22

✏️ Editing: KAM_redirectors.cf

#KAM GOOGLE SPAM
uri           __KAM_GOOGLE_REDIR      /^https?:\/\/(?:www\.)?google\..{2,6}\/(?:url\?q=|amp\/(?:s\/)?)/i

uri           __FACEBOOK_SHARER      m;https?://(?:www\.)?facebook\.com/sharer/sharer\.php;i

url_redirector .allaincemh.com
    url_redirector .australia4wdrentals.com
    url_redirector .awstrack.me
    url_redirector .benchurl.com
    url_redirector .blob.core.windows.net
    url_redirector .cc.rs6.net
    url_redirector .exactag.com
    url_redirector .hosted.phplist.com
    url_redirector .href.li
    url_redirector .maverickcrm.com
    url_redirector .msn.com
    url_redirector .msn.com.br
    url_redirector .protection.sophos.com
    url_redirector .yandex.net
    url_redirector .yandex.ru
    url_redirector auctiva.com
    url_redirector bing.com
    url_redirector cdn.dragon.cere.network
    url_redirector channelchief.varindia.com
    url_redirector clickeu.crmact.com
    url_redirector email.mail.bloom.io
    url_redirector email.mg.evista.hu
    url_redirector flac24bitsearch.com
    url_redirector iplogger.com
    url_redirector link.sowl.to
    url_redirector links.e.shopmyexchange.com
    url_redirector linklock.titanhq.com
    url_redirector mccarthysearch.com
    url_redirector post.spmailtechnolo.com
    url_redirector_get .pstmrk.it
    url_redirector_get docsend.com
    url_redirector_get email.idxhome.co
    url_redirector_get followup.cc
    url_redirector_get google.ae
    url_redirector_get google.al
    url_redirector_get google.be
    url_redirector_get google.ca
    url_redirector_get google.co.ls
    url_redirector_get google.co.uk
    url_redirector_get google.com
    url_redirector_get google.com.af
    url_redirector_get google.com.ag
    url_redirector_get google.com.cu
    url_redirector_get google.cz
    url_redirector_get google.de
    url_redirector_get google.es
    url_redirector_get google.it
    url_redirector_get googleadservices.com
    url_redirector_get hdaud.io
    url_redirector_get linksmail.geosolinc.com
    url_redirector_get t.nypost.com

body __GEN_REDIR_URLB          eval:redir_url()
    meta GB_GEN_REDIR_URL          __GEN_REDIR_URLB && !__FACEBOOK_SHARER
    describe GB_GEN_REDIR_URL      Message has one or more redirected URLs
    score GB_GEN_REDIR_URL         0.5

body GB_REDIR_URL_CHAINED      eval:redir_url_chained()
    describe GB_REDIR_URL_CHAINED  Message has redirected URL chained to other redirectors
    score GB_REDIR_URL_CHAINED     0.5

body GB_REDIR_URL_MAXCHAIN     eval:redir_url_maxchain()
    describe GB_REDIR_URL_MAXCHAIN Message has redirected URL that causes too many redirections
    score GB_REDIR_URL_MAXCHAIN    0.001

body GB_REDIR_URL_LOOP         eval:redir_url_loop()
    describe GB_REDIR_URL_LOOP     Message has redirected URL that loops back to itself
    score GB_REDIR_URL_LOOP        0.001

# meta rule for generic redirector
    meta            __GB_ANY_REDIR          GB_GEN_REDIR_URL
    describe        __GB_ANY_REDIR          Redirector found
else
    header          __GB_FROM_GCAL0         From:addr =~ /calendar\-notification\@google\.com/
    uri             __GB_FROM_GCAL1         /mailto\:calendar\-notification\@google\.com/
    meta            KAM_GOOGLE_REDIR        ( __KAM_GOOGLE_REDIR && !__GB_FROM_GCAL0 && !__GB_FROM_GCAL1 )
    # meta          KAM_GOOGLE_REDIR        __KAM_GOOGLE_REDIR 
    describe        KAM_GOOGLE_REDIR        Use of Google redir
    score           KAM_GOOGLE_REDIR        1.5

