You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/05/08 08:57:15 UTC
svn commit: r1480171 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed May 8 06:57:14 2013
New Revision: 1480171
URL: http://svn.apache.org/r1480171
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1480171&r1=1480170&r2=1480171&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed May 8 06:57:14 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20130572
+## khop-sc-neighbors.cf v 20130582
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -20,7 +20,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|9[35])(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:11[37]|9[35])(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -74,7 +74,7 @@ score KHOP_SC_CIDR16 1.0 0.2 1.0 0.2
# crap, still empty 20100410 bad scrape, script failed to populate rule
# crap, still empty 20110227 this is due to safety net exclusions -> 1 .2 1 .2
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b178\.12[57](?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:178\.12[57]|59\.150|37\.45)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0.4
@@ -92,7 +92,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:3\.(?:192\.144|212\.250)|4\.36\.167)|(?:99\.180\.11|12\.97\.3)3|03\.(?:30\.72|9\.156)|84\.22\.(?:108|53)|21\.54\.54)|64\.(?:120\.170|203\.238)|58\.253\.216)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:3\.(?:30\.72|9\.157)|8\.62\.42)|(?:99\.180\.11|12\.97\.3)3|73\.(?:192\.144|212\.250)|2(?:0\.84\.13|1\.54\.54)|84\.22\.108)|(?:58\.254\.16|64\.203\.23)8)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -111,7 +111,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:0\.(?:128\.2|84\.13)|5\.60\.156)|78\.172\.(?:1(?:5[234]|8[36])|229)|84\.82\.(?:1(?:09|54)|29)|12\.9(?:0\.90|7\.33)|08\.62\.42)|2(?:08\.82\.114|10\.21\.225|\.139\.178)|98\.139\.44|65\.60\.15)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:0\.(?:128\.2|84\.13)|5\.60\.156)|78\.172\.(?:1(?:5[234]|8[36])|229)|84\.82\.(?:1(?:09|54)|29)|12\.9(?:0\.90|7\.33))|2(?:08\.82\.114|10\.21\.225|\.139\.178)|6(?:4\.120\.170|5\.60\.15)|98\.139\.44)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -129,7 +129,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:1(?:86\.(?:46\.107|16\.5)|21\.163\.147|64\.62\.8)|2(?:17\.218\.218|20\.30\.210)|9(?:0\.90\.1[6789]|7\.33\.42))|5\.(?:88\.(?:119\.132|247\.131)|9(?:4\.87\.218|0\.96\.85)|249\.63\.164)|(?:6\.255\.241\.11|9\.192\.252\.)1|0\.(?:165\.125\.152|45\.244\.45)|7\.2(?:39\.144\.70|0\.3\.231)|1\.185\.160\.14|3\.98\.254\.177|4\.207\.113\.55|8\.129\.166\.86)|9(?:9\.(?:18(?:0\.113\.1(?:1[0368]|2[034])|9\.108\.124)|2(?:31\.227\.173|55\.11\.29))|5\.(?:1(?:91\.1(?:66\.25|84\.82)|28\.253\.152|38\.195\.125)|29\.81\.30)|3\.255\.143\.63|2\.162\.24\.71)|2(?:1\.(?:1(?:81\.251\.188|45\.120\.75)|22\.127\.17)|3\.(?:19(?:3\.66\.191|5\.89\.29)|240\.87\.174)|5\.(?:129\.124\.206|210\.188\.35)|0\.128\.2\.1(?:72|85)|4\.243\.124\.206)|7(?:3\.(?:2(?:0(?:0\.90\.196|8\.16\.53)|12\.250\.230)|1(?:92\.144\.105|3\.9\.9))|(?:4\.36\.1(?:67\.11|39\.8)|6\.53\.233\.7)6|5\.196\.73\.189|7\.34\.246\.254)|8(?:4\.(?:82\.(?:1(?:09\.14|54\.51)|29\.3[34])|22\.(?:108
\.1(?:64|80)|53\.211))|2\.233\.226\.183|0\.178\.42\.250|8\.127\.230\.28)|63\.177\.11(?:4\.1(?:4[0123]|3[67])|3\.2(?:2[4589]|30))|0(?:3\.9\.157\.181|6\.241\.3\.217|8\.62\.42\.103)|5(?:3\.127\.232\.158|8\.255\.0\.55))|2(?:1(?:0\.(?:2(?:1\.225\.2(?:4[124578]|3[01368]|27)|45\.89\.69)|(?:118\.26\.18|91\.133\.14)3|51\.44\.199)|1\.(?:1(?:06\.90\.165|47\.211\.16)|206\.133\.94|54\.17\.201)|8\.(?:2(?:2\.17\.235|\.0\.60)|153\.247\.68)|3\.(?:230\.128\.226|81\.164\.57)|7\.1(?:7\.35\.146|98\.3\.238)|6\.153\.136\.125|2\.6\.152\.211)|0(?:2\.(?:1(?:36\.158\.4|42\.203\.1)9|29\.213\.236|71\.136\.200|44\.53\.64)|8\.(?:82\.114\.(?:2[014679]|4[1357]|3[079])|73\.23\.216)|0\.(?:247\.100\.178|142\.133\.21|72\.11\.132)|1\.(?:22\.7\.225|45\.114\.3)|3\.255\.15\.146|4\.11\.60\.114)|2(?:1\.214\.208\.226|2\.236\.16\.14)|\.139\.178\.(?:184|81))|6(?:1\.(?:1(?:75\.223\.13[49]|64\.42\.158|9\.97\.69)|252\.138\.195|80\.254\.220|98\.131\.141)|4\.(?:120\.1(?:34\.120|70\.138|81\.94)|203\.238\.6[47])|5\.(?:60\.15\.
