You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/04/16 08:57:15 UTC
svn commit: r1468316 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Tue Apr 16 06:57:15 2013
New Revision: 1468316
URL: http://svn.apache.org/r1468316
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1468316&r1=1468315&r2=1468316&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Tue Apr 16 06:57:15 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201304152
+## khop-sc-neighbors.cf v 201304162
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -20,7 +20,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|9[35])(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|95|2)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -39,7 +39,7 @@ score KHOP_SC_CIDR8 0.3 0.1 0.3 0.1
# 12.1449/0.0139 0.999 20100410 net, solo=12.1966/0.0197@0.998, ->.2 .1 .3 .2
# 10.3554/0.0112 0.999 20110227@510k solo=10.3717/0.0119@0.999, ->.3 .1 .3 .1
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|90)|37|2)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|90)|37|93)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -92,7 +92,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:4\.(?:141\.25|207\.11)|2\.97\.3)3|03\.(?:30\.72|9\.156)|88\.127\.225|21\.54\.54|76\.31\.36)|2(?:11\.33\.121|20\.94\.235)|67\.222\.145|78\.138\.102|91\.121\.250)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:0\.128\.2|1\.54\.54)|03\.(?:30\.72|9\.156)|41\.105\.64|76\.31\.36)|2(?:1(?:0\.168\.50|1\.33\.121)|20\.94\.235)|(?:59\.150\.25|67\.222\.14)5|78\.138\.102|91\.121\.250)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -111,7 +111,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:12\.97\.(?:24|33)|83\.221\.1[23]|78\.33\.144|20\.84\.13)|2(?:1(?:0\.21\.225|7\.23\.1?2)|08\.82\.114)|5\.39\.2(?:16|20)|66\.199\.228|72\.42\.224|80\.36\.130)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:(?:83\.221|20\.84)\.13|12\.97\.(?:24|33)|78\.33\.144)|2(?:1(?:0\.21\.225|7\.23\.12)|08\.82\.114)|72\.(?:42\.224|55\.179)|5\.39\.2(?:16|20)|66\.199\.228|80\.36\.130)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -129,7 +129,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:5\.(?:88\.119\.132|22\.80\.197|94\.87\.218)|4\.(?:141\.253\.13?4|207\.113\.55)|(?:3\.205\.159\.24|1\.89\.140\.)2|6\.(?:255\.164\.18|90\.162\.116)|2\.(?:217\.218\.218|90\.90\.16)|9\.1(?:84\.214\.18|93\.93\.25)|8\.97\.196\.163|7\.20\.3\.231)|9(?:5\.(?:1(?:3(?:8\.195\.125|\.200\.218)|91\.1(?:66\.25|84\.82)|28\.253\.152)|29\.81\.30)|(?:3\.243\.169\.6|6\.41\.123\.23)6|4\.