mailcow-dockerized/data/conf/rspamd/local.d/rbl_group.conf

symbols = {
  "RBL_UCEPROTECT_LEVEL1" {
    score = 3.5;
  }
  "RBL_UCEPROTECT_LEVEL2" {
    score = 1.5;
  }
  "RECEIVED_SPAMHAUS_XBL" {
    weight = 0.0;
    description = "Received address is listed in ZEN XBL";
  }
  "RBL_INTERSERVER_BAD_URI" {
    score = 4.0;
    description = "Listed on Interserver RBL";
  }
  "RBL_INTERSERVER_BAD_IP" {
    score = 4.0;
    description = "Listed on Interserver RBL";
  }

  "SPAMHAUS_ZEN" {
      weight = 7.0;
      }
  "SH_AUTHBL_RECEIVED" {
      weight = 4.0;
      }
  "RBL_DBL_SPAM" {
      weight = 7.0;
      }
  "RBL_DBL_PHISH" {
      weight = 7.0;
      }
  "RBL_DBL_MALWARE" {
      weight = 7.0;
      }
  "RBL_DBL_BOTNET" {
      weight = 7.0;
      }
  "RBL_DBL_ABUSED_SPAM" {
      weight = 3.0;
      }
  "RBL_DBL_ABUSED_PHISH" {
      weight = 3.0;
      }
  "RBL_DBL_ABUSED_MALWARE" {
      weight = 3.0;
      }
  "RBL_DBL_ABUSED_BOTNET" {
      weight = 3.0;
      }
  "RBL_ZRD_VERY_FRESH_DOMAIN" {
      weight = 7.0;
      }
  "RBL_ZRD_FRESH_DOMAIN" {
      weight = 4.0;
      }
  "ZRD_VERY_FRESH_DOMAIN" {
      weight = 7.0;
      }
  "ZRD_FRESH_DOMAIN" {
      weight = 4.0;
      }
  "SH_EMAIL_DBL" {
      weight = 7.0;
      }
  "SH_EMAIL_DBL_ABUSED" {
      weight = 7.0;
      }
  "SH_EMAIL_ZRD_VERY_FRESH_DOMAIN" {
      weight = 7.0;
      }
  "SH_EMAIL_ZRD_FRESH_DOMAIN" {
      weight = 4.0;
      }
  "RBL_DBL_DONT_QUERY_IPS" {
      weight = 0.0;
      }
  "RBL_ZRD_DONT_QUERY_IPS" {
      weight = 0.0;
      }
  "SH_EMAIL_ZRD_DONT_QUERY_IPS" {
      weight = 0.0;
      }
  "SH_EMAIL_DBL_DONT_QUERY_IPS" {
      weight = 0.0;
      }
  "DBL" {
      weight = 0.0;
      description = "DBL unknown result";
      groups = ["spamhaus"];
  }
  "DBL_SPAM" {
      weight = 7;
      description = "DBL uribl spam";
      groups = ["spamhaus"];
  }
  "DBL_PHISH" {
      weight = 7;
      description = "DBL uribl phishing";
      groups = ["spamhaus"];
  }
  "DBL_MALWARE" {
      weight = 7;
      description = "DBL uribl malware";
      groups = ["spamhaus"];
  }
  "DBL_BOTNET" {
      weight = 7;
      description = "DBL uribl botnet C&C domain";
      groups = ["spamhaus"];
  }


  "DBLABUSED_SPAM_FULLURLS" {
      weight = 5.5;
      description = "DBL uribl abused legit spam";
      groups = ["spamhaus"];
  }
  "DBLABUSED_PHISH_FULLURLS" {
      weight = 5.5;
      description = "DBL uribl abused legit phish";
      groups = ["spamhaus"];
  }
  "DBLABUSED_MALWARE_FULLURLS" {
      weight = 5.5;
      description = "DBL uribl abused legit malware";
      groups = ["spamhaus"];
  }
  "DBLABUSED_BOTNET_FULLURLS" {
      weight = 5.5;
      description = "DBL uribl abused legit botnet";
      groups = ["spamhaus"];
  }
  