1(?:73|86)|181\.126\.164)|6\.(?:96\.213\.138|84\.50\.133)|3\.223\.124\.136|9\.90\.120\.188)|7(?:7\.(?:106\.232\.178|77\.52\.192)|6\.7(?:2\.173\.233|4\.186\.237)|1\.188\.63\.88|2\.35\.20\.131|8\.47\.22\.107)|9(?:3\.1(?:57\.148\.102|15\.92\.155)|5\.(?:51\.156\.218|71\.126\.175)|1\.121\.184\.131|6\.9\.138\.233)|4(?:(?:9\.212\.172\.8|1\.137\.24\.)4|2\.114\.228\.207|6\.28\.69\.230)|5(?:8\.2(?:54\.168\.(?:5[6789]|6[0123])|27\.21\.27)|9\.150\.255\.35)|8(?:7\.236\.232\.231|3\.238\.208\.55|4\.15\.191\.254|\.20\.39\.3)|37\.206\.210\.130)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:1(?:86\.(?:46\.107|16\.5)|21\.163\.147|64\.62\.8)|2(?:17\.218\.218|20\.30\.210)|9(?:0\.90\.1[6789]|7\.33\.42))|5\.(?:249\.63\.164|88\.119\.132|90\.96\.85)|(?:6\.255\.241\.11|9\.192\.252\.)1|0\.(?:165\.125\.152|45\.244\.45)|7\.2(?:39\.144\.70|0\.3\.231)|3\.98\.254\.177|4\.207\.113\.55|8\.97\.196\.163)|9(?:9\.(?:18(?:0\.113\.1(?:2[034]|1[38])|9\.108\.124)|2(?:31\.227\.173|55\.11\.29))|5\.(?:1(?:91\.1(?:66\.25|84\.82)|28\.253\.152|38\.195\.125)|29\.81\.30)|2\.(?:210\.220\.57|162\.24\.71)|3\.(?:255\.143\.63|6\.1\.169)|8\.55\.110\.138)|7(?:3\.(?:2(?:0(?:0\.90\.196|8\.16\.53)|12\.250\.230)|1(?:92\.144\.105|3\.9\.9))|(?:4\.36\.1(?:67\.11|39\.8)|6\.53\.233\.7)6|7\.(?:34\.246\.25|80\.102\.21)4|5\.196\.73\.189)|2(?:1\.(?:1(?:81\.251\.188|45\.120\.75)|22\.127\.17)|5\.(?:129\.124\.206|210\.188\.35)|3\.(?:193\.66\.191|240\.87\.174)|0\.128\.2\.1(?:72|85)|4\.243\.124\.206)|8(?:4\.(?:82\.(?:1(?:09\.14|54\.51)|29\.3[34])|22\.(?:
108\.1(?:64|80)|53\.211))|8\.1(?:27\.230\.28|68\.46\.53)|2\.233\.226\.183|9\.100\.193\.84)|0(?:3\.9\.15(?:7\.181|6\.89)|9\.102\.23\.202|6\.241\.3\.217|8\.62\.42\.103)|63\.177\.11(?:4\.1(?:4[023]|3[67])|3\.2(?:2[4589]|30))|5(?:3\.127\.232\.158|8\.255\.0\.55))|2(?:1(?:0\.(?:2(?:1\.225\.2(?:4[12478]|3[16])|45\.89\.69)|(?:118\.26\.18|91\.133\.14)3|5(?:1\.44\.199|6\.23\.100))|3\.(?:2(?:03\.236\.133|30\.128\.226|51\.186\.229)|171\.39\.154|81\.164\.57)|1\.(?:1(?:06\.90\.165|47\.211\.16)|206\.133\.94|54\.17\.201)|8\.(?:2(?:2\.17\.235|\.0\.60)|153\.247\.68)|(?:6\.153\.136\.12|9\.80\.238\.18)5|7\.1(?:7\.35\.146|98\.3\.238)|2\.6\.152\.211)|0(?:0\.(?:7(?:2\.11\.132|9\.27\.60)|247\.100\.178|142\.133\.21)|2\.(?:1(?:36\.158\.4|42\.203\.1)9|71\.136\.200|44\.53\.64)|8\.(?:82\.114\.(?:4[13579]|2[1679]|3[079]|51)|73\.23\.216)|1\.(?:22\.7\.225|45\.114\.3)|9\.223\.36\.247|4\.11\.60\.114)|2(?:1\.(?:214\.208\.226|143\.50\.219)|0\.94\.235\.200|2\.236\.16\.14)|\.139\.178\.(?:184|81))|6(?:1\.(?:1(?:6
4\.42\.158|9\.97\.69)|252\.138\.195|98\.131\.141)|4\.(?:120\.1(?:34\.120|70\.138|81\.94)|203\.238\.6[47])|6\.(?:84\.(?:50\.133|49\.9)|96\.213\.138)|5\.(?:60\.15\.1(?:73|86)|181\.126\.164)|3\.223\.124\.136|9\.90\.120\.188|8\.115\.192\.7)|7(?:6\.7(?:2\.173\.233|4\.186\.237)|5\.127\.110\.39|1\.188\.63\.88|2\.35\.20\.131|7\.77\.52\.192|8\.47\.22\.107)|9(?:5\.(?:51\.156\.218|71\.126\.175|48\.24\.10)|1\.121\.184\.131|3\.115\.92\.155|6\.9\.138\.233)|4(?:(?:9\.212\.172\.8|1\.137\.24\.)4|2\.114\.228\.207|6\.28\.69\.230)|5(?:8\.2(?:54\.168\.(?:5[6789]|6[013])|27\.21\.27)|9\.150\.255\.35)|8(?:7\.236\.232\.231|3\.238\.208\.55|8\.156\.24\.74|\.20\.39\.3)|37\.206\.210\.130)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work