#MSN Brasil REDIRECTOR - Known exploit since at least 2007!! http://www.xssed.com/mirror/14129/
    uri             KAM_MSNBR_REDIR         /g.msn.com.br\/BR9\/1369.0/i
    describe        KAM_MSNBR_REDIR         Use of MSN Brasil Redirector for Spam seen in 2011
    score           KAM_MSNBR_REDIR         5.0

# Adobe redirector
    uri             GB_ADOBE_REDIR          m|^https?://\w+\-rt\-prod\d+\-t.campaign.adobe.com/r/\?id=.{8,24}&p1=|i
    describe        GB_ADOBE_REDIR          Adobe redirector
    score           GB_ADOBE_REDIR          1.5

# Bing redirector
    uri             GB_BING_REDIR           m|^https?://(?:www.)?bing.com/ck/a\?!&&p=.{32,128}&ptn=\d+&|i
    describe        GB_BING_REDIR           Microsoft Bing redirector
    score           GB_BING_REDIR           1.5

# Bizzabo redirector
    uri             GB_BIZZABO_REDIR        m|^https?://events.bizzabo.com/auth/emailAssociatedLogin/verifyTokenAndRedirect\?token=.{10,128}&redirectUrl=|i
    describe        GB_BIZZABO_REDIR        Bizzabo redirector
    score           GB_BIZZABO_REDIR        1.5

# Windows redirector
    uri             GB_WINDOWS_REDIR        m|^https?://\w+.blob.core.windows.net/\w+/\w+.html?\#\w{2}/\d{5}_md/\d+/|i
    describe        GB_WINDOWS_REDIR        Windows redirector
    score           GB_WINDOWS_REDIR        4.5

# Disq.us redirector
    uri             GB_DISQUS_REDIR         m|^https?://(?:www\.)?disq.us/?\?url=https?:|i
    describe        GB_DISQUS_REDIR         Disq.us redirector
    score           GB_DISQUS_REDIR         1.5

# Yandex redirector
    uri             GB_YANDEX_REDIR         m;^https?://[^/]*sba\.yandex\.(?:net|ru)/redirect\?;i
    describe        GB_YANDEX_REDIR         Yandex redirect used to obscure spamvertised website
    score           GB_YANDEX_REDIR         1.5

# Flashtalking redirector
    uri             GB_FLASHTALK_REDIR      m;^https?://servedby\.flashtalking\.com/click/.{16,256}&url=https?://;i
    describe        GB_FLASHTALK_REDIR      Flashtalking redirector
    score           GB_FLASHTALK_REDIR      1.5

# RetailRocket redirector
    uri             GB_RETAILROCKET_REDIR   m;^https?://clickproxy\.retailrocket\.net/\?url\.aspx.{1,32}url=http;i
    describe        GB_RETAILROCKET_REDIR   RetailRocket redirector
    score           GB_RETAILROCKET_REDIR   1.5

# ShopMyExchange redirector
    uri             GB_SHOPMYEXC_REDIR      m;^https?://links\.e\.shopmyexchange\.com/.{4,128}&kd=;i
    describe        GB_SHOPMYEXC_REDIR      ShopMyExchange redirector
    score           GB_SHOPMYEXC_REDIR      1.5

# Allaincemh redirector
    uri             GB_ALLAINCEMH_REDIR     m;^https?://url\d+\.allaincemh\.com/ls/click\?;i
    describe        GB_ALLAINCEMH_REDIR     Allaincemh redirector
    score           GB_ALLAINCEMH_REDIR     1.5

# Bloom.io redirector
    uri             GB_BLOOMIO_REDIR        m;^https?://email\.mail\.bloom\.io/c/.{256,512};i
    describe        GB_BLOOMIO_REDIR        bloom.io redirector
    score           GB_BLOOMIO_REDIR        1.5

# Dell redirector
    uri             GB_DELL_REDIR           m;^https?://\w\.\w{2}\.home\.dell\.com/r/\?.{8,128}\&p1=;i
    describe        GB_DELL_REDIR           Dell redirector
    score           GB_DELL_REDIR           1.5

