You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2014/02/12 08:57:34 UTC
svn commit: r1567549 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Feb 12 07:57:33 2014
New Revision: 1567549
URL: http://svn.apache.org/r1567549
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1567549&r1=1567548&r2=1567549&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Feb 12 07:57:33 2014
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201402112
+## khop-sc-neighbors.cf v 201402122
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:(?:03\.25\.1|98\.246\.)46|18\.244\.239|73\.208\.215|84\.22\.53)|2(?:21\.238\.21|04\.45\.55)|6(?:1\.163\.101|0\.29\.104)|3(?:1\.192\.111|7\.48\.66)|81\.92\.126)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:98\.(?:143\.128|246\.46)|18\.244\.239|73\.208\.215|03\.25\.146)|6(?:1\.163\.101|0\.29\.104)|217\.13\.154|31\.192\.111|91\.218\.245|81\.92\.126)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:0\.234\.10[56]|8\.143\.150)|8(?:1\.66\.15[67]|3\.182\.39)|(?:73\.208\.18|16\.112\.6)6|2(?:0\.143\.5|5\.93\.77)|03\.25\.14[56])|9(?:(?:1\.218\.(?:11|24)|3\.115\.8)5|4\.20\.224)|7(?:9\.124\.58|4\.91\.31)|31\.192\.111)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:0\.234\.10[56]|8\.143\.150)|8(?:1\.66\.15[67]|3\.182\.39)|(?:73\.208\.18|16\.112\.6)6|2(?:0\.143\.5|5\.93\.77)|03\.25\.14[56])|9(?:(?:1\.218\.11|3\.115\.8)5|4\.20\.224)|(?:221\.238\.2|31\.192\.11)1|7(?:9\.124\.58|4\.91\.31))\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:2(?:1(?:6\.(?:[23]0\.50|86\.253)|7\.161\.3)|20\.224\.59)|1(?:59\.101\.37|63\.149\.29))|(?:5\.88\.119\.13|8\.244\.239\.)2|6\.(?:255\.241\.111|112\.66\.102)|3\.199\.80\.47)|8(?:4\.(?:82\.1(?:7(?:1\.234|9\.117)|23\.85)|22\.(?:53\.(?:190|201)|197\.216))|5\.(?:2(?:4\.232\.(?:193|206)|5\.150\.212)|8\.107\.51)|2\.172\.22\.57)|9(?:8\.(?:143\.1(?:50\.2(?:4[0789]|5[012]|39)|28\.1(?:39|44))|246\.46\.27)|0\.107\.140\.76|3\.109\.69\.145|7\.253\.6\.68)|2(?:1\.(?:1(?:51\.122\.38|37\.91\.42)|88\.54\.17)|(?:8\.140\.219\.10|5\.93\.77\.12)5|3\.200\.28\.77|4\.160\.35\.2)|7(?:3\.2(?:08\.(?:186\.8[3456]|215\.164)|12\.205\.158)|8\.175\.159\.93)|\.209\.242\.218)|2(?:1(?:1\.(?:1(?:69\.224\.17|15\.71\.18)|2(?:18\.27\.112|3\.152\.19))|0\.(?:2(?:17\.150\.195|09\.18\.73|8\.96\.54)|183\.179\.3[89])|(?:6\.107\.159\.9|9\.147\.172\.)2|3\.135\.113\.197|7\.13\.154\.155|8\.38\.29\.68)|2(?:1\.2(?:3(?:2\.247\.27|8\.21\.251)|14\.2(?:08\.226|14\.187))|2\.(?:2
