sb-blacklists.rc

这是一个从音频信号里提取特征参量的程序

# This series of recipes checks various IPs and/or domains associated with
# a particular email message against assorted blacklists.

# Dorkslayers Check
:0
* DORKSLCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.orbs.dorkslayers.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in Dorkslayers"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}



# DSBL Check
:0
* DSBLCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.list.dsbl.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in the DSBL (main)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# DSBL Multi-Stage Relay Check
:0
* DSBLMULTICHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.multihop.dsbl.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in the DSBL (multi-stage)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# Five-Ten-SG Blacklist Checks
#
# five-ten-sg.com has a bunch of different blacklists, and
# the SpamBouncer can be configured to check any arbitrary
# list of them.  This recipe is written to minimize the number
# of hits on the five-ten-sg site itself.

:0
{ RUNCHECK=no }

:0
* FTSGDIALCHECK ?? yes
{ RUNCHECK=yes }

:0
* FTSGIGNORECHECK ?? yes
{ RUNCHECK=yes }

:0
* FTSGMULTICHECK ?? yes
{ RUNCHECK=yes }

:0
* FTSGOPTOUTCHECK ?? yes
{ RUNCHECK=yes }

:0
* FTSGOTHERCHECK ?? yes
{ RUNCHECK=yes }

:0
* FTSGRSSCHECK ?? yes
{ RUNCHECK=yes }

:0
* FTSGSRCCHECK ?? yes
{ RUNCHECK=yes }

:0
* FTSGWEBFORMCHECK ?? yes
{ RUNCHECK=yes }

:0
* RUNCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.blackholes.five-ten-sg.com` }

  :0
  * FTSGSRCCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.2
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in five-ten-sg (spam sources)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGDIALCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.3
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in five-ten-sg (dial-ups)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGOPTOUTCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.4
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in five-ten-sg (opt-out lists)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGMULTICHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.5
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in five-ten-sg (multi-stage open relay)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGRSSCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.6
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in five-ten-sg (open relay)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGIGNORECHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.7
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in five-ten-sg (ignores spam complaints)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGWEBFORMCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.8
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in five-ten-sg (insecure web form)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGOTHERCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.9
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in five-ten-sg (other issues)"

    :0
   { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }
 }

 :0
 * $!SECONDEXIP ?? 000.000.000.000
 * $!SECONDEXIP ?? ${FIRSTEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXREVIP}.blackholes.five-ten-sg.com` }

  :0
  * FTSGSRCCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.2
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in five-ten-sg (spam sources)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGOPTOUTCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.4
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in five-ten-sg (opt-out lists)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGIGNORECHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.7
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in five-ten-sg (ignores spam complaints)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGWEBFORMCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.8
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in five-ten-sg (insecure web form)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGOTHERCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.9
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in five-ten-sg (other issues)"

    :0
   { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }
 }

 :0
 * $!THIRDEXIP ?? 000.000.000.000
 * $!THIRDEXIP ?? ${FIRSTEXIP}
 * $!THIRDEXIP ?? ${SECONDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXREVIP}.blackholes.five-ten-sg.com` }

  :0
  * FTSGSRCCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.2
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in five-ten-sg (spam sources)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGOPTOUTCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.4
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in five-ten-sg (opt-out lists)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGIGNORECHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.7
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in five-ten-sg (ignores spam complaints)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGWEBFORMCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.8
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in five-ten-sg (insecure web form)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGOTHERCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.9
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in five-ten-sg (other issues)"

    :0
   { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }
 }

 :0
 * $!FOURTHEXIP ?? 000.000.000.000
 * $!FOURTHEXIP ?? ${FIRSTEXIP}
 * $!FOURTHEXIP ?? ${SECONDEXIP}
 * $!FOURTHEXIP ?? ${THIRDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXREVIP}.blackholes.five-ten-sg.com` }

  :0
  * FTSGSRCCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.2
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in five-ten-sg (spam sources)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGOPTOUTCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.4
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in five-ten-sg (opt-out lists)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGIGNORECHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.7
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in five-ten-sg (ignores spam complaints)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGWEBFORMCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.8
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in five-ten-sg (insecure web form)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGOTHERCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.9
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in five-ten-sg (other issues)"

    :0
   { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }
 }
}


# MAPS Dial-Up List Check
:0
* DULCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.dialups.mail-abuse.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in the MAPS DUL"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# MAPS Realtime Blackhole List Check
:0
* RBLCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.blackholes.mail-abuse.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in the MAPS RBL"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!SECONDEXIP ?? 000.000.000.000
 * $!SECONDEXIP ?? ${FIRSTEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXREVIP}.blackholes.mail-abuse.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in the MAPS RBL"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!THIRDEXIP ?? 000.000.000.000
 * $!THIRDEXIP ?? ${FIRSTEXIP}
 * $!THIRDEXIP ?? ${SECONDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXREVIP}.blackholes.mail-abuse.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in the MAPS RBL"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!FOURTHEXIP ?? 000.000.000.000
 * $!FOURTHEXIP ?? ${FIRSTEXIP}
 * $!FOURTHEXIP ?? ${SECONDEXIP}
 * $!FOURTHEXIP ?? ${THIRDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXREVIP}.blackholes.mail-abuse.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in the MAPS RBL"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# MAPS Relay Spam Stopper List Check
:0
* RSSCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.relays.mail-abuse.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in the MAPS RSS"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# Monkeys.com formmail.pl blacklist Check
:0
* MONKEYFORMMAILCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.formmail.relays.monkeys.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in monkeys.com (insecure web form)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!SECONDEXIP ?? 000.000.000.000
 * $!SECONDEXIP ?? ${FIRSTEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXREVIP}.formmail.relays.monkeys.com` }