# Oneclick redirector
    uri             GB_ONECLICK_REDIR       m;^https?://go\.onelink\.me/\d+\?pid=InProduct.{16,128}&af_web_dp=https?://;i
    describe        GB_ONECLICK_REDIR       Oneclick redirector
    score           GB_ONECLICK_REDIR       1.5

# Powerobjects redirector
    uri             GB_POWEROBJECTS_REDIR   m;^https?://pocloudcentral\.crm\.powerobjects\.net/PowerEmailWebsite/GetUrl\d+\.aspx\?.{16,128}\&pval=https?://;i
    describe        GB_POWEROBJECTS_REDIR   Powerobjects redirector
    score           GB_POWEROBJECTS_REDIR   1.5

# Kmail-lists redirector
    uri             GB_KMAIL_LISTS_REDIR    m;^https?://manage\.kmail\-lists\.com/subscriptions/subscribe/update\?.{16,128}&r=https?;i
    describe        GB_KMAIL_LISTS_REDIR    Kmail-lists redirector
    score           GB_KMAIL_LISTS_REDIR    1.5

# Emlnk redirector
    uri		GB_EMLNK_REDIR		m;^https?://\w+\.\w+\.emlnk\.com/Prod/link\-tracker\?.{4,64}&redirectUrl=;i
    describe	GB_EMLNK_REDIR		Emlnk redirector
    score		GB_EMLNK_REDIR		1.5

# Benchurl redirector
    uri		GB_BENCH_REDIR		m;^https?://clt\d{4,16}\.benchurl\.com/c/l\?.{8,64}&email\=;i
    describe	GB_BENCH_REDIR		Benchurl redirector
    score		GB_BENCH_REDIR		1.5

# Originsmarket redirector
    uri             GB_ORIGINSMARKET_REDIR  m;https?://sp\-track\.originsmarket\.com\.au/api/v1/track/click/\d+/\d+/.{32,64}\?redirecturl=https?://;i
    describe        GB_ORIGINSMARKET_REDIR  Originsmarket redirector
    score           GB_ORIGINSMARKET_REDIR  1.5

# Contactmonkey redirector
    uri		GB_CONTACTMONKEY_REDIR		m;^https?://contactmonkey\.com/api/v1/tracker.{32,256}\&cm_destination=https?://;i
    describe	GB_CONTACTMONKEY_REDIR		Contactmonkey redirector
    score		GB_CONTACTMONKEY_REDIR		1.5

# Turkmenportal redirector
    uri		GB_TURKMEN_REDIR	m;^https?://turkmenportal\.com/\w{2}/banner/\w/leave\?url=(?:https?:)?//;i
    describe	GB_TURKMEN_REDIR	Turkmenportal redirector
    score		GB_TURKMEN_REDIR	1.5

# Zafos redirector
    uri		GB_ZAFOS_REDIR		m;^https?://zafos\.com/app/newsletter/tracklink\?.{8,32}\&tid=https?://;i
    describe	GB_ZAFOS_REDIR		Zafos redirector
    score		GB_ZAFOS_REDIR		1.5

# SleadTrack redirector
    uri		GB_SLEAD_REDIR		m;^https?://click\.sleadtrack\.com/link\?.{32,128}\&url=https?;i
    describe	GB_SLEAD_REDIR		SleadTrack redirector
    score		GB_SLEAD_REDIR		1.5

# editions-legislatives.fr redirector
    uri		GB_EDLEG_REDIR		m;^https?://\w{2}\.\w{1}\.editions\-legislatives\.fr/r/\?.{16,64}\&p1=\w+\.\w+;i
    describe	GB_EDLEG_REDIR		editions-legislatives.fr redirector
    score		GB_EDLEG_REDIR		1.5

# Exactag redirector
    uri		GB_EXACTAG_REDIR	m;^https?://(?:m\.|www\.)?exactag\.com/ai\.aspx\?.{8,64}&url=;i
    describe	GB_EXACTAG_REDIR	Exactag redirector
    score		GB_EXACTAG_REDIR	1.5

