-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathrules
103 lines (84 loc) · 2.87 KB
/
rules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
# /etc/milter-regex.conf
accept
connect // /127.0.0.1/
# whitelist some criteria first
accept
helo /whitelist/
helo /WORLD/
connect /gprs-gateway/ /193.247.250.1/
envfrom /ebay\.com/i
envfrom /hushgames\.com/i
envfrom /amazon\.com/i
envfrom /yoyofactory/i
envfrom /travel\.ch/i
envfrom /keyserver-beta.pgp.com/i
envfrom /yahoo.com/i
envfrom /ac.uk/i
envfrom /sgi.org.uk/i
header /From/ /Mathieu Sauve-Frankel/
header /From/ /ebay\.com/i
header /From/ /sabresfc11@aol\.com/i
header /From/ /ictp\.ch/i
header /From/ /tera-byte/i
header /From/ /google\.com/i
header /Subject/ /item/i
header /Subject/ /dorabella/i
header /Subject/ /elgar/i
header /Subject/ /malvern/i
# annoying bounces
discard
header /^From$/ /^Mail Delivery System <[email protected]>$/
reject "You fucked up, go away."
header /^From$/ /jobsuchmaschine\.ch/
#tempfail "Sender IP address not resolving"
#connect /\[.*\..*\]/ //
reject "Malformed HELO (not a domain, no dot)"
helo /\./n
reject "Spoofed HELO (my own IP address, nice try)"
helo /62\.65\.145\.30/
helo /127\.0\.0\.1/
# This is rather pointless, some receivers do callback checks using <>
# and refuse service if you're not accepting <> (which is RFC compliant
# for bounces). And sendmail itself will enforce legitimate format for
# non-empty forms (enforcing a @, checking the domain, etc.).
#reject "Malformed MAIL FROM (not an email address or <>)"
#envfrom /(<>|<.*@.*>)/en
reject "Malformed RCPT TO (not an email address, not <.*@.*>)"
envrcpt /<(.*@.*|Postmaster)>/ein
reject "HTML mail not accepted"
( header ,^Content-Type$,i ,^text/html,i or \
body ,^Content-Type: text/html,i ) and not \
header ,^From$, ,deraadt,
reject "Swen worm (caps)"
header /^(TO|FROM|SUBJECT)$/e // and \
not header /^From$/i /telus.blackberry.net/
#reject "Swen worm (boundary)"
#header /^Content-Type$/i /boundary="Boundary_(ID_/i
#header /^Content-Type$/i /boundary="[a-z]*"/
reject "Swen worm (body)"
body ,^Content-Type: audio/x-wav; name="[a-z]*\.[a-z]*",i
body ,^Content-Type: application/x-msdownload; name="[a-z]*\.[a-z]*",i
reject "Unwanted (executable) attachment type"
header ,^Content-Type$, ,multipart/mixed, and \
body ,^Content-Type: application/, and \
body ,name=".*\.(pif|exe|scr|com|bat|rar)"$,e
reject "Opt-out 'mailing list', spam, get lost (otcjournal)"
header /^X-List-Host$/ /otcjournal/i
header /^List-Owner$/ /smallcapnetwork/i
reject "sonicsurf.ch spam, get lost"
header /^Received$/ /\[195\.129\.5[89]\..*\]/
reject "Eat your socks, you fscking spammer."
body /^The New Media Publishers AG/i
body /^New.*Media.*Publisher/i
body /^Socks and more AG/i
body /^Business Corp\. for W\.& L\. AG/i
body /Horizon *Business *Corp/
body /Postfach, 6062 Wilen/i
body /041.*661.*17.*(18|19|20)/e
body /043.*317.*02.*8[0-9]/
body /0_4_1_/
body /W_i_l_e_n/i
body ,^Ort/Datum:.*____,
# generic spammers
reject "Spammer"
header /^From$/i /link-builder\.com/i