u | tr '\n' ' ' | fold -w 80 -s | perl -pe 's/\s+$//; s/.*/util_rb_tld \L$_\n/' if can(Mail::SpamAssassin::Conf::feature_registryboundaries) # Updated 2022-10-18 util_rb_tld xn--11b4c3d xn--1ck2e1b xn--1qqw23a xn--2scrj9c xn--30rr7y xn--3bst00m util_rb_tld xn--3ds443g xn--3e0b707e xn--3hcrj9c xn--3pxu8k xn--42c2d9a xn--45br5cyl util_rb_tld xn--45brj9c xn--45q11c xn--4dbrk0ce xn--4gbrim xn--54b7fta0cc xn--55qw42g util_rb_tld xn--55qx5d xn--5su34j936bgsg xn--5tzm5g xn--6frz82g xn--6qq986b3xl xn--80adxhks util_rb_tld xn--80ao21a xn--80aqecdr1a xn--80asehdb xn--80aswg xn--8y0a063a xn--90a3ac util_rb_tld xn--90ae xn--90ais xn--9dbq2a xn--9et52u xn--9krt00a xn--b4w605ferd util_rb_tld xn--bck1b9a5dre4c xn--c1avg xn--c2br7g xn--cck2b3b xn--cckwcxetd xn--cg4bki util_rb_tld xn--clchc0ea0b2g2a9gcd xn--czr694b xn--czrs0t xn--czru2d xn--d1acj3b xn--d1alf util_rb_tld xn--e1a4c xn--eckvdtc9d xn--efvy88h xn--fct429k xn--fhbei xn--fiq228c5hs util_rb_tld xn--fiq64b xn--fiqs8s xn--fiqz9s xn--fjq720a xn--flw351e xn--fpcrj9c3d util_rb_tld xn--fzc2c9e2c xn--fzys8d69uvgm xn--g2xx48c xn--gckr3f0f xn--gecrj9c xn--gk3at1e util_rb_tld xn--h2breg3eve xn--h2brj9c xn--h2brj9c8c xn--hxt814e xn--i1b6b1a6a2e util_rb_tld xn--imr513n xn--io0a7i xn--j1aef xn--j1amh xn--j6w193g xn--jlq480n2rg util_rb_tld xn--jlq61u9w7b xn--jvr189m xn--kcrx77d1x4a xn--kprw13d xn--kpry57d xn--kput3i util_rb_tld xn--l1acc xn--lgbbat1ad8j xn--mgb9awbf xn--mgba3a3ejt xn--mgba3a4f16a util_rb_tld xn--mgba7c0bbn0a xn--mgbaakc7dvf xn--mgbaam7a8h xn--mgbab2bd xn--mgbah1a3hjkrd util_rb_tld xn--mgbai9azgqp6j xn--mgbayh7gpa xn--mgbbh1a xn--mgbbh1a71e xn--mgbc0a9azcg util_rb_tld xn--mgbca7dzdo xn--mgbcpq6gpa1a xn--mgberp4a5d4ar xn--mgbgu82a xn--mgbi4ecexp util_rb_tld xn--mgbpl2fh xn--mgbt3dhd xn--mgbtx2b xn--mgbx4cd0ab xn--mix891f xn--mk1bu44c util_rb_tld xn--mxtq1m xn--ngbc5azd xn--ngbe9e0a xn--ngbrx xn--node xn--nqv7f util_rb_tld xn--nqv7fs00ema xn--nyqy26a xn--o3cw4h xn--ogbpf8fl xn--otu796d xn--p1acf util_rb_tld xn--p1ai xn--pgbs0dh xn--pssy2u xn--q7ce6a xn--q9jyb4c xn--qcka1pmc xn--qxa6a util_rb_tld xn--qxam xn--rhqv96g xn--rovu88b xn--rvc1e0am3e xn--s9brj9c xn--ses554g util_rb_tld xn--t60b56a xn--tckwe xn--tiq49xqyj xn--unup4y xn--vermgensberater-ctb util_rb_tld xn--vermgensberatung-pwb xn--vhquv xn--vuq861b xn--w4r85el8fhu5dnra xn--w4rs40l util_rb_tld xn--wgbh1c xn--wgbl6a xn--xhq521b xn--xkc2al3hye2a xn--xkc2dl3a5ee0h xn--y9a3aq util_rb_tld xn--yfro4i67o xn--ygbi2ammx xn--zfr164b endif # Standard List # For an up to date list of TLDs that can be pasted into this block, run this command: # wget https://data.iana.org/TLD/tlds-alpha-by-domain.txt -q -O - | tail -n+2 | grep -vi '^xn--' | tr '\n' ' ' | fold -w 80 -s | perl -pe 's/\s+$//; s/.*/util_rb_tld \L$_\n/' # Updated 2022-10-18 util_rb_tld aaa aarp abarth abb abbott abbvie abc able abogado abudhabi ac academy util_rb_tld accenture accountant accountants aco actor ad adac ads adult ae aeg aero aetna util_rb_tld af afl africa ag agakhan agency ai aig airbus airforce airtel akdn al alfaromeo util_rb_tld alibaba alipay allfinanz allstate ally alsace alstom am amazon americanexpress util_rb_tld americanfamily amex amfam amica amsterdam analytics android anquan anz ao aol util_rb_tld apartments app apple aq aquarelle ar arab aramco archi army arpa art arte as util_rb_tld asda asia associates at athleta attorney au auction audi audible audio auspost util_rb_tld author auto autos avianca aw aws ax axa az azure ba baby baidu banamex util_rb_tld bananarepublic band bank bar barcelona barclaycard barclays barefoot bargains util_rb_tld baseball basketball bauhaus bayern bb bbc bbt bbva bcg bcn bd be beats beauty util_rb_tld beer bentley berlin best bestbuy bet bf bg bh bharti bi bible bid bike bing util_rb_tld bingo bio biz bj black blackfriday blockbuster blog bloomberg blue bm bms bmw util_rb_tld bn bnpparibas bo boats boehringer bofa bom bond boo book booking bosch bostik util_rb_tld boston bot boutique box br bradesco bridgestone broadway broker brother util_rb_tld brussels bs bt build builders business buy buzz bv bw by bz bzh ca cab cafe cal util_rb_tld call calvinklein cam camera camp canon capetown capital capitalone car caravan util_rb_tld cards care career careers cars casa case cash casino cat catering catholic cba util_rb_tld cbn cbre cbs cc cd center ceo cern cf cfa cfd cg ch chanel channel charity util_rb_tld chase chat cheap chintai christmas chrome church ci cipriani circle cisco util_rb_tld citadel citi citic city cityeats ck cl claims cleaning click clinic clinique util_rb_tld clothing cloud club clubmed cm cn co coach codes coffee college cologne com util_rb_tld comcast commbank community company compare computer comsec condos construction util_rb_tld consulting contact contractors cooking cookingchannel cool coop corsica country util_rb_tld coupon coupons courses cpa cr credit creditcard creditunion cricket crown crs util_rb_tld cruise cruises cu cuisinella cv cw cx cy cymru cyou cz dabur dad dance data util_rb_tld date dating datsun day dclk dds de deal dealer deals degree delivery dell util_rb_tld deloitte delta democrat dental dentist desi design dev dhl diamonds diet util_rb_tld digital direct directory discount discover dish diy dj dk dm dnp do docs doctor util_rb_tld dog domains dot download drive dtv dubai dunlop dupont durban dvag dvr dz earth util_rb_tld eat ec eco edeka edu education ee eg email emerck energy engineer engineering util_rb_tld enterprises epson equipment er ericsson erni es esq estate et etisalat eu util_rb_tld eurovision eus events exchange expert exposed express extraspace fage fail util_rb_tld fairwinds faith family fan fans farm farmers fashion fast fedex feedback util_rb_tld ferrari ferrero fi fiat fidelity fido film final finance financial fire util_rb_tld firestone firmdale fish fishing fit fitness fj fk flickr flights flir florist util_rb_tld flowers fly fm fo foo food foodnetwork football ford forex forsale forum util_rb_tld foundation fox fr free fresenius frl frogans frontdoor frontier ftr fujitsu fun util_rb_tld fund furniture futbol fyi ga gal gallery gallo gallup game games gap garden gay util_rb_tld gb gbiz gd gdn ge gea gent genting george gf gg ggee gh gi gift gifts gives util_rb_tld giving gl glass gle global globo gm gmail gmbh gmo gmx gn godaddy gold util_rb_tld goldpoint golf goo goodyear goog google gop got gov gp gq gr grainger graphics util_rb_tld gratis green gripe grocery group gs gt gu guardian gucci guge guide guitars util_rb_tld guru gw gy hair hamburg hangout haus hbo hdfc hdfcbank health healthcare help util_rb_tld helsinki here hermes hgtv hiphop hisamitsu hitachi hiv hk hkt hm hn hockey util_rb_tld holdings holiday homedepot homegoods homes homesense honda horse hospital host util_rb_tld hosting hot hoteles hotels hotmail house how hr hsbc ht hu hughes hyatt hyundai util_rb_tld ibm icbc ice icu id ie ieee ifm ikano il im imamat imdb immo immobilien in inc util_rb_tld industries infiniti info ing ink institute insurance insure int international util_rb_tld intuit investments io ipiranga iq ir irish is ismaili ist istanbul it itau itv util_rb_tld jaguar java jcb je jeep jetzt jewelry jio jll jm jmp jnj jo jobs joburg jot joy util_rb_tld jp jpmorgan jprs juegos juniper kaufen kddi ke kerryhotels kerrylogistics util_rb_tld kerryproperties kfh kg kh ki kia kids kim kinder kindle kitchen kiwi km kn util_rb_tld koeln komatsu kosher kp kpmg kpn kr krd kred kuokgroup kw ky kyoto kz la util_rb_tld lacaixa lamborghini lamer lancaster lancia land landrover lanxess lasalle lat util_rb_tld latino latrobe law lawyer lb lc lds lease leclerc lefrak legal lego lexus lgbt util_rb_tld li lidl life lifeinsurance lifestyle lighting like lilly limited limo lincoln util_rb_tld linde link lipsy live living lk llc llp loan loans locker locus loft lol london util_rb_tld lotte lotto love lpl lplfinancial lr ls lt ltd ltda lu lundbeck luxe luxury lv util_rb_tld ly ma macys madrid maif maison makeup man management mango map market marketing util_rb_tld markets marriott marshalls maserati mattel mba mc mckinsey md me med media meet util_rb_tld melbourne meme memorial men menu merckmsd mg mh miami microsoft mil mini mint util_rb_tld mit mitsubishi mk ml mlb mls mm mma mn mo mobi mobile moda moe moi mom monash util_rb_tld money monster mormon mortgage moscow moto motorcycles mov movie mp mq mr ms msd util_rb_tld mt mtn mtr mu museum music mutual mv mw mx my mz na nab nagoya name natura navy util_rb_tld nba nc ne nec net netbank netflix network neustar new news next nextdirect util_rb_tld nexus nf nfl ng ngo nhk ni nico nike nikon ninja nissan nissay nl no nokia util_rb_tld northwesternmutual norton now nowruz nowtv np nr nra nrw ntt nu nyc nz obi util_rb_tld observer office okinawa olayan olayangroup oldnavy ollo om omega one ong onl util_rb_tld online ooo open oracle orange org organic origins osaka otsuka ott ovh pa page util_rb_tld panasonic paris pars partners parts party passagens pay pccw pe pet pf pfizer util_rb_tld pg ph pharmacy phd philips phone photo photography photos physio pics pictet util_rb_tld pictures pid pin ping pink pioneer pizza pk pl place play playstation plumbing util_rb_tld plus pm pn pnc pohl poker politie porn post pr pramerica praxi press prime pro util_rb_tld prod productions prof progressive promo properties property protection pru util_rb_tld prudential ps pt pub pw pwc py qa qpon quebec quest racing radio re read util_rb_tld realestate realtor realty recipes red redstone redumbrella rehab reise reisen util_rb_tld reit reliance ren rent rentals repair report republican rest restaurant review util_rb_tld reviews rexroth rich richardli ricoh ril rio rip ro rocher rocks rodeo rogers util_rb_tld room rs rsvp ru rugby ruhr run rw rwe ryukyu sa saarland safe safety sakura util_rb_tld sale salon samsclub samsung sandvik sandvikcoromant sanofi sap sarl sas save util_rb_tld saxo sb sbi sbs sc sca scb schaeffler schmidt scholarships school schule util_rb_tld schwarz science scot sd se search seat secure security seek select sener util_rb_tld services ses seven sew sex sexy sfr sg sh shangrila sharp shaw shell shia util_rb_tld shiksha shoes shop shopping shouji show showtime si silk sina singles site sj util_rb_tld sk ski skin sky skype sl sling sm smart smile sn sncf so soccer social softbank util_rb_tld software sohu solar solutions song sony soy spa space sport spot sr srl ss st util_rb_tld stada staples star statebank statefarm stc stcgroup stockholm storage store util_rb_tld stream studio study style su sucks supplies supply support surf surgery suzuki util_rb_tld sv swatch swiss sx sy sydney systems sz tab taipei talk taobao target util_rb_tld tatamotors tatar tattoo tax taxi tc tci td tdk team tech technology tel temasek util_rb_tld tennis teva tf tg th thd theater theatre tiaa tickets tienda tiffany tips tires util_rb_tld tirol tj tjmaxx tjx tk tkmaxx tl tm tmall tn to today tokyo tools top toray util_rb_tld toshiba total tours town toyota toys tr trade trading training travel util_rb_tld travelchannel travelers travelersinsurance trust trv tt tube tui tunes tushu tv util_rb_tld tvs tw tz ua ubank ubs ug uk unicom university uno uol ups us uy uz va util_rb_tld vacations vana vanguard vc ve vegas ventures verisign versicherung vet vg vi util_rb_tld viajes video vig viking villas vin vip virgin visa vision viva vivo vlaanderen util_rb_tld vn vodka volkswagen volvo vote voting voto voyage vu vuelos wales walmart util_rb_tld walter wang wanggou watch watches weather weatherchannel webcam weber website util_rb_tld wed wedding weibo weir wf whoswho wien wiki williamhill win windows wine util_rb_tld winners wme wolterskluwer woodside work works world wow ws wtc wtf xbox xerox util_rb_tld xfinity xihuan xin xxx xyz yachts yahoo yamaxun yandex ye yodobashi yoga util_rb_tld yokohama you youtube yt yun za zappos zara zero zip zm zone zuerich zw # # 2nd level TLD list # # http://www.neustar.us/policies/docs/rfc_1480.txt # data originally from http://spamcheck.freeapp.net/two-level-tlds # The freeapp.net site now says that information on the site is obsolete # See discussion and sources in comments of bug 5677 # updated as per bug 5815 # cleanup in progress per bug 6795 (axb) # Unsorted sources: # .ua : https://hostmaster.ua # .hu : http://www.domain.hu/domain/English/szabalyzat/sld.html util_rb_2tld com.ac edu.ac gov.ac mil.ac net.ac org.ac util_rb_2tld nom.ad util_rb_2tld ac.ae co.ae com.ae gov.ae mil.ae name.ae net.ae org.ae pro.ae sch.ae util_rb_2tld com.af edu.af gov.af net.af util_rb_2tld co.ag com.ag net.ag nom.ag org.ag util_rb_2tld com.ai edu.ai gov.ai net.ai off.ai org.ai util_rb_2tld com.al edu.al gov.al net.al org.al util_rb_2tld com.an edu.an net.an org.an util_rb_2tld co.ao ed.ao gv.ao it.ao og.ao pb.ao util_rb_2tld com.ar edu.ar gov.ar int.ar mil.ar net.ar org.ar util_rb_2tld e164.arpa in-addr.arpa ip6.arpa iris.arpa uri.arpa urn.arpa util_rb_2tld ac.at co.at gv.at or.at priv.at util_rb_2tld act.au asn.au com.au conf.au csiro.au edu.au gov.au id.au info.au net.au nsw.au nt.au org.au otc.au oz.au qld.au sa.au tas.au telememo.au vic.au wa.au util_rb_2tld com.aw util_rb_2tld biz.az com.az edu.az gov.az info.az int.az mil.az name.az net.az org.az pp.az util_rb_2tld co.ba com.ba edu.ba gov.ba mil.ba net.ba org.ba rs.ba unbi.ba unsa.ba util_rb_2tld com.bb edu.bb gov.bb net.bb org.bb util_rb_2tld ac.bd com.bd edu.bd gov.bd mil.bd net.bd org.bd util_rb_2tld ac.be belgie.be dns.be fgov.be util_rb_2tld gov.bf util_rb_2tld biz.bh cc.bh com.bh edu.bh gov.bh info.bh net.bh org.bh util_rb_2tld com.bm edu.bm gov.bm net.bm org.bm util_rb_2tld com.bn edu.bn net.bn org.bn util_rb_2tld com.bo edu.bo gob.bo gov.bo int.bo mil.bo net.bo org.bo tv.bo util_rb_2tld adm.br adv.br agr.br am.br arq.br art.br ato.br bio.br bmd.br cim.br cng.br cnt.br com.br coop.br dpn.br eco.br ecn.br edu.br eng.br esp.br etc.br eti.br far.br fm.br fnd.br fot.br fst.br g12.br ggf.br gov.br imb.br ind.br inf.br jor.br lel.br mat.br med.br mil.br mus.br net.br nom.br not.br ntr.br odo.br org.br ppg.br pro.br psc.br psi.br qsl.br rec.br slg.br srv.br tmp.br trd.br tur.br tv.br vet.br zlg.br util_rb_2tld com.bs net.bs org.bs util_rb_2tld com.bt edu.bt gov.bt net.bt org.bt util_rb_2tld co.bw org.bw util_rb_2tld gov.by mil.by util_rb_2tld com.bz net.bz org.bz util_rb_2tld ab.ca bc.ca gc.ca mb.ca nb.ca nf.ca nl.ca ns.ca nt.ca nu.ca on.ca pe.ca qc.ca sk.ca yk.ca util_rb_2tld co.ck edu.ck gov.ck net.ck org.ck util_rb_2tld ac.cn ah.cn bj.cn com.cn cq.cn edu.cn fj.cn gd.cn gov.cn gs.cn gx.cn gz.cn ha.cn hb.cn he.cn hi.cn hk.cn hl.cn hn.cn jl.cn js.cn jx.cn ln.cn mo.cn net.cn nm.cn nx.cn org.cn qh.cn sc.cn sd.cn sh.cn sn.cn sx.cn tj.cn tw.cn xj.cn xz.cn yn.cn zj.cn util_rb_2tld arts.co com.co edu.co firm.co gov.co info.co int.co mil.co net.co nom.co org.co rec.co web.co util_rb_2tld co.cm com.cm net.cm util_rb_2tld au.com br.com cn.com de.com eu.com gb.com hu.com no.com qc.com ru.com sa.com se.com uk.com us.com uy.com za.com util_rb_2tld ac.cr co.cr ed.cr fi.cr go.cr or.cr sa.cr util_rb_2tld com.cu edu.cu gov.cu inf.cu net.cu org.cu util_rb_2tld gov.cx util_rb_2tld ac.cy biz.cy com.cy ekloges.cy gov.cy ltd.cy name.cy net.cy org.cy parliament.cy press.cy pro.cy tm.cy util_rb_2tld co.dk util_rb_2tld com.dm edu.dm gov.dm net.dm org.dm util_rb_2tld art.do com.do edu.do gob.do gov.do mil.do net.do org.do sld.do web.do util_rb_2tld art.dz asso.dz com.dz edu.dz gov.dz net.dz org.dz pol.dz util_rb_2tld com.ec edu.ec fin.ec gov.ec info.ec k12.ec med.ec mil.ec net.ec org.ec pro.ec gob.ec util_rb_2tld co.ee com.ee edu.ee fie.ee med.ee org.ee pri.ee util_rb_2tld com.eg edu.eg eun.eg gov.eg mil.eg net.eg org.eg sci.eg util_rb_2tld com.er edu.er gov.er ind.er mil.er net.er org.er util_rb_2tld com.es edu.es gob.es nom.es org.es util_rb_2tld biz.et com.et edu.et gov.et info.et name.et net.et org.et util_rb_2tld aland.fi util_rb_2tld ac.fj biz.fj com.fj gov.fj id.fj info.fj mil.fj name.fj net.fj org.fj pro.fj school.fj util_rb_2tld ac.fk co.fk com.fk gov.fk net.fk nom.fk org.fk util_rb_2tld tm.fr asso.fr nom.fr prd.fr presse.fr com.fr gouv.fr util_rb_2tld com.ge edu.ge gov.ge mil.ge net.ge org.ge pvt.ge util_rb_2tld ac.gg alderney.gg co.gg gov.gg guernsey.gg ind.gg ltd.gg net.gg org.gg sark.gg sch.gg util_rb_2tld com.gh edu.gh gov.gh mil.gh org.gh util_rb_2tld com.gi edu.gi gov.gi ltd.gi mod.gi org.gi util_rb_2tld ac.gn com.gn gov.gn net.gn org.gn util_rb_2tld asso.gp com.gp edu.gp net.gp org.gp util_rb_2tld com.gr edu.gr gov.gr net.gr org.gr util_rb_2tld com.gt edu.gt gob.gt ind.gt mil.gt net.gt org.gt util_rb_2tld com.gu edu.gu gov.gu mil.gu net.gu org.gu util_rb_2tld com.hk edu.hk gov.hk idv.hk net.hk org.hk util_rb_2tld com.hn edu.hn gob.hn mil.hn net.hn org.hn util_rb_2tld com.hr from.hr iz.hr name.hr util_rb_2tld adult.ht art.ht asso.ht com.ht coop.ht edu.ht firm.ht gouv.ht info.ht med.ht net.ht org.ht perso.ht pol.ht pro.ht rel.ht shop.ht util_rb_2tld 2000.hu agrar.hu bolt.hu casino.hu city.hu co.hu erotica.hu erotika.hu film.hu forum.hu games.hu hotel.hu info.hu ingatlan.hu jogasz.hu konyvelo.hu lakas.hu media.hu news.hu org.hu priv.hu reklam.hu sex.hu shop.hu sport.hu suli.hu szex.hu tm.hu tozsde.hu utazas.hu video.hu util_rb_2tld ac.id co.id go.id mil.id net.id or.id sch.id web.id util_rb_2tld gov.ie util_rb_2tld ac.il co.il gov.il idf.il k12.il muni.il net.il org.il util_rb_2tld ac.im co.im com.im gov.im net.im nic.im org.im util_rb_2tld ac.in co.in edu.in ernet.in firm.in gen.in gov.in ind.in mil.in net.in nic.in org.in res.in util_rb_2tld com.io gov.io mil.io net.io org.io util_rb_2tld gov.iq util_rb_2tld ac.ir co.ir gov.ir id.ir net.ir org.ir sch.ir util_rb_2tld edu.it gov.it util_rb_2tld ac.je co.je gov.je ind.je jersey.je ltd.je net.je org.je sch.je util_rb_2tld com.jm edu.jm gov.jm net.jm org.jm util_rb_2tld com.jo edu.jo gov.jo mil.jo net.jo org.jo util_rb_2tld ac.jp ad.jp aichi.jp akita.jp aomori.jp chiba.jp co.jp ed.jp ehime.jp fukui.jp fukuoka.jp fukushima.jp gifu.jp go.jp gov.jp gr.jp gunma.jp hiroshima.jp hokkaido.jp hyogo.jp ibaraki.jp ishikawa.jp iwate.jp kagawa.jp kagoshima.jp