You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/05/11 08:57:21 UTC
svn commit: r1481260 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sat May 11 06:57:21 2013
New Revision: 1481260
URL: http://svn.apache.org/r1481260
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1481260&r1=1481259&r2=1481260&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sat May 11 06:57:21 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201305102
+## khop-sc-neighbors.cf v 201305112
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -20,7 +20,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:11[37]|95|2)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:1[37]|90)|95)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -39,7 +39,7 @@ score KHOP_SC_CIDR8 0.3 0.1 0.3 0.1
# 12.1449/0.0139 0.999 20100410 net, solo=12.1966/0.0197@0.998, ->.2 .1 .3 .2
# 10.3554/0.0112 0.999 20110227@510k solo=10.3717/0.0119@0.999, ->.3 .1 .3 .1
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|90)|37|93)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:178|37|93|2)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -74,7 +74,7 @@ score KHOP_SC_CIDR16 1.0 0.2 1.0 0.2
# crap, still empty 20100410 bad scrape, script failed to populate rule
# crap, still empty 20110227 this is due to safety net exclusions -> 1 .2 1 .2
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:178\.127|59\.150|37\.45)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:178\.127|59\.150)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0.4
@@ -92,7 +92,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:0\.(?:128\.2|84\.13)|1\.54\.54)|73\.(?:192\.144|212\.250)|0(?:3\.30\.7|8\.62\.4)2|12\.90\.197)|6(?:4\.203\.238|6\.96\.213)|58\.25(?:3\.216|4\.168))\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:8\.(?:174\.20|62\.4)|3\.30\.7)2|73\.(?:192\.144|212\.250)|2(?:0\.84\.13|1\.54\.54)|12\.90\.197|84\.82\.29)|58\.25(?:3\.216|4\.168)|66\.96\.213)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -111,7 +111,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:84\.(?:82\.(?:1(?:09|54)|29)|22\.108)|2(?:5\.60\.156|0\.84\.13)|12\.9(?:0\.90|7\.33)|78\.172\.183)|2(?:08\.82\.114|10\.21\.225|\.139\.178)|6(?:4\.120\.170|5\.60\.15)|98\.139\.44)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:0\.(?:128\.2|84\.13)|5\.60\.156)|84\.(?:82\.1(?:09|54)|22\.108)|12\.9(?:0\.90|7\.33)|78\.172\.183)|2(?:08\.82\.114|10\.21\.225|\.139\.178)|6(?:4\.120\.170|5\.60\.15)|98\.139\.44)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -129,7 +129,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:186\.(?:46\.107|16\.5)|90\.90\.1[6789]|217\.218\.218)|5\.(?:2(?:49\.63\.164|2\.80\.197)|88\.119\.132)|0\.(?:45\.244\.4[45]|165\.125\.152)|4\.(?:141\.253\.13?4|207\.113\.55)|9\.1(?:84\.214\.18|93\.93\.25)|7\.2(?:39\.144\.70|0\.3\.231)|6\.255\.241\.111|1\.185\.166\.86|3\.98\.254\.177|8\.97\.196\.163)|9(?:5\.(?:1(?:(?:28\.253\.15|91\.184\.8)2|38\.195\.125)|29\.81\.30)|9\.(?:180\.113\.1(?:2[034]|18)|255\.11\.29)|2\.(?:210\.220\.57|162\.24\.71)|3\.(?:255\.143\.63|6\.1\.169)|0\.69\.155\.100|8\.55\.110\.138)|8(?:4\.(?:82\.(?:1(?:09\.14|54\.51)|29\.3[34])|22\.(?:108\.1(?:64|80)|53\.211))|8\.(?:1(?:27\.230\.28|68\.46\.53)|252\.0\.237)|9\.(?:100\.193\.84|39\.35\.168)|5\.12\.1(?:2\.25|4\.17)4|2\.233\.226\.183)|7(?:3\.(?:2(?:0(?:0\.90\.196|8\.16\.53)|12\.250\.230)|1(?:92\.144\.105|3\.9\.9))|(?:4\.36\.1(?:67\.11|39\.8)|6\.53\.233\.7)6|7\.(?:34\.246\.25|80\.102\.21)4|5\.196\.73\.189)|0(?:8\.(?:174\.202\.7[23]|62\.42\.103)|9\.
