You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/06/20 08:57:18 UTC
svn commit: r1494875 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Thu Jun 20 06:57:18 2013
New Revision: 1494875
URL: http://svn.apache.org/r1494875
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1494875&r1=1494874&r2=1494875&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Thu Jun 20 06:57:18 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201306192
+## khop-sc-neighbors.cf v 201306202
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -20,7 +20,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:9[35]|117|2)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|9[35])(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -39,7 +39,7 @@ score KHOP_SC_CIDR8 0.3 0.1 0.3 0.1
# 12.1449/0.0139 0.999 20100410 net, solo=12.1966/0.0197@0.998, ->.2 .1 .3 .2
# 10.3554/0.0112 0.999 20110227@510k solo=10.3717/0.0119@0.999, ->.3 .1 .3 .1
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|86|90)|37)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|90)|37|2)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -92,7 +92,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:1\.101\.152|3\.9\.158)|(?:15\.88\.11|84\.82\.2)9|74\.37\.167)|6(?:1\.(?:252\.138|70\.83)|4\.250\.118)|2(?:09\.144\.27|20\.94\.235)|78\.138\.101)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:3\.192\.14[17]|4\.37\.148)|0(?:1\.101\.152|3\.9\.158)|92\.119\.66|84\.82\.29)|209\.144\.27|78\.138\.101|61\.70\.83)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -111,7 +111,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:5\.60\.156|0\.84\.13)|10\.52\.[02]|73\.192\.141|03\.9\.158|58\.255\.2)|2(?:0(?:8\.(?:71\.172|82\.114)|9\.223\.35)|1(?:3\.230\.128|2\.48\.64))|6(?:6\.199\.224|5\.60\.15))\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:8\.(?:71\.172|82\.114)|9\.223\.35)|1(?:3\.230\.128|2\.48\.64))|1(?:10\.52\.[02]|25\.60\.156|74\.37\.167|84\.82\.120)|6(?:6\.199\.224|5\.60\.15)|50\.97\.3)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -129,7 +129,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:21(?:6\.(?:1(?:81\.110|02\.98)|8\.158)|7\.228\.234)|1(?:04\.189\.110|64\.62\.8|86\.16\.5))|0\.(?:45\.(?:1(?:36\.181|40\.89)|244\.(?:4[04]|54))|165\.125\.152)|8\.(?:1(?:14\.77\.116|71\.95\.234)|97\.196\.163)|5\.(?:88\.(?:119\.132|247\.131)|22\.80\.197)|9\.19(?:7\.181\.120|2\.252\.1|3\.93\.25)|4\.207\.113\.55|3\.0\.85\.249|7\.6\.128\.27)|8(?:8\.