You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/06/24 08:57:11 UTC
svn commit: r1495935 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Mon Jun 24 06:57:11 2013
New Revision: 1495935
URL: http://svn.apache.org/r1495935
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1495935&r1=1495934&r2=1495935&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Mon Jun 24 06:57:11 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201306232
+## khop-sc-neighbors.cf v 201306242
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -20,7 +20,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|9[35])(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:2(?:01)?|117|93)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -39,7 +39,7 @@ score KHOP_SC_CIDR8 0.3 0.1 0.3 0.1
# 12.1449/0.0139 0.999 20100410 net, solo=12.1966/0.0197@0.998, ->.2 .1 .3 .2
# 10.3554/0.0112 0.999 20110227@510k solo=10.3717/0.0119@0.999, ->.3 .1 .3 .1
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|90)|37|2)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|86|90)|37)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -74,7 +74,7 @@ score KHOP_SC_CIDR16 1.0 0.2 1.0 0.2
# crap, still empty 20100410 bad scrape, script failed to populate rule
# crap, still empty 20110227 this is due to safety net exclusions -> 1 .2 1 .2
-header KHOP_SC_TOP_CIDR16 Received =~ /___ FAILED TO POPULATE ___/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b84\.126(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0.4
@@ -92,7 +92,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:3\.(?:192\.14[17]|232\.45)|4\.3(?:6\.164|7\.148))|88\.64\.184|92\.119\.66|03\.9\.158)|78\.138\.101|65\.60\.15)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:3\.(?:192\.14[17]|232\.45)|4\.36\.16[47]|7\.1\.223)|92\.119\.66|03\.9\.158)|78\.138\.101|65\.60\.15)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -111,7 +111,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.56\.2(?:4[89]|5[01])|0\.52\.[02])|84\.82\.(?:120|29)|25\.60\.156|74\.37\.167)|2(?:1(?:3\.230\.128|2\.48\.64)|08\.71\.172)|37\.122\.20[89]|66\.199\.224|50\.97\.3)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.56\.2(?:4[89]|5[01])|0\.52\.[02])|74\.37\.1(?:48|67)|84\.82\.(?:120|29)|06\.10\.151|25\.60\.156)|2(?:1(?:3\.230\.128|2\.48\.64)|08\.71\.172)|37\.122\.20[89]|50\.97\.3)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -129,7 +129,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:2(?:1(?:6\.(?:181\.110|55\.162|8\.158)|7\.(?:235\.138|161\.3))|20\.224\.59)|16(?:1\.232\.157|7\.170\.33|8\.218\.86|4\.62\.8))|9\.(?:1(?:9(?:4\.153\.187|7\.181\.120|2\.252\.1|3\.93\.25)|49\.148\.150)|201\.16\.211)|8\.(?:1(?:(?:14\.77\.11|29\.166\.8)6|68\.170\.103)|97\.196\.163)|5\.