You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2014/02/19 08:57:29 UTC
svn commit: r1569656 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Feb 19 07:57:28 2014
New Revision: 1569656
URL: http://svn.apache.org/r1569656
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1569656&r1=1569655&r2=1569656&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Feb 19 07:57:28 2014
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201402182
+## khop-sc-neighbors.cf v 201402192
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:(?:98\.143\.12|41\.105\.6)8|23\.64\.199|84\.22\.53)|2(?:1(?:0\.183\.17|9\.140\.6)9|02\.234\.40)|5(?:8\.251\.146|\.255\.64)|68\.65\.240)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:(?:98\.143\.12|41\.105\.6)8|03\.25\.146|23\.64\.199)|2(?:10\.183\.179|02\.234\.40)|(?:91\.218\.24|5\.255\.6)4|68\.65\.2(?:40|52)|88\.208\.231)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:0\.234\.10[56]|8\.143\.150|4\.105\.9)|8(?:1\.66\.15[67]|3\.182\.39)|0(?:3\.25\.14[56]|1\.14\.89)|20\.(?:143\.5|84\.13))|2(?:12\.146\.101|3\.231\.48)|9(?:1\.218\.24|4\.20\.22)4|50\.(?:193\.157|2\.95)|31\.192\.111|68\.65\.252)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:0\.234\.10[56]|8\.143\.150|4\.105\.9)|0(?:1\.(?:14\.89|9\.205)|3\.25\.14[56])|8(?:1\.66\.15[67]|3\.182\.39|4\.22\.53)|20\.(?:143\.5|84\.13))|2(?:12\.146\.101|3\.231\.48)|9(?:1\.218\.24|4\.20\.22)4|50\.(?:193\.157|2\.95)|31\.192\.111|83\.149\.48)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:4\.(?:1(?:12\.129\.167|41\.253\.14)|247\.23\.66)|9\.(?:110\.108\.92|42\.147\.114|73\.225\.13)|8\.1(?:29\.166\.86|42\.19\.172|89\.11\.10)|2\.(?:184\.172\.244|220\.67\.130)|6\.(?:193\.90\.26|48\.159\.51)|0\.189\.168\.171)|9(?:2\.(?:1(?:19\.174\.(?:13|9)|29\.253\.174)|208\.183\.198|3\.46\.236)|8\.143\.1(?:50\.2(?:4[789]|5[012]|39)|28\.1(?:32|44))|3\.(?:1(?:09\.69\.149|11\.62\.157)|35\.58\.205)|0\.107\.140\.76|4\.105\.9\.85|7\.253\.6\.68)|8(?:4\.(?:82\.1(?:7(?:1\.234|9\.117)|23\.85)|22\.(?:53\.(?:190?|201)|197\.216))|2\.172\.22\.5[79]|5\.25\.150\.212|8\.20\.27\.174)|2(?:2\.(?:219\.138\.227|155\.9\.59)|1\.182\.63\.196|5\.88\.123\.244|3\.200\.28\.77|4\.160\.35\.2|0\.50\.86\.3)|0(?:1\.(?:9\.205\.13|14\.89\.)0|9\.236\.89\.2(?:18|27)|6\.245\.250\.6)|7(?:8\.(?:175\.159\.93|248\.43\.106)|3\.212\.205\.158)|(?:62\.243\.213\.23|59\.224\.80\.4)3)|2(?:1(?:1\.(?:2(?:1(?:8\.27\.112|\.100\.250)|3\.152\.19)|17(?:4\.178\.177|6\.76\.198)|44\.103\.
11)|9\.(?:14(?:0\.69\.12|7\.172\.)2|92\.57\.210)|0\.(?:183\.179\.(?:38|45)|48\.156\.227)|2\.(?:146\.101\.154|98\.171\.157)|3\.135\.113\.197|8\.234\.17\.176)|0(?:2\.(?:(?:82\.202\.22|64\.73\.14|77\.108\.5)8|1(?:30\.114\.130|97\.68\.201)|234\.40\.41)|3\.23(?:0\.112\.45|9\.45\.202)|9\.50\.156\.232)|2(?:1\.(?:214\.2(?:08\.226|14\.187)|178\.236\.19)|2\.(?:200\.182\.65|78\.247\.67)|0\.255\.37\.152)|3\.231\.48\.(?:10|72)|4\.48\.219\.49|\.230\.25\.144)|6(?:8\.65\.2(?:5(?:2\.1(?:8[789]|90)|4\.251)|40\.25[023])|9\.(?:65\.48\.125|9\.42\.219)|0\.190\.92\.234|4\.235\.49\.183|7\.210\.247\.25|1\.35\.92\.92)|5(?:9\.(?:120\.(?:66\.8|76\.2)3|4\.113\.117)|8\.64\.(?:164\.116|200\.150)|\.255\.64\.2(?:4[689]|50)|0\.193\.157\.62)|8(?:8\.208\.2(?:31\.1(?:7[79]|29)|29\.189|09\.31)|5\.185\.(?:30\.163|112\.8)|7\.204\.110\.176|4\.203\.244\.50)|9(?:1\.218\.244\.(?:2(?:1[012345678]|2[23468]|0[2349]|3[34]|40)|1(?:9[124567]|36))|5\.85\.63\.150)|7(?:7\.(?:106\.232\.178|89\.162\.82)|4\.122\.196\.16|2\.9\.107\.69|8\.
