You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/10/01 08:57:29 UTC
svn commit: r1527943 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Tue Oct 1 06:57:29 2013
New Revision: 1527943
URL: http://svn.apache.org/r1527943
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1527943&r1=1527942&r2=1527943&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Tue Oct 1 06:57:29 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201309302
+## khop-sc-neighbors.cf v 20131012
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:18[68]|37|5)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|88)|9?5)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -42,7 +42,7 @@ score KHOP_SC_CIDR8 0.1 0.02 0.2 0.1
# 1.5335/0.5063 0.752 20130629@465k net, solo=1.5947/0.5379@0.748
# 2.0256/0.7432 0.732 20130705@376k solo=2.0429/0.7595@0.729, ->.1 .02 .2 .1
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|78|90)|2)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|90)|37|2)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:3\.30\.7[23]|1\.15\.254)|12\.90\.222|84\.22\.177|21\.54\.54)|2(?:11\.119\.86|21\.4\.142|3\.229\.11)|(?:91\.218\.24|75\.75\.22)5|58\.254\.172|85\.25\.150)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:(?:01\.15\.2|21\.54\.)54|98\.(?:24\.18|44\.)0|12\.90\.222)|2(?:06\.214\.67|11\.119\.86|21\.4\.142|3\.229\.11)|58\.254\.172|75\.75\.225)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:98\.(?:24\.17[45]|50\.163|44\.0)|2(?:5\.60\.156|0\.84\.13)|78\.20\.148|41\.0\.61)|2(?:1(?:3\.132\.241|6\.155\.17)|06\.214\.71)|41\.254\.5|80\.86\.88)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:98\.(?:24\.17[45]|50\.163)|2(?:5\.60\.156|0\.84\.13)|78\.20\.148|41\.0\.61)|2(?:1(?:3\.132\.241|6\.155\.17)|06\.214\.71)|(?:91\.218\.24|41\.254\.)5|80\.86\.88)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.(?:22\.(?:2(?:8\.22[012]|28\.[56]2|30\.213|7\.171)|1(?:7(?:7\.5[12]|2\.145)|97\.216|1\.23))|82\.(?:53\.1(?:06|43|1)|179\.117))|0\.(?:225\.148\.206|166\.124\.90)|3\.(?:136\.128\.22|22\.156\.9)6|8\.252\.0\.237|9\.75\.63\.114)|1(?:8\.(?:1(?:30\.107\.235|75\.28\.3)|217\.180\.116|97\.196\.163)|5\.8(?:2\.242\.197|8\.119\.132)|3\.(?:21\.228\.230|0\.85\.249)|2\.184\.172\.244|6\.193\.90\.26|9\.37\.195\.59)|9(?:8\.(?:24\.1(?:7(?:4\.16[67]|5\.[234]|3\.80)|80\.91)|50\.163\.(?:19[349]|205)|44\.0\.157)|(?:5\.252\.108|4\.106\.16)\.6|9\.30\.137\.10[67]|2\.163\.193\.199|0\.107\.140\.77)|2(?:1\.(?:(?:22\.127|88\.54)\.17|78\.119\.193)|4\.(?:248\.211\.20|160\.35\.)2|5\.(?:75\.235\.127|46\.24\.62)|2\.182\.28\.245)|7(?:3\.2(?:(?:00\.90\.19|32\.161\.3)6|12\.205\.158)|8\.2(?:13\.110\.115|0\.148\.11)|7\.1(?:84\.140\.222|\.223\.73))|0(?:1\.(?:15\.(?:254\.32|114\.8)|44\.3\.50)|3\.9\.157\.12[679]|6\.187\.102\.215)|4(?:1\.(?:255\.161\.102|0\.61\.166)|
8\.223\.59\.187|\.63\.74\.204)|62\.(?:216\.3\.1[45]|105\.25\.123)|\.(?:215\.206\.24|85\.17\.8)2|38\.91\.169\.163)|2(?:0(?:6\.214\.(?:71\.(?:4[123456789]|5[012345789]|3[45678]|6[012])|67\.(?:[29]|10))|2\.(?:1(?:(?:37\.22\.20|58\.39\.25)0|18\.236\.177|42\.203\.19)|71\.136\.200)|3\.(?:23(?:9\.45\.202|8\.95\.11)|171\.233\.243)|0\.(?:7(?:2\.11\.132|9\.27\.60)|51\.45\.180)|1\.(?:195\.239\.27|221\.132\.83)|8\.84\.135\.14[78]|7\.194\.87\.105)|1(?:1\.(?:1(?:19\.86\.1(?:4[3568]|96)|74\.120\.123|47\.211\.16)|232\.92\.23)|0\.(?:183\.179\.(?:39|45)|217\.56\.2|51\.23\.91)|3\.1(?:(?:71\.39\.15|95\.77\.11)4|32\.241\.13)|6\.155\.17\.(?:[489]|1[45])|8\.151\.141\.75|9\.147\.172\.2)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|04\.223\.38|34\.24\.46)|4\.142\.(?:9[01]|[45]1|67))|2\.1(?:12\.150\.58|22\.227\.10|74\.155\.19)|0\.68\.224\.45)|3\.229\.11\.26)|6(?:0\.(?:21(?:4\.223\.178|\.209\.150)|196\.58\.189)|9\.(?:198\.197\.156|64\.49\.109)|1\.14(?:3\.158\.24|1\.21\.3)4|5\.60\.15\.173|7\.90\.21\.150|8\.180\.96\.