kanagawa.jp kanazawa.jp kawasaki.jp kitakyushu.jp kobe.jp kochi.jp kumamoto.jp kyoto.jp lg.jp matsuyama.jp mie.jp miyagi.jp miyazaki.jp nagano.jp nagasaki.jp nagoya.jp nara.jp ne.jp net.jp niigata.jp oita.jp okayama.jp okinawa.jp or.jp org.jp osaka.jp saga.jp saitama.jp sapporo.jp sendai.jp shiga.jp shimane.jp shizuoka.jp takamatsu.jp tochigi.jp tokushima.jp tokyo.jp tottori.jp toyama.jp utsunomiya.jp wakayama.jp yamagata.jp yamaguchi.jp yamanashi.jp yokohama.jp util_rb_2tld ac.ke co.ke go.ke ne.ke new.ke or.ke sc.ke util_rb_2tld com.kg edu.kg gov.kg mil.kg net.kg org.kg util_rb_2tld com.kh edu.kh gov.kh mil.kh net.kh org.kh per.kh util_rb_2tld ac.kr busan.kr chungbuk.kr chungnam.kr co.kr daegu.kr daejeon.kr es.kr gangwon.kr go.kr gwangju.kr gyeongbuk.kr gyeonggi.kr gyeongnam.kr hs.kr incheon.kr jeju.kr jeonbuk.kr jeonnam.kr kg.kr kyonggi.kr mil.kr ms.kr ne.kr or.kr pe.kr re.kr sc.kr seoul.kr ulsan.kr util_rb_2tld com.kw edu.kw gov.kw mil.kw net.kw org.kw util_rb_2tld com.ky edu.ky gov.ky net.ky org.ky util_rb_2tld com.kz edu.kz gov.kz mil.kz net.kz org.kz util_rb_2tld com.la net.la org.la util_rb_2tld com.lb edu.lb gov.lb mil.lb net.lb org.lb util_rb_2tld com.lc edu.lc gov.lc net.lc org.lc util_rb_2tld assn.lk com.lk edu.lk gov.lk grp.lk hotel.lk int.lk ltd.lk net.lk ngo.lk org.lk sch.lk soc.lk web.lk util_rb_2tld com.lr edu.lr gov.lr net.lr org.lr util_rb_2tld co.ls org.ls util_rb_2tld gov.lt mil.lt util_rb_2tld asn.lv com.lv conf.lv edu.lv gov.lv id.lv mil.lv net.lv org.lv util_rb_2tld biz.ly com.ly edu.ly gov.ly id.ly med.ly net.ly org.ly plc.ly sch.ly util_rb_2tld ac.ma co.ma gov.ma net.ma org.ma press.ma util_rb_2tld asso.mc tm.mc util_rb_2tld ac.me co.me edu.me gov.me its.me net.me org.me priv.me util_rb_2tld com.mg edu.mg gov.mg mil.mg nom.mg org.mg prd.mg tm.mg util_rb_2tld army.mil navy.mil util_rb_2tld com.mk org.mk util_rb_2tld com.mm edu.mm gov.mm net.mm org.mm util_rb_2tld edu.mn gov.mn org.mn util_rb_2tld com.mo edu.mo gov.mo net.mo org.mo util_rb_2tld music.mobi weather.mobi util_rb_2tld co.mp edu.mp gov.mp net.mp org.mp util_rb_2tld com.mt edu.mt gov.mt net.mt org.mt tm.mt uu.mt util_rb_2tld co.mu com.mu util_rb_2tld aero.mv biz.mv com.mv coop.mv edu.mv gov.mv info.mv int.mv mil.mv museum.mv name.mv net.mv org.mv pro.mv util_rb_2tld ac.mw co.mw com.mw coop.mw edu.mw gov.mw int.mw museum.mw net.mw org.mw util_rb_2tld com.mx edu.mx gob.mx net.mx org.mx util_rb_2tld com.my edu.my gov.my mil.my name.my net.my org.my util_rb_2tld co.mz net.mz org.mz ac.mz gov.mz edu.mz util_rb_2tld alt.na com.na cul.na edu.na net.na org.na telecom.na unam.na util_rb_2tld com.nc net.nc org.nc util_rb_2tld de.net gb.net uk.net util_rb_2tld ac.ng com.ng edu.ng gov.ng net.ng org.ng sch.ng util_rb_2tld ac.ni biz.ni com.ni edu.ni gob.ni in.ni info.ni int.ni mil.ni net.ni nom.ni org.ni web.ni util_rb_2tld fhs.no folkebibl.no fylkesbibl.no herad.no idrett.no kommune.no mil.no museum.no priv.no stat.no tel.no vgs.no util_rb_2tld com.np edu.np gov.np mil.np net.np org.np util_rb_2tld biz.nr co.nr com.nr edu.nr fax.nr gov.nr info.nr mob.nr mobil.nr mobile.nr net.nr org.nr tel.nr tlf.nr util_rb_2tld ac.nz co.nz cri.nz geek.nz gen.nz govt.nz iwi.nz kiwi.nz maori.nz mil.nz net.nz org.nz parliament.nz school.nz util_rb_2tld ac.om biz.om co.om com.om edu.om gov.om med.om mil.om mod.om museum.om net.om org.om pro.om sch.om util_rb_2tld dk.org eu.org util_rb_2tld abo.pa ac.pa com.pa edu.pa gob.pa ing.pa med.pa net.pa nom.pa org.pa sld.pa util_rb_2tld com.pe edu.pe gob.pe mil.pe net.pe nom.pe org.pe util_rb_2tld com.pf edu.pf org.pf util_rb_2tld ac.pg com.pg net.pg util_rb_2tld com.ph edu.ph gov.ph mil.ph net.ph ngo.ph org.ph util_rb_2tld biz.pk com.pk edu.pk fam.pk gob.pk gok.pk gon.pk gop.pk gos.pk gov.pk net.pk org.pk web.pk util_rb_2tld art.pl biz.pl com.pl edu.pl gov.pl info.pl mil.pl net.pl ngo.pl org.pl util_rb_2tld biz.pr com.pr edu.pr gov.pr info.pr isla.pr name.pr net.pr org.pr pro.pr util_rb_2tld cpa.pro law.pro med.pro util_rb_2tld com.ps edu.ps gov.ps net.ps org.ps plo.ps sec.ps util_rb_2tld com.pt edu.pt gov.pt int.pt net.pt nome.pt org.pt publ.pt util_rb_2tld com.py edu.py gov.py net.py org.py util_rb_2tld com.qa edu.qa gov.qa net.qa org.qa util_rb_2tld asso.re com.re nom.re util_rb_2tld arts.ro com.ro firm.ro info.ro nom.ro nt.ro org.ro rec.ro store.ro tm.ro www.ro util_rb_2tld ac.rs co.rs edu.rs gov.rs in.rs org.rs util_rb_2tld ac.ru com.ru edu.ru gov.ru int.ru mil.ru net.ru org.ru pp.ru util_rb_2tld ac.rw co.rw com.rw edu.rw gouv.rw gov.rw int.rw mil.rw net.rw util_rb_2tld com.sa edu.sa gov.sa med.sa net.sa org.sa pub.sa sch.sa util_rb_2tld com.sb edu.sb gov.sb net.sb org.sb util_rb_2tld com.sc edu.sc gov.sc net.sc org.sc util_rb_2tld com.sd edu.sd gov.sd info.sd med.sd net.sd org.sd sch.sd tv.sd util_rb_2tld ab.se ac.se bd.se brand.se c.se d.se e.se f.se fh.se fhsk.se fhv.se g.se h.se i.se k.se komforb.se kommunalforbund.se komvux.se lanarb.se lanbib.se m.se mil.se n.se naturbruksgymn.se o.se org.se parti.se pp.se press.se s.se sshn.se t.se tm.se u.se w.se x.se y.se z.se util_rb_2tld com.sg edu.sg gov.sg idn.sg net.sg org.sg per.sg util_rb_2tld com.sh edu.sh gov.sh mil.sh net.sh org.sh util_rb_2tld edu.sk gov.sk mil.sk util_rb_2tld co.st com.st consulado.st edu.st embaixada.st gov.st mil.st net.st org.st principe.st saotome.st store.st util_rb_2tld com.sv edu.sv gob.sv org.sv red.sv util_rb_2tld com.sy gov.sy net.sy org.sy util_rb_2tld at.tf bg.tf ca.tf ch.tf cz.tf de.tf edu.tf eu.tf int.tf net.tf pl.tf ru.tf sg.tf us.tf util_rb_2tld ac.th co.th go.th in.th mi.th net.th or.th util_rb_2tld ac.tj biz.tj co.tj com.tj edu.tj go.tj gov.tj int.tj mil.tj name.tj net.tj org.tj web.tj util_rb_2tld com.tn edunet.tn ens.tn fin.tn gov.tn ind.tn info.tn intl.tn nat.tn net.tn org.tn rnrt.tn rns.tn rnu.tn tourism.tn util_rb_2tld gov.to util_rb_2tld gov.tp util_rb_2tld av.tr bbs.tr bel.tr biz.tr com.tr dr.tr edu.tr gen.tr gov.tr info.tr k12.tr mil.tr name.tr net.tr org.tr pol.tr tel.tr web.tr util_rb_2tld aero.tt at.tt au.tt be.tt biz.tt ca.tt co.tt com.tt coop.tt de.tt dk.tt edu.tt es.tt eu.tt fr.tt gov.tt info.tt int.tt it.tt jobs.tt mobi.tt museum.tt name.tt net.tt nic.tt org.tt pro.tt se.tt travel.tt uk.tt us.tt util_rb_2tld co.tv gov.tv util_rb_2tld club.tw com.tw ebiz.tw edu.tw game.tw gov.tw idv.tw mil.tw net.tw org.tw util_rb_2tld ac.tz co.tz go.tz ne.tz or.tz util_rb_2tld cherkassy.ua chernigov.ua chernovtsy.ua ck.ua cn.ua co.ua com.ua crimea.ua cv.ua dn.ua dnepropetrovsk.ua donetsk.ua dp.ua edu.ua gov.ua if.ua in.ua ivano-frankivsk.ua kh.ua kharkov.ua kherson.ua khmelnitskiy.ua kiev.ua kirovograd.ua km.ua kr.ua ks.ua kv.ua lg.ua lugansk.ua lutsk.ua lviv.ua mk.ua net.ua nikolaev.ua od.ua odessa.ua org.ua pl.ua poltava.ua rovno.ua rv.ua sebastopol.ua sumy.ua te.ua ternopil.ua uzhgorod.ua vinnica.ua vn.ua zaporizhzhe.ua zhitomir.ua zp.ua zt.ua util_rb_2tld ac.ug co.ug go.ug ne.ug or.ug sc.ug util_rb_2tld ac.uk bl.uk british-library.uk co.uk edu.uk gov.uk icnet.uk jet.uk ltd.uk me.uk mod.uk national-library-scotland.uk net.uk nhs.uk nic.uk nls.uk org.uk parliament.uk plc.uk police.uk sch.uk util_rb_2tld ak.us al.us ar.us az.us ca.us co.us ct.us dc.us de.us dni.us fed.us fl.us ga.us hi.us ia.us id.us il.us in.us isa.us kids.us ks.us ky.us la.us ma.us md.us me.us mi.us mn.us mo.us ms.us mt.us nc.us nd.us ne.us nh.us nj.us nm.us nsn.us nv.us ny.us oh.us ok.us or.us pa.us ri.us sc.us sd.us tn.us tx.us ut.us va.us vt.us wa.us wi.us wv.us wy.us util_rb_2tld com.uy edu.uy gub.uy mil.uy net.uy org.uy util_rb_2tld vatican.va util_rb_2tld arts.ve bib.ve co.ve com.ve edu.ve firm.ve gov.ve info.ve int.ve mil.ve net.ve nom.ve org.ve rec.ve store.ve tec.ve web.ve util_rb_2tld co.vi com.vi edu.vi gov.vi net.vi org.vi util_rb_2tld ac.vn biz.vn com.vn edu.vn gov.vn health.vn info.vn int.vn name.vn net.vn org.vn pro.vn util_rb_2tld ch.vu com.vu de.vu edu.vu fr.vu net.vu org.vu util_rb_2tld com.ws edu.ws gov.ws net.ws org.ws util_rb_2tld com.ye edu.ye gov.ye mil.ye net.ye org.ye util_rb_2tld ac.za alt.za bourse.za city.za co.za edu.za gov.za law.za mil.za net.za ngo.za nom.za org.za school.za tm.za web.za util_rb_2tld ac.zm co.zm com.zm edu.zm gov.zm org.zm sch.zm util_rb_2tld ac.zw co.zw gov.zw org.zw # util_rb_2tld 110mb.com util_rb_2tld 9k.com util_rb_2tld addr.com util_rb_2tld altervista.org util_rb_2tld biz.tm util_rb_2tld blogger.ca util_rb_2tld blogger.cf util_rb_2tld blogger.ch util_rb_2tld blogspot.com util_rb_2tld blogger.cv util_rb_2tld blogger.jp util_rb_2tld blogger.pl util_rb_2tld blogger.re util_rb_2tld blogger.se util_rb_2tld blogspot.ca util_rb_2tld blogspot.cv util_rb_2tld blogspot.de util_rb_2tld blogspot.fr util_rb_2tld blogspot.in util_rb_2tld blogspot.it util_rb_2tld blogspot.jp util_rb_2tld blogspot.mx util_rb_2tld blogspot.pt util_rb_2tld blogspot.re util_rb_2tld blogspot.se util_rb_2tld bravehost.com util_rb_2tld bravejournal.com util_rb_2tld by.ru util_rb_2tld chat.ru util_rb_2tld cjb.net util_rb_2tld es.tl util_rb_2tld extra.hu util_rb_2tld freehostia.com util_rb_2tld front.ru util_rb_2tld geocities.com util_rb_2tld getmyip.com util_rb_2tld googlepages.com util_rb_2tld helloweb.eu util_rb_2tld host.sk util_rb_2tld hotbox.ru util_rb_2tld hotmail.ru util_rb_2tld hu2.ru util_rb_2tld hut2.ru util_rb_2tld iblogger.org util_rb_2tld ic.cz util_rb_2tld id.ru util_rb_2tld kwik.to util_rb_2tld land.ru util_rb_2tld mine.nu util_rb_2tld mooo.com util_rb_2tld narod.ru util_rb_2tld netsolhost.com util_rb_2tld na.by util_rb_2tld newmail.ru util_rb_2tld nextmail.ru util_rb_2tld nightmail.ru util_rb_2tld nm.ru util_rb_2tld notlong.com util_rb_2tld page.tl page.link util_rb_2tld pochta.ru util_rb_2tld pochtamt.ru util_rb_2tld pop3.ru util_rb_2tld proboards.com util_rb_2tld rbcmail.ru util_rb_2tld rm.ru util_rb_2tld smtp.ru util_rb_2tld sol.ru util_rb_2tld t35.com util_rb_2tld tripod.com util_rb_2tld uk.to util_rb_2tld unblog.fr util_rb_2tld us.to util_rb_2tld web-soft.ru util_rb_2tld wz.cz util_rb_2tld zmail.ru util_rb_2tld t35.net util_rb_2tld t35.com util_rb_2tld wordpress.com util_rb_2tld jino-net.ru util_rb_2tld 6a.org util_rb_2tld xf.cz util_rb_2tld fr.tc util_rb_2tld googlegroups.com util_rb_2tld 150m.com util_rb_2tld bravepages.com util_rb_2tld ucoz.ru util_rb_2tld ucoz.com util_rb_2tld ucoz.net util_rb_2tld szm.com util_rb_2tld geocities.jp util_rb_2tld gmxhome.de util_rb_2tld freeservercity.com util_rb_2tld iquebec.com util_rb_2tld mail2k.ru util_rb_2tld mail.ru util_rb_2tld ath.cx util_rb_2tld go.ro util_rb_2tld z8.ru util_rb_2tld appspot.com util_rb_2tld gigazu.net util_rb_2tld weebly.com util_rb_2tld ifrance.com util_rb_2tld jimdo.com util_rb_2tld kimsufi.com util_rb_2tld mail333.su util_rb_2tld pisem.su util_rb_2tld mail15.su util_rb_2tld prserv.net util_rb_2tld angelfire.com util_rb_2tld 163.to util_rb_2tld home.pl util_rb_2tld redirectme.net util_rb_2tld interia.pl util_rb_2tld co.kg util_rb_2tld ning.com util_rb_2tld xorg.pl util_rb_2tld free.fr util_rb_2tld we.bs util_rb_2tld net.tc util_rb_2tld isuisse.com util_rb_2tld de.ki util_rb_2tld funpic.de util_rb_2tld interii.pl util_rb_2tld selfip.com #util_rb_2tld livejournal.com - Removed per bug 6662 4/7/15 - KAM util_rb_2tld t3.to util_rb_2tld fx.to util_rb_2tld iespana.es util_rb_2tld go.com util_rb_2tld hostevo.com util_rb_2tld iwebsource.com util_rb_2tld one.pl util_rb_2tld gratishost.com util_rb_2tld netfirms.com util_rb_2tld ibelgique.com util_rb_2tld to.it util_rb_2tld whsites.net util_rb_2tld home.ro util_rb_2tld 1blu.de util_rb_2tld co.cc util_rb_2tld cc.cc util_rb_2tld webs.com util_rb_2tld webcindario.com util_rb_2tld idoo.com util_rb_2tld selfip.net util_rb_2tld ovh.net util_rb_2tld sapo.pt util_rb_2tld homeip.net util_rb_2tld unlugar.com util_rb_2tld nov.ru util_rb_2tld republika.pl util_rb_2tld blog.com util_rb_2tld sosblog.com util_rb_2tld servebbs.com util_rb_2tld serveftp.com util_rb_2tld gob.ve util_rb_2tld xanga.com util_rb_2tld com.vc util_rb_2tld net.vc util_rb_2tld org.vc util_rb_2tld kickme.to util_rb_2tld asso.ws util_rb_2tld url.st util_rb_2tld at.pn util_rb_2tld au.pn util_rb_2tld ca.pn util_rb_2tld ch.pn util_rb_2tld cn.pn util_rb_2tld co.pn util_rb_2tld corp.st util_rb_2tld societe.st util_rb_2tld de.pn util_rb_2tld es.pn util_rb_2tld eu.pn util_rb_2tld euro.tm util_rb_2tld fr.pn util_rb_2tld gov.pn util_rb_2tld government.pn util_rb_2tld it.pn util_rb_2tld jp.pn util_rb_2tld perso.tc util_rb_2tld site.tc util_rb_2tld societe.st util_rb_2tld url.st util_rb_2tld blog.ru util_rb_2tld eu.tc util_rb_2tld us.tc util_rb_2tld pro.tc util_rb_2tld de.tc util_rb_2tld at.tc util_rb_2tld it.tc util_rb_2tld es.tc util_rb_2tld ru.tc util_rb_2tld se.tc util_rb_2tld dk.tc util_rb_2tld be.tc util_rb_2tld no.tc util_rb_2tld int.tc util_rb_2tld pl.tc util_rb_2tld bg.tc util_rb_2tld cz.tc util_rb_2tld mx.tc util_rb_2tld br.tc util_rb_2tld hk.tc util_rb_2tld kr.tc util_rb_2tld th.tc util_rb_2tld ph.tc util_rb_2tld at.lv util_rb_2tld de.lv util_rb_2tld ch.lv util_rb_2tld org.rw util_rb_2tld myvnc.com util_rb_2tld blog4ever.com util_rb_2tld sytes.net util_rb_2tld multiply.com util_rb_2tld 80.hk util_rb_2tld shutterfly.com util_rb_2tld chez.com util_rb_2tld ce.ms util_rb_2tld zapto.org util_rb_2tld cz.cc util_rb_2tld fromru.su util_rb_2tld krovatka.su util_rb_2tld pochta.com util_rb_2tld 5ballov.ru util_rb_2tld usa.cc util_rb_2tld jpn.com util_rb_2tld yolasite.com util_rb_2tld in.net util_rb_2tld com.de util_rb_2tld biz.ua util_rb_2tld azurewebsites.net util_rb_2tld azureedge.net util_rb_2tld zohosites.com util_rb_2tld wixsite.com util_rb_2tld firebaseapp.com util_rb_2tld web.app # util_rb_2tld neostrada.pl util_rb_2tld vv.cc util_rb_2tld co.be util_rb_2tld uni.cc util_rb_2tld shop.co util_rb_2tld tumblr.com util_rb_2tld fileave.com util_rb_2tld de.tl util_rb_2tld co.com # Dyndns.com util_rb_2tld dyndns-at-home.com util_rb_2tld dyndns-at-work.com util_rb_2tld dyndns-blog.com util_rb_2tld dyndns-free.com util_rb_2tld dyndns-home.com util_rb_2tld dyndns-ip.com util_rb_2tld dyndns-mail.com util_rb_2tld dyndns-office.com util_rb_2tld dyndns-pics.com util_rb_2tld dyndns-remote.com util_rb_2tld dyndns-server.com util_rb_2tld dyndns-web.com util_rb_2tld dyndns-wiki.com util_rb_2tld dyndns-work.com util_rb_2tld dyndns.biz util_rb_2tld dyndns.info util_rb_2tld dyndns.org util_rb_2tld dyndns.tv util_rb_2tld dyndns.dk util_rb_2tld dyndns.ws util_rb_2tld mydyndns.org util_rb_2tld qip.ru # util_rb_2tld no-ip.biz util_rb_2tld no-ip.ca util_rb_2tld no-ip.com util_rb_2tld no-ip.info util_rb_2tld no-ip.net util_rb_2tld no-ip.org # util_rb_2tld gotdns.ch util_rb_2tld ddnsking.com util_rb_2tld ddns.net util_rb_2tld bounceme.net util_rb_2tld hopto.org util_rb_2tld serveblog.net util_rb_2tld myftp.org util_rb_2tld myftp.biz # # 3rd level TLD list (SA 3.3+) # # There was a bug before 3.4.1(?), only one 3TLD per line works! # if (version >= 3.003000) util_rb_3tld demon.co.uk util_rb_3tld esc.edu.ar util_rb_3tld lkd.co.im util_rb_3tld plc.co.im util_rb_3tld ltd.co.im # util_rb_3tld bay.livefilestore.com util_rb_3tld blu.livefilestore.com util_rb_3tld groups.live.com util_rb_3tld spaces.live.com util_rb_3tld profile.live.com util_rb_3tld web.aplus.net util_rb_3tld cloud.prohosting.com util_rb_3tld skydrive.live.com util_rb_3tld docs.google.com util_rb_3tld spaces.msn.com util_rb_3tld blog.friendster.com util_rb_3tld plc.co.im util_rb_3tld ltd.co.im util_rb_3tld sakura.ne.jp util_rb_3tld web.officelive.com util_rb_3tld com.sapo.pt util_rb_3tld paginas.sapo.pt util_rb_3tld no.sapo.pt util_rb_3tld home.sapo.pt util_rb_3tld do.sapo.pt util_rb_3tld homepage.t-online.de util_rb_3tld privat.t-online.de util_rb_3tld web.fc2.com util_rb_3tld co.uk.pn util_rb_3tld com.au.pn util_rb_3tld co.at.pn util_rb_3tld co.at.lv util_rb_3tld or.at.lv util_rb_3tld co.at.tc util_rb_3tld qld.edu.au util_rb_3tld perso.neuf.fr util_rb_3tld perso.sfr.fr util_rb_3tld hop.clickbank.net util_rb_3tld user.icpnet.pl util_rb_3tld en.alibaba.com # util_rb_3tld blogspot.co.nz util_rb_3tld blogspot.co.uk util_rb_3tld blogspot.com.ar util_rb_3tld blogspot.com.au util_rb_3tld blogspot.com.br util_rb_3tld blogspot.com.es # util_rb_3tld no-ip.co.uk # util_rb_3tld mobile.web.tr util_rb_3tld ct.sendgrid.net endif PK SI�\�r�ؕ ؕ . 