You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2014/03/25 07:58:00 UTC
svn commit: r1581263 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Tue Mar 25 06:57:59 2014
New Revision: 1581263
URL: http://svn.apache.org/r1581263
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1581263&r1=1581262&r2=1581263&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Tue Mar 25 06:57:59 2014
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201403242
+## khop-sc-neighbors.cf v 201403252
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|9?5)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:117|46|95|2)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -42,7 +42,7 @@ score KHOP_SC_CIDR8 0.1 0.02 0.2 0.1
# 1.5335/0.5063 0.752 20130629@465k net, solo=1.5947/0.5379@0.748
# 2.0256/0.7432 0.732 20130705@376k solo=2.0429/0.7595@0.729, ->.1 .02 .2 .1
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|90)|37|2)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|86|90)|37)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:0\.222\.124|4\.82\.169)|92\.227\.167|73\.239\.56)|5(?:8\.254\.1(?:68|72)|\.172\.248)|6(?:4\.120\.202|6\.35\.77)|216\.172\.56|89\.46\.100|31\.3\.227)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:0\.2(?:04\.195|22\.124)|4\.82\.169)|92\.227\.167)|5(?:8\.25(?:1\.146|4\.172)|\.172\.248)|8(?:0\.241\.95|9\.46\.100)|216\.172\.56|91\.109\.10|31\.3\.227)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:1\.(?:14\.253|9\.205)|3\.25\.14[56])|2(?:2\.13\.132|5\.60\.156|0\.84\.13)|9(?:8\.143\.1(?:28|50)|5\.216\.196)|8(?:0\.222\.12[123]|3\.182\.39))|2(?:1(?:2\.146\.101|0\.48\.249)|3\.254\.138)|58\.251\.146|46\.182\.93|94\.20\.224)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:0\.222\.12[123]|3\.182\.39|5\.10\.201)|0(?:1\.(?:14\.253|9\.205)|3\.25\.14[56])|2(?:2\.13\.132|5\.60\.156|0\.84\.13)|9(?:8\.143\.1(?:28|50)|5\.216\.196))|2(?:1(?:2\.146\.101|0\.48\.249)|3\.254\.138)|46\.182\.93|94\.20\.224)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:8\.(?:1(?:43\.1(?:50\.2(?:4[789]|5[012]|39)|28\.1(?:39|44))|0(?:0\.30\.228|1\.13\.207))|66\.140\.195|38\.84\.120)|5\.(?:2(?:16\.196\.1(?:2[0125]|1[459])|22\.45\.217)|138\.65\.113)|2\.(?:2(?:10\.21(?:1\.57|5\.24)|27\.167\.117)|3\.150\.155)|0\.82\.89\.156)|8(?:4\.(?:82\.1(?:69\.1(?:1[45679]|2[245])|7(?:1\.234|9\.117)|30\.23[68]|48\.29)|22\.(?:53\.(?:190?|201)|197\.216|83\.154))|5\.(?:2(?:5\.(?:150\.211|252\.8)|4\.235\.204)|10\.201\.(?:237|48))|8\.64\.185\.(?:5[56]|64)|9\.112\.88\.65|0\.70\.94\.67)|2(?:1\.(?:1(?:3(?:4\.238\.129|6\.57\.163)|5(?:1\.122\.38|9\.11\.164)|81\.252\.228)|78\.88\.239|88\.5\.156)|4\.(?:42\.127\.221|54\.230\.123|160\.35\.2)|3\.64\.199\.23[67]|2\.49\.119\.188)|1(?:2\.(?:216\.(?:105\.9|20\.5)0|175\.17\.116)|8\.41\.(?:207\.57|157\.3)|0\.45\.140\.[78]9|3\.130\.65\.161|5\.88\.119\.132)|0(?:1\.(?:14\.(?:253\.59|89\.201)|9\.20(?:5\.127|6\.193))|6\.24(?:3\.239\.34|5\.250\.6)|9\.6\.150\.108|3\.21\.41\.84)|7(?:3\.2(
