You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/10/23 08:58:17 UTC
svn commit: r1534926 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Oct 23 06:58:17 2013
New Revision: 1534926
URL: http://svn.apache.org/r1534926
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1534926&r1=1534925&r2=1534926&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Oct 23 06:58:17 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201310222
+## khop-sc-neighbors.cf v 201310232
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:12\.90\.(?:222|37)|84\.22\.17[27]|75\.96\.188|03\.9\.157)|(?:31\.192\.10|58\.254\.16)8|9(?:1\.214\.131|8\.143\.158)|222\.122\.227|64\.79\.99)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:8\.24\.173|4\.105\.9)|12\.9(?:0\.37|7\.24)|84\.22\.17[27]|42\.11\.195|03\.9\.157)|58\.254\.1(?:68|72)|31\.192\.108|91\.214\.131)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:78\.124\.1(?:1[1234589]|0[456789]|21)|9(?:8\.24\.17[345]|4\.105\.9)|2(?:5\.60\.156|0\.84\.13)|03\.243\.50|12\.97\.24)|2(?:13\.132\.241|21\.4\.142)|86\.57\.18[68]|31\.192\.108|58\.254\.172|91\.218\.245)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:78\.124\.1(?:0[4789]|1[123])|9(?:8\.24\.17[45]|9\.96\.83)|0(?:3\.243\.50|9\.169\.88)|2(?:5\.60\.156|0\.84\.13)|42\.11\.195|12\.97\.24)|2(?:13\.132\.241|21\.4\.142)|(?:31\.192\.10|86\.57\.18)8|91\.218\.245|64\.79\.99)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:16(?:1\.232\.157|8\.218\.86)|217\.161\.3)|8\.(?:(?:97\.196\.16|41\.157\.)3|130\.107\.235)|4\.(?:3(?:2\.177\.77|3\.22\.29)|247\.23\.66)|9\.(?:110\.108\.92|42\.147\.114)|6\.(?:193\.90\.26|48\.159\.51)|5\.82\.24(?:6\.172|1\.34))|9(?:8\.(?:2(?:4\.1(?:7(?:(?:8\.13|3\.8)0|4\.16[37]|5\.[234])|80\.91)|7\.111\.103)|98\.112\.(?:18|2)7|49\.73\.123)|(?:9\.193\.252\.12|0\.107\.140\.7)7|5\.(?:138\.195\.125|252\.108\.6)|4\.10(?:5\.9\.85|6\.16\.6))|8(?:4\.(?:22\.(?:1(?:7(?:2\.14[45]|7\.51)|97\.216|1\.23|52\.8)|230\.213|53\.190)|82\.1(?:79\.117|23\.85))|3\.(?:106\.116\.109|98\.75\.72)|8\.(?:168\.46\.53|252\.0\.237)|9\.38\.248\.41)|2(?:1\.(?:2(?:54\.171\.143|2\.127\.17)|88\.54\.17)|5\.(?:143\.97\.97|46\.24\.62)|2\.182\.28\.245)|7(?:3\.2(?:12\.205\.158|00\.90\.196)|5\.96\.18(?:0\.175|8\.83)|4\.142\.53\.251|7\.69\.8\.50)|0(?:3\.(?:243\.50\.5[0468]|9\.157\.12[679])|1\.44\.3\.50)|4(?:0\.198\.75\.131|8\.223\.59\.187|1\.0\.61\.166)|38\.91\.158