(?:102\.23\.202|236\.87\.176)|3\.9\.15(?:7\.181|8\.150|6\.89)|6\.241\.3\.217)|2(?:1\.1(?:81\.251\.188|45\.120\.75)|3\.(?:193\.66\.191|240\.87\.174)|0\.128\.2\.1(?:72|85)|4\.243\.124\.206)|63\.177\.114\.1(?:37|43)|53\.127\.232\.158|\.172\.126\.166)|2(?:1(?:3\.(?:2(?:03\.236\.133|30\.128\.226|51\.186\.229)|1(?:71\.39\.154|86\.39\.43)|81\.164\.57)|0\.(?:2(?:1\.225\.2(?:4[124578]|3[1256]|27|54)|45\.89\.69)|5(?:1\.44\.199|6\.23\.100))|1\.(?:147\.211\.16|206\.133\.94|54\.17\.201)|(?:6\.153\.136\.12|8\.22\.17\.23)5|7\.1(?:7\.35\.146|98\.3\.238)|2\.6\.152\.211)|0(?:2\.(?:1(?:(?:36\.158\.4|42\.203\.1)9|58\.39\.250)|71\.136\.200|44\.53\.64)|0\.(?:7(?:2\.11\.132|9\.27\.60)|247\.100\.178|142\.133\.21)|8\.(?:82\.114\.(?:4[135679]|2[359]|3[079]|51)|113\.254\.39)|9\.223\.3(?:6\.2(?:5[13]|47)|5\.16[24])|1\.(?:22\.7\.225|45\.114\.3))|2(?:0\.94\.235\.200|1\.143\.50\.219|2\.236\.16\.14)|\.139\.178\.(?:184|81))|6(?:1\.(?:1(?:64\.42\.158|9\.97\.69)|252\.138\.195|98\.131\.141)|6\.(?:84\.(?:50\.13
3|49\.9)|96\.213\.13[48]|35\.84\.198)|4\.(?:120\.1(?:34\.120|70\.138|81\.94)|203\.238\.6[47])|5\.60\.15\.1(?:73|86)|3\.223\.124\.136|9\.90\.120\.188|8\.115\.192\.7)|9(?:3\.1(?:57\.148\.102|15\.92\.155)|5\.(?:215\.63\.6[49]|48\.24\.10)|4\.23\.108\.78|6\.9\.138\.233)|7(?:(?:6\.74\.186\.23|8\.47\.22\.10)7|5\.127\.110\.39|1\.188\.63\.88|2\.35\.20\.131)|8(?:(?:1\.15\.172\.14|3\.238\.208\.5)5|7\.236\.232\.231|8\.156\.24\.74|\.20\.39\.3)|5(?:8\.254\.168\.(?:5[6789]|6[0123])|9\.150\.255\.35|\.255\.67\.49)|4(?:6\.244\.10\.15[14]|1\.137\.24\.4)|37\.20(?:6\.210\.130|3\.18\.124))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:1(?:86\.(?:46\.107|16\.5)|64\.62\.8)|90\.90\.1[6789]|217\.218\.218)|5\.(?:2(?:49\.63\.164|2\.80\.197)|88\.(?:119\.132|247\.131))|4\.(?:141\.253\.13?4|207\.113\.55)|0\.(?:165\.125\.152|45\.244\.44)|7\.2(?:39\.144\.70|0\.3\.231)|1\.185\.166\.86|3\.98\.254\.177|8\.97\.196\.163|9\.193\.93\.25)|9(?:5\.(?:1(?:(?:28\.253\.15|91\.184\.8)2|38\.195\.125)|29\.81\.30)|9\.(?:180\.113\.1(?:2[04]|18)|255\.11\.29)|2\.