29\.4\.78)|4(?:6\.182\.92\.117|9\.128\.43\.241|1\.137\.24\.4)|31\.192\.111\.(?:[789]\d|6[89]|100))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:9\.(?:110\.108\.92|42\.147\.114|73\.225\.13)|8\.1(?:29\.166\.86|42\.19\.172|89\.11\.10)|4\.1(?:12\.129\.167|41\.253\.14)|6\.(?:193\.90\.26|48\.159\.51)|0\.189\.168\.171|2\.220\.67\.130)|8(?:4\.(?:82\.1(?:7(?:1\.234|9\.117)|23\.85)|22\.(?:53\.(?:190?|201)|197\.216))|3\.(?:106\.150\.78|86\.207\.130)|2\.172\.22\.5[79]|5\.25\.150\.212|8\.20\.27\.174)|9(?:2\.(?:208\.18(?:5\.1(?:06|14)|3\.198)|119\.174\.(?:13|9))|8\.143\.1(?:50\.2(?:4[789]|5[012]|39)|28\.1(?:32|44))|0\.107\.140\.76|3\.111\.62\.157|4\.105\.9\.85)|2(?:1\.(?:182\.63\.196|78\.116\.243)|2\.(?:219\.138\.227|155\.9\.59)|5\.88\.123\.244|4\.160\.35\.2|0\.50\.86\.3)|7(?:8\.(?:175\.159\.93|248\.43\.106)|3\.212\.20(?:5\.158|9\.30))|0(?:1\.(?:9\.205\.13|14\.89\.)0|6\.245\.250\.6)|(?:62\.243\.213\.23|59\.224\.80\.4)3)|2(?:1(?:1\.(?:17(?:4\.178\.177|6\.76\.198)|23(?:2\.154\.6|\.152\.19)|44\.103\.11)|9\.(?:14(?:0\.69\.12|7\.172\.)2|92\.57\.210)|0\.(?:183\.179\.(?:3[89]|45)|48\.156
\.227)|2\.146\.101\.154|3\.135\.113\.197|8\.234\.17\.176)|0(?:2\.(?:1(?:18\.236\.178|30\.114\.130|97\.68\.201)|(?:82\.202\.22|64\.73\.14|77\.108\.5)8|234\.40\.41)|3\.23(?:0\.112\.45|8\.64\.250|9\.45\.202))|2(?:1\.(?:214\.2(?:08\.226|14\.187)|178\.236\.19)|2\.(?:200\.182\.65|78\.247\.67))|3\.231\.48\.(?:10|72)|\.230\.25\.144)|6(?:8\.65\.2(?:5(?:2\.1(?:8[789]|90)|4\.251)|40\.25[023])|(?:4\.235\.49\.18|2\.65\.133\.4)3|7\.2(?:10\.247\.25|05\.67\.7)|0\.190\.92\.234|9\.9\.42\.219)|9(?:1\.2(?:18\.244\.(?:2(?:1[012345678]|2[234568]|0[2349]|4[0189]|3[34])|1(?:9[1234567]|36))|41\.187\.204)|5\.(?:211\.135\.83|85\.63\.150))|8(?:8\.208\.2(?:31\.1(?:7[79]|29)|29\.1[38]9|09\.31)|5\.185\.(?:30\.163|112\.8)|4\.203\.244\.50)|7(?:7\.(?:106\.232\.178|89\.162\.82)|2\.9\.(?:107\.69|97\.116)|4\.122\.196\.16|8\.29\.4\.78)|5(?:8\.64\.(?:164\.116|200\.150)|\.255\.64\.2(?:4[689]|50)|0\.193\.157\.62|9\.4\.113\.117)|4(?:6\.1(?:91\.237\.118|82\.92\.117)|9\.128\.43\.241|1\.137\.24\.4)|31\.192\.111\.(?:9[123456789
]|[78]\d|6[89]|100))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|6\.207\.(?:6[0123]|4[89]|5\d))|7(?:1\.80\.(?:2(?:0[0123]|4[567])|1(?:6[89]|7[01]))|7\.137\.19)|8(?:1\.66\.15[67]|9\.126\.130|8\.73\.252)|0(?:3\.255\.193|9\.127\.80)|90\.234\.10[56]|25\.60\.156)|27\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|58\.5(?:0\.1(?:[2345]|0[456789]|1\d)|4\.18[4567])|41\.254\.6)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:8(?:6\.(?:1(?:3\.[1234]|22\.45)|37\.203)|3\.9(?:3\.114|5\.66)|1\.66\.15[67]|9\.126\.130|8\.73\.252)|1(?:1\.176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|6\.207\.(?:6[0123]|4[89]|5\d)|9\.36\.213)|7(?:1\.80\.(?:2(?:0[0123]|4[567])|1(?:6[89]|7[01]))|7\.(?:1(?:37\.19|1\.55)|36\.17))|0(?:3\.255\.193|9\.127\.80)|2(?:3\.136\.10|5\.60\.15)6|90\.234\.10[56]|30\.193\.147)|27\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|58\.(?:5(?:0\.1(?:[2345]|0[456789]|1\d)|4\.18[4567])|19\.19[01])|41\.254\.[56]|79\.106\.109)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6