You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/04/07 08:57:18 UTC
svn commit: r1465328 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sun Apr 7 06:57:18 2013
New Revision: 1465328
URL: http://svn.apache.org/r1465328
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1465328&r1=1465327&r2=1465328&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sun Apr 7 06:57:18 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20130462
+## khop-sc-neighbors.cf v 20130472
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -20,7 +20,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:13|86)|9[35])(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|9[35])(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -92,7 +92,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:3\.(?:9\.15[67]|20\.75)|6\.241\.3)|2(?:0\.128\.2|1\.54\.54)|75\.45\.168)|2(?:1(?:0\.51\.44|2\.48\.65)|22\.174\.163|06\.71\.51)|78\.138\.101|5\.39\.216)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:3\.(?:9\.15[67]|20\.75)|6\.241\.3)|2(?:0\.128\.2|1\.54\.54)|15\.88\.247|75\.45\.168)|(?:46\.105\.13|78\.138\.10)1|2(?:06\.71\.51|12\.48\.65)|5\.39\.216)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -111,7 +111,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:5\.60\.156|0\.84\.13)|83\.221\.1[23]|03\.20\.75|12\.97\.24)|21(?:7\.2(?:00\.184|3\.2)|0\.21\.225)|7(?:8\.138\.106|2\.42\.224)|(?:80\.36\.13|5\.39\.22)0|66\.199\.228)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:5\.60\.156|0\.84\.13)|12\.97\.(?:24|33)|83\.221\.1[23]|03\.20\.75)|21(?:7\.2(?:00\.184|3\.2)|0\.21\.225)|7(?:8\.138\.106|2\.42\.224)|(?:80\.36\.13|5\.39\.22)0|66\.199\.228)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -129,7 +129,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:6\.(?:112\.66\.102|255\.164\.18|90\.162\.116)|9\.(?:19(?:2\.252\.1|3\.93\.25)|36\.138\.131)|2\.(?:216\.181\.110|164\.62\.8)|4\.1(?:13\.221\.66|41\.253\.14)|5\.(?:88\.247\.131|90\.96\.85)|1\.68\.104\.133|8\.129\.166\.86|3\.31\.42\.30)|9(?:5\.(?:1(?:(?:28\.253\.15|91\.184\.8)2|3(?:8\.195\.125|\.200\.218))|94\.11\.18)|3\.2(?:55\.143\.6[23]|00\.126\.14)|0\.(?:202\.116\.101|82\.89\.156)|9\.(?:46\.117\.226|255\.11\.29)|6\.46\.2\.228)|7(?:8\.(?:2(?:07\.158\.230|13\.33\.95)|3(?:2\.223\.8|3\.38\.17)8|49\.170\.57)|(?:3\.200\.90\.19|6\.53\.233\.7)6|4\.137\.168\.212|5\.117\.144\.15|7\.21\.1\.34)|8(?:8\.(?:127\.230\.28|252\.0\.237)|7\.(?:28\.204\.57|32\.52\.161)|0\.211\.1(?:91\.25|79\.3)0|3\.221\.12\.233|6\.202\.120\.49|5\.2\.12\.77)|2(?:1\.(?:1(?:58\.198\.76|2\.167\.95)|22\.127\.17|66\.95\.156|49\.107\.2)|\.158\.188\.(?:155|46)|0\.132\.132\.119)|0(?:9\.(?:195\.54\.231|236\.220\.98)|3\.9\.157\.181|6\.241\.3\.217|1\.44\.3\.50)|4(?:
