aports/config/rspamd/scores/surbl.conf

group "surbl" {
	description = "URL DNS lists";
	max_score = 12.5;
	
	symbols = {
		"SURBL_BLOCKED" {
			weight = 0.0;
			description = "SURBL: blocked by policy/overusage";
			one_shot = true;
			groups = ["surblorg", "blocked"];
		}
		"PH_SURBL_MULTI" {
			weight = 5.5;
			description = "SURBL: Phishing sites";
			one_shot = true;
			groups = ["surblorg", "phishing"];
		}
		"MW_SURBL_MULTI" {
			weight = 5.5;
			description = "SURBL: Malware sites";
			one_shot = true;
			groups = ["surblorg"];
		}
		"ABUSE_SURBL" {
			weight = 5.5;
			description = "SURBL: ABUSE";
			one_shot = true;
			groups = ["surblorg"];
		}
		"CRACKED_SURBL" {
			weight = 4.0;
			description = "SURBL: cracked site";
			one_shot = true;
			groups = ["surblorg"];
		}
		"RSPAMD_URIBL" {
			weight = 4.5;
			description = "Rspamd uribl, bl.rspamd.com";
			one_shot = true;
			groups = ["rspamdbl"];
		}
	
		"RSPAMD_EMAILBL" {
			weight = 2.5;
			description = "Rspamd emailbl, bl.rspamd.com";
			one_shot = true;
			groups = ["rspamdbl"];
		}
	
		"MSBL_EBL" {
			weight = 7.5;
			description = "MSBL emailbl";
			one_shot = true;
			groups = ["ebl"];
		}
	
		"MSBL_EBL_GREY" {
			weight = 0.5; # TODO: test it
			description = "MSBL emailbl grey list";
			one_shot = true;
			groups = ["ebl"];
		}
	
		"SEM_URIBL_UNKNOWN" {
			weight = 0.0;
			description = "Spameatingmonkey uribl: unknown result";
			one_shot = true;
			groups = ["sem"];
		}
		"SEM_URIBL" {
			weight = 3.5;
			description = "Spameatingmonkey uribl";
			one_shot = true;
			groups = ["sem"];
		}
	
		"SEM_URIBL_FRESH15_UNKNOWN" {
			weight = 0.0;
			description = "Spameatingmonkey Fresh15 uribl: unknown result";
			one_shot = true;
			groups = ["sem"];
		}
		"SEM_URIBL_FRESH15" {
			weight = 3.0;
			description = "Spameatingmonkey uribl. Domains registered in the last 15 days (.AERO,.BIZ,.COM,.INFO,.NAME,.NET,.PRO,.SK,.TEL,.US)";
			one_shot = true;
			groups = ["sem"];
		}
	
		"DBL" {
			weight = 0.0;
			description = "DBL unknown result";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"DBL_SPAM" {
			weight = 6.5;
			description = "DBL uribl spam";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"DBL_PHISH" {
			weight = 6.5;
			description = "DBL uribl phishing";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"DBL_MALWARE" {
			weight = 6.5;
			description = "DBL uribl malware";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"DBL_BOTNET" {
			weight = 5.5;
			description = "DBL uribl botnet C&C domain";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"DBL_ABUSE" {
			weight = 6.5;
			description = "DBL uribl abused legit spam";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"DBL_ABUSE_REDIR" {
			weight = 1.5;
			description = "DBL uribl abused spammed redirector domain";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"DBL_ABUSE_PHISH" {
			weight = 7.5;
			description = "DBL uribl abused legit phish";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"DBL_ABUSE_MALWARE" {
			weight = 7.5;
			description = "DBL uribl abused legit malware";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"DBL_ABUSE_BOTNET" {
			weight = 5.5;
			description = "DBL uribl abused legit botnet C&C";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"DBL_PROHIBIT" {
			weight = 0.0;
			description = "DBL uribl IP queries prohibited!";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"DBL_BLOCKED_OPENRESOLVER" {
			weight = 0.0;
			description = "You are querying Spamhaus from an open resolver, please see https://www.spamhaus.org/returnc/pub/";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"DBL_BLOCKED" {
			weight = 0.0;
			description = "You are exceeding the query limit, please see https://www.spamhaus.org/returnc/vol/";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"URIBL_MULTI" {
			weight = 0.0;
			description = "uribl.com: unrecognised result";
			one_shot = true;
			groups = ["uribl"];
		}
		"URIBL_BLOCKED" {
			weight = 0.0;
			description = "uribl.com: query refused";
			one_shot = true;
			groups = ["uribl", "blocked"];
		}
		"URIBL_BLACK" {
			weight = 7.5;
			description = "uribl.com black url";
			one_shot = true;
			groups = ["uribl"];
		}
		"URIBL_RED" {
			weight = 3.5;
			description = "uribl.com red url";
			one_shot = true;
			groups = ["uribl"];
		}
		"URIBL_GREY" {
			weight = 1.5;
			description = "uribl.com grey url";
			one_shot = true;
			groups = ["uribl"];
		}
		"SPAMHAUS_ZEN_URIBL" {
			ignore = true;
			weight = 0.0;
			description = "Spamhaus ZEN URIBL: Filtered result";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"URIBL_SBL" {
			ignore = true;
			weight = 6.5;
			description = "A domain in the message body resolves to an IP listed in Spamhaus SBL";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"URIBL_SBL_CSS" {
			ignore = true;
			weight = 6.5;
			description = "A domain in the message body resolves to an IP listed in Spamhaus SBL CSS";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"URIBL_XBL" {
			ignore = true;
			weight = 1.5;
			description = "A domain in the message body resolves to an IP listed in Spamhaus XBL";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"URIBL_PBL" {
			ignore = true;
			weight = 0.01;
			description = "A domain in the message body resolves to an IP listed in Spamhaus PBL";
			one_shot = true;
			groups = ["spamhaus"];
		}
		"URIBL_DROP" {
			ignore = true;
			weight = 5.0;
			description = "A domain in the message body resolves to an IP listed in Spamhaus DROP";
			one_shot = true;
			groups = ["spamhaus"];
		}
		#"RBL_SARBL_BAD" {
		#    weight = 2.5;
		#    description = "A domain in the message body is blacklisted in SARBL";
		#    one_shot = true;
		#}
	}
}