\.85|\.215\.206\.242)|2(?:0(?:2\.(?:1(?:(?:29\.216\.6|37\.22\.20|58\.39\.25)0|42\.203\.19)|71\.136\.200|82\.202\.228|234\.40\.41|53\.13\.187)|3\.(?:2(?:3(?:9\.45\.202|8\.95\.11)|46\.196\.33)|171\.233\.243)|0\.(?:7(?:2\.11\.132|9\.27\.60)|51\.45\.180)|1\.1(?:16\.199\.34|95\.239\.27))|1(?:1\.(?:1(?:7(?:4\.120\.123|6\.76\.198)|47\.211\.16)|23(?:0\.74\.17|7\.20\.39))|0\.(?:1(?:83\.179\.45|7\.248\.78)|2(?:45\.89\.69|17\.56\.2)|56\.23\.100)|3\.1(?:(?:71\.39\.15|95\.77\.11)4|32\.241\.13)|8\.(?:151\.141\.75|75\.153\.156)|6\.189\.101\.110)|2(?:2\.(?:1(?:22\.(?:227\.10|79\.103)|00\.140\.4)|23(?:2\.130\.101|9\.255\.70))|1\.(?:2(?:14\.208\.22|34\.24\.4)6|4\.142\.(?:5[678]|41)|153\.158\.37)|0\.(?:6(?:8\.224\.45|7\.90\.31)|128\.138\.245)))|9(?:1\.218\.245\.(?:8[0356789]|7[012678]|6[6789]|9[0234])|3\.1(?:59\.160\.164|88\.8\.67)|8\.143\.158\.4[69]|0\.83\.184\.211)|6(?:1\.(?:1(?:35\.130\.240|9\.246\.93)|222\.113\.196)|(?:0\.190\.216|9\.198\.197)\.156|6\.197\.225\.203|7\.90\.21\.150)|7(?:(?:6\.164\.1
99\.7|2\.35\.20\.13)1|(?:7\.106\.232\.1|8\.29\.4\.)78|4\.(?:216\.223\.82|93\.63\.149))|8(?:1\.(?:144\.152\.51|23\.106\.75)|2\.117\.194\.229|7\.106\.173\.115|3\.3\.103\.227)|3(?:1\.192\.108\.1(?:5[01234789]|[34]\d|6[01])|7\.123\.98\.115)|5(?:9\.12(?:5\.116\.144|4\.115\.88)|8\.254\.172\.177)|41\.137\.24\.4)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:8\.(?:2(?:4\.1(?:7(?:4\.16[37]|5\.[234]|3\.80)|80\.91)|7\.111\.103)|49\.73\.123)|9\.(?:30\.137\.1[67]|96\.83\.13[01]|193\.252\.127)|5\.(?:138\.195\.125|252\.108\.6)|4\.10(?:5\.9\.85|6\.16\.6)|0\.107\.140\.77)|1(?:8\.(?:(?:97\.196\.16|41\.157\.)3|130\.107\.235)|5\.8(?:2\.24(?:6\.172|1\.34)|8\.119\.132)|2\.(?:168\.218\.86|217\.161\.3)|9\.(?:42\.147\.114|37\.195\.59)|4\.(?:247\.23\.66|33\.22\.29)|6\.48\.159\.51)|8(?:4\.(?:22\.(?:1(?:7(?:2\.14[145]|7\.51)|97\.216|1\.23|52\.8)|230\.213|53\.190)|82\.1(?:79\.117|23\.85))|8\.(?:168\.46\.53|252\.0\.237)|3\.106\.116\.109|9\.38\.248\.41)|7(?:3\.2(?:12\.205\.158|00\.90\.196)|7\.(?:1\.223\.73|69\.8\.50)|5\.96\.18(?:0\.175|8\.83)|4\.142\.53\.251)|0(?:3\.(?:243\.50\.5[0468]|9\.157\.12[679])|9\.169\.88\.136|1\.44\.3\.50)|2(?:5\.(?:143\.97\.97|46\.24\.62)|2\.182\.28\.245|1\.88\.54\.17)|4(?:0\.198\.75\.131|8\.223\.59\.187|1\.0\.61\.166|\.63\.74\.204)|38\.91\.158\.85|\.215\.206\.242)|2(?:1(?:1\
