# SpamAssassin rules file: fake-HELO tests # # Please don't modify this file as your changes will be overwritten with # the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead. # See 'perldoc Mail::SpamAssassin::Conf' for details. # # We should write a new ruletype for these, to save typing. # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # # ########################################################################### require_version @@VERSION@@ #--------------------------------------------------------------------------- # Handle hosts that look like HELO_DYNAMIC hosts # cmr-208-124-139-194.cr.net.cable.rogers.com) [208.124.139.194] # cmr-208-97-119-114.cr.net.cable.rogers.com) [208.97.119.114] header __HELO_STATIC_ROGERS X-Spam-Relays-External =~ /^[^\]]+ helo=cmr-\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}\S+\.rogers\.com[^\]]+ auth= /i # o167-89-97-77.outbound-mail.sendgrid.net (bug 7592) header __HELO_STATIC_SENDGRID X-Spam-Relays-External =~ /^[^\]]+ helo=o\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}\.outbound-mail\.sendgrid\.net\s[^\]]+ auth= /i # 50-203-126-142-static.hfc.comcastbusiness.net header __HELO_STATIC_COMCAST X-Spam-Relays-External =~ /^[^\]]+ helo=\d{1,3}-\d{1,3}-\d{1,3}-\d{1,3}-static\.hfc\.comcastbusiness\.net\s[^\]]+ auth= /i # smtp-0f95944d4245d0b2c.core1.sfdc-58ktaz.mta.salesforce.com header __HELO_STATIC_SALESFORCE X-Spam-Relays-External =~ /^[^\]]+ helo=smtp\-\w+\.core\d\.sfdc\-\w+\.mta\.salesforce\.com\s[^\]]+ auth= /i describe HELO_STATIC_HOST Relay HELO'd using static hostname meta HELO_STATIC_HOST (__HELO_STATIC_ROGERS || __HELO_STATIC_SENDGRID || __HELO_STATIC_COMCAST || __HELO_STATIC_SALESFORCE) # --------------------------------------------------------------------------- # Suresh says: these will never be used as HELOs from real mail.com relays. # Just check the most recent handover; the connection to a internal host. # This way a legit sender can send to their MSA using that HELO (quite a few # MUAs will do that), but a spammer gets caught. (List of domains comes from # the drop-down list on the Mail.com signup page.) #header FAKE_HELO_MAIL_COM_DOM X-Spam-Relays-External =~ /^[^\]]+ helo=(?:\S+\.|)(?:(?:mail|email|iname|cheerful|consultant|europe|mindless|myself|post|techie|usa|writeme|2die4|artlover|bikerider|catlover|cliffhanger|cutey|doglover|gardener|hot-shot|inorbit|loveable|mad\.scientist|playful|poetic|popstar|saintly|seductive|soon|whoever|winning|witty|yours|africamail|arcticmail|asia|australiamail|europe|japan|samerica|usa|berlin|dublin|london|madrid|moscowmail|munich|nycmail|paris|rome|sanfranmail|singapore|tokyo|accountant|adexec|allergist|alumnidirector|archaeologist|chemist|clerk|columnist|comic|consultant|counsellor|deliveryman|diplomats|doctor|dr|engineer|execs|financier|geologist|graphic-designer|insurer|journalist|lawyer|legislator|lobbyist|minister|optician|pediatrician|presidency|priest|publicist|realtyagent|registerednurses|repairman|representative|rescueteam|scientist|sociologist|teacher|techietechnologist|umpire)\.com|(?:programmer|earthling|hairdresser)\.net|musician\.org) /i #describe FAKE_HELO_MAIL_COM_DOM Relay HELO'd with suspicious hostname (mail.com) # --------------------------------------------------------------------------- # Interesting new feature; spamware HELO'ing, from a dialup IP addr, # using that IP's rDNS entry. We can catch this easily. There aren't # many legit mailservers calling themselves # 'dhcp024-210-034-053.columbus.rr.com'. ;) # # Note the '^[^\]]+ ' stanza: this ensures that we only match spamware # connecting to a internal relay; if a mail came from a dynamic addr but # was relayed through their smarthost, that's fine. # See bug #5856, all references of trusted were changed to internal # dhcp024-210-034-053.columbus.rr.com [24.210.34.53] # c-66-176-16-108.se.client2.attbi.com [66.176.16.108] # c-67-168-174-61.client.comcast.net [67.168.174.61] # NNN-NNN-NNN-NNN.fibertel.com.ar # NN.NN.NNN.NNN.ap.yournet.ne.jp # NN.NNN.NN-NN.rev.gaoland.net # vaise-1-82-67-44-166.fbx.proxad.net [82.67.44.166] # lns-vlq-11-62-147-186-141.adsl.proxad.net [62.147.186.141] # dsl-200-95-109-107.prod-infinitum.com.mx [200.95.109.107] # port-212-202-77-203.reverse.qsc.de [212.202.77.203] # pool-151-203-32-68.bos.east.verizon.net [151.203.32.68] # c-67-164-133-216.client.comcast.net [67.164.133.216] # 200-171-228-6.customer.telesp.net.br [200.171.228.6] # modemcable090.28-201-24.mc.videotron.ca [24.201.28.90] # 80-218-47-160.dclient.hispeed.ch [80.218.47.160] # cdm-68-226-239-16.laft.cox-internet.com [68.226.239.16] # d53-64-35-171.nap.wideopenwest.com [64.53.171.35] # 74.67-201-80.adsl.skynet.be [80.201.67.74] # 12-218-225-223.client.mchsi.com [12.218.225.223] # (require an alpha first, as legit HELO'ing-as-IP-address is hit otherwise) header __HELO_DYNAMIC_IPADDR X-Spam-Relays-External =~ /^[^\]]+ helo=(?![^\s\]]+[-.]static[-.])[a-z]\S*\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+[^\d\s][^\.]*\.\S+\.\S+[^\]]+ auth= /i meta HELO_DYNAMIC_IPADDR (__HELO_DYNAMIC_IPADDR && !HELO_STATIC_HOST) describe HELO_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1) # dhcp024-210-034-053.columbus.rr.com [24.210.34.53] # catv-506237d8.miskcatv.broadband.hu [80.98.55.216] # node-c-8b22.a2000.nl # cm89.omega139.maxonline.com.sg # cm114.gamma208.maxonline.com.sg header __HELO_DYNAMIC_DHCP X-Spam-Relays-External =~ /^[^\]]+ helo=\S*(?:(?