  "DBL_ABUSE" {
      weight = 5.5;
      description = "DBL uribl abused legit spam";
      groups = ["spamhaus"];
  }
  "DBL_ABUSE_REDIR" {
      weight = 1.5;
      description = "DBL uribl abused spammed redirector domain";
      groups = ["spamhaus"];
  }
  "DBL_ABUSE_PHISH" {
      weight = 5.5;
      description = "DBL uribl abused legit phish";
      groups = ["spamhaus"];
  }
  "DBL_ABUSE_MALWARE" {
      weight = 5.5;
      description = "DBL uribl abused legit malware";
      groups = ["spamhaus"];
  }
  "DBL_ABUSE_BOTNET" {
      weight = 5.5;
      description = "DBL uribl abused legit botnet C&C";
      groups = ["spamhaus"];
  }
  "DBL_PROHIBIT" {
      weight = 0.0;
      description = "DBL uribl IP queries prohibited!";
      groups = ["spamhaus"];
  }
  "DBL_BLOCKED_OPENRESOLVER" {
    weight = 0.0;
    description = "You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/";
    groups = ["spamhaus"];
  }
  "DBL_BLOCKED" {
    weight = 0.0;
    description = "You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/";
    groups = ["spamhaus"];
  }
  "SPAMHAUS_ZEN_URIBL" {
      weight = 0.0;
      description = "Spamhaus ZEN URIBL: Filtered result";
      groups = ["spamhaus"];
  }
  "URIBL_SBL" {
      weight = 6.5;
      description = "A domain in the message body resolves to an IP listed in Spamhaus SBL";
      one_shot = true;
      groups = ["spamhaus"];
  }
  "URIBL_SBL_CSS" {
      weight = 6.5;
      description = "A domain in the message body resolves to an IP listed in Spamhaus SBL CSS";
      one_shot = true;
      groups = ["spamhaus"];
  }
  "URIBL_PBL" {
      weight = 0.01;
      description = "A domain in the message body resolves to an IP listed in Spamhaus PBL";
      one_shot = true;
      groups = ["spamhaus"];
  }
  "URIBL_DROP" {
      weight = 6.5;
      description = "A domain in the message body resolves to an IP listed in Spamhaus DROP";
      one_shot = true;
      groups = ["spamhaus"];
  }
  "URIBL_XBL" {
      weight = 5.0;
      description = "A domain in the message body resolves to an IP listed in Spamhaus XBL";
      one_shot = true;
      groups = ["spamhaus"];
  }
  "SPAMHAUS_SBL_URL" {
      weight = 6.5;
      description = "A numeric URL in the message body is listed in Spamhaus SBL";
      one_shot = true;
      groups = ["spamhaus"];
  }

  "SH_HBL_EMAIL" {
      weight = 7;
      description = "Email listed in HBL";
      groups = ["spamhaus"];
  }

  "SH_HBL_FILE_MALICIOUS" {
      weight = 7;
      description = "An attachment hash is listed in Spamhaus HBL as malicious";
      groups = ["spamhaus"];
  }

  "SH_HBL_FILE_SUSPICIOUS" {
      weight = 5;
      description = "An attachment hash is listed in Spamhaus HBL as suspicious";
      groups = ["spamhaus"];
  }

  "RBL_SPAMHAUS_CW_BTC" {
      score = 7;
      description = "Bitcoin found in Spamhaus cryptowallet list";
      groups = ["spamhaus"];
  }

  "RBL_SPAMHAUS_CW_ETH" {
      score = 7;
      description = "Ethereum found in Spamhaus cryptowallet list";
      groups = ["spamhaus"];
  }

  "RBL_SPAMHAUS_CW_BCH" {
      score = 7;
      description = "Bitcoinhash found in Spamhaus cryptowallet list";
      groups = ["spamhaus"];
  }

  "RBL_SPAMHAUS_CW_XMR" {
      score = 7;
      description = "Monero found in Spamhaus cryptowallet list";
      groups = ["spamhaus"];
  }

  "RBL_SPAMHAUS_CW_LTC" {
      score = 7;
      description = "Litecoin found in Spamhaus cryptowallet list";
      groups = ["spamhaus"];
  }

  "RBL_SPAMHAUS_CW_XRP" {
      score = 7;
      description = "Ripple found in Spamhaus cryptowallet list";
      groups = ["spamhaus"];
  }

  "RBL_SPAMHAUS_HBL_URL" {
      score = 7;
      description = "URL found in spamhaus HBL blocklist";
      groups = ["spamhaus"];
  }

}