You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/09/15 08:59:58 UTC
svn commit: r1523412 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sun Sep 15 06:59:58 2013
New Revision: 1523412
URL: http://svn.apache.org/r1523412
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1523412&r1=1523411&r2=1523412&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sun Sep 15 06:59:58 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201309142
+## khop-sc-neighbors.cf v 201309152
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:84\.(?:22\.(?:1(?:77|1)|230)|82\.53)|0(?:3\.(?:30\.72|9\.157)|1\.8\.236)|12\.90\.222|21\.54\.54|62\.216\.3)|58\.254\.172|65\.60\.15)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:(?:0(?:3\.30\.7|1\.9\.5)|12\.90\.22)2|84\.(?:22\.(?:230|11)|82\.53)|9(?:8\.24\.180|9\.30\.137)|(?:62\.216\.|77\.1\.22)3|21\.54\.54)|58\.254\.172)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:5\.60\.156|0\.84\.13)|98\.24\.1(?:7[345]|80)|12\.97\.24|77\.1\.223)|2(?:06\.214\.95|21\.4\.142)|7(?:9\.106\.109|5\.75\.240)|(?:91\.218\.11|41\.254\.)5|50\.30\.47)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:5\.60\.156|0\.84\.13)|98\.24\.17[345]|84\.22\.177|01\.8\.236|12\.97\.24)|2(?:06\.214\.95|21\.4\.142)|7(?:9\.106\.109|5\.75\.240)|(?:91\.218\.11|41\.254\.)5|50\.30\.47)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:21(?:6\.(?:4(?:8\.252|6\.75)|105\.90|8\.158)|7\.161\.3)|1(?:68\.(?:218\.86|141\.5)|24\.38\.250|70\.181\.99))|9\.1(?:(?:49\.148\.15|97\.181\.12)0|84\.214\.18)|8\.(?:1(?:30\.107\.235|75\.28\.3)|46\.127\.36)|6\.1(?:26\.87\.245|93\.90\.26)|4\.4(?:5\.229\.27|\.44\.206)|0\.189\.168\.171|5\.82\.240\.23|3\.0\.85\.249)|8(?:4\.(?:22\.(?:1(?:7(?:2\.14[56]|7\.5[12])|97\.216|1\.23)|2(?:3[07]\.213|8\.22[012]|28\.62|7\.171))|82\.(?:53\.1(?:0[69]|43|1)|179\.117|251\.100))|0\.2(?:25\.1(?:31\.17|48\.20)6|11\.179\.30)|3\.98\.23\.158|9\.75\.63\.114)|9(?:8\.24\.1(?:7(?:4\.(?:16[67]|57)|5\.[234]|3\.80)|80\.91)|9\.(?:30\.137\.10[67]|71\.215\.141)|2\.163\.193\.199|5\.138\.195\.125|0\.107\.140\.77)|7(?:3\.(?:44\.1(?:82\.(?:2[28]|19)|79\.(?:199|216))|2(?:12\.205\.158|00\.90\.196))|7\.(?:69\.243\.74|1\.223\.73)|4\.36\.137\.170|8\.20\.148\.11)|2(?:1\.(?:1(?:81\.237\.251|99\.12\.28|61\.20\.7)|22\.127\.17)|5\.(?:75\.235\.127|46\.24\.62)|3\.234\.230\
