You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/10/29 07:57:30 UTC
svn commit: r1536597 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Tue Oct 29 06:57:29 2013
New Revision: 1536597
URL: http://svn.apache.org/r1536597
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1536597&r1=1536596&r2=1536597&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Tue Oct 29 06:57:29 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201310282
+## khop-sc-neighbors.cf v 201310292
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:9\.30\.137|4\.105\.9)|03\.(?:243\.50|9\.157)|84\.22\.(?:172|230)|73\.44\.168|21\.54\.54)|2(?:22\.122\.227|06\.214\.72)|85\.204\.147|68\.64\.166)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:8\.24\.175|9\.30\.137)|03\.(?:243\.50|9\.157)|84\.22\.(?:172|230)|73\.44\.168|21\.54\.54)|2(?:22\.122\.227|02\.52\.146)|(?:85\.204\.14|64\.79\.10)7)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:8\.24\.17[45]|9\.96\.83)|2(?:5\.60\.156|0\.84\.13)|4(?:2\.11\.195|1\.0\.61)|1(?:2\.97\.24|0\.52\.0)|09\.169\.88)|4(?:6\.102\.186|9\.156\.191|1\.254\.5)|213\.132\.241|91\.218\.245|64\.79\.99)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:0\.234\.106|8\.24\.174|9\.96\.83)|2(?:5\.60\.156|0\.84\.13)|4(?:2\.11\.195|1\.0\.61)|1(?:2\.97\.24|0\.52\.0)|09\.169\.88)|4(?:6\.102\.186|9\.156\.191|1\.254\.5)|2(?:13\.132\.241|06\.214\.72)|6(?:8\.64\.166|4\.79\.99))\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:1(?:30\.107\.235|63\.156\.109)|(?:97\.196\.16|41\.157\.)3)|2\.(?:1(?:84\.172\.244|70\.181\.99|64\.62\.8)|216\.46\.75)|9\.(?:42\.147\.114|193\.93\.25|37\.195\.59)|6\.(?:228\.65\.228|193\.90\.26)|4\.141\.253\.14|5\.80\.227\.233)|9(?:9\.(?:96\.83\.1(?:3[012456789]|4[01235689]|5[0134689])|30\.137\.1[67])|8\.24\.1(?:7(?:4\.16[37]|5\.[234]|3\.80)|80\.91)|5\.2(?:06\.38\.48|52\.108\.6)|4\.10(?:5\.9\.85|6\.16\.6)|2\.252\.213\.128)|0(?:3\.(?:243\.50\.(?:5[68]|63)|9\.157\.12[679]|31\.241\.16)|1\.(?:15\.123\.255|44\.3\.50|79\.5\.19)|9\.169\.88\.1(?:3[69]|4[04]))|7(?:3\.2(?:12\.205\.158|00\.90\.196)|7\.(?:1\.223\.73|69\.8\.50)|5\.96\.180\.175|4\.76\.130\.40|6\.31\.14\.113)|8(?:4\.(?:22\.(?:1(?:7(?:2\.14[45]|7\.51)|97\.216)|230\.213)|82\.179\.117)|8\.252\.0\.237)|4(?:8\.223\.59\.187|0\.133\.45\.25|1\.0\.61\.166|\.63\.74\.204)|2(?:2\.182\.28\.245|1\.22\.127\.17|0\.50\.86\.3)|\.224\.163\.99)|2(?:0(?:2\.(?:1(?:1(?:7\.120\.(?:8[29]|24)|8
\.236\.178)|29\.216\.60|42\.203\.19)|5(?:2\.146\.38|3\.13\.187)|71\.136\.200|234\.40\.41)|0\.(?:(?:175\.56\.19|51\.45\.18)0|7(?:2\.11\.132|9\.27\.60))|3\.(?:171\.233\.243|211\.133\.244)|1\.116\.199\.34)|1(?:1\.(?:23(?:4\.106\.54|7\.20\.39)|147\.211\.16)|3\.1(?:(?:71\.39\.15|95\.77\.11)4|32\.241\.13)|6\.(?:189\.101\.110|231\.140\.15)|2\.109\.182\.10|8\.151\.141\.75|0\.245\.89\.69)|2(?:1\.(?:2(?:14\.208\.226|04\.223\.38)|4\.142\.(?:5[678]|41))|2\.(?:1(?:12\.150\.58|22\.227\.10)|231\.57\.104))|4\.(?:153\.129\.102|237\.229\.37))|6(?:4\.79\.(?:99\.(?:2(?:4[02345789]|3[78]|5[01])|1(?:7[01234]|6\d))|107\.13)|1\.1(?:35\.130\.240|05\.174\.4)|9\.198\.197\.156|0\.251\.31\.134|5\.60\.15\.173|7\.90\.21\.150|8\.64\.166\.67|2\.4\.0\.9)|8(?:(?:2\.117\.194\.22|5\.204\.147\.)9|(?:7\.106\.173\.11|1\.23\.106\.7)5|3\.(?:18\.234\.202|3\.103\.227)|4\.22\.61\.190)|9(?:1\.218\.245\.(?:7[0123]|6[789])|3\.1(?:59\.160\.164|88\.8\.67)|8\.143\.158\.34)|4(?:6\.102\.186\.(?:[89]|1[346789]|2[23])|9\.218\.33\.215|1\