00\.182\.65|74\.200\.2)|0\.164\.162\.22)|0(?:3\.230\.112\.44|2\.234\.40\.41|5\.164\.26\.36)|3\.238\.207\.130|4\.48\.219\.49)|9(?:1\.218\.(?:115\.1(?:6[01246789]|7[045])|245\.(?:[456]|2[4789]|30?))|3\.115\.85\.2(?:3[01345689]|4[012345]|2[789])|4\.(?:232\.184\.67|77\.199\.148))|6(?:1\.(?:(?:163\.101\.4|43\.97\.13)2|38\.252\.21|98\.77\.169)|0\.(?:190\.92\.234|29\.104\.197))|7(?:9\.124\.58\.1(?:5[012345678]|[34]\d)|(?:7\.106\.232\.1|8\.29\.4\.)78|4\.91\.31\.2(?:29|30))|3(?:1\.1(?:92\.111\.(?:[789]\d|6[89]|100)|86\.87\.231)|7\.48\.66\.(?:18|24|3))|8(?:(?:4\.203\.244\.5|1\.92\.126\.4)0|7\.204\.110\.176|5\.185\.112\.8)|5(?:0\.193\.157\.62|8\.151\.38\.107)|46\.182\.92\.117)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:2(?:1(?:6\.(?:86\.253|30\.50)|7\.161\.3)|20\.224\.59)|1(?:84\.172\.244|59\.101\.37|63\.149\.29))|4\.(?:141\.253\.14|247\.23\.66|32\.177\.77|4\.31\.90)|(?:5\.88\.119\.13|8\.244\.239\.)2|6\.(?:255\.241\.111|112\.66\.102)|3\.196\.70\.128)|9(?:8\.(?:143\.1(?:50\.2(?:4[0789]|5[012]|39)|28\.1(?:39|44))|246\.46\.27)|3\.(?:109\.69\.149|238\.111\.26|35\.58\.205)|2\.(?:129\.253\.174|3\.46\.236)|0\.107\.140\.76|7\.253\.6\.68)|8(?:4\.(?:82\.1(?:7(?:1\.234|9\.117)|23\.85)|22\.(?:53\.(?:190|201)|197\.216))|5\.(?:25\.150\.212|8\.107\.51)|7\.162\.253\.250|0\.67\.207\.162)|2(?:5\.(?:88\.123\.244|93\.77\.125)|1\.(?:151\.122\.38|88\.54\.17)|8\.140\.219\.105|3\.200\.28\.77|4\.160\.35\.2)|7(?:3\.2(?:08\.(?:186\.8[3456]|215\.164)|12\.205\.158)|8\.175\.159\.93)|\.209\.242\.218)|2(?:1(?:0\.(?:2(?:17\.150\.195|09\.18\.73|8\.96\.54)|183\.179\.(?:3[89]|44)|51\.23\.91)|1\.(?:1(?:69\.224\.17|15\.71\.18)|2(?:18\.27\.112|3\.152\.19))|(?:3\.135\.113\.
19|2\.98\.171\.15)7|9\.14(?:0\.69\.12|7\.172\.)2|7\.13\.154\.155)|2(?:1\.2(?:3(?:2\.247\.27|8\.21\.251)|14\.2(?:08\.226|14\.187))|2\.(?:7(?:8\.247\.67|4\.200\.2)|200\.182\.65)|0\.164\.162\.22)|0(?:2\.(?:197\.68\.20|234\.40\.4)1|3\.230\.112\.45|9\.50\.156\.232)|3\.23(?:1\.48\.(?:10|72)|8\.207\.130)|7\.151\.127\.13|4\.48\.219\.49)|9(?:3\.115\.85\.2(?:3[01345689]|4[012345]|2[789])|1\.218\.(?:115\.17[1345]|245\.[36])|4\.77\.199\.148)|6(?:1\.(?:(?:163\.101\.4|43\.97\.13)2|38\.252\.21)|0\.(?:190\.92\.234|29\.104\.197)|9\.65\.48\.125)|7(?:9\.124\.58\.1(?:5[012345678]|[34]\d)|(?:7\.106\.232\.1|8\.29\.4\.)78|4\.91\.31\.2(?:29|30))|3(?:1\.1(?:92\.111\.(?:[789]\d|6[89]|100)|86\.87\.231)|7\.48\.66\.(?:18|24|3))|8(?:(?:4\.203\.244\.5|1\.92\.126\.4)0|7\.204\.110\.176|5\.185\.112\.8)|5(?:0\.193\.157\.62|8\.151\.38\.107|9\.125\.41\.70)|46\.182\.92\.117)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|6\.207\.(?:6[0123]|4[89]|5\d))|7(?:1\.80\.(?:1(?:7[01]|69)|2(?:0[03]|46))|7\.137\.19)|8(?:1\.66\.15[67]|9\.126\.130)|90\.234\.10[56])|27\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|58\.5(?:0\.1(?:[2345]|1[012356789]|0[456789])|4\.18[56]))\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|6\.207\.(?:6[0123]|4[89]|5\d))|7(?:1\.80\.(?:2(?:4[567]|0[03])|1(?:6[89]|7[01]))|7\.137\.19)|8(?:1\.66\.15[67]|9\.126\.130)|90\.234\.10[56])|27\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|58\.5(?:0\.1(?:[2345]|1[012356789]|0[456789])|4\.18[4567]))\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6