(?:177\.40\.195|213\.122\.34)|8\.91\.90\.3[15]|9\.255\.11\.29)|7(?:8\.(?:33\.(?:144\.1(?:4[17]|37)|23\.107|38\.178)|2(?:07\.158\.230|18\.48\.23))|3\.2(?:00\.90\.196|24\.125\.98)|4\.13(?:7\.168\.212|3\.169\.98))|8(?:8\.(?:1(?:2(?:7\.230\.28|8\.99\.94)|68\.46\.53)|252\.0\.237)|7\.(?:32\.52\.161|16\.28\.18)|0\.211\.179\.30|2\.237\.2\.115|9\.38\.50\.28)|2(?:1\.(?:1(?:81\.251\.188|4\.17\.220)|22\.127\.17|78\.152\.51|49\.107\.2)|(?:(?:4\.243|5\.129)\.124\.20|2\.115\.57\.2)6)|4(?:1\.105\.64\.(?:100|91)|\.63\.74\.204)|0(?:9\.123\.100\.56|3\.9\.157\.181)|30\.193\.1
21\.162|\.234\.6\.7)|2(?:1(?:0\.(?:1(?:1(?:8\.26\.183|7\.6\.152)|68\.50\.16)|(?:245\.89\.6|51\.44\.19)9|48\.154\.253)|7\.(?:2(?:3\.(?:2\.1(?:2[68]|04|33|61)|12\.1(?:8[02]|96))|00\.184\.87)|17\.35\.146)|1\.(?:(?:147\.211\.1|206\.121\.6)6|3(?:3\.121\.196|6\.19\.58)|99\.212\.154)|3\.(?:1(?:92\.(?:73\.13|3\.6)6|86\.39\.43)|230\.128\.226|81\.164\.57)|2\.(?:227\.159\.133|6\.152\.211|49\.70\.48)|6\.153\.136\.125|9\.223\.252\.150|8\.194\.91\.238)|0(?:2\.(?:1(?:42\.203\.19|58\.39\.250|04\.22\.42)|4(?:3\.44\.32|4\.53\.64)|62\.104\.115|71\.136\.200|53\.13\.187)|0\.(?:7(?:2\.11\.132|9\.27\.60)|247\.100\.178|142\.133\.21)|1\.(?:39\.214\.247|22\.7\.225|45\.114\.3)|8\.82\.114\.(?:2[0246]|4[02]|38)|9\.(?:105\.248\.|62\.115\.7)4|3\.228\.43\.207)|2(?:2\.(?:1(?:22\.79\.121|74\.163\.2)|236\.16\.14)|0\.(?:110\.167\.22[78]|94\.235\.200)|1\.214\.2(?:08\.226|14\.187)))|7(?:2\.(?:42\.224\.(?:2[023567]|1[468])|35\.20\.131|55\.179\.55|9\.150\.200)|4\.(?:(?:86\.101\.2|9\.203\.18)6|122\.227\.124)|8\.138
\.10(?:2\.(?:2[789]|33)|1\.1)|(?:7\.106\.232\.17|9\.188\.87\.1)8|6\.74\.186\.237)|6(?:6\.(?:199\.228\.2(?:1[13456]|2[12]|07)|84\.(?:50\.133|49\.9))|1\.(?:1(?:66\.55\.153|9\.97\.69)|252\.138\.195|98\.131\.141)|4\.(?:15\.155\.49|20\.44\.140)|9\.90\.120\.188|5\.48\.43\.149|7\.90\.21\.150)|9(?:4\.(?:2(?:42\.227\.2(?:20|49)|3\.2\.185)|100\.89\.158)|1\.1(?:21\.(?:250\.218|184\.12)|02\.161\.10)|5\.(?:51\.156\.218|71\.126\.175|48\.24\.10)|0\.83\.184\.211|3\.89\.225\.96)|8(?:(?:0\.36\.130\.13|1\.15\.172\.14|3\.238\.208\.5)5|4\.(?:15\.191\.254|54\.160\.128)|9\.(?:107\.224\.242|42\.216\.55)|2\.195\.224\.101)|5(?:\.39\.2(?:20\.2(?:32|48)|16\.(?:34|57))|9\.150\.255\.35)|3(?:7\.206\.210\.1|1\.210\.47\.2)30|4(?:6\.137\.52\.222|1\.137\.24\.4))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:5\.(?:2(?:38\.129\.149|49\.63\.164|2\.80\.197)|88\.119\.132|94\.87\.218)|2\.(?:21(?:6\.181\.110|7\.218\.218)|164\.62\.8|90\.90\.16)|8\.(?:(?:219\.232\.24|97\.196\.16)3|129\.166\.86)|4\.