# Awstrack redirector
    uri		GB_AWSTRACK_REDIR	m;^https?://\w+\.\w\.[a-z0-9-]+\.awstrack\.me/\w{2}/https?:;i
    describe	GB_AWSTRACK_REDIR	Awstrack redirector
    score		GB_AWSTRACK_REDIR	1.5

# Vnuspa redirector
    uri		GB_VNUSPA_REDIR		m;^https?://(?:www\.)?vnuspa\.org/\w{2}/go\.php\?url=https?://;i
    describe	GB_VNUSPA_REDIR		Vnuspa redirector
    score		GB_VNUSPA_REDIR		1.5

# Lnks redirector
    uri		GB_LNKS_REDIR		m;^https?://lnks\.io/r\.php\?.{16,128}\&destURL=https?;i
    describe	GB_LNKS_REDIR		Lnks redirector
    score		GB_LNKS_REDIR		1.5

# 3D Model Space redirector
    uri		GB_3DMODEL_REDIR	m;^https?://(?:www\.)3dmodelspace\.com/ad\.jsp\?.{4,16}\&l=https;i
    describe	GB_3DMODEL_REDIR	3D Model Space redirector
    score		GB_3DMODEL_REDIR	1.5

# Generic Php redirector
    uri             GB_PHP_REDIR            /\.php\?.{0,128}url=https?\:\/\//
    describe        GB_PHP_REDIR            Php redirector
    score           GB_PHP_REDIR            1.0

# href.li abused redirector
    uri             GB_HREF_LI_REDIR        m;https?://href\.li/\??https?://;i
    describe        GB_HREF_LI_REDIR        Href.li abused redirector
    score           GB_HREF_LI_REDIR        2.5

if (version >= 4.000000)
      if can(Mail::SpamAssassin::Conf::feature_capture_rules)
        ifplugin Mail::SpamAssassin::Plugin::AskDNS
          uri           __GAD_REDIR_URL         m;(?:adclick\.\w\.doubleclick\.net/pcs/click|(?:www)?\.googleadservices\.com/pagead/aclk)\?.{64,1024}\&adurl=https?//(?<GAD_REDIR_URL>.*)/;
          askdns        GB_GAD_REDIR            _GAD_REDIR_URL_.wild.pccc.com A 127.0.0.4
          describe      GB_GAD_REDIR            Abused Google Ads redirector
          score         GB_GAD_REDIR            9.0
 
          uri           __G_REDIR_URL           m;https?://(?:www\.)?google\..{2,6}/(?:amp/(?:s/)?|url\?q=)(?:https://)?(?<G_REDIR_URL>[a-z0-9\-_\.]+)(?:/|\?|$);i
          askdns        GB_G_REDIR              _G_REDIR_URL_.wild.pccc.com A 127.0.0.4
          describe      GB_G_REDIR              Abused Google search redirector
          score         GB_G_REDIR              9.0
        endif
      endif
    endif

# meta rule for non generic redirector
    meta            __GB_NOTGEN_REDIR          ( KAM_GOOGLE_REDIR || KAM_MSNBR_REDIR || GB_ADOBE_REDIR || GB_BING_REDIR || GB_BIZZABO_REDIR || GB_WINDOWS_REDIR || GB_DISQUS_REDIR || GB_YANDEX_REDIR || GB_FLASHTALK_REDIR || GB_RETAILROCKET_REDIR || GB_SHOPMYEXC_REDIR || GB_ALLAINCEMH_REDIR || GB_BLOOMIO_REDIR || GB_DELL_REDIR || GB_ONECLICK_REDIR || GB_POWEROBJECTS_REDIR || GB_KMAIL_LISTS_REDIR || GB_EMLNK_REDIR || GB_BENCH_REDIR || GB_ORIGINSMARKET_REDIR || GB_CONTACTMONKEY_REDIR || GB_TURKMEN_REDIR || GB_ZAFOS_REDIR || GB_SLEAD_REDIR || GB_EDLEG_REDIR || GB_EXACTAG_REDIR || GB_AWSTRACK_REDIR || GB_VNUSPA_REDIR || GB_LNKS_REDIR || GB_3DMODEL_REDIR || GB_PHP_REDIR || GB_HREF_LI_REDIR )
    describe        __GB_NOTGEN_REDIR          Non generic redirector found

