add Emlbest ESP

Esp-rbl.cf

@@ -70,6 +70,16 @@ ifplugin Mail::SpamAssassin::Plugin::Esp
     tflags      RBL_ESP_EMARSYS  net
   endif
 
+  header        ESP_EMLBEST      eval:esp_emlbest_check()
+  describe      ESP_EMLBEST      Message from Emlbest abused account
+  score         ESP_EMLBEST      0.01
+
+  ifplugin Mail::SpamAssassin::Plugin::AskDNS
+    askdns      RBL_ESP_EMLBEST  _EMLBESTID_.emlbest.espbl.snb.it A 127.0.0.1
+    describe    RBL_ESP_EMLBEST  Esp Emlbest Id blacklist
+    tflags      RBL_ESP_EMLBEST  net
+  endif
+
   header        ESP_EXACTTARGET  eval:esp_exacttarget_check()
   describe      ESP_EXACTTARGET  Message from ExactTarget abused account
   score         ESP_EXACTTARGET  0.01
@@ -324,6 +334,13 @@ if (version >= 4.000000)
     describe    RBL_ESP_EMARSYS       Esp EMarSys Id blacklist
     tflags      RBL_ESP_EMARSYS       net
 
+    header      __ESP_EMLBEST_CSA     X-Complaints-To =~ /\@mail\.emlbest\.com/
+    header      __ESP_EMLBEST_ID      X-Feedback-ID =~ /\d+:(?<EMLBEST_ID>\d+):campaign:\w+/
+    header      __ESP_EMLBEST_RBL     eval:check_hashbl_tag('emlbest.espbl.snb.it/A', 'raw', 'EMLBEST_ID', '^127\.')
+    meta        RBL_ESP_EMLBEST       ( __ESP_EMLBEST_CSA && __ESP_EMLBEST_RBL )
+    describe    RBL_ESP_EMLBEST       Esp Emlbest Id blacklist
+    tflags      RBL_ESP_EMLBEST       net
+
     header      __ESP_EXACTT_CSA      X-CSA-Complaints =~ /\@eco\.de/
     header      __ESP_EXACTT_SFMC     exists:X-SFMC-Stack
     header      __ESP_EXACTT_ID       x-messageKey =~ /(?<EXACTTARGET_ID>\d+)\-(?:\d+)\-(?:\d+)/
@@ -480,6 +497,7 @@ score       RBL_ESP_BEMAIL        4.0
 score       RBL_ESP_CONSTANTCONTACT  4.0
 score       RBL_ESP_ECMESSENGER   4.0
 score       RBL_ESP_EMARSYS       4.0
+score       RBL_ESP_EMLBEST       4.0
 score       RBL_ESP_EXACTTARGET   4.0
 score       RBL_ESP_FXYN          4.0
 score       RBL_ESP_KEYSENDER     4.0

Esp.cf

@@ -79,6 +79,13 @@ header		EMARSYS			eval:esp_emarsys_check()
 describe	EMARSYS			Message from EMarSys abused account
 score		EMARSYS			5.0
 
+# -------- EMLBEST --------
+emarsys_feed /etc/mail/spamassassin/emlbest_id.txt
+
+header		EMLBEST			eval:esp_emlbest_check()
+describe	EMLBEST			Message from Emlbest abused account
+score		EMLBEST			5.0
+
 # -------- EXACTTARGET --------
 exacttarget_feed /etc/mail/spamassassin/exacttarget_id.txt
 

