From 38fa0291e2f3a47699a77388b5aa8e3eca4f660b Mon Sep 17 00:00:00 2001 From: mdecimus Date: Tue, 17 Dec 2024 18:01:12 +0100 Subject: [PATCH] Port Spam filter to Rust - part 8 --- crates/common/src/config/network.rs | 74 +- crates/common/src/config/spamfilter.rs | 761 +++- crates/common/src/enterprise/config.rs | 70 +- crates/common/src/expr/eval.rs | 4 +- crates/common/src/expr/functions/mod.rs | 1 + crates/common/src/expr/functions/text.rs | 30 + crates/smtp/src/inbound/rcpt.rs | 7 +- crates/spam-filter/src/analysis/bayes.rs | 4 +- crates/spam-filter/src/analysis/bounce.rs | 113 - crates/spam-filter/src/analysis/dmarc.rs | 4 +- crates/spam-filter/src/analysis/domain.rs | 85 +- crates/spam-filter/src/analysis/from.rs | 84 +- crates/spam-filter/src/analysis/headers.rs | 96 +- crates/spam-filter/src/analysis/init.rs | 7 +- crates/spam-filter/src/analysis/ip.rs | 8 +- crates/spam-filter/src/analysis/llm.rs | 10 +- crates/spam-filter/src/analysis/mime.rs | 33 +- crates/spam-filter/src/analysis/mod.rs | 25 +- crates/spam-filter/src/analysis/recipient.rs | 31 +- crates/spam-filter/src/analysis/replyto.rs | 21 +- crates/spam-filter/src/analysis/rules.rs | 16 +- crates/spam-filter/src/analysis/score.rs | 18 +- crates/spam-filter/src/analysis/subject.rs | 49 +- .../spam-filter/src/analysis/trusted_reply.rs | 11 +- crates/spam-filter/src/analysis/url.rs | 73 +- crates/spam-filter/src/lib.rs | 2 + crates/spam-filter/src/modules/dnsbl.rs | 25 +- crates/spam-filter/src/modules/expression.rs | 240 +- crates/utils/src/config/mod.rs | 2 +- crates/utils/src/config/utils.rs | 26 + resources/config/build.py | 104 - .../config/spamfilter/maps/allow_dmarc.list | 786 ---- .../config/spamfilter/maps/allow_domains.list | 828 ---- .../spamfilter/maps/allow_spf_dkim.list | 237 - .../spamfilter/maps/domains_disposable.list | 427 -- .../config/spamfilter/maps/domains_free.list | 4007 ----------------- .../config/spamfilter/maps/mime_types.map | 133 - resources/config/spamfilter/maps/scores.map | 376 -- .../config/spamfilter/maps/spam_config.map | 39 - .../spamfilter/maps/url_redirectors.list | 1077 ----- .../spamfilter/scripts/composites.sieve | 79 - .../config/spamfilter/scripts/config.sieve | 44 - 42 files changed, 1217 insertions(+), 8850 deletions(-) delete mode 100644 crates/spam-filter/src/analysis/bounce.rs delete mode 100644 resources/config/build.py delete mode 100644 resources/config/spamfilter/maps/allow_dmarc.list delete mode 100644 resources/config/spamfilter/maps/allow_domains.list delete mode 100644 resources/config/spamfilter/maps/allow_spf_dkim.list delete mode 100644 resources/config/spamfilter/maps/domains_disposable.list delete mode 100644 resources/config/spamfilter/maps/domains_free.list delete mode 100644 resources/config/spamfilter/maps/mime_types.map delete mode 100644 resources/config/spamfilter/maps/scores.map delete mode 100644 resources/config/spamfilter/maps/spam_config.map delete mode 100644 resources/config/spamfilter/maps/url_redirectors.list delete mode 100644 resources/config/spamfilter/scripts/composites.sieve delete mode 100644 resources/config/spamfilter/scripts/config.sieve diff --git a/crates/common/src/config/network.rs b/crates/common/src/config/network.rs index 187f3230..6f0c31d1 100644 --- a/crates/common/src/config/network.rs +++ b/crates/common/src/config/network.rs @@ -33,7 +33,7 @@ pub struct ContactForm { pub field_honey_pot: Option, } -#[derive(Clone)] +#[derive(Clone, Default)] pub enum AsnGeoLookupConfig { Resource { expires: Duration, @@ -49,6 +49,7 @@ pub enum AsnGeoLookupConfig { index_asn_name: Option, index_country: Option, }, + #[default] Disabled, } @@ -155,6 +156,7 @@ impl Network { node_id: config.property("cluster.node-id").unwrap_or_default(), security: Security::parse(config), contact_form: ContactForm::parse(config), + asn_geo_lookup: AsnGeoLookupConfig::parse(config).unwrap_or_default(), ..Default::default() }; let token_map = &TokenMap::default().with_variables(HTTP_VARS); @@ -174,3 +176,73 @@ impl Network { network } } + +impl AsnGeoLookupConfig { + pub fn parse(config: &mut Config) -> Option { + match config.value("server.asn.type")? { + "dns" => AsnGeoLookupConfig::Dns { + zone_ipv4: config + .value_require_non_empty("server.asn.zone.ipv4")? + .to_string(), + zone_ipv6: config + .value_require_non_empty("server.asn.zone.ipv6")? + .to_string(), + separator: config + .value_require_non_empty("server.asn.separator")? + .to_string(), + index_asn: config.property_require("server.asn.index.asn")?, + index_asn_name: config.property("server.asn.index.asn-name"), + index_country: config.property("server.asn.index.country"), + } + .into(), + "resource" => { + let mut resources = vec![]; + + for id in config + .sub_keys("server.asn.resource", ".url") + .map(|k| k.to_string()) + .collect::>() + { + let id = id.as_str(); + let url = config + .value_require_non_empty(("server.asn.resource", id, "url"))? + .to_string(); + let headers = parse_http_headers(config, ("server.asn.resource", id)); + + resources.push( + match config.value_require(("server.asn.resource", id, "type"))? { + "asn" => AsnGeoLookupResource::Asn { url, headers }, + "geo" => AsnGeoLookupResource::Geo { url, headers }, + _ => { + config.new_build_error( + ("server.asn.resource", id), + "Invalid resource", + ); + continue; + } + }, + ); + } + + if resources.is_empty() { + config.new_build_error("server.asn.resource", "No resources found"); + return None; + } + + AsnGeoLookupConfig::Resource { + expires: config.property_or_default::("server.asn.expires", "1d")?, + timeout: config.property_or_default::("server.asn.timeout", "5m")?, + max_size: config + .property("server.asn.max-size") + .unwrap_or(100 * 1024 * 1024), + resources, + } + .into() + } + _ => { + config.new_build_error("server.asn.type", "Invalid value"); + None + } + } + } +} diff --git a/crates/common/src/config/spamfilter.rs b/crates/common/src/config/spamfilter.rs index 7492a990..5c7577f3 100644 --- a/crates/common/src/config/spamfilter.rs +++ b/crates/common/src/config/spamfilter.rs @@ -9,42 +9,59 @@ use std::{net::SocketAddr, time::Duration}; use ahash::AHashSet; use nlp::bayes::BayesClassifier; use utils::{ - config::Config, + config::{utils::ParseValue, Config}, glob::{GlobMap, GlobSet}, }; -use super::if_block::IfBlock; +use super::{if_block::IfBlock, tokenizer::TokenMap}; #[derive(Debug, Clone, Default)] pub struct SpamFilterConfig { - pub max_rbl_ip_checks: usize, - pub max_rbl_domain_checks: usize, - pub max_rbl_email_checks: usize, - pub max_rbl_url_checks: usize, - pub trusted_reply: Option, - + pub enabled: bool, + pub dnsbl: DnsBlConfig, pub rules: Vec, - pub greylist_duration: Option, + pub lists: SpamFilterLists, pub pyzor: Option, pub reputation: Option, pub bayes: Option, + pub scores: SpamFilterScoreConfig, + pub expiry: SpamFilterExpiryConfig, +} - pub score_reject_threshold: f64, - pub score_discard_threshold: f64, - pub score_spam_threshold: f64, +#[derive(Debug, Clone, Default)] +pub struct SpamFilterScoreConfig { + pub reject_threshold: f64, + pub discard_threshold: f64, + pub spam_threshold: f64, +} - pub list_dmarc_allow: GlobSet, - pub list_spf_dkim_allow: GlobSet, - pub list_freemail_providers: GlobSet, - pub list_disposable_providers: GlobSet, - pub list_trusted_domains: GlobSet, - pub list_url_redirectors: GlobSet, - pub list_file_extensions: GlobMap, - pub list_scores: GlobMap>, - pub list_spamtraps: GlobSet, +#[derive(Debug, Clone, Default)] +pub struct SpamFilterExpiryConfig { + pub grey_list: Option, + pub trusted_reply: Option, +} - pub remote_lists: Vec, - pub dnsbls: Vec, +#[derive(Debug, Clone, Default)] +pub struct DnsBlConfig { + pub max_ip_checks: usize, + pub max_domain_checks: usize, + pub max_email_checks: usize, + pub max_url_checks: usize, + pub servers: Vec, +} + +#[derive(Debug, Clone, Default)] +pub struct SpamFilterLists { + pub dmarc_allow: GlobSet, + pub spf_dkim_allow: GlobSet, + pub freemail_providers: GlobSet, + pub disposable_providers: GlobSet, + pub trusted_domains: GlobSet, + pub url_redirectors: GlobSet, + pub file_extensions: GlobMap, + pub scores: GlobMap>, + pub spamtraps: GlobSet, + pub remote: Vec, } #[derive(Debug, Clone)] @@ -63,6 +80,7 @@ pub struct BayesConfig { pub auto_learn_ham_threshold: f64, pub score_spam: f64, pub score_ham: f64, + pub enabled_account: bool, } #[derive(Debug, Clone, Default)] @@ -88,10 +106,10 @@ pub struct PyzorConfig { #[derive(Debug, Clone, PartialEq, Eq)] pub struct SpamFilterRule { pub rule: IfBlock, - pub scope: Option, + pub scope: Element, } -#[derive(Debug, Clone, PartialEq, Eq)] +#[derive(Debug, Clone, Default, PartialEq, Eq)] pub struct FileExtension { pub known_types: AHashSet, pub is_bad: bool, @@ -99,7 +117,7 @@ pub struct FileExtension { pub is_nz: bool, } -#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)] +#[derive(Debug, Default, Clone, Copy, PartialEq, Eq, Hash)] pub enum Element { Url, Domain, @@ -107,6 +125,8 @@ pub enum Element { Ip, Header, Body, + #[default] + Any, } #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)] @@ -132,22 +152,22 @@ pub enum Location { pub struct RemoteListConfig { pub id: String, pub url: String, - pub retry: Duration, // 1 hour - pub refresh: Duration, // 12h openphish, 6h phishtank - pub timeout: Duration, // 10s - pub max_size: usize, // 10MB - pub max_entries: usize, // 100000 - pub max_entry_size: usize, // 256 + pub retry: Duration, + pub refresh: Duration, + pub timeout: Duration, + pub max_size: usize, + pub max_entries: usize, + pub max_entry_size: usize, pub format: RemoteListFormat, - pub element: Element, + pub scope: Element, pub tag: String, } #[derive(Debug, Clone)] -pub struct DnsblConfig { +pub struct DnsBlServer { pub id: String, pub zone: IfBlock, - pub element: Element, + pub scope: Element, pub tags: IfBlock, } @@ -163,7 +183,514 @@ pub enum RemoteListFormat { impl SpamFilterConfig { pub fn parse(config: &mut Config) -> Self { - SpamFilterConfig::default() + SpamFilterConfig { + enabled: config + .property_or_default("spam-filter.enable", "true") + .unwrap_or(true), + dnsbl: DnsBlConfig::parse(config), + rules: parse_rules(config), + lists: SpamFilterLists::parse(config), + pyzor: PyzorConfig::parse(config), + reputation: ReputationConfig::parse(config), + bayes: BayesConfig::parse(config), + scores: SpamFilterScoreConfig::parse(config), + expiry: SpamFilterExpiryConfig::parse(config), + } + } +} + +fn parse_rules(config: &mut Config) -> Vec { + let mut rules = vec![]; + for id in config + .sub_keys("spam-filter.rule", ".scope") + .map(|k| k.to_string()) + .collect::>() + { + if let Some(rule) = SpamFilterRule::parse(config, id) { + rules.push(rule); + } + } + rules.sort_by(|a, b| a.1.cmp(&b.1)); + rules.into_iter().map(|(rule, _)| rule).collect() +} + +impl SpamFilterRule { + pub fn parse(config: &mut Config, id: String) -> Option<(Self, i32)> { + let id = id.as_str(); + if config + .property_or_default(("spam-filter.rule", id, "enable"), "true") + .unwrap_or(true) + { + return None; + } + let priority = config + .property_or_default(("spam-filter.rule", id, "priority"), "0") + .unwrap_or(0); + let scope = config + .property_or_default::(("spam-filter.rule", id, "scope"), "any") + .unwrap_or_default(); + + ( + SpamFilterRule { + rule: IfBlock::try_parse( + config, + ("spam-filter.rule", id, "condition"), + &scope.token_map(), + )?, + scope, + }, + priority, + ) + .into() + } +} + +impl DnsBlConfig { + pub fn parse(config: &mut Config) -> Self { + let mut servers = vec![]; + for id in config + .sub_keys("spam-filter.dnsbl.server", ".url") + .map(|k| k.to_string()) + .collect::>() + { + if let Some(server) = DnsBlServer::parse(config, id) { + servers.push(server); + } + } + + DnsBlConfig { + max_ip_checks: config + .property_or_default("spam-filter.dnsbl.max-check.ip", "20") + .unwrap_or(20), + max_domain_checks: config + .property_or_default("spam-filter.dnsbl.max-check.domain", "20") + .unwrap_or(20), + max_email_checks: config + .property_or_default("spam-filter.dnsbl.max-check.email", "20") + .unwrap_or(20), + max_url_checks: config + .property_or_default("spam-filter.dnsbl.max-check.url", "20") + .unwrap_or(20), + servers, + } + } +} + +impl DnsBlServer { + pub fn parse(config: &mut Config, id: String) -> Option { + let id_ = id.as_str(); + + if config + .property_or_default(("spam-filter.dnsbl.server", id_, "enable"), "true") + .unwrap_or(true) + { + return None; + } + + let scope = + config.property_require::(("spam-filter.dnsbl.server", id_, "scope"))?; + + DnsBlServer { + zone: IfBlock::try_parse( + config, + ("spam-filter.dnsbl.server", id_, "zone"), + &scope.token_map(), + )?, + scope, + tags: IfBlock::try_parse( + config, + ("spam-filter.dnsbl.server", id_, "tag"), + &Element::Domain.token_map(), + )?, + id, + } + .into() + } +} + +impl SpamFilterLists { + pub fn parse(config: &mut Config) -> Self { + let mut lists = SpamFilterLists { + dmarc_allow: GlobSet::default(), + spf_dkim_allow: GlobSet::default(), + freemail_providers: GlobSet::default(), + disposable_providers: GlobSet::default(), + trusted_domains: GlobSet::default(), + url_redirectors: GlobSet::default(), + spamtraps: GlobSet::default(), + file_extensions: GlobMap::default(), + scores: GlobMap::default(), + remote: Default::default(), + }; + + // Parse local lists + let mut errors = vec![]; + for (key, value) in config.iterate_prefix("spam-filter.list") { + if let Some((id, key)) = key + .split_once('.') + .filter(|(id, key)| !id.is_empty() && !key.is_empty()) + { + match id { + "dmarc-allow" => { + lists.dmarc_allow.insert(key); + } + "spf-dkim-allow" => { + lists.spf_dkim_allow.insert(key); + } + "freemail-providers" => { + lists.freemail_providers.insert(key); + } + "disposable-providers" => { + lists.disposable_providers.insert(key); + } + "trusted-domains" => { + lists.trusted_domains.insert(key); + } + "url-redirectors" => { + lists.url_redirectors.insert(key); + } + "spam-traps" => { + lists.spamtraps.insert(key); + } + "scores" => { + let action = match value.to_lowercase().as_str() { + "reject" => SpamFilterAction::Reject, + "discard" => SpamFilterAction::Discard, + score => match score.parse() { + Ok(score) => SpamFilterAction::Allow(score), + Err(err) => { + errors.push(( + format!("spam-filter.list.{id}.{key}"), + format!("Invalid score: {}", err), + )); + continue; + } + }, + }; + lists.scores.insert(key, action); + } + "file-extensions" => { + let mut ext = FileExtension::default(); + + for part in value.split('|') { + let part = part.trim(); + match part { + "AR" => { + ext.is_archive = true; + } + "NZ" => { + ext.is_nz = true; + } + "BAD" => { + ext.is_bad = true; + } + other => { + if other.contains('/') { + ext.known_types.insert(other.to_string()); + } else if !other.is_empty() { + errors.push(( + format!("spam-filter.list.{id}.{key}"), + format!("Invalid file extension: {}", other), + )); + } + } + } + } + + lists.file_extensions.insert(key, ext); + } + _ => (), + } + } + } + + for (key, error) in errors { + config.new_parse_error(key, error); + } + + // Parse remote lists + for id in config + .sub_keys("spam-filter.remote-list", ".url") + .map(|k| k.to_string()) + .collect::>() + { + let id_ = id.as_str(); + if !config + .property_or_default(("spam-filter.remote-list", id_, "enable"), "true") + .unwrap_or(true) + { + continue; + } + + let format = match config + .value_require(("spam-filter.remote-list", id_, "format")) + .unwrap_or_default() + { + "list" => RemoteListFormat::List, + "csv" => RemoteListFormat::Csv { + column: config + .property_require(("spam-filter.remote-list", id_, "column")) + .unwrap_or(0), + separator: config + .property_or_default::( + ("spam-filter.remote-list", id_, "separator"), + ",", + ) + .unwrap_or_default() + .chars() + .next() + .unwrap_or(','), + skip_first: config + .property_or_default::( + ("spam-filter.remote-list", id_, "skip-first"), + "false", + ) + .unwrap_or(false), + }, + other => { + let message = format!("Invalid format: {other:?}"); + config.new_build_error(("spam-filter.remote-list", id_, "format"), message); + continue; + } + }; + + lists.remote.push(RemoteListConfig { + url: config + .value_require(("spam-filter.remote-list", id_, "url")) + .unwrap_or_default() + .to_string(), + retry: config + .property_or_default::( + ("spam-filter.remote-list", id_, "retry"), + "1h", + ) + .unwrap_or(Duration::from_secs(3600)), + refresh: config + .property_or_default::( + ("spam-filter.remote-list", id_, "refresh"), + "12h", + ) + .unwrap_or(Duration::from_secs(43200)), + timeout: config + .property_or_default::( + ("spam-filter.remote-list", id_, "timeout"), + "30s", + ) + .unwrap_or(Duration::from_secs(30)), + max_size: config + .property_or_default::( + ("spam-filter.remote-list", id_, "limits.size"), + "104857600", + ) + .unwrap_or(104857600), + max_entries: config + .property_or_default::( + ("spam-filter.remote-list", id_, "limits.entries"), + "100000", + ) + .unwrap_or(100000), + max_entry_size: config + .property_or_default::( + ("spam-filter.remote-list", id_, "limits.entry-size"), + "512", + ) + .unwrap_or(512), + format, + scope: config + .property_require(("spam-filter.remote-list", id_, "scope")) + .unwrap_or_default(), + tag: config + .property_require(("spam-filter.remote-list", id_, "tag")) + .unwrap_or_else(|| format!("REMOTE_LIST_{}", id_.to_uppercase())), + id, + }); + } + + lists + } +} + +impl PyzorConfig { + pub fn parse(config: &mut Config) -> Option { + if !config + .property_or_default("spam-filter.pyzor.enable", "true") + .unwrap_or(true) + { + return None; + } + + let port = config + .property_or_default::("spam-filter.pyzor.port", "24441") + .unwrap_or(24441); + let host = config + .value("spam-filter.pyzor.host") + .unwrap_or("public.pyzor.org"); + let address = match format!("{host}:{port}").parse() { + Ok(address) => address, + Err(err) => { + config.new_build_error( + "spam-filter.pyzor.host", + format!("Invalid address: {}", err), + ); + return None; + } + }; + + PyzorConfig { + address, + timeout: config + .property_or_default::("spam-filter.pyzor.timeout", "5s") + .unwrap_or(Duration::from_secs(5)), + min_count: config + .property_or_default("spam-filter.pyzor.count", "5") + .unwrap_or(5), + min_wl_count: config + .property_or_default("spam-filter.pyzor.wl-count", "10") + .unwrap_or(10), + ratio: config + .property_or_default("spam-filter.pyzor.ratio", "0.2") + .unwrap_or(0.2), + } + .into() + } +} + +impl ReputationConfig { + pub fn parse(config: &mut Config) -> Option { + if !config + .property_or_default("spam-filter.reputation.enable", "true") + .unwrap_or(true) + { + return None; + } + + ReputationConfig { + expiry: config + .property_or_default::("spam-filter.reputation.expiry", "30d") + .map(|d| d.as_secs()) + .unwrap_or(2592000), + token_score: config + .property_or_default("spam-filter.reputation.score", "0.98") + .unwrap_or(0.98), + factor: config + .property_or_default("spam-filter.reputation.factor", "0.5") + .unwrap_or(0.5), + ip_weight: config + .property_or_default("spam-filter.reputation.weight.ip", "0.2") + .unwrap_or(0.2), + domain_weight: config + .property_or_default("spam-filter.reputation.weight.domain", "0.2") + .unwrap_or(0.2), + asn_weight: config + .property_or_default("spam-filter.reputation.weight.asn", "0.1") + .unwrap_or(0.1), + sender_weight: config + .property_or_default("spam-filter.reputation.weight.sender", "0.5") + .unwrap_or(0.5), + } + .into() + } +} + +impl BayesConfig { + pub fn parse(config: &mut Config) -> Option { + if !config + .property_or_default("spam-filter.bayes.enable", "true") + .unwrap_or(true) + { + return None; + } + + BayesConfig { + classifier: BayesClassifier { + min_token_hits: config + .property_or_default("spam-filter.bayes.classify.tokens.hits", "2") + .unwrap_or(2), + min_tokens: config + .property_or_default("spam-filter.bayes.classify.tokens.min", "11") + .unwrap_or(11), + min_prob_strength: config + .property_or_default("spam-filter.bayes.classify.strength", "0.05") + .unwrap_or(0.05), + min_learns: config + .property_or_default("spam-filter.bayes.classify.learns", "200") + .unwrap_or(200), + min_balance: config + .property_or_default("spam-filter.bayes.classify.balance", "0.9") + .unwrap_or(0.9), + }, + auto_learn: config + .property_or_default("spam-filter.bayes.auto-learn.enable", "true") + .unwrap_or(true), + auto_learn_reply_ham: config + .property_or_default("spam-filter.bayes.auto-learn.trusted-reply", "true") + .unwrap_or(true), + auto_learn_spam_threshold: config + .property_or_default("spam-filter.bayes.auto-learn.threshold.spam", "6.0") + .unwrap_or(6.0), + auto_learn_ham_threshold: config + .property_or_default("spam-filter.bayes.auto-learn.threshold.ham", "-2.0") + .unwrap_or(-2.0), + score_spam: config + .property_or_default("spam-filter.bayes.score.spam", "0.7") + .unwrap_or(0.7), + score_ham: config + .property_or_default("spam-filter.bayes.score.ham", "0.5") + .unwrap_or(0.5), + enabled_account: config + .property_or_default("spam-filter.bayes.enable-account", "false") + .unwrap_or(false), + } + .into() + } +} + +impl SpamFilterScoreConfig { + pub fn parse(config: &mut Config) -> Self { + SpamFilterScoreConfig { + reject_threshold: config + .property("spam-filter.score.reject") + .unwrap_or_default(), + discard_threshold: config + .property("spam-filter.score.discard") + .unwrap_or_default(), + spam_threshold: config + .property_or_default("spam-filter.score.spam", "5.0") + .unwrap_or(5.0), + } + } +} + +impl SpamFilterExpiryConfig { + pub fn parse(config: &mut Config) -> Self { + SpamFilterExpiryConfig { + grey_list: config + .property::>("spam-filter.grey-list.duration") + .unwrap_or_default() + .map(|d| d.as_secs()), + trusted_reply: config + .property_or_default::>( + "spam-filter.trusted-reply.duration", + "30d", + ) + .unwrap_or_default() + .map(|d| d.as_secs()), + } + } +} + +impl ParseValue for Element { + fn parse_value(value: &str) -> utils::config::Result { + match value { + "url" => Ok(Element::Url), + "domain" => Ok(Element::Domain), + "email" => Ok(Element::Email), + "ip" => Ok(Element::Ip), + "header" => Ok(Element::Header), + "body" => Ok(Element::Body), + "any" | "message" => Ok(Element::Any), + other => Err(format!("Invalid type {other:?}.",)), + } } } @@ -188,3 +715,165 @@ impl Location { } } } + +pub const V_SPAM_REMOTE_IP: u32 = 100; +pub const V_SPAM_REMOTE_IP_PTR: u32 = 101; +pub const V_SPAM_EHLO_DOMAIN: u32 = 102; +pub const V_SPAM_AUTH_AS: u32 = 103; +pub const V_SPAM_ASN: u32 = 104; +pub const V_SPAM_COUNTRY: u32 = 105; +pub const V_SPAM_TLS_VERSION: u32 = 106; +pub const V_SPAM_TLS_CIPHER: u32 = 107; +pub const V_SPAM_ENV_FROM: u32 = 108; +pub const V_SPAM_ENV_FROM_LOCAL: u32 = 109; +pub const V_SPAM_ENV_FROM_DOMAIN: u32 = 110; +pub const V_SPAM_ENV_TO: u32 = 111; +pub const V_SPAM_FROM: u32 = 112; +pub const V_SPAM_FROM_NAME: u32 = 113; +pub const V_SPAM_FROM_LOCAL: u32 = 114; +pub const V_SPAM_FROM_DOMAIN: u32 = 115; +pub const V_SPAM_REPLY_TO: u32 = 116; +pub const V_SPAM_REPLY_TO_NAME: u32 = 117; +pub const V_SPAM_REPLY_TO_LOCAL: u32 = 118; +pub const V_SPAM_REPLY_TO_DOMAIN: u32 = 119; +pub const V_SPAM_TO: u32 = 120; +pub const V_SPAM_TO_NAME: u32 = 121; +pub const V_SPAM_TO_LOCAL: u32 = 122; +pub const V_SPAM_TO_DOMAIN: u32 = 123; +pub const V_SPAM_CC: u32 = 124; +pub const V_SPAM_CC_NAME: u32 = 125; +pub const V_SPAM_CC_LOCAL: u32 = 126; +pub const V_SPAM_CC_DOMAIN: u32 = 127; +pub const V_SPAM_BCC: u32 = 128; +pub const V_SPAM_BCC_NAME: u32 = 129; +pub const V_SPAM_BCC_LOCAL: u32 = 130; +pub const V_SPAM_BCC_DOMAIN: u32 = 131; +pub const V_SPAM_BODY_TEXT: u32 = 132; +pub const V_SPAM_BODY_HTML: u32 = 133; +pub const V_SPAM_BODY_RAW: u32 = 134; +pub const V_SPAM_SUBJECT: u32 = 135; +pub const V_SPAM_SUBJECT_THREAD: u32 = 136; +pub const V_SPAM_LOCATION: u32 = 137; + +pub const V_RCPT_EMAIL: u32 = 0; +pub const V_RCPT_NAME: u32 = 1; +pub const V_RCPT_LOCAL: u32 = 2; +pub const V_RCPT_DOMAIN: u32 = 3; +pub const V_RCPT_DOMAIN_SLD: u32 = 4; + +pub const V_URL_FULL: u32 = 0; +pub const V_URL_PATH_QUERY: u32 = 1; +pub const V_URL_PATH: u32 = 2; +pub const V_URL_QUERY: u32 = 3; +pub const V_URL_SCHEME: u32 = 4; +pub const V_URL_AUTHORITY: u32 = 5; +pub const V_URL_HOST: u32 = 6; +pub const V_URL_HOST_SLD: u32 = 7; +pub const V_URL_PORT: u32 = 8; + +pub const V_HEADER_NAME: u32 = 0; +pub const V_HEADER_NAME_LOWER: u32 = 1; +pub const V_HEADER_VALUE: u32 = 2; +pub const V_HEADER_VALUE_LOWER: u32 = 3; +pub const V_HEADER_PROPERTY: u32 = 4; +pub const V_HEADER_RAW: u32 = 5; +pub const V_HEADER_RAW_LOWER: u32 = 6; + +pub const V_IP: u32 = 0; +pub const V_IP_REVERSE: u32 = 1; +pub const V_IP_OCTETS: u32 = 2; +pub const V_IP_IS_V4: u32 = 3; +pub const V_IP_IS_V6: u32 = 4; + +impl Element { + pub fn token_map(&self) -> TokenMap { + let map = TokenMap::default().with_variables_map([ + ("remote_ip", V_SPAM_REMOTE_IP), + ("remote_ip.ptr", V_SPAM_REMOTE_IP_PTR), + ("ehlo_domain", V_SPAM_EHLO_DOMAIN), + ("auth_as", V_SPAM_AUTH_AS), + ("asn", V_SPAM_ASN), + ("country", V_SPAM_COUNTRY), + ("tls_version", V_SPAM_TLS_VERSION), + ("tls_cipher", V_SPAM_TLS_CIPHER), + ("env_from", V_SPAM_ENV_FROM), + ("env_from.local", V_SPAM_ENV_FROM_LOCAL), + ("env_from.domain", V_SPAM_ENV_FROM_DOMAIN), + ("env_to", V_SPAM_ENV_TO), + ("from", V_SPAM_FROM), + ("from.name", V_SPAM_FROM_NAME), + ("from.local", V_SPAM_FROM_LOCAL), + ("from.domain", V_SPAM_FROM_DOMAIN), + ("reply_to", V_SPAM_REPLY_TO), + ("reply_to.name", V_SPAM_REPLY_TO_NAME), + ("reply_to.local", V_SPAM_REPLY_TO_LOCAL), + ("reply_to.domain", V_SPAM_REPLY_TO_DOMAIN), + ("to", V_SPAM_TO), + ("to.name", V_SPAM_TO_NAME), + ("to.local", V_SPAM_TO_LOCAL), + ("to.domain", V_SPAM_TO_DOMAIN), + ("cc", V_SPAM_CC), + ("cc.name", V_SPAM_CC_NAME), + ("cc.local", V_SPAM_CC_LOCAL), + ("cc.domain", V_SPAM_CC_DOMAIN), + ("bcc", V_SPAM_BCC), + ("bcc.name", V_SPAM_BCC_NAME), + ("bcc.local", V_SPAM_BCC_LOCAL), + ("bcc.domain", V_SPAM_BCC_DOMAIN), + ("body", V_SPAM_BODY_TEXT), + ("body.text", V_SPAM_BODY_TEXT), + ("body.html", V_SPAM_BODY_HTML), + ("body.raw", V_SPAM_BODY_RAW), + ("subject", V_SPAM_SUBJECT), + ("subject.thread", V_SPAM_SUBJECT_THREAD), + ("location", V_SPAM_LOCATION), + ]); + + match self { + Element::Url => map.with_variables_map([ + ("url", V_URL_FULL), + ("value", V_URL_FULL), + ("path_query", V_URL_PATH_QUERY), + ("path", V_URL_PATH), + ("query", V_URL_QUERY), + ("scheme", V_URL_SCHEME), + ("authority", V_URL_AUTHORITY), + ("host", V_URL_HOST), + ("sld", V_URL_HOST_SLD), + ("port", V_URL_PORT), + ]), + Element::Email => map.with_variables_map([ + ("email", V_RCPT_EMAIL), + ("name", V_RCPT_NAME), + ("local", V_RCPT_LOCAL), + ("domain", V_RCPT_DOMAIN), + ("sld", V_RCPT_DOMAIN_SLD), + ]), + Element::Ip => map.with_variables_map([ + ("ip", V_IP), + ("value", V_IP), + ("input", V_IP), + ("reverse_ip", V_IP_REVERSE), + ("ip_reverse", V_IP_REVERSE), + ("octets", V_IP_OCTETS), + ("is_v4", V_IP_IS_V4), + ("is_v6", V_IP_IS_V6), + ]), + Element::Header => map.with_variables_map([ + ("name", V_HEADER_NAME), + ("name_lower", V_HEADER_NAME_LOWER), + ("value", V_HEADER_VALUE), + ("value_lower", V_HEADER_VALUE_LOWER), + ("email", V_HEADER_VALUE), + ("email_lower", V_HEADER_VALUE_LOWER), + ("attributes", V_HEADER_PROPERTY), + ("raw", V_HEADER_RAW), + ("raw_lower", V_HEADER_RAW_LOWER), + ]), + Element::Body | Element::Domain => { + map.with_variables_map([("input", 0), ("value", 0), ("result", 0)]) + } + Element::Any => map, + } + } +} diff --git a/crates/common/src/enterprise/config.rs b/crates/common/src/enterprise/config.rs index f8924931..6cc294e8 100644 --- a/crates/common/src/enterprise/config.rs +++ b/crates/common/src/enterprise/config.rs @@ -8,7 +8,7 @@ * */ -use std::time::Duration; +use std::{sync::Arc, time::Duration}; use ahash::AHashMap; use directory::{backend::internal::manage::ManageDirectory, Type}; @@ -27,7 +27,7 @@ use crate::{ use super::{ license::LicenseKey, llm::AiApiConfig, AlertContent, AlertContentToken, AlertMethod, - Enterprise, MetricAlert, MetricStore, TraceStore, Undelete, + Enterprise, MetricAlert, MetricStore, SpamFilterLlmConfig, TraceStore, Undelete, }; impl Enterprise { @@ -187,8 +187,6 @@ impl Enterprise { } } - todo!("implement spam filter llm config"); - Some(Enterprise { license, undelete: config @@ -199,12 +197,74 @@ impl Enterprise { trace_store, metrics_store, metrics_alerts: parse_metric_alerts(config), + spam_filter_llm: SpamFilterLlmConfig::parse(config, &ai_apis), ai_apis, - spam_filter_llm: None, }) } } +impl SpamFilterLlmConfig { + pub fn parse(config: &mut Config, models: &AHashMap>) -> Option { + if config + .property_or_default("spam-filter.llm.enable", "false") + .unwrap_or_default() + { + return None; + } + let model = config.value_require_non_empty("spam-filter.llm.model")?; + let model = if let Some(model) = models.get(model) { + model.clone() + } else { + let message = format!("Model {model:?