You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/10/18 08:58:33 UTC
svn commit: r1533337 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Fri Oct 18 06:58:33 2013
New Revision: 1533337
URL: http://svn.apache.org/r1533337
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1533337&r1=1533336&r2=1533337&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Fri Oct 18 06:58:33 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201310172
+## khop-sc-neighbors.cf v 201310182
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -81,7 +81,7 @@ score KHOP_SC_CIDR16 0.4 0.1 0.4 0.1
# crap, still empty 20130629@465k net
# crap, still empty 20130705@376k net. lowering for low vol -> .4 .1 .4 .1
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b89\.121(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /___ FAILED TO POPULATE ___/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0.3
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:(?:84\.22\.17|03\.9\.15)7|12\.9(?:0\.37|7\.24)|75\.96\.18[08]|62\.210\.250|98\.24\.178|21\.54\.54)|(?:217\.118\.8|91\.214\.13)1|58\.254\.1(?:68|72))\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:(?:12\.97\.2|21\.54\.5)4|75\.96\.18[08]|98\.24\.17[38]|84\.22\.177|41\.0\.61)|2(?:17\.118\.81|21\.4\.142)|58\.254\.1(?:68|72)|91\.214\.131)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:78\.124\.1(?:0[456789]|2[123456]|1\d)|2(?:5\.60\.156|0\.84\.13)|98\.24\.17[45]|57\.250\.81|84\.22\.172|12\.97\.24)|9(?:1\.2(?:18\.245|35\.142)|3\.119\.105|8\.143\.158)|2(?:13\.132\.241|21\.4\.142)|86\.57\.18[46789]|31\.192\.108)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:78\.124\.1(?:2[1234567]|0[456789]|1\d)|2(?:5\.60\.156|0\.84\.13)|98\.24\.17[45]|62\.210\.250|84\.22\.172|12\.97\.24)|9(?:1\.2(?:18\.245|35\.142)|3\.119\.105|8\.143\.158)|86\.57\.1(?:8[456789]|90)|213\.132\.241|31\.192\.108)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:2(?:20\.(?:2(?:24\.59|49\.20)|31\.132)|1(?:7\.228\.234|6\.46\.75))|1(?:61\.232\.157|84\.172\.244))|8\.(?:130\.107\.235|97\.196\.163)|9\.(?:192\.255\.129|201\.16\.211)|4\.(?:247\.23\.66|32\.177\.77)|6\.193\.90\.26|0\.10\.12\.98)|8(?:4\.22\.(?:1(?:7(?:2\.14[145]|7\.5[12])|97\.216|1\.23|52\.8)|2(?:30\.213|28\.62)|53\.190)|3\.(?:10(?:6\.1(?:45\.24|50\.78)|0\.193\.8)|98\.75\.72)|8\.2(?:40\.221\.12|52\.0\.237)|9\.38\.248\.41)|7(?:7\.(?:80\.107\.115|1\.223\.73|69\.8\.50)|3\.2(?:12\.205\.158|00\.90\.196)|4\.(?:142\.53\.251|36\.187\.172)|5\.96\.18(?:0\.100|8\.83)|6\.196\.148\.179|2\.245\.44\.122)|9(?:8\.(?:24\.1(?:7(?:(?:8\.13|3\.8)0|4\.16[67]|5\.[234])|80\.91)|98\.112\.(?:18|2)7)|(?:9\.193\.252\.12|0\.107\.140\.7)7|5\.(?:138\.195\.125|252\.108\.6)|4\.106\.16\.6)|2(?:1\.(?:1(?:34\.238\.129|59\.11\.164|25\.71\.25)|2(?:54\.171\.143|2\.127\.17))|5\.(?:133\.17\.164|46\.24\.62)|2\.182\.28\.245|4\.160\.35\.2)|6(?:2\.210\.250\.(?:4[146