1)|7(?:(?:2\.35\.20\.13|8\.31\.74\.21)1|4\.(?:216\.223\.8|86\.90\.24)2|5\.75\.225\.(?:10[01]|9[89]))|8(?:0\.(?:86\.88\.1(?:13|26)|73\.71\.248)|(?:3\.18\.234\.20|5\.25\.150\.16)2|2\.117\.194\.229)|9(?:3\.1(?:8(?:4\.71\.66|8\.8\.67)|59\.160\.164)|1\.218\.245\.(?:7[1245]|66)|7\.67\.218\.162)|37\.206\.210\.130|58\.213\.157\.68|41\.84\.135\.22)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.(?:22\.(?:1(?:7(?:7\.5[12]|2\.145)|97\.216|1\.23)|2(?:8\.22[12]|30\.213|28\.62)|53\.190)|82\.(?:1(?:79\.117|23\.85)|53\.143))|0\.1(?:66\.124\.90|78\.56\.138)|3\.(?:136\.128\.22|22\.156\.9)6|8\.(?:168\.46\.53|252\.0\.237)|9\.75\.63\.114)|1(?:8\.(?:1(?:30\.107\.235|75\.28\.3)|217\.180\.116|97\.196\.163|41\.157\.7)|2\.(?:184\.172\.244|220\.249\.20)|(?:4\.247\.23\.6|6\.193\.90\.2)6|5\.8(?:2\.242\.197|8\.119\.132)|3\.21\.228\.230|9\.37\.195\.59)|9(?:8\.(?:24\.1(?:7(?:4\.16[67]|5\.[234]|3\.80)|80\.91)|50\.163\.(?:19[349]|205)|44\.0\.157)|(?:5\.252\.108|4\.106\.16)\.6|9\.30\.137\.10[67]|2\.163\.193\.199|0\.107\.140\.77)|2(?:1\.(?:(?:22\.127|88\.54)\.17|78\.119\.193)|4\.(?:248\.211\.20|160\.35\.)2|5\.(?:75\.235\.127|46\.24\.62)|2\.182\.28\.245)|0(?:1\.(?:15\.(?:2(?:42\.159|54\.32)|114\.8)|44\.3\.50)|3\.9\.157\.12[679]|6\.187\.102\.215|9\.224\.20\.138)|7(?:3\.2(?:12\.205\.158|32\.161\.36)|8\.2(?:13\.110\.115|0\.148\.11)|7\.1(?:84\.