} not found in AI API configuration"); + config.new_build_error("spam-filter.llm.model", message); + return None; + }; + + let llm = SpamFilterLlmConfig { + model, + temperature: config + .property_or_default("spam-filter.llm.temperature", "0.5") + .unwrap_or(0.5), + prompt: config + .value_require_non_empty("spam-filter.llm.prompt")? + .to_string(), + separator: config + .value_require_non_empty("spam-filter.llm.separator") + .unwrap_or_default() + .chars() + .next() + .unwrap_or('|'), + index_category: config + .property("spam-filter.llm.index.category") + .unwrap_or_default(), + index_confidence: config.property("spam-filter.llm.index.confidence"), + index_explanation: config.property("spam-filter.llm.index.explanation"), + categories: config + .values("spam-filter.llm.categories") + .map(|(_, v)| v.trim().to_uppercase()) + .collect(), + confidence: config + .values("spam-filter.llm.confidence") + .map(|(_, v)| v.trim().to_uppercase()) + .collect(), + }; + + if llm.categories.is_empty() { + config.new_build_error("spam-filter.llm.categories", "No categories defined"); + return None; + } + if llm.index_confidence.is_some() && llm.confidence.is_empty() { + config.new_build_error( + "spam-filter.llm.confidence", + "Confidence index is defined but no confidence values are provided", + ); + return None; + } + + llm.into() + } +} + pub fn parse_metric_alerts(config: &mut Config) -> Vec { let mut alerts = Vec::new(); diff --git a/crates/common/src/expr/eval.rs b/crates/common/src/expr/eval.rs index eb5d522d..43795cb1 100644 --- a/crates/common/src/expr/eval.rs +++ b/crates/common/src/expr/eval.rs @@ -4,10 +4,9 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ -use std::{borrow::Cow, cmp::Ordering, fmt::Display, net::IpAddr}; +use std::{borrow::Cow, cmp::Ordering, fmt::Display}; use hyper::StatusCode; -use mail_auth::common::resolver::ToReverseName; use trc::EvalEvent; use crate::Server; @@ -15,7 +14,6 @@ use crate::Server; use super::{ functions::{ResolveVariable, FUNCTIONS}, if_block::IfBlock, - tokenizer::TokenMap, BinaryOperator, Constant, Expression, ExpressionItem, UnaryOperator, Variable, }; diff --git a/crates/common/src/expr/functions/mod.rs b/crates/common/src/expr/functions/mod.rs index 6fe274f8..e45e92cc 100644 --- a/crates/common/src/expr/functions/mod.rs +++ b/crates/common/src/expr/functions/mod.rs @@ -79,6 +79,7 @@ pub(crate) const FUNCTIONS: &[(&str, fn(Vec) -> Variable, u32)] = &[ ("rsplit_once", text::fn_rsplit_once, 2), ("split_n", text::fn_split_n, 3), ("split_words", text::fn_split_words, 1), + ("hash", text::fn_hash, 2), ]; pub const F_IS_LOCAL_DOMAIN: u32 = 0; diff --git a/crates/common/src/expr/functions/text.rs b/crates/common/src/expr/functions/text.rs index b32e2e62..eccaafee 100644 --- a/crates/common/src/expr/functions/text.rs +++ b/crates/common/src/expr/functions/text.rs @@ -6,6 +6,9 @@ use std::borrow::Cow; +use sha1::Sha1; +use sha2::{Sha256, Sha512}; + use crate::expr::Variable; pub(crate) fn fn_trim(mut v: Vec) -> Variable { @@ -312,3 +315,30 @@ pub(crate) fn fn_rsplit_once(v: Vec) -> Variable { .unwrap_or_default(), } } + +pub(crate) fn fn_hash(v: Vec) -> Variable { + use sha1::Digest; + let mut v = v.into_iter(); + let value = v.next().unwrap().into_string(); + let algo = v.next().unwrap().into_string(); + + match algo.as_ref() { + "md5" => format!("{:x}", md5::compute(value.as_bytes())).into(), + "sha1" => { + let mut hasher = Sha1::new(); + hasher.update(value.as_bytes()); + format!("{:x}", hasher.finalize()).into() + } + "sha256" => { + let mut hasher = Sha256::new(); + hasher.update(value.as_bytes()); + format!("{:x}", hasher.finalize()).into() + } + "sha512" => { + let mut hasher = Sha512::new(); + hasher.update(value.as_bytes()); + format!("{:x}", hasher.finalize()).into() + } + _ => Variable::default(), + } +} diff --git a/crates/smtp/src/inbound/rcpt.rs b/crates/smtp/src/inbound/rcpt.rs index d98a3b45..5c11b1f3 100644 --- a/crates/smtp/src/inbound/rcpt.rs +++ b/crates/smtp/src/inbound/rcpt.rs @@ -299,7 +299,8 @@ impl Session { .server .core .spam - .greylist_duration + .expiry + .grey_list .filter(|_| self.data.authenticated_as.is_none()) { let mut key = Vec::with_capacity(64); @@ -324,9 +325,7 @@ impl Session { match self .server .in_memory_store() - .key_set( - KeyValue::new(key, vec![]).expires(greylist_duration.as_secs()), - ) + .key_set(KeyValue::new(key, vec![]).expires(greylist_duration)) .await { Ok(_) => { diff --git a/crates/spam-filter/src/analysis/bayes.rs b/crates/spam-filter/src/analysis/bayes.rs index 72cfaec1..9ec14ced 100644 --- a/crates/spam-filter/src/analysis/bayes.rs +++ b/crates/spam-filter/src/analysis/bayes.rs @@ -4,7 +4,7 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use std::future::Future; +use std::future::Future; use common::Server; @@ -47,7 +47,7 @@ impl SpamFilterAnalyzeBayes for Server { .output .env_to_addr .iter() - .any(|addr| self.core.spam.list_spamtraps.contains(&addr.address)) + .any(|addr| self.core.spam.lists.spamtraps.contains(&addr.address)) { ctx.result.add_tag("SPAM_TRAP"); } diff --git a/crates/spam-filter/src/analysis/bounce.rs b/crates/spam-filter/src/analysis/bounce.rs deleted file mode 100644 index 96e67b89..00000000 --- a/crates/spam-filter/src/analysis/bounce.rs +++ /dev/null @@ -1,113 +0,0 @@ -/* - * SPDX-FileCopyrightText: 2020 Stalwart Labs Ltd - * - * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL - */ - - use std::future::Future; - -use common::Server; -use mail_parser::MimeHeaders; - -use crate::SpamFilterContext; - -pub trait SpamFilterAnalyzeBounce: Sync + Send { - fn spam_filter_analyze_bounce( - &self, - ctx: &mut SpamFilterContext<'_>, - ) -> impl Future + Send; -} - -impl SpamFilterAnalyzeBounce for Server { - async fn spam_filter_analyze_bounce(&self, ctx: &mut SpamFilterContext<'_>) { - let mut has_delivery_word = false; - let mut has_undelivery_word = false; - let mut has_failure_word = false; - let mut has_report_word = false; - let mut has_not_word = false; - - for word in ctx.output.subject.split_whitespace() { - match word { - "delivery" | "delivered" => { - has_delivery_word = true; - } - "undeliverable" | "undelivered" => { - has_undelivery_word = true; - } - "returned" | "failed" | "failure" | "warning" => { - has_failure_word = true; - } - - "notice" | "report" | "status" | "mail" => { - has_report_word = true; - } - - "couldn't" | "hasn't" | "not" => { - has_not_word = true; - } - _ => {} - } - } - - // Subject contains words or phrases typical for DSN - let has_bounce_words = has_undelivery_word - || (has_delivery_word && (has_failure_word || has_not_word)) - || (has_report_word && has_failure_word); - - if has_bounce_words { - ctx.result.add_tag("SUBJ_BOUNCE_WORDS"); - } - - if !ctx.input.env_from.is_empty() { - return; - } - - match ctx.input.message.content_type() { - Some(ct) - if ct.ctype().eq_ignore_ascii_case("multipart") - && ct - .subtype() - .map_or(false, |s| s.eq_ignore_ascii_case("report")) - && ct.attribute("report-type").map_or(false, |a| { - a.eq_ignore_ascii_case("delivery-status") - || a.eq_ignore_ascii_case("disposition-notification") - }) => - { - // Message is a DSN - ctx.result.add_tag("BOUNCE"); - } - _ => { - let from_local = &ctx.output.from.email.local_part; - - if from_local.contains("mdaemon") - && ctx.input.message.header("X-MDDSN-Message").is_some() - { - // Message is a DSN - ctx.result.add_tag("BOUNCE"); - } else if from_local.contains("postmaster") || from_local.contains("mailer-daemon") - { - if has_bounce_words { - ctx.result.add_tag("BOUNCE"); - } else { - for part in &ctx.input.message.parts { - if let Some(ct) = part.content_type() { - let st = ct.subtype().unwrap_or_default(); - let ct = ct.ctype(); - - if (ct.eq_ignore_ascii_case("message") - || ct.eq_ignore_ascii_case("text")) - && (st.eq_ignore_ascii_case("rfc822-headers") - || st.eq_ignore_ascii_case("rfc822")) - { - // Message is a DSN - ctx.result.add_tag("BOUNCE"); - break; - } - } - } - } - } - } - } - } -} diff --git a/crates/spam-filter/src/analysis/dmarc.rs b/crates/spam-filter/src/analysis/dmarc.rs index 88f30907..676e9878 100644 --- a/crates/spam-filter/src/analysis/dmarc.rs +++ b/crates/spam-filter/src/analysis/dmarc.rs @@ -83,7 +83,7 @@ impl SpamFilterAnalyzeDmarc for Server { if self .core .spam - .list_dmarc_allow + .lists.dmarc_allow .contains(&ctx.output.from.email.domain_part.fqdn) { if matches!(ctx.input.dmarc_result, DmarcResult::Pass) { @@ -94,7 +94,7 @@ impl SpamFilterAnalyzeDmarc for Server { } else if self .core .spam - .list_spf_dkim_allow + .lists.spf_dkim_allow .contains(&ctx.output.from.email.domain_part.fqdn) { let is_dkim_pass = matches!(ctx.input.arc_result.result(), DkimResult::Pass) diff --git a/crates/spam-filter/src/analysis/domain.rs b/crates/spam-filter/src/analysis/domain.rs index a09c3877..edb258fd 100644 --- a/crates/spam-filter/src/analysis/domain.rs +++ b/crates/spam-filter/src/analysis/domain.rs @@ -4,7 +4,7 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use std::{collections::HashSet, future::Future}; +use std::{collections::HashSet, future::Future}; use common::{ config::spamfilter::{Element, Location}, @@ -17,6 +17,7 @@ use crate::{ modules::{ dnsbl::is_dnsbl, expression::{SpamFilterResolver, StringResolver}, + html::{HtmlToken, A, HREF}, }, Email, Recipient, SpamFilterContext, TextPart, }; @@ -100,23 +101,59 @@ impl SpamFilterAnalyzeDomain for Server { None } })), - TextPart::Html { tokens, .. } => emails.extend(tokens.iter().filter_map(|t| { - if let TokenType::Email(email) = t { - Some(ElementLocation::new( - Recipient { - email: Email::new(email), - name: None, - }, - if is_body { - Location::BodyHtml - } else { - Location::Attachment - }, - )) - } else { - None - } - })), + TextPart::Html { + tokens, + html_tokens, + .. + } => { + emails.extend(tokens.iter().filter_map(|t| { + if let TokenType::Email(email) = t { + Some(ElementLocation::new( + Recipient { + email: Email::new(email), + name: None, + }, + if is_body { + Location::BodyHtml + } else { + Location::Attachment + }, + )) + } else { + None + } + })); + emails.extend(html_tokens.iter().filter_map(|token| { + if let HtmlToken::StartTag { + name: A, + attributes, + .. + } = token + { + attributes.iter().find_map(|(attr, value)| { + if *attr == HREF { + let value = value.as_deref()?.strip_prefix("mailto:")?; + if value.contains('@') { + return Some(ElementLocation::new( + Recipient { + email: Email::new(value), + name: None, + }, + if is_body { + Location::BodyHtml + } else { + Location::Attachment + }, + )); + } + } + None + }) + } else { + None + } + })); + } TextPart::None => (), } } @@ -135,9 +172,9 @@ impl SpamFilterAnalyzeDomain for Server { } // Check Email DNSBL - if ctx.result.rbl_email_checks < self.core.spam.max_rbl_email_checks { - for dnsbl in &self.core.spam.dnsbls { - if dnsbl.element == Element::Email { + if ctx.result.rbl_email_checks < self.core.spam.dnsbl.max_email_checks { + for dnsbl in &self.core.spam.dnsbl.servers { + if dnsbl.scope == Element::Email { if let Some(tag) = is_dnsbl( self, dnsbl, @@ -166,9 +203,9 @@ impl SpamFilterAnalyzeDomain for Server { } // Check Domain DNSBL - if ctx.result.rbl_domain_checks < self.core.spam.max_rbl_domain_checks { - for dnsbl in &self.core.spam.dnsbls { - if dnsbl.element == Element::Domain { + if ctx.result.rbl_domain_checks < self.core.spam.dnsbl.max_domain_checks { + for dnsbl in &self.core.spam.dnsbl.servers { + if dnsbl.scope == Element::Domain { if let Some(tag) = is_dnsbl( self, dnsbl, diff --git a/crates/spam-filter/src/analysis/from.rs b/crates/spam-filter/src/analysis/from.rs index 786f7b04..8e9ca853 100644 --- a/crates/spam-filter/src/analysis/from.rs +++ b/crates/spam-filter/src/analysis/from.rs @@ -4,7 +4,7 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use std::future::Future; +use std::future::Future; use common::Server; use mail_parser::HeaderName; @@ -19,26 +19,12 @@ pub trait SpamFilterAnalyzeFrom: Sync + Send { ) -> impl Future + Send; } -const SERVICE_ACCOUNTS: [&str; 9] = [ - "www-data", - "anonymous", - "ftp", - "apache", - "nobody", - "guest", - "nginx", - "web", - "www", -]; -pub(crate) const TITLES: [&str; 7] = ["mr. ", "mrs. ", "ms. ", "dr. ", "prof. ", "rev. ", "hon. "]; - impl SpamFilterAnalyzeFrom for Server { async fn spam_filter_analyze_from(&self, ctx: &mut SpamFilterContext<'_>) { let mut from_count = 0; let mut from_raw = b"".as_slice(); let mut crt = None; let mut dnt = None; - let mut sender = None; for header in ctx.input.message.headers() { match &header.name { @@ -51,14 +37,6 @@ impl SpamFilterAnalyzeFrom for Server { .get(header.offset_start..header.offset_end) .unwrap_or_default(); } - HeaderName::Sender => { - sender = header - .value() - .as_address() - .and_then(|addrs| addrs.first()) - .and_then(|addr| addr.address()) - .map(Email::new); - } HeaderName::Other(name) => { if name.eq_ignore_ascii_case("X-Confirm-Reading-To") { crt = ctx @@ -87,31 +65,25 @@ impl SpamFilterAnalyzeFrom for Server { } let env_from_empty = ctx.output.env_from_addr.address.is_empty(); - let mut is_from_service_account = false; - let mut is_www_dot_domain = false; let from_addr = &ctx.output.from.email; let from_name = ctx.output.from.name.as_deref().unwrap_or_default(); if from_count > 0 { // Validate address let from_addr_is_valid = from_addr.is_valid(); if from_addr_is_valid { - if SERVICE_ACCOUNTS.contains(&from_addr.local_part.as_str()) { - is_from_service_account = true; - } - if from_addr.domain_part.fqdn.starts_with("www.") { - is_www_dot_domain = true; - } if self .core .spam - .list_freemail_providers + .lists + .freemail_providers .contains(from_addr.domain_part.sld.as_deref().unwrap_or_default()) { ctx.result.add_tag("FREEMAIL_FROM"); } else if self .core .spam - .list_disposable_providers + .lists + .disposable_providers .contains(from_addr.domain_part.sld.as_deref().unwrap_or_default()) { ctx.result.add_tag("DISPOSABLE_FROM"); @@ -144,17 +116,6 @@ impl SpamFilterAnalyzeFrom for Server { } else { ctx.result.add_tag("FROM_NEQ_DISPLAY_NAME"); } - } else { - for title in TITLES { - if from_name.contains(title) { - ctx.result.add_tag("FROM_NAME_HAS_TITLE"); - break; - } - } - - if from_name.contains(" ") { - ctx.result.add_tag("FROM_NAME_EXCESS_SPACE"); - } } } @@ -174,10 +135,6 @@ impl SpamFilterAnalyzeFrom for Server { ctx.result.add_tag("FROM_NEQ_ENVFROM"); } - if from_addr.local_part.contains("+") { - ctx.result.add_tag("TAGGED_FROM"); - } - // Validate FROM/TO relationship if ctx.output.recipients_to.len() + ctx.output.recipients_cc.len() == 1 { let rcpt = ctx @@ -243,10 +200,7 @@ impl SpamFilterAnalyzeFrom for Server { if !env_from_empty { // Validate envelope address if ctx.output.env_from_addr.is_valid() { - if SERVICE_ACCOUNTS.contains(&ctx.output.env_from_addr.local_part.as_str()) { - ctx.result.add_tag("ENVFROM_SERVICE_ACCT"); - } - if self.core.spam.list_freemail_providers.contains( + if self.core.spam.lists.freemail_providers.contains( ctx.output .env_from_addr .domain_part @@ -255,7 +209,7 @@ impl SpamFilterAnalyzeFrom for Server { .unwrap_or_default(), ) { ctx.result.add_tag("FREEMAIL_ENVFROM"); - } else if self.core.spam.list_disposable_providers.contains( + } else if self.core.spam.lists.disposable_providers.contains( ctx.output .env_from_addr .domain_part @@ -292,29 +246,5 @@ impl SpamFilterAnalyzeFrom for Server { } } } - - for addr in [ - ctx.output.reply_to.as_ref().map(|s| &s.email), - sender.as_ref(), - ] - .into_iter() - .flatten() - { - if !is_from_service_account && SERVICE_ACCOUNTS.contains(&addr.local_part.as_str()) { - is_from_service_account = true; - } - - if !is_www_dot_domain && addr.domain_part.fqdn.starts_with("www.") { - is_www_dot_domain = true; - } - } - - if is_from_service_account { - ctx.result.add_tag("FROM_SERVICE_ACCT"); - } - - if is_www_dot_domain { - ctx.result.add_tag("WWW_DOT_DOMAIN"); - } } } diff --git a/crates/spam-filter/src/analysis/headers.rs b/crates/spam-filter/src/analysis/headers.rs index 44058822..68f0173c 100644 --- a/crates/spam-filter/src/analysis/headers.rs +++ b/crates/spam-filter/src/analysis/headers.rs @@ -4,7 +4,7 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use std::future::Future; +use std::future::Future; use common::Server; use mail_parser::HeaderName; @@ -26,6 +26,18 @@ impl SpamFilterAnalyzeHeaders for Server { let raw_message = ctx.input.message.raw_message(); for header in ctx.input.message.headers() { + // Add header exists tag + let hdr_name = header.name(); + let mut tag = String::with_capacity(hdr_name.len() + 5); + tag.push_str("X_HDR_"); + for ch in hdr_name.chars() { + if ch.is_ascii_alphanumeric() { + tag.push(ch.to_ascii_uppercase()); + } else { + tag.push('_'); + } + } + match &header.name { HeaderName::ContentType | HeaderName::ContentTransferEncoding @@ -100,88 +112,6 @@ impl SpamFilterAnalyzeHeaders for Server { } _ => {} } - } else if name.eq_ignore_ascii_case("X-Mailer") { - if name != "X-Mailer" { - ctx.result.add_tag("XM_CASE"); - } - if !value.is_empty() { - if !value.as_bytes().iter().any(|&b| b.is_ascii_digit()) { - ctx.result.add_tag("XM_UA_NO_VERSION"); - } - - if value.contains("phpmailer") { - ctx.result.add_tag("HAS_PHPMAILER_SIG"); - } - } - } else if name.eq_ignore_ascii_case("User-Agent") { - if !value.is_empty() - && !value.as_bytes().iter().any(|&b| b.is_ascii_digit()) - { - ctx.result.add_tag("XM_UA_NO_VERSION"); - } - } else if name.eq_ignore_ascii_case("Organization") - || name.eq_ignore_ascii_case("Organisation") - { - ctx.result.add_tag("HAS_ORG_HEADER"); - } else if name.eq_ignore_ascii_case("X-Originating-IP") { - ctx.result.add_tag("HAS_XOIP"); - } else if name.eq_ignore_ascii_case("X-KLMS-AntiSpam-Status") { - if value.contains("spam") { - ctx.result.add_tag("KLMS_SPAM"); - } - } else if name.eq_ignore_ascii_case("X-Spam") - || name.eq_ignore_ascii_case("X-Spam-Flag") - || name.eq_ignore_ascii_case("X-Spam-Status") - { - if value.contains("yes") || value.contains("true") || value.contains("spam") - { - ctx.result.add_tag("SPAM_FLAG"); - } - } else if name.eq_ignore_ascii_case("X-UI-Filterresults") - || name.eq_ignore_ascii_case("X-UI-Out-Filterresults") - { - if value.contains("junk") { - ctx.result.add_tag("UNITEDINTERNET_SPAM"); - } - } else if name.eq_ignore_ascii_case("X-PHP-Originating-Script") { - ctx.result.add_tag("HAS_X_POS"); - if value.contains("eval()") { - ctx.result.add_tag("X_PHP_EVAL"); - } - if value.contains("../") { - ctx.result.add_tag("HIDDEN_SOURCE_OBJ"); - } - } else if name.eq_ignore_ascii_case("X-PHP-Script") { - ctx.result.add_tag("HAS_X_PHP_SCRIPT"); - if value.contains("eval()") { - ctx.result.add_tag("X_PHP_EVAL"); - } - if value.contains("../") { - ctx.result.add_tag("HIDDEN_SOURCE_OBJ"); - } - if value.contains("sendmail.php") { - ctx.result.add_tag("PHP_XPS_PATTERN"); - } - } else if name.eq_ignore_ascii_case("X-Source") - || name.eq_ignore_ascii_case("X-Source-Args") - || name.eq_ignore_ascii_case("X-Source-Dir") - { - ctx.result.add_tag("HAS_X_SOURCE"); - if value.contains("'../") { - ctx.result.add_tag("HIDDEN_SOURCE_OBJ"); - } - } else if name.eq_ignore_ascii_case("X-Authenticated-Sender") { - if value.contains(": ") { - ctx.result.add_tag("HAS_X_AS"); - } - } else if name.eq_ignore_ascii_case("X-Get-Message-Sender-Via") { - if value.contains("authenticated_id:") { - ctx.result.add_tag("HAS_X_GMSV"); - } - } else if name.eq_ignore_ascii_case("X-AntiAbuse") { - ctx.result.add_tag("HAS_X_ANTIABUSE"); - } else if name.eq_ignore_ascii_case("X-Authentication-Warning") { - ctx.result.add_tag("HAS_XAW"); } } _ => {} diff --git a/crates/spam-filter/src/analysis/init.rs b/crates/spam-filter/src/analysis/init.rs index 3d1d8725..fc5627a6 100644 --- a/crates/spam-filter/src/analysis/init.rs +++ b/crates/spam-filter/src/analysis/init.rs @@ -4,7 +4,7 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use common::Server; +use common::Server; use mail_parser::{parsers::fields::thread::thread_name, HeaderName, PartType}; use nlp::tokenizers::types::{TokenType, TypesTokenizer}; @@ -190,6 +190,7 @@ impl SpamFilterInit for Server { } text_parts.extend(text_parts_nested); + let subject_thread = thread_name(&subject).to_string(); let env_from_addr = Email::new(input.env_from); SpamFilterContext { output: SpamFilterOutput { @@ -213,7 +214,9 @@ impl SpamFilterInit for Server { name: from.and_then(|f| f.name()).map(|s| s.to_lowercase()), }, reply_to, - subject_thread: thread_name(&subject).to_string(), + subject_thread_lc: subject_thread.trim().to_lowercase(), + subject_lc: subject.trim().to_lowercase(), + subject_thread, subject, subject_tokens, recipients_to, diff --git a/crates/spam-filter/src/analysis/ip.rs b/crates/spam-filter/src/analysis/ip.rs index acefe7f7..32a0a9a9 100644 --- a/crates/spam-filter/src/analysis/ip.rs +++ b/crates/spam-filter/src/analysis/ip.rs @@ -4,7 +4,7 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use std::{future::Future, net::IpAddr}; +use std::{future::Future, net::IpAddr}; use common::{ config::spamfilter::{Element, Location}, @@ -119,8 +119,8 @@ impl SpamFilterAnalyzeIp for Server { continue; } - for dnsbl in &self.core.spam.dnsbls { - if dnsbl.element == Element::Ip { + for dnsbl in &self.core.spam.dnsbl.servers { + if dnsbl.scope == Element::Ip { if let Some(tag) = is_dnsbl( self, dnsbl, @@ -133,7 +133,7 @@ impl SpamFilterAnalyzeIp for Server { } } ctx.result.rbl_ip_checks += 1; - if ctx.result.rbl_ip_checks >= self.core.spam.max_rbl_ip_checks { + if ctx.result.rbl_ip_checks >= self.core.spam.dnsbl.max_ip_checks { break; } } diff --git a/crates/spam-filter/src/analysis/llm.rs b/crates/spam-filter/src/analysis/llm.rs index 53cf352c..271b8f80 100644 --- a/crates/spam-filter/src/analysis/llm.rs +++ b/crates/spam-filter/src/analysis/llm.rs @@ -27,7 +27,15 @@ impl SpamFilterAnalyzeLlm for Server { .and_then(|c| c.spam_filter_llm.as_ref()) { let time = Instant::now(); - let prompt = config.prompt.clone(); + let body = if let Some(body) = ctx.text_body() { + body + } else { + return; + }; + let prompt = format!( + "{}\n\nSubject: {}\n\n{}", + config.prompt, ctx.output.subject, body + ); match config .model .send_request(prompt, config.temperature.into()) diff --git a/crates/spam-filter/src/analysis/mime.rs b/crates/spam-filter/src/analysis/mime.rs index f51e6ca2..3f212b70 100644 --- a/crates/spam-filter/src/analysis/mime.rs +++ b/crates/spam-filter/src/analysis/mime.rs @@ -4,7 +4,7 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use std::{collections::HashSet, future::Future, vec}; +use std::{collections::HashSet, future::Future, vec}; use common::{ scripts::functions::{array::cosine_similarity, unicode::CharUtils}, @@ -48,13 +48,27 @@ impl SpamFilterAnalyzeMime for Server { } HeaderName::ContentType => { has_ct = true; - is_plain_text = header.value().as_content_type().map_or(false, |ct| { - ct.ctype().eq_ignore_ascii_case("text") + + if let Some(ct) = header.value().as_content_type() { + if ct.ctype().eq_ignore_ascii_case("multipart") + && ct + .subtype() + .map_or(false, |s| s.eq_ignore_ascii_case("report")) + && ct.attribute("report-type").map_or(false, |a| { + a.eq_ignore_ascii_case("delivery-status") + || a.eq_ignore_ascii_case("disposition-notification") + }) + { + // Message is a DSN + ctx.result.add_tag("IS_DSN"); + } + + is_plain_text = ct.ctype().eq_ignore_ascii_case("text") && ct .subtype() .unwrap_or_default() - .eq_ignore_ascii_case("plain") - }); + .eq_ignore_ascii_case("plain"); + } } HeaderName::ContentTransferEncoding => { has_cte = true; @@ -104,6 +118,11 @@ impl SpamFilterAnalyzeMime for Server { if ct_type.is_empty() { // Content-Type header can't be parsed ctx.result.add_tag("BROKEN_CONTENT_TYPE"); + } else if (ct_type == "message" && ct_subtype == "rfc822") + || (ct_type == "text" && ct_subtype == "rfc822-headers") + { + // Message has parts + ctx.result.add_tag("HAS_MESSAGE_PARTS"); } if raw_message @@ -352,11 +371,11 @@ impl SpamFilterAnalyzeMime for Server { } let attach_name = attach_name.trim().to_lowercase(); if let Some((name, ext)) = attach_name.rsplit_once('.').and_then(|(name, ext)| { - Some((name, self.core.spam.list_file_extensions.get(ext)?)) + Some((name, self.core.spam.lists.file_extensions.get(ext)?)) }) { let sub_ext = name .rsplit_once('.') - .and_then(|(_, ext)| self.core.spam.list_file_extensions.get(ext)); + .and_then(|(_, ext)| self.core.spam.lists.file_extensions.get(ext)); if ext.is_bad { // Attachment has a bad extension diff --git a/crates/spam-filter/src/analysis/mod.rs b/crates/spam-filter/src/analysis/mod.rs index c9a34a92..6203faca 100644 --- a/crates/spam-filter/src/analysis/mod.rs +++ b/crates/spam-filter/src/analysis/mod.rs @@ -4,7 +4,7 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use std::{ +use std::{ borrow::Cow, hash::{Hash, Hasher}, }; @@ -12,10 +12,11 @@ use common::{config::spamfilter::Location, Server}; use mail_parser::{parsers::MessageStream, Header}; -use crate::{Recipient, SpamFilterInput, SpamFilterOutput, SpamFilterResult}; +use crate::{ + Recipient, SpamFilterContext, SpamFilterInput, SpamFilterOutput, SpamFilterResult, TextPart, +}; pub mod bayes; -pub mod bounce; pub mod date; pub mod dmarc; pub mod domain; @@ -61,6 +62,22 @@ impl SpamFilterOutput<'_> { } } +impl SpamFilterContext<'_> { + pub fn text_body(&self) -> Option<&str> { + self.input + .message + .text_body + .first() + .or_else(|| self.input.message.html_body.first()) + .and_then(|idx| self.output.text_parts.get(*idx)) + .and_then(|part| match part { + TextPart::Plain { text_body, .. } => Some(*text_body), + TextPart::Html { text_body, .. } => Some(text_body.as_str()), + TextPart::None => None, + }) + } +} + impl SpamFilterResult { pub fn add_tag(&mut self, tag: impl Into) { self.tags.insert(tag.into()); @@ -100,7 +117,7 @@ impl ElementLocation { } pub(crate) async fn is_trusted_domain(server: &Server, domain: &str, span_id: u64) -> bool { - if server.core.spam.list_trusted_domains.contains(domain) { + if server.core.spam.lists.trusted_domains.contains(domain) { return true; } diff --git a/crates/spam-filter/src/analysis/recipient.rs b/crates/spam-filter/src/analysis/recipient.rs index 40157ac8..84fba142 100644 --- a/crates/spam-filter/src/analysis/recipient.rs +++ b/crates/spam-filter/src/analysis/recipient.rs @@ -4,7 +4,7 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use std::future::Future; +use std::future::Future; use common::{scripts::functions::text::levenshtein_distance, Server}; use mail_parser::HeaderName; @@ -121,12 +121,6 @@ impl SpamFilterAnalyzeRecipient for Server { match unique_recipients.len() { 0 => { ctx.result.add_tag("RCPT_COUNT_ZERO"); - for raw in &[to_raw_utf8, cc_raw_utf8, bcc_raw_utf8] { - if matches!