(?:88\.(?:119\.132|247\.131)|90\.96\.85)|0\.1(?:65\.125\.152|89\.168\.171)|4\.(?:47\.157\.97|27\.94\.29)|7\.211\.91\.147|3\.0\.85\.249)|7(?:4\.3(?:7\.1(?:67\.1(?:03|11|22)|48\.77)|6\.16(?:0\.157|4\.184|7\.116))|3\.(?:192\.14(?:4\.105|7\.114|1\.99)|232\.45\.4[01])|8\.(?:20(?:7\.158\.230|\.148\.11)|33\.144\.132)|7\.1(?:\.223\.(?:10|7)3|40\.162\.120))|8(?:0\.(?:2(?:25\.131\.176|11\.179\.30)|96\.16\.(?:69|72))|4\.(?:82\.(?:120\.2(?:10|35)|29\.3[34])|107\.58\.135)|8\.(?:1(?:27\.230\.28|68\.46\.53)|252\.0\.237)|3\.106\.116\.109|7\.120\.127\.27|9\.39\.35\.168)|9(?:5\.(?:1(?:38\.195\.125|91\.184\.82)|29\.81\.30)|9\.(?:30\.137\.13[89]|255\.11\.2
9)|2\.(?:163\.193\.205|74\.251\.118)|0\.(?:69\.155\.100|82\.89\.156)|4\.106\.16\.6)|2(?:1\.(?:1(?:5(?:6\.66\.110|7\.3\.252)|34\.238\.129|81\.251\.188)|22\.127\.17)|2\.(?:165\.225\.177|49\.119\.188)|8\.134\.37\.115|0\.50\.86\.3)|4(?:4\.76\.83\.111|9\.255\.3\.158|\.33\.121\.67)|3(?:3\.242\.115\.39|8\.91\.88\.93)|03\.9\.15(?:7\.181|8\.147)|58\.255\.2\.6[07]|\.226\.84\.175)|2(?:1(?:1\.(?:1(?:7(?:2\.242\.74|6\.61\.112)|47\.211\.16)|238\.133\.138|33\.121\.231)|3\.(?:2(?:11\.148\.159|30\.128\.226)|1(?:71\.39\.154|32\.241\.7))|0\.(?:2(?:10\.123\.47|45\.89\.69)|51\.44\.199)|7\.(?:2(?:00\.184\.87|3\.6\.196)|198\.3\.238)|8\.1(?:5(?:3\.247\.68|8\.3\.1)|64\.18\.225)|2\.(?:48\.64\.23|6\.152\.21)1|9\.145\.110\.118)|0(?:0\.(?:14(?:8\.125\.247|2\.133\.21)|7(?:2\.11\.132|9\.27\.60))|2\.(?:1(?:(?:58\.39\.25|20\.1\.3)0|42\.203\.19)|71\.136\.200)|9\.(?:2(?:23\.35\.20[35]|39\.114\.172)|144\.27\.22[89])|8\.(?:71\.172\.(?:8[456789]|9[0124])|113\.254\.39)|3\.(?:255\.15\.146|80\.244\.134|155\.102\.2)
|1\.(?:22\.7\.225|45\.114\.3))|2(?:2\.(?:161\.201\.132|99\.202\.239|236\.16\.14)|0\.9(?:0\.201\.143|4\.235\.200)|1\.214\.208\.226)|4\.127\.201\.172)|6(?:1\.(?:2(?:52\.138\.195|31\.19\.112|19\.62\.36)|1(?:64\.42\.158|47\.69\.79)|98\.(?:131\.141|77\.169)|42\.104\.99|57\.65\.125|70\.83\.58|32\.38\.3)|6\.(?:199\.224\.(?:1[479]|2[01])|84\.49\.9)|5\.60\.15\.18[46]|8\.115\.192\.7)|5(?:9\.1(?:(?:20\.213\.3|5\.76\.9)7|08\.47\.58)|\.(?:39\.220\.254|200\.9\.231)|8\.232\.221\.43|0\.97\.3\.89)|8(?:(?:7\.236\.232\.23|\.33\.183\.)1|3\.(?:18\.234\.202|3\.103\.227)|1\.23\.106\.75|2\.207\.51\.92)|7(?:8\.138\.101\.(?:1[014]|4)|7\.106\.232\.178|6\.74\.186\.237|2\.35\.20\.131|4\.9\.203\.186)|37\.(?:122\.2(?:0(?:8\.(?:148|237)|9\.89)|11\.100)|206\.210\.130)|9(?:3\.1(?:57\.148\.102|88\.8\.67)|5\.48\.24\.10)|4(?:6\.182\.24\.130|1\.137\.24\.4))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:2(?:1(?:6\.(?:181\.110|55\.162|8\.158)|7\.(?:235\.138|161\.3))|20\.224\.59)|16(?:1\.232\.157|7\.170\.33|8\.218\.86|4\.62\.8))|9\.