You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/09/03 08:57:57 UTC
svn commit: r1519584 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Tue Sep 3 06:57:57 2013
New Revision: 1519584
URL: http://svn.apache.org/r1519584
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1519584&r1=1519583&r2=1519584&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Tue Sep 3 06:57:57 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20130922
+## khop-sc-neighbors.cf v 20130932
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:4\.42\.13[78]|9\.184\.214|5\.71\.238)|9(?:5\.245\.118|8\.24\.175)|21\.54\.54|77\.5\.230)|2(?:1(?:7\.(?:219\.12|12\.11)3|8\.2\.129)|21\.214\.221|\.183\.155))\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:9\.184\.214|5\.71\.238)|9(?:5\.245\.118|8\.24\.175)|09\.228\.132|21\.54\.54|77\.5\.230)|21(?:2\.68\.44|8\.2\.129)|86\.111\.144|61\.55\.156)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:8\.244\.239|6\.112\.66)|4(?:\.139\.229|1\.0\.61)|25\.60\.156|76\.192\.15|87\.4\.111)|9(?:1\.233\.188|0\.150\.9)|61\.55\.156|82\.207\.51)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:8\.244\.239|6\.112\.66)|4(?:\.139\.229|1\.0\.61)|25\.60\.156|76\.192\.15|87\.4\.111|03\.20\.8)|9(?:1\.233\.188|0\.150\.9)|2\.183\.155|82\.207\.51)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:216\.(?:55\.162|86\.253|30\.50)|1(?:84\.172\.244|24\.15\.141))|8\.(?:2(?:17\.180\.116|44\.239\.2)|130\.107\.235|46\.127\.36)|6\.1(?:12\.(?:66\.102|5\.136)|24\.128\.138|93\.90\.26)|7\.(?:131\.158\.34|239\.107\.21)|9\.(?:184\.214\.18|201\.141\.81)|1\.(?:68\.104\.132|30\.77\.129)|4\.26\.128\.143|5\.71\.238\.141|3\.0\.85\.249)|9(?:0\.(?:107\.140\.77|221\.18\.114|82\.89\.156|0\.60\.238)|8\.24\.1(?:7(?:4\.16[67]|5\.[234]|3\.80)|80\.91)|(?:3\.255\.143\.|6\.3\.181\.1)62|2\.1(?:63\.193\.199|57\.58\.136)|5\.2(?:29\.106\.222|45\.118\.5)|4\.11\.24\.156)|8(?:4\.(?:22\.(?:1(?:77\.5[12]|1\.23)|2(?:30\.213|7\.171))|82\.214\.35)|3\.(?:136\.146\.110|98\.23\.158)|7\.(?:111\.255\.130|4\.111\.218)|0\.211\.179\.30|9\.3\.25\.146)|2(?:1\.(?:22\.(?:127\.17|34\.166)|78\.119\.193)|5\.(?:39\.163\.161|75\.235\.127)|4\.(?:42\.124\.136|207\.34\.91)|3\.234\.230\.45|8\.134\.37\.121)|4(?:\.(?:52\.137\.(?:54|77)|139\.229\.3[456]|33\.121\.67)|1\.(?:0\.61\
.16[56]|105\.65\.10)|8\.223\.59\.187)|7(?:3\.(?:200\.90\.196|44\.178\.104)|7\.(?:5\.230\.114|69\.8\.50)|6\.192\.15\.229|8\.20\.148\.11)|0(?:3\.9\.15(?:8\.1(?:47|81)|7\.126)|1\.1(?:0\.34\.153|5\.253\.4)|9\.228\.132\.146)|\.(?:2(?:2(?:0\.158\.3|6\.84\.27)|15\.206\.242)|93\.21\.147)|3(?:7\.1(?:16\.114\.52|35\.82\.99)|8\.91\.176\.45)|(?:51\.236\.192|68\.62\.178)\.146)|2(?:1(?:8\.(?:1(?:5(?:1\.141\.75|9\.9\.7)|48\.85\.130)|56\.(?:161\.14|37\.250)|4\.100\.252|2\.129\.53)|1\.1(?:7(?:2\.251\.168|4\.120\.123)|5(?:4\.151\.24|7\.114\.13)3|11\.250\.177)|2\.(?:144\.254\.122|247\.140\.71|68\.44\.194)|7\.(?:219\.123\.59|12\.113\.67)|3\.164\.18\.147|9\.239\.227\.81|0\.109\.97\.63)|2(?:2\.(?:7(?:4\.20(?:3\.194|0\.2)|3\.95\.48)|1(?:69\.224\.242|00\.140\.4)|200\.186\.18|92\.141\.155|35\.61\.196)|1\.214\.2(?:08\.226|21\.148)|0\.68\.224\.45)|0(?:2\.(?:1(?:29\.52\.94|0\.42\.73)|29\.241\.33)|1\.1(?:8\.(?:107\.234|95\.158)|16\.199\.34)|0\.(?:142\.133\.21|222\.4\.90)|3\.156\.250\.101)|\.183\.155\.2)|6(?:1\.