(raw, Ok(raw) if raw.to_ascii_lowercase().contains("undisclosed")) { - ctx.result.add_tag("R_UNDISC_RCPT"); - break; - } - } return; } 1 => { @@ -155,7 +149,6 @@ impl SpamFilterAnalyzeRecipient for Server { let mut to_dn_eq_addr_count = 0; let mut to_dn_count = 0; let mut to_match_envrcpt = 0; - let is_from_info = ctx.output.from.email.local_part == "info"; for rcpt in &unique_recipients { // Validate name @@ -164,9 +157,6 @@ impl SpamFilterAnalyzeRecipient for Server { to_dn_eq_addr_count += 1; } else { to_dn_count += 1; - if ["recipient", "recipients"].contains(&rcpt_name.as_str()) { - ctx.result.add_tag("TO_DN_RECIPIENTS"); - } } } @@ -177,27 +167,18 @@ impl SpamFilterAnalyzeRecipient for Server { // Check if the local part is present in the subject if !rcpt.email.local_part.is_empty() { - if ctx.output.subject.contains(&rcpt.email.address) { - ctx.result.add_tag("RCPT_ADDR_IN_SUBJECT"); + if ctx.output.subject_lc.contains(&rcpt.email.address) { + ctx.result.add_tag("RCPT_IN_SUBJECT"); } else if rcpt.email.local_part.len() > 3 - && ctx.output.subject.contains(&rcpt.email.local_part) + && ctx.output.subject_lc.contains(&rcpt.email.local_part) { ctx.result.add_tag("RCPT_LOCAL_IN_SUBJECT"); } - - if rcpt.email.local_part.contains('+') { - ctx.result.add_tag("TAGGED_RCPT"); - } - } - - // Check if it is an into to info - if has_list_unsubscribe && is_from_info && rcpt.email.local_part == "info" { - ctx.result.add_tag("INFO_TO_INFO_LU"); } // Check for freemail or disposable domains if let Some(domain) = rcpt.email.domain_part.sld.as_deref() { - if self.core.spam.list_freemail_providers.contains(domain) { + if self.core.spam.lists.freemail_providers.contains(domain) { if ctx .output .recipients_to @@ -208,7 +189,7 @@ impl SpamFilterAnalyzeRecipient for Server { } else { ctx.result.add_tag("FREEMAIL_CC"); } - } else if self.core.spam.list_disposable_providers.contains(domain) { + } else if self.core.spam.lists.disposable_providers.contains(domain) { if ctx .output .recipients_to diff --git a/crates/spam-filter/src/analysis/replyto.rs b/crates/spam-filter/src/analysis/replyto.rs index 50498af0..045e9cd5 100644 --- a/crates/spam-filter/src/analysis/replyto.rs +++ b/crates/spam-filter/src/analysis/replyto.rs @@ -4,15 +4,13 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use std::future::Future; +use std::future::Future; use common::Server; use mail_parser::HeaderName; use crate::SpamFilterContext; -use super::from::TITLES; - pub trait SpamFilterAnalyzeReplyTo: Sync + Send { fn spam_filter_analyze_reply_to( &self, @@ -113,7 +111,8 @@ impl SpamFilterAnalyzeReplyTo for Server { if self .core .spam - .list_freemail_providers + .lists + .freemail_providers .contains(reply_to_sld) { ctx.result.add_tag("FREEMAIL_REPLYTO"); @@ -129,7 +128,8 @@ impl SpamFilterAnalyzeReplyTo for Server { && self .core .spam - .list_freemail_providers + .lists + .freemail_providers .contains(from_domain_sld) { ctx.result.add_tag("FREEMAIL_REPLYTO_NEQ_FROM_DOM"); @@ -137,7 +137,8 @@ impl SpamFilterAnalyzeReplyTo for Server { } else if self .core .spam - .list_disposable_providers + .lists + .disposable_providers .contains(reply_to_sld) { ctx.result.add_tag("DISPOSABLE_REPLYTO"); @@ -158,14 +159,6 @@ impl SpamFilterAnalyzeReplyTo for Server { ctx.result.add_tag("REPLYTO_EXCESS_BASE64"); } } - - // Validate reply-to name - for title in TITLES { - if reply_to_name.contains(title) { - ctx.result.add_tag("REPLYTO_EMAIL_HAS_TITLE"); - break; - } - } } else { ctx.result.add_tag("REPLYTO_UNPARSABLE"); } diff --git a/crates/spam-filter/src/analysis/rules.rs b/crates/spam-filter/src/analysis/rules.rs index babeddc1..5a5e6aab 100644 --- a/crates/spam-filter/src/analysis/rules.rs +++ b/crates/spam-filter/src/analysis/rules.rs @@ -4,7 +4,7 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use std::future::Future; +use std::future::Future; use common::{ config::spamfilter::{Element, Location}, @@ -27,7 +27,7 @@ impl SpamFilterAnalyzeRules for Server { async fn spam_filter_analyze_rules(&self, ctx: &mut SpamFilterContext<'_>) { for rule in &self.core.spam.rules { match rule.scope { - Some(Element::Url) => { + Element::Url => { for url in &ctx.output.urls { if let Some(tag) = self .eval_if::( @@ -41,7 +41,7 @@ impl SpamFilterAnalyzeRules for Server { } } } - Some(Element::Domain) => { + Element::Domain => { for domain in &ctx.output.domains { if let Some(tag) = self .eval_if::( @@ -59,7 +59,7 @@ impl SpamFilterAnalyzeRules for Server { } } } - Some(Element::Email) => { + Element::Email => { for email in &ctx.output.emails { if let Some(tag) = self .eval_if::( @@ -92,7 +92,7 @@ impl SpamFilterAnalyzeRules for Server { } } } - Some(Element::Ip) => { + Element::Ip => { for ip in &ctx.output.ips { if let Some(tag) = self .eval_if::( @@ -106,7 +106,7 @@ impl SpamFilterAnalyzeRules for Server { } } } - Some(Element::Header) => { + Element::Header => { for header in ctx.input.message.headers() { let raw = String::from_utf8_lossy( ctx.input @@ -135,7 +135,7 @@ impl SpamFilterAnalyzeRules for Server { } } } - Some(Element::Body) => { + Element::Body => { for (idx, part) in ctx.output.text_parts.iter().enumerate() { let text = match part { TextPart::Plain { text_body, .. } => *text_body, @@ -162,7 +162,7 @@ impl SpamFilterAnalyzeRules for Server { } } } - None => { + Element::Any => { if let Some(tag) = self .eval_if::( &rule.rule, diff --git a/crates/spam-filter/src/analysis/score.rs b/crates/spam-filter/src/analysis/score.rs index 23cffd45..5fa7e154 100644 --- a/crates/spam-filter/src/analysis/score.rs +++ b/crates/spam-filter/src/analysis/score.rs @@ -4,7 +4,7 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use common::{config::spamfilter::SpamFilterAction, Server}; +use common::{config::spamfilter::SpamFilterAction, Server}; use std::{fmt::Write, future::Future, vec}; use crate::{modules::bayes::bayes_train_if_balanced, SpamFilterContext}; @@ -28,7 +28,7 @@ impl SpamFilterAnalyzeScore for Server { let mut header_len = 60; for tag in &ctx.result.tags { - let score = match self.core.spam.list_scores.get(tag) { + let score = match self.core.spam.lists.scores.get(tag) { Some(SpamFilterAction::Allow(score)) => *score, Some(SpamFilterAction::Discard) => { return SpamFilterAction::Discard; @@ -40,7 +40,9 @@ impl SpamFilterAnalyzeScore for Server { }; ctx.result.score += score; header_len += tag.len() + 10; - results.push((tag.as_str(), score)); + if score != 0.0 || !tag.starts_with("X_") { + results.push((tag.as_str(), score)); + } } // Sort by score @@ -78,19 +80,19 @@ impl SpamFilterAnalyzeScore for Server { } } - if self.core.spam.score_reject_threshold > 0.0 - && ctx.result.score >= self.core.spam.score_reject_threshold + if self.core.spam.scores.reject_threshold > 0.0 + && ctx.result.score >= self.core.spam.scores.reject_threshold { SpamFilterAction::Reject - } else if self.core.spam.score_discard_threshold > 0.0 - && ctx.result.score >= self.core.spam.score_discard_threshold + } else if self.core.spam.scores.discard_threshold > 0.0 + && ctx.result.score >= self.core.spam.scores.discard_threshold { SpamFilterAction::Discard } else { let _ = write!( &mut header, "X-Spam-Status: {}, score={:.2}\r\n", - if ctx.result.score >= self.core.spam.score_spam_threshold { + if ctx.result.score >= self.core.spam.scores.spam_threshold { "Yes" } else { "No" diff --git a/crates/spam-filter/src/analysis/subject.rs b/crates/spam-filter/src/analysis/subject.rs index ec1a0c75..f4438159 100644 --- a/crates/spam-filter/src/analysis/subject.rs +++ b/crates/spam-filter/src/analysis/subject.rs @@ -4,7 +4,7 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use std::future::Future; +use std::future::Future; use common::Server; use mail_parser::HeaderName; @@ -23,22 +23,15 @@ pub trait SpamFilterAnalyzeSubject: Sync + Send { impl SpamFilterAnalyzeSubject for Server { async fn spam_filter_analyze_subject(&self, ctx: &mut SpamFilterContext<'_>) { let mut subject_raw = b"".as_slice(); - let mut is_reply = false; for header in ctx.input.message.headers() { - match &header.name { - HeaderName::Subject => { - subject_raw = ctx - .input - .message - .raw_message() - .get(header.offset_start..header.offset_end) - .unwrap_or_default(); - } - HeaderName::InReplyTo | HeaderName::References => { - is_reply = true; - } - _ => {} + if header.name == HeaderName::Subject { + subject_raw = ctx + .input + .message + .raw_message() + .get(header.offset_start..header.offset_end) + .unwrap_or_default(); } } @@ -66,12 +59,6 @@ impl SpamFilterAnalyzeSubject for Server { '$' | '€' | '£' | '¥' | '₹' | '₽' | '₿' => { ctx.result.add_tag("SUBJECT_HAS_CURRENCY"); } - '!' => { - ctx.result.add_tag("SUBJECT_HAS_EXCLAIM"); - } - '?' => { - ctx.result.add_tag("SUBJECT_HAS_QUESTION"); - } _ => { if ch.is_alphabetic() { if ch.is_uppercase() { @@ -93,16 +80,6 @@ impl SpamFilterAnalyzeSubject for Server { last_ch = ch; } - match last_ch_trimmed { - '?' => { - ctx.result.add_tag("SUBJECT_ENDS_QUESTION"); - } - '!' => { - ctx.result.add_tag("SUBJECT_ENDS_EXCLAIM"); - } - _ => {} - } - if last_ch.is_whitespace() { if last_ch_trimmed.is_whitespace() { // Subject is empty @@ -122,11 +99,6 @@ impl SpamFilterAnalyzeSubject for Server { ctx.result.add_tag("SUBJ_ALL_CAPS"); } - if ctx.output.subject_thread.len() > 200 { - // Subject is very long - ctx.result.add_tag("LONG_SUBJ"); - } - for token in &ctx.output.subject_tokens { match token { TokenType::Url(_) => { @@ -187,10 +159,5 @@ impl SpamFilterAnalyzeSubject for Server { ctx.result.add_tag("SUBJ_EXCESS_BASE64"); } } - - if !is_reply && ctx.output.subject.trim().starts_with("re:") { - // Subject is not a reply but starts with "re:" - ctx.result.add_tag("FAKE_REPLY"); - } } } diff --git a/crates/spam-filter/src/analysis/trusted_reply.rs b/crates/spam-filter/src/analysis/trusted_reply.rs index c95d0b26..7995ea4d 100644 --- a/crates/spam-filter/src/analysis/trusted_reply.rs +++ b/crates/spam-filter/src/analysis/trusted_reply.rs @@ -4,7 +4,7 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use std::future::Future; +use std::future::Future; use common::{Server, KV_TRUSTED_REPLY}; use mail_parser::{HeaderName, HeaderValue}; @@ -26,7 +26,7 @@ pub trait SpamFilterAnalyzeTrustedReply: Sync + Send { impl SpamFilterAnalyzeTrustedReply for Server { async fn spam_filter_analyze_reply_in(&self, ctx: &mut SpamFilterContext<'_>) { - if self.core.spam.trusted_reply.is_some() { + if self.core.spam.expiry.trusted_reply.is_some() { for header in ctx.input.message.headers() { if let HeaderName::InReplyTo | HeaderName::References = &header.name { let ids: Box + Send> = match &header.value { @@ -61,9 +61,10 @@ impl SpamFilterAnalyzeTrustedReply for Server { } async fn spam_filter_analyze_reply_out(&self, ctx: &mut SpamFilterContext<'_>) { - if let (Some(hold_time), Some(message_id)) = - (self.core.spam.trusted_reply, ctx.input.message.message_id()) - { + if let (Some(hold_time), Some(message_id)) = ( + self.core.spam.expiry.trusted_reply, + ctx.input.message.message_id(), + ) { if let Err(err) = self .in_memory_store() .key_set( diff --git a/crates/spam-filter/src/analysis/url.rs b/crates/spam-filter/src/analysis/url.rs index c152caa2..887f63e9 100644 --- a/crates/spam-filter/src/analysis/url.rs +++ b/crates/spam-filter/src/analysis/url.rs @@ -4,7 +4,7 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use std::collections::HashSet; +use std::collections::HashSet; use std::hash::{Hash, Hasher}; use std::{borrow::Cow, future::Future, time::Duration}; @@ -176,18 +176,14 @@ impl SpamFilterAnalyzeUrl for Server { // Skip local and trusted domains if is_trusted_domain(self, host_sld, ctx.input.span_id).await { - ctx.output.urls.insert(ElementLocation::new( - UrlParts::new(url.element).with_parsed(url_parsed), - url.location, - )); continue; } if let Some(ip) = url_parsed.host.ip { // Check IP DNSBL - if ctx.result.rbl_ip_checks < self.core.spam.max_rbl_ip_checks { - for dnsbl in &self.core.spam.dnsbls { - if dnsbl.element == Element::Ip { + if ctx.result.rbl_ip_checks < self.core.spam.dnsbl.max_ip_checks { + for dnsbl in &self.core.spam.dnsbl.servers { + if dnsbl.scope == Element::Ip { if let Some(tag) = is_dnsbl( self, dnsbl, @@ -201,7 +197,7 @@ impl SpamFilterAnalyzeUrl for Server { } ctx.result.rbl_ip_checks += 1; } - } else if self.core.spam.list_url_redirectors.contains(host_sld) { + } else if self.core.spam.lists.url_redirectors.contains(host_sld) { // Check for redirectors ctx.result.add_tag("REDIRECTOR_URL"); @@ -219,7 +215,8 @@ impl SpamFilterAnalyzeUrl for Server { if self .core .spam - .list_url_redirectors + .lists + .url_redirectors .contains(host.sld_or_default()) { url_redirect = Cow::Owned(location); @@ -262,12 +259,7 @@ impl SpamFilterAnalyzeUrl for Server { }) { let host = &url_parsed.host; let url = &el.element.url; - let url_parsed = &url_parsed.parts; - let query = url_parsed - .path_and_query() - .map(|pq| pq.as_str()) - .unwrap_or_default(); if host.ip.is_none() { if !host.fqdn.is_ascii() { if let Ok(cured_host) = decancer::cure(&host.fqdn, decancer::Options::default()) @@ -283,29 +275,12 @@ impl SpamFilterAnalyzeUrl for Server { ctx.result.add_tag("MIXED_CHARSET_URL"); } } - } else if matches!(host.sld.as_deref(), Some("googleusercontent.com")) - && query.starts_with("/proxy/") - { - ctx.result.add_tag("HAS_GUC_PROXY_URI"); - } else if host.fqdn.ends_with("firebasestorage.googleapis.com") { - ctx.result.add_tag("HAS_GOOGLE_FIREBASE_URL"); - } else if host.sld_or_default().starts_with("google.") && query.contains("url?") { - ctx.result.add_tag("HAS_GOOGLE_REDIR"); - } - - if host.fqdn.contains("ipfs.") || (query.contains("/ipfs") && query.contains("/qm")) - { - // InterPlanetary File System (IPFS) gateway URL, likely malicious - ctx.result.add_tag("HAS_IPFS_GATEWAY_URL"); - } else if host.fqdn.ends_with(".onion") { - // Onion URL - ctx.result.add_tag("HAS_ONION_URI"); } // Check Domain DNSBL - if ctx.result.rbl_domain_checks < self.core.spam.max_rbl_domain_checks { - for dnsbl in &self.core.spam.dnsbls { - if matches!(dnsbl.element, Element::Domain) { + if ctx.result.rbl_domain_checks < self.core.spam.dnsbl.max_domain_checks { + for dnsbl in &self.core.spam.dnsbl.servers { + if matches!(dnsbl.scope, Element::Domain) { if let Some(tag) = is_dnsbl( self, dnsbl, @@ -328,27 +303,9 @@ impl SpamFilterAnalyzeUrl for Server { ctx.result.add_tag("R_SUSPICIOUS_URL"); } - if query.starts_with("/wp-") { - // Contains WordPress URIs - ctx.result.add_tag("HAS_WP_URI"); - - if query.starts_with("/wp-content") || query.starts_with("/wp-includes") { - // URL that is pointing to a compromised WordPress installation - ctx.result.add_tag("WP_COMPROMISED"); - } - } - - if query.contains("/../") - && !query.contains("/.well-known") - && !query.contains("/.well_known") - { - // Message contains URI with a hidden path - ctx.result.add_tag("URI_HIDDEN_PATH"); - } - // Check remote lists - for remote in &self.core.spam.remote_lists { - if matches!(remote.element, Element::Url) + for remote in &self.core.spam.lists.remote { + if matches!(remote.scope, Element::Url) && is_in_remote_list(self, remote, url.as_ref(), ctx.input.span_id).await { ctx.result.add_tag(&remote.tag); @@ -356,9 +313,9 @@ impl SpamFilterAnalyzeUrl for Server { } // Check URL DNSBL - if ctx.result.rbl_url_checks < self.core.spam.max_rbl_url_checks { - for dnsbl in &self.core.spam.dnsbls { - if matches!(dnsbl.element, Element::Url) { + if ctx.result.rbl_url_checks < self.core.spam.dnsbl.max_url_checks { + for dnsbl in &self.core.spam.dnsbl.servers { + if matches!(dnsbl.scope, Element::Url) { if let Some(tag) = is_dnsbl( self, dnsbl, diff --git a/crates/spam-filter/src/lib.rs b/crates/spam-filter/src/lib.rs index 69f5f1f0..66546004 100644 --- a/crates/spam-filter/src/lib.rs +++ b/crates/spam-filter/src/lib.rs @@ -66,7 +66,9 @@ pub struct SpamFilterOutput<'x> { pub reply_to: Option, pub subject: String, + pub subject_lc: String, pub subject_thread: String, + pub subject_thread_lc: String, pub subject_tokens: Vec>, pub ips: AHashSet>, diff --git a/crates/spam-filter/src/modules/dnsbl.rs b/crates/spam-filter/src/modules/dnsbl.rs index 19e9f4db..1c83fd92 100644 --- a/crates/spam-filter/src/modules/dnsbl.rs +++ b/crates/spam-filter/src/modules/dnsbl.rs @@ -4,19 +4,19 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use std::time::Instant; +use std::{net::Ipv4Addr, time::Instant}; -use common::{config::spamfilter::DnsblConfig, expr::functions::ResolveVariable, Server}; +use common::{config::spamfilter::DnsBlServer, expr::functions::ResolveVariable, Server}; use mail_auth::Error; use trc::SpamEvent; -use crate::modules::expression::StringListResolver; +use crate::modules::expression::IpResolver; use super::expression::SpamFilterResolver; pub(crate) async fn is_dnsbl( server: &Server, - config: &DnsblConfig, + config: &DnsBlServer, resolver: SpamFilterResolver<'_, impl ResolveVariable>, ) -> Option { let time = Instant::now(); @@ -27,13 +27,11 @@ pub(crate) async fn is_dnsbl( match server.core.smtp.resolvers.dns.ipv4_lookup(&zone).await { Ok(result) => { - let result = result.iter().map(|ip| ip.to_string()).collect::>(); - trc::event!( Spam(SpamEvent::Classify), Result = result .iter() - .map(|ip| trc::Value::from(ip.clone())) + .map(|ip| trc::Value::from(ip.to_string())) .collect::>(), Elapsed = time.elapsed() ); @@ -41,7 +39,18 @@ pub(crate) async fn is_dnsbl( server .eval_if( &config.tags, - &StringListResolver(&result), + &SpamFilterResolver::new( + resolver.ctx, + &IpResolver( + result + .iter() + .copied() + .next() + .unwrap_or(Ipv4Addr::BROADCAST) + .into(), + ), + resolver.location, + ), resolver.ctx.input.span_id, ) .await diff --git a/crates/spam-filter/src/modules/expression.rs b/crates/spam-filter/src/modules/expression.rs index cf711ba9..3ed5a1ed 100644 --- a/crates/spam-filter/src/modules/expression.rs +++ b/crates/spam-filter/src/modules/expression.rs @@ -4,56 +4,17 @@ * SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL */ - use std::net::IpAddr; +use std::net::IpAddr; use common::{ - config::spamfilter::Location, - expr::{functions::ResolveVariable, tokenizer::TokenMap, Variable}, + config::spamfilter::*, + expr::{functions::ResolveVariable, Variable}, }; use mail_auth::common::resolver::ToReverseName; use mail_parser::{Header, HeaderValue}; use crate::{analysis::url::UrlParts, Recipient, SpamFilterContext, TextPart}; -pub const V_SPAM_REMOTE_IP: u32 = 100; -pub const V_SPAM_REMOTE_IP_PTR: u32 = 101; -pub const V_SPAM_EHLO_DOMAIN: u32 = 102; -pub const V_SPAM_AUTH_AS: u32 = 103; -pub const V_SPAM_ASN: u32 = 104; -pub const V_SPAM_COUNTRY: u32 = 105; -pub const V_SPAM_TLS_VERSION: u32 = 106; -pub const V_SPAM_TLS_CIPHER: u32 = 107; -pub const V_SPAM_ENV_FROM: u32 = 108; -pub const V_SPAM_ENV_FROM_LOCAL: u32 = 109; -pub const V_SPAM_ENV_FROM_DOMAIN: u32 = 110; -pub const V_SPAM_ENV_TO: u32 = 111; -pub const V_SPAM_FROM: u32 = 112; -pub const V_SPAM_FROM_NAME: u32 = 113; -pub const V_SPAM_FROM_LOCAL: u32 = 114; -pub const V_SPAM_FROM_DOMAIN: u32 = 115; -pub const V_SPAM_REPLY_TO: u32 = 116; -pub const V_SPAM_REPLY_TO_NAME: u32 = 117; -pub const V_SPAM_REPLY_TO_LOCAL: u32 = 118; -pub const V_SPAM_REPLY_TO_DOMAIN: u32 = 119; -pub const V_SPAM_TO: u32 = 120; -pub const V_SPAM_TO_NAME: u32 = 121; -pub const V_SPAM_TO_LOCAL: u32 = 122; -pub const V_SPAM_TO_DOMAIN: u32 = 123; -pub const V_SPAM_CC: u32 = 124; -pub const V_SPAM_CC_NAME: u32 = 125; -pub const V_SPAM_CC_LOCAL: u32 = 126; -pub const V_SPAM_CC_DOMAIN: u32 = 127; -pub const V_SPAM_BCC: u32 = 128; -pub const V_SPAM_BCC_NAME: u32 = 129; -pub const V_SPAM_BCC_LOCAL: u32 = 130; -pub const V_SPAM_BCC_DOMAIN: u32 = 131; -pub const V_SPAM_BODY_TEXT: u32 = 132; -pub const V_SPAM_BODY_HTML: u32 = 133; -pub const V_SPAM_BODY_RAW: u32 = 134; -pub const V_SPAM_SUBJECT: u32 = 135; -pub const V_SPAM_SUBJECT_THREAD: u32 = 136; -pub const V_SPAM_LOCATION: u32 = 137; - pub(crate) struct SpamFilterResolver<'x, T: ResolveVariable> { pub ctx: &'x SpamFilterContext<'x>, pub item: &'x T, @@ -245,23 +206,7 @@ impl ResolveVariable for SpamFilterResolver<'_, T> { .map(|r| Variable::String(r.email.domain_part.fqdn.as_str().into())) .collect::>() .into(), - V_SPAM_BODY_TEXT => self - .ctx - .input - .message - .text_body - .first() - .or_else(|| self.ctx.input.message.html_body.first()) - .and_then(|idx| self.ctx.output.text_parts.get(*idx)) - .map(|part| { - match part { - TextPart::Plain { text_body, .. } => text_body, - TextPart::Html { text_body, .. } => text_body.as_str(), - TextPart::None => "", - } - .into() - }) - .unwrap_or_default(), + V_SPAM_BODY_TEXT => self.ctx.text_body().unwrap_or_default().into(), V_SPAM_BODY_HTML => self .ctx .input @@ -280,8 +225,8 @@ impl ResolveVariable for SpamFilterResolver<'_, T> { V_SPAM_BODY_RAW => Variable::String(String::from_utf8_lossy( self.ctx.input.message.raw_message(), )), - V_SPAM_SUBJECT => self.ctx.output.subject.as_str().into(), - V_SPAM_SUBJECT_THREAD => self.ctx.output.subject_thread.as_str().into(), + V_SPAM_SUBJECT => self.ctx.output.subject_lc.as_str().into(), + V_SPAM_SUBJECT_THREAD => self.ctx.output.subject_thread_lc.as_str().into(), V_SPAM_LOCATION => self.location.as_str().into(), _ => Variable::Integer(0), } @@ -292,97 +237,65 @@ impl ResolveVariable for SpamFilterResolver<'_, T> { } } -pub fn spam_token_map() -> TokenMap { - TokenMap::default().with_variables_map([ - ("remote_ip", V_SPAM_REMOTE_IP), - ("remote_ip.ptr", V_SPAM_REMOTE_IP_PTR), - ("ehlo_domain", V_SPAM_EHLO_DOMAIN), - ("auth_as", V_SPAM_AUTH_AS), - ("asn", V_SPAM_ASN), - ("country", V_SPAM_COUNTRY), - ("tls_version", V_SPAM_TLS_VERSION), - ("tls_cipher", V_SPAM_TLS_CIPHER), - ("env_from", V_SPAM_ENV_FROM), - ("env_from.local", V_SPAM_ENV_FROM_LOCAL), - ("env_from.domain", V_SPAM_ENV_FROM_DOMAIN), - ("env_to", V_SPAM_ENV_TO), - ("from", V_SPAM_FROM), - ("from.name", V_SPAM_FROM_NAME), - ("from.local", V_SPAM_FROM_LOCAL), - ("from.domain", V_SPAM_FROM_DOMAIN), - ("reply_to", V_SPAM_REPLY_TO), - ("reply_to.name", V_SPAM_REPLY_TO_NAME), - ("reply_to.local", V_SPAM_REPLY_TO_LOCAL), - ("reply_to.domain", V_SPAM_REPLY_TO_DOMAIN), - ("to", V_SPAM_TO), - ("to.name", V_SPAM_TO_NAME), - ("to.local", V_SPAM_TO_LOCAL), - ("to.domain", V_SPAM_TO_DOMAIN), - ("cc", V_SPAM_CC), - ("cc.name", V_SPAM_CC_NAME), - ("cc.local", V_SPAM_CC_LOCAL), - ("cc.domain", V_SPAM_CC_DOMAIN), - ("bcc", V_SPAM_BCC), - ("bcc.name", V_SPAM_BCC_NAME), - ("bcc.local", V_SPAM_BCC_LOCAL), - ("bcc.domain", V_SPAM_BCC_DOMAIN), - ("body", V_SPAM_BODY_TEXT), - ("body.text", V_SPAM_BODY_TEXT), - ("body.html", V_SPAM_BODY_HTML), - ("body.raw", V_SPAM_BODY_RAW), - ("subject", V_SPAM_SUBJECT), - ("subject.thread", V_SPAM_SUBJECT_THREAD), - ("location", V_SPAM_LOCATION), - ]) -} - pub(crate) struct EmailHeader<'x> { pub header: &'x Header<'x>, pub raw: &'x str, } -pub fn mail_header_token_map() -> TokenMap { - TokenMap::default().with_variables_map([ - ("name", 0), - ("value", 1), - ("email", 1), - ("name", 2), - ("attributes", 2), - ("raw", 3), - ]) -} - impl ResolveVariable for EmailHeader<'_> { fn resolve_variable(&self, variable: u32) -> Variable<'_> { match variable { - 0 => self.header.name().into(), - 1 | 2 => match &self.header.value { - HeaderValue::Text(text) => text.as_ref().into(), + V_HEADER_NAME => self.header.name().into(), + V_HEADER_NAME_LOWER => self.header.name().to_ascii_lowercase().into(), + V_HEADER_VALUE | V_HEADER_VALUE_LOWER | V_HEADER_PROPERTY => match &self.header.value { + HeaderValue::Text(text) => { + if variable == V_HEADER_VALUE_LOWER { + text.to_ascii_lowercase().into() + } else { + text.as_ref().into() + } + } HeaderValue::TextList(list) => Variable::Array( list.iter() - .map(|v| Variable::String(v.as_ref().into())) + .map(|text| { + Variable::String(if variable == V_HEADER_VALUE_LOWER { + text.to_ascii_lowercase().into() + } else { + text.as_ref().into() + }) + }) .collect(), ), HeaderValue::Address(address) => Variable::Array(if variable == 1 { address .iter() .filter_map(|a| { - a.address - .as_ref() - .map(|a| Variable::String(a.as_ref().into())) + a.address.as_ref().map(|text| { + Variable::String(if variable == V_HEADER_VALUE_LOWER { + text.to_ascii_lowercase().into() + } else { + text.as_ref().into() + }) + }) }) .collect() } else { address .iter() .filter_map(|a| { - a.name.as_ref().map(|a| Variable::String(a.as_ref().into())) + a.name.as_ref().map(|text| { + Variable::String(if variable == V_HEADER_VALUE_LOWER { + text.to_ascii_lowercase().into() + } else { + text.as_ref().into() + }) + }) }) .collect() }), HeaderValue::DateTime(date_time) => date_time.to_rfc3339().into(), HeaderValue::ContentType(ct) => { - if variable == 1 { + if variable != V_HEADER_PROPERTY { if let Some(st) = ct.subtype() { format!("{}/{}", ct.ctype(), st).into() } else { @@ -400,10 +313,17 @@ impl ResolveVariable for EmailHeader<'_> { ) } } - HeaderValue::Received(_) => self.raw.trim().into(), + HeaderValue::Received(_) => { + if variable == V_HEADER_VALUE_LOWER { + self.raw.trim().to_lowercase().into() + } else { + self.raw.trim().into() + } + } HeaderValue::Empty => "".into(), }, - 3 => self.raw.into(), + V_HEADER_RAW => self.raw.into(), + V_HEADER_RAW_LOWER => self.raw.to_lowercase().into(), _ => Variable::Integer(0), } } @@ -413,12 +333,6 @@ impl ResolveVariable for EmailHeader<'_> { } } -pub const V_RCPT_EMAIL: u32 = 0; -pub const V_RCPT_NAME: u32 = 1; -pub const V_RCPT_LOCAL: u32 = 2; -pub const V_RCPT_DOMAIN: u32 = 3; -pub const V_RCPT_DOMAIN_SLD: u32 = 4; - impl ResolveVariable for Recipient { fn resolve_variable(&self, variable: u32) -> Variable<'_> { match variable { @@ -436,28 +350,6 @@ impl ResolveVariable for Recipient { } } -impl Recipient { - pub fn token_map() -> TokenMap { - TokenMap::default().with_variables_map([ - ("email", V_RCPT_EMAIL), - ("name", V_RCPT_NAME), - ("local", V_RCPT_LOCAL), - ("domain", V_RCPT_DOMAIN), - ("sld", V_RCPT_DOMAIN_SLD), - ]) - } -} - -pub const V_URL_FULL: u32 = 0; -pub const V_URL_PATH_QUERY: u32 = 1; -pub const V_URL_PATH: u32 = 2; -pub const V_URL_QUERY: u32 = 3; -pub const V_URL_SCHEME: u32 = 4; -pub const V_URL_AUTHORITY: u32 = 5; -pub const V_URL_HOST: u32 = 6; -pub const V_URL_HOST_SLD: u32 = 7; -pub const V_URL_PORT: u32 = 8; - impl ResolveVariable for UrlParts { fn resolve_variable(&self, variable: u32) -> Variable<'_> { match variable { @@ -526,22 +418,6 @@ impl ResolveVariable for UrlParts { } } -impl UrlParts { - pub fn token_map() -> TokenMap { - TokenMap::default().with_variables_map([ - ("url", V_URL_FULL), - ("path_query", V_URL_PATH_QUERY), - ("path", V_URL_PATH), - ("query", V_URL_QUERY), - ("scheme", V_URL_SCHEME), - ("authority", V_URL_AUTHORITY), - ("host", V_URL_HOST), - ("sld", V_URL_HOST_SLD), - ("port", V_URL_PORT), - ]) - } -} - pub struct StringResolver<'x>(pub &'x str); impl ResolveVariable for StringResolver<'_> { @@ -571,8 +447,22 @@ pub struct IpResolver(pub IpAddr); impl ResolveVariable for IpResolver { fn resolve_variable(&self, variable: u32) -> Variable<'_> { match variable { - 0 => Variable::String(self.0.to_string().into()), - 1 => Variable::String(self.0.to_reverse_name().into()), + V_IP => Variable::String(self.0.to_string().into()), + V_IP_REVERSE => Variable::String(self.0.to_reverse_name().into()), + V_IP_OCTETS => Variable::Array(match self.0 { + IpAddr::V4(ipv4_addr) => ipv4_addr + .octets() + .iter() + .map(|o| Variable::Integer(*o as _)) + .collect(), + IpAddr::V6(ipv6_addr) => ipv6_addr + .octets() + .iter() + .map(|o| Variable::Integer(*o as _)) + .collect(), + }), + V_IP_IS_V4 => Variable::Integer(self.0.is_ipv4() as _), + V_IP_IS_V6 => Variable::Integer(self.0.is_ipv6() as _), _ => Variable::Integer(0), } } @@ -581,7 +471,3 @@ impl ResolveVariable for IpResolver { Variable::Integer(0) } } - -pub fn new_ip() -> TokenMap { - TokenMap::default().with_variables_map([("ip", 0), ("reverse_ip", 1)]) -} diff --git a/crates/utils/src/config/mod.rs b/crates/utils/src/config/mod.rs index 6e797a6a..cf7fbcb8 100644 --- a/crates/utils/src/config/mod.rs +++ b/crates/utils/src/config/mod.rs @@ -55,7 +55,7 @@ pub struct Rate { pub period: Duration, } -pub(crate) type Result = std::result::Result; +pub type Result = std::result::Result; impl Config { pub async fn resolve_macros(&mut self, classes: &[&str]) { diff --git a/crates/utils/src/config/utils.rs b/crates/utils/src/config/utils.rs index 62fcadd8..2790731d 100644 --- a/crates/utils/src/config/utils.rs +++ b/crates/utils/src/config/utils.rs @@ -208,6 +208,32 @@ impl Config { } } + pub fn value_require_non_empty(&mut self, key: impl AsKey) -> Option<&str> { + let key = key.as_key(); + + #[cfg(debug_assertions)] + self.keys_read.lock().insert(key.clone()); + + if let Some(value) = self.keys.get(&key).and_then(|v| { + let v = v.trim(); + if !v.is_empty() { + Some(v) + } else { + None + } + }) { + Some(value) + } else { + self.errors.insert( + key, + ConfigError::Parse { + error: "Missing property".to_string(), + }, + ); + None + } + } + pub fn try_parse_value(&mut self, key: impl AsKey, value: &str) -> Option { match T::parse_value(value) { Ok(value) => Some(value), diff --git a/resources/config/build.py b/resources/config/build.py deleted file mode 100644 index 59bf8fbb..00000000 --- a/resources/config/build.py +++ /dev/null @@ -1,104 +0,0 @@ -# -# SPDX-FileCopyrightText: 2020 Stalwart Labs Ltd -# -# SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-SEL -# - -import os - -# Define the scripts and their component files -scripts = { - "spam-filter": [ - "config.sieve", - "prelude.sieve", - "from.sieve", - "recipient.sieve", - "subject.sieve", - "replyto.sieve", - "date.sieve", - "messageid.sieve", - "received.sieve", - "headers.sieve", - "bounce.sieve", - "html.sieve", - "mime.sieve", - "dmarc.sieve", - "ip.sieve", - "helo.sieve", - "replies_in.sieve", - "spamtrap.sieve", - "bayes_classify.sieve", - "url.sieve", - "rbl.sieve", - "pyzor.sieve", - "llm.sieve", - "composites.sieve", - "scores.sieve", - "reputation.sieve", - "epilogue.sieve" - ], - "track-replies": [ - "config.sieve", - "replies_out.sieve" - ], - "greylist": [ - "config.sieve", - "greylist.sieve" - ], - "train": [ - "config.sieve", - "train.sieve" - ] -} -script_names = { - "spam-filter" : "Spam Filter", - "track-replies" : "Track Replies", - "greylist" : "Greylisting", - "train": "Train Bayes Classifier" -} - -maps = ["spam_config.map", - "scores.map", - "allow_dmarc.list", - "allow_domains.list", - "allow_spf_dkim.list", - "domains_disposable.list", - "domains_free.list", - "mime_types.map", - "url_redirectors.list"] - - -def read_and_concatenate(files): - content = "" - for file in files: - with open(os.path.join("./spamfilter/scripts", file), "r", encoding="utf-8") as f: - content += "\n#### Script " + file + " ####\n\n" - content += f.read() + "\n" - return content - -def read_file(file): - with open(file, "r", encoding="utf-8") as f: - return f.read() + "\n" - -def build_spam_filters(scripts): - spam_filter = "[version]\nspam-filter = \"1.2\"\n\n" - for script_name, file_list in scripts.items(): - script_content = read_and_concatenate(file_list).replace("'''", "\\'\\'\\'") - script_description = script_names[script_name] - spam_filter += f"[sieve.trusted.scripts.