3.004004/updates_spamassassin_org/50_scores.cfnu �[��� # SpamAssassin score file # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### # Default scores. Note that if a test is named in the files, but a score is # not assigned here, the default score will be set to 1. # The following block of scores were generated using the mass-checking # scripts, and a perceptron to determine the optimum scores which # resulted in minimum false positives or negatives. The scores are # weighted to produce roughly 1 false positive in 2500 non-spam messages # using the default threshold of 5.0. # Start of generated scores. <gen:mutable> score ACT_NOW_CAPS 0.1 #score ADVANCE_FEE_2 2.314 2.294 1.198 1.053 #score ADVANCE_FEE_3 2.686 1.898 3.505 3.817 #score ADVANCE_FEE_4 0.001 0.001 0.001 0.271 score ALL_TRUSTED -1.000 score APOSTROPHE_FROM 0.148 0.786 0.651 0.545 # n=2 score BAD_CREDIT 0.1 score BANG_GUAR 1.0 score BANG_OPRAH 0 # n=0 n=1 n=2 n=3 score BANKING_LAWS 2.399 2.004 2.157 1.099 # n=2 score BILLION_DOLLARS 0.001 1.451 1.229 1.638 score BODY_ENHANCEMENT 0.927 1.611 0.974 0.001 score BODY_ENHANCEMENT2 0.1 score CONFIRMED_FORGED 0 # n=0 n=1 n=2 n=3 score CORRUPT_FROM_LINE_IN_HDRS 0 # n=0 n=1 n=2 n=3 score CTYPE_001C_A 0 # n=0 n=1 n=2 n=3 score CTYPE_001C_B 0.001 0.001 0.001 0.001 # n=1 score CUM_SHOT 0 # n=0 n=1 n=2 n=3 score CURR_PRICE 0.001 # n=0 n=1 n=2 n=3 score DATE_SPAMWARE_Y2K 0 # n=0 n=1 n=2 n=3 score DEAR_FRIEND 2.683 2.604 1.801 2.577 score DEAR_SOMETHING 1.999 1.731 1.787 1.973 score DEAR_WINNER 3.099 3.099 2.309 3.099 # n=2 score DIET_1 0.714 0.000 0.399 0.001 score DIGEST_MULTIPLE 0 0.001 0 0.293 # n=0 n=2 score DOS_ANAL_SPAM_MAILER 0 # n=0 n=1 n=2 score DOS_FIX_MY_URI 0 # n=0 n=1 n=2 n=3 score DOS_HIGH_BAT_TO_MX 0 # n=0 n=1 n=2 score DOS_LET_GO_JOB 0 # n=0 n=1 n=2 n=3 score DOS_OE_TO_MX 2.602 3.086 2.265 2.523 score DOS_OE_TO_MX_IMAGE 2.886 1.886 2.425 3.699 score DOS_OUTLOOK_TO_MX 2.636 1.449 1.737 2.845 score DOS_RCVD_IP_TWICE_C 2.599 2.060 3.292 0.096 score DOS_STOCK_BAT 0.001 # n=0 n=1 n=2 n=3 score DOS_STOCK_BAT2 0 # n=0 n=1 n=2 n=3 score DOS_URI_ASTERISK 0 # n=0 n=1 n=2 n=3 score DOS_YOUR_PLACE 0 # n=0 n=1 n=2 n=3 score DRUGS_ANXIETY 0.1 score DRUGS_ANXIETY_EREC 0 # n=0 n=1 n=2 n=3 score DRUGS_ANXIETY_OBFU 0 # n=0 n=1 n=2 n=3 score DRUGS_DIET 2.660 0.757 1.831 0.337 score DRUGS_DIET_OBFU 0 # n=0 n=1 n=2 n=3 score DRUGS_ERECTILE 1.778 2.221 1.299 1.994 score DRUGS_ERECTILE_OBFU 1.324 1.309 2.935 1.109 score DRUGS_HDIA 0 # n=0 n=1 n=2 n=3 score DRUGS_MANYKINDS 2.001 1.473 0.841 0.342 score DRUGS_MUSCLE 0.001 2.499 0.392 0.164 score DRUGS_SLEEP_EREC 0 # n=0 n=1 n=2 n=3 score DRUGS_SMEAR1 3.300 2.051 3.148 0.235 # n=0 score DRUGS_STOCK_MIMEOLE 2.699 1.681 2.478 1.321 # n=2 score DRUG_DOSAGE 0 # n=0 n=1 n=2 n=3 score DRUG_ED_CAPS 2.799 1.023 2.516 0.936 score DRUG_ED_GENERIC 0 # n=0 n=1 n=2 n=3 score DRUG_ED_ONLINE 0.696 1.152 1.221 0.608 # n=0 score DRUG_ED_SILD 0.001 score DYN_RDNS_AND_INLINE_IMAGE 1.345 1.344 1.434 1.168 # n=2 score DYN_RDNS_SHORT_HELO_HTML 0.001 0.001 0.000 0.001 # n=2 score DYN_RDNS_SHORT_HELO_IMAGE 1.825 2.516 2.285 1.013 # n=2 score EMAIL_ROT13 0 # n=0 n=1 n=2 n=3 score EMPTY_MESSAGE 2.195 2.344 1.552 2.320 score EM_ROLEX 0.595 1.309 2.068 0.618 # n=0 score ENGLISH_UCE_SUBJECT 0.953 1.542 2.569 2.899 # n=0 score EXCUSE_4 2.399 1.687 2.399 1.325 score EXCUSE_REMOVE 2.907 2.992 3.299 3.299 #score FAKE_HELO_MAIL_COM_DOM 1.887 0.152 1.370 2.136 score FAKE_OUTBLAZE_RCVD 0 # n=0 n=1 n=2 n=3 score FAKE_REPLY_C 0.688 0.001 2.553 1.486 # n=2 score FILL_THIS_FORM_FRAUD_PHISH 1.195 0.396 0.615 0.334 score FILL_THIS_FORM_LOAN 2.092 2.237 1.836 2.880 score FILL_THIS_FORM_LONG 3.800 3.476 2.300 3.404 score FIN_FREE 0.1 score FORGED_IMS_HTML 0 # n=0 n=1 n=2 n=3 score FORGED_IMS_TAGS 0 # n=0 n=1 n=2 n=3 score FORGED_MSGID_AOL 0 # n=0 n=1 n=2 n=3 score FORGED_MSGID_EXCITE 2.399 1.899 1.649 0.528 # n=0 score FORGED_MSGID_HOTMAIL 0 # n=0 n=1 n=2 n=3 score FORGED_MSGID_MSN 0 # n=0 n=1 n=2 n=3 score FORGED_MSGID_YAHOO 0.1 score FORGED_MUA_EUDORA 2.828 2.510 1.962 0.001 score FORGED_MUA_IMS 2.399 2.399 2.399 1.943 score FORGED_MUA_MOZILLA 2.399 1.596 2.399 2.309 score FORGED_MUA_OIMO 2.600 2.599 2.599 2.599 score FORGED_MUA_OUTLOOK 3.999 2.785 2.500 1.927 score FORGED_MUA_THEBAT_BOUN 3.046 3.220 3.207 3.399 score FORGED_MUA_THEBAT_CS 0 # n=0 n=1 n=2 n=3 score FORGED_OUTLOOK_HTML 0.001 0.001 0.001 0.021 score FORGED_OUTLOOK_TAGS 0.003 0.565 0.001 0.052 score FORGED_QUALCOMM_TAGS 0 # n=0 n=1 n=2 n=3 score FORGED_TELESP_RCVD 2.499 2.499 2.499 1.841 # n=0 score FORGED_THEBAT_HTML 0 # n=0 n=1 n=2 n=3 score FORWARD_LOOKING 0 # n=0 n=1 n=2 n=3 score FRAGMENTED_MESSAGE 0 # n=0 n=1 n=2 #FREEMAIL SCORES - Scores lowered per bug 6744 score FREEMAIL_FORGED_REPLYTO 1.199 2.503 1.204 2.095 score FREEMAIL_REPLY 1.0 score FREEMAIL_REPLYTO 1.0 score FREEMAIL_REPLYTO_END_DIGIT 0.25 score FREEMAIL_ENVFROM_END_DIGIT 0.25 score FREEMAIL_FROM 0.001 score FREE_PORN 0 # n=0 n=1 n=2 n=3 score FREE_QUOTE_INSTANT 2.700 2.699 2.699 1.297 # n=2 score FROM_BLANK_NAME 2.099 2.099 2.099 0.723 score FROM_DOMAIN_NOVOWEL 0.500 score FROM_EXCESS_BASE64 0.001 score FROM_LOCAL_DIGITS 0.001 score FROM_LOCAL_HEX 0.000 0.331 0.001 0.006 score FROM_LOCAL_NOVOWEL 0.500 score FROM_NO_USER 0.001 2.599 0.019 0.798 #score FROM_OFFERS 2.699 2.699 2.510 2.699 # defer to nightly GA rescorer per bug 6580 score FROM_STARTS_WITH_NUMS 2.801 0.553 1.201 0.738 score FSL_FAKE_HOTMAIL_RVCD 2.631 1.816 2.011 2.365 score FSL_HELO_BARE_IP_1 2.598 1.426 3.099 2.347 score FSL_HELO_DEVICE 0.1 score FSL_HELO_NON_FQDN_1 2.361 0.001 1.783 0.001 score FSL_HELO_SETUP 0 # n=0 n=1 n=2 score FSL_INTERIA_ABUSE 3.899 2.664 3.080 3.106 score GAPPY_SUBJECT 0.1 score GEO_QUERY_STRING 0 # n=0 n=1 n=2 n=3 score GUARANTEED_100_PERCENT 2.699 2.699 2.480 2.699 score HDR_ORDER_FTSDMCXX_001C 0 # n=0 n=1 n=2 n=3 score HDR_ORDER_FTSDMCXX_BAT 0 # n=0 n=1 n=2 n=3 score HEADER_SPAM 2.499 2.499 1.994 0.585 score HEAD_LONG 0 # n=0 n=1 n=2 score HELO_DYNAMIC_CHELLO_NL 2.412 1.918 2.019 2.428 score HELO_DYNAMIC_DHCP 2.602 0.841 1.537 0.206 score HELO_DYNAMIC_DIALIN 2.629 3.233 2.186 1.366 score HELO_DYNAMIC_HCC 4.299 2.514 2.931 2.762 score HELO_DYNAMIC_HEXIP 2.321 0.511 1.773 1.789 score HELO_DYNAMIC_HOME_NL 2.385 1.530 1.024 1.459 score HELO_DYNAMIC_IPADDR 2.633 3.243 3.680 1.951 score HELO_DYNAMIC_IPADDR2 2.815 3.888 3.728 3.607 score HELO_DYNAMIC_ROGERS 0 # n=0 n=1 n=2 n=3 score HELO_DYNAMIC_SPLIT_IP 3.031 2.893 4.225 3.482 score HELO_FRIEND 0 # n=0 n=1 n=2 n=3 score HELO_LH_HOME 0.001 2.023 0.537 1.736 # n=2 score HELO_LH_LD 0 # n=0 n=1 n=2 n=3 score HELO_LOCALHOST 2.639 3.603 2.915 3.828 # n=2 score HELO_OEM 2.899 2.899 1.234 0.270 # n=2 score HIDE_WIN_STATUS 0.001 score HIGH_CODEPAGE_URI 0 # n=0 n=1 n=2 # score HK_LOTTO 3.599 2.755 2.993 3.599 # Allow GA manage score score HK_NAME_DRUGS 4.299 0.001 3.077 0.552 # score HK_RANDOM_ENVFROM 2.638 0.626 1.798 0.001 # Allow GA manage score score HTML_MIME_NO_HTML_TAG 0.001 0.635 0.001 0.377 score HTML_MISSING_CTYPE 0 # n=0 n=1 n=2 n=3 score HTML_SHORT_CENTER 3.799 3.421 2.611 0.743 score HTML_SHORT_LINK_IMG_1 2.215 0.139 0.480 0.001 score HTML_SHORT_LINK_IMG_2 1.419 0.259 0.603 0.001 score HTML_SHORT_LINK_IMG_3 0.691 0.328 0.001 0.148 score HTML_TITLE_SUBJ_DIFF 1.149 2.171 1.801 2.036 score HTTP_77 0 # n=0 n=1 n=2 n=3 score HTTP_ESCAPED_HOST 0.1 score HTTP_EXCESSIVE_ESCAPES 0.001 score IMPOTENCE 1.539 2.144 3.028 1.374 score INVALID_DATE 1.701 0.432 1.200 1.096 score INVALID_DATE_TZ_ABSURD 0.262 0.632 0.706 0.491 score INVALID_MSGID 2.602 1.167 1.328 0.568 score INVALID_TZ_CST 0 # n=0 n=1 n=2 n=3 score INVALID_TZ_EST 0 # n=0 n=1 n=2 n=3 score INVESTMENT_ADVICE 0.1 score IP_LINK_PLUS 0.001 0.001 0.246 0.012 score JAPANESE_UCE_BODY 0 # n=0 n=1 n=2 n=3 score JAPANESE_UCE_SUBJECT 0 # n=0 n=1 n=2 n=3 score JM_I_FEEL_LUCKY 0 # n=0 n=1 n=2 score JM_RCVD_QMAILV1 0 # n=0 n=1 n=2 n=3 score JM_TORA_XM 0 # n=0 n=1 n=2 n=3 score JOIN_MILLIONS 0.1 score JS_FROMCHARCODE 0 # n=0 n=1 n=2 n=3 score KB_DATE_CONTAINS_TAB 3.800 3.799 3.799 2.751 score KB_FAKED_THE_BAT 2.432 3.441 2.008 2.694 score KB_RATWARE_MSGID 4.099 2.987 2.108 1.700 score KB_RATWARE_OUTLOOK_MID 4.400 4.400 2.503 1.499 score KOREAN_UCE_SUBJECT 0 # n=0 n=1 n=2 n=3 score LIVEFILESTORE 0.1 score LIVE_PORN 0 # n=0 n=1 n=2 n=3 score LONGWORDS 2.199 1.844 1.819 2.035 score LONG_TERM_PRICE 0.001 # n=0 n=1 n=2 n=3 score LOOPHOLE_1 0 # n=0 n=1 n=2 n=3 score LOTTERY_1 0.001 1.488 1.630 0.087 # n=2 score LOTTERY_PH_004470 0.1 score LOW_PRICE 0.1 score L_SPAM_TOOL_13 0.539 0.485 0.494 1.333 # n=2 score MALE_ENHANCE 3.100 3.099 3.099 0.851 score MARKETING_PARTNERS 0.553 0.235 0.689 0.001 score MID_DEGREES 0 # n=0 n=1 n=2 n=3 #score MILLION_USD 3.799 2.477 3.221 3.247 score MIME_BOUND_DD_DIGITS 3.016 0.349 2.417 1.373 score MIME_BOUND_DIGITS_15 0.1 score MIME_BOUND_EQ_REL 0 # n=0 n=1 n=2 n=3 score MIME_BOUND_MANY_HEX 0 # n=0 n=1 n=2 n=3 score MIME_HEADER_CTYPE_ONLY 0.1 score MIME_HTML_ONLY_MULTI 0.000 0.001 0.001 0.001 score MIME_PHP_NO_TEXT 2.800 2.799 2.799 2.799 score MISSING_DATE 2.739 1.396 1.800 1.360 # n=0 score MISSING_HB_SEP 0 # n=0 n=1 n=2 score MISSING_MID 0.552 0.140 1.199 0.497 # n=1 score MISSING_MIMEOLE 0.392 1.843 0.571 1.899 score MISSING_SUBJECT 0.001 1.767 1.300 1.799 score MONEY_BACK 2.910 2.486 0.601 1.232 score MORE_SEX 2.799 2.765 2.568 1.413 score MSGID_DOLLARS_RANDOM 0 # n=0 n=1 n=2 n=3 score MSGID_FROM_MTA_HEADER 0.401 0.001 0.473 0.001 score MSGID_RANDY 2.196 2.599 2.599 2.599 score MSGID_SHORT 0.001 0.337 0.001 0.001 score MSGID_SPAM_CAPS 2.366 1.997 3.099 3.099 score MSGID_SPAM_LETTERS 0 # n=0 n=1 n=2 n=3 score MSGID_YAHOO_CAPS 0.797 1.413 2.278 1.411 score MSOE_MID_WRONG_CASE 0.993 3.373 0.960 2.584 # n=2 score MULTI_FORGED 0 # n=0 n=1 n=2 n=3 #score NA_DOLLARS 3.599 score NONEXISTENT_CHARSET 0 # n=0 n=1 n=2 n=3 score NORMAL_HTTP_TO_IP 0.159 0.001 0.795 0.001 score NOT_ADVISOR 0 # n=0 n=1 n=2 n=3 score NO_MEDICAL 2.199 1.254 2.199 1.773 # n=0 score NO_PRESCRIPTION 1.915 1.102 2.280 2.399 score NULL_IN_BODY 0.511 0.498 2.056 1.596 # n=2 score NUMERIC_HTTP_ADDR 0.000 0.001 0.001 1.242 score OBFUSCATING_COMMENT 0.000 0.000 0.001 0.723 score OBSCURED_EMAIL 0 # n=0 n=1 n=2 n=3 score ONE_TIME 1.840 1.175 1.830 0.714 # n=0 score ONLINE_PHARMACY 0.843 2.371 0.008 0.650 score PERCENT_RANDOM 2.999 2.837 2.983 1.838 score PLING_QUERY 0.1 score PREST_NON_ACCREDITED 0 # n=0 n=1 n=2 n=3 score PREVENT_NONDELIVERY 0 # n=0 n=1 n=2 n=3 score PRICES_ARE_AFFORDABLE 0.794 0.851 1.112 0.551 score RATWARE_EGROUPS 1.898 1.258 1.406 1.621 score RATWARE_HASH_DASH 0 # n=0 n=1 n=2 n=3 score RATWARE_MOZ_MALFORMED 0 # n=0 n=1 n=2 n=3 score RATWARE_MPOP_WEBMAIL 1.153 1.338 1.229 1.999 # n=0 # jhardin 05/2021 # masscheck corpora thin or nonexistent, real world FPs reported - exposing to ruleqa for eval #score RATWARE_MS_HASH 2.036 3.692 0.454 2.148 score RATWARE_OE_MALFORMED 0 # n=0 n=1 n=2 n=3 # jhardin 05/2021 # masscheck corpora thin or nonexistent, real world FPs reported - exposing to ruleqa for eval #score RATWARE_OUTLOOK_NONAME 2.964 0.033 2.685 2.950 score RATWARE_RCVD_AT 0 # n=0 n=1 n=2 n=3 score RATWARE_RCVD_PF 0 # n=0 n=1 n=2 n=3 score RATWARE_ZERO_TZ 2.392 2.535 0.265 1.781 # n=0 score RCVD_AM_PM 0 # n=0 n=1 n=2 n=3 score RCVD_BAD_ID 0 # n=0 n=1 n=2 n=3 score RCVD_DOUBLE_IP_LOOSE 1.150 0.960 1.042 1.012 score RCVD_DOUBLE_IP_SPAM 2.411 2.777 1.912 1.808 score RCVD_FAKE_HELO_DOTCOM 2.799 2.389 2.605 1.189 score RCVD_FORGED_WROTE 0 # n=0 n=1 n=2 n=3 score RCVD_FORGED_WROTE2 0 # n=0 n=1 n=2 n=3 #score RCVD_IN_BRBL_LASTEXT 0 1.644 0 1.449 # n=0 n=2 score RCVD_IN_PSBL 0 2.700 0 2.700 # n=0 n=2 score RCVD_IN_VALIDITY_RPBL 0 1.284 0 1.310 # n=0 n=2 score RCVD_MAIL_COM 0 # n=0 n=1 n=2 n=3 score RDNS_DYNAMIC 2.639 0.363 1.663 0.982 score RDNS_LOCALHOST 3.700 0.969 2.345 0.001 score RDNS_NONE 2.399 1.274 1.228 0.793 score REFINANCE_NOW 0 # n=0 n=1 n=2 n=3 score REFINANCE_YOUR_HOME 0 # n=0 n=1 n=2 n=3 score REMOVE_BEFORE_LINK 0.1 score REPLICA_WATCH 3.487 3.164 4.074 3.775 score REPLYTO_WITHOUT_TO_CC 2.399 1.946 0.607 1.552 score REPTO_QUOTE_AOL 0 # n=0 n=1 n=2 n=3 score REPTO_QUOTE_IMS 0 # n=0 n=1 n=2 n=3 score REPTO_QUOTE_MSN 0 # n=0 n=1 n=2 n=3 score REPTO_QUOTE_QUALCOMM 0 # n=0 n=1 n=2 n=3 score REPTO_QUOTE_YAHOO 0.001 0.490 0.001 0.646 score RUDE_HTML 0 # n=0 n=1 n=2 n=3 score SB_GIF_AND_NO_URIS 2.199 2.199 2.200 2.199 # n=2 score SHORT_HELO_AND_INLINE_IMAGE 0.1 score SHORT_TERM_PRICE 0.001 # n=0 n=1 n=2 n=3 score SPAMMY_XMAILER 2.650 0.862 1.993 2.491 # n=2 score SPOOF_COM2COM 0.001 score SPOOF_COM2OTH 0.001 score SPOOF_NET2COM 0 # n=0 n=1 n=2 n=3 score STOCK_ALERT 0 # n=0 n=1 n=2 n=3 score STOCK_IMG_CTYPE 0.001 0.005 0.001 0.001 # n=2 score STOCK_IMG_HDR_FROM 0.001 0.001 0.001 0.021 # n=2 score STOCK_IMG_HTML 0.000 0.028 0.000 0.005 # n=2 score STOCK_IMG_OUTLOOK 0.001 0.702 0.413 0.190 # n=2 score STOCK_PRICES 0 # n=0 n=1 n=2 n=3 score STOX_AND_PRICE 0 # n=0 n=1 n=2 n=3 score STOX_REPLY_TYPE 1.898 0.212 0.141 0.439 # n=1 score STOX_REPLY_TYPE_WITHOUT_QUOTES 3.099 1.860 1.629 1.757 score STRONG_BUY 0 # n=0 n=1 n=2 n=3 score SUBJECT_DIET 1.927 1.563 0.817 1.466 score SUBJECT_DRUG_GAP_C 2.108 0.989 1.348 2.140 score SUBJECT_DRUG_GAP_L 2.799 2.304 1.402 1.561 score SUBJECT_DRUG_GAP_S 0 # n=0 n=1 n=2 n=3 #score SUBJECT_DRUG_GAP_VA 0 # n=0 n=1 n=2 n=3 score SUBJECT_DRUG_GAP_X 0 # n=0 n=1 n=2 n=3 score SUBJECT_NEEDS_ENCODING 0.498 0.100 0.804 0.049 # n=2 score SUBJECT_SEXUAL 0 # n=0 n=1 n=2 n=3 score SUBJ_AS_SEEN 2.711 3.099 3.099 1.461 # n=0 score SUBJ_BUY 0.594 1.498 0.001 0.639 score SUBJ_DOLLARS 0.1 #score SUBJ_YOUR_DEBT 3.299 3.045 1.199 0.987 score SUBJ_YOUR_FAMILY 2.910 2.999 2.999 2.999 score TBIRD_SUSP_MIME_BDRY 2.400 2.400 2.399 2.399 score THEBAT_UNREG 2.599 1.843 2.324 1.524 score TO_MALFORMED 0.1 score TRACKER_ID 0.1 score TT_MSGID_TRUNC 0.748 0.023 1.434 1.448 # n=2 score TT_OBSCURED_VALIUM 0 # n=0 n=1 n=2 n=3 score TT_OBSCURED_VIAGRA 0 # n=0 n=1 n=2 n=3 score TVD_ACT_193 0 # n=0 n=1 n=2 n=3 score TVD_DEAR_HOMEOWNER 0 # n=0 n=1 n=2 n=3 score TVD_EB_PHISH 0 # n=0 n=1 n=2 n=3 score TVD_ENVFROM_APOST 0 # n=0 n=1 n=2 n=3 score TVD_FINGER_02 0.001 score TVD_FLOAT_GENERAL 0 # n=0 n=1 n=2 n=3 score TVD_INCREASE_SIZE 1.529 0.601 1.055 0.001 # n=1 score TVD_LINK_SAVE 0 # n=0 n=1 n=2 n=3 score TVD_PH_BODY_ACCOUNTS_PRE 0.001 #changed to 0.001 due to .211 S/O on 2015-05-01 but left due to Meta Use - #1.201 1.527 1.327 2.393 # n=1 score TVD_PH_REC 0.1 score TVD_PH_SEC 0.1 score TVD_PP_PHISH 0 # n=0 n=1 n=2 n=3 score TVD_QUAL_MEDS 2.697 2.397 2.799 2.483 # n=2 score TVD_RATWARE_CB 0 # n=0 n=1 n=2 n=3 score TVD_RATWARE_CB_2 0 # n=0 n=1 n=2 n=3 score TVD_RATWARE_MSGID_02 0 # n=0 n=1 n=2 n=3 #score TVD_RCVD_SPACE_BRACKET 0.001 0.001 0.001 0.001 # n=1 score TVD_SECTION 0 # n=0 n=1 n=2 n=3 score TVD_SILLY_URI_OBFU 0 # n=0 n=1 n=2 n=3 score TVD_SPACED_SUBJECT_WORD3 0 # n=0 n=1 n=2 n=3 score TVD_SUBJ_ACC_NUM 0.1 score TVD_SUBJ_FINGER_03 0 # n=0 n=1 n=2 n=3 score TVD_SUBJ_OWE 0 # n=0 n=1 n=2 n=3 score TVD_SUBJ_WIPE_DEBT 2.599 2.291 2.599 1.004 # n=2 score TVD_VISIT_PHARMA 1.957 1.196 0.417 1.406 # n=2 score TVD_VIS_HIDDEN 0 # n=0 n=1 n=2 n=3 score UNCLAIMED_MONEY 2.699 2.699 2.699 2.427 score UNCLOSED_BRACKET 2.699 1.329 1.425 1.496 score UPPERCASE_50_75 0.001 0.791 0.001 0.008 score UPPERCASE_75_100 1.480 1.189 0.001 0.001 score URG_BIZ 1.750 0.941 0.568 0.573 score URI_NOVOWEL 0.500 #score URI_NO_WWW_BIZ_CGI 2.399 2.399 2.400 2.399 # n=0 #score URI_NO_WWW_INFO_CGI 2.299 2.299 0.292 2.071 #score URI_OBFU_WWW 3.099 3.099 2.306 2.475 score URI_UNSUBSCRIBE 0 # n=0 n=1 n=2 n=3 #score US_DOLLARS_3 2.599 2.523 1.780 1.754 score VIA_GAP_GRA 0 # n=0 n=1 n=2 n=3 score WEIRD_PORT 0.001 0.001 0.097 0.001 score WEIRD_QUOTING 0.001 0.001 0.001 0.001 score WITH_LC_SMTP 0 # n=0 n=1 n=2 n=3 score X_IP 0.001 0.001 0.001 0.001 score X_MAILER_CME_6543_MSN 2.886 2.004 3.002 3.348 score X_MESSAGE_INFO 0 # n=0 n=1 n=2 n=3 score X_PRIORITY_CC 0 # n=0 n=1 n=2 n=3 score YAHOO_DRS_REDIR 0 # n=0 n=1 n=2 n=3 score YAHOO_RD_REDIR 0 # n=0 n=1 n=2 n=3 # End of generated scores. </gen:mutable> # Bug 5700 - performing terribly 6/2019 #score URI_HEX 2.800 1.313 1.206 1.122 score URI_HEX 0.1 # Bug 6022, settle at informative score score TVD_RCVD_IP 0.001 score TVD_RCVD_IP4 0.001 # Bug 6280, 5690, settle at informative score score BAD_ENC_HEADER 0.001 ########################################################################### ifplugin Mail::SpamAssassin::Plugin::Shortcircuit score SHORTCIRCUIT 0 endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::AccessDB score ACCESSDB 0 endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::BodyEval # <gen:mutable> score BLANK_LINES_80_90 0 # n=0 n=1 n=2 n=3 score MPART_ALT_DIFF 2.246 0.724 0.595 0.790 score MPART_ALT_DIFF_COUNT 2.799 1.483 1.199 1.112 score TVD_STOCK1 0 # n=0 n=1 n=2 n=3 # </gen:mutable> score TVD_SPACE_RATIO 0.001 endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::HTMLEval # <gen:mutable> score HTML_COMMENT_SAVED_URL 0.198 0.357 0.899 1.391 score HTML_COMMENT_SHORT 0 # n=0 n=1 n=2 n=3 score HTML_EMBEDS 0.001 score HTML_EXTRA_CLOSE 0.001 score HTML_FONT_FACE_BAD 0.001 score HTML_FONT_LOW_CONTRAST 0.713 0.001 0.786 0.001 score HTML_FONT_SIZE_HUGE 0.001 score HTML_FONT_SIZE_LARGE 0.001 score HTML_FORMACTION_MAILTO 0 # n=0 n=1 n=2 n=3 score HTML_IFRAME_SRC 0 # n=0 n=1 n=2 n=3 score HTML_IMAGE_ONLY_04 1.680 0.342 1.799 1.172 score HTML_IMAGE_ONLY_08 0.585 1.781 1.845 1.651 score HTML_IMAGE_ONLY_12 1.381 1.629 1.400 2.059 score HTML_IMAGE_ONLY_16 1.969 1.048 1.199 1.092 score HTML_IMAGE_ONLY_20 2.109 0.700 1.300 1.546 score HTML_IMAGE_ONLY_24 2.799 1.282 1.328 1.618 score HTML_IMAGE_ONLY_28 2.799 0.726 1.512 1.404 score HTML_IMAGE_ONLY_32 2.196 0.001 1.172 0.001 score HTML_IMAGE_RATIO_02 0.001 score HTML_IMAGE_RATIO_04 0.001 score HTML_IMAGE_RATIO_06 0.001 0.001 0.001 0.001 score HTML_IMAGE_RATIO_08 0.001 0.001 0.001 0.001 score HTML_OBFUSCATE_05_10 0.601 0.001 0.718 0.260 score HTML_OBFUSCATE_10_20 0.174 1.162 0.588 0.093 score HTML_OBFUSCATE_20_30 2.499 2.441 1.449 1.999 score HTML_OBFUSCATE_30_40 0 # n=0 n=1 n=2 n=3 score HTML_OBFUSCATE_50_60 0 # n=0 n=1 n=2 n=3 score HTML_OBFUSCATE_70_80 0 # n=0 n=1 n=2 n=3 score HTML_OBFUSCATE_90_100 2.000 # n=0 n=1 n=2 n=3 - manually scored per list discussion score HTML_BADTAG_40_50 0 # n=0 n=1 n=2 n=3 score HTML_BADTAG_50_60 0 # n=0 n=1 n=2 n=3 score HTML_BADTAG_60_70 0 # n=0 n=1 n=2 n=3 score HTML_BADTAG_90_100 0 # n=0 n=1 n=2 n=3 score HTML_NONELEMENT_30_40 0.000 0.001 0.308 0.001 score HTML_NONELEMENT_40_50 0 # n=0 n=1 n=2 n=3 score HTML_NONELEMENT_60_70 0 # n=0 n=1 n=2 n=3 score HTML_NONELEMENT_80_90 0 # n=0 n=1 n=2 n=3 score HTML_TAG_BALANCE_BODY 0.1 score HTML_TAG_BALANCE_HEAD 0.520 0.000 0.600 0.817 score HTML_TAG_EXIST_BGSOUND 0 # n=0 n=1 n=2 n=3 # </gen:mutable> # HTML control test score HTML_MESSAGE 0.001 endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::DNSEval # <gen:mutable> score RCVD_IN_BL_SPAMCOP_NET 0 1.246 0 1.347 # n=0 n=2 score RCVD_IN_IADB_DK 0 -0.223 0 -0.095 # n=0 n=1 n=2 score RCVD_IN_IADB_DOPTIN_GT50 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_DOPTIN_LT50 0 -0.001 0 -0.001 # n=0 n=1 n=2 score RCVD_IN_IADB_EDDB 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_EPIA 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_GOODMAIL 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_LISTED 0 -0.380 0 -0.001 # n=0 n=2 score RCVD_IN_IADB_LOOSE 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_MI_CPEAR 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_MI_CPR_30 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_MI_CPR_MAT 0 -0.332 0 -0.000 # n=0 n=1 n=2 score RCVD_IN_IADB_NOCONTROL 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_OOO 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_OPTIN 0 -2.057 0 -1.470 # n=0 n=1 n=2 score RCVD_IN_IADB_OPTIN_GT50 0 -1.208 0 -0.007 # n=0 n=2 score RCVD_IN_IADB_OPTIN_LT50 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_OPTOUTONLY 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_RDNS 0 -0.167 