You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/09/02 08:59:08 UTC
svn commit: r1519359 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Mon Sep 2 06:59:08 2013
New Revision: 1519359
URL: http://svn.apache.org/r1519359
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1519359&r1=1519358&r2=1519359&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Mon Sep 2 06:59:08 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201308302
+## khop-sc-neighbors.cf v 20130922
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:8[68]|13)|37)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:8[68]|22)|37)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:4\.42\.1(?:3[678]|54)|9\.184\.214|6\.112\.5)|(?:87\.4\.11|\.93\.2)1|21\.(?:22\.127|54\.54)|77\.5\.230)|2(?:17\.219\.123|21\.214\.221)|61\.133\.125|91\.233\.188)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:4\.42\.13[78]|9\.184\.214|5\.71\.238)|9(?:5\.245\.118|8\.24\.175)|21\.54\.54|77\.5\.230)|2(?:1(?:7\.(?:219\.12|12\.11)3|8\.2\.129)|21\.214\.221|\.183\.155))\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:8\.244\.239|6\.112\.66)|2(?:1\.199\.18|5\.60\.156)|4(?:\.139\.229|1\.0\.61)|76\.192\.15)|(?:218\.2\.12|90\.150\.)9|61\.55\.156|82\.207\.51)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:8\.244\.239|6\.112\.66)|4(?:\.139\.229|1\.0\.61)|25\.60\.156|76\.192\.15|87\.4\.111)|9(?:1\.233\.188|0\.150\.9)|61\.55\.156|82\.207\.51)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:1(?:61\.232\.157|84\.172\.244|24\.15\.141)|216\.(?:55\.162|30\.50))|6\.1(?:12\.(?:66\.102|5\.136)|93\.90\.26)|7\.(?:131\.158\.34|239\.107\.21)|1\.(?:68\.104\.132|30\.77\.129)|9\.1(?:84\.214\.18|93\.93\.25)|4\.26\.128\.143|5\.71\.238\.141|8\.244\.239\.2)|9(?:0\.(?:2(?:02\.116\.101|21\.18\.114)|1(?:07\.140\.77|81\.113\.2)|82\.89\.156|0\.60\.238)|8\.(?:24\.1(?:80\.91|75\.3)|52\.247\.103)|2\.1(?:63\.193\.199|57\.58\.136)|3\.(?:255\.143\.62|95\.90\.194)|5\.2(?:29\.106\.222|45\.118\.5)|4\.11\.24\.156|6\.3\.181\.162)|2(?:1\.(?:1(?:99\.18\.220|2\.167\.95)|22\.(?:127\.17|34\.166)|78\.119\.193)|5\.(?:39\.163\.161|75\.235\.127)|4\.(?:42\.124\.136|207\.34\.91)|3\.234\.230\.45|8\.134\.37\.121)|8(?:3\.(?:98\.23(?:5\.12|\.158)|136\.146\.110|238\.169\.86)|7\.(?:111\.255\.130|4\.111\.218)|9\.(?:75\.63\.114|3\.25\.146)|0\.211\.17(?:0\.86|9\.30)|4\.82\.214\.35)|7(?:8\.(?:20(?:7\.158\.230|\.148\.11)|150\.174\.97)|7\.(?:21\.226\.10|5\.230\.
114|99\.203\.2)|3\.(?:200\.90\.196|44\.178\.104)|6\.192\.15\.229)|0(?:1\.(?:1(?:0\.34\.153|5\.253\.4)|99\.28\.194)|3\.9\.15(?:8\.1(?:47|81)|7\.126)|9\.228\.132\.146)|4(?:\.(?:52\.137\.(?:54|77)|139\.229\.3[456])|1\.(?:0\.61\.16[56]|105\.65\.10)|8\.223\.59\.187)|3(?:7\.1(?:16\.1(?:22\.218|14\.52)|35\.82\.99)|8\.91\.176\.45)|\.(?:2(?:15\.206\.242|26\.84\.175)|93\.21\.147|85\.17\.82)|(?:51\.236\.192|68\.62\.178)\.146)|2(?:1(?:2\.(?:1(?:11\.205\.137|44\.254\.122)|2(?:47\.140\.71|3\.234\.45)|68\.44\.194)|8\.(?:56\.(?:161\.14|37\.250)|148\.85\.130|4\.100\.252|2\.129\.53)|1\.1(?:5(?:4\.151\.24|7\.114\.13)3|7(?:2\.251\.16|6\.76\.19)8)|7\.(?:219\.123\.59|12\.113\.67)|9\.(?:239\.227\.81|139\.38\.49)|3\.164\.18\.147|0\.109\.97\.63)|0(?:2\.(?:1(?:0(?:3\.241\.169|\.42\.73)|37\.22\.200|29\.52\.94)|29\.241\.33)|1\.1(?:8\.(?:107\.234|95\.158)|16\.199\.34)|3\.(?:156\.250\.101|239\.45\.202)|9\.190\.38\.107|0\.222\.4\.90|8\.98\.51\.46)|2(?:2\.(?:7(?:4\.20(?:3\.194|0\.2)|3\.95\.48)|1(?:69\.224\.242|17\