.45)|0(?:1\.(?:(?:8\.236\.24|44\.3\.5)0|13\.123\.62|9\.52\.119)|3\.9\.157\.12[679])|4(?:\.(?:45\.130\.155|33\.121\.67|63\.74\.204)|8\.223\.59\.187|1\.0\.61\.166)|\.(?:226\.84\.27|85\.17\.82)|62\.216\.3\.1[4567])|2(?:1(?:1\.(?:1(?:7(?:2\.2(?:51\.168|42\.74)|4\.120\.123|6\.61\.112)|1(?:9\.86\.14[357]|8\.37\.56)|57\.144\.27)|33\.121\.231)|3\.1(?:9(?:5\.77\.114|9\.248\.27)|32\.241\.13|71\.39\.154)|2\.156\.44\.134|6\.24\.201\.177|0\.93\.48\.211|9\.147\.172\.2)|0(?:2\.(?:1(?:37\.22\.200|42\.203\.19)|71\.136\.200)|6\.214\.95\.(?:6[689]|7[01]|9[14])|8\.(?:84\.135\.14[78]|76\.106\.66)|3\.(?:171\.233\.243|255\.15\.146)|0\.7(?:2\.11\.132|9\.27\.60)|7\.46\.132\.188)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|04\.223\.38|\.144\.135)|4\.142\.(?:9[0123]|6[79]|7[01]))|2\.(?:2(?:18\.142\.49|31\.33\.38)|174\.54\.164|51\.160\.156)|0\.188\.110\.129))|6(?:0\.(?:21(?:4\.223\.178|\.209\.150)|190\.43\.10)|1\.(?:16(?:6\.55\.153|7\.120\.9)|98\.77\.169)|5\.(?:60\.15\.18[46]|125\.155\.90)|9\.(?:198\.197\.156|64\.4
9\.109)|4\.120\.169\.146|7\.90\.21\.150)|9(?:3\.(?:1(?:59\.160\.164|88\.8\.67)|95\.98\.196)|1\.218\.115\.(?:5[2456789]|10[89]|6[013])|0\.83\.184\.211|5\.155\.8\.219)|8(?:2\.(?:11(?:7\.194\.229|4\.79\.254)|99\.246\.10)|3\.238\.208\.55)|7(?:5\.75\.240\.1(?:4[01234]|3[89])|4\.216\.223\.82|2\.35\.20\.131)|5(?:0\.30\.47\.(?:121|87)|8\.213\.157\.68|9\.8\.26\.22)|4(?:1\.(?:84\.135\.22|137\.24\.4)|2\.121\.121\.42)|37\.123\.98\.115)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:1(?:68\.(?:218\.86|141\.5)|24\.38\.250|70\.181\.99)|21(?:6\.(?:105\.90|46\.75)|7\.161\.3))|9\.1(?:(?:49\.148\.15|97\.181\.12)0|84\.214\.18)|8\.1(?:30\.107\.235|75\.28\.3)|4\.4(?:5\.229\.27|\.44\.206)|0\.189\.168\.171|5\.82\.240\.23|6\.193\.90\.26|3\.0\.85\.249)|8(?:4\.(?:22\.(?:1(?:7(?:2\.14[56]|7\.5[12])|97\.216|1\.23)|2(?:3[07]\.213|8\.22[012]|28\.62|7\.171))|82\.(?:53\.1(?:0[69]|43|1)|179\.117|251\.100))|0\.2(?:25\.131\.176|11\.179\.30)|3\.98\.23\.158|9\.75\.63\.114)|7(?:3\.(?:44\.1(?:79\.(?:2(?:0[24]|2[05]|16)|199)|82\.(?:1[049]|28|3))|2(?:12\.205\.158|00\.90\.196))|7\.(?:69\.243\.74|1\.223\.73)|4\.36\.137\.170|8\.20\.148\.11)|9(?:8\.24\.1(?:7(?:4\.(?:16[67]|57)|5\.[234]|3\.80)|80\.91)|9\.(?:30\.137\.10[67]|71\.215\.141)|2\.163\.193\.199|5\.138\.195\.125|0\.107\.140\.77)|2(?:1\.(?:1(?:81\.237\.251|99\.12\.28|61\.20\.7)|22\.127\.17)|5\.(?:75\.235\.127|46\.24\.62))|0(?:1\.(?:(?:8\.236\.24|44\.3\.5)0|13\.123\.62|9\.52\