.137\.24\.4)|7(?:(?:6\.164\.199\.7|2\.35\.20\.13)1|4\.92\.74\.230)|3(?:1\.192\.108\.14[123]|7\.123\.98\.115))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:9\.(?:19(?:2\.255\.129|3\.93\.25)|42\.147\.114|203\.72\.73|37\.195\.59)|8\.(?:1(?:30\.107\.235|63\.156\.109|42\.19\.172)|97\.196\.163)|2\.(?:1(?:84\.172\.244|70\.181\.99|64\.62\.8)|216\.46\.75)|5\.(?:8(?:0\.227\.233|2\.233\.146)|210\.49\.185)|4\.(?:141\.253\.14|247\.23\.66)|6\.(?:228\.65\.228|193\.90\.26))|9(?:9\.(?:96\.83\.1(?:4[01235689]|5[01345689]|3\d)|30\.137\.1[67])|8\.2(?:4\.1(?:7(?:5\.[234]|4\.167|3\.80)|80\.91)|0\.67\.9)|5\.2(?:06\.38\.48|52\.108\.6)|2\.252\.213\.128|4\.106\.16\.6)|7(?:3\.2(?:12\.205\.158|00\.90\.196)|5\.(?:96\.180\.175|102\.6\.90)|7\.(?:1\.223\.73|69\.8\.50)|2\.245\.44\.122|4\.76\.130\.40|6\.31\.14\.113)|0(?:1\.(?:15\.123\.255|44\.3\.50|79\.5\.19)|3\.(?:9\.157\.12[679]|243\.50\.63)|9\.169\.88\.1(?:3[69]|4[04]))|8(?:4\.(?:22\.(?:1(?:7(?:2\.14[45]|7\.51)|97\.216)|230\.213)|82\.179\.117)|3\.106\.150\.78|8\.252\.0\.237)|2(?:1\.(?:78\.119\.193|22\.127\.17)|2\.182\.28\.245|0\.50\.86\.3)|4(?:8\.223\.59\.18
7|1\.0\.61\.166|\.63\.74\.204)|\.2(?:15\.206\.242|24\.163\.99))|2(?:0(?:2\.(?:1(?:1(?:7\.120\.8[29]|8\.236\.178)|29\.216\.60|42\.203\.19)|5(?:2\.146\.38|3\.13\.187)|71\.136\.200|234\.40\.41)|0\.(?:(?:175\.56\.19|51\.45\.18)0|7(?:2\.11\.132|9\.27\.60))|3\.(?:171\.233\.243|211\.133\.244)|1\.116\.199\.34)|1(?:3\.1(?:(?:71\.39\.15|95\.77\.11)4|32\.241\.13)|6\.(?:189\.101\.110|231\.140\.15)|1\.(?:147\.211\.16|234\.106\.54)|2\.109\.182\.10)|2(?:2\.(?:1(?:12\.150\.58|22\.227\.10)|231\.57\.104)|1\.2(?:14\.208\.226|04\.223\.38))|4\.(?:153\.129\.102|237\.229\.37))|6(?:4\.79\.(?:99\.(?:2(?:4[02345789]|3[78]|5[01])|1(?:7[01234]|6\d))|107\.13)|1\.1(?:35\.130\.240|05\.174\.4)|8\.64\.166\.(?:67|70)|9\.198\.197\.156|0\.251\.31\.134|5\.60\.15\.173|7\.90\.21\.150|2\.4\.0\.9)|8(?:(?:7\.106\.173\.11|1\.23\.106\.7)5|5\.(?:17\.27\.11[57]|204\.147\.9)|3\.(?:18\.234\.202|3\.103\.227)|2\.117\.194\.229|4\.22\.61\.190)|9(?:1\.218\.(?:245\.7[23]|160\.206)|3\.1(?:59\.160\.164|88\.8\.67)|8\.143\.158\.34)|4(?:6\.
102\.186\.(?:[89]|1[346789]|2[234567])|9\.218\.33\.215|1\.137\.24\.4)|7(?:2\.(?:166\.187\.139|35\.20\.131)|7\.106\.232\.178|6\.164\.199\.71)|37\.123\.98\.115)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|0\.(?:205\.3[234]|52\.[0123])|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|2\.215\.(?:6[34]|44)|9\.36\.21[23])|0(?:3\.(?:2(?:4(?:0\.(?:117|252)|2\.7)|6\.29)|7\.243|5\.27)|9\.127\.8[01])|8(?:3\.9(?:3\.(?:11[45]|98)|5\.6[67])|1\.66\.15[67])|25\.(?:44\.24[01234567]|60\.156)|9(?:0\.234\.10[56]|7\.252\.0)|7(?:3\.44\.168|7\.36\.22)|30\.193\.1(?:46|65))|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|1(?:1\.91\.22[01]|2\.34\.12))|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|7[01]|69)|19\.19[01])|9\.55\.25[2345])|4(?:1\.254\.[258]|6\.249\.82)|79\.106\.109|37\.0\.120)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|0\.(?:205\.3[2345]|52\.[0123])|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|2\.215\.(?:6[34]|44)|9\.36\.21[23])|0(?:3\.(?:2(?:4(?:0\.(?:117|252)|2\.7)|6\.29)|7\.243|5\.27)|9\.127\.8[01])|8(?:3\.9(?:3\.(?:11[45]|98)|5\.6[67])|1\.66\.15[67])|9(?:0\.234\.10[56]|2\.95\.63|7\.252\.0)|25\.(?:44\.24[01234567]|60\.156)|7(?:3\.44\.168|7\.36\.22)|30\.193\.1(?:46|65))|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|1(?:1\.91\.22[01]|2\.34\.12))|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|7[01])|19\.19[01])|9\.55\.25[235])|41\.254\.[258]|79\.106\.109|82\.199\.156|37\.0\.120)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6