.(?:1(?:7(?:4\.120\.123|6\.76\.198)|47\.211\.16)|23(?:4\.106\.54|0\.74\.17|7\.20\.39))|0\.(?:1(?:83\.179\.45|7\.248\.78)|2(?:45\.89\.69|17\.56\.2)|56\.23\.100)|3\.1(?:(?:71\.39\.15|95\.77\.11)4|32\.241\.13)|6\.(?:189\.101\.110|231\.140\.15)|8\.151\.141\.75|7\.96\.37\.18)|0(?:2\.(?:1(?:(?:29\.216\.6|58\.39\.25)0|42\.203\.19)|71\.136\.200|82\.202\.228|234\.40\.41|53\.13\.187)|3\.(?:2(?:3(?:9\.45\.202|8\.95\.11)|46\.196\.33)|171\.233\.243)|0\.(?:(?:175\.56\.19|51\.45\.18)0|7(?:2\.11\.132|9\.27\.60))|1\.1(?:16\.199\.34|95\.239\.27))|2(?:2\.(?:1(?:12\.150\.58|22\.227\.10|00\.140\.4)|239\.255\.70)|1\.(?:2(?:14\.208\.22|34\.24\.4)6|4\.142\.(?:5[678]|41))|0\.67\.90\.31))|6(?:1\.(?:1(?:35\.130\.240|9\.246\.93)|222\.113\.196)|4\.79\.(?:99\.16[012345678]|107\.13)|9\.198\.197\.156|7\.90\.21\.150)|9(?:1\.218\.245\.(?:7[012378]|8[03789]|6[6789]|9[234])|3\.1(?:59\.160\.164|88\.8\.67)|0\.83\.184\.211|8\.143\.158\.49)|8(?:1\.(?:144\.152\.51|23\.106\.75)|3\.(?:238\.208\.55|3\.103\.227)|2\.117\.194\.2
29|7\.106\.173\.115)|7(?:(?:6\.164\.199\.7|2\.35\.20\.13)1|4\.(?:216\.223\.82|92\.74\.230)|8\.29\.4\.78)|3(?:1\.192\.108\.1(?:3[013456789]|5[01234789]|6[01]|4\d)|7\.123\.98\.115)|59\.12(?:5\.116\.144|4\.115\.88)|41\.137\.24\.4)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|0\.(?:205\.3[34]|52\.[0123])|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|2\.215\.(?:6[34]|44)|9\.36\.21[23])|0(?:3\.(?:2(?:4(?:0\.(?:117|252)|2\.7)|6\.29)|7\.243|5\.27)|9\.127\.8[01])|2(?:5\.(?:44\.24[01234567]|60\.156)|3\.(?:136\.10|6\.13)6)|8(?:3\.9(?:3\.(?:11[45]|98)|5\.6[67])|1\.66\.15[67])|7(?:3\.44\.1(?:68|81)|7\.36\.22)|9(?:0\.234\.10[56]|8\.50\.174)|30\.193\.165)|2(?:7\.20\.(?:[689]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|1(?:6\.155\.(?:20|54|63)|1\.91\.22[01]|2\.34\.12))|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|6[89]|7[01])|19\.19[01])|9\.55\.25[2345])|41\.254\.[258]|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|0\.(?:205\.3[345]|52\.[0123])|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|2\.215\.(?:6[34]|44)|9\.36\.21[23])|0(?:3\.(?:2(?:4(?:0\.(?:117|252)|2\.7)|6\.29)|7\.243|5\.27)|9\.127\.8[01])|8(?:3\.9(?:3\.(?:11[45]|98)|5\.6[67])|1\.66\.15[67])|2(?:5\.(?:44\.24[01234567]|60\.156)|3\.136\.106)|7(?:3\.44\.1(?:68|81)|7\.36\.22)|9(?:0\.234\.10[56]|8\.50\.174)|30\.193\.1(?:46|65))|2(?:7\.20\.(?:[6789]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]?|5[6789])|1(?:1\.91\.22[01]|6\.155\.54|2\.34\.12))|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|6[89]|7[01])|19\.19[01])|9\.55\.25[2345])|41\.254\.[258]|79\.106\.109)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6