4\.76\.31\.172|\.63\.74\.204)|30\.193\.121\.162|\.226\.83\.81)|2(?:1(?:1\.(?:1(?:15\.127\.32|47\.211\.16|74\.179\.80|96\.186\.53)|2(?:0(?:6\.133\.94|2\.3\.156)|22\.53\.83)|58\.255\.121|43\.149\.60)|7\.(?:2(?:3\.2\.1(?:2[59]|3[23]|5[35]|61)|19\.1(?:23\.59|32\.15)|00\.184\.87)|12\.113\.67)|3\.(?:2(?:30\.128\.226|51\.186\.229)|1(?:71\.39\.154|86\.39\.43)|81\.164\.57|0\.89\.6)|0\.(?:1(?:18\.26\.227|3\.210\.84|68\.50\.16)|(?:245\.89\.6|51\.44\.19)9|91\.133\.143)|8\.(?:1(?:(?:53\.247\.6|94\.91\.23)8|45\.71\.192)|5(?:0\.1\.146|6\.32\.11))|9\.(?:223\.252\.15|143\.3\.21)0|2\.4(?:8\.65\.34|9\.70\.48)|6\.153\.136\.125)|0(?:0\.(?:7(?:2\.11\.132|9\.27\.60)|247\.100\.178|142\.133\.21)|2\.(?:1(?:42\.203\.19|58\.39\.250)|71\.136\.200)|1\.(?:195\.239\.27|22\.7\.225|45\.114\.3)|3\.(?:236\.93\.14|155\.102\.)2|8\.115\.2(?:22\.116|44\.54)|4\.13\.169\.37|6\.71\.51\.153)|2(?:1\.2(?:07\.220\.140|14\.208\.226)|2\.(?:255\.27\.140|174\.163\.2))|\.183\.155\.2)|6(?:1\.(?:1(?:3(?:3\.125\.162|8\.104\.30|6
\.68\.76)|75\.223\.142|66\.55\.153)|(?:55\.156\.21|80\.254\.22)0)|6\.(?:199\.22(?:8\.(?:20[01246]|19[678])|7\.11[57])|240\.232\.54|84\.50\.133)|0\.173\.11\.121)|9(?:1\.(?:1(?:44\.153\.211|21\.184\.12)|221\.176\.163)|5\.(?:51\.156\.218|48\.24\.10)|4\.(?:23\.2\.185|83\.91\.53)|3\.159\.160\.164)|8(?:9\.218\.(?:224\.(?:35|58)|94\.166|68\.90)|(?:0\.36\.130\.13|1\.15\.172\.14)5|2\.207\.51\.92|3\.3\.103\.227|5\.202\.5\.110)|7(?:8\.138\.10(?:6\.(?:3[0289]|5[25]|44)|1\.7)|4\.(?:122\.227\.124|9\.203\.186)|2\.42\.224\.(?:[58]|1[012])|9\.125\.72\.141)|4(?:6\.(?:99\.253\.158|137\.18\.7)|2\.121\.1(?:05\.138|17\.236)|9\.128\.40\.70|1\.137\.24\.4)|3(?:7\.(?:59\.(?:146\.2[125]|231\.22|36\.217|62\.186)|122\.208\.18)|1\.210\.47\.230)|5(?:9\.(?:11\.237\.151|34\.57\.88|60\.7\.146)|\.39\.2(?:20\.2(?:26|32)|16\.50)))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:7(?:8\.(?:3(?:3\.(?:170\.(?:85|93)|38\.178)|2\.223\.88)|2(?:07\.158\.230|36\.112\.56)|49\.170\.57)|(?:3\.200\.90\.19|6\.53\.233\.7)6|4\.137\.168\.212|5\.117\.144\.15|7\.67\.96\.244)|1(?:6\.(?:112\.66\.102|255\.164\.18|90\.162\.116)|8\.(?:219\.232\.243|129\.166\.86)|2\.(?:216\.181\.110|164\.62\.8)|5\.(?:88\.247\.131|90\.96\.85)|4\.113\.221\.66|9\.192\.252\.1)|9(?:5\.(?:1(?:(?:28\.253\.15|91\.184\.8)2|3(?:8\.195\.125|\.200\.218))|94\.11\.18)|3\.2(?:00\.126\.14|55\.143\.63)|9\.(?:46\.117\.226|255\.11\.29)|0\.82\.89\.156|6\.46\.2\.228)|2(?:1\.(?:1(?:58\.198\.76|25\.63\.87)|22\.127\.17|66\.95\.156|49\.107\.2)|\.158\.188\.(?:155|46)|0\.132\.132\.119|2\.112\.97\.124)|8(?:7\.(?:32\.52\.161|4\.80\.188)|0\.211\.179\.30|6\.202\.120\.49|8\.252\.0\.237)|0(?:9\.(?:195\.54\.231|236\.220\.98)|3\.9\.157\.181|6\.241\.3\.217)|4(?:9\.255\.3\.158|\.63\.74\.204)|30\.193\.121\.162|\.226\.83\.81)|2(?:1(?:1\.(?:1(?:15\.(?:127|68)\.32|47\.211\.16|