.219\.97)|200\.186\.18|92\.141\.155|35\.61\.196)|1\.2(?:14\.2(?:08\.226|21\.148)|04\.223\.38)|0\.68\.224\.45)|4\.172\.17\.78|\.183\.155\.2)|6(?:1\.(?:1(?:7(?:5\.223\.1(?:34|42)|7\.248\.202)|(?:05\.174|81\.252)\.6|33\.125\.162|66\.55\.153)|55\.156\.210|32\.38\.3)|0\.(?:19(?:0\.43\.1[04]|6\.58\.189)|29\.(?:15\.194|75\.142))|4\.1(?:81\.43\.79|91\.34\.51|4\.85\.2)|9\.198\.197\.156|5\.60\.15\.184|7\.90\.21\.150)|9(?:5\.(?:1(?:5(?:4\.106\.18|9\.105\.2)|30\.9\.89)|78\.123\.159)|1\.2(?:1(?:2\.124\.153|0\.0\.226)|33\.188\.154|03\.69\.41)|3\.1(?:59\.160\.164|23\.54\.138|84\.71\.66)|0\.(?:83\.184\.211|150\.9\.38)|2\.(?:51\.109\.182|247\.60\.5)|4\.77\.199\.148)|8(?:3\.(?:111\.92\.120|238\.208\.55)|(?:4\.17\.27\.24|0\.240\.35\.)5|2\.(?:114\.79\.254|207\.51\.92)|6\.111\.144\.194)|4(?:2\.12(?:1\.11(?:7\.15|8\.12)3|0\.18\.118)|1\.2(?:08\.150\.116|26\.11\.117)|6\.249\.46\.104|9\.248\.113\.50)|5(?:9\.(?:1(?:1\.237\.151|51\.37\.8|2\.17\.6)|8\.26\.22)|8\.(?:215\.176\.210|143\.131\.79)|4\.216\.223\.122)
|7(?:(?:8\.141\.67\.15|2\.35\.20\.13)1|9\.174\.204\.134)|3(?:6\.237\.212\.172|7\.123\.98\.115))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:216\.(?:55\.162|86\.253|30\.50)|1(?:84\.172\.244|24\.15\.141))|8\.(?:2(?:17\.180\.116|44\.239\.2)|130\.107\.235|46\.127\.36)|6\.1(?:12\.(?:66\.102|5\.136)|24\.128\.138|93\.90\.26)|7\.(?:131\.158\.34|239\.107\.21)|9\.(?:184\.214\.18|201\.141\.81)|1\.(?:68\.104\.132|30\.77\.129)|4\.26\.128\.143|5\.71\.238\.141|3\.0\.85\.249)|9(?:0\.(?:107\.140\.77|221\.18\.114|82\.89\.156|0\.60\.238)|8\.24\.1(?:7(?:4\.16[67]|5\.[234]|3\.80)|80\.91)|(?:3\.255\.143\.|6\.3\.181\.1)62|2\.1(?:63\.193\.199|57\.58\.136)|5\.2(?:29\.106\.222|45\.118\.5)|4\.11\.24\.156)|8(?:4\.(?:22\.(?:1(?:77\.5[12]|1\.23)|2(?:30\.213|7\.171))|82\.214\.35)|3\.(?:136\.146\.110|98\.23\.158)|7\.(?:111\.255\.130|4\.111\.218)|0\.211\.179\.30|9\.3\.25\.146)|2(?:1\.(?:22\.(?:127\.17|34\.166)|78\.119\.193)|5\.(?:39\.163\.161|75\.235\.127)|4\.(?:42\.124\.136|207\.34\.91)|3\.234\.230\.45|8\.134\.37\.121)|4(?:\.(?:52\.137\.(?:54|77)|139\.229\.3[456]|33\.121\.67)|1\.(?:0\.61\
.16[56]|105\.65\.10)|8\.223\.59\.187)|7(?:3\.(?:200\.90\.196|44\.178\.104)|7\.(?:5\.230\.114|69\.8\.50)|6\.192\.15\.229|8\.20\.148\.11)|0(?:3\.9\.15(?:8\.1(?:47|81)|7\.126)|1\.1(?:0\.34\.153|5\.253\.4)|9\.228\.132\.146)|\.(?:2(?:2(?:0\.158\.3|6\.84\.27)|15\.206\.242)|93\.21\.147)|3(?:7\.1(?:16\.114\.52|35\.82\.99)|8\.91\.176\.45)|(?:51\.236\.192|68\.62\.178)\.146)|2(?:1(?:8\.(?:1(?:5(?:1\.141\.75|9\.9\.7)|48\.85\.130)|56\.(?:161\.14|37\.250)|4\.100\.252|2\.129\.53)|1\.1(?:7(?:2\.251\.168|4\.120\.123)|5(?:4\.151\.24|7\.114\.13)3|11\.250\.177)|2\.(?:144\.254\.122|247\.140\.71|68\.44\.194)|7\.(?:219\.123\.59|12\.113\.67)|3\.164\.18\.147|9\.239\.227\.81|0\.109\.97\.63)|2(?:2\.(?:7(?:4\.20(?:3\.194|0\.2)|3\.95\.48)|1(?:69\.224\.242|00\.140\.4)|200\.186\.18|92\.141\.155|35\.61\.196)|1\.214\.2(?:08\.226|21\.148)|0\.68\.224\.45)|0(?:2\.(?:1(?:29\.52\.94|0\.42\.73)|29\.241\.33)|1\.1(?:8\.(?:107\.234|95\.158)|16\.199\.34)|0\.(?:142\.133\.21|222\.4\.90)|3\.156\.250\.101)|\.183\.155\.2)|6(?:1\.