(?:1(?:75\.223\.1(?:3[49]|4[12])|33\.125\.162|66\.55\.153|81\.252\.6)|238\.148\.161|55\.156\.210|32\.38\.3)|0\.(?:19(?:0\.43\.1[04]|1\.142\.233|6\.58\.189)|29\.(?:15\.194|75\.142))|4\.(?:1(?:81\.43\.79|91\.34\.51|4\.85\.2)|71\.156\.216)|9\.(?:198\.197\.156|64\.49\.109)|2\.141\.37\.85|5\.60\.15\.184|7\.90\.21\.150)|9(?:3\.1(?:59\.1(?:60\.164|91\.246)|23\.54\.138|84\.71\.66)|1\.2(?:1(?:2\.124\.153|0\.0\.226)|33\.188\.154)|5\.(?:78\.123\.159|159\.105\.2)|0\.(?:83\.184\.211|150\.9\.38)|4\.77\.199\.148)|5(?:8\.(?:1(?:43\.131\.79|50\.97\.242)|215\.176\.(?:109|210))|9\.(?:1(?:1\.237\.151|51\.37\.8|2\.17\.6)|8\.26\.22)|4\.216\.223\.122)|8(?:(?:3\.238\.208\.5|4\.17\.27\.24|0\.240\.35\.)5|2\.(?:207\.51\.92|99\.246\.10)|6\.111\.144\.194|7\.103\.197\.93)|4(?:1\.(?:2(?:08\.150\.116|26\.11\.117)|137\.24\.4)|2\.12(?:1\.118\.123|0\.18\.118)|9\.248\.113\.50)|7(?:(?:8\.141\.67\.15|2\.35\.20\.13)1|9\.1(?:74\.204\.13|42\.176\.2)4|4\.216\.223\.82)|3(?:7\.1(?:59\.192\.162|23\.98\.115)|6\.237\.212\.172))\
b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:1(?:84\.172\.244|24\.15\.141|70\.181\.99)|216\.86\.253|90\.222\.134)|8\.(?:2(?:17\.180\.116|44\.239\.2)|130\.107\.235|46\.127\.36)|6\.1(?:12\.(?:66\.102|5\.136)|24\.128\.138|93\.90\.26)|(?:0\.164\.70\.21|5\.71\.238\.14)1|7\.(?:131\.158\.34|239\.107\.21)|9\.(?:184\.214\.18|201\.141\.81)|1\.(?:68\.104\.132|30\.77\.129)|3\.0\.85\.249)|9(?:5\.(?:2(?:29\.106\.222|45\.118\.5)|138\.195\.125)|8\.24\.1(?:7(?:4\.16[67]|5\.[234]|3\.80)|80\.91)|0\.