74\.179\.80|96\.186\.53)|2(?:0(?:6\.133\.94|2\.3\.156)|22\.53\.83)|4(?:3\.149\.60|0\.135\.4)|58\.255\.121)|8\.(?:1(?:(?:53\.247\.6|94\.91\.23)8|45\.71\.192)|5(?:0\.1\.146|6\.32\.11)|232\.111\.227)|3\.(?:2(?:30\.128\.226|51\.186\.229)|1(?:71\.39\.154|86\.39\.43)|81\.164\.57|0\.89\.6)|7\.(?:2(?:3\.2\.1(?:2[57]|5[35]|07|32|45)|00\.184\.87|19\.132\.15)|12\.113\.67)|0\.(?:1(?:18\.26\.227|68\.50\.16)|(?:245\.89\.6|51\.44\.19)9|91\.133\.143)|2\.4(?:8\.65\.34|9\.70\.48)|6\.153\.136\.125|9\.223\.252\.150)|0(?:0\.(?:7(?:2\.11\.132|9\.27\.60)|247\.100\.178|142\.133\.21)|1\.(?:195\.239\.27|82\.216\.162|22\.7\.225|45\.114\.3)|2\.(?:1(?:42\.203\.19|58\.39\.250)|71\.136\.200)|3\.(?:236\.93\.14|155\.102\.)2|6\.71\.51\.15[23]|4\.13\.169\.37)|2(?:1\.(?:1(?:61\.197\.65|43\.46\.13)|214\.208\.226)|2\.(?:174\.163\.2|236\.16\.14))|\.183\.155\.2)|6(?:1\.(?:1(?:3(?:8\.104\.30|6\.68\.76)|66\.55\.153)|(?:55\.156\.21|80\.254\.22)0)|6\.(?:199\.22(?:8\.(?:2(?:0[012468]|10)|19[6789])|7\.11[57])|84\.50\.13
3)|0\.173\.11\.121|9\.65\.45\.225)|9(?:1\.(?:1(?:44\.153\.211|21\.184\.12)|2(?:18\.114\.204|35\.126\.92))|3\.15(?:7\.148\.102|9\.160\.164)|5\.(?:51\.156\.218|48\.24\.10)|4\.(?:23\.2\.185|83\.91\.53))|7(?:8\.138\.10(?:6\.(?:3[0289]|5[25]|44)|1\.(?:[57]|12))|4\.(?:122\.227\.124|9\.203\.186)|2\.42\.224\.(?:[58]|1[01235])|7\.106\.232\.178|9\.125\.72\.141)|8(?:(?:0\.36\.130\.13|1\.15\.172\.14)5|9\.218\.(?:224\.35|94\.166)|4\.15\.191\.254|3\.3\.103\.227)|3(?:7\.(?:59\.(?:146\.2[125]|231\.22|36\.217)|122\.208\.18)|1\.(?:210\.47\.230|3\.243\.24))|4(?:6\.1(?:05\.131\.(?:1[67]|20)|37\.18\.7)|2\.121\.105\.138|9\.128\.40\.70|1\.137\.24\.4)|5(?:\.39\.2(?:20\.2(?:3[23]|26)|16\.50|5\.44)|9\.(?:11\.237\.151|60\.7\.146)))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -163,7 +163,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:2\.215\.(?:6[34]|44)|0\.52\.[028]|5\.63\.1[02]|8\.186\.86)|78\.172\.(?:1(?:5[234]|8[36])|229)|2(?:2\.155\.42|5\.60\.156)|83\.221\.1[23]|30\.193\.165|09\.127\.81|97\.252\.0)|(?:79\.106\.10|217\.76\.6|5\.44\.3)9|4(?:1\.254\.[158]|6\.227\.191)|85\.(?:115\.248|26\.184)|37\.17\.11[2345])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:7(?:8\.172\.(?:1(?:5[234]|8[36])|229)|3\.213\.124)|2(?:1\.63\.(?:1[78]|2[01])|2\.155\.42|5\.60\.156)|1(?:2\.215\.(?:6[34]|44)|8\.186\.86|0\.52\.8)|8(?:3\.221\.1[23]|6\.123\.135)|30\.193\.165|09\.127\.81|97\.252\.0)|4(?:1\.2(?:23\.16[12]|54\.[158])|6\.(?:227\.191|53\.195))|2(?:17\.(?:168\.185|76\.69)|02\.231\.248)|(?:79\.106\.10|5\.44\.3)9|85\.(?:153\.31|26\.184)|37\.17\.11[2345])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6