You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2014/01/29 08:59:07 UTC
svn commit: r1562375 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Jan 29 07:59:06 2014
New Revision: 1562375
URL: http://svn.apache.org/r1562375
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1562375&r1=1562374&r2=1562375&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Jan 29 07:59:06 2014
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201401282
+## khop-sc-neighbors.cf v 201401292
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:8\.244\.239|7\.19\.75)|84\.22\.197)|6(?:1\.163\.101|0\.29\.104|9\.175\.40)|2(?:10\.183\.179|21\.238\.21)|(?:31\.192\.11|75\.144\.8)1)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:8\.244\.239|7\.19\.75)|84\.(?:22\.197|82\.179)|73\.212\.205)|2(?:10\.183\.179|21\.238\.21)|6(?:1\.163\.101|0\.29\.104)|75\.144\.81)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:1\.(?:50\.12|9\.207)|3\.246\.195)|9(?:0\.234\.10[56]|8\.143\.150)|8(?:1\.66\.15[67]|4\.22\.53)|2(?:0\.84\.13|5\.93\.77)|73\.208\.(?:186|215)|34\.255\.250|16\.112\.66|57\.14\.103)|9(?:1\.218\.245|4\.20\.224)|217\.23\.6|74\.91\.31)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:1\.(?:50\.12|9\.207)|3\.246\.195)|2(?:0\.(?:143\.55|84\.13)|5\.93\.77)|9(?:0\.234\.10[56]|8\.143\.150)|8(?:1\.66\.15[67]|4\.22\.53)|73\.208\.(?:186|215)|16\.112\.66|57\.14\.103)|9(?:1\.218\.245|4\.20\.224)|7(?:8\.25\.120|4\.91\.31)|217\.23\.6)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:1(?:63\.156\.109|29\.166\.86)|2(?:17\.180\.116|44\.239\.2)|4(?:6\.127\.36|1\.157\.3)|97\.186\.94)|2\.(?:1(?:84\.172\.244|68\.218\.86)|216\.(?:105\.90|86\.253)|90\.239\.211)|9\.(?:1(?:61\.161\.188|10\.108\.92|93\.93\.25)|42\.147\.114|82\.231\.126)|6\.(?:1(?:12\.66\.102|93\.90\.26)|255\.241\.111)|4\.(?:141\.253\.14|247\.23\.66)|5\.8(?:8\.119\.132|5\.64\.210)|7\.19\.75\.(?:231|42)|0\.45\.156\.101)|8(?:4\.(?:22\.(?:1(?:97\.216|52\.8)|53\.(?:190?|201))|82\.1(?:7(?:1\.234|9\.117)|23\.85)|107\.159\.154)|3\.(?:86\.207\.130|98\.235\.12)|8\.2(?:19\.14\.43|6\.102\.92)|7\.162\.253\.250|2\.172\.22\.57)|2(?:1\.(?:1(?:81\.237\.251|34\.190\.59|58\.198\.78)|88\.54\.17)|5\.(?:75\.235\.127|93\.77\.125)|4\.(?:42\.13\.230|160\.35\.2)|3\.64\.199\.2(?:22|37)|2\.49\.119\.188)|9(?:8\.1(?:43\.1(?:50\.2(?:4[0789]|5[012]|39)|28\.144)|2\.80\.87)|0\.(?:107\.140\.76|90\.193\.202)|7\.(?:159\.16\.5|253\.6\.6)8|3\.109\.69\.14[57])|0(?:1\.(?:14\.(?:252\.
33|88\.119)|9\.207\.(?:11|23)9|50\.12\.132)|6\.245\.2(?:40\.205|50\.6)|9\.3\.159\.178)|7(?:3\.2(?:08\.(?:186\.8[3456]|215\.164)|12\.205\.158)|(?:2\.245\.62\.17|7\.80\.104\.5)2)|\.(?:234\.38\.106|85\.17\.82)|63\.177\.132\.1(?:44|65)|47\.175\.214\.72)|2(?:1(?:1\.(?:1(?:7(?:4\.(?:178\.175|215\.100)|2\.251\.168)|15\.68\.133)|232\.154\.6|54\.17\.201)|8\.(?:15(?:9\.195\.251|1\.141\.75)|234\.17\.176|36\.254\.141)|9\.(?:1(?:4(?:0\.69\.12|7\.172\.)2|39\.38\.49)|238\.181\.120)|7\.(?:23\.6\.(?:1(?:6[89]|08|46)|21[23])|146\.252\.9)|3\.13(?:5\.113\.197|9\.7\.95)|0\.183\.179\.(?:3[89]|4[45]))|2(?:1\.2(?:3(?:2\.247\.27|8\.21\.251)|14\.2(?:08\.226|14\.187)|04\.223\.38)|0\.(?:1(?:27\.225\.130|64\.162\.22)|68\.224\.45)|2\.(?:1(?:00\.234\.251|22\.227\.10)|35\.61\.196)|3\.130\.7\.69)|0(?:2\.(?:1(?:37\.22\.200|94\.119\.69)|2(?:07\.1\.234|34\.40\.41)|64\.73\.148|71\.98\.62)|3\.(?:2(?:3(?:0\.112\.4[45]|9\.125\.32)|52\.154\.246)|146\.140\.77))|7\.1(?:20\.103\.37|50\.45\.174)|3\.245\.26\.96|4\.48\.219\.49)|
