You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2014/04/12 08:57:28 UTC
svn commit: r1586822 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sat Apr 12 06:57:28 2014
New Revision: 1586822
URL: http://svn.apache.org/r1586822
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1586822&r1=1586821&r2=1586822&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sat Apr 12 06:57:28 2014
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201404112
+## khop-sc-neighbors.cf v 201404122
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:0\.222\.124|9\.105\.238|3\.182\.39)|2(?:4\.156\.251|2\.13\.132|3\.64\.199)|01\.14\.253)|21(?:0\.(?:183\.179|217\.150)|3\.252\.247|7\.108\.148)|63\.247\.82)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:4\.(?:82\.12|22\.5)3|0\.222\.124|9\.105\.238|3\.182\.39)|2(?:4\.156\.251|2\.13\.132|0\.84\.13)|01\.14\.253)|21(?:0\.217\.150|2\.146\.101|3\.252\.247|7\.108\.148))\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:03\.2(?:5(?:\.14[56]|0\.0)|25\.80)|8(?:0\.222\.12[123]|4\.82\.17[19])|9(?:8\.143\.1(?:28|50)|4\.105\.9)|77\.179\.62|17\.19\.74|20\.84\.13)|2(?:1(?:2\.146\.101|3\.252\.247)|02\.62\.16|7\.123\.24)|46\.166\.179|5\.172\.248|94\.20\.224)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:3\.25(?:\.14[56]|0\.0)|1\.14\.91)|8(?:0\.222\.12[123]|4\.82\.17[19])|9(?:8\.143\.1(?:28|50)|4\.105\.9)|77\.179\.62|17\.19\.74)|2(?:13\.252\.247|02\.62\.16|7\.123\.24)|46\.166\.179|5\.172\.248|65\.54\.190)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:8\.1(?:43\.(?:1(?:50\.2(?:4[12345789]|5[012]|3[89])|28\.1(?:3[29]|44)|\.237)|2\.(?:184|222))|5\.(?:102\.(?:6[678]|70)|96\.22[789]|73\.5[59]))|5\.(?:138\.65\.113|230\.113\.7)|4\.1(?:58\.204\.250|05\.9\.85)|2\.227\.182\.207|3\.238\.111\.26|7\.253\.6\.68)|1(?:2\.(?:1(?:84\.172\.244|63\.149\.29|24\.27\.12)|2(?:16\.105\.90|20\.224\.59))|0\.(?:34\.231\.188|87\.218\.206|45\.140\.79)|(?:6\.112\.66\.10|7\.19\.74\.7)2|5\.(?:88\.119\.132|95\.101\.66)|8\.4(?:6\.127\.36|1\.157\.7)|3\.130\.65\.161)|2(?:1\.(?:1(?:8(?:1\.252\.228|6\.153\.33|9\.62\.186)|34\.238\.129)|78\.1(?:(?:26\.22|44\.15)8|1(?:2\.3|6\.7)7)|254\.172\.108)|3\.(?:64\.199\.2(?:1[89]|2[26]|36)|200\.28\.77)|(?:2\.224\.104\.15|5\.141\.199\.24)5|4\.156\.251\.122)|8(?:4\.(?:82\.1(?:7(?:1\.234|9\.117)|(?:30\.23|23\.8)5)|22\.(?:53\.190?|66\.138))|9\.1(?:05\.238\.126|12\.88\.65)|2\.1(?:62\.73\.193|72\.22\.59)|0\.250\.181\.70|3\.35\.209\.11|5\.12\.14\.247)|0(?:1\.(?:14\.253\.20|9\.205