0 -0.235 # n=0 n=1 n=2 score RCVD_IN_IADB_SENDERID 0 -0.001 0 -0.001 # n=0 n=2 score RCVD_IN_IADB_SPF 0 -0.001 0 -0.059 # n=0 n=2 score RCVD_IN_IADB_UNVERIFIED_1 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_UNVERIFIED_2 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_UT_CPEAR 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_UT_CPR_30 0 # n=0 n=1 n=2 n=3 score RCVD_IN_IADB_UT_CPR_MAT 0 -0.095 0 -0.001 # n=0 n=1 n=2 score RCVD_IN_SBL 0 2.596 0 0.141 # n=0 n=2 score RCVD_IN_SORBS_BLOCK 0 # n=0 n=1 n=2 n=3 score RCVD_IN_SORBS_DUL 0 0.001 0 0.001 # n=0 n=2 score RCVD_IN_SORBS_HTTP 0 2.499 0 0.001 # n=0 n=2 score RCVD_IN_SORBS_MISC 0 # n=0 n=1 n=2 n=3 score RCVD_IN_SORBS_SMTP 0 # n=0 n=1 n=2 n=3 score RCVD_IN_SORBS_SOCKS 0 2.443 0 1.927 # n=0 n=2 #score RCVD_IN_SORBS_SPAM 0 0.5 0 0.5 score RCVD_IN_SORBS_WEB 0 1.5 0 1.5 score RCVD_IN_SORBS_ZOMBIE 0 # n=0 n=1 n=2 n=3 score RCVD_IN_XBL 0 0.724 0 0.375 # n=0 n=2 score RCVD_IN_PBL 0 3.558 0 3.335 # n=0 n=2 score RCVD_IN_SBL_CSS 0 3.558 0 3.335 # n=0 n=2 score NO_DNS_FOR_FROM 0 0.379 0 0.001 # n=0 n=2 # </gen:mutable> score RCVD_IN_ZEN_BLOCKED_OPENDNS 0 0.001 0 0.001 score RCVD_IN_ZEN_BLOCKED 0 0.001 0 0.001 # Validity (née ReturnPath) Certified # https://www.validity.com/resource-center/fact-sheet-certification/ # CERTIFIED is a subset of SAFE, thus the score is cumulative. # -2 + -3 = -5 points for CERTIFIED score RCVD_IN_VALIDITY_CERTIFIED 0.0 -3.0 0.0 -3.0 score RCVD_IN_VALIDITY_SAFE 0.0 -2.0 0.0 -2.0 # DNSWL is a commercial service that requires payment for servers over 100K queries daily. # Unfortunately, they will return true answers for DNS servers they consider abusive so # SA Admins must enable these rules manually. # score RCVD_IN_DNSWL_NONE 0 -0.0001 0 -0.0001 score RCVD_IN_DNSWL_LOW 0 -0.7 0 -0.7 score RCVD_IN_DNSWL_MED 0 -2.3 0 -2.3 score RCVD_IN_DNSWL_HI 0 -5 0 -5 score RCVD_IN_DNSWL_BLOCKED 0 0.001 0 0.001 # IADB score RCVD_IN_IADB_VOUCHED 0 -2.2 0 -2.2 score RCVD_IN_IADB_DOPTIN 0 -4 0 -4 score RCVD_IN_IADB_ML_DOPTIN 0 -6 0 -6 # MAPS # MAPS is a commercial service. If you pay for these, assign a score # so they will be checked. score RCVD_IN_MAPS_RBL 0 score RCVD_IN_MAPS_DUL 0 score RCVD_IN_MAPS_RSS 0 score RCVD_IN_MAPS_OPS 0 score RCVD_IN_MAPS_NML 0 endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::HeaderEval # <gen:mutable> score DATE_IN_FUTURE_03_06 3.399 2.426 2.997 3.027 score DATE_IN_FUTURE_06_12 2.899 0.001 2.222 1.947 score DATE_IN_FUTURE_12_24 2.603 2.489 3.199 3.199 score DATE_IN_FUTURE_24_48 2.598 1.248 0.001 2.048 score DATE_IN_FUTURE_48_96 2.384 0.813 1.078 2.181 #score DATE_IN_FUTURE_96_XX 2.614 3.028 2.851 3.087 score DATE_IN_FUTURE_96_XX 0 score DATE_IN_PAST_03_06 2.399 1.076 1.200 1.592 score DATE_IN_PAST_06_12 1.699 1.103 1.274 1.543 score DATE_IN_PAST_12_24 0.001 0.804 1.190 1.049 score DATE_IN_PAST_24_48 1.109 0.485 0.624 1.340 score DATE_IN_PAST_96_XX 2.600 2.070 1.233 3.405 score FORGED_HOTMAIL_RCVD2 0.001 1.187 0.698 0.874 score FORGED_YAHOO_RCVD 2.397 1.022 2.599 1.630 score FROM_ILLEGAL_CHARS 2.192 2.059 0.240 0.036 score HEADER_COUNT_CTYPE 0 # n=0 n=1 n=2 n=3 score HEADER_COUNT_SUBJECT 0 # n=0 n=1 n=2 n=3 score HEAD_ILLEGAL_CHARS 0 # n=0 n=1 n=2 n=3 score LOCALPART_IN_SUBJECT 0.001 0.730 1.199 1.107 score MISSING_HEADERS 0.915 1.207 1.204 1.021 score MSGID_OUTLOOK_INVALID 3.899 score RATWARE_EFROM 0.1 score RATWARE_NAME_ID 3.099 0.309 3.099 0.247 # n=0 score SORTED_RECIPS 1.801 2.474 1.791 2.499 score SUBJ_ALL_CAPS 0.5 score SUBJ_ILLEGAL_CHARS 0.620 1.105 0.448 1.518 score SUSPICIOUS_RECIPS 2.499 2.497 2.139 2.510 score UNRESOLVED_TEMPLATE 3.035 0.716 2.424 1.252 # </gen:mutable> # ok_locales score CHARSET_FARAWAY_HEADER 3.200 endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::ImageInfo # <gen:mutable> score DC_GIF_UNO_LARGO 0.001 1.323 0.053 2.176 # n=2 score DC_IMAGE_SPAM_HTML 0.1 score DC_IMAGE_SPAM_TEXT 0.1 score DC_PNG_UNO_LARGO 0.001 # n=0 n=1 n=2 n=3 # </gen:mutable> endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::MIMEEval # <gen:mutable> score BASE64_LENGTH_78_79 0.1 score BASE64_LENGTH_79_INF 1.379 2.019 0.583 1.502 # n=2 score MIME_BAD_ISO_CHARSET 0 # n=0 n=1 n=2 n=3 #score MIME_BASE64_BLANKS 0.001 0.001 0.001 0.001 score MIME_BASE64_TEXT 0.001 0.001 0.001 1.741 score MIME_HTML_MOSTLY 0.1 score MIME_HTML_ONLY 0.1 score MISSING_MIME_HB_SEP 0.001 0.001 0.001 0.001 score MULTIPART_ALT_NON_TEXT 0 # n=0 n=1 n=2 n=3 # </gen:mutable> score MIME_QP_LONG_LINE 0.001 score MIMEPART_LIMIT_EXCEEDED 0.001 # ok_locales score CHARSET_FARAWAY 3.200 # we dare you # score HEAD_LONG 2.5 # score MISSING_HB_SEP 2.5 endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::RelayEval # <gen:mutable> score NO_RDNS_DOTCOM_HELO 3.100 0.433 3.099 0.823 score RCVD_HELO_IP_MISMATCH 1.680 1.186 2.362 2.368 # score RCVD_ILLEGAL_IP 3.399 score RCVD_ILLEGAL_IP 1.3 score RCVD_NUMERIC_HELO 0.001 0.865 0.001 1.164 # </gen:mutable> # Informational rules about Received header parsing score NO_RELAYS -0.001 score UNPARSEABLE_RELAY 0.001 score HELO_STATIC_HOST -0.001 # immutable (due to tflags userconf), see bug 5544 # score ALL_TRUSTED -1.360 -1.440 -1.665 -1.800 endif ########################################################################### ifplugin Mail::SpamAssassin::Plugin::URIEval # <gen:mutable> score HTTPS_IP_MISMATCH 0 # n=0 n=1 n=2 n=3 # </gen:mutable> score URI_TRUNCATED 0.001 endif ########################################################################### # Scores for tests that are scored manually or with isolated rescore runs. # Most are net tests, userconf tests, tests occuring with very low frequency, # or tests with many false positives. # GTUBE - Generic Test for Unsolicited Bulk Email score GTUBE 1000.000 # we dare you # score FRAGMENTED_MESSAGE 2.5 # score HIGH_CODEPAGE_URI 2.5 # make the Bayes scores unmutable (as discussed in bug 4505) ifplugin Mail::SpamAssassin::Plugin::Bayes score BAYES_00 0 0 -1.5 -1.9 score BAYES_05 0 0 -0.3 -0.5 score BAYES_20 0 0 -0.001 -0.001 score BAYES_40 0 0 -0.001 -0.001 score BAYES_50 0 0 2.0 0.8 score BAYES_60 0 0 2.5 1.5 score BAYES_80 0 0 2.7 2.0 score BAYES_95 0 0 3.2 3.0 score BAYES_99 0 0 3.8 3.5 score BAYES_999 0 0 0.2 0.2 endif # Informational rules about Received header parsing score NO_RECEIVED -0.001 # Informational rule, URI parsing encountered an overlong URI # Informational rule, typically means corrupt corpus/input score NO_HEADERS_MESSAGE 0.001 # ok_locales score HTML_CHARSET_FARAWAY 0.500 score MIME_CHARSET_FARAWAY 2.450 # rescore never changes the welcomelist/blocklist scores ifplugin Mail::SpamAssassin::Plugin::WLBLEval #score USER_IN_BLOCKLIST 100.000 - Moved to 60_welcomelist.cf #score USER_IN_WELCOMELIST -100.000 - Moved to 60_welcomelist.cf #score USER_IN_DEF_WELCOMELIST -15.000 - Moved to 60_welcomelist.cf #score USER_IN_BLOCKLIST_TO 10.000 - Moved to 60_welcomelist.cf #score URI_HOST_IN_BLOCKLIST 100.0 - Moved to 60_welcomelist.cf #score URI_HOST_IN_WELCOMELIST -100.0 - Moved to 60_welcomelist.cf #Removed in bug 7256 #score HEADER_HOST_IN_BLOCKLIST 100.0 #score HEADER_HOST_IN_WELCOMELIST -100.0 # not really false positives but the user wants spam! #score USER_IN_WELCOMELIST_TO -6.000 - Moved to 60_welcomelist.cf score USER_IN_MORE_SPAM_TO -20.000 score USER_IN_ALL_SPAM_TO -100.000 endif ifplugin Mail::SpamAssassin::Plugin::SPF score USER_IN_SPF_WELCOMELIST -100 # overridden in 60_welcomelist_spf.cf score USER_IN_SPF_WHITELIST -100 # overridden in 60_welcomelist_spf.cf score USER_IN_DEF_SPF_WL -7.500 score ENV_AND_HDR_SPF_MATCH -0.5 endif # Mail::SpamAssassin::Plugin::SPF # DKIM ifplugin Mail::SpamAssassin::Plugin::DKIM score USER_IN_DKIM_WELCOMELIST -100 # overridden in 60_welcomelist_dkim.cf score USER_IN_DKIM_WHITELIST -100 # overridden in 60_welcomelist_dkim.cf score USER_IN_DEF_DKIM_WL -7.500 score DKIM_SIGNED 0.1 score DKIM_VALID -0.1 score DKIM_INVALID 0.1 score DKIM_VALID_AU -0.1 if (version >= 3.004002) score DKIM_VALID_EF -0.1 endif if can(Mail::SpamAssassin::Plugin::DKIM::has_arc) score ARC_SIGNED 0.001 score ARC_VALID -0.1 score ARC_INVALID 0.1 endif score DKIM_VERIFIED 0 score DKIM_POLICY_SIGNALL 0 score DKIM_POLICY_SIGNSOME 0 score DKIM_POLICY_TESTING 0 score DKIM_ADSP_CUSTOM_LOW 0.001 score DKIM_ADSP_CUSTOM_MED 0.001 score DKIM_ADSP_CUSTOM_HIGH 0.001 score NML_ADSP_CUSTOM_LOW 0 0.7 0 0.7 score NML_ADSP_CUSTOM_MED 0 1.2 0 0.9 score NML_ADSP_CUSTOM_HIGH 0 2.6 0 2.5 # <gen:mutable> score DKIM_ADSP_ALL 0 1.1 0 0.8 score DKIM_ADSP_DISCARD 0 1.8 0 1.8 score DKIM_ADSP_NXDOMAIN 0 0.8 0 0.9 # </gen:mutable> endif # Mail::SpamAssassin::Plugin::DKIM ifplugin Mail::SpamAssassin::Plugin::AskDNS # <gen:mutable> score DKIMDOMAIN_IN_DWL 0 -3.5 0 -3.5 score DKIMDOMAIN_IN_DWL_UNKNOWN 0 -0.01 0 -0.01 # </gen:mutable> endif # SPF # Note that the benefit for a valid SPF record is deliberately minimal; it's # likely that more spammers would quickly move to setting valid SPF records # otherwise. The penalties for an *incorrect* record, however, are large. ;) ifplugin Mail::SpamAssassin::Plugin::SPF score SPF_NONE 0.001 score SPF_HELO_NONE 0.001 score SPF_PASS -0.001 score SPF_HELO_PASS -0.001 # <gen:mutable> score SPF_FAIL 0 0.919 0 0.001 # n=0 n=2 score SPF_HELO_FAIL 0 0.001 0 0.001 # n=0 n=2 score SPF_HELO_NEUTRAL 0 0.001 0 0.112 # n=0 n=2 score SPF_HELO_SOFTFAIL 0 0.896 0 0.732 # n=0 n=2 score SPF_NEUTRAL 0 0.652 0 0.779 # n=0 n=2 score SPF_SOFTFAIL 0 0.972 0 0.665 # n=0 n=2 # </gen:mutable> endif # Mail::SpamAssassin::Plugin::SPF # DMARC ifplugin Mail::SpamAssassin::Plugin::DMARC score DMARC_PASS -0.001 # <gen:mutable> score DMARC_REJECT 0.001 1.797 0.001 1.797 # n=0 n=2 score DMARC_QUAR 0.001 1.198 0.001 1.198 # n=0 n=2 score DMARC_NONE 0.001 0.898 0.001 0.898 # n=0 n=2 # </gen:mutable> score DMARC_MISSING 0.001 endif # Mail::SpamAssassin::Plugin::DMARC # URIDNSBL ifplugin Mail::SpamAssassin::Plugin::URIDNSBL # <gen:mutable> #score URIBL_AB_SURBL 0 4.499 0 4.499 # n=0 n=2 - removed bug 7279 #Changed below from JP to Abuse - bug 7279 score URIBL_ABUSE_SURBL 0 1.948 0 1.250 # n=0 n=2 score URIBL_PH_SURBL 0 0.001 0 0.610 # n=0 n=2 score URIBL_RHS_DOB 0 0.276 0 1.514 # n=0 n=2 score URIBL_SBL 0 0.644 0 1.623 # n=0 n=2 score URIBL_CSS 0 0.1 0 0.1 score URIBL_SBL_A 0 0.1 0 0.1 score URIBL_CSS_A 0 0.1 0 0.1 #score URIBL_SC_SURBL 0 0.001 0 0.568 # n=0 n=2 - removed bug 7279 #score URIBL_WS_SURBL 0 1.659 0 1.608 # n=0 n=2 - Removed bug 8093 score URIBL_MW_SURBL 0 1.263 0 1.263 score URIBL_CR_SURBL 0 1.263 0 1.263 score URIBL_BLACK 0 1.7 0 1.7 # n=0 n=2 score URIBL_GREY 0 1.084 0 0.424 # n=0 n=2 score URIBL_DBL_SPAM 0 2.5 0 2.5 score URIBL_DBL_PHISH 0 2.5 0 2.5 score URIBL_DBL_MALWARE 0 2.5 0 2.5 score URIBL_DBL_BOTNETCC 0 2.5 0 2.5 score URIBL_DBL_ABUSE_SPAM 0 2.0 0 2.0 score URIBL_DBL_ABUSE_REDIR 0 0.001 0 0.001 score URIBL_DBL_ABUSE_PHISH 0 2.5 0 2.5 score URIBL_DBL_ABUSE_MALW 0 2.5 0 2.5 score URIBL_DBL_ABUSE_BOTCC 0 2.5 0 2.5 # </gen:mutable> # score URIBL_GREY 0.25 score URIBL_RED 0 0.001 0 0.001 score URIBL_BLOCKED 0 0.001 0 0.001 score URIBL_DBL_ERROR 0 0.001 0 0.001 score URIBL_ZEN_BLOCKED_OPENDNS 0 0.001 0 0.001 score URIBL_ZEN_BLOCKED 0 0.001 0 0.001 score URIBL_DBL_BLOCKED_OPENDNS 0 0.001 0 0.001 score URIBL_DBL_BLOCKED 0 0.001 0 0.001 endif # Mail::SpamAssassin::Plugin::URIDNSBL # ReplaceTags ifplugin Mail::SpamAssassin::Plugin::ReplaceTags # <gen:mutable> score FUZZY_AFFORDABLE 0 # n=0 n=1 n=2 n=3 #score FUZZY_AMBIEN 0.1 score FUZZY_BILLION 0 # n=0 n=1 n=2 n=3 score FUZZY_CPILL 0.001 0.001 0.001 0.001 score FUZZY_CREDIT 1.699 1.413 0.601 1.678 #score FUZZY_ERECT 0.1 score FUZZY_GUARANTEE 0 # n=0 n=1 n=2 n=3 score FUZZY_MEDICATION 0 # n=0 n=1 n=2 n=3 score FUZZY_MERIDIA 0 # n=0 n=1 n=2 n=3 score FUZZY_MILLION 0.1 score FUZZY_MONEY 0 # n=0 n=1 n=2 n=3 score FUZZY_MORTGAGE 0 # n=0 n=1 n=2 n=3 score FUZZY_OBLIGATION 0 # n=0 n=1 n=2 n=3 score FUZZY_OFFERS 0 # n=0 n=1 n=2 n=3 score FUZZY_PHARMACY 2.960 3.299 1.967 1.353 score FUZZY_PHENT 2.799 1.647 1.540 2.662 # n=0 score FUZZY_PRESCRIPT 0 # n=0 n=1 n=2 n=3 score FUZZY_PRICES 1.821 0.720 2.210 2.311 score FUZZY_REFINANCE 0 # n=0 n=1 n=2 n=3 score FUZZY_REMOVE 0 # n=0 n=1 n=2 n=3 #score FUZZY_ROLEX 0.1 score FUZZY_SOFTWARE 0 # n=0 n=1 n=2 n=3 score FUZZY_THOUSANDS 0 # n=0 n=1 n=2 n=3 score FUZZY_VLIUM 0 # n=0 n=1 n=2 n=3 score FUZZY_VIOXX 0 # n=0 n=1 n=2 n=3 score FUZZY_VPILL 0.001 0.494 0.796 1.014 score FUZZY_XPILL 0.1 score SUBJECT_FUZZY_CHEAP 0.641 1.831 0.833 0.001 # n=0 score SUBJECT_FUZZY_MEDS 0 # n=0 n=1 n=2 n=3 score SUBJECT_FUZZY_PENIS 0 # n=0 n=1 n=2 n=3 score SUBJECT_FUZZY_TION 0 # n=0 n=1 n=2 n=3 score SUBJECT_FUZZY_VPILL 0 # n=0 n=1 n=2 n=3 score TVD_FUZZY_DEGREE 0 # n=0 n=1 n=2 n=3 score TVD_FUZZY_FINANCE 0 # n=0 n=1 n=2 n=3 score TVD_FUZZY_FIXED_RATE 0 # n=0 n=1 n=2 n=3 score TVD_FUZZY_MICROCAP 0 # n=0 n=1 n=2 n=3 score TVD_FUZZY_PHARMACEUTICAL 0 # n=0 n=1 n=2 n=3 score TVD_FUZZY_SYMBOL 0 # n=0 n=1 n=2 n=3 # </gen:mutable> endif # Mail::SpamAssassin::Plugin::ReplaceTags # DCC ifplugin Mail::SpamAssassin::Plugin::DCC score DCC_CHECK 0 1.1 0 1.1 score DCC_REPUT_00_12 0 -0.8 0 -0.4 score DCC_REPUT_13_19 0 -0.1 0 -0.1 score DCC_REPUT_70_89 0 0.1 0 0.1 score DCC_REPUT_90_94 0 0.4 0 0.6 score DCC_REPUT_95_98 0 0.7 0 1.0 score DCC_REPUT_99_100 0 1.2 0 1.4 endif # Mail::SpamAssassin::Plugin::DCC # Pyzor ifplugin Mail::SpamAssassin::Plugin::Pyzor # <gen:mutable> score PYZOR_CHECK 0 1.985 0 1.392 # n=0 n=2 # </gen:mutable> endif # Mail::SpamAssassin::Plugin::Pyzor # Razor2 ifplugin Mail::SpamAssassin::Plugin::Razor2 # <gen:mutable> score RAZOR2_CHECK 0 1.729 0 0.922 # n=0 n=2 score RAZOR2_CF_RANGE_51_100 0 2.430 0 1.886 # n=0 n=2 # </gen:mutable> endif # Mail::SpamAssassin::Plugin::Razor2 # TextCat ifplugin Mail::SpamAssassin::Plugin::TextCat score UNWANTED_LANGUAGE_BODY 2.800 score BODY_8BITS 1.500 endif # Mail::SpamAssassin::Plugin::TextCat # AntiVirus ifplugin Mail::SpamAssassin::Plugin::AntiVirus score MICROSOFT_EXECUTABLE 0.1 score MIME_SUSPECT_NAME 0.1 endif # Mail::SpamAssassin::Plugin::AntiVirus # VBounce - anti-bounce message ruleset. All of these are informational, # and should not be scored as antispam rules; instead the user needs # to detect messages that hit ANY_BOUNCE_MESSAGE, and filter them aside # as spurious bounces. # ifplugin Mail::SpamAssassin::Plugin::VBounce score BOUNCE_MESSAGE 0.1 score CRBOUNCE_MESSAGE 0.1 score VBOUNCE_MESSAGE 0.1 score OOOBOUNCE_MESSAGE 0.1 score ANY_BOUNCE_MESSAGE 0.1 endif # Mail::SpamAssassin::Plugin::VBounce # another informational rule: this is for C/R responses to mail the user # really did sent -- the opposite of CRBOUNCE_MESSAGE. some users might # like to block all C/R bounces, or filter them separately. # score CHALLENGE_RESPONSE 0.1 # It's still quite common for non-spam senders to send mail from hosts with # no rDNS, or "dynamic-looking" rDNS. Lock these down to low values; # some sites can increase them as a matter of local policy, and they # make great fodder for meta rules, too. # # score RDNS_NONE 0 1.1 0 0.7 # score RDNS_DYNAMIC 0 0.5 0 0.5 ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # <gen:mutable> score CTYPE_8SPACE_GIF 0 # n=0 n=1 n=2 n=3 # </gen:mutable> endif ifplugin Mail::SpamAssassin::Plugin::HTTPSMismatch # <gen:mutable> score HTTPS_HTTP_MISMATCH 0.1 # </gen:mutable> endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # <gen:mutable> score PART_CID_STOCK 0.001 0.001 0.001 0.000 # n=2 # </gen:mutable> endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # <gen:mutable> score PART_CID_STOCK_LESS 0.000 0.036 0.745 0.894 # n=2 # </gen:mutable> endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # <gen:mutable> score TVD_FW_GRAPHIC_NAME_LONG 0.001 0.648 0.836 1.293 # n=2 # </gen:mutable> endif ifplugin Mail::SpamAssassin::Plugin::MIMEHeader # <gen:mutable> score TVD_FW_GRAPHIC_NAME_MID 0.600 0.001 0.389 0.095 # n=2 # </gen:mutable> endif # Bug 6155 c115 score KB_RATWARE_OUTLOOK_08 0 score KB_RATWARE_OUTLOOK_12 0 score KB_RATWARE_OUTLOOK_16 0 score KB_RATWARE_BOUNDARY 0 # MAILSPIKE RBL ENABLED FOR SA3.4 and above - BUG 6400 if (version >= 3.004000) # FLOATING SCORES FOR GA - adjust after GA to make L3 - L5 linear # Probably adjust up slightly to make up for the "reuse" imperfection # <gen:mutable> score RCVD_IN_MSPIKE_ZBI 2.7 score RCVD_IN_MSPIKE_L5 2.5 score RCVD_IN_MSPIKE_L4 1.7 score RCVD_IN_MSPIKE_L3 0.9 # </gen:mutable> # FIXED SCORES # TEMPORARILY LOWERED - adjust these higher after GA is done # (pending discussion: Welcomelists need scores, but they shouldn't effect the scoring of spam detection rules.) score RCVD_IN_MSPIKE_H3 -0.01 score RCVD_IN_MSPIKE_H4 -0.01 score RCVD_IN_MSPIKE_H5 -1.0 # FIXED SCORES - informational rules, useful only for statistical comparisons score RCVD_IN_MSPIKE_BL 0.01 score RCVD_IN_MSPIKE_WL -0.01 endif PK SI�\��(jg jg . 