You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/08/24 08:57:15 UTC
svn commit: r1517113 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sat Aug 24 06:57:15 2013
New Revision: 1517113
URL: http://svn.apache.org/r1517113
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1517113&r1=1517112&r2=1517113&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sat Aug 24 06:57:15 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201308232
+## khop-sc-neighbors.cf v 201308242
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|9[35])(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:8[68]|17)|93)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -81,7 +81,7 @@ score KHOP_SC_CIDR16 0.4 0.1 0.4 0.1
# crap, still empty 20130629@465k net
# crap, still empty 20130705@376k net. lowering for low vol -> .4 .1 .4 .1
-header KHOP_SC_TOP_CIDR16 Received =~ /___ FAILED TO POPULATE ___/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b85\.105(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0.3
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:4\.42\.1(?:3[5789]|53)|9\.184\.214|6\.112\.5)|83\.136\.146)|2(?:1(?:1\.172\.246|7\.198\.3)|00\.(?:247\.100|31\.105))|(?:41\.226\.1|82\.207\.5)1|90\.150\.9)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:4\.42\.13[5789]|9\.184\.214)|2(?:3\.234\.230|1\.12\.167)|8(?:3\.136\.146|7\.4\.111))|2(?:00\.(?:247\.100|31\.105)|17\.198\.3)|86\.111\.144|91\.233\.188)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:6\.192\.15|8\.20\.148)|8(?:3\.221\.12|7\.4\.111)|9(?:2\.157\.58|3\.95\.90)|20\.84\.13|41\.0\.61)|(?:61\.133\.12|2\.183\.15)5|86\.111\.144|91\.233\.188)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:1\.199\.18|5\.60\.156|0\.84\.13)|7(?:6\.192\.15|8\.20\.148)|9(?:2\.157\.58|3\.95\.90)|83\.221\.12|16\.112\.5|41\.0\.61)|(?:61\.133\.12|2\.183\.15)5|90\.150\.9)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:1(?:84\.172\.244|63\.150\.30)|90\.222\.1[357])|3\.(?:130\.70\.113|21\.228\.230|6\.248\.194)|9\.(?:184\.214\.18|201\.141\.81)|1\.(?:68\.104\.132|30\.77\.129)|7\.(?:131\.158\.34|36\.77\.170)|8\.(?:170\.9\.247|244\.239\.2)|6\.112\.(?:66\.102|5\.136)|4\.45\.234\.190)|9(?:8\.(?:2(?:4\.1(?:7(?:4\.16[67]|5\.[34]|3\.80)|80\.91)|0\.168\.165)|52\.(?:123\.212|247\.103)|74\.122\.9)|0\.(?:200\.211\.229|107\.140\.77|81\.196\.71)|2\.1(?:63\.197\.135|57\.58\.136|98\.90\.51)|3\.95\.(?:90\.194|69\.58)|5\.242\.161\.10|4\.11\.24\.156)|8(?:4\.(?:22\.(?:1(?:77\.5[12]|1\.23)|2(?:30\.213|7\.171))|107\.148\.206)|3\.(?:136\.146\.(?:110|99)|238\.169\.86|98\.23\.158)|0\.211\.179\.30|7\.4\.111\.218|9\.75\.63\.114|2\.72\.140\.2)|2(?:1\.(?:1(?:34\.238\.129|99\.18\.220|2\.167\.95)|2(?:2\.(?:127\.17|34\.166)|6\.229\.197))|3\.234\.230\.45|4\.42\.124\.136|5\.75\.235\.127|2\.70\.220\.99)|7(?:3\.(?:192\.144\.105|254\.227\.34)|2\.245\.216\.160|4\.36\.164\.1