(?:107\.140\.77|221\.18\.114|0\.60\.238)|(?:3\.255\.143\.|6\.3\.181\.1)62|2\.1(?:63\.193\.199|57\.58\.136)|4\.11\.24\.156)|8(?:4\.(?:22\.(?:1(?:77\.5[12]|1\.23)|2(?:30\.213|7\.171))|82\.214\.35)|3\.(?:1(?:36\.146\.110|01\.38\.202)|98\.23\.158)|7\.(?:111\.255\.130|4\.111\.218)|0\.211\.179\.30|9\.3\.25\.146)|2(?:1\.(?:22\.(?:127\.17|34\.166)|78\.119\.193|88\.255\.202)|4\.(?:42\.124\.136|207\.34\.91)|3\.234\.230\.45|5\.75\.235\.127|8\.134\.37\.121)|4(?:\.(?:(?:52\.137\.5|63\.74\.20)4|139\.22
9\.3[456]|33\.121\.67)|1\.(?:0\.61\.16[56]|105\.65\.10)|8\.223\.59\.187)|7(?:7\.(?:39\.193\.109|5\.230\.114|69\.8\.50)|3\.(?:200\.90\.196|44\.178\.104)|6\.192\.15\.229|8\.20\.148\.11)|0(?:3\.9\.15(?:8\.1(?:47|81)|7\.126)|1\.1(?:0\.34\.153|5\.253\.4)|9\.228\.132\.146)|\.(?:22(?:0\.158\.3|6\.84\.27)|93\.21\.147)|3(?:7\.116\.114\.52|8\.91\.176\.45)|(?:51\.236\.192|68\.62\.178)\.146)|2(?:1(?:1\.(?:1(?:7(?:2\.251\.168|4\.120\.123)|5(?:4\.151\.24|7\.114\.13)3|1(?:1\.250\.177|8\.37\.56))|232\.154\.6)|8\.(?:1(?:5(?:1\.141\.75|9\.9\.7)|48\.85\.130)|4\.100\.252|56\.161\.14|2\.129\.53)|2\.(?:144\.254\.122|247\.140\.71|68\.44\.194)|3\.1(?:64\.18\.147|95\.77\.114)|7\.(?:219\.123\.59|12\.113\.67)|9\.239\.227\.81|0\.109\.97\.63)|2(?:2\.(?:1(?:69\.224\.242|00\.140\.4)|2(?:00\.186\.1|31\.33\.3)8|74\.20(?:3\.194|0\.2)|92\.141\.155|35\.61\.196)|1\.214\.2(?:08\.226|21\.148)|0\.68\.224\.45)|0(?:0\.(?:1(?:42\.133\.21|75\.56\.190)|72\.11\.132|222\.4\.90)|2\.(?:129\.52\.94|29\.241\.33)|1\.1(?:16\.199\.|8\.