?:39\.56\.(?:[456]|1[23])|25\.121\.1[34]|12\.205\.158)|5\.123\.111\.135|6\.227\.202\.201|2\.245\.212\.24)|62\.248\.(?:5\.(?:26|60)|101\.153)|\.2(?:09\.242\.218|15\.239\.66)|4(?:2\.4\.14\.12|\.220\.59\.6)|57\.56\.112\.247)|2(?:1(?:1\.(?:2(?:3(?:2\.(?:154\.6|4\.12)|3\.64\.110)|18\.27\.11[02]|55\.1\.142)|1(?:7(?:4\.178\.175|2\.246\.78)|15\.71\.(?:18|35)|69\.224\.17))|8\.(?:1(?:47\.191\.179|51\.141\.75)|234\.108\.13|38\.29\.68)|0\.(?:217\.150\.195|183\.179\.44)|9\.14(?:0\.69\.12|7\.172\.)2|3\.247\.47\.2(?:1[24]|21)|2\.146\.101\.154|7\.8\.255\.206)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|04\.223\.38)|1(?:58\.243\.251|48\.35\.73))|2\.(?:106\.216\.100|78\.247\.67)|3\.164\.255\.194|0\.160\.243\.20)|0(?:3\.2(?:3(?:8\.64\.250|9\.125\.32)|40\.225\.115|55\.175\.147)|2\.(?:2(?:07\.1\.234|34\.40\.41)|77\.108\.58)|1\.83\.135\.100)|3\.(?:94\.104\.(?:163|40)|254\.138\.180)|7\.123\.25\.236)|9(?:1\.(?:1(?:09\.10\.223|87\.213\.57)|241\.187\.204)|5\.(?:172\.18\.5[12]|211\.142\.22)|3\.7(?:6\.225\.73|7\.19
9\.11)|2\.51\.109\.181)|6(?:1\.(?:38\.186\.(?:117|210)|106\.26\.226)|5\.55\.34\.(?:142|77)|2\.212\.89\.115|6\.35\.77\.203|4\.6\.237\.34)|7(?:7\.(?:1(?:06\.232\.178|23\.253\.50)|89\.162\.83)|8\.(?:3(?:6\.14\.195|9\.178\.2)|29\.4\.78)|2\.22\.74\.51)|8(?:6\.(?:64\.142\.28|98\.29\.251)|0\.24(?:5\.173|1\.95)\.218|9\.46\.100\.8[678]|5\.17\.132\.110)|3(?:6\.250\.(?:22(?:6\.(?:1[01]|5)|5\.3[6789])|86\.56)|1\.3\.227\.2(?:02|51))|4(?:9\.(?:159\.218\.39|213\.19\.227)|6\.182\.93\.(?:112|96)|1\.137\.24\.4)|5(?:8\.(?:151\.171\.114|246\.179\.82)|9\.4\.113\.11[67]))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:8\.(?:1(?:43\.1(?:50\.2(?:4[789]|5[012]|39)|28\.1(?:39|44))|0(?:0\.30\.228|1\.13\.207))|38\.84\.(?:120|91))|2\.(?:2(?:27\.16(?:5\.176|7\.117)|10\.21(?:1\.57|5\.24))|3\.150\.155)|5\.216\.196\.1(?:2[0125]|1[459])|0\.82\.89\.156)|2(?:1\.(?:1(?:8(?:1\.252\.228|6\.153\.33|9\.62\.186)|3(?:4\.238\.129|6\.57\.163)|5(?:1\.122\.38|9\.11\.164))|78\.(?:112\.37|88\.239)|254\.237\.37|88\.5\.156)|4\.(?:42\.127\.221|160\.35\.2)|2\.49\.119\.188|3\.64\.199\.236)|8(?:5\.(?:2(?:5\.(?:150\.211|252\.8)|4\.235\.204)|10\.201\.(?:237|48|50))|4\.82\.1(?:69\.1(?:1[45679]|2[245])|30\.23[68]|48\.29)|8\.64\.185\.(?:5[56]|64)|9\.112\.88\.65|0\.70\.94\.67)|1(?:2\.(?:2(?:16\.(?:105\.9|20\.5)0|20\.224\.59)|175\.17\.116)|(?:5\.88\.119\.13|6\.112\.66\.10)2|8\.41\.(?:207\.57|157\.3)|0\.45\.140\.[78]9|3\.130\.65\.161)|7(?:3\.2(?:39\.56\.(?:[456]|1[23])|25\.121\.1[34])|2\.24(?:5\.212\.24|6\.20\.10)|5\.123\.111\.135|6\.227\.202\.201)|0(?:1\.(?:14\.(?:253\.59|89\.20
1)|9\.205\.127)|6\.24(?:3\.239\.34|5\.250\.6)|9\.6\.150\.108|3\.21\.41\.84)|62\.248\.(?:5\.(?:26|60)|101\.153)|\.2(?:09\.242\.218|15\.239\.66)|4(?:2\.4\.14\.12|\.220\.59\.6)|57\.56\.112\.247)|2(?:1(?:1\.(?:2(?:3(?:2\.(?:154\.6|4\.12)|3\.64\.110)|18\.27\.11[02]|55\.1\.142)|1(?:7(?:4\.178\.175|2\.246\.78)|15\.71\.(?:18|35)|69\.224\.17))|8\.(?:1(?:47\.191\.179|51\.141\.75)|234\.108\.13|38\.29\.68)|0\.(?:183\.179\.(?:39|44)|217\.150\.195)|9\.14(?:0\.69\.12|7\.172\.)2|3\.247\.47\.2(?:1[24]|21)|2\.146\.101\.154|7\.8\.255\.206)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|04\.223\.38)|1(?:58\.243\.251|48\.35\.73))|2\.(?:1(?:06\.216\.100|17\.219\.97)|78\.247\.67)|3\.164\.255\.194|0\.160\.243\.20)|0(?:2\.(?:2(?:07\.1\.234|34\.40\.41)|7(?:7\.108\.58|9\.52\.53))|3\.2(?:40\.225\.115|39\.125\.32)|1\.83\.135\.100)|3\.(?:94\.104\.(?:163|40)|254\.138\.180)|7\.123\.2(?:4\.237|5\.236))|9(?:1\.(?:1(?:09\.10\.223|87\.213\.57)|241\.187\.204)|5\.(?:172\.18\.5[12]|211\.142\.22)|3\.7(?:6\.225\.73|7\.199\.11)|2\.