{script_name}]\nname = \"{script_description}\"\ncontents = '''\n{script_content}'''\n\n" - - spam_filter += "\n[lookup]\n" - for map in maps : - with open(os.path.join("./spamfilter/maps", map), "r", encoding="utf-8") as f: - spam_filter += f.read() + "\n" - - return spam_filter - -def main(): - spam_filter = build_spam_filters(scripts) - with open("spamfilter.toml", "w", encoding="utf-8") as toml_file: - toml_file.write(spam_filter) - print("Stalwart TOML configuration files have been generated.") - -if __name__ == "__main__": - main() diff --git a/resources/config/spamfilter/maps/allow_dmarc.list b/resources/config/spamfilter/maps/allow_dmarc.list deleted file mode 100644 index 7a973841..00000000 --- a/resources/config/spamfilter/maps/allow_dmarc.list +++ /dev/null @@ -1,786 +0,0 @@ -spam-dmarc = {"18f.gov", -"1password.com", -"2gis.com", -"4chan.org", -"4pda.ru", -"9-11commission.gov", -"911.gov", -"aberdeenshire.gov.uk", -"abilityone.gov", -"absolutbank.ru", -"access-board.gov", -"acquisition.gov", -"acus.gov", -"ada.gov", -"adf.gov", -"adidas.co.kr", -"adidas.com.au", -"adidas.com.br", -"adidas.com.hk", -"adidas.fi", -"adidas.fr", -"admongo.gov", -"adobe.dk", -"adobe.es", -"adobeawards.com", -"adp.com", -"advice.hmrc.gov.uk", -"aerocivil.gov.co", -"afreximbank.com", -"agingstats.gov", -"agro.ru", -"ahcpr.gov", -"aids.gov", -"airbnb.co.uk", -"airbnb.com", -"airbnb.com.tr", -"airbnb.cz", -"airbnb.de", -"airbnb.fi", -"airbnb.fr", -"airbnb.pl", -"airbnb.ru", -"airbnb.se", -"airnow.gov", -"airtel.in", -"alfabank.com", -"alfabank.ru", -"alfastrah.ru", -"alibaba.com", -"aliexpress.com", -"alipay.com", -"alkupone.ru", -"alzheimers.gov", -"amazon.co.uk", -"amazon.com", -"amazon.com.br", -"amberalert.gov", -"americanexpress.com", -"ameslab.gov", -"angus.gov.uk", -"anidub.com", -"annapolis.gov", -"anstaskforce.gov", -"apple.com.au", -"apple.com.cn", -"apps.gov", -"archives.gov", -"arctic.gov", -"arionbanki.is", -"asg.com", -"asic.gov.au", -"askona.ru", -"asos.com", -"assist.ru", -"atf.gov", -"avast.com", -"avg.com", -"avito.ru", -"avtoradio.ru", -"axisbank.com", -"badoo.com", -"baltbank.ru", -"bank.lv", -"banki.ru", -"bankofamerica.com", -"barclaycard.co.uk", -"barclays.co.uk", -"barclays.com", -"battle.net", -"beeline.kz", -"beeline.ru", -"benefits.gov", -"betfaq.ru", -"biglion.ru", -"binary.com", -"binbank.ru", -"bioethics.gov", -"biometrics.gov", -"biopreferred.gov", -"birminghampost.net", -"bishopsmove.com", -"bitbank.cc", -"bjs.gov", -"blizzard.com", -"blog.gov.uk", -"bls.gov", -"bluestarindia.com", -"boemre.gov", -"bolsover.gov.uk", -"bolton.gov.uk", -"booking.com", -"bookmate.com", -"books.ru", -"bournemouth.gov.uk", -"box.com", -"bpa.gov", -"brandshop.ru", -"bridgend.gov.uk", -"brighton-hove.gov.uk", -"britishembassy.gov.uk", -"broadbandmap.gov", -"bromley.gov.uk", -"bts.gov", -"business.gov", -"caerphilly.gov.uk", -"caixa.gov.br", -"cambridge-news.co.uk", -"campaign.gov.uk", -"cancer.gov", -"cannockchasedc.gov.uk", -"capitalone.co.uk", -"cardiff.gov.uk", -"carecredit.com", -"cbp.gov", -"cdfifund.gov", -"centralbedfordshire.gov.uk", -"ceredigion.gov.uk", -"cesg.gov.uk", -"cfda.gov", -"cfo.gov", -"challenge.gov", -"change.org", -"chase.com", -"chcoc.gov", -"childstats.gov", -"cio.gov", -"circle.com", -"citibank.ae", -"citibank.co.in", -"citibank.co.uk", -"citibank.com.my", -"citibank.hu", -"citibank.pl", -"cloud.gov", -"cloudflare.com", -"cms.gov", -"co-operativebank.co.uk", -"colgate.com.br", -"collegedrinkingprevention.gov", -"companies-house.gov.uk", -"comuneap.gov.it", -"conab.gov.br", -"concerts.com", -"consultant.ru", -"contact-sys.com", -"copeland.gov.uk", -"cosla.gov.uk", -"courtservice.gov.uk", -"coventry.gov.uk", -"cre.gov.uk", -"csosa.gov", -"cuidadodesalud.gov", -"culturarecreacionydeporte.gov.co", -"customs.gov.my", -"customs.gov.ua", -"cybercrime.gov", -"dailypost.co.uk", -"danskebank.dk", -"danskebank.fi", -"danskebank.ie", -"danskebank.no", -"dartford.gov.uk", -"dartmoor.gov.uk", -"dataprotection.gov.uk", -"daventrydc.gov.uk", -"dellin.ru", -"denbighshire.gov.uk", -"deutsche-bank.de", -"deutschebank.be", -"deutschebank.co.in", -"dh.gov.uk", -"dhl.com", -"dhs.gov", -"diablo3.com", -"digital.gov", -"digitalgov.gov", -"digitalliteracy.gov", -"disability.gov", -"disability.gov.uk", -"dnfsb.gov", -"docker.com", -"docusign.net", -"doe.gov", -"doioig.gov", -"dol.gov", -"doleta.gov", -"domofond.ru", -"drought.gov", -"drugabuse.gov", -"dsns.gov.ua", -"dtv.gov", -"dudley.gov.uk", -"dyslexiaida.org", -"e-boks.dk", -"e-verify.gov", -"eastdunbarton.gov.uk", -"eaststaffsbc.gov.uk", -"eastsuffolk.gov.uk", -"ebay.be", -"ebay.ca", -"ebay.ch", -"ebay.co.uk", -"ebay.com", -"ebay.com.au", -"ebay.com.cn", -"ebay.de", -"ebay.es", -"ebay.eu", -"ebay.fr", -"ebay.in", -"ebay.it", -"ebay.se", -"economy.gov.tr", -"econsumer.gov", -"ed.gov", -"eftps.gov", -"ehsni.gov.uk", -"eia.gov", -"ejob.gov.tw", -"elance.com", -"eldorado.ru", -"email-ee.co.uk", -"email.tektorg.ru", -"emarsys.com", -"ems.gov", -"energystar.gov", -"erewash.gov.uk", -"esetnod32.ru", -"essex-fire.gov.uk", -"eubank.kz", -"evernote.com", -"everychildmatters.gov.uk", -"evus.gov", -"exist.ru", -"expediamail.com", -"facebook.com", -"facebookmail.com", -"fbi.gov", -"fcc.gov", -"fco.gov.uk", -"fdic.gov", -"feb.gov", -"federalreserve.gov", -"fedex.com", -"fedramp.gov", -"fedshirevets.gov", -"feedthefuture.gov", -"fema.gov", -"ferc.gov", -"fhfa.gov", -"fhfaoig.gov", -"fife.gov.uk", -"financialresearch.gov", -"financialstability.gov", -"firstbankpb.bank", -"firstbankpb.com", -"firstnet.gov", -"firstresponder.gov", -"fishwatch.gov", -"fitness.gov", -"flagma.ua", -"flamp.ru", -"fletc.gov", -"fmc.gov", -"fmcs.gov", -"foia.gov", -"food.gov.uk", -"force.com", -"fordlibrarymuseum.gov", -"foreignassistance.gov", -"foreigntrade.gov.tr", -"franklinwi.gov", -"ftc.gov", -"ftccomplaintassistant.gov", -"gamereactor.dk", -"gap.com", -"garant.ru", -"geekbrains.ru", -"geektimes.ru", -"getsmartaboutdrugs.gov", -"gibraltar.gov.uk", -"gitlab.com", -"globalentry.gov", -"globalhealth.gov", -"globe.gov", -"gloucestershire.gov.uk", -"goes-r.gov", -"gosuslugi.ru", -"gov.uk", -"groupon.es", -"groupon.hk", -"groupon.it", -"gsa.gov", -"gsaadvantage.gov", -"gsaauctions.gov", -"gsaig.gov", -"gtbank.com", -"guideline.gov", -"guidelines.gov", -"gwynedd.gov.uk", -"habr.com", -"hambleton.gov.uk", -"harp.gov", -"hawaiicounty.gov", -"hdfcbank.com", -"hdrezka.ag", -"healthcare.gov", -"healthypeople.gov", -"hertfordshire.gov.uk", -"hh.kz", -"hh.ru", -"highland.gov.uk", -"highwaycode.gov.uk", -"hillingdon.gov.uk", -"hiv.gov", -"hmrc.gov.uk", -"homeoffice.gov.uk", -"homesales.gov", -"hotels.com", -"hounslow.gov.uk", -"howto.gov", -"hru.gov", -"huduser.gov", -"hurricanes.gov", -"iba.gov.au", -"ice.gov", -"idmanagement.gov", -"ikea.ch", -"ikea.co.uk", -"ikea.com", -"ikea.de", -"ikea.fr", -"ikea.gr", -"ikea.nl", -"ikea.pl", -"imgur.com", -"incometaxindiaefiling.gov.in", -"ing.com", -"inl.gov", -"inlandrevenue.gov.uk", -"insider.co.uk", -"insolvency.gov.uk", -"instagram.com", -"insurekidsnow.gov", -"invasivespeciesinfo.gov", -"investor.gov", -"irda.gov.in", -"itunes.com", -"jccbi.gov", -"jd.ru", -"jet.com", -"jimmycarterlibrary.gov", -"job.com", -"johnsonsbaby.co.uk", -"joybuy.com", -"jpmorgan.com", -"jpmorgansecurities.com", -"judiciary.gov.uk", -"justice.gov", -"justice.gov.az", -"justice.gov.uk", -"jyskebank.dk", -"kassy.ru", -"kent.gov.uk", -"keys.openpgp.org", -"kids.gov", -"kingston.gov.uk", -"kivra.com", -"klarna.com", -"klarna.se", -"kpk.gov.pl", -"lacoast.gov", -"landsbanki.is", -"lanl.gov", -"lbhf.gov.uk", -"lcd.gov.uk", -"learningcurve.gov.uk", -"leeds.gov.uk", -"leroymerlin.es", -"lichfielddc.gov.uk", -"lincoln.gov.uk", -"lincolnshire.gov.uk", -"linkedin.com", -"livejournal.com", -"llnl.gov", -"lloydsbank.com", -"locatorplus.gov", -"lostfilm.tv", -"louisvilleco.gov", -"love.ru", -"lufthansa-group.com", -"lufthansa.com", -"mackeeper.com", -"mailgun.net", -"mak.com", -"mandtbank.com", -"mcc.gov", -"mcga.gov.uk", -"mchenrycountyil.gov", -"mecknc.gov", -"mediamarkt.se", -"medicaid.gov", -"medicare.gov", -"medium.com", -"megafon.ru", -"megaplan.ru", -"mercadolibre.com.ar", -"mercadolivre.com.br", -"merseyfire.gov.uk", -"merthyr.gov.uk", -"meshok.ru", -"messenger.com", -"microsoft.net", -"middlesbrough.gov.uk", -"midlothian.gov.uk", -"mil.ru", -"mincit.gov.co", -"minhacienda.gov.co", -"minsvyaz.ru", -"mintic.gov.co", -"mirrorfootball.co.uk", -"mkb.ru", -"mlg.ru", -"mlg.tv", -"mns.gov.ua", -"mod.gov.az", -"molisa.gov.vn", -"mos.ru", -"mosoblbank.ru", -"mosreg.ru", -"motinfo.gov.uk", -"movavi.com", -"msha.gov", -"mspb.gov", -"msport.gov.pl", -"murfreesborotn.gov", -"mvideo.ru", -"mxtoolbox.com", -"mymoney.gov", -"myplate.gov", -"myra.gov", -"myshared.ru", -"n-kesteven.gov.uk", -"n-somerset.gov.uk", -"nads.gov.ua", -"nalog.ru", -"namus.gov", -"nasa.gov", -"nationalarchives.gov.uk", -"nationalservice.gov", -"nationsreportcard.gov", -"nbr.gov.bd", -"nbtbank.com", -"ncifcrf.gov", -"ncpw.gov", -"nctb.gov.bd", -"ne-derbyshire.gov.uk", -"nea.gov", -"nelincs.gov.uk", -"neobux.com", -"neolane.net", -"netflix.com", -"newegg.com", -"newmoney.gov", -"nga.gov", -"ngu.gov.ua", -"nhtsa.gov", -"nic.ru", -"nidw.gov.bd", -"nij.gov", -"nio.gov.uk", -"niscc.gov.uk", -"nist.gov", -"nixonlibrary.gov", -"nkh.gov.hu", -"noaa.gov", -"nordea.dk", -"nordea.com", -"nordea.fi", -"nordea.no", -"nordea.se", -"north-ayrshire.gov.uk", -"north-norfolk.gov.uk", -"northlincs.gov.uk", -"norwich.gov.uk", -"notifications.service.gov.uk", -"nottinghamcity.gov.uk", -"nrc-gateway.gov", -"nrc.gov", -"nrel.gov", -"nsf.gov", -"nsopr.gov", -"nsopw.gov", -"nwtrb.gov", -"oculus.com", -"ofcm.gov", -"office.com", -"officemag.ru", -"ok.ru", -"omb.gov", -"ombudsman.gov.tr", -"onedrive.com", -"onguardonline.gov", -"opengl.org", -"openinternet.gov", -"ordsvy.gov.uk", -"ornl.gov", -"oshrc.gov", -"osti.gov", -"oxfordshire.gov.uk", -"ozon.ru", -"paauditor.gov", -"paccar.com", -"paddle8.com", -"pandemicflu.gov", -"passport.gov.uk", -"payeer.com", -"paymentaccuracy.gov", -"paypal-community.com", -"paypal.be", -"paypal.cn", -"paypal.co.il", -"paypal.co.uk", -"paypal.com", -"paypal.com.au", -"paypal.com.br", -"paypal.com.mx", -"paypal.de", -"paypal.dk", -"paypal.es", -"paypal.fr", -"paypal.nl", -"paypal.se", -"pbgc.gov", -"pc.gov.au", -"pch.com", -"penanghill.gov.my", -"pepfar.gov", -"performance.gov", -"pinterest.co.kr", -"pinterest.com", -"pinterest.de", -"pinterest.jp", -"pinterest.se", -"pkc.gov.uk", -"planeta.ru", -"platron.ru", -"plymouth.gov.uk", -"pm.gov.uk", -"pmf.gov", -"pmi.gov", -"pncbank.com", -"pokerstars.com", -"pokerstars.fr", -"pokerstars.it", -"pokerstars.net", -"priorbank.by", -"privatbank.ua", -"prospertx.gov", -"prostocash.com", -"provident.bank", -"psbank.ru", -"psc.gov", -"punjab.gov.in", -"puzzle-english.com", -"qiwi.com", -"qiwi.ru", -"rabota.ru", -"rbkc.gov.uk", -"ready.gov", -"reaganlibrary.gov", -"redbridge.gov.uk", -"reddit.com", -"reebok.es", -"reebok.nl", -"reginfo.gov", -"regulations.gov", -"reisebank.de", -"renfrewshire.gov.uk", -"rentonwa.gov", -"reportband.gov", -"rgs.ru", -"richmond.gov.uk", -"rivers.gov", -"rkn.gov.ru", -"ros.gov.uk", -"roseltorg.ru", -"rostelecom.ru", -"roundrocktexas.gov", -"royalmail.com", -"rozetka.com.ua", -"rt.com", -"rt.ru", -"rushcliffe.gov.uk", -"rutubeinfo.ru", -"sacn.gov.uk", -"safercar.gov", -"samhsa.gov", -"sanmarcostx.gov", -"sberbank.ru", -"sberbank-ast.ru", -"sbir.gov", -"sbis.ru", -"scality.com", -"scdhhs.gov", -"science360.gov", -"sciencebase.gov", -"scijinks.gov", -"sec.gov", -"secretservice.gov", -"section508.gov", -"semnan.ac.ir", -"senate.gov", -"sendgrid.net", -"seniorcorps.gov", -"serpro.gov.br", -"service.gov.uk", -"sftool.gov", -"shetland.gov.uk", -"shropshire-cc.gov.uk", -"shutterstock.com", -"sigtarp.gov", -"sk.ru", -"skat.dk", -"skatteverket.se", -"skbbank.ru", -"skittles.com", -"skydio.com", -"skype.com", -"slideshare.com", -"smart.gov", -"smida.gov.ua", -"smokefree.gov", -"snickers.com", -"solardecathlon.gov", -"sourceforge.net", -"south-ayrshire.gov.uk", -"sovest.ru", -"spbrealty.ru", -"sportmaster.ru", -"squarespace.com", -"sravni.ru", -"srs.gov", -"staffordbc.gov.uk", -"stat.gov.az", -"stedmundsbury.gov.uk", -"sthelens.gov.uk", -"stihl.ru", -"stopalcoholabuse.gov", -"stopfraud.gov", -"studentloans.gov", -"subscribe.ru", -"suffolkcc.gov.uk", -"suncorpbank.com.au", -"sundaymirror.co.uk", -"sunlight.net", -"superjob.ru", -"surestart.gov.uk", -"sutton.gov.uk", -"swansea.gov.uk", -"swift.com", -"symantec.com", -"synologynotification.com", -"taobao.com", -"tatar.ru", -"tauntondeane.gov.uk", -"tda.gov.uk", -"tdk.gov.tr", -"tdscpc.gov.in", -"telework.gov", -"tenders.gov.au", -"textmagic.com", -"tfhrc.gov", -"thebell.io", -"thecoolspot.gov", -"thinkroadsafety.gov.uk", -"tiaabank.com", -"ticketland.ru", -"tinder.com", -"tinkoff.ru", -"tomsk.gov.ru", -"torbay.gov.uk", -"tradingstandards.gov.uk", -"treas.gov", -"trial-sport.ru", -"tsa.gov", -"tst.gov.br", -"tuba.gov.tr", -"turystyka.gov.pl", -"tutu.ru", -"twitch.tv", -"twitter.com", -"twix.com", -"uber.com", -"ucarecdn.com", -"ucrdatatool.gov", -"udall.gov", -"ukvisas.gov.uk", -"ulmart.ru", -"unicor.gov", -"uniras.gov.uk", -"ups.com", -"uralairlines.ru", -"us-cert.gov", -"usa.gov", -"usadf.gov", -"usaid.gov", -"usap.gov", -"uscg.gov", -"usconsulate.gov", -"usmission.gov", -"usphs.gov", -"uspis.gov", -"usps.com", -"usps.gov", -"ustreas.gov", -"utair.ru", -"utkonos.ru", -"vaccines.gov", -"valeofglamorgan.gov.uk", -"verizonwireless.com", -"vigoda.ru", -"visa.co.uk", -"visa.com", -"visa.com.ar", -"visa.com.br", -"visa.com.cn", -"visa.com.tw", -"visa.pl", -"vistacampus.gov", -"vk.com", -"vkrugudruzei.ru", -"vkusnyblog.ru", -"vmc.gov.in", -"voa.gov.uk", -"volunteer.gov", -"vote.gov", -"walsall.gov.uk", -"wandsworth.gov.uk", -"wartimecontracting.gov", -"warwickdc.gov.uk", -"wealden.gov.uk", -"wellingtonfl.gov", -"west-lindsey.gov.uk", -"westernunion.com", -"westernunion.ru", -"westlothian.gov.uk", -"whatsapp.com", -"whistleblowers.gov", -"wirral.gov.uk", -"wlga.gov.uk", -"womenshealth.gov", -"wrexham.gov.uk", -"wrigley.com", -"wrp.gov", -"yandex-team.ru", -"york.gov.uk", -"youla.ru", -"youth.gov", -"youthrules.gov", -"youtube.com", -"zcts.ru", -"zendesk.com", -"zionsbank.com", -"zomato.com"} - diff --git a/resources/config/spamfilter/maps/allow_domains.list b/resources/config/spamfilter/maps/allow_domains.list deleted file mode 100644 index 5c2ed876..00000000 --- a/resources/config/spamfilter/maps/allow_domains.list +++ /dev/null @@ -1,828 +0,0 @@ -spam-allow = {"126.com", -"163.com", -"1gost.info", -"1stnationalbank.com", -"2o7.net", -"365online.com", -"4at1.com", -"53.com", -"5iantlavalamp.com", -"abl.com.pk", -"about.com", -"accessbankplc.com", -"adelphia.net", -"adib.ae", -"adobe.com", -"agora-inc.com", -"agoramedia.com", -"aibgb.co.uk", -"aib.ie", -"airdriesavingsbank.com", -"akamai.net", -"akamaitech.net", -"aldermore.co.uk", -"alexa.com", -"alliancebank.com.my", -"alliancefg.com", -"alliantcreditunion.com", -"alliantcreditunion.org", -"allianz.de", -"allybank.com", -"alterna.ca", -"amazon.com", -"americanexpress.ch", -"americanexpress.com", -"anadolubank.nl", -"ancestry.com", -"anz.com", -"anz.co.nz", -"aol.com", -"apache.org", -"apple.com", -"arbuthnotlatham.co.uk", -"arcamax.com", -"asb.co.nz", -"ask.com", -"astrology.com", -"atdmt.com", -"att.net", -"authorize.net", -"autorambler.ru", -"axisbank.co.in", -"axisbank.com", -"b2bbank.com", -"baaderbank.de", -"baidu.com", -"baloise.ch", -"baml.com", -"banamex.com", -"bancanetbsc.do", -"bancanetsantacruz.com.do", -"bancapulia.it", -"bancarios.com", -"bancastato.ch", -"bancatransilvania.ro", -"bancobase.com", -"bancobic.ao", -"bancobic.pt", -"bancobpi.pt", -"banco.bradesco", -"bancobrasil.com.br", -"bancochile.cl", -"bancochile.com", -"bancoestado.cl", -"bancofalabella.cl", -"bancofalabella.com.co", -"bancofalabella.pe", -"bancomer.com", -"bancopopolare.it", -"bancopostaclick.it", -"bancoposta.it", -"bancosantander.es", -"bancovotorantimcartoes.com.br", -"bank24.ru", -"bankalhabib.com", -"bankaustria.at", -"bank.barclays.co.uk", -"bankbgzbnpparibas.pl", -"bankcardservices.co.uk", -"bankcomm.com", -"bankcoop.ch", -"bankiabancapersonal.es", -"bankia.com", -"bankia.es", -"bankinter.com", -"bankinter.es", -"bankmutual.com", -"bankofamerica.com", -"bankofcanada.ca", -"bankofchina.com", -"bankofcyprus.com", -"bankofindia.co.nz", -"bankofireland.com", -"bank-of-ireland.co.uk", -"bankofirelanduk.com", -"bankofoklahoma.com", -"bankofscotland.co.uk", -"banksinarmas.com", -"bankvonroll.ch", -"bankwest.com.au", -"banque-casino.fr", -"banquepopulaire.fr", -"banquescotia.com", -"barclaycard.co.uk", -"barclaycard.de", -"barclaycard.es", -"barclays.com", -"barclays.co.uk", -"barclayspartnerfinance.com", -"barclays.sc", -"barodanzltd.co.nz", -"basler.ch", -"bbandt.com", -"bbc.co.uk", -"bcentral.com", -"bci.cl", -"bcp.com.pe", -"bcv.ch", -"bcvs.ch", -"bekb.ch", -"bellevue.ch", -"bellsouth.net", -"bendigobank.com.au", -"berliner-bank.de", -"berliner-sparkasse.de", -"bfanet.ao", -"bfi0.com", -"bgfi.com", -"bgfionline.com", -"bgzbnpparibas.pl", -"billmelater.com", -"bing.com", -"bkb.ch", -"bk.rw", -"bks.at", -"blkb.ch", -"bmocm.com", -"bmo.com", -"bmogam.com", -"bmoharris.com", -"bmoharrisprivatebankingonline.com", -"bmoinvestorline.com", -"bmonesbittburns.com", -"bnl.it", -"bnpparibas.com", -"bnpparibas.fr", -"boc.cnnz", -"bonuscard.ch", -"bpe-gruposantander.com", -"bpi.pt", -"bpostbank.be", -"bradescardonline.com.br", -"bradesco.com.br", -"bradescoseguranca.com.br", -"bridgetrack.com", -"bridgewaterbank.ca", -"bsibank.com", -"btrl.ro", -"bt-trade.ro", -"businessonline-boi.com", -"bzbank.ch", -"ca-cib.com", -"ca-egypt.com", -"cafbank.org", -"cafe24.com", -"cafonline.org", -"caisse-epargne.com", -"caisse-epargne.fr", -"caixabank.com", -"caixa.gov.br", -"cajasur.es", -"camsonline.com", -"canadiandirect.com", -"capitalone360.com", -"capitalone.com", -"capitaloneonline.co.uk", -"capitecbank.co.za", -"cariparma.it", -"carrefour-banque.fr", -"cartabcc.it", -"cartabccpos.it", -"cartasi.it", -"ca-suisse.com", -"catalunyacaixa.com", -"cbg.gm", -"cbonline.co.uk", -"cembra.ch", -"cenbank.org", -"centralbank.ae", -"charitybank.org", -"charter.net", -"chase.com", -"chebanca.it", -"chinatrust.com.tw", -"cial.ch", -"cibc.com", -"cic.ch", -"cimbclicks.com.my", -"citibank.ae", -"citibank.co.in", -"citibank.com", -"citibank.co.uk", -"citibankonline.com", -"citibusiness.com", -"citicards.com", -"citi.com", -"citi.co.nz", -"citi.eu", -"citigroup.com", -"citizensbank.ca", -"citizensbank.com", -"civibank.com", -"civibank.it", -"cjb.net", -"classmates.com", -"clickbank.net", -"closebrothers.com", -"closebrothers.co.uk", -"clubsc.ch", -"cnet.com", -"cnn.com", -"co.kg", -"colpatria.com", -"colpatria.com.co", -"comcast.net", -"com.com", -"commbank.com.au", -"commerzbank.com", -"commerzbank.de", -"com.ne.kr", -"coopbank.dk", -"co-operativebank.co.uk", -"cornerbanca.ch", -"cornercard.ch", -"cornercard.com", -"corner.ch", -"corporate-ir.net", -"cosycard.ch", -"coutts.com", -"cox.net", -"craigslist.org", -"credit-agricole.com", -"credit-agricole.fr", -"creditagricole.rs", -"credit-suisse.com", -"cs.com", -"css.ch", -"ctbcbank.com", -"ctfs.com", -"custhelp.com", -"cwbank.com", -"cwbankgroup.com", -"cwt.ca", -"cybg.com", -"danskebankas.lt", -"danskebank.com", -"danskebank.co.uk", -"danskebank.de", -"danskebank.dk", -"danskebank.ee", -"danskebank.fi", -"danskebank.ie", -"danskebank.no", -"datatrans.biz", -"datatrans.ch", -"daum.net", -"db.com", -"dbs.com", -"dd.se", -"debian.org", -"dell.com", -"demirbank.kg", -"denizbank.com", -"desjardins.ca", -"desjardins.com", -"deutschebank.be", -"deutschebank.co.nz", -"deutsche-bank.de", -"diamondbank.com", -"dibpak.com", -"directnic.com", -"directtrack.com", -"discovercard.com", -"discover.com", -"discovery.co.za", -"dnbnord.lt", -"domain.com", -"doubleclick.com", -"dresdner-bank.de", -"dsbbank.sr", -"dsbl.org", -"duncanlawrie.com", -"earthlink.net", -"easybank.at", -"easylnk.com", -"ebay.com", -"ebay.co.uk", -"ebay.de", -"ebayimg.com", -"ebaystatic.com", -"ecobank.com", -"edgesuite.net", -"ediets.com", -"edwardjones.com", -"egroups.com", -"e-gulfbank.com", -"emode.com", -"esunbank.com.tw", -"example.com", -"example.net", -"example.org", -"excite.com", -"facebook.com", -"fedex.com", -"fednetbank.com", -"fidelity.com", -"fidor.de", -"finance.com", -"finansbank.com.tr", -"finasta.lt", -"fineco.it", -"firstbankcard.com", -"firstmerit.com", -"firstnational.com", -"firstnationalmerchantsolutions.com", -"firsttrustbank.co.uk", -"flickr.com", -"fnbc.ca", -"fnb.co.za", -"fnb-online.com", -"freebsd.org", -"free.fr", -"friuladria.it", -"f-secure.com", -"garantibank.eu", -"garantibank.nl", -"garanti.com.tr", -"gazprombank.ch", -"gazprombank.ru", -"generali.es", -"genevoise.ch", -"gentoo.org", -"geocities.com", -"gkb.ch", -"gmail.com", -"gmx.net", -"go.com", -"godaddy.com", -"googleadservices.com", -"google.co.in", -"google.com", -"google.it", -"google.ru", -"granitbank.hu", -"grisoft.com", -"gtbank.com", -"halifax.co.uk", -"hallmark.com", -"handelsbanken.se", -"harrodsbank.co.uk", -"hbl.com", -"hblibank.com", -"hblibank.com.pk", -"hdfcbank.com", -"heartland.co.nz", -"hellenicbank.com", -"hinet.net", -"hkbea.com", -"hlb.com.kh", -"hlb.com.my", -"hoaresbank.co.uk", -"home.barclays", -"hongleongconnect.com.kh", -"hongleongconnect.com.vn", -"hongleongconnect.my", -"hotbar.com", -"hotmail.com", -"hotpop.com", -"hp.com", -"hsbc.com", -"hsbc.com.ar", -"hsbc.com.hk", -"hsbc.co.nz", -"hsbc.co.uk", -"hypovereinsbank.co.uk", -"hypovereinsbank.de", -"ibm.com", -"icbcnz.com", -"icicibank.co.in", -"icicibank.com", -"icicibankprivatebanking.com", -"icorner.ch", -"icscards.de", -"icscards.nl", -"incredimail.com", -"ing.be", -"ing.com", -"ing-diba.de", -"ingdirect.ca", -"ing.lu", -"ing.nl", -"ingvysyabank.com", -"interac.ca", -"investorplace.com", -"iobnet.co.in", -"isbank.com.tr", -"isbank.de", -"isbank.ge", -"isbank.iq", -"isbankkosova.com", -"itau.com.br", -"ivillage.com", -"joingevalia.com", -"jpmchase.com", -"jpmorgan.com", -"jsafrasarasin.com", -"julianhodgebank.com", -"juliusbaer.com", -"juno.com", -"jyskebank.dk", -"kantonalbank.ch", -"kernel.org", -"key.com", -"kiwibank.co.nz", -"kotak.com", -"kredytbank.pl", -"kreissparkasse-schwalm-eder.de", -"ksklb.de", -"kutxabank.es", -"laboralkutxa.com", -"lacaixa.cat", -"lacaixa.es", -"laurentianbank.ca", -"lbb.de", -"lcl.com", -"lcl.fr", -"li.ru", -"list.ru", -"liveinternet.ru", -"livejournal.com", -"lloydsbank.com", -"lloydsbankcommercial.com", -"lloydsbankinggroup.com", -"lloydstsb.ch", -"lloydstsb.co.uk", -"lombardodier.com", -"loydsbank.com", -"lycos.com", -"m7z.net", -"mac.com", -"macromedia.com", -"maerki-baumann.ch", -"mail.com", -"mail.ru", -"mailscanner.info", -"mandtbank.com", -"manulifebank.ca", -"manulifebankselect.ca", -"manulife.com", -"manulifeone.ca", -"marketwatch.com", -"mashreqbank.com", -"mastercard.com", -"maybank2u.com", -"maybank2u.com.my", -"mcafee.com", -"mchsi.com", -"mdmbank.com", -"mechanicsbank.com", -"medbank.lt", -"messagelabs.com", -"metrobankdirect.com", -"metrobankonline.co.uk", -"microsoft.com", -"migbank.com", -"migrosbank.ch", -"military.com", -"mindspring.com", -"mit.edu", -"mizuhobank.co.jp", -"mmwarburg.lu", -"monster.com", -"montepio.pt", -"morganstanley.com", -"mozilla.com", -"mps.it", -"ms.com", -"msn.com", -"mufg.jp", -"myonlineresourcecenter.com", -"myonlineservices.ch", -"myspace.com", -"nate.com", -"nationalesuisse.ch", -"nationwide-communications.co.uk", -"nationwide.co.uk", -"nationwide-service.co.uk", -"natwest.com", -"navyfederal.org", -"nbc.ca", -"netflix.com", -"netscape.com", -"netscape.net", -"netzero.net", -"newyorkfed.org", -"nibl.com.np", -"nod32.com", -"nordea.fi", -"nordea.lt", -"nordfynsbank.dk", -"norisbank.de", -"norman.com", -"notenstein.ch", -"nuvisionfederal.com", -"nytimes.com", -"oceanbank.com", -"onlinesbi.com", -"openoffice.org", -"openxmlformats.org", -"optonline.net", -"orchardbank.com", -"osdn.com", -"ostsaechsische-sparkasse-dresden.de", -"overstock.com", -"pacbell.net", -"pandasoftware.com", -"passport.com", -"paylife.at", -"paypal.be", -"paypal-brasil.com.br", -"paypal.ca", -"paypal.ch", -"paypal.co.il", -"paypal.com", -"paypal.com.au", -"paypal.com.br", -"paypal-communication.com", -"paypal-community.com", -"paypal.com.mx", -"paypal.com.pt", -"paypal.co.uk", -"paypal-customerfeedback.com", -"paypal.de", -"paypal-deutschland.de", -"paypal.dk", -"paypal.es", -"paypal-exchanges.com", -"paypal.fr", -"paypal.it", -"paypal-marketing.co.uk", -"paypal-marketing.pl", -"paypal.net", -"paypal.nl", -"paypal.no", -"paypal-notify.com", -"paypal-now.com", -"paypalobjects.com", -"paypal-opwaarderen.nl", -"paypal-pages.com", -"paypal.pt", -"paypal.ru", -"paypal.se", -"paypal-search.com", -"paypal-shopping.co.uk", -"paypal-techsupport.com", -"pbebank.com", -"pcfinancial.ca", -"peoplepc.com", -"permanenttsb.ie", -"plaxo.com", -"pnc.com", -"popolarevicenza.it", -"postbank.de", -"postepay.it", -"postfinancearena.ch", -"postfinance.ch", -"postfinance.info", -"price.ru", -"prodigy.net", -"publicislamicbank.com.my", -"rabobank.com", -"rabobank.co.nz", -"rabobank.nl", -"radaruol.com.br", -"rahnbodmer.ch", -"raiffeisenbank.rs", -"raiffeisen.ch", -"raiffeisen.hu", -"raiffeisen.li", -"raiffeisen.ru", -"rambler-co.ru", -"rambler.ru", -"raphaelsbank.com", -"rbc.com", -"rbcroyalbank.com", -"rbs.co.uk", -"rbssecure.co.uk", -"rbsworldpay.com", -"rcb.at", -"real.com", -"recordbank.be", -"redhat.com", -"rediff.com", -"regiobank.nl", -"regions.com", -"regionsnet.com", -"renasantbank.com", -"rhbgroup.com", -"rogersbank.com", -"rogers.com", -"rothschildbank.com", -"rothschild.com", -"royalbank.com", -"rr.com", -"sagepay.com", -"sagepay.co.uk", -"sainsburysbank.co.uk", -"samba.com", -"santander.cl", -"santander.com", -"santander.com.br", -"santander.com.mx", -"santandercorretora.com.br", -"santander.co.uk", -"santanderesfera.com.br", -"santandersantiago.cl", -"sarasin.ch", -"sbcglobal.net", -"sberbank.ch", -"sbs.net.nz", -"sc.com", -"schoellerbank.at", -"scotiabank.ca", -"scotiabank.com", -"scotiamocatta.com", -"scotiaonline.com", -"s.de", -"sec.gov", -"securetrustbank.com", -"service-sparkasse.de", -"serviciobancomer.com", -"sf.net", -"shawbrook.co.uk", -"shaw.ca", -"shkb.ch", -"shockwave.com", -"six-group.com", -"six-payment-services.com", -"skrill.com", -"sls-direkt.de", -"smithbarney.com", -"snb.ch", -"snsbank.nl", -"societegenerale.fr", -"sourceforge.net", -"spamcop.net", -"sparda-a.de", -"sparda-bank-hamburg.de", -"sparda-b.de", -"sparda-bw.de", -"sparda-h.de", -"sparda-hessen.de", -"sparda-m.de", -"sparda-ms.de", -"sparda-n.de", -"sparda-ostbayern.de", -"sparda-sw.de", -"sparda-verband.de", -"sparda-west.de", -"sparkasse.at", -"sparkasse-bank-malta.com", -"sparkasse-bielefeld.de", -"sparkasseblog.de", -"sparkasse-bochum.de", -"sparkasse.ch", -"sparkasse.de", -"sparkasse-gera-greiz.de", -"sparkasse-hamm.de", -"sparkasse-heidelberg.de", -"sparkasse-ingolstadt.de", -"sparkasse-mittelthueringen.de", -"speedera.net", -"sportsline.com", -"standardbank.com", -"standardbank.co.za", -"standardchartered.com.gh", -"standardchartered.com.my", -"subscribe.ru", -"sun.com", -"suncorpbank.com.au", -"suntrust.com", -"swedbank.com", -"swedbank.ee", -"swedbank.lt", -"swedbank.lu", -"swedbank.se", -"swisscanto.ch", -"swisscaution.ch", -"swissquote.ch", -"sydbank.dk", -"sympatico.ca", -"tails.nl", -"tangerine.ca", -"tcb-bank.com.tw", -"tdbank.com", -"tdcommercialbanking.com", -"telus.net", -"terra.com.br", -"tescobank.com", -"ticketmaster.com", -"tinyurl.com", -"tiscali.co.uk", -"tns-counter.ru", -"tom.com", -"tone.co.nz", -"t-online.de", -"top4top.ru", -"tsbbank.co.nz", -"tsb.co.nz", -"tsb.co.uk", -"tux.org", -"twitter.com", -"ubibanca.com", -"ubs.com", -"ulsterbankanytimebanking.co.uk", -"ulsterbank.co.uk", -"unibancoconnect.pt", -"unibanco.pt", -"unicreditbank.lt", -"unicredit.eu", -"unicreditgroup.eu", -"unicredit.it", -"unionbankcameroon.com", -"unionbank.com", -"unity.co.uk", -"uob.com.sg", -"uobgroup.com", -"uol.com.br", -"ups.com", -"usbank.com", -"valianttrust.com", -"vaudoise.ch", -"venetobanca.it", -"venetobanka.al", -"verizon.net", -"versabank.com", -"videobank.it", -"virginmoney.com", -"visa.com.ar", -"visa.com.br", -"visaeurope.ch", -"visaeurope.com", -"viseca.ch", -"volksbank.de", -"volkswagenbank.de", -"vpbank.com", -"vr.de", -"vwbank.de", -"w3.org", -"wachovia.com", -"walmart.com", -"wamu.com", -"wanadoo.fr", -"washingtonpost.com", -"weatherbug.com", -"weatherbys.co.uk", -"web.de", -"webshots.com", -"webtv.net", -"wegelin.ch", -"wellsfargo.com", -"wellsfargoemail.com", -"westernunion.ca", -"westernunion.com", -"westernunion.fr", -"westernunion.se", -"westpac.com.au", -"westpac.co.nz", -"wir.ch", -"wordpress.com", -"worldbank.org", -"worldpay.com", -"wsj.com", -"wvb.de", -"xmlsoap.org", -"yacht.nl", -"yahoo.ca", -"yahoo.co.jp", -"yahoo.co.kr", -"yahoo.com", -"yahoo.com.br", -"yahoo.co.uk", -"yahoogroups.com", -"yandex.net", -"yandex.ru", -"ybonline.co.uk", -"yimg.com", -"yopi.de", -"yorkshirebank.co.uk", -"yourbankcard.com", -"yoursite.com", -"youtube.com", -"zagbank.ca", -"zdnet.com", -"zenithbank.com", -"zkb.ch", -"zugerkb.ch", -"vistaprint.dk", -"vistaprint.com", -"anpdm.com", -"dovecot.org", -"exacttarget.com", -"github.com", -"isc.org", -"lists.isc.org", -"lists.roundcube.net", -"svn.apache.org", -"taggedmail.com", -"tumblr.com"} diff --git a/resources/config/spamfilter/maps/allow_spf_dkim.list b/resources/config/spamfilter/maps/allow_spf_dkim.list deleted file mode 100644 index 25628cdc..00000000 --- a/resources/config/spamfilter/maps/allow_spf_dkim.list +++ /dev/null @@ -1,237 +0,0 @@ -spam-spdk = {"1cfresh.com", -"4chan.org", -"6pm.com", -"about.com", -"addthis.com", -"adf.ly", -"adobe.com", -"adp.com", -"adschemist.com", -"airbnb.com", -"airtel.in", -"alibaba.com", -"aliexpress.com", -"alipay.com", -"allrecipes.com", -"amazon.ca", -"amazon.cn", -"amazon.co.jp", -"amazon.com", -"amazon.co.uk", -"amazon.de", -"amazon.es", -"amazon.fr", -"amazon.in", -"amazon.it", -"amazon.ru", -"americanexpress.com", -"ancestry.com", -"android.com", -"apple.com", -"asana.com", -"att.com", -"autohome.com.cn", -"avg.com", -"aweber.com", -"badoo.com", -"bankofamerica.com", -"basecamp.com", -"battle.net", -"bet365.com", -"biglobe.ne.jp", -"bitly.com", -"bleacherreport.com", -"blogger.com", -"bloomberg.com", -"booking.com", -"box.com", -"bt.com", -"capitalone.com", -"cdiscount.com", -"change.org", -"chase.com", -"cisco.com", -"citi.com", -"costco.com", -"craigslist.org", -"custhelp.com", -"dell.com", -"delta.com", -"diply.com", -"discovercard.com", -"disqus.com", -"dropbox.com", -"drweb.com", -"e-boks.dk", -"ebay.ca", -"ebay.com", -"ebay.com.au", -"ebay.co.uk", -"ebay.de", -"ebay.fr", -"ebay.in", -"ebay.it", -"ebay.ru", -"etsy.com", -"evernote.com", -"expedia.com", -"facebook.com", -"fedex.com", -"fidelity.com", -"fishki.net", -"flickr.com", -"flirchi.com", -"force.com", -"freepik.com", -"gap.com", -"gawker.com", -"github.com", -"gizmodo.com", -"godaddy.com", -"googleadservices.com", -"googleusercontent.com", -"groupon.com", -"hdfcbank.com", -"hgtv.com", -"hh.ru", -"hm.com", -"houzz.com", -"hubspot.com", -"icicibank.com", -"icloud.com", -"ign.com", -"imgur.com", -"immobilienscout24.de", -"indeed.com", -"indiatimes.com", -"infusionsoft.com", -"instagram.com", -"intel.com", -"irctc.co.in", -"kayak.com", -"kickstarter.com", -"kijiji.ca", -"kotaku.com", -"letsencrypt.org", -"libero.it", -"lifehacker.com", -"likes.com", -"linkedin.com", -"linux.com", -"list-manage.com", -"mackeeper.com", -"mailchimp.com", -"mashable.com", -"match.com", -"mercadolibre.com.ar", -"mercadolivre.com.br", -"messenger.com", -"microsoft.com", -"microsoftonline.com", -"minmyndighetspost.se", -"moikrug.ru", -"mts.ru", -"neobux.com", -"netflix.com", -"newegg.com", -"nhk.or.jp", -"nifty.com", -"nikkeibp.co.jp", -"nyaa.se", -"nytimes.com", -"odnoklassniki.ru", -"ofd.yandex.ru", -"ok.ru", -"olx.ua", -"overstock.com", -"ozon.ru", -"ozon.travel", -"pandora.com", -"paypal.ca", -"paypal.cn", -"paypal.com", -"paypal.co.uk", -"paypal.de", -"paypal.es", -"paypal.fr", -"paypal.it", -"paypal.ru", -"paytm.com", -"pch.com", -"pinterest.com", -"porn.com", -"priceline.com", -"quora.com", -"rakuten.co.jp", -"reddit.com", -"researchgate.net", -"salesforce.com", -"sciencedirect.com", -"shopify.com", -"skanetrafiken.se", -"skat.dk", -"skatteverket.se", -"slack.com", -"slideshare.net", -"so-net.ne.jp", -"southwest.com", -"spotify.com", -"springer.com", -"squarespace.com", -"stalker.com", -"steampowered.com", -"stumbleupon.com", -"surveymonkey.com", -"swagbucks.com", -"taboola.com", -"taleo.net", -"taobao.com", -"target.com", -"taringa.net", -"taxi.yandex.ru", -"tele2.ru", -"thekitchn.com", -"tochka.com", -"tokopedia.com", -"trello.com", -"tribunnews.com", -"trulia.com", -"tumblr.com", -"twitter.com", -"ultimate-guitar.com", -"ups.com", -"usaa.com", -"usbank.com", -"usps.com", -"verizon.com", -"verizonwireless.com", -"vimeo.com", -"vine.co", -"vk.com", -"vmware.com", -"vtb24.ru", -"wahoofitness.com", -"walmart.com", -"wav.tv", -"wellsfargo.com", -"whatsapp.com", -"wikia.com", -"wikimedia.org", -"wikipedia.org", -"wildberries.ru", -"wix.com", -"wordpress.com", -"wordpress.org", -"wp.com", -"xuite.net", -"xvideos.com", -"yelp.com", -"youtube.com", -"yts.to", -"zappos.com", -"zendesk.com", -"zippyshare.com", -"zomato.com", -"zoom.us", -"zulily.com", -"zwift.com"} diff --git a/resources/config/spamfilter/maps/domains_disposable.list b/resources/config/spamfilter/maps/domains_disposable.list deleted file mode 100644 index faeb4b9a..00000000 --- a/resources/config/spamfilter/maps/domains_disposable.list +++ /dev/null @@ -1,427 +0,0 @@ -spam-disposable = {"0815.ru", -"0clickemail.com", -"0wnd.net", -"0wnd.org", -"1054733.mail-temp.com", -"10m.email", -"10minutemail.com", -"10minutesmail.com", -"1secmail.com", -"1secmail.net", -"1secmail.org", -"20minutemail.com", -"2emailock.com", -"2prong.com", -"33mail.com", -"3d-magical-magnet.ru", -"4warding.com", -"90bit.ru", -"9ox.net", -"a-bc.net", -"afrobacon.com", -"alaki.ga", -"alivance.com", -"amilegit.com", -"amiri.net", -"anonymbox.com", -"antichef.com", -"antichef.net", -"antispam.de", -"audio.now.im", -"awex.icu", -"barenshop.ru", -"barryogorman.com", -"baxomale.ht.cx", -"beefmilk.com", -"binkmail.com", -"bio-muesli.net", -"bobmail.info", -"bofthew.com", -"brefmail.com", -"bsnow.net", -"bspamfree.org", -"bugmenot.com", -"casualdx.com", -"centermail.com", -"cetpass.com", -"chammy.info", -"choicemail1.com", -"choocho-telegram.ru", -"cool.fr.nf", -"courriel.fr.nf", -"courrieltemporaire.com", -"cuvox.de", -"dandikmail.com", -"dayrep.com", -"dcemail.com", -"deadspam.com", -"desoz.com", -"devnullmail.com", -"dfg6.kozow.com", -"dfgh.net", -"digitalsanctuary.com", -"dingbone.com", -"discardmail.com", -"discardmail.de", -"dispomail.win", -"dispomail.xyz", -"disposableaddress.com", -"disposeamail.com", -"dispostable.com", -"divismail.ru", -"dlesha.ru", -"dmaster39.ru", -"dodgit.com", -"domremonta-nv.ru", -"donemail.ru", -"dontreg.com", -"dontsendmespam.de", -"dumpandjunk.com", -"e-mail.com", -"e-mail.org", -"e4ward.com", -"edu.aiot.ze.cx", -"ekholotdeeper.ru", -"email-24x7.com", -"email60.com", -"emailate.com", -"emailay.com", -"emailias.com", -"emailmiser.com", -"emailsensei.com", -"emailtemporanea.net", -"emailtemporario.com.br", -"emailtex.com", -"emailwarden.com", -"emailx.at.hm", -"emailxfer.com", -"emz.net", -"exbts.com", -"explodemail.com", -"extremail.ru", -"eyeemail.com", -"fakeinbox.com", -"fakeinformation.com", -"fantasymail.de", -"filzmail.com", -"fls4.gleeze.com", -"fotosta.ru", -"frapmail.com", -"fudgerub.com", -"funny-mom.ru", -"furycraft.ru", -"garliclife.com", -"get2mail.fr", -"getonemail.com", -"gishpuppy.com", -"gnomi.ru", -"goplaygame.ru", -"greensloth.com", -"grr.la", -"gsrv.co.uk", -"guerillamail.com", -"guerrillamail.biz", -"guerrillamail.com", -"guerrillamail.de", -"guerrillamail.info", -"guerrillamail.net", -"guerrillamail.org", -"guerrillamailblock.com", -"h2ocoffe.ru", -"haltospam.com", -"hatespam.org", -"hidemail.de", -"hmamail.com", -"hochsitze.com", -"hulapla.de", -"hydraulics360.ru", -"i.xcode.ro", -"imails.info", -"inboxclean.com", -"inboxclean.org", -"irish2me.com", -"isdaq.com", -"iwi.net", -"jetable.com", -"jetable.fr.nf", -"jetable.net", -"jetable.org", -"justyland.ru", -"kasmail.com", -"kaspop.com", -"kemampuan.me", -"kikoxltd.com", -"killmail.com", -"killmail.net", -"kismail.ru", -"kkm35.ru", -"klassmaster.com", -"klzlk.com", -"koszmail.pl", -"kurzepost.de", -"kusrc.com", -"lackmail.ru", -"laoho.com", -"ldaho.biz", -"leeching.net", -"letthemeatspam.com", -"lhsdv.com", -"lifebyfood.com", -"lifeguru.online", -"light-marketing.ru", -"lol.ovpn.to", -"lookugly.com", -"lortemail.dk", -"lr78.com", -"madecassol78.ru", -"mail-temporaire.fr", -"mail.mezimages.net", -"mail333.com", -"mailbidon.com", -"mailblocks.com", -"mailbucket.org", -"mailcatch.com", -"maildrop.cc", -"maildx.com", -"mailed.ro", -"mailfreeonline.com", -"mailfs.com", -"mailin8r.com", -"mailinater.com", -"mailinator.com", -"mailinator.net", -"mailinator2.com", -"mailincubator.com", -"mailme.ir", -"mailme.lv", -"mailmetal.com", -"mailmetrash.com", -"mailmoat.com", -"mailnesia.com", -"mailnull.com", -"mailscrap.com", -"mailshell.com", -"mailsiphon.com", -"mailsoul.com", -"mailtrash.net", -"mailzilla.com", -"makemetheking.com", -"mbx.cc", -"mega.zik.dj", -"meinspamschutz.de", -"meltmail.com", -"messagebeamer.de", -"mineblue.ru", -"mintemail.com", -"misha-rosestoy.ru", -"moboinfo.xyz", -"moncourrier.fr.nf", -"monemail.fr.nf", -"monmail.fr.nf", -"mor19.uu.gl", -"mt2009.com", -"mvrht.com", -"mycleaninbox.net", -"mymail-in.net", -"mypartyclip.de", -"myphantomemail.com", -"mytempemail.com", -"mytrashmail.com", -"neomailbox.com", -"nepwk.com", -"nervmich.net", -"nervtmich.net", -"netmails.com", -"netmails.net", -"neverbox.com", -"newfilm24.ru", -"niepodam.pl", -"no-spam.ws", -"nomail.xl.cx", -"nomorespamemails.com", -"nospam.ze.tc", -"nospam4.us", -"nospammail.net", -"notmailinator.com", -"notsharingmy.info", -"nowmymail.com", -"nurfuerspam.de", -"objectmail.com", -"obobbo.com", -"officialrolex.ru", -"oneoffemail.com", -"onewaymail.com", -"onlinenet.info", -"oopi.org", -"ordinaryamerican.net", -"otherinbox.com", -"ovpn.to", -"owlpic.com", -"p33.org", -"pancakemail.com", -"partner1bizmoney.ru", -"pchelovodstvo-tut.ru", -"piratesdelivery.ru", -"pmlep.de", -"politikerclub.de", -"pookmail.com", -"powerbank-russia.ru", -"privacy.net", -"proxymail.eu", -"prtnx.com", -"putthisinyourspamdatabase.com", -"quickinbox.com", -"razinrocks.me", -"rcpt.at", -"reallymymail.com", -"recode.me", -"reconmail.com", -"recursor.net", -"reloadpoint.ru", -"rtrtr.com", -"s-sakamas.ru", -"s0ny.net", -"safe-mail.net", -"safersignup.de", -"safetymail.info", -"safetypost.de", -"samogonda.ru", -"sendspamhere.com", -"senseless-entertainment.com", -"sgbteamreborn.imouto.pro", -"shar-kov.ru", -"sharklasers.com", -"shiftmail.com", -"shitmail.me", -"shortmail.net", -"sibmail.com", -"slaskpost.se", -"smellfear.com", -"sneakemail.com", -"sofimail.com", -"sogetthis.com", -"soodonims.com", -"spam4.me", -"spambob.net", -"spambog.com", -"spambog.de", -"spambog.ru", -"spambooger.com", -"spambox.us", -"spambox.win", -"spambox.xyz", -"spamcannon.com", -"spamcannon.net", -"spamcon.org", -"spamcorptastic.com", -"spamcowboy.com", -"spamcowboy.net", -"spamcowboy.org", -"spamday.com", -"spamex.com", -"spamfree.eu", -"spamfree24.com", -"spamfree24.de", -"spamfree24.org", -"spamgourmet.com", -"spamgourmet.net", -"spamgourmet.org", -"spamhereplease.com", -"spamhole.com", -"spamify.com", -"spaml.de", -"spammotel.com", -"spamobox.com", -"spamslicer.com", -"spamthis.co.uk", -"speed.1s.fr", -"squizzy.net", -"sskstroy.ru", -"streetwisemail.com", -"super-auswahl.de", -"supermailer.jp", -"suremail.info", -"tecninja.xyz", -"teewars.org", -"teleosaurs.xyz", -"teleworm.com", -"temp-mail.org", -"tempe-mail.com", -"tempemail.com", -"tempemail.net", -"tempinbox.co.uk", -"tempinbox.com", -"tempmail.it", -"tempmail.top", -"tempmail.win", -"tempomail.fr", -"thankyou2010.com", -"thisisnotmyrealemail.com", -"thrott.com", -"throwawayemailaddress.com", -"tilien.com", -"titaspaharpur1.gq", -"tmailinator.com", -"tradermail.info", -"trash-mail.at", -"trash-mail.com", -"trash-mail.de", -"trash2009.com", -"trashdevil.com", -"trashemail.de", -"trashinbox.net", -"trashmail.at", -"trashmail.com", -"trashmail.de", -"trashmail.me", -"trashmail.net", -"trashmail.org", -"trashmail.ws", -"trashmailer.com", -"trashymail.com", -"trbvm.com", -"trbvn.com", -"trillianpro.com", -"tvchd.com", -"twinmail.de", -"tyldd.com", -"uggsrock.com", -"upliftnow.com", -"urhen.com", -"ussv.club", -"vapecentral.ru", -"venompen.com", -"veryrealemail.com", -"vkusup.ru", -"voemail.com", -"vssms.com", -"weammo.xyz", -"webcool.club", -"wegwerfadresse.de", -"wegwerfemail.com", -"wegwerfemail.de", -"wegwerfmail.de", -"wegwerfmail.net", -"wegwerfmail.org", -"wh4f.org", -"whyspam.me", -"willhackforfood.biz", -"willselfdestruct.com", -"wronghead.com", -"wwwnew.eu", -"xemaps.com", -"xitroo.com", -"xmaily.com", -"xoxy.net", -"xww.ro", -"yep.it", -"yevme.com", -"yopmail.com", -"yopmail.fr", -"yopmail.net", -"yuurok.com", -"zagorodnyi-domik.ru", -"zdorovpagh.ru", -"zehnminutenmail.de", -"zippymail.info", -"zoemail.net"} diff --git a/resources/config/spamfilter/maps/domains_free.list b/resources/config/spamfilter/maps/domains_free.list deleted file mode 100644 index fadfe85b..00000000 --- a/resources/config/spamfilter/maps/domains_free.list +++ /dev/null @@ -1,4007 +0,0 @@ -spam-free = {"0-mail.com", -"027168.com", -"0815.su", -"0sg.net", -"10mail.org", -"10minutemail.co.za", -"123.com", -"123india.com", -"123mail.cl", -"123mail.org", -"126.com", -"139.com", -"150mail.com", -"150ml.com", -"15meg4free.com", -"163.com", -"16mail.com", -"188.com", -"189.cn", -"1ce.us", -"1chuan.com", -"1funplace.com", -"1internetdrive.com", -"1mail.net", -"1me.net", -"1mum.com", -"1musicrow.com", -"1pad.de", -"1zhuan.com", -"2-mail.com", -"20email.eu", -"20mail.in", -"20mail.it", -"212.com", -"21cn.com", -"24horas.com", -"2980.com", -"2bmail.co.uk", -"2die4.com", -"2trom.com", -"3126.com", -"321media.com", -"37.com", -"3ammagazine.com", -"3dmail.com", -"3g.ua", -"3mail.ga", -"444.net", -"4email.net", -"4mg.com", -"4warding.net", -"4x4man.com", -"50mail.com", -"5iron.com", -"60minutemail.com", -"6ip.us", -"74.ru", -"7mail.ml", -"88.am", -"8mail.ml", -"97rock.com", -"99experts.com", -"9online.fr", -"a1.net", -"a45.in", -"aaamail.zzn.com", -"aapt.net.au", -"aaronkwok.net", -"abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijk.com", -"abcflash.net", -"abdulnour.com", -"aberystwyth.com", -"about.com", -"abv.bg", -"abwesend.de", -"abyssmail.com", -"acceso.or.cr", -"access4less.net", -"accountant.com", -"acdcfan.com", -"acmemail.net", -"acninc.net", -"activist.com", -"adam.com.au", -"add3000.pp.ua", -"addcom.de", -"address.com", -"adelphia.net", -"adexec.com", -"adfarrow.com", -"adoption.com", -"ados.fr", -"adrenalinefreak.com", -"advalvas.be", -"advantimo.com", -"aeiou.pt", -"africamail.com", -"africamel.net", -"agoodmail.com", -"ahaa.dk", -"ahk.jp", -"aichi.com", -"aim.com", -"aircraftmail.com", -"airforce.net", -"airforceemail.com", -"airpost.net", -"ajacied.com", -"ak47.hu", -"aknet.kg", -"albawaba.com", -"algeria.com", -"alhilal.net", -"alibaba.com", -"alice.it", -"aliyun.com", -"allergist.com", -"allmail.net", -"allracing.com", -"allsaintsfan.com", -"alpenjodel.de", -"alphafrau.de", -"alskens.dk", -"alternativagratis.com", -"alumni.com", -"alumnidirector.com", -"alvilag.hu", -"amail.com", -"amele.com", -"america.hm", -"ameritech.net", -"amnetsal.com", -"amorki.pl", -"amrer.net", -"amuro.net", -"amuromail.com", -"ananzi.co.za", -"ancestry.com", -"andylau.net", -"angelfire.com", -"angelic.com", -"animail.net", -"animalhouse.com", -"anjungcafe.com", -"annsmail.com", -"ano-mail.net", -"anonymous.to", -"anote.com", -"another.com", -"anotherdomaincyka.tk", -"anotherwin95.com", -"anti-social.com", -"antisocial.com", -"antispam24.de", -"anymoment.com", -"anytimenow.com", -"aol.co.uk", -"aol.com", -"aol.fr", -"aon.at", -"apexmail.com", -"apmail.com", -"apollo.lv", -"aport.ru", -"aport2000.ru", -"appraiser.net", -"arabia.com", -"arabtop.net", -"archaeologist.com", -"arcor.de", -"arcticmail.com", -"argentina.com", -"army.net", -"armyspy.com", -"arnet.com.ar", -"artlover.com", -"artlover.com.au", -"asdasd.nl", -"asean-mail.com", -"asheville.com", -"asia-links.com", -"asia-mail.com", -"asia.com", -"asiafind.com", -"asianavenue.com", -"asiancityweb.com", -"asiansonly.net", -"asianwired.net", -"asiapoint.net", -"ass.pp.ua", -"assala.com", -"assamesemail.com", -"astrolover.com", -"astrosfan.net", -"asurfer.com", -"atheist.com", -"athenachu.net", -"atina.cl", -"atozasia.com", -"atrus.ru", -"att.net", -"attglobal.net", -"attymail.com", -"au.ru", -"auctioneer.net", -"ausi.com", -"aussiemail.com.au", -"austin.rr.com", -"australia.edu", -"australiamail.com", -"autoescuelanerja.com", -"autograf.pl", -"autorambler.ru", -"aver.com", -"avh.hu", -"awsom.net", -"axoskate.com", -"azazazatashkent.tk", -"azmeil.tk", -"bachelorboy.com", -"bachelorgal.com", -"backpackers.com", -"backstreet-boys.com", -"bagherpour.com", -"baldmama.de", -"baldpapa.de", -"ballyfinance.com", -"bangkok.com", -"bangkok2000.com", -"bannertown.net", -"baptistmail.com", -"baptized.com", -"barcelona.com", -"bareed.ws", -"bartender.net", -"baseballmail.com", -"basketballmail.com", -"batuta.net", -"bboy.zzn.com", -"bcvibes.com", -"beddly.com", -"beeebank.com", -"beenhad.com", -"beep.ru", -"beer.com", -"beethoven.com", -"belice.com", -"bell.net", -"bellair.net", -"bellsouth.net", -"berlin.com", -"berlin.de", -"bestmail.us", -"betriebsdirektor.de", -"bettergolf.net", -"bharatmail.com", -"bigassweb.com", -"bigblue.net.au", -"bigfoot.com", -"bigfoot.de", -"bigger.com", -"biggerbadder.com", -"bigmailbox.com", -"bigmir.net", -"bigpond.com", -"bigpond.com.au", -"bigpond.net.au", -"bigstring.com", -"bikemechanics.com", -"bikeracer.com", -"bikerider.com", -"billsfan.com", -"billsfan.net", -"bin-wieder-da.de", -"birdlover.com", -"bisons.com", -"bitmail.com", -"bitpage.net", -"bizhosting.com", -"bk.ru", -"blackplanet.com", -"blader.com", -"bladesmail.net", -"blazemail.com", -"bleib-bei-mir.de", -"blockfilter.com", -"blogmyway.org", -"bluebottle.com", -"bluemail.ch", -"bluemail.dk", -"blushmail.com", -"boardermail.com", -"bodhi.lawlita.com", -"bol.com.br", -"bolando.com", -"bolt.com", -"boltonfans.com", -"bombdiggity.com", -"bootybay.de", -"boun.cr", -"bounce.net", -"bouncr.com", -"box.az", -"box.ua", -"boxemail.com", -"boxformail.in", -"boxfrog.com", -"boximail.com", -"bradfordfans.com", -"brasilia.net", -"brazilmail.com", -"breathe.com", -"brennendesreich.de", -"bresnan.net", -"brew-master.com", -"brew-meister.com", -"briefemail.com", -"bright.net", -"britneyclub.com", -"broadcast.net", -"brokenvalve.com", -"brusseler.com", -"bsdmail.com", -"btcmail.pw", -"btinternet.com", -"buerotiger.de", -"bullsfan.com", -"bumpymail.com", -"bund.us", -"burnthespam.info", -"burstmail.info", -"businessman.net", -"buyersusa.com", -"bvimailbox.com", -"byom.de", -"c2.hu", -"c3.hu", -"c4.com", -"cabacabana.com", -"cableone.net", -"caere.it", -"calidifontain.be", -"californiamail.com", -"callnetuk.com", -"callsign.net", -"caltanet.it", -"camidge.com", -"canada-11.com", -"canadianmail.com", -"canoemail.com", -"caramail.com", -"caramail.fr", -"care2.com", -"careerbuildermail.com", -"carioca.net", -"cartestraina.ro", -"casablancaresort.com", -"casema.nl", -"cash4u.com", -"casino.com", -"catchamail.com", -"catholic.org", -"catlover.com", -"cd2.com", -"cegetel.net", -"celineclub.com", -"celtic.com", -"center-mail.de", -"centermail.at", -"centermail.de", -"centermail.info", -"centoper.it", -"centralpets.com", -"centrum.cz", -"centrum.sk", -"centurytel.net", -"certifiedmail.com", -"cfl.rr.com", -"cgac.es", -"chacuo.net", -"chaiyomail.com", -"chammy.info", -"chandrasekar.net", -"charmedmail.com", -"charter.com", -"charter.net", -"chat.ru", -"chattown.com", -"cheatmail.de", -"chechnya.conf.work", -"check.com", -"check1check.com", -"cheerful.com", -"chef.net", -"chek.com", -"chello.nl", -"chemist.com", -"cheyenneweb.com", -"chez.com", -"china.com", -"chinamail.com", -"chirk.com", -"chocaholic.com.au", -"chong-mail.net", -"churchusa.com", -"cia-agent.com", -"cia.hu", -"cicciociccio.com", -"cincinow.net", -"citiz.net", -"citlink.net", -"city-of-birmingham.com", -"city-of-cambridge.com", -"city-of-edinburgh.com", -"city-of-lincoln.com", -"city-of-liverpool.com", -"city-of-manchester.com", -"city-of-oxford.com", -"city-of-swansea.com", -"city-of-westminster.com", -"city-of-westminster.net", -"city-of-york.net", -"cityoflondon.org", -"ckaazaza.tk", -"claramail.com", -"classicalfan.com", -"classicmail.co.za", -"clerk.com", -"cliffhanger.com", -"clixser.com", -"close2you.net", -"clrmail.com", -"club4x4.net", -"clubalfa.com", -"clubbers.net", -"clubducati.com", -"clubhonda.net", -"club-internet.fr", -"clubinternet.fr", -"clubmember.org", -"clubnetnoir.com", -"clubvdo.net", -"cluemail.com", -"cmail.net", -"cmpmail.com", -"cnnsimail.com", -"cntv.cn", -"codec.ro", -"coder.hu", -"coid.biz", -"coldmail.com", -"collectiblesuperstore.com", -"collector.org", -"collegeclub.com", -"collegemail.com", -"colleges.com", -"columbus.rr.com", -"columbusrr.com", -"columnist.com", -"comcast.net", -"comic.com", -"communityconnect.com", -"comprendemail.com", -"compuserve.com", -"computer4u.com", -"computermail.net", -"conexcol.com", -"conk.com", -"connect4free.net", -"consultant.com", -"consumerriot.com", -"contractor.net", -"coole-files.de", -"coolgoose.ca", -"coolgoose.com", -"coolkiwi.com", -"coolmail.com", -"coolmail.net", -"coolsite.net", -"cooperation.net", -"cooperationtogo.net", -"copacabana.com", -"cornells.com", -"corporatedirtbag.com", -"cotas.net", -"counsellor.com", -"cox.com", -"cox.net", -"coxinet.net", -"cracker.hu", -"crapmail.org", -"crazedanddazed.com", -"crazymailing.com", -"cristianemail.com", -"critterpost.com", -"croeso.com", -"crosshairs.com", -"crosswinds.net", -"crwmail.com", -"cs.com", -"csinibaba.hu", -"cuemail.com", -"curio-city.com", -"curryworld.de", -"cute-girl.com", -"cutey.com", -"cyber-africa.net", -"cyber-innovation.club", -"cyber-matrix.com", -"cyber-wizard.com", -"cyber4all.com", -"cyberbabies.com", -"cybercafemaui.com", -"cyberdude.com", -"cybergal.com", -"cybergrrl.com", -"cybermail.net", -"cybernet.it", -"cyberservices.com", -"cyberspace-asia.com", -"cybertrains.org", -"cyclefanz.com", -"cynetcity.com", -"dabsol.net", -"dadacasa.com", -"dailypioneer.com", -"dallasmail.com", -"dangerous-minds.com", -"dasdasdascyka.tk", -"dawnsonmail.com", -"dawsonmail.com", -"dbzmail.com", -"deadlymob.org", -"deagot.com", -"deal-maker.com", -"dearriba.com", -"death-star.com", -"deliveryman.com", -"deneg.net", -"depechemode.com", -"deseretmail.com", -"desilota.com", -"deskpilot.com", -"destin.com", -"detik.com", -"deutschland-net.com", -"devotedcouples.com", -"dezigner.ru", -"dfwatson.com", -"di-ve.com", -"die-besten-bilder.de", -"die-genossen.de", -"die-optimisten.net", -"diemailbox.de", -"digibel.be", -"digital-filestore.de", -"diplomats.com", -"directbox.com", -"dirtracer.com", -"discard.email", -"discard.ga", -"discard.gq", -"disciples.com", -"discofan.com", -"discovery.com", -"discoverymail.com", -"disign-revelation.com", -"dispomail.eu", -"disposable.com", -"dispose.it", -"dm.w3internet.co.uk", -"dnsmadeeasy.com", -"docmail.cz", -"doctor.com", -"dodo.com.au", -"dodsi.com", -"dog.com", -"dogit.com", -"doglover.com", -"dogsnob.net", -"doityourself.com", -"domforfb1.tk", -"domforfb2.tk", -"domforfb3.tk", -"domforfb4.tk", -"domforfb5.tk", -"domforfb6.tk", -"domforfb8.tk", -"domozmail.com", -"doneasy.com", -"dontgotmail.com", -"dontmesswithtexas.com", -"doramail.com", -"dostmail.com", -"dotcom.fr", -"dotmsg.com", -"dott.it", -"download-privat.de", -"dplanet.ch", -"dr.com", -"dropmail.me", -"dropzone.com", -"drotposta.hu", -"dublin.com", -"dublin.ie", -"dumpmail.com", -"dumpmail.de", -"dumpyemail.com", -"dunlopdriver.com", -"dunloprider.com", -"duno.com", -"duskmail.com", -"dutchmail.com", -"dwp.net", -"dygo.com", -"dyndns.org", -"e-apollo.lv", -"e-mail.com.tr", -"e-mail.dk", -"e-mail.ru", -"e-mail.ua", -"e-mailanywhere.com", -"e-tapaal.com", -"earthalliance.com", -"earthcam.net", -"earthdome.com", -"earthling.net", -"earthlink.net", -"earthonline.net", -"eastcoast.co.za", -"eastmail.com", -"easy.to", -"easypost.com", -"easytrashmail.com", -"ecardmail.com", -"echina.com", -"ecompare.com", -"edmail.com", -"edtnmail.com", -"educacao.te.pt", -"eelmail.com", -"ehmail.com", -"einrot.com", -"eintagsmail.de", -"eircom.net", -"elitemail.org", -"elvis.com", -"elvisfan.com", -"email-fake.gq", -"email-london.co.uk", -"email.biz", -"email.com", -"email.cz", -"email.ee", -"email.it", -"email.nu", -"email.org", -"email.ro", -"email.ru", -"email.su", -"email.ua", -"email2me.net", -"emailacc.com", -"emailaccount.com", -"emailasso.net", -"emailchoice.com", -"emailcorner.net", -"emailem.com", -"emailengine.net", -"emailengine.org", -"emailgo.de", -"emailgroups.net", -"emailinfive.com", -"emailit.com", -"emailplanet.com", -"emailplus.org", -"emailto.de", -"emailuser.net", -"emailx.net", -"embarqmail.com", -"emeil.in", -"emeil.ir", -"emil.com", -"eml.cc", -"eml.pp.ua", -"enel.net", -"engineer.com", -"england.com", -"england.edu", -"englandmail.com", -"epage.ru", -"ephemail.net", -"epix.net", -"eposta.hu", -"eramail.co.za", -"eresmas.com", -"eriga.lv", -"estranet.it", -"ethos.st", -"eudoramail.com", -"europamel.net", -"europe.com", -"europemail.com", -"euroseek.com", -"eurosport.com", -"every1.net", -"everyday.com.kh", -"everymail.net", -"everyone.net", -"everytg.ml", -"examnotes.net", -"excite.co.jp", -"excite.com", -"excite.it", -"execs.com", -"exemail.com.au", -"expressasia.com", -"extenda.net", -"eyepaste.com", -"ezcybersearch.com", -"ezrs.com", -"f-m.fm", -"f1fans.net", -"facebook.com", -"fahr-zur-hoelle.org", -"fake-email.pp.ua", -"fake-mail.cf", -"falseaddress.com", -"fan.com", -"fansonlymail.com", -"fantasticmail.com", -"farang.net", -"faroweb.com", -"fast-email.com", -"fast-mail.fr", -"fast-mail.org", -"fastchevy.com", -"fastem.com", -"fastemail.us", -"fastemailer.com", -"fastermail.com", -"fastest.cc", -"fastimap.com", -"fastmail.ca", -"fastmail.cn", -"fastmail.co.uk", -"fastmail.com", -"fastmail.com.au", -"fastmail.es", -"fastmail.fm", -"fastmail.im", -"fastmail.in", -"fastmail.jp", -"fastmail.mx", -"fastmail.net", -"fastmail.nl", -"fastmail.se", -"fastmail.to", -"fastmail.tw", -"fastmail.us", -"fastmailbox.net", -"fastmazda.com", -"fastmessaging.com", -"fastservice.com", -"fastsubaru.com", -"fatflap.com", -"fathersrightsne.org", -"fax.ru", -"fbi.hu", -"fea.st", -"federalcontractors.com", -"feinripptraeger.de", -"felicitymail.com", -"femenino.com", -"fetchmail.co.uk", -"fettabernett.de", -"feyenoorder.com", -"ffanet.com", -"fiberia.com", -"ficken.de", -"fightallspam.com", -"filipinolinks.com", -"financemail.net", -"financier.com", -"findmail.com", -"fire-brigade.com", -"fireman.net", -"fishburne.org", -"fishfuse.com", -"fixmail.tk", -"fizmail.com", -"flashbox.5july.org", -"flashmail.com", -"flashmail.net", -"fleckens.hu", -"flipcode.com", -"fmail.co.uk", -"fmailbox.com", -"fmgirl.com", -"fmguy.com", -"fnbmail.co.za", -"fnmail.com", -"folkfan.com", -"foodmail.com", -"footard.com", -"football.ua", -"footballmail.com", -"for-president.com", -"force9.co.uk", -"forgetmail.com", -"forpresident.com", -"fortuncity.com", -"fortunecity.com", -"forum.dk", -"foxmail.com", -"fr33mail.info", -"francemel.fr", -"free-online.net", -"free-org.com", -"free.com.pe", -"free.fr", -"freeaccess.nl", -"freeaccount.com", -"freeandsingle.com", -"freedom.usa.com", -"freedomlover.com", -"freegates.be", -"freelance-france.eu", -"freeler.nl", -"freemail.c3.hu", -"freemail.com.pk", -"freemail.de", -"freemail.et", -"freemail.gr", -"freemail.hu", -"freemail.it", -"freemail.lt", -"freemail.org.mk", -"freemails.ga", -"freemeil.gq", -"freenet.de", -"freenet.kg", -"freeola.com", -"freeola.net", -"freestart.hu", -"freesurf.fr", -"freesurf.nl", -"freeuk.com", -"freeuk.net", -"freeukisp.co.uk", -"freeweb.org", -"freewebemail.com", -"freeyellow.com", -"freezone.co.uk", -"fresnomail.com", -"freudenkinder.de", -"freundin.ru", -"friendlymail.co.uk", -"friendsfan.com", -"from-africa.com", -"from-australia.com", -"from-europe.com", -"from-holland.com", -"from-japan.net", -"from-mexico.com", -"from-outerspace.com", -"from-russia.com", -"fromalaska.com", -"fromarizona.com", -"fromarkansas.com", -"fromcalifornia.com", -"fromconnecticut.com", -"fromgeorgia.com", -"fromhawaii.net", -"fromidaho.com", -"fromindiana.com", -"fromiowa.com", -"fromkansas.com", -"fromlouisiana.com", -"frommaryland.com", -"frommassachusetts.com", -"frommiami.com", -"frommichigan.com", -"fromminnesota.com", -"frommississippi.com", -"frommissouri.com", -"fromnevada.com", -"fromnewhampshire.com", -"fromnewjersey.com", -"fromnewmexico.com", -"fromnorthcarolina.com", -"fromnorthdakota.com", -"fromohio.com", -"fromoklahoma.com", -"frompennsylvania.com", -"fromrhodeisland.com", -"fromru.com", -"fromsouthcarolina.com", -"fromtennessee.com", -"fromtexas.com", -"fromutah.com", -"fromvermont.com", -"fromvirginia.com", -"fromwashington.com", -"fromwashingtondc.com", -"fromwestvirginia.com", -"fromwisconsin.com", -"fromwyoming.com", -"front.ru", -"frontier.com", -"frontiernet.net", -"fsmail.net", -"ftml.net", -"fullmail.com", -"fuorissimo.com", -"furnitureprovider.com", -"fuse.net", -"fut.es", -"galaxyhit.com", -"gamebox.net", -"gamegeek.com", -"gamespotmail.com", -"garbage.com", -"gardener.com", -"gaybrighton.co.uk", -"gaza.net", -"gazeta.pl", -"gazibooks.com", -"gci.net", -"geek.com", -"geeklife.com", -"gelitik.in", -"gencmail.com", -"gentlemansclub.de", -"geocities.com", -"geography.net", -"geologist.com", -"geopia.com", -"germanymail.com", -"get.pp.ua", -"get1mail.com", -"getairmail.com", -"getairmail.gq", -"getonemail.net", -"ghanamail.com", -"ghostmail.com", -"ghosttexter.de", -"gigileung.org", -"girl4god.com", -"glay.org", -"glendale.net", -"globalfree.it", -"globalpagan.com", -"gmail.com", -"gmail.com.br", -"gmx.at", -"gmx.biz", -"gmx.ch", -"gmx.co.uk", -"gmx.com", -"gmx.de", -"gmx.eu", -"gmx.fr", -"gmx.info", -"gmx.li", -"gmx.net", -"gmx.org", -"gmx.us", -"go.com", -"go.ro", -"go.ru", -"gocollege.com", -"gocubs.com", -"goldmail.ru", -"goldtoolbox.com", -"golfemail.com", -"golfilla.info", -"golfmail.be", -"gonavy.net", -"goodnewsmail.com", -"goodstick.com", -"googlemail.com", -"goplay.com", -"gorillaswithdirtyarmpits.com", -"gospelfan.com", -"gotmail.com", -"gotmail.org", -"gotomy.com", -"gotti.otherinbox.com", -"gportal.hu", -"graduate.org", -"graffiti.net", -"gramszu.net", -"grandmamail.com", -"graphic-designer.com", -"grapplers.com", -"greenmail.net", -"groupmail.com", -"grr.la", -"gtmc.net", -"gua.net", -"guessmail.com", -"guju.net", -"gustr.com", -"guy.com", -"guy2.com", -"guyanafriends.com", -"h-mail.us", -"hab-verschlafen.de", -"habmalnefrage.de", -"hacccc.com", -"hackermail.com", -"hackermail.net", -"hailmail.net", -"hairdresser.net", -"hamptonroads.com", -"handbag.com", -"handleit.com", -"hanmail.net", -"happemail.com", -"happycounsel.com", -"happypuppy.com", -"harakirimail.com", -"hardcorefreak.com", -"hartbot.de", -"hawaii.rr.com", -"hawaiiantel.net", -"heerschap.com", -"heesun.net", -"hello.hu", -"hello.net.au", -"hello.to", -"helter-skelter.com", -"herediano.com", -"herp.in", -"herr-der-mails.de", -"hetnet.nl", -"hey.to", -"hidzz.com", -"highquality.com", -"highveldmail.co.za", -"hilarious.com", -"hiphopfan.com", -"hispavista.com", -"hitmail.com", -"hitthe.net", -"hkg.net", -"hockeymail.com", -"hollywoodkids.com", -"home-email.com", -"home.de", -"home.nl", -"home.ro", -"home.se", -"homemail.com", -"homestead.com", -"honduras.com", -"hongkong.com", -"hoopsmail.com", -"hopemail.biz", -"hot-shot.com", -"hot.ee", -"hotbrev.com", -"hotletter.com", -"hotmail.ca", -"hotmail.ch", -"hotmail.co.il", -"hotmail.co.uk", -"hotmail.com", -"hotmail.de", -"hotmail.es", -"hotmail.fr", -"hotmail.it", -"hotmail.kz", -"hotmail.nl", -"hotmail.ru", -"hotpop3.com", -"hotvoice.com", -"housemail.com", -"hsuchi.net", -"hu2.ru", -"hughes.net", -"humanoid.net", -"hunsa.com", -"hurting.com", -"hush.com", -"hushmail.com", -"hypernautica.com", -"i-connect.com", -"i-mail.com.au", -"i-p.com", -"i.am", -"i.ua", -"i2pmail.org", -"iamawoman.com", -"icestorm.com", -"ich-bin-verrueckt-nach-dir.de", -"ich-will-net.de", -"icloud.com", -"icmsconsultants.com", -"icq.com", -"icqmail.com", -"icrazy.com", -"idirect.com", -"ieh-mail.de", -"iespana.es", -"ig.com.br", -"ihateclowns.com", -"iinet.net.au", -"ijustdontcare.com", -"ikbenspamvrij.nl", -"ilkposta.com", -"ilovechocolate.com", -"ilovejesus.com", -"ilse.nl", -"imaginemail.com", -"imail.org", -"imail.ru", -"imap-mail.com", -"imap.cc", -"imapmail.org", -"imel.org", -"imgof.com", -"imgv.de", -"immo-gerance.info", -"imposter.co.uk", -"imstations.com", -"imstressed.com", -"in-box.net", -"iname.com", -"inbax.tk", -"inbox.com", -"inbox.net", -"inbox