9]|5[136]|3[68]|60)|8\.63\.174\.108)|4(?:8\.223\.59\.187|1\.0\.61\.166|\.35\.201\.15)|0(?:3\.9\.157\.12[679]|1\.44\.3\.50)|\.2(?:15\.206\.242|24\.163\.99)|37\.116\.235\.187)|2(?:1(?:1\.(?:1(?:1(?:9\.86\.14[578]|8\.37\.56)|74\.120\.123|47\.211\.16)|230\.74\.17)|3\.1(?:(?:71\.39\.15|95\.77\.11)4|3(?:2\.241\.13|9\.7\.95))|0\.(?:183\.179\.(?:38|44)|245\.89\.69)|8\.(?:151\.141\.75|75\.153\.156)|6\.189\.101\.110)|0(?:2\.(?:1(?:17\.120\.24|37\.22\.200|42\.203\.19)|71\.136\.200|234\.40\.41)|0\.(?:7(?:2\.11\.132|9\.27\.60)|51\.45\.180)|3\.1(?:56\.207\.249|71\.233\.243)|8\.84\.135\.14[78]|1\.116\.199\.34)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|34\.24\.46)|4\.142\.(?:5[678]|41)|153\.158\.37)|0\.(?:1(?:28\.138\.245|30\.142\.42)|6(?:8\.224\.45|7\.90\.31))))|9(?:1\.(?:2(?:18\.245\.(?:7[356789]|6[6789]|8[0256]|9[0234])|35\.142\.24[345678])|194\.99\.242)|3\.1(?:19\.105\.[234567]|59\.160\.164)|8\.143\.158\.(?:4[2369]|53))|7(?:(?:7\.106\.232\.1|8\.29\.4\.)78|4\.(?:216\.223\.82|93\.63\.149)|2\.35\.20\
.131)|6(?:9\.1(?:63\.229\.13|98\.197\.15)6|(?:0\.21\.209|7\.90\.21)\.150|5\.60\.15\.173)|3(?:1\.(?:192\.108\.1(?:3\d|40)|220\.42\.77)|7\.(?:206\.210\.130|123\.98\.115))|4(?:9\.(?:218\.3(?:2\.130|3\.159)|1\.224\.9)|1\.(?:137\.24\.4|0\.3\.229))|8(?:2\.1(?:17\.194\.22|89\.158\.6)9|7\.106\.173\.115))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.(?:22\.(?:1(?:7(?:2\.14[145]|7\.5[12])|97\.216|1\.23|52\.8)|2(?:30\.213|28\.62)|53\.190)|82\.123\.85)|3\.(?:106\.1(?:16\.109|45\.24|50\.78)|98\.75\.72)|8\.252\.0\.237|9\.38\.248\.41)|7(?:7\.(?:80\.107\.115|1\.223\.73|69\.8\.50)|3\.2(?:12\.205\.158|00\.90\.196)|4\.(?:142\.53\.251|36\.187\.172)|5\.96\.18(?:0\.100|8\.83)|6\.196\.148\.179|2\.245\.44\.122)|9(?:8\.(?:24\.1(?:7(?:(?:8\.13|3\.8)0|4\.16[67]|5\.[234])|80\.91)|98\.112\.(?:18|2)7)|(?:9\.193\.252\.12|0\.107\.140\.7)7|5\.(?:138\.195\.125|252\.108\.6)|4\.106\.16\.6)|1(?:2\.(?:2(?:1(?:7\.228\.234|6\.46\.75)|20\.249\.20)|1(?:61\.232\.157|84\.172\.244))|8\.(?:130\.107\.235|97\.196\.163)|4\.32\.177\.77|6\.193\.90\.26)|2(?:1\.(?:1(?:34\.238\.129|59\.11\.164|25\.71\.25)|2(?:54\.171\.143|2\.127\.17))|5\.(?:133\.17\.164|46\.24\.62)|2\.182\.28\.245)|6(?:2\.210\.250\.(?:4[169]|5[136]|3[68]|60)|8\.63\.174\.108)|0(?:3\.9\.157\.12[679]|1\.44\.3\.50)|4(?:8\.223\.59\.187|1\.0\.61\.166)