51\.109\.181|4\.229\.74\.178)|8(?:6\.(?:64\.142\.28|98\.29\.251)|0\.24(?:5\.173|1\.95)\.218|9\.46\.100\.8[678]|4\.108\.211\.115|5\.17\.132\.110)|6(?:1\.(?:38\.186\.(?:117|210)|106\.26\.226)|5\.55\.34\.(?:142|77)|2\.212\.89\.115|6\.35\.77\.203|4\.6\.237\.34)|7(?:7\.(?:1(?:06\.232\.178|23\.253\.50)|89\.162\.83)|8\.(?:3(?:6\.14\.195|9\.178\.2)|29\.4\.78)|2\.22\.74\.51)|3(?:6\.250\.(?:22(?:6\.(?:1[01]|5)|5\.3[6789])|86\.56)|1\.3\.227\.2(?:02|51))|4(?:6\.1(?:82\.93\.(?:112|96)|49\.19\.55)|9\.213\.19\.227|1\.137\.24\.4)|5(?:8\.(?:151\.171\.114|246\.179\.82)|9\.4\.113\.11[67]))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|6\.207\.(?:6[0123]|4[89]|5\d)|2\.215\.(?:6[34]|44)|3\.56\.24[89]|9\.36\.21[23]|4\.108\.203)|8(?:6\.(?:1(?:3\.[01234567]|22\.4[4567])|37\.203)|3\.9(?:3\.(?:11[45]|99)|5\.6[67])|8\.73\.252)|9(?:0\.113\.2(?:0[89]|1[01])|(?:8\.50\.23|9\.19\.9)2|7\.252\.[01]|4\.228\.11)|2(?:(?:3\.136\.10|5\.60\.15)6|2\.155\.(?:34|43))|0(?:3\.2(?:40\.252|51\.157)|9\.127\.80)|77\.(?:36\.[12]7|11\.55)|30\.193\.1(?:4[67]|65)|54\.65\.32)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:1\.(?:220\.24[23]|191\.255)|3\.191\.2[56]|2\.62\.16)|1(?:3\.143\.60|2\.5\.158)|4\.244\.23)|5(?:8\.(?:5(?:0\.1(?:[2345]|0[456789]|1\d)|4\.187)|19\.19[01])|\.1(?:02\.253|72\.248))|9(?:0\.(?:84\.144|174\.2)|5\.83\.2(?:49|53)|4\.230\.93)|41\.(?:254\.[2568]|158\.97)|7(?:8\.109\.26|9\.170\.54))\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|6\.207\.(?:6[0123]|4[89]|5\d)|2\.215\.(?:6[34]|44)|3\.56\.2(?:4[89]|50)|9\.36\.21[23]|4\.108\.203)|8(?:6\.(?:1(?:3\.[01234567]|22\.4[4567])|37\.203)|3\.9(?:3\.(?:11[45]|99)|5\.6[67])|8\.73\.252)|9(?:0\.113\.2(?:0[89]|1[01])|(?:8\.50\.23|9\.19\.9)2|7\.252\.[01]|4\.228\.11)|2(?:(?:3\.136\.10|5\.60\.15)6|2\.155\.(?:34|43))|0(?:3\.2(?:40\.252|51\.157)|9\.127\.80)|77\.(?:36\.[12]7|11\.55)|30\.193\.1(?:4[67]|65))|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:1\.(?:220\.24[23]|191\.255)|3\.191\.2[56]|2\.62\.16)|1(?:3\.143\.60|2\.5\.158)|4\.244\.23)|5(?:8\.(?:5(?:0\.1(?:[2345]|0[456789]|1\d)|4\.18[4567])|19\.19[01])|\.1(?:02\.253|72\.248))|9(?:0\.(?:84\.144|174\.2)|5\.83\.2(?:49|53)|4\.230\.93)|41\.(?:254\.[2568]|158\.97)|37\.239\.64|78\.109\.26)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6