(?:1(?:27\.230\.28|68\.46\.53)|252\.0\.237)|0\.2(?:11\.1(?:62\.254|79\.30)|25\.131\.176)|(?:3\.81\.152\.22|9\.39\.35\.16)8|4\.82\.(?:29\.3[34]|120\.210)|6\.(?:237\.41\.56|6\.224\.69)|7\.120\.127\.27)|9(?:5\.(?:1(?:38\.195\.125|91\.184\.82)|29\.81\.30)|9\.(?:30\.137\.13[89]|255\.11\.29)|2\.187\.10(?:1\.125|2\.212)|8\.50\.164\.21[89]|3\.164\.254\.3|4\.106\.16\.6)|7(?:4\.3(?:7\.1(?:67\.1(?:03|11|22)|48\.77)|6\.16(?:0\.157|4\.184|7\.116))|3\.192\.14(?:4\.105|7\.114|1\.99)|8\.20(?:7\.158\.230|\.148\.11))|2(?:1\.(?:1(?:34\.238\.129|81\.251\.188|57\.3\.252)|22\.127\.17)|2\.165\.22
5\.177|3\.201\.60\.83)|0(?:3\.9\.15(?:7\.181|8\.147)|9\.236\.89\.141)|5(?:8\.255\.2\.6[49]|1\.84\.131\.107)|38\.91\.88\.93)|2(?:0(?:8\.(?:71\.172\.(?:8[456789]|9[1234])|82\.114\.(?:4[4579]|5[179])|113\.254\.39)|0\.(?:14(?:8\.125\.247|2\.133\.21)|7(?:2\.11\.132|9\.27\.60)|94\.77\.1)|2\.(?:1(?:58\.(?:39\.250|52\.84)|42\.203\.19)|71\.136\.200)|9\.(?:2(?:23\.35\.20[23456]|39\.114\.172)|144\.27\.22[689])|3\.(?:255\.15\.146|155\.102\.2)|6\.217\.105\.67|1\.45\.114\.3)|1(?:8\.(?:1(?:45\.135\.137|64\.18\.225)|234\.108\.13)|3\.(?:1(?:71\.39\.154|32\.241\.7)|230\.128\.226)|1\.(?:(?:147\.211\.1|232\.154\.)6|33\.121\.231)|0\.(?:2(?:10\.123\.47|45\.89\.69)|56\.23\.100)|7\.(?:1(?:49\.52\.12|98\.3\.238)|200\.184\.87)|9\.(?:145\.110\.118|80\.238\.185)|2\.(?:48\.64\.14|6\.152\.21)1)|2(?:2\.(?:2(?:53\.182\.139|36\.16\.14)|161\.201\.132|99\.202\.239)|1\.(?:214\.208\.226|143\.50\.219)|0\.94\.235\.200)|4\.127\.201\.172)|6(?:1\.(?:2(?:52\.138\.195|31\.19\.112)|(?:164\.42\.1|70\.83\.)58|38\.186\.11
7|98\.131\.141|57\.65\.125)|6\.(?:199\.224\.(?:[68]|1[02345679]|2[01])|84\.49\.9)|4\.250\.118\.15[23]|9\.61\.206\.162|5\.60\.15\.184|8\.115\.192\.7)|8(?:3\.(?:18\.234\.202|3\.103\.227)|1\.(?:15\.172\.14|23\.106\.7)5|8\.250\.233\.164|6\.64\.171\.198|4\.22\.61\.190|7\.97\.215\.67)|5(?:9\.1(?:(?:20\.213\.3|5\.76\.9)7|0\.7\.16)|\.(?:135\.51\.214|200\.9\.231)|8\.232\.221\.43|0\.97\.3\.89)|9(?:5\.(?:48\.24\.10|86\.4\.79)|2\.253\.123\.95|4\.189\.183\.70|1\.214\.83\.2|3\.188\.8\.67)|3(?:7\.(?:(?:206\.210\.13|46\.224\.25)0|122\.2(?:08\.169|11\.100))|1\.13\.211\.28)|7(?:6\.74\.186\.237|8\.138\.101\.14|2\.35\.20\.131|4\.9\.203\.186)|4(?:6\.182\.24\.130|1\.137\.24\.4))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:21(?:6\.(?:1(?:81\.110|02\.98)|8\.158)|7\.228\.234)|1(?:6(?:8\.218\.86|4\.62\.8)|04\.189\.110))|0\.(?:45\.(?:1(?:36\.181|40\.89)|244\.(?:4[04]|54))|165\.125\.152)|5\.(?:88\.