3.004004/updates_spamassassin_org/72_scores.cfnu �[��� score ACCT_PHISHING_MANY 1.000 1.000 1.000 1.000 score AC_BR_BONANZA 0.001 0.001 0.001 0.001 score AC_DIV_BONANZA 0.001 0.001 0.001 0.001 score AC_FROM_MANY_DOTS 2.999 2.790 2.999 2.790 score AC_HTML_NONSENSE_TAGS 1.999 1.999 1.999 1.999 score AC_POST_EXTRAS 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS1 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS10 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS11 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS12 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS2 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS3 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS4 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS8 1.000 1.000 1.000 1.000 score AC_SPAMMY_URI_PATTERNS9 1.000 1.000 1.000 1.000 score ADMITS_SPAM 2.199 1.773 2.199 1.773 score ADULT_DATING_COMPANY 10.000 10.000 10.000 10.000 score ADVANCE_FEE_2_NEW_FORM 1.000 1.000 1.000 1.000 score ADVANCE_FEE_2_NEW_FRM_MNY 1.791 1.953 1.791 1.953 score ADVANCE_FEE_2_NEW_MONEY 2.000 1.999 2.000 1.999 score ADVANCE_FEE_3_NEW 3.499 3.499 3.499 3.499 score ADVANCE_FEE_3_NEW_MONEY 2.599 2.297 2.599 2.297 score ADVANCE_FEE_4_NEW 2.699 2.399 2.699 2.399 score ADVANCE_FEE_4_NEW_FRM_MNY 1.253 0.001 1.253 0.001 score ADVANCE_FEE_4_NEW_MONEY 1.963 2.463 1.963 2.463 score ADVANCE_FEE_5_NEW 2.299 1.293 2.299 1.293 score ADVANCE_FEE_5_NEW_FRM_MNY 0.001 0.001 0.001 0.001 score ADVANCE_FEE_5_NEW_MONEY 0.001 0.001 0.001 0.001 score AD_PREFS 0.467 0.499 0.467 0.499 score ALIBABA_IMG_NOT_RCVD_ALI 1.000 1.000 1.000 1.000 score AMAZON_IMG_NOT_RCVD_AMZN 0.001 0.001 0.001 0.001 score APP_DEVELOPMENT_FREEM 1.000 1.000 1.000 1.000 score APP_DEVELOPMENT_NORDNS 1.000 1.000 1.000 1.000 score ARC_SIGNED 0.001 0.001 0.001 0.001 score ARC_VALID 0.001 0.001 0.001 0.001 score AXB_XMAILER_MIMEOLE_OL_024C2 0.001 0.001 0.001 0.001 score AXB_X_FF_SEZ_S 3.100 0.754 3.100 0.754 score BEBEE_IMG_NOT_RCVD_BB 1.000 1.000 1.000 1.000 score BIGNUM_EMAILS_FREEM 2.249 2.438 2.249 2.438 score BIGNUM_EMAILS_MANY 1.000 1.000 1.000 1.000 score BITCOIN_BOMB 1.000 1.000 1.000 1.000 score BITCOIN_DEADLINE 1.500 0.001 1.500 0.001 score BITCOIN_EXTORT_01 4.250 0.001 4.250 0.001 score BITCOIN_EXTORT_02 1.000 1.000 1.000 1.000 score BITCOIN_IMGUR 1.000 1.000 1.000 1.000 score BITCOIN_MALF_HTML 3.499 3.499 3.499 3.499 score BITCOIN_MALWARE 2.462 2.083 2.462 2.083 score BITCOIN_OBFU_SUBJ 3.142 1.000 3.142 1.000 score BITCOIN_ONAN 1.000 1.000 1.000 1.000 score BITCOIN_PAY_ME 1.000 1.000 1.000 1.000 score BITCOIN_SPAM_01 1.000 1.000 1.000 1.000 score BITCOIN_SPAM_02 2.100 1.519 2.100 1.519 score BITCOIN_SPAM_03 1.000 1.000 1.000 1.000 score BITCOIN_SPAM_04 1.000 1.000 1.000 1.000 score BITCOIN_SPAM_05 0.001 2.499 0.001 2.499 score BITCOIN_SPAM_06 1.000 1.000 1.000 1.000 score BITCOIN_SPAM_07 1.000 1.000 1.000 1.000 score BITCOIN_SPAM_08 1.000 1.000 1.000 1.000 score BITCOIN_SPAM_09 1.499 1.499 1.499 1.499 score BITCOIN_SPAM_10 1.000 1.000 1.000 1.000 score BITCOIN_SPAM_11 1.000 1.000 1.000 1.000 score BITCOIN_SPAM_12 1.000 1.000 1.000 1.000 score BITCOIN_SPF_ONLYALL 0.001 1.000 0.001 1.000 score BITCOIN_XPRIO 1.640 1.494 1.640 1.494 score BITCOIN_YOUR_INFO 2.999 2.999 2.999 2.999 score BODY_URI_ONLY 1.406 2.131 1.406 2.131 score BOGUS_MIME_VERSION 1.000 1.000 1.000 1.000 score BOGUS_MSM_HDRS 1.000 1.000 1.000 1.000 score BOMB_FREEM 1.000 1.000 1.000 1.000 score BOMB_MONEY 1.000 1.000 1.000 1.000 score BTC_ORG 1.000 1.000 1.000 1.000 score BULK_RE_SUSP_NTLD 1.000 1.000 1.000 1.000 score CANT_SEE_AD 1.000 1.000 1.000 1.000 score CK_HELO_GENERIC 0.249 0.001 0.249 0.001 score COMMENT_GIBBERISH 1.000 1.000 1.000 1.000 score CONTENT_AFTER_HTML 1.000 1.000 1.000 1.000 score CONTENT_AFTER_HTML_WEAK 1.499 1.499 1.499 1.499 score CTE_8BIT_MISMATCH 0.999 0.001 0.999 0.001 score DAY_I_EARNED 1.000 1.000 1.000 1.000 score DEAR_BENEFICIARY 2.999 0.001 2.999 0.001 score DKIMWL_BL 0.001 1.000 0.001 1.000 score DKIMWL_BLOCKED 0.001 0.001 0.001 0.001 score DKIMWL_WL_HIGH 0.001 -0.001 0.001 -0.001 score DKIMWL_WL_MED 0.001 -0.001 0.001 -0.001 score DKIMWL_WL_MEDHI 0.001 -0.001 0.001 -0.001 score DOTGOV_IMAGE 1.000 1.000 1.000 1.000 score DX_TEXT_03 1.699 1.699 1.699 1.699 score DYNAMIC_IMGUR 1.000 1.000 1.000 1.000 score EBAY_IMG_NOT_RCVD_EBAY 1.000 1.000 1.000 1.000 score ENCRYPTED_MESSAGE -0.999 -0.999 -0.999 -0.999 score END_FUTURE_EMAILS 2.500 2.499 2.500 2.499 score ENVFROM_GOOG_TRIX 1.000 1.000 1.000 1.000 score FACEBOOK_IMG_NOT_RCVD_FB 1.000 1.000 1.000 1.000 score FBI_MONEY 1.000 1.000 1.000 1.000 score FBI_SPOOF 1.000 1.000 1.000 1.000 score FILL_THIS_FORM 0.001 0.001 0.001 0.001 score FONT_INVIS_DIRECT 0.001 0.001 0.001 0.001 score FONT_INVIS_DOTGOV 1.000 1.000 1.000 1.000 score FONT_INVIS_HTML_NOHTML 1.000 1.000 1.000 1.000 score FONT_INVIS_LONG_LINE 3.000 2.087 3.000 2.087 score FONT_INVIS_MSGID 1.969 0.950 1.969 0.950 score FONT_INVIS_NORDNS 1.000 1.000 1.000 1.000 score FONT_INVIS_POSTEXTRAS 0.001 0.842 0.001 0.842 score FORM_FRAUD 0.999 1.000 0.999 1.000 score FORM_FRAUD_3 2.699 0.001 2.699 0.001 score FORM_FRAUD_5 0.001 0.001 0.001 0.001 score FOUND_YOU 1.000 1.000 1.000 1.000 score FREEMAIL_FORGED_FROMDOMAIN 0.249 0.250 0.249 0.250 score FREEM_FRNUM_UNICD_EMPTY 1.000 1.000 1.000 1.000 score FRNAME_IN_MSG_XPRIO_NO_SUB 1.000 1.000 1.000 1.000 score FROM_2_EMAILS_SHORT 2.808 2.446 2.808 2.446 score FROM_ADDR_WS 3.000 2.951 3.000 2.951 score FROM_BANK_NOAUTH 0.001 1.000 0.001 1.000 score FROM_FMBLA_NDBLOCKED 0.001 0.001 0.001 0.001 score FROM_FMBLA_NEWDOM 0.001 1.000 0.001 1.000 score FROM_FMBLA_NEWDOM14 0.001 0.001 0.001 0.001 score FROM_FMBLA_NEWDOM28 0.001 0.799 0.001 0.799 score FROM_GOV_DKIM_AU 0.001 -0.867 0.001 -0.867 score FROM_GOV_REPLYTO_FREEMAIL 0.001 1.000 0.001 1.000 score FROM_GOV_SPOOF 0.001 1.000 0.001 1.000 score FROM_MISSP_EH_MATCH 1.999 1.999 1.999 1.999 score FROM_MISSP_SPF_FAIL 0.001 0.001 0.001 0.001 score FROM_NEWDOM_BTC 0.001 1.000 0.001 1.000 score FROM_NTLD_LINKBAIT 1.000 1.000 1.000 1.000 score FROM_NTLD_REPLY_FREEMAIL 1.000 1.000 1.000 1.000 score FROM_NUMBERO_NEWDOMAIN 0.001 1.000 0.001 1.000 score FROM_PAYPAL_SPOOF 0.001 0.575 0.001 0.575 score FROM_SUSPICIOUS_NTLD 0.499 0.463 0.499 0.463 score FROM_SUSPICIOUS_NTLD_FP 1.999 1.999 1.999 1.999 score FROM_UNBAL1 2.299 0.001 2.299 0.001 score FSL_BULK_SIG 0.001 0.001 0.001 0.001 score FSL_NEW_HELO_USER 0.001 0.001 0.001 0.001 score FUZZY_AMAZON 0.001 0.001 0.001 0.001 score FUZZY_IMPORTANT 3.799 3.467 3.799 3.467 score FUZZY_WALLET 1.794 0.001 1.794 0.001 score GAPPY_SALES_LEADS_FREEM 1.000 1.000 1.000 1.000 score GB_BITCOIN_CP 1.859 2.205 1.859 2.205 score GB_BITCOIN_NH 1.000 0.001 1.000 0.001 score GB_CUSTOM_HTM_URI 1.500 0.049 1.500 0.049 score GB_FAKE_RF_SHORT 1.000 1.000 1.000 1.000 score GB_FORGED_MUA_POSTFIX 1.000 1.000 1.000 1.000 score GB_FREEMAIL_DISPTO 0.001 0.001 0.001 0.001 score GB_FREEMAIL_DISPTO_NOTFREEM 0.500 0.500 0.500 0.500 score GB_GOOGLE_OBFUR 0.750 0.750 0.750 0.750 score GB_HASHBL_BTC 0.001 1.090 0.001 1.090 score GB_STORAGE_GOOGLE_EMAIL 1.000 1.000 1.000 1.000 score GB_URI_FLEEK_STO_HTM 1.000 1.000 1.000 1.000 score GOOGLE_DOCS_PHISH 1.000 1.000 1.000 1.000 score GOOGLE_DOCS_PHISH_MANY 1.000 1.000 1.000 1.000 score GOOGLE_DOC_SUSP 1.000 1.000 1.000 1.000 score GOOGLE_DRIVE_REPLY_BAD_NTLD 1.000 1.000 1.000 1.000 score GOOG_MALWARE_DNLD 1.000 1.000 1.000 1.000 score GOOG_REDIR_NORDNS 2.602 2.900 2.602 2.900 score GOOG_STO_EMAIL_PHISH 1.000 1.000 1.000 1.000 score GOOG_STO_HTML_PHISH 1.000 1.000 1.000 1.000 score GOOG_STO_HTML_PHISH_MANY 1.000 1.000 1.000 1.000 score GOOG_STO_IMG_HTML 1.846 1.000 1.846 1.000 score GOOG_STO_IMG_NOHTML 1.000 1.000 1.000 1.000 score GOOG_STO_NOIMG_HTML 2.999 2.950 2.999 2.950 score HAS_X_NO_RELAY 1.000 1.000 1.000 1.000 score HAS_X_OUTGOING_SPAM_STAT 0.489 0.001 0.489 0.001 score HDRS_LCASE_IMGONLY 0.099 0.099 0.099 0.099 score HDRS_MISSP 2.499 2.499 2.499 2.499 score HDR_ORDER_FTSDMCXX_DIRECT 1.999 0.001 1.999 0.001 score HDR_ORDER_FTSDMCXX_NORDNS 0.001 0.001 0.001 0.001 score HEADER_FROM_DIFFERENT_DOMAINS 0.250 0.249 0.250 0.249 score HELO_MISC_IP 0.250 0.001 0.250 0.001 score HELO_NO_DOMAIN 0.001 0.001 0.001 0.001 score HEXHASH_WORD 1.000 1.000 1.000 1.000 score HK_CTE_RAW 1.000 1.000 1.000 1.000 score HK_LOTTO 0.999 0.999 0.999 0.999 score HK_RANDOM_ENVFROM 1.000 0.001 1.000 0.001 score HK_RANDOM_FROM 0.999 0.635 0.999 0.635 score HK_RANDOM_REPLYTO 0.999 0.999 0.999 0.999 score HK_RCVD_IP_MULTICAST 1.000 1.000 1.000 1.000 score HK_SCAM 1.999 1.999 1.999 1.999 score HK_WIN 1.000 0.001 1.000 0.001 score HOSTED_IMG_DIRECT_MX 0.001 0.001 0.001 0.001 score HOSTED_IMG_DQ_UNSUB 1.000 1.000 1.000 1.000 score HOSTED_IMG_FREEM 3.499 1.416 3.499 1.416 score HOSTED_IMG_MULTI 1.000 1.000 1.000 1.000 score HOSTED_IMG_MULTI_PUB_01 2.999 2.999 2.999 2.999 score HTML_ENTITY_ASCII 2.999 2.999 2.999 2.999 score HTML_ENTITY_ASCII_TINY 1.000 1.000 1.000 1.000 score HTML_FONT_TINY_NORDNS 1.885 0.001 1.885 0.001 score HTML_OFF_PAGE 2.497 0.001 2.497 0.001 score HTML_SHRT_CMNT_OBFU_MANY 1.000 1.000 1.000 1.000 score HTML_SINGLET_MANY 2.499 1.000 2.499 1.000 score HTML_TAG_BALANCE_CENTER 2.782 3.599 2.782 3.599 score HTML_TEXT_INVISIBLE_FONT 1.401 0.369 1.401 0.369 score HTML_TEXT_INVISIBLE_STYLE 2.298 1.725 2.298 1.725 score IMG_ONLY_FM_DOM_INFO 1.000 1.000 1.000 1.000 score JH_SPAMMY_HEADERS 3.499 3.499 3.499 3.499 score JH_SPAMMY_PATTERN01 1.000 1.000 1.000 1.000 score JH_SPAMMY_PATTERN02 1.000 1.000 1.000 1.000 score KHOP_HELO_FCRDNS 0.400 0.001 0.400 0.001 score LINKEDIN_IMG_NOT_RCVD_LNKN 1.000 1.000 1.000 1.000 score LIST_PRTL_PUMPDUMP 1.000 1.000 1.000 1.000 score LIST_PRTL_SAME_USER 1.000 1.000 1.000 1.000 score LONG_HEX_URI 2.999 2.988 2.999 2.988 score LONG_IMG_URI 0.083 0.001 0.083 0.001 score LONG_INVISIBLE_TEXT 2.999 2.999 2.999 2.999 score LOTS_OF_MONEY 0.010 0.010 0.010 0.010 score LOTTO_AGENT 0.438 1.499 0.438 1.499 score LUCRATIVE 1.000 1.000 1.000 1.000 score MALFORMED_FREEMAIL 2.799 2.799 2.799 2.799 score MALF_HTML_B64 1.000 1.000 1.000 1.000 score MALWARE_NORDNS 2.700 1.277 2.700 1.277 score MALWARE_PASSWORD 1.000 1.000 1.000 1.000 score MALW_ATTACH 2.300 2.199 2.300 2.199 score MANY_SPAN_IN_TEXT 2.499 2.299 2.499 2.299 score MILLION_HUNDRED 2.699 1.869 2.699 1.869 score MILLION_USD 1.999 1.779 1.999 1.779 score MIMEOLE_DIRECT_TO_MX 0.001 0.001 0.001 0.001 score MIME_NO_TEXT 1.000 1.000 1.000 1.000 score MIXED_AREA_CASE 1.000 1.000 1.000 1.000 score MIXED_CENTER_CASE 1.000 1.000 1.000 1.000 score MIXED_ES 1.799 1.899 1.799 1.899 score MIXED_FONT_CASE 1.000 1.000 1.000 1.000 score MIXED_HREF_CASE 1.000 1.999 1.000 1.999 score MIXED_IMG_CASE 1.000 1.000 1.000 1.000 score MONERO_DEADLINE 1.000 1.000 1.000 1.000 score MONERO_EXTORT_01 1.000 1.000 1.000 1.000 score MONERO_MALWARE 1.000 1.000 1.000 1.000 score MONERO_PAY_ME 1.000 1.000 1.000 1.000 score MONEY_ATM_CARD 0.029 0.001 0.029 0.001 score MONEY_FORM 0.001 0.001 0.001 0.001 score MONEY_FORM_SHORT 2.499 2.499 2.499 2.499 score MONEY_FRAUD_3 2.699 1.368 2.699 1.368 score MONEY_FRAUD_5 2.699 2.517 2.699 2.517 score MONEY_FRAUD_8 0.001 0.001 0.001 0.001 score MONEY_FREEMAIL_REPTO 0.001 0.001 0.001 0.001 score MONEY_FROM_41 1.000 1.000 1.000 1.000 score MSGID_DOLLARS_URI_IMG 1.000 1.000 1.000 1.000 score MSGID_HDR_MALF 1.000 1.000 1.000 1.000 score MSMAIL_PRI_ABNORMAL 0.001 0.780 0.001 0.780 score MSM_PRIO_REPTO 1.000 1.000 1.000 1.000 score NA_DOLLARS 1.499 1.499 1.499 1.499 score NEWEGG_IMG_NOT_RCVD_NEGG 1.000 1.000 1.000 1.000 score NEW_PRODUCTS 1.000 1.000 1.000 1.000 score NICE_REPLY_A -0.001 -0.351 -0.001 -0.351 score NORDNS_LOW_CONTRAST 0.001 0.001 0.001 0.001 score NO_FM_NAME_IP_HOSTN 0.001 0.001 0.001 0.001 score NSL_RCVD_FROM_USER 0.001 0.001 0.001 0.001 score NSL_RCVD_HELO_USER 0.001 0.001 0.001 0.001 score NUMBERONLY_BITCOIN_EXP 1.269 1.384 1.269 1.384 score OBFU_BITCOIN 1.000 1.000 1.000 1.000 score OBFU_TEXT_ATTACH 0.001 0.461 0.001 0.461 score ODD_FREEM_REPTO 2.999 2.534 2.999 2.534 score PDS_BAD_THREAD_QP_64 0.999 0.049 0.999 0.049 score PDS_BTC_ID 0.499 0.208 0.499 0.208 score PDS_BTC_MSGID 0.001 0.001 0.001 0.001 score PDS_BTC_NTLD 1.826 1.621 1.826 1.621 score PDS_DBL_URL_TNB_RUNON 1.999 1.000 1.999 1.000 score PDS_HELO_SPF_FAIL 0.001 1.737 0.001 1.737 score PDS_NAKED_TO_NUMERO 1.596 1.358 1.596 1.358 score PDS_NO_FULL_NAME_SPOOFED_URL 0.750 0.750 0.750 0.750 score PDS_PHP_EVAL 1.000 1.000 1.000 1.000 score PDS_RDNS_DYNAMIC_FP 0.001 0.001 0.001 0.001 score PDS_SHORT_SPOOFED_URL 1.999 1.999 1.999 1.999 score PDS_TONAME_EQ_TOLOCAL_FREEM_FORGE 2.000 1.000 2.000 1.000 score PHISH_AZURE_CLOUDAPP 3.500 3.500 3.500 3.500 score PHISH_FBASEAPP 1.000 1.000 1.000 1.000 score PHP_NOVER_MUA 1.000 1.000 1.000 1.000 score PHP_ORIG_SCRIPT 1.746 0.196 1.746 0.196 score PHP_ORIG_SCRIPT_EVAL 1.000 1.000 1.000 1.000 score PHP_SCRIPT 2.499 2.499 2.499 2.499 score PHP_SCRIPT_MUA 1.000 1.000 1.000 1.000 score PP_MIME_FAKE_ASCII_TEXT 0.999 0.001 0.999 0.001 score PP_TOO_MUCH_UNICODE02 0.500 0.500 0.500 0.500 score PP_TOO_MUCH_UNICODE05 1.000 1.000 1.000 1.000 score PUMPDUMP 1.000 1.000 1.000 1.000 score PUMPDUMP_MULTI 1.000 1.000 1.000 1.000 score RAND_HEADER_LIST_SPOOF 1.000 1.000 1.000 1.000 score RAND_HEADER_MANY 1.000 1.000 1.000 1.000 score RAND_MKTG_HEADER 1.999 1.999 1.999 1.999 score RATWARE_NO_RDNS 0.001 1.112 0.001 1.112 score RCVD_DOTEDU_SHORT 1.000 1.000 1.000 1.000 score RCVD_DOTEDU_SUSP_URI 1.000 1.000 1.000 1.000 score RCVD_IN_MSPIKE_BL 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_H2 0.001 -0.001 0.001 -0.001 score RCVD_IN_MSPIKE_H3 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_H4 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_H5 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_L2 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_L3 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_L4 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_L5 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_WL 0.001 0.001 0.001 0.001 score RCVD_IN_MSPIKE_ZBI 0.001 0.001 0.001 0.001 score RDNS_NUM_TLD_ATCHNX 1.000 1.000 1.000 1.000 score RDNS_NUM_TLD_XM 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD 1.000 2.586 1.000 2.586 score REPTO_419_FRAUD_AOL 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_AOL_LOOSE 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_CNS 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_GM 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_GM_LOOSE 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_HM 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_OL 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_PM 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_QQ 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_YH 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_YH_LOOSE 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_YJ 1.000 1.000 1.000 1.000 score REPTO_419_FRAUD_YN 1.000 1.000 1.000 1.000 score REPTO_INFONUMSCOM 1.000 1.000 1.000 1.000 score SCC_ISEMM_LID_1 1.000 1.000 1.000 1.000 score SCC_ISEMM_LID_1B 1.499 0.550 1.499 0.550 score SENDGRID_REDIR 1.499 1.068 1.499 1.068 score SENDGRID_REDIR_PHISH 1.000 1.000 1.000 1.000 score SEO_SUSP_NTLD 1.000 1.000 1.000 1.000 score SERGIO_SUBJECT_VIAGRA01 3.199 3.204 3.199 3.204 score SHOPIFY_IMG_NOT_RCVD_SFY 2.499 2.499 2.499 2.499 score SHORTENED_URL_SRC 2.999 2.285 2.999 2.285 score SHORTENER_SHORT_IMG 1.000 1.000 1.000 1.000 score SHORT_IMG_SUSP_NTLD 1.000 1.000 1.000 1.000 score SHORT_SHORTNER 1.999 0.393 1.999 0.393 score SPOOFED_FREEMAIL 0.001 0.001 0.001 0.001 score SPOOFED_FREEMAIL_NO_RDNS 0.001 0.001 0.001 0.001 score SPOOFED_FREEM_REPTO 0.001 0.001 0.001 0.001 score SPOOFED_FREEM_REPTO_CHN 0.001 1.000 0.001 1.000 score SPOOFED_FREEM_REPTO_RUS 0.001 1.000 0.001 1.000 score SPOOF_GMAIL_MID 1.500 0.001 1.500 0.001 score STATIC_XPRIO_OLE 0.001 0.001 0.001 0.001 score STOCK_TIP 1.000 1.000 1.000 1.000 score STOX_BOUND_090909_B 1.769 0.001 1.769 0.001 score SUBJ_ATTENTION 0.500 0.500 0.500 0.500 score SUBJ_BRKN_WORDNUMS 1.000 1.000 1.000 1.000 score SURBL_BLOCKED 0.001 0.001 0.001 0.001 score SUSP_UTF8_WORD_SUBJ 1.999 1.999 1.999 1.999 score SYSADMIN 1.000 1.000 1.000 1.000 score TAGSTAT_IMG_NOT_RCVD_TGST 1.000 1.000 1.000 1.000 score TARINGANET_IMG_NOT_RCVD_TN 1.000 1.000 1.000 1.000 score THIS_AD 2.199 1.729 2.199 1.729 score THIS_IS_ADV_SUSP_NTLD 1.000 1.000 1.000 1.000 score TONLINE_FAKE_DKIM 1.000 1.000 1.000 1.000 score TO_EQ_FM_DIRECT_MX 1.000 1.000 1.000 1.000 score TO_EQ_FM_DOM_SPF_FAIL 0.001 0.001 0.001 0.001 score TO_EQ_FM_SPF_FAIL 0.001 0.001 0.001 0.001 score TO_IN_SUBJ 0.100 0.100 0.100 0.100 score TO_NAME_SUBJ_NO_RDNS 2.999 2.999 2.999 2.999 score TO_NO_BRKTS_HTML_IMG 1.999 1.999 1.999 1.999 score TO_NO_BRKTS_HTML_ONLY 1.999 1.999 1.999 1.999 score TO_NO_BRKTS_MSFT 0.001 0.001 0.001 0.001 score TO_NO_BRKTS_NORDNS_HTML 1.999 1.999 1.999 1.999 score TO_NO_BRKTS_PCNT 1.897 2.408 1.897 2.408 score TW_GIBBERISH_MANY 1.000 1.000 1.000 1.000 score UC_GIBBERISH_OBFU 1.000 1.000 1.000 1.000 score UNDISC_FREEM 3.100 2.999 3.100 2.999 score UNDISC_MONEY 3.499 3.299 3.499 3.299 score UNICODE_OBFU_ASC 1.000 1.000 1.000 1.000 score UNICODE_OBFU_ZW 1.000 1.000 1.000 1.000 score UNSUB_GOOG_FORM 1.000 1.000 1.000 1.000 score URI_ADOBESPARK 1.000 1.000 1.000 1.000 score URI_AZURE_CLOUDAPP 1.000 1.000 1.000 1.000 score URI_DASHGOVEDU 1.000 1.000 1.000 1.000 score URI_DATA 1.000 1.000 1.000 1.000 score URI_DOTEDU 1.999 1.999 1.999 1.999 score URI_DOTEDU_ENTITY 1.000 1.000 1.000 1.000 score URI_FIREBASEAPP 1.000 1.000 1.000 1.000 score URI_GOOGLE_PROXY 1.599 1.499 1.599 1.499 score URI_GOOG_STO_SPAMMY 3.000 3.000 3.000 3.000 score URI_HEX_IP 1.000 1.000 1.000 1.000 score URI_IMG_WP_REDIR 1.000 1.000 1.000 1.000 score URI_LONG_REPEAT 1.000 1.000 1.000 1.000 score URI_ONLY_MSGID_MALF 1.824 0.036 1.824 0.036 score URI_OPTOUT_3LD 1.000 1.000 1.000 1.000 score URI_PHISH 3.999 3.598 3.999 3.598 score URI_PHP_REDIR 1.000 1.000 1.000 1.000 score URI_TRY_3LD 1.801 1.169 1.801 1.169 score URI_TRY_USME 1.000 1.000 1.000 1.000 score URI_WP_DIRINDEX 1.000 1.000 1.000 1.000 score URI_WP_HACKED 3.499 3.499 3.499 3.499 score URI_WP_HACKED_2 2.499 2.499 2.499 2.499 score USB_DRIVES 1.000 1.000 1.000 1.000 score VFY_ACCT_NORDNS 2.785 2.999 2.785 2.999 score VPS_NO_NTLD 1.000 1.000 1.000 1.000 score WALMART_IMG_NOT_RCVD_WAL 1.000 1.000 1.000 1.000 score WORD_INVIS 1.579 1.243 1.579 1.243 score WORD_INVIS_MANY 2.999 2.999 2.999 2.999 score XFER_LOTSA_MONEY 0.999 0.747 0.999 0.747 score XM_DIGITS_ONLY 1.000 1.000 1.000 1.000 score XM_RANDOM 2.499 0.001 2.499 0.001 score XM_RECPTID 2.999 2.999 2.999 2.999 score XPRIO 0.213 0.001 0.213 0.001 score XPRIO_SHORT_SUBJ 1.000 1.000 1.000 1.000 score XPRIO_URL_SHORTNER 0.815 0.270 0.815 0.270 score YOU_INHERIT 2.499 0.001 2.499 0.001 PK SI�\0<C/ 1 3.004004/updates_spamassassin_org/25_antivirus.cfnu �[��� # SpamAssassin - anti-virus rules # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### # Requires the Mail::SpamAssassin::Plugin::AntiVirus plugin be loaded. ifplugin Mail::SpamAssassin::Plugin::AntiVirus body MICROSOFT_EXECUTABLE eval:check_microsoft_executable() describe MICROSOFT_EXECUTABLE Message includes Microsoft executable program body MIME_SUSPECT_NAME eval:check_suspect_name() describe MIME_SUSPECT_NAME MIME filename does not match content endif # Mail::SpamAssassin::Plugin::AntiVirus PK SI�\,�0 0 + 3.004004/updates_spamassassin_org/25_spf.cfnu �[��� # SpamAssassin - SPF rules # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### # Requires the Mail::SpamAssassin::Plugin::SPF plugin be loaded. ifplugin Mail::SpamAssassin::Plugin::SPF # SPF support: # "pass" is nice # "neutral" is somewhat bad # "fail" is bad # "softfail" is bad, but not as bad as "fail" # "permerror" is very bad, and means the domain doesn't have a valid spf record # These are more trustworthy results than the SPF_HELO rules. # some are "userconf" so that scores are set by hand? header SPF_PASS eval:check_for_spf_pass() describe SPF_PASS SPF: sender matches SPF record tflags SPF_PASS nice userconf net reuse SPF_PASS header SPF_NEUTRAL eval:check_for_spf_neutral() describe SPF_NEUTRAL SPF: sender does not match SPF record (neutral) tflags SPF_NEUTRAL net reuse SPF_NEUTRAL header SPF_FAIL eval:check_for_spf_fail() describe SPF_FAIL SPF: sender does not match SPF record (fail) tflags SPF_FAIL net reuse SPF_FAIL header SPF_SOFTFAIL eval:check_for_spf_softfail() describe SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) tflags SPF_SOFTFAIL net reuse SPF_SOFTFAIL # NOTE: SPF_HELO_PASS is not incredibly hard to fake, so shouldn't # provide much in the way of points compared to SPF_PASS et al. # However, a *failure* is still a very good spamsign. header SPF_HELO_PASS eval:check_for_spf_helo_pass() describe SPF_HELO_PASS SPF: HELO matches SPF record tflags SPF_HELO_PASS nice userconf net reuse SPF_HELO_PASS header SPF_HELO_NEUTRAL eval:check_for_spf_helo_neutral() describe SPF_HELO_NEUTRAL SPF: HELO does not match SPF record (neutral) tflags SPF_HELO_NEUTRAL net reuse SPF_HELO_NEUTRAL header SPF_HELO_FAIL eval:check_for_spf_helo_fail() describe SPF_HELO_FAIL SPF: HELO does not match SPF record (fail) tflags SPF_HELO_FAIL net reuse SPF_HELO_FAIL header SPF_HELO_SOFTFAIL eval:check_for_spf_helo_softfail() describe SPF_HELO_SOFTFAIL SPF: HELO does not match SPF record (softfail) tflags SPF_HELO_SOFTFAIL net reuse SPF_HELO_SOFTFAIL # Implementing the Sender Check for No SPF REcord defaulting to disabled so Admins can override header SPF_NONE eval:check_for_spf_none() describe SPF_NONE SPF: sender does not publish an SPF Record tflags SPF_NONE net reuse SPF_NONE header SPF_HELO_NONE eval:check_for_spf_helo_none() describe SPF_HELO_NONE SPF: HELO does not publish an SPF Record tflags SPF_HELO_NONE net reuse SPF_HELO_NONE if can(Mail::SpamAssassin::Plugin::SPF::has_check_for_spf_errors) header T_SPF_PERMERROR eval:check_for_spf_permerror() describe T_SPF_PERMERROR SPF: test of record failed (permerror) tflags T_SPF_PERMERROR net reuse T_SPF_PERMERROR header T_SPF_TEMPERROR eval:check_for_spf_temperror() describe T_SPF_TEMPERROR SPF: test of record failed (temperror) tflags T_SPF_TEMPERROR net reuse T_SPF_TEMPERROR header T_SPF_HELO_PERMERROR eval:check_for_spf_helo_permerror() describe T_SPF_HELO_PERMERROR SPF: test of HELO record failed (permerror) tflags T_SPF_HELO_PERMERROR net reuse T_SPF_HELO_PERMERROR header T_SPF_HELO_TEMPERROR eval:check_for_spf_helo_temperror() describe T_SPF_HELO_TEMPERROR SPF: test of HELO record failed (temperror) tflags T_SPF_HELO_TEMPERROR net reuse T_SPF_HELO_TEMPERROR endif endif # Mail::SpamAssassin::Plugin::SPF PK SI�\��( �) �) 5 3.004004/updates_spamassassin_org/25_url_shortener.cfnu �[��� # SpamAssassin - URL shortener rules # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### ### ### Note that this file contains two separate lists, url_shortener and a ### backup regex generated from it. Both must updated and kept in sync. ### ### __URL_SHORTENER will always by set by either the plugin or regex ### # SpamAssassin 4.0 version required if can(Mail::SpamAssassin::Plugin::DecodeShortURLs::has_short_url_redir) body __URL_SHORTENER eval:short_url() body URL_SHORTENER_CHAINED eval:short_url_chained() describe URL_SHORTENER_CHAINED Message contains shortened URL chained to other shorteners tflags URL_SHORTENER_CHAINED net score URL_SHORTENER_CHAINED 0.01 uri URL_SHORTENER_DISABLED m,^https://(?:bitly\.com/a/blocked|tinyurl\.com/app/nospam), describe URL_SHORTENER_DISABLED Message contains shortened URL that has been disabled due to abuse tflags URL_SHORTENER_DISABLED net score URL_SHORTENER_DISABLED 2 # # Please only add entries that you manually verified as actual working # redirectors that can have abusable custom URLs. Adding non-abusable # services only generates unnecessary HTTP requests. # # After any changes, also update __URL_SHORTENER regex at end of file. # # generic list of likely active services - cleaned up 25.05.2022 url_shortener .ftn.app url_shortener .page.link url_shortener .short.gy url_shortener .shortz.me url_shortener 0rz.tw url_shortener 4sq.com url_shortener 4url.cc url_shortener afly.co url_shortener ai6.net url_shortener amzn.com url_shortener amzn.to url_shortener b.link url_shortener b23.ru url_shortener binged.it url_shortener bit.do url_shortener bit.ly url_shortener bitly.com url_shortener bizj.us url_shortener chilp.it url_shortener conta.cc url_shortener crks.me url_shortener cutt.ly url_shortener cutwin.biz url_shortener dai.ly url_shortener db.tt url_shortener disq.us url_shortener dlvr.it url_shortener doi.org url_shortener doiop.com url_shortener eepurl.com url_shortener fb.me url_shortener fire.to url_shortener firsturl.de url_shortener firsturl.net url_shortener flic.kr url_shortener gdurl.com url_shortener go.ly url_shortener goo.gl url_shortener goolnk.com url_shortener gplinks.in url_shortener guest.link url_shortener hellotxt.com url_shortener hop.kz url_shortener hotshorturl.com url_shortener hub.am url_shortener huff.to url_shortener hurl.it url_shortener hyperurl.co url_shortener inx.lv url_shortener is.gd url_shortener it2.in url_shortener j.mp url_shortener kore.us url_shortener kurl.no url_shortener l.bestsellers.to url_shortener lnk.sk url_shortener lnkd.in url_shortener lnkiy.in url_shortener lru.jp url_shortener mrte.ch url_shortener n9.cl url_shortener ndurl.com url_shortener onion.com url_shortener ouo.io url_shortener ow.ly url_shortener owl.li url_shortener pduda.mobi url_shortener rb.gy url_shortener redir.ec url_shortener rotf.lol url_shortener s.apache.org url_shortener s.free.fr url_shortener s.id url_shortener shar.es url_shortener shorl.com url_shortener shortn.me url_shortener shorturl.at url_shortener simurl.net url_shortener slidesha.re url_shortener smarturl.it url_shortener smfu.in url_shortener snip.ly url_shortener snkr.me url_shortener stpmvt.com url_shortener t.co url_shortener t.ly url_shortener tcrn.ch url_shortener tgr.ph url_shortener tiny.cc url_shortener tiny.one url_shortener tiny.pl url_shortener tinylink.in url_shortener tinyurl.com url_shortener to.ly url_shortener trib.al url_shortener twixar.me url_shortener u.nu url_shortener u.to url_shortener url.ie url_shortener urlcut.com url_shortener urlday.cc url_shortener urls.im url_shortener urlz.at url_shortener urlzs.com url_shortener utfg.sk url_shortener wow.link url_shortener wp.me url_shortener x.co url_shortener x.hypem.com url_shortener xurl.es url_shortener yhoo.it url_shortener youtu.be url_shortener z23.ru url_shortener zurl.ws # www.shrunken.com - list validated 25.05.2022 url_shortener www.shrunken.com url_shortener 0.gp url_shortener 2.gp url_shortener 2.ly url_shortener 3.ly url_shortener 4.gp url_shortener 4.ly url_shortener 5.gp url_shortener 6.gp url_shortener 6.ly url_shortener 7.ly url_shortener 8.ly url_shortener 9.ly url_shortener g.asia url_shortener p.asia url_shortener ur3.us # shorturl.com - list validated 25.05.2022 url_shortener alturl.com url_shortener .1sta.com url_shortener .24ex.com url_shortener .2fear.com url_shortener .2fortune.com url_shortener .2freedom.com url_shortener .2hell.com url_shortener .2savvy.com url_shortener .2truth.com url_shortener .2tunes.com url_shortener .2ya.com url_shortener .alturl.com url_shortener .antiblog.com url_shortener .bigbig.com url_shortener .dealtap.com url_shortener .ebored.com url_shortener .echoz.com url_shortener .filetap.com url_shortener .funurl.com url_shortener .headplug.com url_shortener .hereweb.com url_shortener .hitart.com url_shortener .mirrorz.com url_shortener .mp3update.com url_shortener .shorturl.com url_shortener .spyw.com url_shortener .vze.com # iscool.net - list validated 25.05.2022 url_shortener .arecool.net url_shortener .iscool.net url_shortener .isfun.net url_shortener .tux.nu # kisa.link - list validated 25.05.2022 url_shortener kisa.link url_shortener www.kisa.link url_shortener bul.tc url_shortener cy.tc url_shortener fn.tc url_shortener ftp.tc url_shortener gr.tc url_shortener hbr.tc url_shortener heg.tc url_shortener ins.tc url_shortener ko.tc url_shortener kod.tc url_shortener lol.tc url_shortener m2.tc url_shortener ml.tc url_shortener mmo.tc url_shortener oy.tc url_shortener pc.tc url_shortener pubg.tc url_shortener pvp.tc url_shortener sro.tc url_shortener tek.link url_shortener tw.tc # grabify.link - list validated 25.05.2022 url_shortener grabify.link url_shortener catsnthing.com url_shortener catsnthings.fun url_shortener cheapcinema.club url_shortener dateing.club url_shortener fortnight.space url_shortener fortnitechat.site url_shortener freegiftcards.co url_shortener gaming-at-my.best url_shortener gamingfun.me url_shortener headshot.monster url_shortener imageshare.best url_shortener joinmy.site url_shortener leancoding.co url_shortener locations.quest url_shortener lovebird.guru url_shortener myprivate.pics url_shortener noodshare.pics url_shortener partpicker.shop url_shortener progaming.monster url_shortener screenshare.pics url_shortener screenshot.best url_shortener shhh.lol url_shortener shrekis.life url_shortener sportshub.bar url_shortener stopify.co url_shortener trulove.guru url_shortener yourmy.monster # GET method required for some services, keep the same services in url_shortener also if can(Mail::SpamAssassin::Plugin::DecodeShortURLs::has_get) url_shortener_get bit.ly endif endif # has_short_url_redir ### ### Use a regex if DecodeShortURLs plugin is not loaded ### if !can(Mail::SpamAssassin::Plugin::DecodeShortURLs::has_short_url_redir) ## Generate __URL_SHORTENER with this command, to keep it in sync with url_shortener list: ## ## perl -pe 'while (<>) {/^\s*url_shortener\s+(\S+)/ or next;$s=quotemeta($1);$s=~s/^\\./\\w+\\./;push @a,$s} print "uri __URL_SHORTENER m,^https?://(?:".join("|",@a).")/,i\n"' < 25_url_shortener.cf ## uri __URL_SHORTENER m,^https?://(?:\w+\.ftn\.app|\w+\.page\.link|\w+\.short\.gy|\w+\.shortz\.me|0rz\.tw|4sq\.com|4url\.cc|afly\.co|ai6\.net|amzn\.com|amzn\.to|b\.link|b23\.ru|binged\.it|bit\.do|bit\.ly|bitly\.com|bizj\.us|chilp\.it|conta\.cc|crks\.me|cutt\.ly|cutwin\.biz|dai\.ly|db\.tt|disq\.us|dlvr\.it|doi\.org|doiop\.com|eepurl\.com|fb\.me|fire\.to|firsturl\.de|firsturl\.net|flic\.kr|gdurl\.com|go\.ly|goo\.gl|goolnk\.com|gplinks\.in|guest\.link|hellotxt\.com|hop\.kz|hotshorturl\.com|hub\.am|huff\.to|hurl\.it|hyperurl\.co|inx\.lv|is\.gd|it2\.in|j\.mp|kore\.us|kurl\.no|l\.bestsellers\.to|lnk\.sk|lnkd\.in|lnkiy\.in|lru\.jp|mrte\.ch|n9\.cl|ndurl\.com|onion\.com|ouo\.io|ow\.ly|owl\.li|pduda\.mobi|rb\.gy|redir\.ec|rotf\.lol|s\.apache\.org|s\.free\.fr|s\.id|shar\.es|shorl\.com|shortn\.me|shorturl\.at|simurl\.net|slidesha\.re|smarturl\.it|smfu\.in|snip\.ly|snkr\.me|stpmvt\.com|t\.co|t\.ly|tcrn\.ch|tgr\.ph|tiny\.cc|tiny\.one|tiny\.pl|tinylink\.in|tinyurl\.com|to\.ly|trib\.al|twixar\.me|u\.nu|u\.to|url\.ie|urlcut\.com|urlday\.cc|urls\.im|urlz\.at|urlzs\.com|utfg\.sk|wow\.link|wp\.me|x\.co|x\.hypem\.com|xurl\.es|yhoo\.it|youtu\.be|z23\.ru|zurl\.ws|www\.shrunken\.com|0\.gp|2\.gp|2\.ly|3\.ly|4\.gp|4\.ly|5\.gp|6\.gp|6\.ly|7\.ly|8\.ly|9\.ly|g\.asia|p\.asia|ur3\.us|alturl\.com|\w+\.1sta\.com|\w+\.24ex\.com|\w+\.2fear\.com|\w+\.2fortune\.com|\w+\.2freedom\.com|\w+\.2hell\.com|\w+\.2savvy\.com|\w+\.2truth\.com|\w+\.2tunes\.com|\w+\.2ya\.com|\w+\.alturl\.com|\w+\.antiblog\.com|\w+\.bigbig\.com|\w+\.dealtap\.com|\w+\.ebored\.com|\w+\.echoz\.com|\w+\.filetap\.com|\w+\.funurl\.com|\w+\.headplug\.com|\w+\.hereweb\.com|\w+\.hitart\.com|\w+\.mirrorz\.com|\w+\.mp3update\.com|\w+\.shorturl\.com|\w+\.spyw\.com|\w+\.vze\.com|\w+\.arecool\.net|\w+\.iscool\.net|\w+\.isfun\.net|\w+\.tux\.nu|kisa\.link|www\.kisa\.link|bul\.tc|cy\.tc|fn\.tc|ftp\.tc|gr\.tc|hbr\.tc|heg\.tc|ins\.tc|ko\.tc|kod\.tc|lol\.tc|m2\.tc|ml\.tc|mmo\.tc|oy\.tc|pc\.tc|pubg\.tc|pvp\.tc|sro\.tc|tek\.link|tw\.tc|grabify\.link|catsnthing\.com|catsnthings\.fun|cheapcinema\.club|dateing\.club|fortnight\.space|fortnitechat\.site|freegiftcards\.co|gaming\-at\-my\.best|gamingfun\.me|headshot\.monster|imageshare\.best|joinmy\.site|leancoding\.co|locations\.quest|lovebird\.guru|myprivate\.pics|noodshare\.pics|partpicker\.shop|progaming\.monster|screenshare\.pics|screenshot\.best|shhh\.lol|shrekis\.life|sportshub\.bar|stopify\.co|trulove\.guru|yourmy\.monster)/,i endif PK SI�\��y y = 3.004004/updates_spamassassin_org/73_sandbox_manual_scores.cfnu �[��� # SpamAssassin rules file # # Manual override of the automatically-generated scores # for automatically-published sandbox rules # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### require_version 3.004004 # jhardin # things depend on these # score as informative just for the hits header score LOTS_OF_MONEY 0.001 score FILL_THIS_FORM 0.001 # jhardin # reevolved Advance Fee rules # scores are cumulative (i.e. 3 hits 2, 4 hits 3 and 2) # Commented out if GA is scoring reasonably #score ADVANCE_FEE_2_NEW_MONEY 0.50 #score ADVANCE_FEE_2_NEW_FORM 0.75 #score ADVANCE_FEE_3_NEW 0.50 #score ADVANCE_FEE_3_NEW_MONEY 1.00 #score ADVANCE_FEE_3_NEW_FORM 1.00 #score ADVANCE_FEE_4_NEW 1.00 #score ADVANCE_FEE_5_NEW 1.50 score ADVANCE_FEE_5_NEW_MONEY 3.00 # jhardin # metas using Advance Fee component rules # Commented out if GA is scoring reasonably #score FORM_FRAUD_3 0.50 #score FORM_FRAUD_5 0.50 #score MONEY_FRAUD_3 1.00 #score MONEY_FRAUD_5 0.50 #score MONEY_FRAUD_8 0.50 # jhardin # GA scores this unreasonably high, and # the fact that this is defined in an #ifplugin # appears to be preventing score limiting from working score FILL_THIS_FORM_LONG 2.00 # jhardin # misc rules # Commented out if GA is scoring reasonably #score FROM_MISSP_MSFT 0.50 #score TO_NO_BRKTS_DYNIP 0.50 #score LOTTO_AGENT 0.50 # jhardin # 1.000 S/O, hits only <= 6 points, but GA is not publishing it! # perhaps because very few examples in spam corpus # 12/24/12 GA likes it now #score GOOGLE_DOCS_PHISH 3.00 # similar: .990 S/O, hits primarily spam <= 5 points # 01/07/13 GA likes it now #score EMAIL_URI_PHISH 2.50 # Reliable but not widespread (low corpus count, ahead of the curve?), boost the score score PHISH_AZURE_CLOUDAPP 3.50 score URI_GOOG_STO_SPAMMY 3.50 # jhardin # double-extension file attachments, low corpus count score PHISH_ATTACH 3.50 score MALW_ATTACH 3.50 # hege # FPs reported [bug 6417], GA assigning 3+ points # reduce score until that's resolved # score HK_FAKENAME_MICROSOFT 2.50 # RULE DISABLED IN 20_hk.cf # jhardin for mmartinec # Lots of hate; score as informative hammy, may override locally score RP_MATCHES_RCVD -0.001 # until rule or rescoring issues sorted, hits 20%+ ham # too problematic, disabled entirely #score STYLE_GIBBERISH 0.1 # jhardin # Limit some network scores until rule changes can be evaluated by weekly net masscheck # Dangit, relative scores are broken - see bug#7721 #score FROM_IN_TO_AND_SUBJ (0) 0.001 (0) 0.001 #score OBFU_TEXT_ATTACH (0) 0.001 (0) 0.001 #score MIME_NO_TEXT (0) 0.001 (0) 0.001 #score AD_PREFS (0) 0.001 (0) 0.001 score AD_PREFS 0.250 #score URI_WP_HACKED_2 (0) 0.001 (0) 0.001 #score STYLE_GIBBERISH (0) 0.001 (0) 0.001 #score UC_GIBBERISH_OBFU (0) 0.001 (0) 0.001 #score LUCRATIVE (0) 0.001 (0) 0.001 #score HEXHASH_WORD (0) 0.001 (0) 0.001 #score FROM_WORDY (0) 0.001 (0) 0.001 #score AC_HTML_NONSENSE_TAGS (0) 0.001 (0) 0.001 #score LONG_HEX_URI (0) 0.001 (0) 0.001 #score FROM_PAYPAL_SPOOF (0) 0.001 (0) 0.001 # jhardin # Don't joe-job a SA dev's wife score ADULT_DATING_COMPANY 20.000 PK SI�\ :ڏ � 2 3.004004/updates_spamassassin_org/20_compensate.cfnu �[��� # SpamAssassin rules file: compensation for common false positives # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### # Header compensation tests require_version 3.004004 header __HAS_RCVD exists:Received priority __HAS_RCVD -2000 # Bug 8078 meta NO_RECEIVED (!__HAS_RCVD) tflags NO_RECEIVED nice userconf describe NO_RECEIVED Informational: message has no Received headers ########################################################################### ifplugin Mail::SpamAssassin::Plugin::RelayEval # The message was never sent via an untrustworthy host. header ALL_TRUSTED eval:check_all_trusted() describe ALL_TRUSTED Passed through trusted hosts only via SMTP tflags ALL_TRUSTED nice userconf header NO_RELAYS eval:check_no_relays() tflags NO_RELAYS nice userconf describe NO_RELAYS Informational: message was not relayed via SMTP endif PK SI�\&.��� � + 3.004004/updates_spamassassin_org/60_awl.cfnu �[��� # SpamAssassin rules file: auto-welcomelist # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> ifplugin Mail::SpamAssassin::Plugin::AWL if can(Mail::SpamAssassin::Conf::feature_welcomelist_blocklist) header AWL eval:check_from_in_auto_welcomelist() endif if !can(Mail::SpamAssassin::Conf::feature_welcomelist_blocklist) header AWL eval:check_from_in_auto_whitelist() endif describe AWL Adjusted score from AWL reputation of From: address tflags AWL userconf noautolearn priority AWL 1000 endif # Mail::SpamAssassin::Plugin::AWL PK SI�\U/FF_# _# 7 3.004004/updates_spamassassin_org/20_fake_helo_tests.cfnu �[��� # SpamAssassin rules file: fake-HELO tests # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # We should write a new ruletype for these, to save typing. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### require_version 3.004004 #--------------------------------------------------------------------------- # Handle hosts that look like HELO_DYNAMIC hosts # cmr-208-124-139-194.cr.net.cable.rogers.com) [208.124.139.194] # cmr-208-97-119-114.cr.net.cable.rogers.com) [208.97.119.114] header __HELO_STATIC_ROGERS X-Spam-Relays-External =~ /^[^\]]+ helo=cmr-\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}\S+\.rogers\.com[^\]]+ auth= /i # o167-89-97-77.outbound-mail.sendgrid.net (bug 7592) header __HELO_STATIC_SENDGRID X-Spam-Relays-External =~ /^[^\]]+ helo=o\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}\.outbound-mail\.sendgrid\.net\s[^\]]+ auth= /i # 50-203-126-142-static.hfc.comcastbusiness.net header __HELO_STATIC_COMCAST X-Spam-Relays-External =~ /^[^\]]+ helo=\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}-static\.hfc\.comcastbusiness\.net\s[^\]]+ auth= /i describe HELO_STATIC_HOST Relay HELO'd using static hostname meta HELO_STATIC_HOST (__HELO_STATIC_ROGERS || __HELO_STATIC_SENDGRID || __HELO_STATIC_COMCAST) # --------------------------------------------------------------------------- # Suresh says: these will never be used as HELOs from real mail.com relays. # Just check the most recent handover; the connection to a internal host. # This way a legit sender can send to their MSA using that HELO (quite a few # MUAs will do that), but a spammer gets caught. (List of domains comes from # the drop-down list on the Mail.com signup page.) #header FAKE_HELO_MAIL_COM_DOM X-Spam-Relays-External =~ /^[^\]]+ helo=(?:\S+\.|)(?:(?:mail|email|iname|cheerful|consultant|europe|mindless|myself|post|techie|usa|writeme|2die4|artlover|bikerider|catlover|cliffhanger|cutey|doglover|gardener|hot-shot|inorbit|loveable|mad\.scientist|playful|poetic|popstar|saintly|seductive|soon|whoever|winning|witty|yours|africamail|arcticmail|asia|australiamail|europe|japan|samerica|usa|berlin|dublin|london|madrid|moscowmail|munich|nycmail|paris|rome|sanfranmail|singapore|tokyo|accountant|adexec|allergist|alumnidirector|archaeologist|chemist|clerk|columnist|comic|consultant|counsellor|deliveryman|diplomats|doctor|dr|engineer|execs|financier|geologist|graphic-designer|insurer|journalist|lawyer|legislator|lobbyist|minister|optician|pediatrician|presidency|priest|publicist|realtyagent|registerednurses|repairman|representative|rescueteam|scientist|sociologist|teacher|techietechnologist|umpire)\.com|(?:programmer|earthling|hairdresser)\.net|musician\.org) /i #describe FAKE_HELO_MAIL_COM_DOM Relay HELO'd with suspicious hostname (mail.com) # --------------------------------------------------------------------------- # Interesting new feature; spamware HELO'ing, from a dialup IP addr, # using that IP's rDNS entry. We can catch this easily. There aren't # many legit mailservers calling themselves # 'dhcp024-210-034-053.columbus.rr.com'. ;) # # Note the '^[^\]]+ ' stanza: this ensures that we only match spamware # connecting to a internal relay; if a mail came from a dynamic addr but # was relayed through their smarthost, that's fine. # See bug #5856, all references of trusted were changed to internal # dhcp024-210-034-053.columbus.rr.com [24.210.34.53] # c-66-176-16-108.se.client2.attbi.com [66.176.16.108] # c-67-168-174-61.client.comcast.net [67.168.174.61] # NNN-NNN-NNN-NNN.fibertel.com.ar # NN.NN.NNN.NNN.ap.yournet.ne.jp # NN.NNN.NN-NN.rev.gaoland.net # vaise-1-82-67-44-166.fbx.proxad.net [82.67.44.166] # lns-vlq-11-62-147-186-141.adsl.proxad.net [62.147.186.141] # dsl-200-95-109-107.prod-infinitum.com.mx [200.95.109.107] # port-212-202-77-203.reverse.qsc.de [212.202.77.203] # pool-151-203-32-68.bos.east.verizon.net [151.203.32.68] # c-67-164-133-216.client.comcast.net [67.164.133.216] # 200-171-228-6.customer.telesp.net.br [200.171.228.6] # modemcable090.28-201-24.mc.videotron.ca [24.201.28.90] # 80-218-47-160.dclient.hispeed.ch [80.218.47.160] # cdm-68-226-239-16.laft.cox-internet.com [68.226.239.16] # d53-64-35-171.nap.wideopenwest.com [64.53.171.35] # 74.67-201-80.adsl.skynet.be [80.201.67.74] # 12-218-225-223.client.mchsi.com [12.218.225.223] # (require an alpha first, as legit HELO'ing-as-IP-address is hit otherwise) header __HELO_DYNAMIC_IPADDR X-Spam-Relays-External =~ /^[^\]]+ helo=(?![^\s\]]+[-.]static[-.])[a-z]\S*\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+[^\]]+ auth= /i meta HELO_DYNAMIC_IPADDR (__HELO_DYNAMIC_IPADDR && !HELO_STATIC_HOST) describe HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1) # dhcp024-210-034-053.columbus.rr.com [24.210.34.53] # catv-506237d8.miskcatv.broadband.hu [80.98.55.216] # node-c-8b22.a2000.nl # cm89.omega139.maxonline.com.sg # cm114.gamma208.maxonline.com.sg header __HELO_DYNAMIC_DHCP X-Spam-Relays-External =~ /^[^\]]+ helo=\S*(?:(?<!smtp)(?<!a)cm|catv|docsis|cable|dsl|dhcp|cpe|node)\S*\d+[^\d\s]+\d+[^\]]+ auth= /i meta HELO_DYNAMIC_DHCP (__HELO_DYNAMIC_DHCP && !HELO_STATIC_HOST) describe HELO_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP) # fia83-8.dsl.hccnet.nl [62.251.8.83] # fia160-115-100.dsl.hccnet.nl [80.100.115.160] header __HELO_DYNAMIC_HCC X-Spam-Relays-External =~ /^[^\]]+ helo=\S*\d+[^\d\s]+\d+\S*\.(?:docsis|cable|dsl|adsl|dhcp|cpe)\.[^\]]+ auth= /i meta HELO_DYNAMIC_HCC (__HELO_DYNAMIC_HCC && !HELO_STATIC_HOST) describe HELO_DYNAMIC_HCC Relay HELO'd using suspicious hostname (HCC) # h0002a5d76857.ne.client2.attbi.com [65.96.12.59] # CPE0004e2372711-CM000a73666706.cpe.net.cable.rogers.com # CPE00e0184f0eba-CM014490118324.cpe.net.cable.rogers.com [24.43.109.140] header HELO_DYNAMIC_ROGERS X-Spam-Relays-External =~ /^[^\]]+ helo=CPE\d+\S+\.rogers\.com[^\]]+ auth= /i describe HELO_DYNAMIC_ROGERS Relay HELO'd using suspicious hostname (Rogers) # pD9E4F89F.dip.t-dialin.net [217.228.248.159] header HELO_DYNAMIC_DIALIN X-Spam-Relays-External =~ /^[^\]]+ helo=[a-z][A-F0-9]+\.dip\./ describe HELO_DYNAMIC_DIALIN Relay HELO'd using suspicious hostname (T-Dialin) # 0xd5aaf40b.dhcp.kabelnettet.dk # 0x50a46949.virnxx11.adsl-dhcp.tele.dk header HELO_DYNAMIC_HEXIP X-Spam-Relays-External =~ /^[^\]]+ helo=0x[a-f0-9]{8}\./ describe HELO_DYNAMIC_HEXIP Relay HELO'd using suspicious hostname (Hex IP) # 118.Red-80-35-201.pooles.rima-tde.net header HELO_DYNAMIC_SPLIT_IP X-Spam-Relays-External =~ /^[^\]]+ helo=\d+\.\S+\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]/ describe HELO_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname (Split IP) # YahooBB219173000034.bbtec.net [219.173.0.34] # 10-35-124-91.pool.ukrtel.net [91.124.35.10] # 89-215-186-91.2073241113.ddns-lan.rakovski.ekk.bg [217.18.240.147] # 200.109.193-29.dyn.dsl.cantv.net [200.109.193.29] # 113x35x70x11.ap113.ftth.ucom.ne.jp [113.35.70.11] # 98x9x3p5siouq.kvknv3sv1quk.3ejp4xzv.com [213.250.20.156] # 1.0/24.137.95.202.in-addr.arpa [202.95.137.1] header __HELO_DYNAMIC_IPADDR2 X-Spam-Relays-External =~ /^[^\]]+ helo=(?![^\s\]]+[-.](?:static|mail|smtp|mx)\d*[-.])\d{1,3}(?:[\Wx_]\d{1,3}){3}[^\d\s][^\s.]*\.\S+\.\S+[^\]]+ auth= /i meta HELO_DYNAMIC_IPADDR2 (__HELO_DYNAMIC_IPADDR2 && !HELO_DYNAMIC_SPLIT_IP) describe HELO_DYNAMIC_IPADDR2 Relay HELO'd using suspicious hostname (IP addr 2) # h234n2fls32o895.telia.com [217.208.73.234] # h53n2fls32o828.telia.com # h116n2fls32o1111.telia.com # h29n1fls306o1003.telia.com # CM-vina5-168-207.cm.vtr.net [200.104.168.207] # CM-anto1-98-153.cm.vtr.net [200.104.98.153] # ec9z5l.cm.chello.no # g225174.upc-g.chello.nl # a151145.upc-a.chello.nl # a96134.upc-a.chello.nl header HELO_DYNAMIC_CHELLO_NL X-Spam-Relays-External =~ /^[^\]]+ helo=[a-z]\d+\.upc-[a-z]\.chello\.nl[^\]]+ auth= /i describe HELO_DYNAMIC_CHELLO_NL Relay HELO'd using suspicious hostname (Chello.nl) # cp160000-a.mill1.nb.home.nl # cp341468-b.venra1.lb.home.nl header HELO_DYNAMIC_HOME_NL X-Spam-Relays-External =~ /^[^\]]+ helo=[a-z]{2}\d+-\S\.\S+\d\.[a-z]{2}\.home\.nl[^]]+ auth= /i describe HELO_DYNAMIC_HOME_NL Relay HELO'd using suspicious hostname (Home.nl) PK SI�\�]ǠI I ; 3.004004/updates_spamassassin_org/60_welcomelist_subject.cfnu �[��� # SpamAssassin rules file: default welcomelist/blocklist subject # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> ########################################################################### # Welcomelist/Blocklist rules # # Note that most of these get 'noautolearn'. They should not be # considered when deciding whether to auto-learn a message, as a # user slip-up could result in scribbling side-effects in the bayes # db as a result -- which is hard to remedy. # 4.0 / Bug 7826 renames whitelist to welcomelist and blacklist to blocklist # Module was renamed WhiteListSubject -> WelcomeListSubject ifplugin Mail::SpamAssassin::Plugin::WelcomeListSubject header SUBJECT_IN_WELCOMELIST eval:check_subject_in_welcomelist() describe SUBJECT_IN_WELCOMELIST Subject: contains string in the user's welcome-list tflags SUBJECT_IN_WELCOMELIST userconf nice noautolearn score SUBJECT_IN_WELCOMELIST -100 # Backwards compatibility # To disable set "enable_compat welcomelist_blocklist" in init.pre if !can(Mail::SpamAssassin::Conf::compat_welcomelist_blocklist) meta SUBJECT_IN_WHITELIST (SUBJECT_IN_WELCOMELIST) describe SUBJECT_IN_WHITELIST DEPRECATED: See SUBJECT_IN_WELCOMELIST tflags SUBJECT_IN_WHITELIST userconf nice noautolearn score SUBJECT_IN_WHITELIST -100 score SUBJECT_IN_WELCOMELIST -0.01 endif header SUBJECT_IN_BLOCKLIST eval:check_subject_in_blocklist() describe SUBJECT_IN_BLOCKLIST Subject: contains string in the user's block-list tflags SUBJECT_IN_BLOCKLIST userconf noautolearn score SUBJECT_IN_BLOCKLIST 100 if !can(Mail::SpamAssassin::Conf::compat_welcomelist_blocklist) meta SUBJECT_IN_BLACKLIST (SUBJECT_IN_BLOCKLIST) describe SUBJECT_IN_BLACKLIST DEPRECATED: See SUBJECT_IN_BLOCKLIST tflags SUBJECT_IN_BLACKLIST userconf noautolearn score SUBJECT_IN_BLACKLIST 100 score SUBJECT_IN_BLOCKLIST 0.01 endif endif if !plugin(Mail::SpamAssassin::Plugin::WelcomeListSubject) ifplugin Mail::SpamAssassin::Plugin::WhiteListSubject header SUBJECT_IN_WELCOMELIST eval:check_subject_in_whitelist() describe SUBJECT_IN_WELCOMELIST Subject: contains string in the user's welcome-list tflags SUBJECT_IN_WELCOMELIST userconf nice noautolearn score SUBJECT_IN_WELCOMELIST -0.01 meta SUBJECT_IN_WHITELIST (SUBJECT_IN_WELCOMELIST) describe SUBJECT_IN_WHITELIST DEPRECATED: See SUBJECT_IN_WELCOMELIST tflags SUBJECT_IN_WHITELIST userconf nice noautolearn score SUBJECT_IN_WHITELIST -100 header SUBJECT_IN_BLOCKLIST eval:check_subject_in_blacklist() describe SUBJECT_IN_BLOCKLIST Subject: contains string in the user's block-list tflags SUBJECT_IN_BLOCKLIST userconf noautolearn score SUBJECT_IN_BLOCKLIST 0.01 meta SUBJECT_IN_BLACKLIST (SUBJECT_IN_BLOCKLIST) describe SUBJECT_IN_BLACKLIST DEPRECATED: See SUBJECT_IN_BLOCKLIST tflags SUBJECT_IN_BLACKLIST userconf noautolearn score SUBJECT_IN_BLACKLIST 100 endif endif PK SI�\;͍�� � + 3.004004/updates_spamassassin_org/25_asn.cfnu �[��� # SpamAssassin - ASN rules # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### # Requires the Mail::SpamAssassin::Plugin::ASN plugin be loaded. # This plugin queries asn.routeviews.org for ASN and route info and adds a # header containing the data returned so that it can be used by the bayes # tokenizer. See the plugin's POD docs for more info. # Apply default ASN rules for pre-4.0 clients only. # Usage changed in 4.0: there is also direct GeoDB/GeoIP support, # users should configure manually as described in plugin documentation. ifplugin Mail::SpamAssassin::Plugin::ASN if !(can(Mail::SpamAssassin::Plugin::ASN::has_check_asn)) asn_lookup asn.routeviews.org _ASN_ _ASNCIDR_ add_header all ASN _ASN_ _ASNCIDR_ # IPv6 support (Bug 7211) #if can(Mail::SpamAssassin::Plugin::ASN::has_asn_lookup_ipv6) # asn_lookup_ipv6 origin6.asn.cymru.com _ASN_ _ASNCIDR_ #endif endif # !has_check_asn endif # Mail::SpamAssassin::Plugin::ASN PK SI�\.�G�� � 0 3.004004/updates_spamassassin_org/20_freemail.cfnu �[��� # SpamAssassin - FreeMail rules # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### ifplugin Mail::SpamAssassin::Plugin::FreeMail body __freemail_safe_fwd /---\s?(?:(?:Forwarded|Original) message|Alkuper(?:\xe4|\xc3\xa4)inen viesti)/i header __freemail_safe_rls X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+\.(?:tfbnw\.net|ebay\.com|tieto\.com) / meta __freemail_safe __freemail_safe_fwd || __ML2 || __ML4 || __HAS_X_MAILING_LIST || __HAS_X_MAILMAN_VERSION || __freemail_safe_rls header __freemail_replyto eval:check_freemail_replyto('replyto') meta FREEMAIL_REPLYTO __freemail_replyto && !__freemail_safe describe FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails score FREEMAIL_REPLYTO 2 header __freemail_reply eval:check_freemail_replyto('reply') meta FREEMAIL_REPLY __freemail_reply && !__freemail_replyto && !__freemail_safe describe FREEMAIL_REPLY From and body contain different freemails score FREEMAIL_REPLY 0.5 header FREEMAIL_FROM eval:check_freemail_from() describe FREEMAIL_FROM Sender email is commonly abused enduser mail provider score FREEMAIL_FROM 0.001 header FREEMAIL_ENVFROM_END_DIGIT eval:check_freemail_header('EnvelopeFrom', '\d@') describe FREEMAIL_ENVFROM_END_DIGIT Envelope-from freemail username ends in digit score FREEMAIL_ENVFROM_END_DIGIT 0.1 header FREEMAIL_REPLYTO_END_DIGIT eval:check_freemail_header('Reply-To', '\d@') describe FREEMAIL_REPLYTO_END_DIGIT Reply-To freemail username ends in digit score FREEMAIL_REPLYTO_END_DIGIT 0.1 #header FREEMAIL_SUBJECT eval:check_freemail_header('Subject') #describe FREEMAIL_SUBJECT Subject contains freemail #score FREEMAIL_SUBJECT 0.001 # Idea from John Hardin header __freemail_hdr_replyto eval:check_freemail_header('Reply-To') meta FREEMAIL_FORGED_REPLYTO __freemail_hdr_replyto && !FREEMAIL_FROM && !__freemail_safe describe FREEMAIL_FORGED_REPLYTO Freemail in Reply-To, but not From score FREEMAIL_FORGED_REPLYTO 0.1 endif PK SI�\\��� � - 3.004004/updates_spamassassin_org/MIRRORED.BYnu �[��� #HOW TO UPDATE # # SOURCE: https://svn.apache.org/repos/asf/spamassassin/site/updates/ # # 'svn checkout' the repo, update this file, and commit it # # A svnpubsub update on spamassassin.apache.org will instantly pull # from SVN after the commit. # # A cron'd update on sa-vm.apache.org will also automatically pull # from SVN to /www/spamassassin.apache.org/updates which is also the # [updates] rsync module path the mirrors are syncing from. #CONTACT: hege@apache.org https://sa-update.mailfud.org/ weight=3 #CONTACT: Matthias Leisi http://sa-update.dnswl.org/ weight=3 #CONTACT: Kevin A. McGrail https://www.sa-update.pccc.com/ weight=5 #CONTACT: Rene Schwarz https://sa-update.space-pro.be/ weight=1 #CONTACT: Dave Jones http://sa-update.ena.com/ weight=5 #CONTACT: Dave Warren https://sa-update.razx.cloud/ weight=5 #CONTACT: Jens Schleusener # Removed per list reqest 27.7.2022 #http://sa-update.fossies.org/ weight=1 #CONTACT: tobisworld gmail http://sa-update.verein-clean.net/ weight=10 #CONTACT: Giovanni Bechis https://sa-update-asf.snb.it/ weight=5 #CONTACT: sysadmins@spamassassin.apache.org http://sa-update.spamassassin.org/ weight=10 PK SI�\�Ʀ>;I ;I - 3.004004/updates_spamassassin_org/25_uribl.cfnu �[��� # SpamAssassin - URIDNSBL rules # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### # Requires the Mail::SpamAssassin::Plugin::URIDNSBL plugin be loaded. # Note that this plugin defines a new config setting, 'uridnsbl', # which lists the zones to look up in advance. The rules will # not hit unless each rule has a corresponding 'uridnsbl' line. ifplugin Mail::SpamAssassin::Plugin::URIDNSBL ########################################################################### ## Spamhaus uridnssub URIBL_SBL zen.spamhaus.org. A 127.0.0.2 body URIBL_SBL eval:check_uridnsbl('URIBL_SBL') describe URIBL_SBL Contains an URL's NS IP listed in the Spamhaus SBL blocklist tflags URIBL_SBL net reuse URIBL_SBL uridnssub URIBL_CSS zen.spamhaus.org. A 127.0.0.3 body URIBL_CSS eval:check_uridnsbl('URIBL_CSS') describe URIBL_CSS Contains an URL's NS IP listed in the Spamhaus CSS blocklist tflags URIBL_CSS net reuse URIBL_CSS # Only works correctly from 3.4.3, earlier versions basically run as URIBL_SBL duplicate if can(Mail::SpamAssassin::Plugin::URIDNSBL::has_uridnsbl_for_a) uridnssub URIBL_SBL_A zen.spamhaus.org. A 127.0.0.2 body URIBL_SBL_A eval:check_uridnsbl('URIBL_SBL_A') describe URIBL_SBL_A Contains URL's A record listed in the Spamhaus SBL blocklist tflags URIBL_SBL_A net a reuse URIBL_SBL_A uridnssub URIBL_CSS_A zen.spamhaus.org. A 127.0.0.3 body URIBL_CSS_A eval:check_uridnsbl('URIBL_CSS_A') describe URIBL_CSS_A Contains URL's A record listed in the Spamhaus CSS blocklist tflags URIBL_CSS_A net a reuse URIBL_CSS_A endif # New blocked checks 10/2019 uridnssub URIBL_ZEN_BLOCKED_OPENDNS zen.spamhaus.org. A 127.255.255.254 body URIBL_ZEN_BLOCKED_OPENDNS eval:check_uridnsbl('URIBL_ZEN_BLOCKED_OPENDNS') describe URIBL_ZEN_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/ tflags URIBL_ZEN_BLOCKED_OPENDNS net reuse URIBL_ZEN_BLOCKED_OPENDNS # New blocked checks 10/2019 uridnssub URIBL_ZEN_BLOCKED zen.spamhaus.org. A 127.255.255.255 body URIBL_ZEN_BLOCKED eval:check_uridnsbl('URIBL_ZEN_BLOCKED') describe URIBL_ZEN_BLOCKED ADMINISTRATOR NOTICE: The query to zen.