107\.2)34|8\.98\.25\.183)|\.183\.155\.2)|6(?:1\.(?:1(?:75\.223\.1(?:3[49]|4[12])|33\.125\.162|66\.55\.153|81\.252\.6)|238\.148\.161|55\.156\.210)|0\.(?:19(?:0\.43\.1[04]|1\.142\.233|6\.58\.189)|29\.(?:15\.194|75\.142))|4\.(?:1(?:81\.43\.79|91\.34\.51|4\.85\.2)|71\.156\.216)|9\.(?:198\.197\.156|64\.49\.109)|5\.(?:125\.155\.90|60\.15\.184)|2\.141\.37\.85|7\.90\.21\.150)|9(?:1\.2(?:1(?:2\.124\.153|0\.0\.226)|33\.188\.154)|5\.(?:1(?:59\.105\.2|30\.9\.89)|78\.123\.159)|3\.1(?:59\.1(?:60\.164|91\.246)|23\.54\.138)|0\.(?:83\.184\.211|150\.9\.38)|4\.77\.199\.148)|8(?:3\.(?:167\.231\.43|238\.208\.55)|(?:4\.17\.27\.24|0\.240\.35\.)5|2\.(?:207\.51\.92|99\.246\.10)|6\.111\.144\.194|7\.103\.197\.93)|5(?:8\.(?:1(?:43\.131\.79|50\.97\.242)|215\.176\.(?:109|210))|9\.(?:1(?:1\.237\.151|51\.37\.8)|8\.26\.22)|4\.216\.223\.122)|7(?:(?:8\.141\.67\.15|2\.35\.20\.13)1|9\.1(?:74\.204\.13|42\.176\.2)4|4\.216\.223\.82)|4(?:2\.12(?:1\.118\.123|0\.18\.118)|1\.(?:226\.11\.117|137\.24\.4)|9\.248\.113\.50)|37\.1(
?:59\.192\.162|23\.98\.115))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|3\.(?:56\.2(?:4[589]|5[01]|25)|18(?:7\.1[67]|5\.6))|5\.(?:63\.(?:[89]|1[012345])|58\.135)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|4\.1(?:08\.2(?:03|14)|34\.189)|2\.215\.(?:6[34]|44)|0\.52\.[0123]|9\.36\.21[23])|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|6\.(?:123\.135|37\.203)|8\.(?:165\.168|73\.252)|1\.66\.15[67]|2\.18\.222)|2(?:5\.(?:44\.24[134567]|60\.156)|(?:1\.54\.[45]|2\.155\.4)4|3\.(?:136\.106|30\.165)|4\.107\.127)|9(?:0\.(?:113\.2(?:1[01]|09)|234\.10[56])|7\.2(?:5(?:2\.[01]|4\.224)|16\.21))|0(?:3\.(?:2(?:0\.(?:37|8)|8\.184)|30\.72|1\.69|5\.27)|9\.127\.8[016])|7(?:3\.232\.19|7\.47\.106)|30\.193\.1(?:46|65)|42\.234\.186)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:2\.(?:29\.17[67]|153\.84)|3\.(?:82\.8[17]|194\.115))|1(?:3\.(?:143\.[56]0|55\.105)|2\.34\.12)|22\.140\.157|\.179\.211)|5(?:8\.(?:50\.
(?:1(?:[2345]|0[456789]|1[016789])|69|70)|19\.19[01])|9\.(?:55\.254|99\.136))|4(?:1\.2(?:54\.[1258]|23\.161)|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|3\.(?:56\.2(?:4[589]|5[01]|25)|18(?:7\.1[67]|5\.6))|5\.(?:63\.(?:[89]|1[012345])|58\.135)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|4\.1(?:08\.2(?:03|14)|34\.189)|2\.215\.(?:6[34]|44)|0\.52\.[0123]|9\.36\.21[23])|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|6\.(?:123\.135|37\.203)|8\.(?:165\.168|73\.252)|1\.66\.15[67]|2\.18\.222)|2(?:5\.(?:44\.24[134567]|60\.156)|(?:1\.54\.[45]|2\.155\.4)4|3\.(?:136\.106|30\.165)|4\.107\.127)|9(?:0\.(?:113\.2(?:1[01]|09)|234\.10[56])|7\.2(?:5(?:2\.[01]|4\.224)|16\.21))|0(?:3\.(?:2(?:0\.(?:37|8)|8\.184)|30\.72|1\.69|5\.27)|9\.127\.8[016])|7(?:3\.232\.19|7\.47\.106)|30\.193\.1(?:46|65)|42\.234\.186)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:2\.(?:29\.17[67]|153\.84)|3\.(?:82\.8[17]|194\.115))|1(?:3\.(?:55\.1[01]5|143\.50)|2\.34\.12)|22\.140\.15[79])|5(?:8\.(?:50\.(?:1(?:[
2345]|0[456789]|1[016789])|70)|19\.19[01])|9\.(?:55\.25[45]|99\.136))|4(?:1\.2(?:23\.16[01]|54\.[1258])|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6