9(?:3\.(?:1(?:57\.148\.102|84\.71\.66)|90\.102\.194)|1\.218\.245\.(?:[456789]|2\d?|1\d|30?)|(?:2\.50\.155\.21|4\.77\.199\.14)8)|6(?:1\.(?:1(?:63\.101\.42|41\.21\.34|9\.246\.93)|38\.186\.117)|0\.29\.104\.197|9\.175\.40\.106)|7(?:(?:7\.106\.232\.1|8\.29\.4\.)78|4\.91\.31\.2(?:29|30)|5\.144\.81\.177|6\.72\.254\.222)|4(?:6\.1(?:82\.92\.1(?:37|73)|91\.237\.118)|1\.(?:137\.24\.4|63\.166\.3))|58\.2(?:37\.102\.214|46\.179\.82)|31\.1(?:70\.106\.90|86\.87\.231)|85\.185\.112\.8)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:1(?:63\.156\.109|29\.166\.86)|2(?:17\.180\.116|44\.239\.2)|4(?:6\.127\.36|1\.157\.3)|97\.186\.94)|2\.(?:1(?:84\.172\.244|68\.218\.86)|216\.(?:105\.90|86\.253)|90\.239\.211)|6\.(?:1(?:12\.66\.102|93\.90\.26)|255\.241\.111)|9\.(?:1(?:10\.108\.92|93\.93\.25)|42\.147\.114)|7\.(?:19\.75\.(?:231|42)|6\.130\.159)|4\.(?:141\.253\.14|247\.23\.66)|5\.8(?:8\.119\.132|5\.64\.210)|0\.45\.156\.101)|8(?:4\.(?:22\.(?:1(?:97\.216|52\.8)|53\.(?:190?|201))|82\.1(?:7(?:1\.234|9\.117)|23\.85)|107\.159\.154)|3\.(?:86\.207\.130|98\.235\.12)|8\.2(?:19\.14\.43|6\.102\.92)|7\.162\.253\.250|5\.25\.150\.212)|9(?:8\.1(?:43\.1(?:50\.2(?:4[0789]|5[012]|39)|28\.1(?:39|44))|2\.80\.87)|0\.(?:107\.140\.76|90\.193\.202)|7\.(?:159\.16\.5|253\.6\.6)8|3\.109\.69\.14[57])|2(?:1\.1(?:5(?:1\.122\.3|8\.198\.7)8|81\.237\.251)|5\.(?:75\.235\.127|88\.123\.244|93\.77\.125)|4\.(?:42\.13\.230|160\.35\.2)|3\.64\.199\.2(?:22|37))|0(?:1\.(?:14\.252\.33|50\.12\.132|9\.207
\.119)|3\.(?:20\.7\.(?:161|225)|9\.223\.110)|6\.245\.2(?:40\.205|50\.6)|9\.3\.159\.178)|7(?:3\.2(?:08\.(?:186\.8[3456]|215\.164)|12\.205\.158)|2\.245\.(?:18\.10|62\.17)2|5\.124\.121\.47)|63\.177\.132\.1(?:44|65)|\.234\.38\.106)|2(?:1(?:1\.(?:1(?:7(?:4\.(?:178\.175|215\.100)|2\.251\.168)|15\.(?:68\.133|71\.18))|(?:44\.103\.1|54\.17\.20)1|232\.154\.6)|8\.(?:15(?:9\.195\.251|1\.141\.75)|234\.17\.176|36\.254\.141)|9\.(?:1(?:4(?:0\.69\.12|7\.172\.)2|39\.38\.49)|238\.181\.120)|0\.(?:183\.179\.(?:3[89]|4[45])|219\.203\.226)|7\.146\.252\.9|3\.139\.7\.95)|2(?:1\.2(?:3(?:2\.247\.27|8\.21\.251)|14\.2(?:08\.226|14\.187)|04\.223\.38)|0\.(?:1(?:27\.225\.130|64\.162\.22)|231\.105\.174|68\.224\.45)|2\.(?:122\.227\.10|35\.61\.196)|3\.130\.7\.(?:69|76))|0(?:3\.(?:2(?:3(?:0\.112\.4[45]|8\.64\.250|9\.125\.32)|52\.154\.246)|146\.140\.77)|2\.(?:1(?:37\.22\.200|94\.119\.69)|2(?:07\.1\.234|34\.40\.41)|64\.73\.148))|7\.1(?:20\.103\.37|50\.45\.174)|4\.48\.219\.49)|9(?:3\.(?:1(?:57\.148\.102|84\.71\.66)|90\.1
02\.194)|1\.218\.245\.(?:[456789]|2\d?|1\d|30?)|4\.(?:228\.215\.135|77\.199\.148)|2\.50\.155\.218)|6(?:1\.(?:1(?:63\.101\.42|41\.21\.34)|38\.186\.117)|7\.196\.86\.(?:32|47)|0\.29\.104\.197)|4(?:6\.1(?:82\.92\.(?:1(?:37|73)|9)|91\.237\.118)|1\.(?:137\.24\.4|63\.166\.3))|7(?:(?:7\.106\.232\.1|8\.29\.4\.)78|4\.91\.31\.2(?:2[79]|30)|5\.144\.81\.177)|5(?:8\.2(?:37\.102\.214|46\.179\.82)|9\.125\.240\.239)|3(?:1\.1(?:70\.106\.90|86\.87\.231)|7\.48\.66\.[23])|85\.185\.112\.8)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:[67]|(?:12|8)[4567]|5[01]?|48)|6\.207\.(?:5[012345678]|4[89]|60))|7(?:7\.(?:137\.19|36\.22)|1\.80\.1(?:7[01]|68))|8(?:1\.66\.15[67]|6\.251\.142)|90\.234\.10[56]|03\.240\.117)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.191\.26|9\.245\.91))|58\.5(?:0\.1(?:[2345]|1[13456789]|0[567])|4\.18[567]))\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:8(?:1\.66\.15[67]|6\.251\.142)|9(?:0\.234\.10[56]|2\.95\.63)|03\.240\.117|77\.36\.22)|2(?:09\.245\.9|7\.20\.24)1|58\.50\.117)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6