|\.2(?:15\.206\.242|24\.163\.99)|37\.116\.235\.187)|2(?:0(?:2\.(?:1(?:(?:29\.216\.6|37\.22\.20|58\.39\.25)0|17\.120\.24|42\.203\.19)|71\.136\.200|234\.40\.41)|0\.(?:7(?:2\.11\.132|9\.27\.60)|51\.45\.180)|1\.1(?:16\.199\.34|95\.239\.27)|8\.84\.135\.14[78]|3\.171\.233\.243)|1(?:1\.(?:1(?:1(?:9\.86\.145|8\.37\.56)|74\.120\.123|47\.211\.16)|230\.74\.17)|3\.1(?:(?:71\.39\.15|95\.77\.11)4|32\.241\.13)|0\.(?:183\.179\.(?:4[45]|38)|245\.89\.69)|6\.189\.101\.110|8\.75\.153\.156)|2(?:1\.(?:2(?:14\.208\.22|34\.24\.4)6|4\.142\.(?:5[678]|41)|153\.158\.37)|0\.(?:1(?:28\.138\.245|30\.142\.42)|6(?:8\.224\.45|7\.90\.31))|2\.23(?:2\.130\.101|9\.255\.70)))|9(?:1\.2(?:18\.245\.(?:6[6789]|9[0234]|8[256]|7\d)|35\.142\.24[345678])|3\.1(?:19\.105\.[234567]|59\.160\.164)|8\.143\.158\.(?:4[369]|53))|6(?:0\.(?:190\.216\.156|21\.209\.150)|9\.1(?:63\.229\.13|98\.197\.15)6|5\.60\.15\.173|7\.90\.21\.150)|7(?:(?:7\.106\.232\.1|8\.29\.4\.)78|4\.(?:216\.223\.82|93\.63\.149)|2\.35\.20\.131)|8(?:2\.1(?:17\.194\.22|89\
.158\.6)9|7\.106\.173\.115|3\.3\.103\.227)|4(?:1\.(?:137\.24\.4|0\.3\.229)|9\.218\.3(?:2\.130|3\.159))|3(?:1\.192\.108\.1(?:3[012345679]|4\d)|7\.123\.98\.115)|59\.124\.115\.88)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|2\.(?:215\.(?:6[34]|44)|72\.13)|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|0\.52\.[0123]|9\.36\.21[23])|2(?:5\.(?:44\.245|60\.156)|3\.136\.106|4\.107\.127|2\.155\.44)|0(?:3\.(?:2(?:40\.(?:117|252)|6\.29)|5\.27)|9\.127\.8[016])|8(?:3\.9(?:3\.11[45]|5\.6[67])|1\.66\.15[67]|6\.37\.203)|9(?:0\.234\.10[56]|8\.50\.174|7\.252\.0)|30\.193\.1(?:46|65))|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|1(?:6\.155\.(?:20|54|63)|2\.34\.12)|0(?:3\.194\.115|7\.199\.166))|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|7[01]|69)|19\.19[01])|9\.55\.25[23]|\.39\.221)|4(?:1\.254\.[1258]|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|2\.(?:215\.(?:6[34]|44)|72\.13)|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|0\.52\.[0123]|9\.36\.21[23])|2(?:5\.(?:44\.24[123456]|60\.156)|3\.136\.106|4\.107\.127|2\.155\.44)|0(?:3\.(?:2(?:40\.(?:117|252)|6\.29)|7\.243|5\.27)|9\.127\.8[016])|8(?:3\.9(?:3\.(?:11[45]|98)|5\.6[67])|1\.66\.15[67]|6\.37\.203)|9(?:0\.234\.10[56]|8\.50\.174|7\.252\.0)|30\.193\.1(?:46|65)|77\.36\.22)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|1(?:6\.155\.(?:20|54|63)|2\.34\.12)|03\.194\.115)|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|6[89]|7[01])|19\.19[01])|9\.55\.25[235]|\.39\.221)|4(?:1\.254\.[1258]|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6