(?:141\.253\.13?4|207\.113\.55)|(?:3\.205\.159\.24|1\.89\.140\.)2|6\.(?:255\.164\.18|90\.162\.116)|9\.1(?:84\.214\.18|93\.93\.25)|7\.20\.3\.231)|9(?:5\.(?:1(?:3(?:8\.195\.125|\.200\.218)|91\.1(?:66\.25|84\.82)|28\.253\.152)|29\.81\.30)|4\.(?:177\.40\.195|213\.122\.34)|3\.2(?:43\.169\.66|55\.143\.63)|0\.104\.199\.148|8\.91\.90\.3[15]|6\.41\.123\.236|9\.255\.11\.29)|8(?:8\.(?:1(?:2(?:7\.230\.28|8\.99\.94)|68\.46\.53)|252\.0\.237)|0\.(?:211\.179\.30|37\.242\.11)|7\.(?:32\.52\.161|16\.28\.18)|2\.237\.2\.115|9\.38\.50\.28)|7(?:8\.(?:33\.(?:144\.1(?:4[17]|37)|23\.107|38\.178)|2(?:07\.158\.230|18\.48\.23))|3\.2(?:00\.90\.196|24\.125\.98)|4\.13(?:7\.168\.212|3\.169\.98))|2(?:1\.(?:1(?:81\.251\.188|4\.17\.220)|22\.127\.17|78\.152\.51)|(?:(?:4\.2
43|5\.129)\.124\.20|2\.115\.57\.2)6)|0(?:9\.123\.100\.56|3\.9\.157\.181|1\.44\.3\.50)|4(?:1\.105\.64\.(?:100|91)|\.63\.74\.204)|30\.193\.121\.162|\.234\.6\.7)|2(?:1(?:0\.(?:1(?:18\.26\.183|68\.50\.16)|(?:245\.89\.6|51\.44\.19)9|48\.154\.253)|3\.(?:1(?:92\.(?:73\.13|3\.6)6|86\.39\.43)|230\.128\.226|81\.164\.57)|7\.(?:2(?:3\.(?:12\.1(?:8[02]|96)|2\.128)|00\.184\.87)|17\.35\.146)|1\.(?:(?:147\.211\.1|206\.121\.6|33\.121\.19)6|99\.212\.154)|2\.(?:227\.159\.133|6\.152\.211|49\.70\.48)|9\.(?:223\.252\.150|147\.172\.2)|6\.153\.136\.125|8\.194\.91\.238)|0(?:2\.(?:1(?:42\.203\.19|58\.39\.250|04\.22\.42)|4(?:3\.44\.32|4\.53\.64)|71\.136\.200|53\.13\.187)|0\.(?:7(?:2\.11\.132|9\.27\.60)|247\.100\.178|142\.133\.21)|8\.82\.114\.(?:2[01246]|4[02]|38)|9\.(?:105\.248\.|62\.115\.7)4|1\.(?:22\.7\.225|45\.114\.3))|2(?:2\.(?:1(?:22\.79\.121|74\.163\.2)|236\.16\.14)|0\.(?:110\.167\.22[78]|94\.235\.200)|1\.214\.2(?:08\.226|14\.187)))|7(?:2\.(?:42\.224\.(?:2[34567]|1[468])|35\.20\.131|55\.179\.55|
9\.150\.200)|8\.138\.10(?:2\.(?:2[789]|33)|1\.1)|(?:7\.106\.232\.17|9\.188\.87\.1)8|4\.(?:122\.227\.124|86\.101\.26)|6\.74\.186\.237)|6(?:1\.(?:1(?:66\.55\.153|9\.97\.69)|252\.138\.195|98\.131\.141)|6\.(?:199\.228\.2(?:1[123456]|2[12])|84\.(?:50\.133|49\.9))|4\.(?:15\.155\.49|20\.44\.140)|9\.90\.120\.188|7\.90\.21\.150)|9(?:4\.(?:2(?:42\.227\.2(?:20|49)|3\.2\.185)|100\.89\.158)|1\.1(?:21\.(?:250\.218|184\.12)|02\.161\.10)|5\.(?:51\.156\.218|71\.126\.175|48\.24\.10)|0\.83\.184\.211|3\.89\.225\.96)|8(?:(?:0\.36\.130\.13|3\.238\.208\.5)5|4\.(?:15\.191\.254|54\.160\.128)|9\.(?:107\.224\.242|42\.216\.55)|2\.195\.224\.101)|3(?:7\.(?:59\.(?:182\.39|36\.217)|206\.210\.130)|1\.210\.47\.230)|5(?:\.39\.2(?:20\.2(?:32|48)|16\.(?:34|57))|9\.150\.255\.35)|4(?:6\.137\.52\.222|1\.137\.24\.4))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work