symbol { weight = 3.0; name = "SEM_URIBL_FRESH15"; description = "Spameatingmonkey uribl. Domains registered in the last 15 days (.AERO,.BIZ,.COM,.INFO,.NAME,.NET,.PRO,.SK,.TEL,.US)"; }
symbol {
- weight = 5.500000;
- description = "DBL uribl";
+ weight = 0.000000;
+ description = "DBL uribl unknown symbol (error)";
name = "DBL";
}
+ symbol {
+ weight = 6.500000;
+ description = "DBL uribl spam";
+ name = "DBL_SPAM";
+ }
+ symbol {
+ weight = 6.500000;
+ description = "DBL uribl phishing";
+ name = "DBL_PHISH";
+ }
+ symbol {
+ weight = 6.500000;
+ description = "DBL uribl malware";
+ name = "DBL_MALWARE";
+ }
+ symbol {
+ weight = 5.500000;
+ description = "DBL uribl botnet C&C domain";
+ name = "DBL_BOTNET";
+ }
+ symbol {
+ weight = 6.500000;
+ description = "DBL uribl abused legit spam";
+ name = "DBL_ABUSE";
+ }
+ symbol {
+ weight = 7.500000;
+ description = "DBL uribl abused spammed redirector domain";
+ name = "DBL_ABUSE_REDIR";
+ }
+ symbol {
+ weight = 7.500000;
+ description = "DBL uribl abused legit phish";
+ name = "DBL_ABUSE_PHISH";
+ }
+ symbol {
+ weight = 7.500000;
+ description = "DBL uribl abused legit malware";
+ name = "DBL_ABUSE_MALWARE";
+ }
+ symbol {
+ weight = 5.500000;
+ description = "DBL uribl abused legit botnet C&C";
+ name = "DBL_ABUSE_BOTNET";
+ }
+ symbol {
+ weight = 0.00000;
+ description = "DBL uribl IP queries prohibited!";
+ name = "DBL_PROHIBIT";
+ }
symbol {
weight = 7.5;
description = "uribl.com black url";
suffix = "dbl.spamhaus.org";
symbol = "DBL";
options = "noip";
+ ips = {
+ DBL_SPAM = "127.0.1.2"; # spam domain
+ DBL_PHISH = "127.0.1.4"; # phish domain
+ DBL_MALWARE = "127.0.1.5"; # malware domain
+ DBL_BOTNET = "127.0.1.6"; # botnet C&C domain
+ DBL_ABUSE = "127.0.1.102"; # abused legit spam
+ DBL_ABUSE_REDIR = "127.0.1.103"; # abused spammed redirector domain
+ DBL_ABUSE_PHISH = "127.0.1.104"; # abused legit phish
+ DBL_ABUSE_MALWARE = "127.0.1.105"; # abused legit malware
+ DBL_ABUSE_BOTNET = "127.0.1.106"; # abused legit botnet C&C
+ DBL_PROHIBIT = "127.0.1.255"; # IP queries prohibited!
+ }
}
rule {
suffix = "uribl.spameatingmonkey.net";