.ru", -"inbox.si", -"inboxalias.com", -"incamail.com", -"incredimail.com", -"index.ua", -"indexa.fr", -"india.com", -"indiatimes.com", -"indo-mail.com", -"indomail.com", -"indyracers.com", -"inerted.com", -"info-media.de", -"info-radio.ml", -"info66.com", -"infohq.com", -"infomail.es", -"infomart.or.jp", -"infospacemail.com", -"infovia.com.ar", -"inicia.es", -"inmail.sk", -"inmail24.com", -"inmano.com", -"inmynetwork.tk", -"innocent.com", -"inorbit.com", -"inoutbox.com", -"insidebaltimore.net", -"insight.rr.com", -"instantemailaddress.com", -"instantmail.fr", -"instruction.com", -"instructor.net", -"insurer.com", -"interburp.com", -"interfree.it", -"interia.pl", -"interlap.com.ar", -"intermail.co.il", -"internet-e-mail.com", -"internet-mail.org", -"internet-police.com", -"internetegypt.com", -"internetemails.net", -"internetmailing.net", -"internode.on.net", -"inwind.it", -"iobox.com", -"iobox.fi", -"iol.it", -"iowaemail.com", -"ip4.pp.ua", -"ip6.pp.ua", -"ipoo.org", -"iprimus.com.au", -"iqemail.com", -"irangate.net", -"ireland.com", -"irelandmail.com", -"irj.hu", -"iroid.com", -"isellcars.com", -"iservejesus.com", -"islamonline.net", -"isleuthmail.com", -"ismart.net", -"isp9.net", -"israelmail.com", -"ist-allein.info", -"ist-einmalig.de", -"ist-ganz-allein.de", -"ist-willig.de", -"italymail.com", -"itmom.com", -"ivebeenframed.com", -"iwmail.com", -"iwon.com", -"izadpanah.com", -"jahoopa.com", -"jakuza.hu", -"jazzandjava.com", -"jazzfan.com", -"je-recycle.info", -"jerusalemmail.com", -"jetable.de", -"jetable.pp.ua", -"jetemail.net", -"jippii.fi", -"jmail.co.za", -"job4u.com", -"jokes.com", -"journalist.com", -"jourrapide.com", -"jovem.te.pt", -"jpopmail.com", -"jsrsolutions.com", -"jubiimail.dk", -"juniormail.com", -"junkmail.com", -"juno.com", -"justemail.net", -"justicemail.com", -"kaazoo.com", -"kaffeeschluerfer.com", -"kaffeeschluerfer.de", -"kaixo.com", -"kalpoint.com", -"kansascity.com", -"karbasi.com", -"katamail.com", -"kayafmmail.co.za", -"kbjrmail.com", -"kcks.com", -"keg-party.com", -"keinpardon.de", -"keko.com.ar", -"kellychen.com", -"keromail.com", -"keyemail.com", -"kgb.hu", -"kickassmail.com", -"killermail.com", -"kimo.com", -"kinglibrary.net", -"kinki-kids.com", -"kissfans.com", -"kittymail.com", -"kitznet.at", -"kiwitown.com", -"km.ru", -"knol-power.nl", -"kommespaeter.de", -"konx.com", -"korea.com", -"koreamail.com", -"kpnmail.nl", -"krongthip.com", -"krunis.com", -"ksanmail.com", -"ksee24mail.com", -"kukamail.com", -"kulturbetrieb.info", -"kumarweb.com", -"la.com", -"ladymail.cz", -"lagerlouts.com", -"lags.us", -"lakmail.com", -"lamer.hu", -"land.ru", -"lankamail.com", -"laoeq.com", -"laposte.net", -"lass-es-geschehen.de", -"lastmail.co", -"latemodels.com", -"lavache.com", -"law.com", -"lawyer.com", -"lazyinbox.com", -"leehom.net", -"legalrc.loan", -"legislator.com", -"lenta.ru", -"leonlai.net", -"letsgomets.net", -"letterboxes.org", -"letthemeatspam.com", -"levele.hu", -"lex.bg", -"lexis-nexis-mail.com", -"libero.it", -"liberomail.com", -"lick101.com", -"liebt-dich.info", -"linktrader.com", -"linuxfreemail.com", -"linuxmail.org", -"liontrucks.com", -"liquidinformation.net", -"list.ru", -"listomail.com", -"littleapple.com", -"littleblueroom.com", -"live.at", -"live.ca", -"live.cl", -"live.cn", -"live.co.uk", -"live.co.za", -"live.com", -"live.com.ar", -"live.com.au", -"live.com.mx", -"live.com.pt", -"live.com.sg", -"live.de", -"live.dk", -"live.fr", -"live.ie", -"live.in", -"live.it", -"live.jp", -"live.nl", -"live.ru", -"live.se", -"liveradio.tk", -"liverpoolfans.com", -"llandudno.com", -"llangollen.com", -"lobbyist.com", -"localbar.com", -"locos.com", -"loh.pp.ua", -"lolfreak.net", -"london.com", -"looksmart.co.uk", -"looksmart.com", -"lopezclub.com", -"louiskoo.com", -"loveable.com", -"lovecat.com", -"lovefall.ml", -"lovefootball.com", -"lovemail.com", -"lover-boy.com", -"lovesea.gq", -"lovethebroncos.com", -"loveyouforever.de", -"lovingjesus.com", -"lowandslow.com", -"lroid.com", -"luukku.com", -"lycos.co.uk", -"lycos.com", -"lycos.es", -"lycos.ne.jp", -"m-hmail.com", -"m4.org", -"mac.com", -"macbox.com", -"macfreak.com", -"macmail.com", -"madonnafan.com", -"maennerversteherin.com", -"maennerversteherin.de", -"maffia.hu", -"magicmail.co.za", -"mail-awu.de", -"mail-box.cz", -"mail-center.com", -"mail-central.com", -"mail-easy.fr", -"mail-filter.com", -"mail-me.com", -"mail-page.com", -"mail-tester.com", -"mail.az", -"mail.be", -"mail.bulgaria.com", -"mail.by", -"mail.co.za", -"mail.com", -"mail.com.tr", -"mail.ee", -"mail.gr", -"mail.hitthebeach.com", -"mail.htl22.at", -"mail.md", -"mail.misterpinball.de", -"mail.nu", -"mail.org.uk", -"mail.pf", -"mail.pt", -"mail.ru", -"mail.sisna.com", -"mail.svenz.eu", -"mail.usa.com", -"mail.wtf", -"mail114.net", -"mail15.com", -"mail2007.com", -"mail2aaron.com", -"mail2abby.com", -"mail2abc.com", -"mail2actor.com", -"mail2admiral.com", -"mail2adorable.com", -"mail2adoration.com", -"mail2adore.com", -"mail2adventure.com", -"mail2aeolus.com", -"mail2aether.com", -"mail2affection.com", -"mail2afghanistan.com", -"mail2africa.com", -"mail2agent.com", -"mail2aha.com", -"mail2ahoy.com", -"mail2aim.com", -"mail2air.com", -"mail2airbag.com", -"mail2airforce.com", -"mail2airport.com", -"mail2alabama.com", -"mail2alan.com", -"mail2alaska.com", -"mail2albania.com", -"mail2alcoholic.com", -"mail2alec.com", -"mail2alexa.com", -"mail2algeria.com", -"mail2alicia.com", -"mail2alien.com", -"mail2allan.com", -"mail2allen.com", -"mail2allison.com", -"mail2alpha.com", -"mail2alyssa.com", -"mail2amanda.com", -"mail2amazing.com", -"mail2amber.com", -"mail2america.com", -"mail2american.com", -"mail2andorra.com", -"mail2andrea.com", -"mail2andy.com", -"mail2anesthesiologist.com", -"mail2angela.com", -"mail2angola.com", -"mail2ann.com", -"mail2anna.com", -"mail2anne.com", -"mail2anthony.com", -"mail2aphrodite.com", -"mail2apollo.com", -"mail2april.com", -"mail2aquarius.com", -"mail2arabia.com", -"mail2arabic.com", -"mail2architect.com", -"mail2ares.com", -"mail2argentina.com", -"mail2aries.com", -"mail2arizona.com", -"mail2arkansas.com", -"mail2armenia.com", -"mail2army.com", -"mail2arnold.com", -"mail2art.com", -"mail2arthur.com", -"mail2artist.com", -"mail2ashley.com", -"mail2ask.com", -"mail2astronomer.com", -"mail2athena.com", -"mail2athlete.com", -"mail2atlas.com", -"mail2atom.com", -"mail2attitude.com", -"mail2auction.com", -"mail2aunt.com", -"mail2australia.com", -"mail2austria.com", -"mail2azerbaijan.com", -"mail2baby.com", -"mail2bahamas.com", -"mail2bahrain.com", -"mail2ballerina.com", -"mail2ballplayer.com", -"mail2band.com", -"mail2bangladesh.com", -"mail2bank.com", -"mail2banker.com", -"mail2bankrupt.com", -"mail2baptist.com", -"mail2bar.com", -"mail2barbados.com", -"mail2barbara.com", -"mail2barter.com", -"mail2basketball.com", -"mail2batter.com", -"mail2beach.com", -"mail2beast.com", -"mail2beatles.com", -"mail2beauty.com", -"mail2becky.com", -"mail2beijing.com", -"mail2belgium.com", -"mail2belize.com", -"mail2ben.com", -"mail2bernard.com", -"mail2beth.com", -"mail2betty.com", -"mail2beverly.com", -"mail2beyond.com", -"mail2biker.com", -"mail2bill.com", -"mail2billionaire.com", -"mail2billy.com", -"mail2bio.com", -"mail2biologist.com", -"mail2black.com", -"mail2blackbelt.com", -"mail2blake.com", -"mail2blind.com", -"mail2blonde.com", -"mail2blues.com", -"mail2bob.com", -"mail2bobby.com", -"mail2bolivia.com", -"mail2bombay.com", -"mail2bonn.com", -"mail2bookmark.com", -"mail2boreas.com", -"mail2bosnia.com", -"mail2boston.com", -"mail2botswana.com", -"mail2bradley.com", -"mail2brazil.com", -"mail2breakfast.com", -"mail2brian.com", -"mail2bride.com", -"mail2brittany.com", -"mail2broker.com", -"mail2brook.com", -"mail2bruce.com", -"mail2brunei.com", -"mail2brunette.com", -"mail2brussels.com", -"mail2bryan.com", -"mail2bug.com", -"mail2bulgaria.com", -"mail2business.com", -"mail2buy.com", -"mail2ca.com", -"mail2california.com", -"mail2calvin.com", -"mail2cambodia.com", -"mail2cameroon.com", -"mail2canada.com", -"mail2cancer.com", -"mail2capeverde.com", -"mail2capricorn.com", -"mail2cardinal.com", -"mail2cardiologist.com", -"mail2care.com", -"mail2caroline.com", -"mail2carolyn.com", -"mail2casey.com", -"mail2cat.com", -"mail2caterer.com", -"mail2cathy.com", -"mail2catlover.com", -"mail2catwalk.com", -"mail2cell.com", -"mail2chad.com", -"mail2champaign.com", -"mail2charles.com", -"mail2chef.com", -"mail2chemist.com", -"mail2cherry.com", -"mail2chicago.com", -"mail2chile.com", -"mail2china.com", -"mail2chinese.com", -"mail2chocolate.com", -"mail2christian.com", -"mail2christie.com", -"mail2christmas.com", -"mail2christy.com", -"mail2chuck.com", -"mail2cindy.com", -"mail2clark.com", -"mail2classifieds.com", -"mail2claude.com", -"mail2cliff.com", -"mail2clinic.com", -"mail2clint.com", -"mail2close.com", -"mail2club.com", -"mail2coach.com", -"mail2coastguard.com", -"mail2colin.com", -"mail2college.com", -"mail2color.com", -"mail2colorado.com", -"mail2columbia.com", -"mail2comedian.com", -"mail2composer.com", -"mail2computer.com", -"mail2computers.com", -"mail2concert.com", -"mail2congo.com", -"mail2connect.com", -"mail2connecticut.com", -"mail2consultant.com", -"mail2convict.com", -"mail2cook.com", -"mail2cool.com", -"mail2cory.com", -"mail2costarica.com", -"mail2country.com", -"mail2courtney.com", -"mail2cowboy.com", -"mail2cowgirl.com", -"mail2craig.com", -"mail2crave.com", -"mail2crazy.com", -"mail2create.com", -"mail2croatia.com", -"mail2cry.com", -"mail2crystal.com", -"mail2cuba.com", -"mail2culture.com", -"mail2curt.com", -"mail2customs.com", -"mail2cute.com", -"mail2cutey.com", -"mail2cynthia.com", -"mail2cyprus.com", -"mail2czechrepublic.com", -"mail2dad.com", -"mail2dale.com", -"mail2dallas.com", -"mail2dan.com", -"mail2dana.com", -"mail2dance.com", -"mail2dancer.com", -"mail2danielle.com", -"mail2danny.com", -"mail2darlene.com", -"mail2darling.com", -"mail2darren.com", -"mail2daughter.com", -"mail2dave.com", -"mail2dawn.com", -"mail2dc.com", -"mail2dealer.com", -"mail2deanna.com", -"mail2dearest.com", -"mail2debbie.com", -"mail2debby.com", -"mail2deer.com", -"mail2delaware.com", -"mail2delicious.com", -"mail2demeter.com", -"mail2democrat.com", -"mail2denise.com", -"mail2denmark.com", -"mail2dennis.com", -"mail2dentist.com", -"mail2derek.com", -"mail2desert.com", -"mail2devoted.com", -"mail2devotion.com", -"mail2diamond.com", -"mail2diana.com", -"mail2diane.com", -"mail2diehard.com", -"mail2dilemma.com", -"mail2dillon.com", -"mail2dinner.com", -"mail2dinosaur.com", -"mail2dionysos.com", -"mail2diplomat.com", -"mail2director.com", -"mail2dirk.com", -"mail2disco.com", -"mail2dive.com", -"mail2diver.com", -"mail2divorced.com", -"mail2djibouti.com", -"mail2doctor.com", -"mail2doglover.com", -"mail2dominic.com", -"mail2dominica.com", -"mail2dominicanrepublic.com", -"mail2don.com", -"mail2donald.com", -"mail2donna.com", -"mail2doris.com", -"mail2dorothy.com", -"mail2doug.com", -"mail2dough.com", -"mail2douglas.com", -"mail2dow.com", -"mail2downtown.com", -"mail2dream.com", -"mail2dreamer.com", -"mail2dude.com", -"mail2dustin.com", -"mail2dyke.com", -"mail2dylan.com", -"mail2earl.com", -"mail2earth.com", -"mail2eastend.com", -"mail2eat.com", -"mail2economist.com", -"mail2ecuador.com", -"mail2eddie.com", -"mail2edgar.com", -"mail2edwin.com", -"mail2egypt.com", -"mail2electron.com", -"mail2eli.com", -"mail2elizabeth.com", -"mail2ellen.com", -"mail2elliot.com", -"mail2elsalvador.com", -"mail2elvis.com", -"mail2emergency.com", -"mail2emily.com", -"mail2engineer.com", -"mail2english.com", -"mail2environmentalist.com", -"mail2eos.com", -"mail2eric.com", -"mail2erica.com", -"mail2erin.com", -"mail2erinyes.com", -"mail2eris.com", -"mail2eritrea.com", -"mail2ernie.com", -"mail2eros.com", -"mail2estonia.com", -"mail2ethan.com", -"mail2ethiopia.com", -"mail2eu.com", -"mail2europe.com", -"mail2eurus.com", -"mail2eva.com", -"mail2evan.com", -"mail2evelyn.com", -"mail2everything.com", -"mail2exciting.com", -"mail2expert.com", -"mail2fairy.com", -"mail2faith.com", -"mail2fanatic.com", -"mail2fancy.com", -"mail2fantasy.com", -"mail2farm.com", -"mail2farmer.com", -"mail2fashion.com", -"mail2fat.com", -"mail2feeling.com", -"mail2female.com", -"mail2fever.com", -"mail2fighter.com", -"mail2fiji.com", -"mail2filmfestival.com", -"mail2films.com", -"mail2finance.com", -"mail2finland.com", -"mail2fireman.com", -"mail2firm.com", -"mail2fisherman.com", -"mail2flexible.com", -"mail2florence.com", -"mail2florida.com", -"mail2floyd.com", -"mail2fly.com", -"mail2fond.com", -"mail2fondness.com", -"mail2football.com", -"mail2footballfan.com", -"mail2found.com", -"mail2france.com", -"mail2frank.com", -"mail2frankfurt.com", -"mail2franklin.com", -"mail2fred.com", -"mail2freddie.com", -"mail2free.com", -"mail2freedom.com", -"mail2french.com", -"mail2freudian.com", -"mail2friendship.com", -"mail2from.com", -"mail2fun.com", -"mail2gabon.com", -"mail2gabriel.com", -"mail2gail.com", -"mail2galaxy.com", -"mail2gambia.com", -"mail2games.com", -"mail2gary.com", -"mail2gavin.com", -"mail2gemini.com", -"mail2gene.com", -"mail2genes.com", -"mail2geneva.com", -"mail2george.com", -"mail2georgia.com", -"mail2gerald.com", -"mail2german.com", -"mail2germany.com", -"mail2ghana.com", -"mail2gilbert.com", -"mail2gina.com", -"mail2girl.com", -"mail2glen.com", -"mail2gloria.com", -"mail2goddess.com", -"mail2gold.com", -"mail2golfclub.com", -"mail2golfer.com", -"mail2gordon.com", -"mail2government.com", -"mail2grab.com", -"mail2grace.com", -"mail2graham.com", -"mail2grandma.com", -"mail2grandpa.com", -"mail2grant.com", -"mail2greece.com", -"mail2green.com", -"mail2greg.com", -"mail2grenada.com", -"mail2gsm.com", -"mail2guard.com", -"mail2guatemala.com", -"mail2guy.com", -"mail2hades.com", -"mail2haiti.com", -"mail2hal.com", -"mail2handhelds.com", -"mail2hank.com", -"mail2hannah.com", -"mail2harold.com", -"mail2harry.com", -"mail2hawaii.com", -"mail2headhunter.com", -"mail2heal.com", -"mail2heather.com", -"mail2heaven.com", -"mail2hebe.com", -"mail2hecate.com", -"mail2heidi.com", -"mail2helen.com", -"mail2hell.com", -"mail2help.com", -"mail2helpdesk.com", -"mail2henry.com", -"mail2hephaestus.com", -"mail2hera.com", -"mail2hercules.com", -"mail2herman.com", -"mail2hermes.com", -"mail2hespera.com", -"mail2hestia.com", -"mail2highschool.com", -"mail2hindu.com", -"mail2hip.com", -"mail2hiphop.com", -"mail2holland.com", -"mail2holly.com", -"mail2hollywood.com", -"mail2homer.com", -"mail2honduras.com", -"mail2honey.com", -"mail2hongkong.com", -"mail2hope.com", -"mail2horse.com", -"mail2hot.com", -"mail2hotel.com", -"mail2houston.com", -"mail2howard.com", -"mail2hugh.com", -"mail2human.com", -"mail2hungary.com", -"mail2hungry.com", -"mail2hygeia.com", -"mail2hyperspace.com", -"mail2hypnos.com", -"mail2ian.com", -"mail2ice-cream.com", -"mail2iceland.com", -"mail2idaho.com", -"mail2idontknow.com", -"mail2illinois.com", -"mail2imam.com", -"mail2in.com", -"mail2india.com", -"mail2indian.com", -"mail2indiana.com", -"mail2indonesia.com", -"mail2infinity.com", -"mail2intense.com", -"mail2iowa.com", -"mail2iran.com", -"mail2iraq.com", -"mail2ireland.com", -"mail2irene.com", -"mail2iris.com", -"mail2irresistible.com", -"mail2irving.com", -"mail2irwin.com", -"mail2isaac.com", -"mail2israel.com", -"mail2italian.com", -"mail2italy.com", -"mail2jackie.com", -"mail2jacob.com", -"mail2jail.com", -"mail2jaime.com", -"mail2jake.com", -"mail2jamaica.com", -"mail2james.com", -"mail2jamie.com", -"mail2jan.com", -"mail2jane.com", -"mail2janet.com", -"mail2janice.com", -"mail2japan.com", -"mail2japanese.com", -"mail2jasmine.com", -"mail2jason.com", -"mail2java.com", -"mail2jay.com", -"mail2jazz.com", -"mail2jed.com", -"mail2jeffrey.com", -"mail2jennifer.com", -"mail2jenny.com", -"mail2jeremy.com", -"mail2jerry.com", -"mail2jessica.com", -"mail2jessie.com", -"mail2jesus.com", -"mail2jew.com", -"mail2jeweler.com", -"mail2jim.com", -"mail2jimmy.com", -"mail2joan.com", -"mail2joann.com", -"mail2joanna.com", -"mail2jody.com", -"mail2joe.com", -"mail2joel.com", -"mail2joey.com", -"mail2john.com", -"mail2join.com", -"mail2jon.com", -"mail2jonathan.com", -"mail2jones.com", -"mail2jordan.com", -"mail2joseph.com", -"mail2josh.com", -"mail2joy.com", -"mail2juan.com", -"mail2judge.com", -"mail2judy.com", -"mail2juggler.com", -"mail2julian.com", -"mail2julie.com", -"mail2jumbo.com", -"mail2junk.com", -"mail2justin.com", -"mail2justme.com", -"mail2k.ru", -"mail2kansas.com", -"mail2karate.com", -"mail2karen.com", -"mail2karl.com", -"mail2karma.com", -"mail2kathleen.com", -"mail2kathy.com", -"mail2katie.com", -"mail2kay.com", -"mail2kazakhstan.com", -"mail2keen.com", -"mail2keith.com", -"mail2kelly.com", -"mail2kelsey.com", -"mail2ken.com", -"mail2kendall.com", -"mail2kennedy.com", -"mail2kenneth.com", -"mail2kenny.com", -"mail2kentucky.com", -"mail2kenya.com", -"mail2kerry.com", -"mail2kevin.com", -"mail2kim.com", -"mail2kimberly.com", -"mail2king.com", -"mail2kirk.com", -"mail2kiss.com", -"mail2kosher.com", -"mail2kristin.com", -"mail2kurt.com", -"mail2kuwait.com", -"mail2kyle.com", -"mail2kyrgyzstan.com", -"mail2la.com", -"mail2lacrosse.com", -"mail2lance.com", -"mail2lao.com", -"mail2larry.com", -"mail2latvia.com", -"mail2laugh.com", -"mail2laura.com", -"mail2lauren.com", -"mail2laurie.com", -"mail2lawrence.com", -"mail2lawyer.com", -"mail2lebanon.com", -"mail2lee.com", -"mail2leo.com", -"mail2leon.com", -"mail2leonard.com", -"mail2leone.com", -"mail2leslie.com", -"mail2letter.com", -"mail2liberia.com", -"mail2libertarian.com", -"mail2libra.com", -"mail2libya.com", -"mail2liechtenstein.com", -"mail2life.com", -"mail2linda.com", -"mail2linux.com", -"mail2lionel.com", -"mail2lipstick.com", -"mail2liquid.com", -"mail2lisa.com", -"mail2lithuania.com", -"mail2litigator.com", -"mail2liz.com", -"mail2lloyd.com", -"mail2lois.com", -"mail2lola.com", -"mail2london.com", -"mail2looking.com", -"mail2lori.com", -"mail2lost.com", -"mail2lou.com", -"mail2louis.com", -"mail2louisiana.com", -"mail2lovable.com", -"mail2love.com", -"mail2lucky.com", -"mail2lucy.com", -"mail2lunch.com", -"mail2lust.com", -"mail2luxembourg.com", -"mail2luxury.com", -"mail2lyle.com", -"mail2lynn.com", -"mail2madagascar.com", -"mail2madison.com", -"mail2madrid.com", -"mail2maggie.com", -"mail2mail4.com", -"mail2maine.com", -"mail2malawi.com", -"mail2malaysia.com", -"mail2maldives.com", -"mail2mali.com", -"mail2malta.com", -"mail2mambo.com", -"mail2man.com", -"mail2mandy.com", -"mail2manhunter.com", -"mail2mankind.com", -"mail2many.com", -"mail2marc.com", -"mail2marcia.com", -"mail2margaret.com", -"mail2margie.com", -"mail2marhaba.com", -"mail2maria.com", -"mail2marilyn.com", -"mail2marines.com", -"mail2mark.com", -"mail2marriage.com", -"mail2married.com", -"mail2marries.com", -"mail2mars.com", -"mail2marsha.com", -"mail2marshallislands.com", -"mail2martha.com", -"mail2martin.com", -"mail2marty.com", -"mail2marvin.com", -"mail2mary.com", -"mail2maryland.com", -"mail2mason.com", -"mail2massachusetts.com", -"mail2matt.com", -"mail2matthew.com", -"mail2maurice.com", -"mail2mauritania.com", -"mail2mauritius.com", -"mail2max.com", -"mail2maxwell.com", -"mail2maybe.com", -"mail2mba.com", -"mail2me4u.com", -"mail2mechanic.com", -"mail2medieval.com", -"mail2megan.com", -"mail2mel.com", -"mail2melanie.com", -"mail2melissa.com", -"mail2melody.com", -"mail2member.com", -"mail2memphis.com", -"mail2methodist.com", -"mail2mexican.com", -"mail2mexico.com", -"mail2mgz.com", -"mail2miami.com", -"mail2michael.com", -"mail2michelle.com", -"mail2michigan.com", -"mail2mike.com", -"mail2milan.com", -"mail2milano.com", -"mail2mildred.com", -"mail2milkyway.com", -"mail2millennium.com", -"mail2millionaire.com", -"mail2milton.com", -"mail2mime.com", -"mail2mindreader.com", -"mail2mini.com", -"mail2minister.com", -"mail2minneapolis.com", -"mail2minnesota.com", -"mail2miracle.com", -"mail2missionary.com", -"mail2mississippi.com", -"mail2missouri.com", -"mail2mitch.com", -"mail2model.com", -"mail2mom.com", -"mail2monaco.com", -"mail2money.com", -"mail2mongolia.com", -"mail2monica.com", -"mail2montana.com", -"mail2monty.com", -"mail2moon.com", -"mail2morocco.com", -"mail2morpheus.com", -"mail2mors.com", -"mail2moscow.com", -"mail2moslem.com", -"mail2mouseketeer.com", -"mail2movies.com", -"mail2mozambique.com", -"mail2mp3.com", -"mail2mrright.com", -"mail2msright.com", -"mail2museum.com", -"mail2music.com", -"mail2musician.com", -"mail2muslim.com", -"mail2my.com", -"mail2myboat.com", -"mail2mycar.com", -"mail2mycell.com", -"mail2mygsm.com", -"mail2mylaptop.com", -"mail2mymac.com", -"mail2mypager.com", -"mail2mypalm.com", -"mail2mypc.com", -"mail2myphone.com", -"mail2myplane.com", -"mail2namibia.com", -"mail2nancy.com", -"mail2nasdaq.com", -"mail2nathan.com", -"mail2nauru.com", -"mail2navy.com", -"mail2neal.com", -"mail2nebraska.com", -"mail2ned.com", -"mail2neil.com", -"mail2nelson.com", -"mail2nemesis.com", -"mail2nepal.com", -"mail2netherlands.com", -"mail2network.com", -"mail2nevada.com", -"mail2newhampshire.com", -"mail2newjersey.com", -"mail2newmexico.com", -"mail2newyork.com", -"mail2newzealand.com", -"mail2nicaragua.com", -"mail2nick.com", -"mail2nicole.com", -"mail2niger.com", -"mail2nigeria.com", -"mail2nike.com", -"mail2no.com", -"mail2noah.com", -"mail2noel.com", -"mail2noelle.com", -"mail2normal.com", -"mail2norman.com", -"mail2northamerica.com", -"mail2northcarolina.com", -"mail2northdakota.com", -"mail2northpole.com", -"mail2norway.com", -"mail2notus.com", -"mail2noway.com", -"mail2nowhere.com", -"mail2nuclear.com", -"mail2nun.com", -"mail2ny.com", -"mail2oasis.com", -"mail2oceanographer.com", -"mail2ohio.com", -"mail2ok.com", -"mail2oklahoma.com", -"mail2oliver.com", -"mail2oman.com", -"mail2one.com", -"mail2onfire.com", -"mail2online.com", -"mail2oops.com", -"mail2open.com", -"mail2ophthalmologist.com", -"mail2optometrist.com", -"mail2oregon.com", -"mail2oscars.com", -"mail2oslo.com", -"mail2painter.com", -"mail2pakistan.com", -"mail2pan.com", -"mail2panama.com", -"mail2paraguay.com", -"mail2paralegal.com", -"mail2paris.com", -"mail2park.com", -"mail2parker.com", -"mail2party.com", -"mail2passion.com", -"mail2pat.com", -"mail2patricia.com", -"mail2patrick.com", -"mail2patty.com", -"mail2paul.com", -"mail2paula.com", -"mail2pay.com", -"mail2peace.com", -"mail2pediatrician.com", -"mail2peggy.com", -"mail2pennsylvania.com", -"mail2perry.com", -"mail2persephone.com", -"mail2persian.com", -"mail2peru.com", -"mail2pete.com", -"mail2peter.com", -"mail2pharmacist.com", -"mail2phil.com", -"mail2philippines.com", -"mail2phoenix.com", -"mail2phonecall.com", -"mail2phyllis.com", -"mail2pickup.com", -"mail2pilot.com", -"mail2pisces.com", -"mail2planet.com", -"mail2platinum.com", -"mail2plato.com", -"mail2pluto.com", -"mail2pm.com", -"mail2podiatrist.com", -"mail2poet.com", -"mail2poland.com", -"mail2policeman.com", -"mail2policewoman.com", -"mail2politician.com", -"mail2pop.com", -"mail2pope.com", -"mail2popular.com", -"mail2portugal.com", -"mail2poseidon.com", -"mail2potatohead.com", -"mail2power.com", -"mail2presbyterian.com", -"mail2president.com", -"mail2priest.com", -"mail2prince.com", -"mail2princess.com", -"mail2producer.com", -"mail2professor.com", -"mail2protect.com", -"mail2psychiatrist.com", -"mail2psycho.com", -"mail2psychologist.com", -"mail2qatar.com", -"mail2queen.com", -"mail2rabbi.com", -"mail2race.com", -"mail2racer.com", -"mail2rachel.com", -"mail2rage.com", -"mail2rainmaker.com", -"mail2ralph.com", -"mail2randy.com", -"mail2rap.com", -"mail2rare.com", -"mail2rave.com", -"mail2ray.com", -"mail2raymond.com", -"mail2realtor.com", -"mail2rebecca.com", -"mail2recruiter.com", -"mail2recycle.com", -"mail2redhead.com", -"mail2reed.com", -"mail2reggie.com", -"mail2register.com", -"mail2rent.com", -"mail2republican.com", -"mail2resort.com", -"mail2rex.com", -"mail2rhodeisland.com", -"mail2rich.com", -"mail2richard.com", -"mail2ricky.com", -"mail2ride.com", -"mail2riley.com", -"mail2rita.com", -"mail2rob.com", -"mail2robert.com", -"mail2roberta.com", -"mail2robin.com", -"mail2rock.com", -"mail2rocker.com", -"mail2rod.com", -"mail2rodney.com", -"mail2romania.com", -"mail2rome.com", -"mail2ron.com", -"mail2ronald.com", -"mail2ronnie.com", -"mail2rose.com", -"mail2rosie.com", -"mail2roy.com", -"mail2rss.org", -"mail2rudy.com", -"mail2rugby.com", -"mail2runner.com", -"mail2russell.com", -"mail2russia.com", -"mail2russian.com", -"mail2rusty.com", -"mail2ruth.com", -"mail2rwanda.com", -"mail2ryan.com", -"mail2sa.com", -"mail2sabrina.com", -"mail2safe.com", -"mail2sagittarius.com", -"mail2sail.com", -"mail2sailor.com", -"mail2sal.com", -"mail2salaam.com", -"mail2sam.com", -"mail2samantha.com", -"mail2samoa.com", -"mail2samurai.com", -"mail2sandra.com", -"mail2sandy.com", -"mail2sanfrancisco.com", -"mail2sanmarino.com", -"mail2santa.com", -"mail2sara.com", -"mail2sarah.com", -"mail2sat.com", -"mail2saturn.com", -"mail2saudi.com", -"mail2saudiarabia.com", -"mail2save.com", -"mail2savings.com", -"mail2school.com", -"mail2scientist.com", -"mail2scorpio.com", -"mail2scott.com", -"mail2sean.com", -"mail2search.com", -"mail2seattle.com", -"mail2secretagent.com", -"mail2senate.com", -"mail2senegal.com", -"mail2sensual.com", -"mail2seth.com", -"mail2sevenseas.com", -"mail2sexy.com", -"mail2seychelles.com", -"mail2shane.com", -"mail2sharon.com", -"mail2shawn.com", -"mail2ship.com", -"mail2shirley.com", -"mail2shoot.com", -"mail2shuttle.com", -"mail2sierraleone.com", -"mail2simon.com", -"mail2singapore.com", -"mail2single.com", -"mail2site.com", -"mail2skater.com", -"mail2skier.com", -"mail2sky.com", -"mail2sleek.com", -"mail2slim.com", -"mail2slovakia.com", -"mail2slovenia.com", -"mail2smile.com", -"mail2smith.com", -"mail2smooth.com", -"mail2soccer.com", -"mail2soccerfan.com", -"mail2socialist.com", -"mail2soldier.com", -"mail2somalia.com", -"mail2son.com", -"mail2song.com", -"mail2sos.com", -"mail2sound.com", -"mail2southafrica.com", -"mail2southamerica.com", -"mail2southcarolina.com", -"mail2southdakota.com", -"mail2southkorea.com", -"mail2southpole.com", -"mail2spain.com", -"mail2spanish.com", -"mail2spectrum.com", -"mail2splash.com", -"mail2sponsor.com", -"mail2sports.com", -"mail2srilanka.com", -"mail2stacy.com", -"mail2stan.com", -"mail2stanley.com", -"mail2star.com", -"mail2state.com", -"mail2stephanie.com", -"mail2steve.com", -"mail2steven.com", -"mail2stewart.com", -"mail2stlouis.com", -"mail2stock.com", -"mail2stockholm.com", -"mail2stockmarket.com", -"mail2storage.com", -"mail2store.com", -"mail2strong.com", -"mail2student.com", -"mail2studio.com", -"mail2studio54.com", -"mail2stuntman.com", -"mail2subscribe.com", -"mail2sudan.com", -"mail2superstar.com", -"mail2surfer.com", -"mail2suriname.com", -"mail2susan.com", -"mail2suzie.com", -"mail2swaziland.com", -"mail2sweden.com", -"mail2sweetheart.com", -"mail2swim.com", -"mail2swimmer.com", -"mail2swiss.com", -"mail2switzerland.com", -"mail2sydney.com", -"mail2sylvia.com", -"mail2syria.com", -"mail2taboo.com", -"mail2taiwan.com", -"mail2tajikistan.com", -"mail2tammy.com", -"mail2tango.com", -"mail2tanya.com", -"mail2tanzania.com", -"mail2tara.com", -"mail2taurus.com", -"mail2taxi.com", -"mail2taxidermist.com", -"mail2taylor.com", -"mail2taz.com", -"mail2teacher.com", -"mail2technician.com", -"mail2ted.com", -"mail2telephone.com", -"mail2tenderness.com", -"mail2tennessee.com", -"mail2tennis.com", -"mail2tennisfan.com", -"mail2terri.com", -"mail2terry.com", -"mail2test.com", -"mail2texas.com", -"mail2thailand.com", -"mail2therapy.com", -"mail2think.com", -"mail2tickets.com", -"mail2tiffany.com", -"mail2tim.com", -"mail2time.com", -"mail2timothy.com", -"mail2tina.com", -"mail2titanic.com", -"mail2toby.com", -"mail2todd.com", -"mail2togo.com", -"mail2tom.com", -"mail2tommy.com", -"mail2tonga.com", -"mail2tony.com", -"mail2touch.com", -"mail2tourist.com", -"mail2tracey.com", -"mail2tracy.com", -"mail2tramp.com", -"mail2travel.com", -"mail2traveler.com", -"mail2travis.com", -"mail2trekkie.com", -"mail2trex.com", -"mail2triallawyer.com", -"mail2trick.com", -"mail2trillionaire.com", -"mail2troy.com", -"mail2truck.com", -"mail2trump.com", -"mail2try.com", -"mail2tunisia.com", -"mail2turbo.com", -"mail2turkey.com", -"mail2turkmenistan.com", -"mail2tv.com", -"mail2tycoon.com", -"mail2tyler.com", -"mail2u4me.com", -"mail2uae.com", -"mail2uganda.com", -"mail2uk.com", -"mail2ukraine.com", -"mail2uncle.com", -"mail2unsubscribe.com", -"mail2uptown.com", -"mail2uruguay.com", -"mail2usa.com", -"mail2utah.com", -"mail2uzbekistan.com", -"mail2v.com", -"mail2vacation.com", -"mail2valentines.com", -"mail2valerie.com", -"mail2valley.com", -"mail2vamoose.com", -"mail2vanessa.com", -"mail2vanuatu.com", -"mail2venezuela.com", -"mail2venous.com", -"mail2venus.com", -"mail2vermont.com", -"mail2vickie.com", -"mail2victor.com", -"mail2victoria.com", -"mail2vienna.com", -"mail2vietnam.com", -"mail2vince.com", -"mail2virginia.com", -"mail2virgo.com", -"mail2visionary.com", -"mail2vodka.com", -"mail2volleyball.com", -"mail2waiter.com", -"mail2wallstreet.com", -"mail2wally.com", -"mail2walter.com", -"mail2warren.com", -"mail2washington.com", -"mail2wave.com", -"mail2way.com", -"mail2waycool.com", -"mail2wayne.com", -"mail2webmaster.com", -"mail2webtop.com", -"mail2webtv.com", -"mail2weird.com", -"mail2wendell.com", -"mail2wendy.com", -"mail2westend.com", -"mail2westvirginia.com", -"mail2whether.com", -"mail2whip.com", -"mail2white.com", -"mail2whitehouse.com", -"mail2whitney.com", -"mail2why.com", -"mail2wilbur.com", -"mail2wild.com", -"mail2willard.com", -"mail2willie.com", -"mail2wine.com", -"mail2winner.com", -"mail