Esp.pm

@@ -64,6 +64,7 @@ sub new {
   $self->register_eval_rule('esp_constantcontact_check',  $Mail::SpamAssassin::Conf::TYPE_HEAD_EVALS);
   $self->register_eval_rule('esp_ecmessenger_check',  $Mail::SpamAssassin::Conf::TYPE_HEAD_EVALS);
   $self->register_eval_rule('esp_emarsys_check',  $Mail::SpamAssassin::Conf::TYPE_HEAD_EVALS);
+  $self->register_eval_rule('esp_emlbest_check',  $Mail::SpamAssassin::Conf::TYPE_HEAD_EVALS);
   $self->register_eval_rule('esp_exacttarget_check',  $Mail::SpamAssassin::Conf::TYPE_HEAD_EVALS);
   $self->register_eval_rule('esp_fxyn_check',  $Mail::SpamAssassin::Conf::TYPE_HEAD_EVALS);
   $self->register_eval_rule('esp_keysender_check',  $Mail::SpamAssassin::Conf::TYPE_HEAD_EVALS);
@@ -126,6 +127,9 @@ Usage:
   esp_emarsys_check()
     Checks for EMarSys abused accounts
 
+  esp_emlbest_check()
+    Checks for Emlbest abused accounts
+
   esp_exacttarget_check()
     Checks for ExactTarget abused accounts
 
@@ -227,6 +231,11 @@ Files can be separated by a comma.
 A list of files with abused EMarSys accounts.
 Files can be separated by a comma.
 
+=item emlbest_feed [...]
+
+A list of files with abused Eimlbest accounts.
+Files can be separated by a comma.
+
 =item exacttarget_feed [...]
 
 A list of files with abused ExactTarget accounts.
@@ -469,6 +478,12 @@ sub set_config {
     type => $Mail::SpamAssassin::Conf::CONF_TYPE_STRING,
     }
   );
+  push(@cmds, {
+    setting => 'emlbest_feed',
+    is_admin => 1,
+    type => $Mail::SpamAssassin::Conf::CONF_TYPE_STRING,
+    }
+  );
   push(@cmds, {
     setting => 'exacttarget_feed',
     is_admin => 1,
@@ -606,6 +621,7 @@ sub finish_parsing_end {
   $self->_read_configfile('constantcontact_feed', 'CONSTANTCONTACT');
   $self->_read_configfile('ecmessenger_feed', 'ECMESSENGER');
   $self->_read_configfile('emarsys_feed', 'EMARSYS');
+  $self->_read_configfile('emlbest_feed', 'EMLBEST');
   $self->_read_configfile('exacttarget_feed', 'EXACTTARGET');
   $self->_read_configfile('fordem_feed', 'FORDEM');
   $self->_read_configfile('fxyn_feed', 'FXYN');
@@ -818,6 +834,30 @@ sub esp_emarsys_check {
   return _hit_and_tag($self, $pms, $uid, 'EMARSYS', 'EMarSys', 'EMARSYSID', $opts);
 }
 
+sub esp_emlbest_check {
+  my ($self, $pms, $opts) = @_;
+  my $fid;
+
+  # return if X-Complaints-To is not what we want
+  my $xc = $pms->get("X-Complaints-To", undef);
+
+  chomp($xc);
+  if((not defined $xc) or ($xc ne '[email protected]')) {
+    return;
+  }
+
+  # Parse the X-Feedback-ID
+  # X-Feedback-ID: 332658814:5769873:campaign:US
+  $fid = $pms->get("X-Feedback-ID", undef);
+  return if not defined $fid;
+
+  if($fid =~ /\d+:(\d+):campaign:\w+/) {
+    $fid = $1;
+    return _hit_and_tag($self, $pms, $fid, 'EMLBEST', 'Emlbest', 'EMLBESTID', $opts);
+  }
+  return;
+}
+
 sub esp_exacttarget_check {
   my ($self, $pms, $opts) = @_;
   my ($fid, $uid);
@@ -1245,6 +1285,7 @@ sub has_esp_be_mail_check { 1 };
 sub has_esp_constantcontact_check { 1 };
 sub has_esp_ecmessenger_check { 1 };
 sub has_esp_emarsys_check { 1 };
+sub has_esp_emlbest_check { 1 };
 sub has_esp_exacttarget_check { 1 };
 sub has_esp_fxyn_check { 1 };
 sub has_esp_keysender_check { 1 };