(?:1(?:9(?:4\.153\.187|7\.181\.120|2\.252\.1|3\.93\.25)|49\.148\.150)|201\.16\.211)|8\.(?:1(?:(?:14\.77\.11|29\.166\.8)6|68\.170\.103)|41\.157\.7)|5\.(?:88\.(?:119\.132|247\.131)|90\.96\.85)|0\.1(?:65\.125\.152|89\.168\.171)|4\.(?:47\.157\.97|27\.94\.29)|7\.211\.91\.147|3\.0\.85\.249)|7(?:4\.3(?:7\.1(?:67\.1(?:03|11|22)|48\.77)|6\.16(?:0\.157|4\.184|7\.116))|7\.(?:1(?:\.223\.(?:10|7)3|40\.162\.120)|80\.102\.214)|3\.(?:192\.14(?:4\.105|7\.114|1\.99)|232\.45\.4[01])|8\.(?:20(?:7\.158\.230|\.148\.11)|33\.144\.132))|8(?:4\.(?:82\.(?:120\.2(?:10|35)|29\.3[34])|1(?:07\.58\.135|64\.130\.19))|0\.(?:2(?:25\.131\.176|11\.179\.30)|96\.16\.(?:69|72))|8\.(?:1(?:27\.230\.28|68\.46\.53)|252\.0\.237)|3\.106\.116\.109|7\.120\.127\.27|9\.39\.35\.168)|9(?:5\.(?:1(?:38\.195\.125|91\.184\.82)|29\.81\.30)|9
\.(?:30\.137\.13[89]|168\.141\.98|255\.11\.29)|0\.(?:69\.155\.100|82\.89\.156)|2\.74\.251\.118|3\.255\.143\.63|4\.106\.16\.6)|2(?:1\.(?:1(?:34\.238\.129|81\.251\.188|56\.66\.110)|2(?:54\.171\.15|2\.127\.17)|88\.255\.202)|2\.165\.225\.177|8\.134\.37\.115|0\.50\.86\.3)|4(?:4\.76\.83\.111|9\.255\.3\.158|\.33\.121\.67)|0(?:3\.9\.15(?:7\.181|8\.147)|1\.101\.152\.40)|\.(?:161\.108\.226|226\.84\.175)|58\.255\.2\.6[078]|33\.242\.115\.39)|2(?:1(?:1\.(?:1(?:7(?:2\.242\.74|6\.61\.112)|47\.211\.16)|238\.133\.138|33\.121\.231)|3\.(?:1(?:71\.39\.154|32\.241\.7)|230\.128\.226)|0\.(?:2(?:10\.123\.47|45\.89\.69)|51\.44\.199)|7\.(?:2(?:00\.184\.87|3\.6\.196)|198\.3\.238)|8\.1(?:5(?:3\.247\.68|8\.3\.1)|64\.18\.225)|2\.(?:48\.64\.23|6\.152\.21)1|9\.145\.110\.118|6\.194\.34\.210)|0(?:0\.(?:14(?:8\.125\.247|2\.133\.21)|7(?:2\.11\.132|9\.27\.60))|2\.(?:1(?:(?:58\.39\.25|20\.1\.3)0|42\.203\.19)|71\.136\.200)|9\.(?:2(?:39\.114\.172|23\.35\.205)|144\.27\.229)|8\.(?:71\.172\.(?:8[45689]|9[024])|113\.2
54\.39)|3\.(?:255\.15\.146|80\.244\.134|155\.102\.2)|1\.(?:22\.7\.225|45\.114\.3))|2(?:2\.(?:117\.219\.97|99\.202\.239|236\.16\.14)|0\.9(?:0\.201\.143|4\.235\.200)|1\.214\.208\.226)|4\.127\.201\.172)|6(?:1\.(?:2(?:52\.138\.195|31\.19\.112|19\.62\.36)|1(?:64\.42\.158|47\.69\.79)|(?:42\.104\.9|98\.77\.16)9|57\.65\.125|70\.83\.58|32\.38\.3)|6\.1(?:99\.224\.(?:1[79]|21)|68\.32\.82)|5\.60\.15\.18[46]|0\.196\.58\.189|8\.115\.192\.7)|7(?:8\.(?:138\.101\.(?:1[014]|4)|29\.4\.78)|7\.106\.232\.178|6\.74\.186\.237|2\.35\.20\.131|4\.9\.203\.186)|8(?:(?:3\.18\.234\.20|2\.207\.51\.9)2|(?:7\.236\.232\.23|\.33\.183\.)1|6\.111\.144\.194|1\.23\.106\.75)|5(?:9\.1(?:20\.213\.37|08\.47\.58)|\.(?:39\.220\.254|200\.9\.231)|8\.232\.221\.43|0\.97\.3\.89)|9(?:3\.1(?:57\.148\.102|88\.8\.67)|5\.(?:71\.126\.175|48\.24\.10)|1\.236\.252\.13)|37\.(?:122\.20(?:8\.(?:148|237)|9\.89)|206\.210\.130)|4(?:6\.182\.24\.130|1\.137\.24\.4))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work