84|6\.192\.15\.229|8\.20\.148\.11|7\.1\.223\.73)|4(?:1\.(?:8\.247\.(?:38|56)|0\.61\.16[56])|\.(?:52\.137\.(?:54|77)|139\.229\.36)|8\.223\.59\.187)|\.(?:2(?:15\.206\.242|34\.38\.106|26\.84\.27)|(?:34\.181\.2|85\.17\.8)2|160\.73\.175|93\.21\.147)|37\.1(?:35\.(?:1(?:1(?:2\.63|6\.87)|21\.32)|82\.99)|1(?:6\.122\.(?:218|60)|7\.87\.16))|0(?:3\.9\.15(?:8\.1(?:47|81)|7\.126)|6\.187\.35\.127|1\.44\.3\.50)|62\.(?:105\.25\.123|209\.207\.21))|2(?:1(?:1\.(?:1(?:5(?:4\.151\.24|7\.114\.13)3|91\.168\.166|72\.246\.74)|51\.249\.158|44\.103\.11|87\.184\.44)|2\.(?:2(?:6\.134\.11|3\.234\.4)5|111\.205\.137|6\.152\.211|73\.75\.242)|8\.(?:1(?:51\.141\.75|92\.175\.84)|2(?:34\.108\.1|\.129\.5)3)|0\.(?:51\.(?:44\.48|3\.42)|45\.117\.249|109\.97\.63)|7\.(?:198\.3\.238|79\.231\.13|8\.255\.176)|9\.(?:240\.39\.201|80\.238\.185))|2(?:1\.(?:2(?:14\.208\.226|32\.247\.27|\.144\.135)|19(?:4\.(?:128\.223|43\.10)|2\.134\.91))|2\.74\.20(?:3\.194|0\.2)|0\.132\.157\.71)|0(?:0\.(?:247\.100\.178|109\.248\.20|31\.105\.172)|2\.(
?:29\.22\.183|10\.42\.74)|3\.171\.233\.243)|\.183\.155\.2)|6(?:1\.(?:1(?:3(?:3\.125\.162|6\.68\.76)|6(?:6\.55\.153|3\.37\.76)|8(?:1\.252\.6|5\.4\.164)|75\.223\.1(?:4[12]|39)|43\.158\.244)|238\.148\.161|38\.186\.117|55\.156\.210)|0\.(?:2(?:9\.(?:15\.194|75\.142)|14\.223\.178)|13\.167\.30|8\.63\.52)|5\.(?:60\.15\.18[46]|125\.155\.90)|9\.198\.197\.156|4\.181\.43\.79|7\.90\.21\.150|2\.64\.7\.244)|9(?:1\.2(?:12\.124\.153|33\.188\.154|03\.69\.41)|3\.1(?:59\.1(?:60\.164|91\.246)|84\.71\.66)|0\.(?:83\.184\.211|150\.9\.38)|4\.77\.199\.148|5\.159\.105\.2)|8(?:2\.(?:114\.79\.254|207\.51\.92)|3\.1(?:11\.92\.120|74\.202\.54)|6\.111\.144\.194|4\.235\.57\.122|5\.234\.22\.126)|7(?:(?:7\.245\.175\.14|6\.72\.169\.20)6|8\.1(?:59\.227\.142|41\.67\.151)|2\.35\.20\.131|0\.38\.71\.55)|4(?:(?:2\.121\.11(?:7\.15|8\.12)|9\.218\.37\.22)3|1\.(?:226\.11\.117|78\.77\.253)|6\.249\.46\.104)|5(?:(?:4\.235\.143\.24|9\.11\.237\.15)1|8\.215\.176\.210)|3(?:7\.(?:123\.98\.115|59\.238\.178)|1\.220\.4\.213))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:8\.(?:24\.1(?:7(?:4\.16[67]|5\.[34]|3\.80)|80\.91)|52\.(?:123\.212|247\.103))|0\.(?:1(?:07\.140\.77|81\.113\.2)|200\.211\.229|81\.196\.71|0\.60\.238)|2\.1(?:63\.197\.135|57\.58\.136|98\.90\.51)|3\.95\.(?:90\.194|69\.58)|5\.242\.161\.10|4\.11\.24\.156|9\.127\.57\.67)|1(?:3\.(?:130\.70\.113|21\.228\.230|6\.248\.194)|6\.1(?:12\.(?:66\.102|5\.136)|93\.90\.26)|2\.1(?:84\.172\.244|63\.150\.30)|9\.