.119)|3\.9\.157\.12[679])|4(?:(?:8\.223\.59\.18|\.33\.121\.6)7|1\.0\.61\.166)|62\.216\.3\.1[4567]|\.85\.17\.82)|2(?:1(?:1\.(?:1(?:7(?:2\.251\.168|4\.120\.123|6\.61\.112)|1(?:9\.86\.14[357]|8\.37\.56)|91\.168\.166|57\.144\.27)|54\.17\.200)|3\.1(?:9(?:5\.77\.114|9\.248\.27)|32\.241\.13)|2\.156\.44\.134|0\.93\.48\.211|9\.147\.172\.2)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|04\.223\.38|\.144\.135)|4\.142\.(?:6[4579]|9[0123]|4[12]|7[01]))|2\.(?:1(?:22\.79\.103|74\.54\.164)|231\.33\.38)|0\.188\.110\.129)|0(?:6\.214\.95\.(?:6[689]|7[012]|9[14])|8\.(?:84\.135\.14[78]|76\.106\.66)|3\.(?:171\.233\.243|255\.15\.146)|2\.(?:137\.22|71\.136)\.200|7\.46\.132\.188))|6(?:1\.(?:16(?:6\.55\.153|7\.120\.9)|33\.162\.92)|0\.(?:214\.223\.178|190\.43\.10)|9\.(?:198\.197\.156|64\.49\.109)|5\.60\.15\.18[46]|4\.120\.169\.146|7\.90\.21\.150)|9(?:1\.218\.115\.(?:5[2456789]|3[45678]|10[89]|6[013])|3\.(?:159\.160\.164|95\.98\.196)|0\.83\.184\.211|5\.155\.8\.219)|7(?:5\.75\.240\.1(?:4[01234567]|3[89])|4\.143\.199\.
46|2\.35\.20\.131)|5(?:0\.30\.47\.(?:121|87)|8\.213\.157\.68|9\.8\.26\.22)|4(?:1\.(?:84\.135\.22|137\.24\.4)|2\.121\.121\.42)|82\.(?:11(?:7\.194\.229|4\.79\.254)|99\.246\.10)|37\.123\.98\.115)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|5\.(?:63\.(?:[89]|1[012345])|58\.13[34])|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|0\.(?:205\.3[25]|52\.[0123])|3\.56\.2(?:4[589]|5[01]|25)|2\.215\.(?:6[34]|44)|9\.36\.21[23])|2(?:5\.(?:4(?:4\.24[01234567]|2\.202)|60\.156)|3\.136\.106|4\.107\.127|2\.155\.44)|0(?:3\.(?:28\.184|30\.72|7\.243|1\.69|5\.27)|9\.127\.8[016])|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|1\.66\.15[67]|6\.123\.135)|9(?:0\.234\.10[56]|7\.252\.[01])|30\.193\.1(?:46|65)|77\.47\.10[26]|42\.234\.186)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:2\.29\.17[67]|3\.194\.115|6\.246\.99)|22\.140\.15[89]|12\.34\.12)|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|6[89]|70)|19\.190)|9\.55\.254)|4(?:1\.2(?:54\.[1258]|23\.161)|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|5\.(?:63\.(?:[89]|1[012345])|58\.134)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|0\.(?:205\.3[25]|52\.[0123])|3\.56\.2(?:4[589]|5[01]|25)|2\.215\.(?:6[34]|44)|9\.36\.21[23])|2(?:5\.(?:44\.24[01234567]|60\.156)|3\.136\.106|4\.107\.127|2\.155\.44)|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|1\.66\.15[67]|6\.123\.135)|0(?:3\.(?:2(?:8\.184|0\.39)|30\.72|7\.243)|9\.127\.8[01])|9(?:0\.234\.10[56]|7\.252\.[01])|30\.193\.1(?:46|65)|77\.47\.10[26]|42\.234\.186|63\.125\.144)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:2\.29\.17[67]|3\.194\.115|6\.246\.99)|22\.140\.15[89])|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|6[89]|71)|19\.190)|9\.55\.254)|4(?:1\.254\.[1258]|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6