\.39)|3\.2(?:5\.146\.125|1\.41\.84)|6\.245\.250\.6|7\.150\.41\.11)|7(?:3\.21(?:2\.205\.15|3\.80\.3)8|7\.179\.(?:121\.77|62\.35)|4\.137\.132\.164|9\.197\.186\.63)|\.(?:2(?:09\.242\.218|26\.84\.175)|11\.66\.70|85\.17\.82)|6(?:2\.2(?:16\.227\.1|48\.101\.)17|8\.62\.203\.221)|4(?:8\.235\.147\.69|\.220\.59\.63))|2(?:1(?:0\.(?:21(?:7\.150\.19[56]|9\.203\.226)|183\.179\.(?:3[89]|44))|8\.(?:147\.191\.179|202\.219\.75|85\.252\.186)|(?:2\.146\.101\.15|3\.148\.5\.24)4|1\.(?:53\.209\.117|23\.152\.19)|7\.1(?:08\.148\.77|47\.92\.16)|6\.168\.137\.80|9\.147\.172\.2)|2(?:0\.(?:6(?:8\.224\.45|7\.90\.31)|160\.24(?:7\.130|0\.95))|2\.(?:1(?:17\.219\.97|86\.43\.105)|201\.132\.28)|1\.214\.208\.226)|0(?:(?:0\.52\.182\.23|4\.68\.120\.15)6|3\.201\.172\.162|2\.234\.40\.41)|3\.(?:94\.10(?:1\.(?:73|95)|4\.81)|228\.64\.(?:3[789]|40))|7\.1(?:5(?:0\.160\.134|7\.251\.8)|23\.24\.2(?:3[27]|27)))|7(?:8\.(?:3(?:6\.14\.195|9\.178\.2)|29\.4\.78)|(?:9\.180\.167\.19|2\.22\.74\.5)1|7\.(?:106\.232\.178|74\.50\.36)|4\.204\.163
\.148|0\.98\.79\.216)|6(?:2\.(?:113\.242\.253|75\.207\.4|4\.27\.92)|3\.247\.82\.(?:19[4569]|20[2456])|0\.247\.27\.119|9\.46\.221\.50|1\.84\.94\.15)|8(?:5\.1(?:7\.132\.11[05]|85\.30\.163)|0\.241\.95\.218|3\.239\.83\.102|9\.46\.102\.45|4\.40\.22\.99)|9(?:1\.2(?:41\.187\.204|02\.25\.219)|3\.(?:90\.102\.194|57\.84\.18)|2\.51\.109\.181|4\.41\.52\.65)|4(?:6\.1(?:66\.179\.(?:5[023579]|4[24567])|91\.237\.118)|1\.137\.2[04]\.4)|5(?:8\.2(?:10\.206\.239|46\.179\.82)|0\.30\.45\.223)|3(?:8\.89\.160\.188|6\.39\.246\.33|7\.29\.108\.70))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:2(?:1\.(?:1(?:8(?:6\.153\.33|9\.62\.186)|34\.238\.129)|78\.1(?:1(?:(?:2\.3|6\.7)7|9\.193)|44\.158)|254\.172\.108)|3\.(?:64\.199\.2(?:1[89]|2[26])|200\.28\.77|30\.53\.56)|4\.(?:1(?:56\.251\.12|60\.35\.)2|42\.127\.221)|5\.(?:141\.199\.245|214\.216\.250|79\.225\.27)|2\.(?:224\.104\.15|182\.28\.24)5)|9(?:8\.1(?:43\.(?:1(?:50\.2(?:4[245789]|3[89]|5[01])|28\.1(?:32|44)|\.237)|2\.(?:184|222))|5\.(?:102\.(?:6[678]|70)|96\.22[789]))|5\.(?:2(?:30\.113\.7|9\.81\.30)|138\.65\.113)|(?:3\.238\.111\.2|0\.54\.13\.10)6|2\.227\.182\.207|4\.105\.9\.85|7\.253\.6\.68)|1(?:2\.(?:1(?:48\.206\.195|84\.172\.244|63\.149\.29|24\.27\.12)|2(?:16\.105\.90|20\.224\.59))|(?:9\.(?:193\.183\.22|82\.224\.24)|5\.88\.119\.13|7\.19\.74\.7)2|0\.(?:170\.190\.194|34\.231\.188|87\.218\.206)|8\.4(?:6\.127\.36|1\.157\.7)|3\.130\.65\.161)|8(?:4\.(?:22\.(?:53\.(?:190?|201)|197\.216|66\.138|83\.154)|82\.1(?:7(?:1\.234|9\.117)|23\.85))|9\.1(?:05\.238\.126|12\.88\.65)|2\.1(?:62
\.73\.193|72\.22\.59)|5\.1(?:2\.14\.24|4\.28\.12)7|0\.250\.181\.70|8\.168\.46\.53)|7(?:3\.21(?:2\.205\.15|3\.80\.3)8|7\.179\.(?:121\.77|62\.35)|4\.137\.132\.164)|0(?:3\.2(?:5\.146\.125|1\.41\.84)|1\.14\.(?:253\.20|91\.158)|6\.245\.250\.6)|\.(?:2(?:09\.242\.218|26\.84\.175|34\.3\.164)|11\.66\.70|85\.17\.82)|6(?:2\.216\.227\.117|8\.62\.203\.221)|4(?:8\.223\.59\.140|\.220\.58\.216)|30\.185\.152\.120)|2(?:1(?:1\.(?:1(?:15\.89\.141|47\.211\.16)|2(?:3\.152\.19|26\.10\.3)|53\.209\.117)|0\.(?:21(?:7\.150\.19[56]|9\.203\.226)|183\.179\.