1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
|
# junkfilter
# a junk e-mail filter system for procmail
# Copyright 1997-98, Gregory Sutter <gsutter@pobox.com>
#
# $Id: junkfilter.one,v 1.6 1998/08/27 19:54:00 gsutter Exp $
#
# Please read the file "junkfilter.readme" and the page
# http://www.pobox.com/~gsutter/junkfilter/ before using
# junkfilter. junkfilter is copyright 1997-98 Gregory
# Sutter and is licensed under the terms of the GNU
# General Public License, version 2. See the file
# junkfilter.readme for details.
# This is junkfilter.one, 100% certainty spam catchers.
JFSEC=1
# Kills anything from an impossible IP address
:0
* ()\/^Received.*\[[0-9\.]*([03-9][0-9][0-9]|2[6-9][0-9]|25[6-9])
{ JFMATCH="$JFSEC: Forged Received header: $MATCH" INCLUDERC=$JFDIR/junkfilter.match }
# Mail needs to have certain headers.
:0
* ! ()\/^(From|Date):[ ]*.*
{ JFMATCH="$JFSEC: Missing necessary header: $MATCH" INCLUDERC=$JFDIR/junkfilter.match }
# Checks date. Because -0600 is either CST, MDT, or water, NOTHING should
# ever have a time-zone of "-0600 (EST)".
:0
* ()\/^(Date|Received):.* -0600 \(EST\)
{ JFMATCH="$JFSEC: Invalid datestamp: $MATCH" INCLUDERC=$JFDIR/junkfilter.match }
# junk mail / mail bomb software
:0D
* ()\/^X-(Mailer|Sender):.*(Aristotle|Avalanche|Blaster|Bomber|DejaVu|eMerge|Extractor|Floodgate|fusion|GeoList|Group|Mach10|MegaPro|RAF|RIME|TURBO)\>
{ JFMATCH="$JFSEC: Junkmail software: $MATCH" INCLUDERC=$JFDIR/junkfilter.match }
:0D
* ()\/^(Received|Message-Id|X-(Mailer|Sender)):.*(AutoMail|E-Broadcaster|Emailer Platinum|eMarksman|Extractor|e-Merge|from stealth|Global Messenger|GroupMaster|List-X|Mailcast|MAILGOD|MailKing|Match10|MassE-Mail|massmail\.pl|NetContact|NetMailer|News Breaker|Powermailer|Quick Shot|Ready Aim Fire|Sonic|WindoZ|WinNT\'s Blat|WorldMerge|Yourdora)\>
{ JFMATCH="$JFSEC: Junkmail Software: $MATCH" INCLUDERC=$JFDIR/junkfilter.match }
# Pegasus mailer is the only mailer which legitimately generates
# "Comments: Authenticated sender is ..." so kill anything else.
# This works for versions 2.54 and below only.
:0
* ^Comments:.*Authenticated sender
* !^X-Mailer:.*Pegasus Mail
* !^Resent-To:
* !^Return-Path:.*owner-
{ JFMATCH="$JFSEC: Forged Pegasus Mail authentication" INCLUDERC=$JFDIR/junkfilter.match }
# "unknown host" is not a valid Received: header
:0
* ()\/^Received:.*unknown host
{ JFMATCH="$JFSEC: Forged Received header: $MATCH" INCLUDERC=$JFDIR/junkfilter.match }
# Check to see if they're trying to exploit a security fault in
# Sendmail 8.8, like MailGod does.
:0
* ^Received:.....................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................\
..........................................................................
{ JFMATCH="$JFSEC: Received line longer than 1023 characters" INCLUDERC=$JFDIR/junkfilter.match }
JFSEC
# EOF junkfilter.one
|