(?:184\.214\.18|201\.141\.81)|1\.(?:68\.104\.132|30\.77\.129)|7\.(?:131\.158\.34|36\.77\.170)|8\.244\.239\.2)|8(?:4\.(?:22\.(?:1(?:77\.5[12]|1\.23)|2(?:30\.213|7\.171))|107\.148\.206)|3\.(?:136\.146\.(?:110|99)|238\.169\.86|98\.23\.158)|0\.211\.17(?:0\.86|9\.30)|7\.4\.111\.218|9\.75\.63\.114)|2(?:1\.(?:1(?:34\.238\.129|99\.18\.220|2\.167\.95)|2(?:2\.(?:127\.17|34\.166)|6\.229\.197))|3\.(?:234\.230\.45|63\.18\.226)|4\.42\.124\.136|5\.75\.235\.127|2\.70\.220\.99)|7(?:8\.(?:20(?:7\.158\.230|\.148\.11)|150\.174\.97)|7\.(?:21\.226\.10|1\.223\.7
3|99\.203\.2)|3\.(?:192\.144\.105|254\.227\.34)|2\.245\.216\.160|6\.192\.15\.229)|37\.1(?:35\.(?:1(?:1(?:2\.63|6\.87)|21\.32)|82\.99)|1(?:6\.122\.(?:218|60)|7\.87\.16))|\.(?:2(?:34\.38\.106|26\.84\.27)|(?:34\.181\.2|85\.17\.8)2|160\.73\.175|93\.21\.147)|4(?:1\.(?:8\.247\.(?:38|56)|0\.61\.16[56])|\.(?:52\.137\.(?:54|77)|139\.229\.36))|0(?:1\.(?:99\.28\.194|44\.3\.50)|3\.9\.15(?:7\.126|8\.181)|6\.187\.35\.127)|62\.(?:105\.25\.123|209\.207\.21))|2(?:1(?:1\.(?:1(?:5(?:4\.151\.24|7\.114\.13)3|91\.168\.166|72\.246\.74)|51\.249\.158|87\.184\.44)|8\.(?:1(?:51\.141\.75|92\.175\.84)|2(?:34\.108\.1|\.129\.5)3|4\.100\.252)|0\.(?:51\.(?:44\.48|3\.42)|45\.117\.249|109\.97\.63)|2\.(?:111\.205\.137|73\.75\.242)|9\.(?:240\.39\.201|139\.38\.49)|7\.(?:198\.3\.238|79\.231\.13)|3\.164\.18\.147)|2(?:1\.(?:2(?:14\.208\.226|04\.223\.38|32\.247\.27|\.144\.135)|19(?:4\.(?:128\.223|43\.10)|2\.134\.91))|2\.74\.20(?:3\.194|0\.2)|0\.227\.90\.238)|0(?:0\.(?:247\.100\.178|109\.248\.20|31\.105\.172)|2\.(?:1(?:37\.2
2\.200|0\.42\.74)|29\.22\.183)|9\.190\.38\.107)|4\.172\.17\.78|\.183\.155\.2)|6(?:1\.(?:1(?:7(?:5\.223\.1(?:4[12]|39)|7\.248\.202)|3(?:3\.125\.162|6\.68\.76)|6(?:6\.55\.153|3\.37\.76)|8(?:1\.252\.6|5\.4\.164)|43\.158\.244)|238\.148\.161|38\.186\.117|55\.156\.210)|0\.(?:2(?:9\.(?:15\.194|75\.142)|14\.223\.178)|13\.167\.30|8\.63\.52)|5\.(?:60\.15\.18[46]|125\.155\.90)|4\.181\.43\.79|7\.90\.21\.150|2\.64\.7\.244)|9(?:1\.2(?:12\.124\.153|33\.188\.154|03\.69\.41)|5\.1(?:5(?:4\.106\.18|9\.105\.2)|30\.9\.89)|(?:4\.77\.199\.14|0\.150\.9\.3)8|2\.(?:51\.109\.182|247\.60\.5)|3\.1(?:59\.191\.24|84\.71\.6)6)|8(?:2\.(?:114\.79\.254|207\.51\.92)|3\.1(?:11\.92\.120|74\.202\.54)|6\.111\.144\.194|4\.235\.57\.122|5\.234\.22\.126)|7(?:(?:7\.245\.175\.14|6\.72\.169\.20)6|8\.1(?:59\.227\.142|41\.67\.151)|2\.35\.20\.131|0\.38\.71\.55)|4(?:1\.(?:226\.11\.117|78\.77\.253)|2\.121\.11(?:7\.15|8\.12)3|6\.249\.46\.104|9\.248\.113\.50)|5(?:9\.(?:11\.237\.151|8\.26\.22)|4\.235\.143\.241|8\.215\.176\.210)|31\.220\
.4\.213)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work