symbols = { "RBL_UCEPROTECT_LEVEL1" { score = 3.5; } "RBL_UCEPROTECT_LEVEL2" { score = 1.5; } "RECEIVED_SPAMHAUS_XBL" { weight = 0.0; description = "Received address is listed in ZEN XBL"; } "RBL_INTERSERVER_BAD_URI" { score = 4.0; description = "Listed on Interserver RBL"; } "RBL_INTERSERVER_BAD_IP" { score = 4.0; description = "Listed on Interserver RBL"; } "SPAMHAUS_ZEN" { weight = 7.0; } "SH_AUTHBL_RECEIVED" { weight = 4.0; } "RBL_DBL_SPAM" { weight = 7.0; } "RBL_DBL_PHISH" { weight = 7.0; } "RBL_DBL_MALWARE" { weight = 7.0; } "RBL_DBL_BOTNET" { weight = 7.0; } "RBL_DBL_ABUSED_SPAM" { weight = 3.0; } "RBL_DBL_ABUSED_PHISH" { weight = 3.0; } "RBL_DBL_ABUSED_MALWARE" { weight = 3.0; } "RBL_DBL_ABUSED_BOTNET" { weight = 3.0; } "RBL_ZRD_VERY_FRESH_DOMAIN" { weight = 7.0; } "RBL_ZRD_FRESH_DOMAIN" { weight = 4.0; } "ZRD_VERY_FRESH_DOMAIN" { weight = 7.0; } "ZRD_FRESH_DOMAIN" { weight = 4.0; } "SH_EMAIL_DBL" { weight = 7.0; } "SH_EMAIL_DBL_ABUSED" { weight = 7.0; } "SH_EMAIL_ZRD_VERY_FRESH_DOMAIN" { weight = 7.0; } "SH_EMAIL_ZRD_FRESH_DOMAIN" { weight = 4.0; } "RBL_DBL_DONT_QUERY_IPS" { weight = 0.0; } "RBL_ZRD_DONT_QUERY_IPS" { weight = 0.0; } "SH_EMAIL_ZRD_DONT_QUERY_IPS" { weight = 0.0; } "SH_EMAIL_DBL_DONT_QUERY_IPS" { weight = 0.0; } "DBL" { weight = 0.0; description = "DBL unknown result"; groups = ["spamhaus"]; } "DBL_SPAM" { weight = 7; description = "DBL uribl spam"; groups = ["spamhaus"]; } "DBL_PHISH" { weight = 7; description = "DBL uribl phishing"; groups = ["spamhaus"]; } "DBL_MALWARE" { weight = 7; description = "DBL uribl malware"; groups = ["spamhaus"]; } "DBL_BOTNET" { weight = 7; description = "DBL uribl botnet C&C domain"; groups = ["spamhaus"]; } "DBLABUSED_SPAM_FULLURLS" { weight = 5.5; description = "DBL uribl abused legit spam"; groups = ["spamhaus"]; } "DBLABUSED_PHISH_FULLURLS" { weight = 5.5; description = "DBL uribl abused legit phish"; groups = ["spamhaus"]; } "DBLABUSED_MALWARE_FULLURLS" { weight = 5.5; description = "DBL uribl abused legit malware"; groups = ["spamhaus"]; } "DBLABUSED_BOTNET_FULLURLS" { weight = 5.5; description = "DBL uribl abused legit botnet"; groups = ["spamhaus"]; } "DBL_ABUSE" { weight = 5.5; description = "DBL uribl abused legit spam"; groups = ["spamhaus"]; } "DBL_ABUSE_REDIR" { weight = 1.5; description = "DBL uribl abused spammed redirector domain"; groups = ["spamhaus"]; } "DBL_ABUSE_PHISH" { weight = 5.5; description = "DBL uribl abused legit phish"; groups = ["spamhaus"]; } "DBL_ABUSE_MALWARE" { weight = 5.5; description = "DBL uribl abused legit malware"; groups = ["spamhaus"]; } "DBL_ABUSE_BOTNET" { weight = 5.5; description = "DBL uribl abused legit botnet C&C"; groups = ["spamhaus"]; } "DBL_PROHIBIT" { weight = 0.0; description = "DBL uribl IP queries prohibited!"; groups = ["spamhaus"]; } "DBL_BLOCKED_OPENRESOLVER" { weight = 0.0; description = "You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/"; groups = ["spamhaus"]; } "DBL_BLOCKED" { weight = 0.0; description = "You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/"; groups = ["spamhaus"]; } "SPAMHAUS_ZEN_URIBL" { weight = 0.0; description = "Spamhaus ZEN URIBL: Filtered result"; groups = ["spamhaus"]; } "URIBL_SBL" { weight = 6.5; description = "A domain in the message body resolves to an IP listed in Spamhaus SBL"; one_shot = true; groups = ["spamhaus"]; } "URIBL_SBL_CSS" { weight = 6.5; description = "A domain in the message body resolves to an IP listed in Spamhaus SBL CSS"; one_shot = true; groups = ["spamhaus"]; } "URIBL_PBL" { weight = 0.01; description = "A domain in the message body resolves to an IP listed in Spamhaus PBL"; one_shot = true; groups = ["spamhaus"]; } "URIBL_DROP" { weight = 6.5; description = "A domain in the message body resolves to an IP listed in Spamhaus DROP"; one_shot = true; groups = ["spamhaus"]; } "URIBL_XBL" { weight = 5.0; description = "A domain in the message body resolves to an IP listed in Spamhaus XBL"; one_shot = true; groups = ["spamhaus"]; } "SPAMHAUS_SBL_URL" { weight = 6.5; description = "A numeric URL in the message body is listed in Spamhaus SBL"; one_shot = true; groups = ["spamhaus"]; } "SH_HBL_EMAIL" { weight = 7; description = "Email listed in HBL"; groups = ["spamhaus"]; } "SH_HBL_FILE_MALICIOUS" { weight = 7; description = "An attachment hash is listed in Spamhaus HBL as malicious"; groups = ["spamhaus"]; } "SH_HBL_FILE_SUSPICIOUS" { weight = 5; description = "An attachment hash is listed in Spamhaus HBL as suspicious"; groups = ["spamhaus"]; } "RBL_SPAMHAUS_CW_BTC" { score = 7; description = "Bitcoin found in Spamhaus cryptowallet list"; groups = ["spamhaus"]; } "RBL_SPAMHAUS_CW_ETH" { score = 7; description = "Ethereum found in Spamhaus cryptowallet list"; groups = ["spamhaus"]; } "RBL_SPAMHAUS_CW_BCH" { score = 7; description = "Bitcoinhash found in Spamhaus cryptowallet list"; groups = ["spamhaus"]; } "RBL_SPAMHAUS_CW_XMR" { score = 7; description = "Monero found in Spamhaus cryptowallet list"; groups = ["spamhaus"]; } "RBL_SPAMHAUS_CW_LTC" { score = 7; description = "Litecoin found in Spamhaus cryptowallet list"; groups = ["spamhaus"]; } "RBL_SPAMHAUS_CW_XRP" { score = 7; description = "Ripple found in Spamhaus cryptowallet list"; groups = ["spamhaus"]; } "RBL_SPAMHAUS_HBL_URL" { score = 7; description = "URL found in spamhaus HBL blocklist"; groups = ["spamhaus"]; } }