(?:1(?:75\.223\.1(?:3[49]|4[12])|33\.125\.162|66\.55\.153|81\.252\.6)|238\.148\.161|55\.156\.210|32\.38\.3)|0\.(?:19(?:0\.43\.1[04]|1\.142\.233|6\.58\.189)|29\.(?:15\.194|75\.142))|4\.(?:1(?:81\.43\.79|91\.34\.51|4\.85\.2)|71\.156\.216)|9\.(?:198\.197\.156|64\.49\.109)|2\.141\.37\.85|5\.60\.15\.184|7\.90\.21\.150)|9(?:3\.1(?:59\.1(?:60\.164|91\.246)|23\.54\.138|84\.71\.66)|1\.2(?:1(?:2\.124\.153|0\.0\.226)|33\.188\.154)|5\.(?:78\.123\.159|159\.105\.2)|0\.(?:83\.184\.211|150\.9\.38)|4\.77\.199\.148)|5(?:8\.(?:1(?:43\.131\.79|50\.97\.242)|215\.176\.(?:109|210))|9\.(?:1(?:1\.237\.151|51\.37\.8|2\.17\.6)|8\.26\.22)|4\.216\.223\.122)|8(?:(?:3\.238\.208\.5|4\.17\.27\.24|0\.240\.35\.)5|2\.(?:207\.51\.92|99\.246\.10)|6\.111\.144\.194|7\.103\.197\.93)|4(?:1\.(?:2(?:08\.150\.116|26\.11\.117)|137\.24\.4)|2\.12(?:1\.118\.123|0\.18\.118)|9\.248\.113\.50)|7(?:(?:8\.141\.67\.15|2\.35\.20\.13)1|9\.1(?:74\.204\.13|42\.176\.2)4|4\.216\.223\.82)|3(?:7\.1(?:59\.192\.162|23\.98\.115)|6\.237\.212\.172))\
b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|3\.56\.2(?:4[589]|5[01]|25)|5\.63\.(?:[89]|1[012345])|9\.3(?:6\.21[23]|9\.195)|2\.215\.(?:6[34]|44)|4\.108\.203)|8(?:6\.(?:1(?:23\.135|67\.242)|37\.203)|3\.93\.(?:1[12]5|9[78]|69|84)|1\.66\.15[67]|2\.18\.222)|2(?:5\.(?:44\.24[1456]|60\.156)|(?:2\.155\.4|1\.54\.5)4|3\.136\.106|4\.107\.127)|9(?:0\.(?:113\.21[01]|234\.10[56])|7\.25(?:2\.[01]|4\.224))|0(?:3\.(?:2(?:8\.184|0\.37)|30\.72|5\.27)|9\.127\.8[016])|77\.(?:154\.139|47\.106)|30\.193\.1(?:46|65))|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.(?:194\.115|82\.81)|2\.29\.176)|1(?:3\.143\.[56]0|2\.34\.12))|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|69|70)|19\.19[01])|9\.55\.25[24])|4(?:1\.2(?:54\.[1258]|23\.161)|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|3\.(?:56\.2(?:4[589]|5[01]|25)|18(?:7\.1[67]|5\.6))|5\.(?:63\.(?:[89]|1[012345])|58\.135)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|4\.1(?:08\.2(?:03|14)|34\.189)|2\.215\.(?:6[34]|44)|0\.52\.[0123]|9\.36\.21[23])|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|6\.(?:123\.135|37\.203)|8\.(?:165\.168|73\.252)|1\.66\.15[67]|2\.18\.222)|2(?:5\.(?:44\.24[134567]|60\.156)|(?:1\.54\.[45]|2\.155\.4)4|3\.(?:136\.106|30\.165)|4\.107\.127)|9(?:0\.(?:113\.2(?:1[01]|09)|234\.10[56])|7\.2(?:5(?:2\.[01]|4\.224)|16\.21))|0(?:3\.(?:2(?:0\.(?:37|8)|8\.184)|30\.72|1\.69|5\.27)|9\.127\.8[016])|7(?:3\.232\.19|7\.47\.106)|30\.193\.1(?:46|65)|42\.234\.186)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:2\.(?:29\.17[67]|153\.84)|3\.(?:82\.8[17]|194\.115))|1(?:3\.(?:143\.[56]0|55\.105)|2\.34\.12)|22\.140\.157|\.179\.211)|5(?:8\.(?:50\.
(?:1(?:[2345]|0[456789]|1[016789])|69|70)|19\.19[01])|9\.(?:55\.254|99\.136))|4(?:1\.2(?:54\.[1258]|23\.161)|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6