(?:162\.24\.(?:169|71)|210\.220\.57)|0\.69\.155\.100|8\.55\.110\.138|3\.6\.1\.169)|8(?:4\.(?:22\.(?:10(?:8\.1(?:64|80)|6\.84)|36\.28)|82\.(?:1(?:09\.14|54\.51)|29\.3[34]))|8\.(?:1(?:27\.230\.28|68\.46\.53)|252\.0\.237)|9\.(?:100\.193\.84|39\.35\.168)|5\.12\.1(?:2\.25|4\.17)4)|7(?:3\.(?:2(?:0(?:0\.90\.196|8\.16\.53)|12\.250\.230)|1(?:92\.144\.105|3\.9\.9))|7\.(?:34\.246\.25|80\.102\.21)4|5\.196\.73\.189|6\.53\.233\.76)|0(?:8\.(?:6(?:2\.42\.10[39]|1\.43\.72)|174\.202\.7[234])|3\.9\.15(?:7\.181|8\.150|6\.89)|9\.236\.8
7\.176)|2(?:1\.1(?:81\.251\.188|45\.120\.75)|3\.(?:193\.66\.191|240\.87\.174)|0\.128\.2\.1(?:72|85))|63\.177\.114\.1(?:37|43)|53\.127\.232\.158|\.172\.126\.166)|2(?:1(?:0\.(?:2(?:1\.225\.2(?:3[012356789]|4[1245789]|27|54)|45\.89\.69)|5(?:1\.44\.199|6\.23\.100))|3\.(?:2(?:03\.236\.133|30\.128\.226|51\.186\.229)|1(?:71\.39\.154|86\.39\.43)|81\.164\.57)|(?:6\.153\.136\.12|8\.22\.17\.23)5|1\.(?:147\.211\.16|54\.17\.201)|7\.1(?:7\.35\.146|98\.3\.238)|2\.6\.152\.211)|0(?:2\.(?:1(?:(?:36\.158\.4|42\.203\.1)9|58\.39\.250)|71\.136\.200|44\.53\.64)|0\.(?:7(?:2\.11\.132|9\.27\.60)|247\.100\.178|142\.133\.21)|8\.(?:82\.114\.(?:4[135679]|2[359]|5[135]|39)|113\.254\.39)|9\.223\.3(?:6\.2(?:5[13]|26|47)|5\.16[246])|1\.(?:22\.7\.225|45\.114\.3))|2(?:0\.94\.235\.200|1\.143\.50\.219|2\.236\.16\.14)|\.139\.178\.(?:184|81))|6(?:1\.(?:1(?:64\.42\.158|9\.97\.69)|252\.138\.195|98\.131\.141)|6\.(?:84\.(?:50\.133|49\.9)|96\.213\.13[48]|35\.84\.198)|4\.(?:120\.1(?:34\.120|70\.138|81\.94)|203\.238\.6[4
7])|5\.60\.15\.1(?:73|86)|3\.223\.124\.136|9\.90\.120\.188|8\.115\.192\.7)|5(?:8\.25(?:4\.168\.(?:5[6789]|6[0123])|3\.216\.136)|9\.150\.255\.35|\.255\.67\.49)|8(?:(?:1\.(?:15\.172\.14|23\.106\.7)|3\.238\.208\.5)5|7\.236\.232\.231|\.20\.39\.3)|7(?:5\.127\.110\.39|6\.74\.186\.237|1\.188\.63\.88|2\.35\.20\.131)|9(?:5\.(?:215\.63\.6[49]|48\.24\.10)|4\.23\.108\.78)|4(?:6\.244\.10\.1(?:5[14]|72)|1\.137\.24\.4)|37\.206\.210\.130)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work