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/ tflags URIBL_ZEN_BLOCKED net reuse URIBL_ZEN_BLOCKED if can(Mail::SpamAssassin::Conf::feature_dns_block_rule) dns_block_rule URIBL_ZEN_BLOCKED_OPENDNS zen.spamhaus.org dns_block_rule URIBL_ZEN_BLOCKED zen.spamhaus.org endif # DBL, https://www.spamhaus.org/dbl/ # changes axb 05-17-2014: as per https://www.spamhaus.org/news/article/713/ # SH changes effective 06-01-2014 if can(Mail::SpamAssassin::Plugin::URIDNSBL::has_tflags_domains_only) urirhssub URIBL_DBL_SPAM dbl.spamhaus.org. A 127.0.1.2 body URIBL_DBL_SPAM eval:check_uridnsbl('URIBL_DBL_SPAM') describe URIBL_DBL_SPAM Contains a spam URL listed in the Spamhaus DBL blocklist tflags URIBL_DBL_SPAM net domains_only notrim reuse URIBL_DBL_SPAM urirhssub URIBL_DBL_PHISH dbl.spamhaus.org. A 127.0.1.4 body URIBL_DBL_PHISH eval:check_uridnsbl('URIBL_DBL_PHISH') describe URIBL_DBL_PHISH Contains a Phishing URL listed in the Spamhaus DBL blocklist tflags URIBL_DBL_PHISH net domains_only notrim reuse URIBL_DBL_PHISH urirhssub URIBL_DBL_MALWARE dbl.spamhaus.org. A 127.0.1.5 body URIBL_DBL_MALWARE eval:check_uridnsbl('URIBL_DBL_MALWARE') describe URIBL_DBL_MALWARE Contains a malware URL listed in the Spamhaus DBL blocklist tflags URIBL_DBL_MALWARE net domains_only notrim reuse URIBL_DBL_MALWARE urirhssub URIBL_DBL_BOTNETCC dbl.spamhaus.org. A 127.0.1.6 body URIBL_DBL_BOTNETCC eval:check_uridnsbl('URIBL_DBL_BOTNETCC') describe URIBL_DBL_BOTNETCC Contains a botned C&C URL listed in the Spamhaus DBL blocklist tflags URIBL_DBL_BOTNETCC net domains_only notrim reuse URIBL_DBL_BOTNETCC urirhssub URIBL_DBL_ABUSE_SPAM dbl.spamhaus.org. A 127.0.1.102 body URIBL_DBL_ABUSE_SPAM eval:check_uridnsbl('URIBL_DBL_ABUSE_SPAM') describe URIBL_DBL_ABUSE_SPAM Contains an abused spamvertized URL listed in the Spamhaus DBL blocklist tflags URIBL_DBL_ABUSE_SPAM net domains_only notrim reuse URIBL_DBL_ABUSE_SPAM urirhssub URIBL_DBL_ABUSE_REDIR dbl.spamhaus.org. A 127.0.1.103 body URIBL_DBL_ABUSE_REDIR eval:check_uridnsbl('URIBL_DBL_ABUSE_REDIR') describe URIBL_DBL_ABUSE_REDIR Contains an abused redirector URL listed in the Spamhaus DBL blocklist tflags URIBL_DBL_ABUSE_REDIR net domains_only notrim reuse URIBL_DBL_ABUSE_REDIR urirhssub URIBL_DBL_ABUSE_PHISH dbl.spamhaus.org. A 127.0.1.104 body URIBL_DBL_ABUSE_PHISH eval:check_uridnsbl('URIBL_DBL_ABUSE_PHISH') describe URIBL_DBL_ABUSE_PHISH Contains an abused phishing URL listed in the Spamhaus DBL blocklist tflags URIBL_DBL_ABUSE_PHISH net domains_only notrim reuse URIBL_DBL_ABUSE_PHISH urirhssub URIBL_DBL_ABUSE_MALW dbl.spamhaus.org. A 127.0.1.105 body URIBL_DBL_ABUSE_MALW eval:check_uridnsbl('URIBL_DBL_ABUSE_MALW') describe URIBL_DBL_ABUSE_MALW Contains an abused malware URL listed in the Spamhaus DBL blocklist tflags URIBL_DBL_ABUSE_MALW net domains_only notrim reuse URIBL_DBL_ABUSE_MALW urirhssub URIBL_DBL_ABUSE_BOTCC dbl.spamhaus.org. A 127.0.1.106 body URIBL_DBL_ABUSE_BOTCC eval:check_uridnsbl('URIBL_DBL_ABUSE_BOTCC') describe URIBL_DBL_ABUSE_BOTCC Contains an abused botnet C&C URL listed in the Spamhaus DBL blocklist tflags URIBL_DBL_ABUSE_BOTCC net domains_only notrim reuse URIBL_DBL_ABUSE_BOTCC # this indicates that IP-address queries were sent to DBL, and should # never appear; if it does, something is wrong with SpamAssassin urirhssub URIBL_DBL_ERROR dbl.spamhaus.org. A 127.0.1.255 body URIBL_DBL_ERROR eval:check_uridnsbl('URIBL_DBL_ERROR') describe URIBL_DBL_ERROR Error: queried the Spamhaus DBL blocklist for an IP tflags URIBL_DBL_ERROR net domains_only notrim reuse URIBL_DBL_ERROR # New blocked checks 10/2019 urirhssub URIBL_DBL_BLOCKED_OPENDNS dbl.spamhaus.org. A 127.255.255.254 body URIBL_DBL_BLOCKED_OPENDNS eval:check_uridnsbl('URIBL_DBL_BLOCKED_OPENDNS') describe URIBL_DBL_BLOCKED_OPENDNS ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked due to usage of an open resolver. See https://www.spamhaus.org/returnc/pub/ tflags URIBL_DBL_BLOCKED_OPENDNS net domains_only notrim reuse URIBL_DBL_BLOCKED_OPENDNS # New blocked checks 10/2019 urirhssub URIBL_DBL_BLOCKED dbl.spamhaus.org. A 127.255.255.255 body URIBL_DBL_BLOCKED eval:check_uridnsbl('URIBL_DBL_BLOCKED') describe URIBL_DBL_BLOCKED ADMINISTRATOR NOTICE: The query to dbl.spamhaus.org was blocked. See https://www.spamhaus.org/returnc/vol/ tflags URIBL_DBL_BLOCKED net domains_only notrim reuse URIBL_DBL_BLOCKED endif ########################################################################### ## SURBL #MERGED INTO BIT 64 per bug 7279 #urirhssub URIBL_SC_SURBL multi.surbl.org. A 2 #body URIBL_SC_SURBL eval:check_uridnsbl('URIBL_SC_SURBL') #describe URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist #tflags URIBL_SC_SURBL net notrim #reuse URIBL_SC_SURBL #REMOVED per bug 8093 #urirhssub URIBL_WS_SURBL multi.surbl.org. A 4 #body URIBL_WS_SURBL eval:check_uridnsbl('URIBL_WS_SURBL') #describe URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist #tflags URIBL_WS_SURBL net notrim #reuse URIBL_WS_SURBL urirhssub URIBL_PH_SURBL multi.surbl.org. A 8 body URIBL_PH_SURBL eval:check_uridnsbl('URIBL_PH_SURBL') describe URIBL_PH_SURBL Contains an URL listed in the PH SURBL blocklist tflags URIBL_PH_SURBL net notrim reuse URIBL_PH_SURBL urirhssub URIBL_MW_SURBL multi.surbl.org. A 16 body URIBL_MW_SURBL eval:check_uridnsbl('URIBL_MW_SURBL') describe URIBL_MW_SURBL Contains a URL listed in the MW SURBL blocklist tflags URIBL_MW_SURBL net notrim reuse URIBL_MW_SURBL urirhssub URIBL_CR_SURBL multi.surbl.org. A 128 body URIBL_CR_SURBL eval:check_uridnsbl('URIBL_CR_SURBL') describe URIBL_CR_SURBL Contains an URL listed in the CR SURBL blocklist tflags URIBL_CR_SURBL net notrim reuse URIBL_CR_SURBL #MERGED INTO BIT 64 per bug 7279 #urirhssub URIBL_AB_SURBL multi.surbl.org. A 32 #body URIBL_AB_SURBL eval:check_uridnsbl('URIBL_AB_SURBL') #describe URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist #tflags URIBL_AB_SURBL net notrim #reuse URIBL_AB_SURBL #JP MOVED INTO ABUSE AS WELL AND BIT REUSED per bug 7279 urirhssub URIBL_ABUSE_SURBL multi.surbl.org. A 64 body URIBL_ABUSE_SURBL eval:check_uridnsbl('URIBL_ABUSE_SURBL') describe URIBL_ABUSE_SURBL Contains an URL listed in the ABUSE SURBL blocklist tflags URIBL_ABUSE_SURBL net notrim reuse URIBL_ABUSE_SURBL #SURBL BLOCK RULES - Bit 1 means your DNS has been blocked and this rule should be triggered to notify you. urirhssub SURBL_BLOCKED multi.surbl.org. A 1 body SURBL_BLOCKED eval:check_uridnsbl('SURBL_BLOCKED') describe SURBL_BLOCKED ADMINISTRATOR NOTICE: The query to SURBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists\#dnsbl-block for more information. tflags SURBL_BLOCKED net noautolearn notrim reuse SURBL_BLOCKED if can(Mail::SpamAssassin::Conf::feature_dns_block_rule) dns_block_rule SURBL_BLOCKED multi.surbl.org endif ########################################################################### ## URIBL urirhssub URIBL_BLACK multi.uribl.com. A 2 body URIBL_BLACK eval:check_uridnsbl('URIBL_BLACK') describe URIBL_BLACK Contains an URL listed in the URIBL blacklist tflags URIBL_BLACK net reuse URIBL_BLACK urirhssub URIBL_GREY multi.uribl.com. A 4 body URIBL_GREY eval:check_uridnsbl('URIBL_GREY') describe URIBL_GREY Contains an URL listed in the URIBL greylist tflags URIBL_GREY net reuse URIBL_GREY urirhssub URIBL_RED multi.uribl.com. A 8 body URIBL_RED eval:check_uridnsbl('URIBL_RED') describe URIBL_RED Contains an URL listed in the URIBL redlist tflags URIBL_RED net reuse URIBL_RED #URIBL BLOCK RULES - Bit 1 means your DNS has been blocked and this rule should be triggered to notify you. urirhssub URIBL_BLOCKED multi.uribl.com. A 1 body URIBL_BLOCKED eval:check_uridnsbl('URIBL_BLOCKED') describe URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists\#dnsbl-block for more information. tflags URIBL_BLOCKED net noautolearn reuse URIBL_BLOCKED if can(Mail::SpamAssassin::Conf::feature_dns_block_rule) dns_block_rule URIBL_BLOCKED multi.uribl.com endif ########################################################################### ## DOMAINS TO SKIP (KNOWN GOOD) # Linting uridnsbl_skip_domain taint.org # Don't bother looking for example domains as per RFC 2606. uridnsbl_skip_domain example.com example.net example.org uridnsbl_skip_domain local.cf # MUA CSS class definitions uridnsbl_skip_domain div.tk p.tk li.tk no.tk # (roughly) top 200 domains not blacklisted by SURBL uridnsbl_skip_domain 126.com 163.com 2o7.net 4at1.com uridnsbl_skip_domain 5iantlavalamp.com about.com adelphia.net adobe.com addthis.com uridnsbl_skip_domain agora-inc.com agoramedia.com akamai.net uridnsbl_skip_domain akamaitech.net amazon.com ancestry.com aol.com uridnsbl_skip_domain apache.org apple.com arcamax.com astrology.com apple.news uridnsbl_skip_domain atdmt.com att.net bbc.co.uk uridnsbl_skip_domain bcentral.com bellsouth.net bfi0.com uridnsbl_skip_domain bridgetrack.com cafe24.com charter.net uridnsbl_skip_domain citibank.com citizensbank.com cjb.net uridnsbl_skip_domain classmates.com clickbank.net cnet.com uridnsbl_skip_domain cnn.com com.com com.ne.kr comcast.net uridnsbl_skip_domain corporate-ir.net cox.net cs.com uridnsbl_skip_domain custhelp.com daum.net dd.se debian.org uridnsbl_skip_domain dell.com directtrack.com directnic.com domain.com uridnsbl_skip_domain dsbl.org earthlink.net ebay.co.uk ebay.com uridnsbl_skip_domain ebayimg.com ebaystatic.com edgesuite.net ediets.com uridnsbl_skip_domain egroups.com emode.com excite.com f-secure.com uridnsbl_skip_domain free.fr freebsd.org uridnsbl_skip_domain gentoo.org geocities.com gmail.com gmx.net uridnsbl_skip_domain go.com google.com googleadservices.com grisoft.com uridnsbl_skip_domain hallmark.com hinet.net hotbar.com hotmail.com uridnsbl_skip_domain hotpop.com hp.com ibm.com incredimail.com uridnsbl_skip_domain investorplace.com ivillage.com joingevalia.com uridnsbl_skip_domain juno.com kernel.org livejournal.com lycos.com uridnsbl_skip_domain m7z.net mac.com macromedia.com uridnsbl_skip_domain mail.com mail.ru mailscanner.info marketwatch.com uridnsbl_skip_domain mcafee.com mchsi.com messagelabs.com uridnsbl_skip_domain microsoft.com military.com mindspring.com mit.edu uridnsbl_skip_domain monster.com msn.com nate.com uridnsbl_skip_domain netflix.com netscape.com netscape.net netzero.net uridnsbl_skip_domain norman.com nytimes.com optonline.net osdn.com uridnsbl_skip_domain overstock.com pacbell.net pandasoftware.com uridnsbl_skip_domain paypal.com peoplepc.com plaxo.com uridnsbl_skip_domain prodigy.net radaruol.com.br uridnsbl_skip_domain real.com redhat.com regions.com regionsnet.com uridnsbl_skip_domain rogers.com rr.com sbcglobal.net sec.gov sf.net uridnsbl_skip_domain shaw.ca shockwave.com smithbarney.com uridnsbl_skip_domain sourceforge.net spamcop.net speedera.net sportsline.com uridnsbl_skip_domain sun.com suntrust.com t-online.de uridnsbl_skip_domain tails.nl telus.net terra.com.br ticketmaster.com uridnsbl_skip_domain tinyurl.com tiscali.co.uk tom.com uridnsbl_skip_domain tone.co.nz tux.org uol.com.br uridnsbl_skip_domain ups.com verizon.net w3.org usps.com uridnsbl_skip_domain wamu.com wanadoo.fr washingtonpost.com weatherbug.com uridnsbl_skip_domain web.de webshots.com webtv.net wsj.com uridnsbl_skip_domain yahoo.ca yahoo.co.kr yahoo.co.uk uridnsbl_skip_domain yahoo.com yahoo.com.br yahoogroups.com yimg.com uridnsbl_skip_domain yopi.de yoursite.com zdnet.com uridnsbl_skip_domain openxmlformats.org passport.com xmlsoap.org uridnsbl_skip_domain abc.xyz avast.com schema.org # wtogami's most frequent known good URIDNSBL lookups (1/1/2011) uridnsbl_skip_domain alexa.com ask.com baidu.com bing.com craigslist.org uridnsbl_skip_domain doubleclick.com ebay.de facebook.com flickr.com godaddy.com uridnsbl_skip_domain google.co.in google.it mozilla.com myspace.com rediff.com uridnsbl_skip_domain twitter.com wordpress.com yahoo.co.jp youtube.com # axb's frequent known good URIDNSBL lookups uridnsbl_skip_domain fedex.com uridnsbl_skip_domain openoffice.org uridnsbl_skip_domain vk.com # pointless footer noise uridnsbl_skip_domain security.cloud uridnsbl_skip_domain yac.mx # Microsoft on ns1.msedge.net uridnsbl_skip_domain microsofttranslator.com office.com microsoftonline.com bing.com msedge.net # Some frequent known good URIDNSBL lookups 3.10.2018 -hk uridnsbl_skip_domain aka.ms akamaihd.net alibaba.com alicdn.com amazon.co.uk uridnsbl_skip_domain amazon.de amazonses.com bandcamp.com uridnsbl_skip_domain booking.com cdninstagram.com dhl.com uridnsbl_skip_domain dhl.fi dna.fi domain.fi dpd.de dropbox.com ebay.fr uridnsbl_skip_domain elisa.fi elisanet.fi emltrk.com fbcdn.net ficora.fi uridnsbl_skip_domain gappssmtp.com github.com google-analytics.com uridnsbl_skip_domain google.de google.fi googleusercontent.com uridnsbl_skip_domain gstatic.com hotels.com ikea.com images-amazon.com uridnsbl_skip_domain inet.fi instagram.com kolumbus.fi licdn.com linkedin.com uridnsbl_skip_domain media-amazon.com mtasv.net mzstatic.com nebula.fi uridnsbl_skip_domain nic.fi onmicrosoft.com oracle.com paypalobjects.com uridnsbl_skip_domain pinimg.com pinterest.com posti.com posti.fi pstmrk.it uridnsbl_skip_domain skype.com soundcloud.com ssl-images-amazon.com uridnsbl_skip_domain suomi24.fi t.co telia.com telia.fi tnt.com tori.fi uridnsbl_skip_domain tripadvisor.com twimg.com youtu.be # Some more frequent known good URIDNSBL lookups 10.4.2020 -hk uridnsbl_skip_domain docs.google.com etuovi.com iki.fi nflxext.com nflximg.com uridnsbl_skip_domain nflximg.net outlook.com postnord.com postnord.fi postnord.no uridnsbl_skip_domain saunalahti.fi endif # Mail::SpamAssassin::Plugin::URIDNSBL PK SI�\ B 3.004004/updates_spamassassin_org/STATISTICS-set2-72_scores.cf.txtnu �[��� PK SI�\���y y 1 3.004004/updates_spamassassin_org/20_uri_tests.cfnu �[��� # SpamAssassin rules file: URI tests # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### require_version 3.004004 # possible IDN spoofing attack: https://web.archive.org/web/20141006091906/https://www.shmoo.com/idn/homograph.txt # not expecting any hits on this (yet) uri HIGH_CODEPAGE_URI /^https?:\/\/[^\/]*\&\#(?:\d{4,}|[3456789]\d\d);/i tflags HIGH_CODEPAGE_URI userconf ########################################################################### # Redirector URI patterns redirector_pattern /^http:\/\/chkpt\.zdnet\.com\/chkpt\/\w+\/(.*)$/i redirector_pattern /^http:\/\/www(?:\d+)?\.nate\.com\/r\/\w+\/(.*)$/i redirector_pattern /^http:\/\/.+\.gov\/(?:.*\/)?externalLink\.jhtml\?.*url=(.*?)(?:&.*)?$/i redirector_pattern /^http:\/\/redir\.internet\.com\/.+?\/.+?\/(.*)$/i redirector_pattern /^http:\/\/(?:.*?\.)?adtech\.de\/.*(?:;|\|)link=(.*?)(?:;|$)/i redirector_pattern m'^http.*?/redirect\.php\?.*(?<=[?&])goto=(.*?)(?:$|[&\#])'i redirector_pattern m'^https?:/*(?:[^/]+\.)?emf\d\.com/r\.cfm.*?&r=(.*)'i uri NUMERIC_HTTP_ADDR m{^https?://[\d.]+(?:[:/?\#]|$)}i describe NUMERIC_HTTP_ADDR Uses a numeric IP address in URL # Theo sez: # Have gotten FPs off this, and whitespace can't be in the host, so... # % Visit my homepage: http://i.like.foo.com % # Also ignore some bad parses like http://foo.bar%20http://foo.bar uri HTTP_ESCAPED_HOST /^https?\:\/\/[^\/\s\?\&\#\']*(?!%(?:20|3[cCeE])(?:https?:|mailto:))%[0-9a-fA-F][0-9a-fA-F]/ describe HTTP_ESCAPED_HOST Uses %-escapes inside a URL's hostname # look for URI with escaped 0-9, A-Z, or a-z characters (all other safe # characters have been well-tested, but are sometimes unnecessarily escaped # in nonspam; requiring "http" or "https" also reduces false positives). uri HTTP_EXCESSIVE_ESCAPES /^https?:\/\/\S*%(?:3\d|[46][1-9a-f]|[57][\da])/i describe HTTP_EXCESSIVE_ESCAPES Completely unnecessary %-escapes inside a URL # bug 1801 uri IP_LINK_PLUS m{^https?://\d+\.\d+\.\d+\.\d+.{0,20}(?:cgi|click|ads|id=)}i describe IP_LINK_PLUS Dotted-decimal IP address followed by CGI # allow ports 80 and 443 which are http and https, respectively # we don't want to hit http://www.cnn.com:USArticle1840@www.liquidshirts.com/ # though, which actually doesn't have a weird port in it. uri WEIRD_PORT m{https?://[^/?\s]+?:\d+(?<!:80)(?<!:443)(?<!:8080)(?:/|\s|$)} describe WEIRD_PORT Uses non-standard port number for HTTP # Matt Cline # Pretty good for most folks, except for jm: I have a really stupid # e-commerce bunch obfuscating their URLs with this for some reason. screw 'em # jm: hesitant to remove this outright; it should be good against phishers #uri HTTP_ENTITIES_HOST m{https?://[^\s\">/]*\&\#[\da-f]+}i #describe HTTP_ENTITIES_HOST URI obscured with character entities uri YAHOO_RD_REDIR m{^https?\://rd\.yahoo\.com/(?:[0-9]{4}|partner\b|dir\b)}i describe YAHOO_RD_REDIR Has Yahoo Redirect URI uri YAHOO_DRS_REDIR m{^https?://drs\.yahoo\.com/}i describe YAHOO_DRS_REDIR Has Yahoo Redirect URI # "www" hidden as "%77%77%77", "ww%77", etc. # note: *not* anchored to start of string, to catch use of redirectors uri HTTP_77 /http:\/\/.{0,2}\%77/ describe HTTP_77 Contains an URL-encoded hostname (HTTP77) # a.com.b.c uri SPOOF_COM2OTH m{^https?://(?:\w+\.)+?com\.(?!(?:[a-z]{2}\.)?s3\.amazonaws\.com|\w+\.psmtp\.com)(?:\w+\.){2}}i describe SPOOF_COM2OTH URI contains ".com" in middle # a.com.b.com uri __SPOOF_COM2COM m{^https?://(?:\w+\.)+?com\.(?!(?:[a-z]{2}\.)?s3\.amazonaws\.com|\w+\.psmtp\.com)(?:\w+\.)+?com\b}i meta SPOOF_COM2COM __SPOOF_COM2COM && !SPOOF_COM2OTH describe SPOOF_COM2COM URI contains ".com" in middle and end # a.net.b.com uri SPOOF_NET2COM m{^https?://(?:\w+\.)+?(?:net|org)\.(?!(?:[a-z]{2}\.)?s3\.amazonaws\.com)(?:\w+\.)+?com\b}i describe SPOOF_NET2COM URI contains ".net" or ".org", then ".com" uri URI_HEX m%^https?://[^/?&\#]*\b(?![0-9a-f]{0,12}[a-f]{3})[0-9a-f]{6,}\b%i describe URI_HEX URI hostname has long hexadecimal sequence uri URI_NOVOWEL m%^https?://[^/?&\#]*[bcdfgjklmnpqrstvwxz]{7}%i describe URI_NOVOWEL URI hostname has long non-vowel sequence tflags URI_NOVOWEL userconf # lock scores low uri URI_UNSUBSCRIBE /\b(?:gone|opened|out)\.php/i describe URI_UNSUBSCRIBE URI contains suspicious unsubscribe link # bug 3896: URIs in various TLDs, other than 3rd level www uri URI_NO_WWW_INFO_CGI /^(?:https?:\/\/)?[^\/]+(?<!\/www)\.[^.]{7,}\.info\/(?=\S{15,})\S*\?/i describe URI_NO_WWW_INFO_CGI CGI in .info TLD other than third-level "www" uri URI_NO_WWW_BIZ_CGI /^(?:https?:\/\/)?[^\/]+(?<!\/www)\.[^.]{7,}\.biz\/(?=\S{15,})\S*\?/i describe URI_NO_WWW_BIZ_CGI CGI in .biz TLD other than third-level "www" ########################################################################### uri NORMAL_HTTP_TO_IP m{^https?://(?!1(?:0|27|69\.254|72\.(?:1[6-9]|2\d|3[01])|92\.168)\.)\d+\.\d+\.\d+\.\d+\b(?![.-])}i describe NORMAL_HTTP_TO_IP URI host has a public dotted-decimal IPv4 address PK SI�\s�|� 0 3.004004/updates_spamassassin_org/25_accessdb.cfnu �[��� # SpamAssassin rules file: accessdb tests # # Please don't modify this file as your changes will be overwritten with # the next update. Use /etc/mail/spamassassin/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### ifplugin Mail::SpamAssassin::Plugin::AccessDB # this code uses an access database (sendmail, postfix, etc.) # Since you need to actively create an accessdb to use it, the plugin # and rule is considered userconf and is disabled by default. header ACCESSDB eval:check_access_database('/etc/mail/access.db') describe ACCESSDB Message would have been caught by accessdb tflags ACCESSDB userconf score ACCESSDB 0 endif PK SI�\�*=�<