140\.222|\.223\.73))|4(?:1\.(?:255\.161\.102|0\.61\.166)|8\.223\.59\.187|\.63\.74\.204)|\.(?:2(?:15\.206\.242|34\.50\.245)|85\.17\.82)|62\.(?:216\.3\.1[45]|105\.25\.123)|38\.91\.169\.163)|2(?:0(?:2\.(?:1(?:(?:37\.22\.20|58\.39\.25)0|18\.236\.177|42\.203\.19)|71\.136\.200)|6\.214\.(?:71\.(?:5[012345789]|3[45678]|6[012])|67\.(?:[29]|10))|0\.(?:7(?:2\.11\.132|9\.27\.60)|51\.45\.180)|1\.(?:195\.239\.27|221\.132\.83)|3\.(?:171\.233\.243|238\.95\.11)|8\.84\.135\.14[78]|7\.194\.87\.105)|1(?:1\.(?:1(?:19\.86\.1(?:4[3568]|96)|74\.120\.123|47\.211\.16)|23(?:4\.106\.54|2\.92\.23))|3\.1(?:(?:71\.39\.15|95\.77\.11)4|32\.241\.13)|0\.(?:183\.179\.39|217\.56\.2|51\.23\.91)|6\.155\.17\.(?:[489]|1[45])|8\.151\.141\.75|9\.147\.172\.2)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|04\.223\.38|34\.24\.46)|4\.142\.(?:[59][01]|6[07]|41))|2\.(?:1(?:12\.150\.58|22\.227\.10|74\.155\.19)|234\.3\.151)|0\.68\.224\.45)|3\.229\.11\.26|4\.172\.17\.78)|6(?:1\.1(?:4(?:3\.158\.24|1\.21\.3)4|32\.229\.115)|9\.(?:198\.197\.156
|64\.49\.109)|0\.21(?:4\.223\.178|\.209\.150)|5\.60\.15\.173|7\.90\.21\.150|8\.180\.96\.1)|9(?:3\.1(?:8(?:4\.71\.66|8\.8\.67)|59\.160\.164)|1\.218\.245\.(?:7[1245678]|66|81)|7\.67\.218\.162)|8(?:0\.(?:86\.88\.1(?:13|26)|73\.71\.248)|(?:3\.18\.234\.20|5\.25\.150\.16)2|2\.117\.194\.229)|7(?:(?:2\.35\.20\.13|8\.31\.74\.21)1|5\.75\.225\.(?:10[01]|9[89])|7\.106\.232\.178)|41\.(?:84\.135\.22|137\.24\.4)|37\.206\.210\.130|58\.213\.157\.68)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|3\.56\.2(?:4[589]|5[01]|25)|5\.63\.(?:[89]|1[012345])|2\.215\.(?:6[34]|44)|0\.52\.[0123]|9\.36\.21[23])|8(?:3\.9(?:3\.(?:9[78]|115|69|84)|5\.6[67])|(?:2\.18\.22|8\.73\.25)2|6\.(?:123\.135|37\.203)|1\.66\.15[67])|0(?:3\.(?:2(?:0\.3[79]|8\.184)|30\.72|7\.243|1\.69|5\.27)|9\.127\.8[01])|9(?:0\.(?:113\.21[01]|234\.10[56])|7\.252\.[01])|7(?:7\.(?:47\.10|86\.4)6|3\.44\.232)|25\.(?:44\.24[01234567]|60\.156)|30\.193\.1(?:46|65)|42\.234\.186|63\.125\.144)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|03\.(?:19(?:4\.115|1\.27)|82\.81)|1(?:6\.155\.(?:20|54)|2\.34\.12)|3\.106\.71)|58\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|6[89])|19\.19[01])|4(?:1\.2(?:54\.[1258]|23\.161)|9\.0\.11[89])|79\.106\.109|85\.153\.71)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|2\.215\.(?:6[34]|44)|0\.52\.[0123]|9\.36\.21[23])|8(?:3\.9(?:3\.(?:11[45]|98)|5\.6[67])|(?:2\.18\.22|8\.73\.25)2|6\.(?:123\.135|37\.203)|1\.66\.15[67])|0(?:3\.(?:2(?:0\.3[79]|8\.184)|30\.72|1\.69|5\.27)|9\.127\.8[01])|9(?:0\.(?:113\.21[01]|234\.10[56])|7\.252\.[01])|7(?:7\.(?:47\.10|86\.4)6|3\.44\.232)|25\.(?:44\.24[012367]|60\.156)|30\.193\.1(?:46|65)|63\.125\.144)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|1(?:6\.155\.(?:20|54|63)|2\.34\.12)|03\.(?:19(?:4\.115|1\.27)|82\.81))|58\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|6[89])|19\.19[01])|4(?:1\.2(?:54\.[1258]|23\.161)|9\.0\.11[89])|79\.106\.109|85\.153\.71)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6