(?:119\.132|247\.131)|79\.205\.84|90\.96\.85)|8\.(?:1(?:14\.77\.116|71\.95\.234)|97\.196\.163)|9\.19(?:7\.181\.120|2\.252\.1|3\.93\.25)|(?:3\.0\.85\.24|4\.27\.94\.2)9|7\.(?:218\.55\.70|6\.128\.27))|8(?:8\.(?:1(?:27\.230\.28|68\.46\.53)|252\.0\.237)|0\.2(?:11\.1(?:62\.254|79\.30)|25\.131\.176)|9\.(?:195\.215\.90|39\.35\.168)|4\.82\.(?:29\.3[34]|120\.210)|6\.(?:237\.41\.56|6\.224\.69)|3\.81\.152\.228|7\.120\.127\.27)|7(?:4\.3(?:7\.1(?:67\.1(?:03|11|22)|48\.77)|6\.16(?:0\.157|4\.184|7\.116))|8\.(?:20(?:7\.158\.230|\.148\.11)|163\.105\.52)|3\.192\.14(?:4\.105|7\.114|1\.99)|7\.(?:1\.223\.73|37\.4\.146))|9(?:5\.(?:1(?:38\.195\.125|91\.184\.82)|29\.81\.30)|9\.(?:30\.137\.13[89]|255\.11\.29)|8\.50\.164\.21[89]|2\.187\.101\.125|4\.106\.16\.6)|2(?:1\.(
?:1(?:34\.238\.129|81\.251\.188|57\.3\.252)|22\.127\.17)|(?:3\.201\.60\.8|0\.50\.86\.)3|2\.165\.225\.177)|03\.9\.15(?:7\.181|8\.147)|58\.255\.2\.6[49]|38\.91\.88\.93)|2(?:1(?:3\.(?:2(?:11\.148\.159|30\.128\.226)|1(?:71\.39\.154|32\.241\.7))|0\.(?:2(?:10\.123\.47|45\.89\.69)|5(?:1\.44\.199|6\.23\.100))|8\.(?:1(?:45\.135\.137|53\.247\.68|64\.18\.225)|234\.108\.13)|1\.(?:1(?:47\.211\.16|76\.61\.112)|33\.121\.231)|7\.(?:1(?:49\.52\.12|98\.3\.238)|200\.184\.87)|9\.(?:145\.110\.118|80\.238\.185)|2\.(?:48\.64\.14|6\.152\.21)1)|0(?:8\.(?:71\.172\.(?:8[456789]|9[01234])|82\.114\.(?:4[4579]|51)|113\.254\.39)|0\.(?:14(?:8\.125\.247|2\.133\.21)|7(?:2\.11\.132|9\.27\.60)|94\.77\.1)|2\.(?:1(?:58\.(?:39\.250|52\.84)|42\.203\.19)|71\.136\.200)|9\.(?:2(?:23\.35\.20[23456]|39\.114\.172)|144\.27\.22[689])|3\.(?:255\.15\.146|155\.102\.2)|1\.45\.114\.3)|2(?:2\.(?:2(?:53\.182\.139|36\.16\.14)|161\.201\.132|99\.202\.239)|1\.214\.208\.226|0\.94\.235\.200))|6(?:1\.(?:2(?:52\.138\.195|31\.19\.112)|(?
:164\.42\.1|70\.83\.)58|38\.186\.117|98\.131\.141|57\.65\.125)|6\.(?:199\.224\.(?:1[0245679]|2[01]|8)|84\.49\.9)|9\.61\.206\.162|5\.60\.15\.184|8\.115\.192\.7)|8(?:3\.(?:18\.234\.202|3\.103\.227)|1\.(?:15\.172\.14|23\.106\.7)5|8\.250\.233\.164|6\.64\.171\.198|4\.22\.61\.190|7\.97\.215\.67)|5(?:9\.1(?:(?:20\.213\.3|5\.76\.9)7|0\.7\.16)|8\.(?:232\.221\.43|62\.113\.251)|\.(?:135\.51\.214|200\.9\.231)|0\.97\.3\.89)|3(?:7\.(?:(?:206\.210\.13|46\.224\.25)0|122\.2(?:08\.169|11\.100))|6\.229\.224\.79|1\.13\.211\.28)|9(?:5\.(?:48\.24\.10|86\.4\.79)|4\.189\.183\.70|1\.214\.83\.2|3\.188\.8\.67)|7(?:8\.138\.101\.1[04]|6\.74\.186\.237|2\.35\.20\.131|4\.9\.203\.186)|4(?:6\.182\.24\.130|1\.137\.24\.4))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work