2wired.com", -"mail2wisconsin.com", -"mail2woman.com", -"mail2wonder.com", -"mail2world.com", -"mail2worship.com", -"mail2wow.com", -"mail2www.com", -"mail2wyoming.com", -"mail2xfiles.com", -"mail2xox.com", -"mail2yachtclub.com", -"mail2yahalla.com", -"mail2yemen.com", -"mail2yes.com", -"mail2yugoslavia.com", -"mail2zack.com", -"mail2zambia.com", -"mail2zenith.com", -"mail2zephir.com", -"mail2zeus.com", -"mail2zipper.com", -"mail2zoo.com", -"mail2zoologist.com", -"mail2zurich.com", -"mail3000.com", -"mail4trash.com", -"mail4u.info", -"mailandftp.com", -"mailas.com", -"mailasia.com", -"mailbolt.com", -"mailboom.com", -"mailbox.as", -"mailbox.co.za", -"mailbox.gr", -"mailbox.hu", -"mailc.net", -"mailcan.com", -"mailcat.biz", -"mailcc.com", -"mailcity.com", -"mailclub.fr", -"maildx.com", -"mailed.ro", -"mailexcite.com", -"mailfa.tk", -"mailforce.net", -"mailforspam.com", -"mailfs.com", -"mailftp.com", -"mailgenie.net", -"mailguard.me", -"mailhaven.com", -"mailhood.com", -"mailimate.com", -"mailinatar.com", -"mailinator.org", -"mailinblack.com", -"mailingaddress.org", -"mailingweb.com", -"mailisent.com", -"mailismagic.com", -"mailite.com", -"mailmate.com", -"mailme.dk", -"mailme.gq", -"mailme24.com", -"mailmight.com", -"mailnator.com", -"mailnew.com", -"mailoye.com", -"mailpanda.com", -"mailpick.biz", -"mailpost.zzn.com", -"mailpride.com", -"mailproxsy.com", -"mailpuppy.com", -"mailquack.com", -"mailrock.biz", -"mailroom.com", -"mailru.com", -"mailsac.com", -"mailsent.net", -"mailservice.ms", -"mailshuttle.com", -"mailslapping.com", -"mailstart.com", -"mailstartplus.com", -"mailsurf.com", -"mailtag.com", -"mailtemp.info", -"mailtothis.com", -"mailueberfall.de", -"mailup.net", -"mailwire.com", -"mailworks.org", -"mailzi.ru", -"mailzilla.org", -"malayalamtelevision.net", -"maltesemail.com", -"mamber.net", -"manager.de", -"mancity.net", -"mantramail.com", -"manybrain.com", -"marchmail.com", -"mariahc.com", -"marijuana.com", -"marijuana.nl", -"married-not.com", -"martindalemail.com", -"masrawy.com", -"matmail.com", -"mauimail.com", -"mauritius.com", -"maxmail.co.uk", -"mbox.com.au", -"me.com", -"meta.ua", -"medical.net.au", -"medscape.com", -"meetingmall.com", -"megapoint.com", -"mehrani.com", -"mehtaweb.com", -"meine-dateien.info", -"meine-diashow.de", -"meine-fotos.info", -"meine-urlaubsfotos.de", -"mekhong.com", -"merda.flu.cc", -"merda.igg.biz", -"merda.nut.cc", -"merda.usa.cc", -"message.hu", -"messages.to", -"metacrawler.com", -"metalfan.com", -"metta.lk", -"mexicomail.com", -"mezimages.net", -"mfsa.ru", -"mierdamail.com", -"miesto.sk", -"mighty.co.za", -"migmail.net", -"migmail.pl", -"miho-nakayama.com", -"mikrotamanet.com", -"millionaireintraining.com", -"millionairemail.com", -"milmail.com", -"mindless.com", -"mindspring.com", -"minister.com", -"misery.net", -"mittalweb.com", -"mixmail.com", -"mjfrogmail.com", -"ml1.net", -"mm.st", -"mns.ru", -"moakt.com", -"mobileninja.co.uk", -"mochamail.com", -"mohammed.com", -"mohmal.com", -"moldova.cc", -"moldova.com", -"moldovacc.com", -"momslife.com", -"monemail.com", -"money.net", -"montevideo.com.uy", -"monumentmail.com", -"moose-mail.com", -"mor19.uu.gl", -"mortaza.com", -"moscowmail.com", -"mostlysunny.com", -"motormania.com", -"movemail.com", -"movieluver.com", -"mox.pp.ua", -"mp4.it", -"mr-potatohead.com", -"msgbox.com", -"msn.cn", -"msn.com", -"msn.nl", -"mt2015.com", -"mt2016.com", -"mttestdriver.com", -"muehlacker.tk", -"munich.com", -"music.com", -"musician.org", -"musicscene.org", -"muskelshirt.de", -"muslim.com", -"muslimsonline.com", -"mutantweb.com", -"mvrht.com", -"my.com", -"my10minutemail.com", -"mybox.it", -"mycity.com", -"mydomain.com", -"mydotcomaddress.com", -"myfamily.com", -"myfastmail.com", -"mygo.com", -"myiris.com", -"mymacmail.com", -"mynamedot.com", -"mynet.com", -"mynetstore.de", -"myownemail.com", -"mypacks.net", -"mypad.com", -"myplace.com", -"myrambler.ru", -"myrealbox.com", -"myremarq.com", -"myself.com", -"myspamless.com", -"mystupidjob.com", -"mytemp.email", -"mythirdage.com", -"myway.com", -"myworldmail.com", -"n2.com", -"n2baseball.com", -"n2mail.com", -"n2soccer.com", -"n2software.com", -"nabc.biz", -"nafe.com", -"nakedgreens.com", -"name.com", -"naplesnews.net", -"naseej.com", -"nativeweb.net", -"naui.net", -"naver.com", -"navigator.lv", -"navy.org", -"naz.com", -"nchoicemail.com", -"neeva.net", -"nenter.com", -"neo.rr.com", -"nervhq.org", -"net-c.be", -"net-c.ca", -"net-c.cat", -"net-c.com", -"net-c.es", -"net-c.fr", -"net-c.it", -"net-c.lu", -"net-c.nl", -"net-c.pl", -"net-pager.net", -"net-shopping.com", -"net4b.pt", -"net4you.at", -"netbounce.com", -"netbroadcaster.com", -"netby.dk", -"netc.eu", -"netc.fr", -"netc.it", -"netc.lu", -"netc.pl", -"netcenter-vn.net", -"netcmail.com", -"netcourrier.com", -"netexecutive.com", -"netexpressway.com", -"netgenie.com", -"netian.com", -"netizen.com.ar", -"netmongol.com", -"netnoir.net", -"netpiper.com", -"netralink.com", -"netscape.net", -"netspace.net.au", -"netster.com", -"nettaxi.com", -"nettemail.com", -"netterchef.de", -"netzero.com", -"netzero.net", -"neue-dateien.de", -"neuf.fr", -"neuro.md", -"newmail.com", -"newmail.net", -"newmail.ru", -"newsboysmail.com", -"newyork.com", -"nextmail.ru", -"nexxmail.com", -"nfmail.com", -"nicebush.com", -"nicegal.com", -"nicholastse.net", -"nicolastse.com", -"nikopage.com", -"nimail.com", -"ninfan.com", -"nirvanafan.com", -"nmail.cf", -"noavar.com", -"nonpartisan.com", -"nonspam.eu", -"nonspammer.de", -"norika-fujiwara.com", -"norikomail.com", -"northgates.net", -"nowhere.org", -"ntlhelp.net", -"ntscan.com", -"null.net", -"nullbox.info", -"nur-fuer-spam.de", -"nus.edu.sg", -"nwldx.com", -"nxt.ru", -"ny.com", -"nybella.com", -"nyc.com", -"nycmail.com", -"nzoomail.com", -"o-tay.com", -"o2.co.uk", -"oaklandas-fan.com", -"oath.com", -"oceanfree.net", -"oddpost.com", -"odmail.com", -"office-dateien.de", -"office-email.com", -"offroadwarrior.com", -"oicexchange.com", -"oikrach.com", -"okbank.com", -"okhuman.com", -"okmagic.com", -"oldies104mail.com", -"olemail.com", -"olympist.net", -"olypmall.ru", -"omaninfo.com", -"omen.ru", -"onebox.com", -"onenet.com.ar", -"oneoffmail.com", -"onet.com.pl", -"onet.eu", -"onet.pl", -"oninet.pt", -"online.ie", -"online.ms", -"online.nl", -"onlinewiz.com", -"onmilwaukee.com", -"onobox.com", -"op.pl", -"opayq.com", -"openmailbox.org", -"operafan.com", -"operamail.com", -"opoczta.pl", -"optician.com", -"optonline.net", -"optusnet.com.au", -"orange.fr", -"orbitel.bg", -"orgmail.net", -"orthodontist.net", -"osite.com.br", -"oso.com", -"otakumail.com", -"our-computer.com", -"our-office.com", -"our.st", -"ourbrisbane.com", -"ournet.md", -"outgun.com", -"outlook.at", -"outlook.be", -"outlook.cl", -"outlook.co.id", -"outlook.co.il", -"outlook.co.nz", -"outlook.co.th", -"outlook.com", -"outlook.com.au", -"outlook.com.br", -"outlook.com.gr", -"outlook.com.pe", -"outlook.com.tr", -"outlook.com.vn", -"outlook.cz", -"outlook.de", -"outlook.dk", -"outlook.es", -"outlook.fr", -"outlook.hu", -"outlook.ie", -"outlook.in", -"outlook.it", -"outlook.jp", -"outlook.kr", -"outlook.lv", -"outlook.my", -"outlook.ph", -"outlook.pt", -"outlook.sa", -"outlook.sg", -"outlook.sk", -"over-the-rainbow.com", -"ownmail.net", -"ozbytes.net.au", -"ozemail.com.au", -"pacbell.net", -"pacific-ocean.com", -"pacific-re.com", -"pacificwest.com", -"pagina.de", -"pagons.org", -"pakistanmail.com", -"pakistanoye.com", -"parkjiyoon.com", -"parrot.com", -"parsmail.com", -"partlycloudy.com", -"partybombe.de", -"partyheld.de", -"partynight.at", -"passwordmail.com", -"pathfindermail.com", -"pcusers.otherinbox.com", -"pediatrician.com", -"penpen.com", -"peoplepc.com", -"peopleweb.com", -"pepbot.com", -"perfectmail.com", -"perso.be", -"personal.ro", -"personales.com", -"petlover.com", -"petml.com", -"pettypool.com", -"pezeshkpour.com", -"pfui.ru", -"phayze.com", -"phone.net", -"photographer.net", -"phpbb.uu.gl", -"phreaker.net", -"physicist.net", -"pianomail.com", -"pickupman.com", -"picusnet.com", -"pigpig.net", -"pinoymail.com", -"piracha.net", -"pisem.net", -"pjjkp.com", -"planet.nl", -"planetaccess.com", -"planetarymotion.net", -"planetearthinter.net", -"planetmail.com", -"planetmail.net", -"planetout.com", -"playersodds.com", -"playful.com", -"plus.com", -"plusmail.com.br", -"pmail.net", -"pobox.sk", -"pochta.ru", -"poczta.fm", -"poczta.onet.pl", -"poetic.com", -"pokemail.net", -"pokemonpost.com", -"pokepost.com", -"polandmail.com", -"polbox.com", -"politician.com", -"polizisten-duzer.de", -"poond.com", -"popaccount.com", -"popmail.com", -"popsmail.com", -"popstar.com", -"portugalmail.com", -"portugalmail.pt", -"post.com", -"post.cz", -"post.sk", -"posta.ro", -"postaccesslite.com", -"postafree.com", -"postfach.cc", -"postinbox.com", -"postino.ch", -"postmark.net", -"postmaster.co.uk", -"postpro.net", -"powerfan.com", -"praize.com", -"premiumservice.com", -"presidency.com", -"priest.com", -"primposta.com", -"primposta.hu", -"privy-mail.com", -"privymail.de", -"pro.hu", -"probemail.com", -"prodigy.net", -"progetplus.it", -"programist.ru", -"programmer.net", -"proinbox.com", -"promessage.com", -"prontomail.com", -"protestant.com", -"protonmail.com", -"prydirect.info", -"psv-supporter.com", -"ptd.net", -"public-files.de", -"public.usa.com", -"publicist.com", -"pulp-fiction.com", -"purpleturtle.com", -"put2.net", -"pwrby.com", -"q.com", -"qmail.com", -"qprfans.com", -"qq.com", -"quackquack.com", -"quakemail.com", -"qualityservice.com", -"quantentunnel.de", -"quickhosts.com", -"quickmail.nl", -"quicknet.nl", -"quickwebmail.com", -"quiklinks.com", -"quikmail.com", -"qv7.info", -"qwest.net", -"qwestoffice.net", -"racedriver.com", -"racefanz.com", -"racingmail.com", -"radicalz.com", -"radiku.ye.vc", -"radiologist.net", -"ragingbull.com", -"ralib.com", -"rambler.ru", -"rambler.ua", -"ranmamail.com", -"rastogi.net", -"ratt-n-roll.com", -"rattle-snake.com", -"raubtierbaendiger.de", -"ravearena.com", -"ravemail.com", -"realemail.net", -"reality-concept.club", -"reallyfast.biz", -"reallyfast.info", -"reallymymail.com", -"realtyagent.com", -"reborn.com", -"reconmail.com", -"recycler.com", -"recyclermail.com", -"rediff.com", -"rediffmail.com", -"rediffmailpro.com", -"rednecks.com", -"redseven.de", -"reggaefan.com", -"registerednurses.com", -"regspaces.tk", -"reincarnate.com", -"religious.com", -"remail.ga", -"renren.com", -"repairman.com", -"reply.hu", -"representative.com", -"rescueteam.com", -"resgedvgfed.tk", -"resumemail.com", -"rezai.com", -"rhyta.com", -"richmondhill.com", -"rickymail.com", -"rin.ru", -"riopreto.com.br", -"rn.com", -"ro.ru", -"roadrunner.com", -"roanokemail.com", -"rock.com", -"rocketmail.com", -"rocketship.com", -"rockfan.com", -"rodrun.com", -"rogers.com", -"roosh.com", -"rootprompt.org", -"royal.net", -"rr.com", -"rrohio.com", -"rsub.com", -"runbox.com", -"rushpost.com", -"ruttolibero.com", -"rvshop.com", -"s-mail.com", -"sacbeemail.com", -"saeuferleber.de", -"safrica.com", -"sagra.lu", -"sags-per-mail.de", -"sailormoon.com", -"saintly.com", -"salehi.net", -"salesperson.net", -"samerica.com", -"samilan.net", -"sammimail.com", -"sandelf.de", -"sanfranmail.com", -"sanook.com", -"sapo.pt", -"saudia.com", -"sayhi.net", -"sbcglobal.net", -"scandalmail.com", -"scarlet.nl", -"schafmail.de", -"schizo.com", -"schmusemail.de", -"schoolmail.com", -"schoolsucks.com", -"schreib-doch-mal-wieder.de", -"sci.fi", -"scientist.com", -"scotland.com", -"scotlandmail.com", -"scottishmail.co.uk", -"scubadiving.com", -"seanet.com", -"search.ua", -"searchwales.com", -"sebil.com", -"secret-police.com", -"secretary.net", -"secretservices.net", -"secure-mail.biz", -"secure-mail.cc", -"seductive.com", -"seekstoyboy.com", -"seguros.com.br", -"selfdestructingmail.com", -"send.hu", -"sendme.cz", -"sendspamhere.com", -"sent.as", -"sent.at", -"sent.com", -"sentrismail.com", -"serga.com.ar", -"servemymail.com", -"servermaps.net", -"sesmail.com", -"sexmagnet.com", -"seznam.cz", -"sfr.fr", -"shaniastuff.com", -"shared-files.de", -"sharedmailbox.org", -"sharmaweb.com", -"she.com", -"shieldedmail.com", -"shinedyoureyes.com", -"shitaway.cf", -"shitaway.ga", -"shitaway.gq", -"shitaway.ml", -"shitaway.tk", -"shitaway.usa.cc", -"shitmail.de", -"shitmail.org", -"shitware.nl", -"shortmail.com", -"shotgun.hu", -"showslow.de", -"sialkotcity.com", -"sialkotian.com", -"sialkotoye.com", -"sify.com", -"silkroad.net", -"sina.cn", -"sina.com", -"singles4jesus.com", -"singmail.com", -"singnet.com.sg", -"singpost.com", -"sinnlos-mail.de", -"siteposter.net", -"skafan.com", -"skeefmail.com", -"skim.com", -"skizo.hu", -"skrx.tk", -"sky.com", -"slamdunkfan.com", -"slave-auctions.net", -"slingshot.com", -"slippery.email", -"slipry.net", -"slotter.com", -"smap.4nmv.ru", -"smapxsmap.net", -"smashmail.de", -"smoothmail.com", -"sms.at", -"snail-mail.net", -"snakebite.com", -"snet.net", -"sniper.hu", -"snkmail.com", -"snoopymail.com", -"snowboarding.com", -"snowdonia.net", -"socceramerica.net", -"soccermail.com", -"soccermomz.com", -"social-mailer.tk", -"socialworker.net", -"sociologist.com", -"sofort-mail.de", -"sofortmail.de", -"softhome.net", -"sogou.com", -"sohu.com", -"sol.dk", -"solcon.nl", -"soldier.hu", -"solution4u.com", -"solvemail.info", -"songwriter.net", -"sonnenkinder.org", -"soodomail.com", -"soon.com", -"soulfoodcookbook.com", -"sp.nl", -"space-bank.com", -"space-man.com", -"space-ship.com", -"space-travel.com", -"space.com", -"spacemart.com", -"spacewar.com", -"spainmail.com", -"spam.2012-2016.ru", -"spamavert.com", -"spambob.com", -"spambooger.com", -"spamdecoy.net", -"spameater.com", -"spamfree24.info", -"spaminator.de", -"spaml.com", -"spamoff.de", -"spartapiet.com", -"speedemail.net", -"speedpost.net", -"speedrules.com", -"speedrulz.com", -"speedymail.org", -"sperke.net", -"spils.com", -"spinfinder.com", -"spl.at", -"spoko.pl", -"spoofmail.de", -"sportsmail.com", -"sporttruckdriver.com", -"spray.se", -"spybox.de", -"spymac.com", -"srilankan.net", -"ssl-mail.com", -"st-davids.net", -"stade.fr", -"stargateradio.com", -"starmail.com", -"starmedia.com", -"starspath.com", -"start.com.au", -"startkeys.com", -"stinkefinger.net", -"stipte.nl", -"stoned.com", -"stones.com", -"stop-my-spam.pp.ua", -"streber24.de", -"streetwisemail.com", -"strompost.com", -"strongguy.com", -"student.su", -"studentcenter.org", -"stuffmail.de", -"subram.com", -"sudolife.me", -"sudolife.net", -"sudomail.biz", -"sudomail.com", -"sudomail.net", -"sudoverse.com", -"sudoverse.net", -"sudoweb.net", -"sudoworld.com", -"sudoworld.net", -"suhabi.com", -"sukhumvit.net", -"sunpoint.net", -"sunrise-sunset.com", -"sunsgame.com", -"sunumail.sn", -"superdada.com", -"supereva.it", -"supermail.ru", -"superrito.com", -"surf3.net", -"surfree.com", -"surfy.net", -"surgical.net", -"surimail.com", -"survivormail.com", -"svk.jp", -"swbell.net", -"sweb.cz", -"swedenmail.com", -"sweetxxx.de", -"swift-mail.com", -"swiftdesk.com", -"swingeasyhithard.com", -"swingfan.com", -"swipermail.zzn.com", -"swirve.com", -"swissmail.com", -"swissmail.net", -"switchboardmail.com", -"sx172.com", -"syom.com", -"t-online.de", -"t.psh.me", -"t2mail.com", -"tafmail.com", -"takuyakimura.com", -"talk21.com", -"talkinator.com", -"tamil.com", -"tampabay.rr.com", -"tankpolice.com", -"tatanova.com", -"tbwt.com", -"tds.net", -"teachermail.net", -"teachers.org", -"teamdiscovery.com", -"teamtulsa.net", -"tech-center.com", -"tech4peace.org", -"techemail.com", -"techie.com", -"technisamail.co.za", -"technologist.com", -"techscout.com", -"techspot.com", -"tele2.at", -"tele2.nl", -"teleline.es", -"telerymd.com", -"teleworm.us", -"telfort.nl", -"telfortglasvezel.nl", -"telinco.net", -"telpage.net", -"telstra.com", -"telstra.com.au", -"temp-mail.com", -"temp-mail.de", -"temp.headstrong.de", -"tempail.com", -"tempemail.biz", -"tempmail.us", -"tempmaildemo.com", -"tempmailer.com", -"temporarioemail.com.br", -"temporaryemail.us", -"tempthe.net", -"tempymail.com", -"temtulsa.net", -"tenchiclub.com", -"tenderkiss.com", -"tennismail.com", -"terminverpennt.de", -"terra.cl", -"terra.com", -"terra.com.ar", -"terra.com.br", -"test.com", -"test.de", -"tfanus.com.er", -"tfz.net", -"thai.com", -"thaimail.com", -"thaimail.net", -"thanksnospam.info", -"the-african.com", -"the-aliens.com", -"the-american.com", -"the-animal.com", -"the-astronaut.com", -"the-beauty.com", -"the-big-apple.com", -"the-boss.com", -"the-captain.com", -"the-cowboy.com", -"the-eagles.com", -"the-fastest.net", -"the-galaxy.net", -"the-genius.com", -"the-gentleman.com", -"the-german.com", -"the-italian.com", -"the-lair.com", -"the-madman.com", -"the-marine.com", -"the-master.com", -"the-mexican.com", -"the-monkey.com", -"the-pentagon.com", -"the-professional.com", -"the-quickest.com", -"the-russian.com", -"the-spaceman.com", -"thecriminals.com", -"thedoghousemail.com", -"thedorm.com", -"theend.hu", -"theglobe.com", -"thegolfcourse.com", -"theheadoffice.com", -"theinternetemail.com", -"thelanddownunder.com", -"themail.com", -"themillionare.net", -"theplate.com", -"thepokerface.com", -"thepostmaster.net", -"theraces.com", -"therapist.net", -"thestreetfighter.com", -"thewatercooler.com", -"thewebpros.co.uk", -"thirdage.com", -"thisgirl.com", -"thraml.com", -"throwam.com", -"tidni.com", -"tiscali.co.uk", -"tiscali.it", -"tkcity.com", -"tmail.ws", -"toast.com", -"toke.com", -"tom.com", -"toolsource.com", -"toomail.biz", -"toothfairy.com", -"topletter.com", -"topmail-files.de", -"torontomail.com", -"tortenboxer.de", -"totalmail.de", -"totalmusic.net", -"tpg.com.au", -"trash-mail.ml", -"trashdevil.de", -"trashymail.net", -"trayna.com", -"trialbytrivia.com", -"trickmail.net", -"trimix.cn", -"tritium.net", -"trmailbox.com", -"tropicalstorm.com", -"truckracer.com", -"truckracers.com", -"truthmail.com", -"tsamail.co.za", -"ttml.co.in", -"turboprinz.de", -"turboprinzessin.de", -"turkey.com", -"tut.by", -"tvstar.com", -"twc.com", -"twinstarsmail.com", -"typemail.com", -"u2club.com", -"ua.fm", -"ubbi.com", -"uboot.com", -"uk2.net", -"uk2k.com", -"uk2net.com", -"uk7.net", -"uk8.net", -"ukbuilder.com", -"ukcool.com", -"ukdreamcast.com", -"ukmail.org", -"ukmax.com", -"ukr.net", -"uku.co.uk", -"ultapulta.com", -"ultrapostman.com", -"ummah.org", -"umpire.com", -"unbounded.com", -"unforgettable.com", -"uni.de", -"unican.es", -"unihome.com", -"universal.pt", -"uno.ee", -"uno.it", -"unofree.it", -"unterderbruecke.de", -"uol.com.br", -"uol.com.co", -"uol.com.ve", -"uomail.com", -"upc.nl", -"upcmail.nl", -"upf.org", -"uplipht.com", -"ureach.com", -"uroid.com", -"usa.com", -"usa.net", -"usaaccess.net", -"usermail.com", -"username.e4ward.com", -"usma.net", -"usmc.net", -"uswestmail.net", -"utanet.at", -"uymail.com", -"uyuyuy.com", -"vaasfc4.tk", -"vahoo.com", -"valemail.net", -"vampirehunter.com", -"varbizmail.com", -"vcmail.com", -"velnet.co.uk", -"velocall.com", -"verizon.net", -"verlass-mich-nicht.de", -"versatel.nl", -"veryfast.biz", -"veryrealemail.com", -"veryspeedy.net", -"vfemail.net", -"vickaentb.tk", -"videotron.ca", -"viditag.com", -"vinbazar.com", -"violinmakers.co.uk", -"vip.126.com", -"vip.163.com", -"vip.21cn.com", -"vip.citiz.net", -"vip.gr", -"vip.onet.pl", -"vip.qq.com", -"vip.sina.com", -"vipmail.ru", -"virgilio.it", -"virgin.net", -"virginbroadband.com.au", -"visitweb.com", -"visto.com", -"vivavelocity.com", -"vivianhsu.net", -"vkcode.ru", -"vnet.citiz.net", -"vnn.vn", -"vodafone.nl", -"vodafonethuis.nl", -"volcanomail.com", -"vollbio.de", -"volloeko.de", -"vomoto.com", -"vorsicht-bissig.de", -"vorsicht-scharf.de", -"vote-democrats.com", -"vote-republicans.com", -"vote4gop.org", -"votenet.com", -"vp.pl", -"vr9.com", -"vubby.com", -"w3.to", -"wahoye.com", -"walala.org", -"wales2000.net", -"walkmail.net", -"walkmail.ru", -"wam.co.za", -"wanadoo.es", -"wanadoo.fr", -"war-im-urlaub.de", -"warmmail.com", -"warpmail.net", -"warrior.hu", -"wazabi.club", -"wbdet.com", -"web-contact.info", -"web-emailbox.eu", -"web-mail.com.ar", -"web-mail.pp.ua", -"web-police.com", -"web.de", -"webave.com", -"webcity.ca", -"webcontact-france.eu", -"webdream.com", -"webindia123.com", -"webmail.co.za", -"webmail.hu", -"webmails.com", -"webname.com", -"webstation.com", -"websurfer.co.za", -"webtopmail.com", -"wee.my", -"weekonline.com", -"wefjo.grn.cc", -"weg-werf-email.de", -"wegas.ru", -"wegwerf-emails.de", -"wegwerfmail.info", -"wegwerpmailadres.nl", -"wehshee.com", -"weibsvolk.de", -"weibsvolk.org", -"weinenvorglueck.de", -"welsh-lady.com", -"westnet.com.au", -"wfgdfhj.tk", -"whale-mail.com", -"whartontx.com", -"whatiaas.com", -"whatpaas.com", -"wheelweb.com", -"whipmail.com", -"whoever.com", -"whtjddn.33mail.com", -"wickmail.net", -"wideopenwest.com", -"wildmail.com", -"wilemail.com", -"will-hier-weg.de", -"windowslive.com", -"windstream.net", -"wingnutz.com", -"winning.com", -"wir-haben-nachwuchs.de", -"wir-sind-cool.org", -"witty.com", -"wiz.cc", -"wkbwmail.com", -"wmail.cf", -"wo.com.cn", -"woh.rr.com", -"wolke7.net", -"wombles.com", -"women-at-work.org", -"wongfaye.com", -"wooow.it", -"worker.com", -"workmail.com", -"worldemail.com", -"worldnet.att.net", -"wormseo.cn", -"wosaddict.com", -"wowgirl.com", -"wowmail.com", -"wowway.com", -"wp.pl", -"wptamail.com", -"wrexham.net", -"writeme.com", -"writemeback.com", -"wrongmail.com", -"www.com", -"www.e4ward.com", -"wxs.net", -"x-mail.net", -"x-networks.net", -"x5g.com", -"xaker.ru", -"xing886.uu.gl", -"xmastime.com", -"xms.nl", -"xoom.com", -"xpressmail.zzn.com", -"xs4all.nl", -"xsecurity.org", -"xsmail.com", -"xtra.co.nz", -"xuno.com", -"xww.ro", -"xy9ce.tk", -"y7mail.com", -"ya.ru", -"yada-yada.com", -"yahoo.at", -"yahoo.be", -"yahoo.ca", -"yahoo.cn", -"yahoo.co.id", -"yahoo.co.il", -"yahoo.co.in", -"yahoo.co.jp", -"yahoo.co.kr", -"yahoo.co.nz", -"yahoo.co.th", -"yahoo.co.uk", -"yahoo.co.za", -"yahoo.com", -"yahoo.com.ar", -"yahoo.com.au", -"yahoo.com.br", -"yahoo.com.cn", -"yahoo.com.co", -"yahoo.com.hk", -"yahoo.com.mx", -"yahoo.com.my", -"yahoo.com.ph", -"yahoo.com.sg", -"yahoo.com.tr", -"yahoo.com.tw", -"yahoo.com.vn", -"yahoo.cz", -"yahoo.de", -"yahoo.dk", -"yahoo.es", -"yahoo.fi", -"yahoo.fr", -"yahoo.gr", -"yahoo.hu", -"yahoo.ie", -"yahoo.in", -"yahoo.it", -"yahoo.jp", -"yahoo.nl", -"yahoo.no", -"yahoo.pl", -"yahoo.pt", -"yahoo.ro", -"yahoo.se", -"yalla.com", -"yalla.com.lb", -"yalook.com", -"yam.com", -"yandex.com", -"yandex.ru", -"yandex.ua", -"yapped.net", -"yawmail.com", -"yeah.net", -"yebox.com", -"yehey.com", -"yepmail.net", -"yert.ye.vc", -"yesey.net", -"ymail.com", -"yogotemail.com", -"yomail.info", -"yopmail.pp.ua", -"yopolis.com", -"yopweb.com", -"youareadork.com", -"youmailr.com", -"your-house.com", -"your-mail.com", -"yourname.freeservers.com", -"yours.com", -"yoursubdomain.zzn.com", -"yourteacher.net", -"yuuhuu.net", -"yyhmail.com", -"z1p.biz", -"za.com", -"zahadum.com", -"zaktouni.fr", -"zeepost.nl", -"zetmail.com", -"zhaowei.net", -"zhouemail.510520.org", -"ziggo.nl", -"zionweb.org", -"zip.net", -"zipido.com", -"ziplip.com", -"zipmail.com", -"zipmail.com.br", -"zipmax.com", -"zmail.ru", -"zoho.com", -"zomg.info", -"zonnet.nl", -"zoominternet.net", -"zubee.com", -"zuzzurello.com", -"zwallet.com", -"zweb.in", -"zxcvbnm.com", -"zybermail.com", -"zydecofan.com", -"zzn.com", -"zzz.com"} diff --git a/resources/config/spamfilter/maps/mime_types.map b/resources/config/spamfilter/maps/mime_types.map deleted file mode 100644 index 917c12b8..00000000 --- a/resources/config/spamfilter/maps/mime_types.map +++ /dev/null @@ -1,133 +0,0 @@ -spam-mime = { -"bat" = "BAD", -"chm" = "BAD", -"com" = "BAD", -"exe" = "BAD", -"hta" = "BAD|NZ", -"iso" = "BAD", -"jar" = "BAD|NZ", -"lnk" = "BAD", -"scr" = "BAD", -"htm" = "text/html|BAD", -"html" = "text/html|BAD", -"shtm" = "text/html|BAD", -"shtml" = "text/html|BAD", -"ace" = "BAD|AR", -"arj" = "BAD|AR", -"asx" = "BAD", -"cab" = "BAD|AR", -"sfx" = "BAD", -"vst" = "BAD", -"vss" = "BAD", -"ade" = "BAD", -"adp" = "BAD", -"cmd" = "BAD", -"cpl" = "BAD", -"ins" = "BAD", -"isp" = "BAD", -"js" = "BAD|NZ", -"jse" = "BAD", -"lib" = "BAD", -"mde" = "BAD", -"msc" = "BAD", -"msi" = "BAD", -"msp" = "BAD", -"mst" = "BAD", -"nsh" = "BAD", -"pif" = "BAD", -"sct" = "BAD", -"shb" = "BAD", -"sys" = "BAD", -"vb" = "BAD", -"vbe" = "BAD", -"vbs" = "BAD|NZ", -"vxd" = "BAD", -"wsc" = "BAD", -"wsh" = "BAD", -"app" = "BAD", -"asp" = "BAD", -"bas" = "BAD", -"cnt" = "BAD", -"csh" = "BAD", -"diagcab" = "BAD", -"fxp" = "BAD", -"gadget" = "BAD", -"grp" = "BAD", -"hlp" = "BAD", -"hpj" = "BAD", -"inf" = "BAD", -"its" = "BAD", -"jnlp" = "BAD", -"ksh" = "BAD", -"mad" = "BAD", -"maf" = "BAD", -"mag" = "BAD", -"mam" = "BAD", -"maq" = "BAD", -"mar" = "BAD", -"mas" = "BAD", -"mat" = "BAD", -"mau" = "BAD", -"mav" = "BAD", -"maw" = "BAD", -"mcf" = "BAD", -"mda" = "BAD", -"mdb" = "BAD", -"mdt" = "BAD", -"mdw" = "BAD", -"mdz" = "BAD", -"msh" = "BAD", -"msh1" = "BAD", -"msh2" = "BAD", -"mshxml" = "BAD", -"msh1xml" = "BAD", -"msh2xml" = "BAD", -"msu" = "BAD", -"ops" = "BAD", -"osd" = "BAD", -"pcd" = "BAD", -"pl" = "BAD", -"plg" = "BAD", -"prf" = "BAD", -"prg" = "BAD", -"printerexport" = "BAD", -"ps1" = "BAD", -"ps1xml" = "BAD", -"ps2" = "BAD", -"ps2xml" = "BAD", -"psc1" = "BAD", -"psc2" = "BAD", -"psd1" = "BAD", -"psdm1" = "BAD", -"pst" = "BAD", -"reg" = "BAD", -"scf" = "BAD", -"shs" = "BAD", -"theme" = "BAD", -"url" = "BAD", -"vbp" = "BAD", -"vsmacros" = "BAD", -"vsw" = "BAD", -"webpnp" = "BAD", -"website" = "BAD", -"ws" = "BAD", -"xbap" = "BAD", -"xll" = "BAD", -"xnk" = "BAD", -"docx" = "NZ", -"docm" = "BAD", -"pptm" = "BAD", -"xlsm" = "BAD", -"pdf" = "application/pdf|application/x-pdf|NZ", -"pptx" = "NZ", -"wsf" = "NZ", -"xlsx" = "NZ", -"7x" = "AR", -"alz" = "AR", -"bz2" = "AR", -"egg" = "AR", -"lz" = "AR", -"rar" = "AR", -"xz" = "AR", -"zip" = "AR", -"txt" = "text/plain|message/disposition-notification|text/rfc822-headers"} diff --git a/resources/config/spamfilter/maps/scores.map b/resources/config/spamfilter/maps/scores.map deleted file mode 100644 index 8b5c55b8..00000000 --- a/resources/config/spamfilter/maps/scores.map +++ /dev/null @@ -1,376 +0,0 @@ -spam-scores = {"ABUSE_SURBL" = "5.0", -"ALLOWLIST_DKIM" = "-1.0", -"ALLOWLIST_DMARC" = "-7.0", -"ALLOWLIST_SPF" = "-1.0", -"ALLOWLIST_SPF_DKIM" = "-3.0", -"ARC_ALLOW" = "-1.0", -"ARC_DNSFAIL" = "0.0", -"ARC_INVALID" = "0.5", -"ARC_NA" = "0.0", -"ARC_REJECT" = "1.0", -"ARC_SIGNED" = "0.0", -"AUTH_NA" = "1.0", -"AUTH_NA_OR_FAIL" = "1.0", -"AUTOGEN_PHP_SPAMMY" = "1.0", -"BAYES_HAM" = "-3.0", -"BAYES_SPAM" = "5.1", -"BLOCKLIST_DKIM" = "2.0", -"BLOCKLIST_DMARC" = "6.0", -"BLOCKLIST_SPF" = "1.0", -"BLOCKLIST_SPF_DKIM" = "3.0", -"BODY_URI_ONLY" = "2.0", -"BOGUS_ENCRYPTED_AND_TEXT" = "10.0", -"BOUNCE" = "-0.1", -"BOUNCE_NO_AUTH" = "1.0", -"BROKEN_CONTENT_TYPE" = "1.5", -"COMPROMISED_ACCT_BULK" = "3.0", -"CRACKED_SURBL" = "5.0", -"CTE_CASE" = "0.5", -"CTYPE_MISSING_DISPOSITION" = "4.0", -"CTYPE_MIXED_BOGUS" = "1.0", -"CT_EXTRA_SEMI" = "1.0", -"DATA_URI_OBFU" = "2.0", -"DATE_IN_FUTURE" = "4.0", -"DATE_IN_PAST" = "1.0", -"DBL_ABUSE" = "5.0", -"DBL_ABUSE_BOTNET" = "6.5", -"DBL_ABUSE_MALWARE" = "6.5", -"DBL_ABUSE_PHISH" = "6.5", -"DBL_ABUSE_REDIR" = "5.0", -"DBL_BLOCKED" = "0.0", -"DBL_BLOCKED_OPENRESOLVER" = "0.0", -"DBL_BOTNET" = "7.5", -"DBL_MALWARE" = "7.5", -"DBL_PHISH" = "7.5", -"DBL_SPAM" = "6.5", -"DCC_BULK" = "3.0", -"DIRECT_TO_MX" = "0.0", -"DISPOSABLE_CC" = "0.0", -"DISPOSABLE_ENVFROM" = "0.0", -"DISPOSABLE_FROM" = "0.0", -"DISPOSABLE_REPLYTO" = "0.0", -"DISPOSABLE_TO" = "0.0", -"DKIM_SIGNED" = "0.0", -"DMARC_BAD_POLICY" = "0.5", -"DMARC_DNSFAIL" = "0.0", -"DMARC_NA" = "0.0", -"DMARC_POLICY_ALLOW" = "-0.5", -"DMARC_POLICY_ALLOW_WITH_FAILURES" = "0.0", -"DMARC_POLICY_QUARANTINE" = "1.5", -"DMARC_POLICY_REJECT" = "2.0", -"DMARC_POLICY_SOFTFAIL" = "0.1", -"DNSWL_BLOCKED" = "0.0", -"DWL_DNSWL_BLOCKED" = "0.0", -"DWL_DNSWL_HI" = "-3.5", -"DWL_DNSWL_LOW" = "-1.0", -"DWL_DNSWL_MED" = "-2.0", -"DWL_DNSWL_NONE" = "0.0", -"EMPTY_SUBJECT" = "1.0", -"ENCRYPTED_PGP" = "-0.5", -"ENCRYPTED_SMIME" = "-0.5", -"ENVFROM_INVALID" = "2.0", -"ENVFROM_SERVICE_ACCT" = "1.0", -"EXT_CSS" = "1.0", -"FAKE_REPLY" = "1.0", -"FORGED_RCVD_TRAIL" = "1.0", -"FORGED_RECIPIENTS" = "2.0", -"FORGED_RECIPIENTS_MAILLIST" = "0.0", -"FORGED_SENDER" = "0.3", -"FORGED_SENDER_MAILLIST" = "0.0", -"FREEMAIL_AFF" = "4.0", -"FREEMAIL_CC" = "0.0", -"FREEMAIL_ENVFROM" = "0.0", -"FREEMAIL_FROM" = "0.0", -"FREEMAIL_REPLYTO" = "0.0", -"FREEMAIL_REPLYTO_NEQ_FROM_DOM" = "3.0", -"FREEMAIL_TO" = "0.0", -"FROM_DN_EQ_ADDR" = "1.0", -"FROM_EQ_ENVFROM" = "0.0", -"FROM_EXCESS_BASE64" = "1.5", -"FROM_EXCESS_QP" = "1.2", -"FROM_HAS_DN" = "0.0", -"FROM_INVALID" = "2.0", -"FROM_NAME_EXCESS_SPACE" = "1.0", -"FROM_NAME_HAS_TITLE" = "1.0", -"FROM_NEEDS_ENCODING" = "1.0", -"FROM_NEQ_DISPLAY_NAME" = "4.0", -"FROM_NEQ_ENVFROM" = "0.0", -"FROM_NO_DN" = "0.0", -"FROM_SERVICE_ACCT" = "1.0", -"HACKED_WP_PHISHING" = "4.5", -"HAS_ANON_DOMAIN" = "0.1", -"HAS_ATTACHMENT" = "0.0", -"HAS_DATA_URI" = "0.0", -"HAS_GOOGLE_FIREBASE_URL" = "2.0", -"HAS_GOOGLE_REDIR" = "1.0", -"HAS_GUC_PROXY_URI" = "1.0", -"HAS_IPFS_GATEWAY_URL" = "6.0", -"HAS_LIST_UNSUB" = "-0.01", -"HAS_ONION_URI" = "0.0", -"HAS_ORG_HEADER" = "0.0", -"HAS_PHPMAILER_SIG" = "0.0", -"HAS_REPLYTO" = "0.0", -"HAS_WP_URI" = "0.0", -"HAS_XAW" = "0.0", -"HAS_XOIP" = "0.0", -"HAS_X_ANTIABUSE" = "0.0", -"HAS_X_AS" = "0.0", -"HAS_X_GMSV" = "0.0", -"HAS_X_PHP_SCRIPT" = "0.0", -"HAS_X_POS" = "0.0", -"HAS_X_PRIO_FIVE" = "0.0", -"HAS_X_PRIO_ONE" = "0.0", -"HAS_X_PRIO_THREE" = "0.0", -"HAS_X_PRIO_TWO" = "0.0", -"HAS_X_PRIO_ZERO" = "0.0", -"HAS_X_SOURCE" = "0.0", -"HEADER_EMPTY_DELIMITER" = "1.0", -"HEADER_FORGED_MDN" = "2.0", -"HEADER_RCONFIRM_MISMATCH" = "2.0", -"FROMHOST_NORES_A_OR_MX" = "1.5", -"FROM_BOUNCE" = "0.0", -"HELO_BAREIP" = "3.0", -"HELO_IP_A" = "1.0", -"HELO_NORES_A_OR_MX" = "0.3", -"HELO_NOT_FQDN" = "2.0", -"HELO_IPREV_MISMATCH" = "1.0", -"RCPT_BOUNCEMOREONE" = "1.5", -"URL_ONLY" = "2.2", -"HIDDEN_SOURCE_OBJ" = "2.0", -"HTML_META_REFRESH_URL" = "5.0", -"HTML_SHORT_LINK_IMG_1" = "2.0", -"HTML_SHORT_LINK_IMG_2" = "1.0", -"HTML_SHORT_LINK_IMG_3" = "0.5", -"HTML_TEXT_IMG_RATIO" = "1.0", -"HTML_UNBALANCED_TAG" = "0.5", -"HTTP_TO_HTTPS" = "0.5", -"HTTP_TO_IP" = "1.0", -"INFO_TO_INFO_LU" = "2.0", -"INVALID_DATE" = "1.5", -"INVALID_FROM_8BIT" = "6.0", -"INVALID_MSGID" = "1.7", -"KLMS_SPAM" = "5.0", -"LONG_SUBJ" = "3.0", -"MAILLIST" = "-0.2", -"MANY_INVISIBLE_PARTS" = "1.0", -"MID_BARE_IP" = "2.0", -"MID_CONTAINS_FROM" = "1.0", -"MID_CONTAINS_TO" = "1.0", -"MID_MISSING_BRACKETS" = "1.0", -"MID_RHS_IP_LITERAL" = "1.0", -"MID_RHS_MATCH_FROM" = "1.0", -"MID_RHS_MATCH_FROMTLD" = "1.0", -"MID_RHS_MATCH_TO" = "1.0", -"MID_RHS_NOT_FQDN" = "0.5", -"MID_RHS_WWW" = "0.5", -"MIME_ARCHIVE_IN_ARCHIVE" = "5.0", -"MIME_BAD" = "1.0", -"MIME_BAD_ATTACHMENT" = "4.0", -"MIME_BAD_EXTENSION" = "2.0", -"MIME_BAD_UNICODE" = "8.0", -"MIME_BASE64_TEXT" = "0.1", -"MIME_BASE64_TEXT_BOGUS" = "1.0", -"MIME_DOUBLE_BAD_EXTENSION" = "2.0", -"MIME_GOOD" = "-0.1", -"MIME_HEADER_CTYPE_ONLY" = "2.0", -"MIME_HTML_ONLY" = "0.2", -"MIME_MA_MISSING_HTML" = "1.0", -"MIME_MA_MISSING_TEXT" = "2.0", -"MISSING_DATE" = "1.0", -"MISSING_FROM" = "2.0", -"MISSING_MID" = "2.5", -"MISSING_MIME_VERSION" = "2.0", -"MISSING_SUBJECT" = "2.0", -"MISSING_TO" = "2.0", -"MSBL_EBL" = "7.5", -"MSBL_EBL_GREY" = "0.5", -"MULTIPLE_FROM" = "8.0", -"MULTIPLE_UNIQUE_HEADERS" = "7.0", -"MV_CASE" = "0.5", -"MW_SURBL_MULTI" = "7.5", -"HOMOGRAPH_URL" = "5.0", -"ONCE_RECEIVED" = "0.1", -"PHISHED_OPENPHISH" = "7.0", -"PHISHED_PHISHTANK" = "7.0", -"PHISHING" = "4.0", -"PHISH_EMOTION" = "1.0", -"PHP_XPS_PATTERN" = "0.0", -"PH_SURBL_MULTI" = "7.5", -"PRECEDENCE_BULK" = "0.0", -"PREVIOUSLY_DELIVERED" = "0.0", -"PYZOR" = "3.5", -"RBL_BARRACUDA" = "4.0", -"RBL_BLOCKLISTDE" = "4.0", -"RBL_MAILSPIKE_BAD" = "1.0", -"RBL_MAILSPIKE_VERYBAD" = "1.5", -"RBL_MAILSPIKE_WORST" = "2.0", -"RBL_NIXSPAM" = "4.0", -"RBL_SEM" = "1.0", -"RBL_SEM_IPV6" = "1.0", -"RBL_SENDERSCORE" = "2.0", -"RBL_SPAMCOP" = "4.0", -"RBL_SPAMHAUS" = "0.0", -"RBL_SPAMHAUS_BLOCKED" = "0.0", -"RBL_SPAMHAUS_BLOCKED_OPENRESOLVER" = "0.0", -"RBL_SPAMHAUS_CSS" = "2.0", -"RBL_SPAMHAUS_DROP" = "7.0", -"RBL_SPAMHAUS_PBL" = "2.0", -"RBL_SPAMHAUS_SBL" = "4.0", -"RBL_SPAMHAUS_XBL" = "4.0", -"RBL_VIRUSFREE_BOTNET" = "2.0", -"RCPT_ADDR_IN_SUBJECT" = "3.0", -"RCPT_COUNT_FIVE" = "0.0", -"RCPT_COUNT_GT_50" = "1.0", -"RCPT_COUNT_ONE" = "0.0", -"RCPT_COUNT_SEVEN" = "0.0", -"RCPT_COUNT_THREE" = "0.0", -"RCPT_COUNT_TWELVE" = "0.0", -"RCPT_COUNT_TWO" = "0.0", -"RCPT_COUNT_ZERO" = "0.0", -"RCPT_LOCAL_IN_SUBJECT" = "2.0", -"RCVD_COUNT_FIVE" = "0.0", -"RCVD_COUNT_ONE" = "0.0", -"RCVD_COUNT_SEVEN" = "0.0", -"RCVD_COUNT_THREE" = "0.0", -"RCVD_COUNT_TWELVE" = "0.0", -"RCVD_COUNT_TWO" = "0.0", -"RCVD_COUNT_ZERO" = "0.0", -"RCVD_DKIM_ARC_DNSWL_HI" = "-1.0", -"RCVD_DKIM_ARC_DNSWL_MED" = "-0.5", -"RCVD_DOUBLE_IP_SPAM" = "2.0", -"RCVD_FROM_SMTP_AUTH" = "0.0", -"RCVD_HELO_USER" = "3.0", -"RCVD_ILLEGAL_CHARS" = "4.0", -"RCVD_IN_DNSWL_HI" = "-0.5", -"RCVD_IN_DNSWL_LOW" = "-0.1", -"RCVD_IN_DNSWL_MED" = "-0.2", -"RCVD_IN_DNSWL_NONE" = "0.0", -"RCVD_NO_TLS_LAST" = "0.1", -"RCVD_TLS_ALL" = "0.0", -"RCVD_TLS_LAST" = "0.0", -"RCVD_UNAUTH_PBL" = "2.0", -"RCVD_VIA_SMTP_AUTH" = "0.0", -"RDNS_DNSFAIL" = "0.0", -"RDNS_NONE" = "1.0", -"RECEIVED_BLOCKLISTDE" = "3.0", -"RECEIVED_SPAMHAUS_BLOCKED" = "0.0", -"RECEIVED_SPAMHAUS_BLOCKED_OPENRESOLVER" = "0.0", -"RECEIVED_SPAMHAUS_CSS" = "1.0", -"RECEIVED_SPAMHAUS_PBL" = "0.0", -"RECEIVED_SPAMHAUS_SBL" = "3.0", -"RECEIVED_SPAMHAUS_XBL" = "1.0", -"REDIRECTOR_URL" = "0.0", -"REDIRECTOR_URL_ONLY" = "1.0", -"REPLYTO_ADDR_EQ_FROM" = "0.0", -"REPLYTO_DN_EQ_FROM_DN" = "0.0", -"REPLYTO_DOM_EQ_FROM_DOM" = "0.0", -"REPLYTO_DOM_NEQ_FROM_DOM" = "0.0", -"REPLYTO_EMAIL_HAS_TITLE" = "2.0", -"REPLYTO_EQ_FROM" = "0.0", -"REPLYTO_EQ_TO_ADDR" = "5.0", -"REPLYTO_EXCESS_BASE64" = "1.5", -"REPLYTO_EXCESS_QP" = "1.2", -"REPLYTO_UNPARSABLE" = "1.0", -"RWL_MAILSPIKE_EXCELLENT" = "-0.4", -"RWL_MAILSPIKE_GOOD" = "-0.1", -"RWL_MAILSPIKE_NEUTRAL" = "0.0", -"RWL_MAILSPIKE_POSSIBLE" = "0.0", -"RWL_MAILSPIKE_VERYGOOD" = "-0.2", -"R_BAD_CTE_7BIT" = "3.5", -"DKIM_ALLOW" = "-0.2", -"DKIM_NA" = "0.0", -"DKIM_PERMFAIL" = "0.0", -"DKIM_REJECT" = "1.0", -"DKIM_TEMPFAIL" = "0.0", -"R_MISSING_CHARSET" = "0.5", -"R_MIXED_CHARSET" = "5.0", -"MIXED_CHARSET_URL" = "7.0", -"R_NO_SPACE_IN_FROM" = "1.0", -"R_PARTS_DIFFER" = "1.0", -"SPF_ALLOW" = "-0.2", -"SPF_DNSFAIL" = "0.0", -"SPF_FAIL" = "1.0", -"SPF_NA" = "0.0", -"SPF_NEUTRAL" = "0.0", -"SPF_PERMFAIL" = "0.0", -"SPF_SOFTFAIL" = "0.0", -"R_SUSPICIOUS_URL" = "5.0", -"R_UNDISC_RCPT" = "3.0", -"SEM_URIBL" = "3.5", -"SEM_URIBL_FRESH15" = "3.0", -"SIGNED_PGP" = "-2.0", -"SIGNED_SMIME" = "-2.0", -"SORTED_RECIPS" = "3.5", -"SPAM_FLAG" = "5.0", -"SPAM_TRAP" = "discard", -"SPOOF_DISPLAY_NAME" = "8.0", -"SPOOF_REPLYTO" = "6.0", -"SUBJECT_ENDS_EXCLAIM" = "0.0", -"SUBJECT_ENDS_QUESTION" = "1.0", -"SUBJECT_ENDS_SPACES" = "0.5", -"SUBJECT_HAS_CURRENCY" = "1.0", -"SUBJECT_HAS_EXCLAIM" = "0.0", -"SUBJECT_HAS_QUESTION" = "0.0", -"SUBJECT_NEEDS_ENCODING" = "1.0", -"SUBJ_ALL_CAPS" = "3.0", -"SUBJ_BOUNCE_WORDS" = "0.0", -"SUBJ_EXCESS_BASE64" = "1.5", -"SUBJ_EXCESS_QP" = "1.2", -"SURBL_BLOCKED" = "0.0", -"SURBL_HASHBL_ABUSE" = "5.0", -"SURBL_HASHBL_CRACKED" = "5.0", -"SURBL_HASHBL_EMAIL" = "5.0", -"SURBL_HASHBL_MALWARE" = "6.5", -"SURBL_HASHBL_PHISH" = "6.5", -"SUSPICIOUS_RECIPS" = "1.5", -"TAGGED_FROM" = "0.0", -"TAGGED_RCPT" = "0.0", -"THREAD_HIJACKING_FROM_INJECTOR" = "2.0", -"TO_DN_ALL" = "0.0", -"TO_DN_EQ_ADDR_ALL" = "0.0", -"TO_DN_EQ_ADDR_SOME" = "0.0", -"TO_DN_NONE" = "0.0", -"TO_DN_RECIPIENTS" = "2.0", -"TO_DN_SOME" = "0.0", -"TO_DOM_EQ_FROM_DOM" = "0.0", -"TO_EQ_FROM" = "0.0", -"TO_EXCESS_BASE64" = "1.5", -"TO_EXCESS_QP" = "1.2", -"TO_MATCH_ENVRCPT_ALL" = "0.0", -"TO_MATCH_ENVRCPT_SOME" = "0.0", -"TO_NEEDS_ENCODING" = "1.0", -"TO_WRAPPED_IN_SPACES" = "2.0", -"TRUSTED_REPLY" = "-7.0", -"UNDISC_RCPTS_BULK" = "3.0", -"UNITEDINTERNET_SPAM" = "5.0", -"URIBL_BLACK" = "7.5", -"URIBL_BLOCKED" = "0.0", -"URIBL_GREY" = "1.5", -"URIBL_RED" = "3.5", -"URI_COUNT_ODD" = "0.5", -"URI_HIDDEN_PATH" = "1.0", -"URL_IN_SUBJECT" = "4.0", -"URL_REDIRECTOR_NESTED" = "1.0", -"VIOLATED_DIRECT_SPF" = "3.5", -"WP_COMPROMISED" = "0.0", -"WWW_DOT_DOMAIN" = "0.5", -"XM_CASE" = "0.5", -"XM_UA_NO_VERSION" = "0.01", -"X_PHP_EVAL" = "4.0", -"ZERO_WIDTH_SPACE_URL" = "7.0", -"SHORT_PART_BAD_HEADERS" = "7.0", -"MISSING_ESSENTIAL_HEADERS" = "7.0", -"SINGLE_SHORT_PART" = "0.0", -"COMPLETELY_EMPTY" = "7.0", -"LLM_UNSOLICITED_HIGH" = "3.0", -"LLM_UNSOLICITED_MEDIUM" = "2.0", -"LLM_UNSOLICITED_LOW" = "0.5", -"LLM_COMMERCIAL_HIGH" = "3.0", -"LLM_COMMERCIAL_MEDIUM" = "2.0", -"LLM_COMMERCIAL_LOW" = "0.5", -"LLM_HARMFUL_HIGH" = "3.0", -"LLM_HARMFUL_MEDIUM" = "2.0", -"LLM_HARMFUL_LOW" = "0.5", -"LLM_LEGITIMATE_HIGH" = "-3.0", -"LLM_LEGITIMATE_MEDIUM" = "-2.0", -"LLM_LEGITIMATE_LOW" = "-0.5"} diff --git a/resources/config/spamfilter/maps/spam_config.map b/resources/config/spamfilter/maps/spam_config.map deleted file mode 100644 index 02b81316..00000000 --- a/resources/config/spamfilter/maps/spam_config.map +++ /dev/null @@ -1,39 +0,0 @@ -spam-config = { -"add-spam" = true, -"add-spam-result" = true, -"learn-enable" = true, -"learn-balance" = "0.9", -"learn-ham-replies" = true, -"learn-ham-threshold" = "-0.5", -"learn-spam-threshold" = "6.0", -"threshold-spam" = "5.0", -"threshold-discard" = "0.0", -"threshold-reject" = "0.0", -"directory" = "", -"lookup" = "", -"llm-model" = "", -"llm-prompt" = "You are an AI assistant specialized in analyzing email content to detect unsolicited, commercial, or harmful messages. Your task is to examine the provided email, including its subject line, and determine if it falls into any of these categories. Please follow these steps: - -- Carefully read the entire email content, including the subject line. -- Look for indicators of unsolicited messages, such as: - * Lack of prior relationship or consent - * Mass-mailing characteristics - * Vague or misleading sender information -- Identify commercial content by checking for: - * Promotional language - * Product or service offerings - * Call-to-action for purchases -- Detect potentially harmful content by searching for: - * Phishing attempts (requests for personal information, suspicious links) - * Malware indicators (suspicious attachments, urgent calls to action) - * Scams or fraudulent schemes -- Analyze the overall tone, intent, and legitimacy of the email. -- Determine the most appropriate single category for the email: Unsolicited, Commercial, Harmful, or Legitimate. -- Assess your confidence level in this determination: High, Medium, or Low. -- Provide a brief explanation for your determination. -- Format your response as follows, separated by commas: Category,Confidence,Explanation - * Example: Unsolicited,High,The email contains mass-mailing characteristics without any prior relationship context. - -Here's the email to analyze, please provide your analysis based on the above instructions, ensuring your response is in the specified comma-separated format:", -"add-llm-result" = true -} diff --git a/resources/config/spamfilter/maps/url_redirectors.list b/resources/config/spamfilter/maps/url_redirectors.list deleted file mode 100644 index 93fc4d41..00000000 --- a/resources/config/spamfilter/maps/url_redirectors.list +++ /dev/null @@ -1,1077 +0,0 @@ -spam-redirect = {"000d.ru", -"0845.com", -"0c.ru", -"0lv.ru", -"0pen.me", -"0rz.tw", -"10r.us", -"123url.org", -"140.uz", -"17q.com", -"1c-bitrix.ru", -"1cl.in", -"1ink.in", -"1ink.ru", -"1iny.com", -"1lik.net", -"1link.in", -"1url.com", -"1url.in", -"1-url.net", -"1-url.ru", -"2big.at", -"2dwww.com", -"2.gp", -"2it.info", -"2.ly", -"2mb.eu", -"2qu.ru", -"2sms.ru", -"2tu.me", -"2tu.us", -"2url.org", -"307.to", -"3fw.ru", -"3le.ru", -"3.ly", -"3.vu", -"3x.si", -"4.gg", -"4job.ru", -"4.ly", -"4ms.me", -"4p5.com", -"4ry.ru", -"4sq.com", -"4u.gd", -"4url.cc", -"4url.tk", -"5.gp", -"5link.tk", -"5pl.us", -"5url.net", -"5z8.info", -"6fr.ru", -"6.ly", -"6pn.com", -"6url.com", -"6yo.org", -"70.ru", -"74job.ru", -"7.ly", -"7ly.ru", -"7pisem.ru", -"7ruh.com", -"7ry.us", -"7xu.org", -"8.ly", -"8q.ro", -"9mp.com", -"9-n.org", -"9xi.ru", -"a1.tc", -"a2k.in", -"aa.cx", -"aafter.us", -"abe5.com", -"access.im", -"action-emails.ru", -"ad4.us", -"adf.ly", -"adjix.com", -"adsbeta.net", -"ad.vu", -"afx.cc", -"a.gg", -"ah.ae", -"aipro.ru", -"airs.ru", -"aka-url.com", -"alic.at", -"all.fuseurl.com", -"allshort.ru", -"all-top.ru", -"alturl.com", -"a.md", -"amzn.to", -"a.nf", -"apeurl.com", -"api.m3653.net", -"apsense.cc", -"apu.sh", -"ar.gy", -"arm.in", -"arst.ch", -"atiny.me", -"atto.co.za", -"atu.ca", -"autodesk.com", -"avast.com", -"avoo.net", -"azc.cc", -"b23.ru", -"b2l.me", -"backupurl.com", -"bacn.me", -"bai.lu", -"bcool.bz", -"bezurl.com", -"bi.gl", -"binged.it", -"bin.nu", -"bitby.net", -"bit.do", -"bit.gy", -"bit.ly", -"bitleyco.cc", -"bitly.com", -"bitrix24.ru", -"biturl.net", -"bit.uz", -"bizj.us", -"bloat.me", -"bmu.li", -"boi.re", -"bq.ro", -"bravo.ly", -"briefurl.pl", -"bsa.ly", -"bsndsy.ru", -"budurl.com", -"bun.ru", -"bu.tt", -"byst.ro", -"byyb.net", -"bz9.com", -"campaign-services.directcrm.ru", -"canurl.com", -"capello.linkatty.com", -"capourl.com", -"care2share.tk", -"cbs.so", -"cbuz.com", -"cctv.ws", -"cd.vg", -"cektkp.com", -"cha.la", -"chilp.it", -"chzb.gr", -"cjb.net", -"cjt99.tk", -"clck.ru", -"cliccami.info", -"click2.info", -"clicks.biletix.ru", -"clicks.citilink.ru", -"click.email4customers.com", -"click.emailinfo.mail.hpe.com", -"click.icptrack.com", -"click.mlsend.com", -"click-me.us", -"clickthru.ca", -"clickv.tk", -"cli.gs", -"clkit.co", -"cl.lk", -"cl.ly", -"clme.ru", -"cloakreferer.com", -"clockurl.com", -"clop.in", -"cms.im", -"cmylink.com", -"cnect.us", -"comyonet.com", -"conta.cc", -"coolestone.com", -"cort.as", -"cortas.elpais.com", -"cot.ag", -"cowurl.com", -"cp.bitrix.ru", -"cr.am", -"createurl.com", -"crks.me", -"crlf.ru", -"crop.im", -"crum.pl", -"ctvr.us", -"cug.kr", -"cut4.me", -"cut.by", -"cuthut.com", -"cutt.us", -"d2u.us", -"d8z.ru", -"dai.ly", -"da.lc", -"ddp.net", -"decenturl.com", -"delivr.com", -"dev0.ru", -"dft.ba", -"digbig.com", -"di.gd", -"digg.com", -"digidns.net", -"din.gy", -"directtrafficlink.com", -"disq.us", -"dld.bz", -"dlvr.it", -"dmanalytics1.com", -"doiop.com", -"do.my", -"dopen.us", -"dot.tk", -"dr2.biz", -"driz.ru", -"dr.tl", -"durlz.info", -"easyuri.com", -"easyurl.jp", -"easyurl.net", -"eepurl.com", -"ej.uz", -"elurl.com", -"email.account.2gis.com", -"email.mail.ostrovok.ru", -"email.mxtoolbox.com", -"email.news.ostrovok.ru", -"e.mail.ru", -"em.digium.com", -"emap.ws", -"emlstart.com", -"etdurl.com", -"eweri.com", -"exa.im", -"f1ru.net", -"fa.by", -"fanta.linkatty.com", -"fav.me", -"fbi.pp.ua", -"fb.me", -"fbshare.me", -"fff.to", -"ff.im", -"ffs.cc", -"fi.gd", -"fire.to", -"firsturl.de", -"firsturl.net", -"fishurl.ru", -"flane.info", -"flavr.be", -"flic.kr", -"flq.us", -"flx.im", -"fly2.ws", -"folo.me", -"fo.my", -"fon.gs", -"forex-trade.be", -"fqav.com", -"freak.to", -"freepl.us", -"free-redirect.tk", -"freeurl.me", -"free-url-redirection.com.ru", -"fur.ly", -"fuseurl.com", -"fuzzy.to", -"fwd4.me", -"fwds.me", -"fwib.net", -"fyad.org", -"fyn.im", -"g00.me", -"gadaf.fi", -"game-url.com", -"gentleurl.net", -"geteml.com", -"getlink.info", -"get.sh", -"get.tf", -"gho.co", -"gig140.com", -"gizmo.do", -"gl.am", -"glink.co", -"gltw.ru", -"gmetzner.de", -"gmy.su", -"gnu.su", -"go2-url.com", -"go.9nl.com", -"go9.us", -"goandgrab.info", -"gog.tc", -"go.it", -"go-links.net", -"golook.at", -"go.ly", -"good.ly", -"goo.gl", -"goo.pm", -"go.qb.by", -"goshrink.com", -"gosite.in", -"goto.pattayacitythailand.com", -"gourl.ca", -"gourl.gr", -"gourl.it", -"go-url.ru", -"go.usa.gov", -"gri.bz", -"groteck.com", -"g.ro.lt", -"gtgg.us", -"g.ua", -"gu.ma", -"gurl.es", -"haqm.com", -"hex.io", -"hhvx.com", -"hiderefer.com", -"hijw.com", -"hi.kg", -"hit.kg", -"hj.to", -"hlurl.com", -"hmm.ph", -"ho.io", -"hop.clickbank.net", -"hopclicks.com", -"ho.pe", -"hop.kz", -"href.in", -"hsblinks.com", -"htxt.it", -"hubb.me", -"huff.to", -"hulu.com", -"hurl.me", -"hurl.ws", -"huuk.net", -"hvmnd.org", -"i2h.de", -"i5.be", -"icanhaz.com", -"idek.net", -"idelink.com", -"ifree.kz", -"ih3.ru", -"ikeafamilynews.ru", -"ilix.in", -"ilnk.me", -"informer.ru", -"innogam.es", -"ino.me", -"int.kz", -"ipsha.ru", -"ir.pe", -"is.gd", -"is.gs", -"issuu.com", -"itshrunk.com", -"its.my", -"iurlz.com", -"ix.lt", -"ixr.be", -"j3w.it", -"ja.cx", -"jdem.cz", -"jewi.sh", -"jijr.com", -"jmb.tw", -"j.mp", -"jom.la", -"joo.ru", -"just.as", -"juu.cc", -"keep2.me", -"kickurl.com", -"kipq.com", -"kisaurl.com", -"ki.tl", -"kl.am", -"klck.me", -"klik.sihitam.com", -"klx.co", -"knb.im", -"kon.tl", -"kore.us", -"korta.nu", -"kqon.com", -"kr1n.ru", -"krunchd.com", -"krz.ch", -"ktzr.us", -"l24.cm", -"l3ss.me", -"l9k.net", -"lat.ms", -"lavvs.com", -"lcut.us", -"leeturl.net", -"leto.tk", -"liip.to", -"liltext.com", -"lin.io", -"link2me.ru", -"link.ac", -"linkbee.com", -"linkbun.ch", -"linkcash.biz", -"linkde.info", -"linkee.com", -"link.from.homecredit.ru", -"link.hhut.ru", -"linkl.ru", -"link.mail.1fd-system.ru", -"link.mail.e-gazeta-unp.ru", -"link.mail.e.glavbukh-mail.ru", -"link.mail.fd-online.ru", -"link.mail.glavbukh-mail.ru", -"link.mail.unp-client.ru", -"link.rengo.ru", -"link.sendsay.ru", -"linkslash.ca", -"linkunion.de", -"linkx.me", -"linkyy.com", -"linkzip.net", -"lip.tc", -"li.ru", -"list-manage1.com", -"list-manage2.com", -"list-manage.com", -"little.im", -"littleurl.net", -"liurl.cn", -"livehoster.org", -"llinks.net", -"ln0.ru", -"ln4.me", -"lnk.by", -"lnk.cm", -"lnk.co", -"lnk.gd", -"lnk.in", -"lnk.ly", -"lnk.ms", -"lnk.sk", -"lnkd.in", -"lnks.gd", -"lnks.it", -"lnkstts.com", -"lnkurl.com", -"ln-s.net", -"ln-s.ru", -"loh.ru", -"loo.gl", -"lovebyt.es", -"low.cc", -"l.pr", -"lr.tc", -"lru.jp", -"lrwk.com", -"ltos.ru", -"lt.tl", -"lul.es", -"lurl.no", -"lx2.net", -"ly9.net", -"m4u.in", -"m7a.org", -"macte.ch", -"mail.rambler.ru", -"mandrillapp.com", -"mash.to", -"mee.la", -"merky.de", -"metamark.net", -"micurl.com", -"migre.me", -"miliuner.com", -"miniurl.com", -"miniurl.net.ru", -"miniurl.pl", -"mimecast.com", -"minu.me", -"minurl.fr", -"minyurl.net", -"minyurl.org", -"mislead.in", -"miud.in", -"mixe.me", -"mj.is", -"mjt.lu", -"mke.me", -"mlcampaignru.com", -"mljt.tech", -"mlsendru.com", -"mmt.su", -"mobotix-news.com", -"mo.by", -"moby.to", -"mockurl.com", -"moourl.com", -"mp77.com", -"mrte.ch", -"mtp.pl", -"mty.in", -"mug.gs", -"murl.kz", -"mvp.im", -"mylink4u.info", -"mylink.to", -"myloc.me", -"myooo.info", -"mypaqe.com", -"mypl.us", -"mytinyurl.net", -"myurl.in", -"myurl.si", -"myxx.me", -"mzan.si", -"n3n.in", -"n3r.ru", -"nbc.co", -"nblo.gs", -"nbold.com", -"ne1.net", -"netgod.tk", -"neuf.tk", -"newhotlink.com", -"nexturl.ru", -"nicesharing.com", -"nik.im", -"niurl.com", -"nl.cr", -"nn.nf", -"no1.in", -"no.io", -"nonameno.com", -"normalurl.com", -"notlong.com", -"not.my", -"now.am", -"n.pr", -"nsfw.in", -"nutshellurl.com", -"nxy.in", -"nyti.ms", -"oc1.us", -"oeeq.com", -"oiurl.com", -"o.ly", -"omf.gd", -"om.ly", -"omoikane.net", -"on.cnn.com", -"on.mktw.net", -"oogyah.com", -"oork.com", -"opurl.us", -"orbita.co.il", -"orz.se", -"ourgplus.at", -"out.houseofgaga.ru", -"ovr.me", -"ow.ly", -"o-x.fr", -"p1.fr", -"pathto.net", -"paypal-communication.com", -"pb8.ru", -"pburl.com", -"pcw.ro", -"pduda.mobi", -"pechkincensor.ru", -"pechkinspy.ru", -"peeep.us", -"peekurl.com", -"pendek.in", -"penting.web.id", -"pfat.de", -"pho.se", -"phpm.ru", -"php-ru.info", -"pi90.com", -"picourl.ru", -"piks.nl", -"ping.fm", -"pli.gs", -"plink.es", -"plo.cc", -"ploshadka.ru", -"plugin.name", -"plusphp.com", -"p.ly", -"pnt.me", -"pobierz-film.tk", -"politi.co", -"ponyurl.com", -"poo.pr", -"post.ly", -"pot.vg", -"pp.gg", -"ppt.cc", -"pra.im", -"privacy-surf.com", -"proext.com", -"professionali.ru", -"profile.to", -"proofpoint.com", -"prourl.de", -"ptiturl.com", -"p.tl", -"pub.vitrue.com", -"punyurl.com", -"purl.org", -"pvh.me", -"pw.ly", -"pxlz.org", -"py6.ru", -"pygmyurl.com", -"pysper.com", -"q32.ru", -"qick.ws", -"qid.in", -"qkr.cc", -"qlnk.net", -"qlql.ru", -"qnh.pl", -"qr.cx", -"qr.ee", -"qrf.in", -"qr.net", -"qru.ru", -"qte.me", -"qtwk.com", -"quik.in", -"qurl.com", -"qu.tc", -"qz.bz", -"rb6.me", -"r.delphicomponent.ru", -"rdrct.us", -"rdr.to", -"read.bi", -"readthis.ca", -"reallytinyurl.com", -"redir.ec", -"redirectingat.com", -"redirects.ca", -"redirect.subscribe.ru", -"redire.ru", -"redirx.com", -"reduc.in", -"referer.us", -"retweet.cc", -"retwt.me", -"reurl.org", -"rhwm.eu", -"rickroll.it", -"r.im", -"ri.ms", -"riz.gd", -"rlu.ru", -"rmse.ru", -"rnd.ru", -"romb.su", -"r-ss.de", -"rt.nu", -"rubyurl.com", -"ru.ly", -"rurl.org", -"rurl.ru", -"rurls.ru", -"rustech.org", -"rww.tw", -"s0bu.ru", -"s0e.ru", -"s4c.in", -"s7y.us", -"s8.hk", -"safe.mn", -"saf.li", -"safelinks.protection.outlook.com", -"sami.24.gg", -"sayabit.com", -"sbrf.link.info.sberbank.ru", -"s.coop", -"scurtare-url.hi2.ro", -"sdut.us", -"securityexpert.ru", -"securl.ru", -"sendgrid.net", -"sendit.in", -"sendsay.ru", -"sendurl.info", -"sg4d.com", -"sg-url.tk", -"shadyurl.com", -"share.flocktory.com", -"shar.es", -"shink.de", -"shiturl.com", -"shli.de", -"shorl.com", -"shortb.net", -"shorten.im", -"shorten.ws", -"short.ie", -"short.im", -"shortlinks.co.uk", -"short-me.com", -"shortner.com", -"shortn.me", -"short.nr", -"short.su", -"short.to", -"shorturl.asia", -"shorturl.com", -"short-url.co.uk", -"shorturls.co.uk", -"shortz.me", -"shout.to", -"show.my", -"shrinkee.com", -"shrinkify.com", -"shrinkr.com", -"shrten.com", -"shrt.fr", -"shrtl.com", -"shrt.st", -"shrunkin.com", -"shx.in", -"simplesite.com", -"simurl.com", -"sitefwd.com", -"sk9.pl", -"slate.me", -"sli.su", -"slki.ru", -"sl.to", -"smallr.com", -"smallurl.in", -"smallurl.ru", -"smalur.com", -"s-m.co", -"smsh.me", -"smurl.ca", -"smurl.name", -"sn9.ru", -"sn.im", -"snipr.com", -"snipurl.com", -"snurl.com", -"softlinemail.ru", -"sokrati.ru", -"somexyz.com", -"song.ly", -"sorturl.net", -"so.vg", -"sp2.ro", -"spedr.com", -"speed-tester.info", -"sq6.ru", -"srclick.ru", -"srcom.net", -"srnk.net", -"srs.li", -"srtn.me", -"starts.com", -"starturl.com", -"stat-pulse.com", -"stnx.at", -"stump.ws", -"su.ly", -"su.pr", -"surl.co.uk", -"surl.hu", -"surl.me", -"surs.nl", -"susurl.com", -"swturl.com", -"t1ny.net", -"ta.gd", -"ta.gg", -"tagiturl.com", -"taourl.com", -"tbd.ly", -"t.cn", -"t.co", -"tcrn.ch", -"techto.us", -"tez.co", -"tgl.net", -"tgr.me", -"tgr.ph", -"th8.us", -"thexyz.org", -"thinfi.com", -"th.ly", -"thnlnk.com", -"thurl.in", -"tie.ly", -"tighturl.com", -"tin.cc", -"tiniuri.com", -"tiny9.com", -"tinyarro.ws", -"tiny.by", -"tiny.cc", -"tinyit.cc", -"tinylink.ca", -"tinylink.in", -"tiny.ly", -"tiny.pl", -"tiny.ps", -"tinyuri.ca", -"tinyurl.com", -"tinyurl.ru", -"tki.me", -"tldr.in", -"tl.gd", -"t.lh.com", -"tlim.ru", -"tllg.net", -"tmi.me", -"tnij.org", -"tny.com", -"tny.tc", -"to8.cc", -"togoto.us", -"to.je", -"to.ly", -"toma.ai", -"tos.co", -"totc.us", -"tourl.fr", -"toysr.us", -"tozm.com", -"tpm.ly", -"tra.kz", -"track-mail.skbkontur.ru", -"trg.li", -"trii.us", -"tr.im", -"trimurl.me", -"trk.emlbest.com", -"trk.klclick.com", -"trk.klclick1.com", -"trk.klclick2.com", -"trk.klclick3.com", -"trunc.it", -"trusteml.com", -"tty.su", -"tuckinfo.com", -"tux-pla.net", -"tvsl.eu", -"tweet.ms", -"tweez.me", -"twhub.com", -"twirl.at", -"twitclicks.com", -"twitter.com", -"twitterurl.net", -"twiturl.de", -"twiu.ru", -"twurl.cc", -"twurl.nl", -"tyny.me", -"u2s.in", -"u76.org", -"ub0.cc", -"u.info-mg.ru", -"ukril.ru", -"ulk.me", -"ulmart.ru", -"ulo.me", -"ulu.lu", -"u.mavrev.com", -"umenytt.se", -"unfake.it", -"u.nu", -"updating.me", -"ur1.ca", -"ur3.us", -"ural-tender.ru", -"url2.ru", -"url360.me", -"url3.ru", -"url4.eu", -"url4.ru", -"url4t.com", -"url5.ru", -"url66.com", -"urla.ru", -"url.az", -"url.b24.am", -"urlbit.us", -"urlborg.com", -"urlbrief.com", -"urlcantik.com", -"urlclick.ru", -"url.cn", -"urlcorta.es", -"url.co.uk", -"urlcover.com", -"urlcut.com", -"urldefender.com", -"urldefense.com", -"urldepo.ru", -"url.dflix.net", -"urlel.com", -"urlenco.de", -"urle.us", -"url.g4team.com", -"urlgator.com", -"urlgeo.me", -"urlg.in", -"url-go.com", -"urlgo.ru", -"url.ie", -"urlin.it", -"urlink.eu", -"urli.nl", -"urlite.de", -"url.lotpatrol.com", -"urlmint.com", -"url.mk.ua", -"urlms.com", -"urloid.com", -"urloo.com", -"urlot.com", -"urlredo.com", -"urlscott.com", -"urls.co.za", -"url.shinri.biz", -"urlshorteningservicefortwitter.com", -"urlshort.me", -"urls.im", -"urlsim.com", -"urlsnip.com", -"urlsp.in", -"urlsqueeze.com", -"urls.vg", -"urltwit.com", -"urlu.ms", -"urlus.ru", -"url.vsofte.ru", -"urlx.ie", -"urlxs.fr", -"ur.ly", -"url.yanclex.com", -"urlz.at", -"urlzen.com", -"url-zip.com", -"urlz.ro", -"usat.ly", -"use.my", -"u.to", -"uud.in", -"uuu.su", -"uww.me", -"uyurl.com", -"vani.sh", -"vash-repetitor.ru", -"vb.ly", -"vc8.net", -"vgn.am", -"view.my", -"vk.cc", -"vl.am", -"vll.me", -"vog.me", -"vovka.com", -"vst.tv", -"w3t.org", -"w55.de", -"wa.la", -"wapo.st", -"wapurl.co.uk", -"warble.co", -"webformyself.com", -"weblist.kharkov.ua", -"weburl.me", -"weeclix.com", -"wez.su", -"whspr.it", -"widg.me", -"wik.ro", -"wipi.es", -"wlatcy-moch.tk", -"wlink.me.uk", -"wmturls.com", -"wom.im", -"wowurl.com", -"wp.me", -"wp.nu", -"wurl.in", -"wurl.us", -"wuw.su", -"ww.tl", -"clickmeeting.com", -"grandstreamnetworks.ru", -"reg.ru", -"wz.ae", -"x2t.com", -"xaa.su", -"xav.cc", -"xcqv.com", -"xcs.me", -"xd5.net", -"xdvn.net", -"xew.co", -"xops.fr", -"xp.cm", -"xr.com", -"xrl.in", -"xrls.tk", -"xrl.us", -"x-url.com", -"xurl.es", -"xurl.jp", -"x.vu", -"xvx.su", -"xw6.com", -"xxsurl.de", -"xxw.me", -"y.ahoo.it", -"yatuc.com", -"ydn.ru", -"ye.pe", -"yep.it", -"yfrog.com", -"yhoo.it", -"yi.pe", -"yiyd.com", -"ysu.me", -"yuarel.com", -"yurl.in", -"y-url.ru", -"yurl.ru", -"z0p.de", -"z2z.ca", -"zapt.in", -"zazi.me", -"zcom.us", -"zebratelecom.ru", -"zeep.in", -"zi.ma", -"zi.mu", -"zio.in", -"zipmyurl.com", -"zolp.net", -"zrps.info", -"zti.me", -"zud.me", -"zurl.ws", -"zxc9.com", -"zzang.kr", -"zz.gd"} - diff --git a/resources/config/spamfilter/scripts/composites.sieve b/resources/config/spamfilter/scripts/composites.sieve deleted file mode 100644 index 27bffa69..00000000 --- a/resources/config/spamfilter/scripts/composites.sieve +++ /dev/null @@ -1,79 +0,0 @@ -if eval "t.MISSING_ESSENTIAL_HEADERS && t.SINGLE_SHORT_PART" { - let "t.SHORT_PART_BAD_HEADERS" "1"; -} - -if eval "t.FORGED_RECIPIENTS && t.MAILLIST" { - let "t.FORGED_RECIPIENTS_MAILLIST" "1"; -} - -if eval "t.FORGED_SENDER && t.MAILLIST" { - let "t.FORGED_SENDER_MAILLIST" "1"; -} - -if eval "t.DMARC_POLICY_ALLOW && (t.SPF_SOFTFAIL || t.SPF_FAIL || t.DKIM_REJECT)" { - let "t.DMARC_POLICY_ALLOW_WITH_FAILURES" "1"; -} - -if eval "t.DKIM_NA && t.SPF_NA && t.DMARC_NA && t.ARC_NA" { - let "t.AUTH_NA" "1"; -} - -if eval "!(t.DKIM_NA && t.SPF_NA && t.DMARC_NA && t.ARC_NA) && (t.DKIM_NA || t.DKIM_TEMPFAIL || t.DKIM_PERMFAIL) && (t.SPF_NA || t.SPF_DNSFAIL) && t.DMARC_NA && (t.ARC_NA || t.ARC_DNSFAIL)" { - let "t.AUTH_NA_OR_FAIL" "1"; -} - -if eval "(t.AUTH_NA || t.AUTH_NA_OR_FAIL) && (t.BOUNCE || t.SUBJ_BOUNCE_WORDS)" { - let "t.BOUNCE_NO_AUTH" "1"; -} - -if eval "(t.HAS_X_POS || t.HAS_PHPMAILER_SIG) && t.HAS_WP_URI && (t.PHISHING || t.CRACKED_SURBL || t.PH_SURBL_MULTI || t.DBL_PHISH || t.DBL_ABUSE_PHISH || t.URIBL_BLACK || t.PHISHED_OPENPHISH || t.PHISHED_PHISHTANK)" { - let "t.HACKED_WP_PHISHING" "1"; -} - -if eval "(t.HAS_XOIP || t.RCVD_FROM_SMTP_AUTH) && t.DCC_BULK" { - let "t.COMPROMISED_ACCT_BULK" "1"; -} - -if eval "t.DCC_BULK && (t.MISSING_TO || t.R_UNDISC_RCPT)" { - let "t.UNDISC_RCPTS_BULK" "1"; -} - -if eval "t.RECEIVED_SPAMHAUS_PBL && !t.RCVD_VIA_SMTP_AUTH" { - let "t.RCVD_UNAUTH_PBL" "1"; -} - -if eval "(t.DKIM_ALLOW || t.ARC_ALLOW) && t.RCVD_IN_DNSWL_MED" { - let "t.RCVD_DKIM_ARC_DNSWL_MED" "1"; -} - -if eval "(t.DKIM_ALLOW || t.ARC_ALLOW) && t.RCVD_IN_DNSWL_HI" { - let "t.RCVD_DKIM_ARC_DNSWL_HI" "1"; -} - -if eval "(t.HAS_X_POS || t.HAS_PHPMAILER_SIG || t.HAS_X_PHP_SCRIPT) && (t.SUBJECT_ENDS_QUESTION || t.SUBJECT_ENDS_EXCLAIM || t.MANY_INVISIBLE_PARTS)" { - let "t.AUTOGEN_PHP_SPAMMY" "1"; -} - -if eval "(t.PHISHING || t.DBL_PHISH || t.PHISHED_OPENPHISH || t.PHISHED_PHISHTANK) && (t.SUBJECT_ENDS_QUESTION || t.SUBJECT_ENDS_EXCLAIM)" { - let "t.PHISH_EMOTION" "1"; -} - -if eval "t.HAS_GUC_PROXY_URI || t.URIBL_RED || t.DBL_ABUSE_REDIR || t.HAS_ONION_URI" { - let "t.HAS_ANON_DOMAIN" "1"; -} - -if eval "(t.SPF_FAIL || t.SPF_SOFTFAIL) && (t.RCVD_COUNT_ZERO || t.RCVD_NO_TLS_LAST)" { - let "t.VIOLATED_DIRECT_SPF" "1"; -} - -if eval "(t.FREEMAIL_FROM || t.FREEMAIL_ENVFROM || t.FREEMAIL_REPLYTO) && (t.TO_DN_RECIPIENTS || t.R_UNDISC_RCPT) && (t.FROM_NAME_HAS_TITLE || t.FREEMAIL_REPLYTO_NEQ_FROM_DOM)" { - let "t.FREEMAIL_AFF" "1"; -} - -if eval "t.URL_ONLY && t.REDIRECTOR_URL" { - let "t.REDIRECTOR_URL_ONLY" "1"; -} - -if eval "t.FAKE_REPLY && t.RCVD_VIA_SMTP_AUTH && (!t.RECEIVED_SPAMHAUS_PBL || t.RECEIVED_SPAMHAUS_XBL || t.RECEIVED_SPAMHAUS_SBL)" { - let "t.THREAD_HIJACKING_FROM_INJECTOR" "1"; -} diff --git a/resources/config/spamfilter/scripts/config.sieve b/resources/config/spamfilter/scripts/config.sieve deleted file mode 100644 index ee220af3..00000000 --- a/resources/config/spamfilter/scripts/config.sieve +++ /dev/null @@ -1,44 +0,0 @@ -# Whether to add an X-Spam-Status header -let "ADD_HEADER_SPAM" "key_get('spam-config', 'add-spam')"; - -# Whether to add an X-Spam-Result header -let "ADD_HEADER_SPAM_RESULT" "key_get('spam-config', 'add-spam-result')"; - -# Whether message replies from authenticated users should be learned as ham -let "AUTOLEARN_REPLIES_HAM" "key_get('spam-config', 'learn-ham-replies')"; - -# Whether the bayes classifier should be trained automatically -let "AUTOLEARN_ENABLE" "key_get('spam-config', 'learn-enable') && !env.test"; - -# When to learn ham (score >= threshold) -let "AUTOLEARN_HAM_THRESHOLD" "key_get('spam-config', 'learn-ham-threshold')"; - -# When to learn spam (score <= threshold) -let "AUTOLEARN_SPAM_THRESHOLD" "key_get('spam-config', 'learn-spam-threshold')"; - -# Keep difference for spam/ham learns for at least this value -let "AUTOLEARN_SPAM_HAM_BALANCE" "key_get('spam-config', 'learn-balance')"; - -# If ADD_HEADER_SPAM is enabled, mark as SPAM messages with a score above this threshold -let "SCORE_SPAM_THRESHOLD" "key_get('spam-config', 'threshold-spam')"; - -# Discard messages with a score above this threshold -let "SCORE_DISCARD_THRESHOLD" "key_get('spam-config', 'threshold-discard')"; - -# Reject messages with a score above this threshold -let "SCORE_REJECT_THRESHOLD" "key_get('spam-config', 'threshold-reject')"; - -# Directory name to use for local domain lookups (leave empty for default) -let "DOMAIN_DIRECTORY" "key_get('spam-config', 'directory')"; - -# Store to use for Bayes tokens and ids (leave empty for default) -let "SPAM_DB" "key_get('spam-config', 'lookup')"; - -# LLM model to use for spam classification -let "LLM_MODEL" "key_get('spam-config', 'llm-model')"; - -# LLM prompt to use for spam classification -let "LLM_PROMPT_TEXT" "key_get('spam-config', 'llm-prompt')"; - -# Whether to add an X-Spam-Llm-Result header -let "ADD_HEADER_LLM" "key_get('spam-config', 'add-llm-result')";