(?:3[89]|44))|8\.(?:147\.191\.179|202\.219\.75|85\.252\.186)|3\.(?:1(?:95\.77\.11|48\.5\.24)4|81\.164\.57)|7\.1(?:08\.148\.77|47\.92\.16)|2\.146\.101\.154|6\.168\.137\.80|9\.147\.172\.2)|0(?:2\.(?:1(?:(?:29\.216\.6|58\.39\.25)0|42\.203\.19)|234\.40\.41|53\.13\.187)|0\.(?:5(?:2\.182\.236|1\.45\.180)|(?:175\.56\.19|79\.27\.6)0)|9\.237\.150\.14[56]|3\.201\.172\.162|4\.68\.120\.156)|2(?:0\.(?:6(?:8\.224\.45|7\.90\.31)|160\.247\.130|90\.201\.3)|2\.(?:1(?:17\.219\.9
7|86\.43\.105)|201\.132\.28)|1\.214\.2(?:08\.226|14\.187))|3\.(?:94\.10(?:1\.(?:73|95)|4\.81)|228\.64\.(?:38|40))|7\.1(?:5(?:0\.160\.134|1\.127\.13)|23\.24\.23[27]))|8(?:5\.1(?:7\.132\.11[05]|85\.30\.163)|(?:2\.117\.194\.22|4\.40\.22\.9)9|3\.23(?:8\.208\.55|9\.83\.102)|6\.111\.243\.247|0\.241\.95\.218)|7(?:8\.(?:3(?:6\.14\.195|9\.178\.2)|29\.4\.78)|(?:9\.180\.167\.19|2\.22\.74\.5)1|7\.(?:106\.232\.178|75\.76\.26)|4\.204\.163\.148)|9(?:1\.2(?:41\.187\.204|02\.25\.219)|3\.(?:90\.102\.194|57\.84\.18)|4\.(?:232\.222\.26|41\.52\.65)|2\.51\.109\.181)|6(?:2\.(?:113\.242\.253|4\.27\.92)|0\.247\.27\.119|9\.46\.221\.50|1\.84\.94\.15)|4(?:6\.1(?:66\.179\.(?:4[2456]|59)|91\.237\.118)|1\.(?:33\.169\.36|137\.24\.4))|36\.(?:239\.2(?:04\.226|15\.178)|39\.246\.33)|58\.2(?:10\.206\.239|46\.179\.82))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|6\.207\.(?:6[0123]|4[89]|5\d)|2\.215\.(?:6[34]|44)|3\.185\.15)|9(?:(?:2\.227\.17|9\.19\.9)2|4\.2(?:19\.240|28\.32)|0\.113\.20[89])|0(?:3\.2(?:5(?:1\.157|3\.21|0\.0)|40\.252)|9\.127\.80)|8(?:6\.1(?:3\.[01234567]|22\.4[4567])|8\.73\.252)|2(?:(?:3\.136\.10|5\.60\.15)6|2\.155\.4[34])|77\.(?:53\.140|11\.55|36\.17)|30\.193\.1(?:47|65))|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:1\.220\.243|3\.205\.38|2\.62\.16)|12\.(?:73\.15[89]|5\.158)|4\.244\.23)|5(?:8\.50\.1(?:[2345]|1[01256789]|0[456789])|\.1(?:02\.253|72\.248))|9(?:1\.250\.24|4\.230\.9|5\.83\.25)3|3(?:7\.237\.168|1\.210\.91)|41\.254\.[2568]|64\.187\.109|84\.247\.1)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|2\.(?:215\.(?:6[34]|44)|72\.13)|6\.207\.(?:6[0123]|4[89]|5\d)|3\.185\.15)|9(?:(?:2\.227\.17|9\.19\.9)2|4\.2(?:19\.240|28\.32)|0\.113\.20[89]|7\.252\.[01])|8(?:6\.1(?:3\.[01234567]|22\.4[4567])|0\.194\.189|8\.73\.252)|0(?:3\.2(?:5(?:1\.157|3\.21|0\.0)|40\.252)|9\.127\.80)|2(?:(?:3\.136\.10|5\.60\.15)6|2\.155\.4[34])|77\.(?:53\.140|11\.55|36\.17)|30\.193\.1(?:47|65))|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:1\.220\.243|3\.205\.38|2\.62\.16)|12\.(?:73\.15[89]|5\.158)|4\.244\.23)|5(?:8\.50\.1(?:[2345]|0[456789]|1\d)|\.1(?:02\.253|72\.248))|9(?:(?:1\.250\.24|4\.230\.9|5\.83\.25)3|0\.174\.2)|3(?:7\.237\.168|1\.210\.91)|41\.254\.[2568]|64\.187\.109|84\.247\.1)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6