if can(Mail::SpamAssassin::Conf::feature_capture_rules)
      ifplugin Mail::SpamAssassin::Plugin::AskDNS
        uri           __GEN_REDIR_URL        m;https?://.{8,512}(?:\?|\&)(?:adurl|af_web_dp|cm_destination|destination|destURL|l|location|p1|pval|r|_?(?:redir(?:ect)?(?:to)?|return)(?:Url)?|ret_url|referer|scl_url|service|tid|u|url)+\=(?:https?)?(?:\:?//)?(?:\%3A\%2F\%2F|\%253A)?(?:www\.)?(?<GEN_REDIR_URL>[a-z0-9\-_]+\.[a-z0-9\-_\.]+);i
        meta          GB_GEN_REDIR_URL       __GEN_REDIR_URL && !__FACEBOOK_SHARER
        describe      GB_GEN_REDIR_URL       Redirector found in href link
        score         GB_GEN_REDIR_URL       0.5

# XXX only generic rule should hit
        askdns        __GB_GEN_REDIR         _GEN_REDIR_URL_.wild.pccc.com A 127.0.0.4
        meta          GB_GEN_REDIR           ( __GB_GEN_REDIR && !__GB_NOTGEN_REDIR )
        describe      GB_GEN_REDIR           Abused redirected uri found on Wild RBL
        score         GB_GEN_REDIR           1.5 # limit 9.0
        tflags        GB_GEN_REDIR           net
      endif
    endif

# meta rule for generic redirector
    meta            __GB_ANY_REDIR          ( KAM_GOOGLE_REDIR || KAM_MSNBR_REDIR || GB_ADOBE_REDIR || GB_BING_REDIR || GB_BIZZABO_REDIR || GB_WINDOWS_REDIR || GB_DISQUS_REDIR || GB_YANDEX_REDIR || GB_FLASHTALK_REDIR || GB_RETAILROCKET_REDIR || GB_SHOPMYEXC_REDIR || GB_ALLAINCEMH_REDIR || GB_BLOOMIO_REDIR || GB_DELL_REDIR || GB_ONECLICK_REDIR || GB_POWEROBJECTS_REDIR || GB_KMAIL_LISTS_REDIR || GB_EMLNK_REDIR || GB_BENCH_REDIR || GB_ORIGINSMARKET_REDIR || GB_CONTACTMONKEY_REDIR || GB_TURKMEN_REDIR || GB_ZAFOS_REDIR || GB_SLEAD_REDIR || GB_EDLEG_REDIR || GB_EXACTAG_REDIR || GB_AWSTRACK_REDIR || GB_VNUSPA_REDIR || GB_LNKS_REDIR || GB_3DMODEL_REDIR || GB_PHP_REDIR || GB_HREF_LI_REDIR )
    describe        __GB_ANY_REDIR          Redirector found
  endif
endif

uri             __GB_DOUBLE_GREDIR      /https:\/\/google\..{2,6}\/amp\/s\/.{3,64}/
tflags          __GB_DOUBLE_GREDIR      multiple maxhits=2
meta            GB_DOUBLE_GREDIR        ( __GB_DOUBLE_GREDIR >= 2 )
describe        GB_DOUBLE_GREDIR        Email with more then two Google redirectors
score           GB_DOUBLE_GREDIR        5.0

meta            KAM_GOOGLE_FRESH_REDIR  __GB_ANY_REDIR && ( FROM_FMBLA_NEWDOM || SEM_FRESH )
describe        KAM_GOOGLE_FRESH_REDIR  Redirector found on email sent by a new domain
score           KAM_GOOGLE_FRESH_REDIR  2.0
tflags          KAM_GOOGLE_FRESH_REDIR  net

meta		GB_REDIR_EXEURI		( __GB_ANY_REDIR && KAM_EXEURI )
describe	GB_REDIR_EXEURI		Redirector and uri to a .exe file
score		GB_REDIR_EXEURI		1.5

MR SKB