You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/05/30 08:57:22 UTC
svn commit: r1487768 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Thu May 30 06:57:22 2013
New Revision: 1487768
URL: http://svn.apache.org/r1487768
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1487768&r1=1487767&r2=1487768&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Thu May 30 06:57:22 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201305292
+## khop-sc-neighbors.cf v 201305302
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -20,7 +20,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:1[37]|86)|2)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|95|2)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -92,7 +92,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:73\.212\.250|89\.108\.118|12\.90\.197|51\.84\.131|03\.30\.72|21\.54\.54)|2(?:(?:03\.210\.8|17\.198\.)3|21\.194\.128)|6(?:1\.78\.109|6\.96\.213)|87\.236\.232|46\.53\.195)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:1\.(?:181\.251|54\.54)|0\.(?:128\.2|84\.13))|84\.82\.(?:10|2)9|73\.212\.250|12\.90\.197|03\.30\.72)|58\.25(?:3\.216|4\.168)|46\.53\.195|66\.96\.213)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -111,7 +111,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:20\.(?:128\.2|84\.13)|78\.172\.152|84\.82\.154|03\.9\.158|12\.90\.90)|2(?:08\.(?:71\.172|82\.114)|10\.21\.225)|(?:66\.199|72\.42)\.224|46\.32\.233|80\.36\.130)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:78\.172\.(?:1(?:52|83)|229)|12\.9(?:7\.3[6789]|0\.90)|03\.(?:30\.73|9\.158)|51\.84\.131|84\.82\.154|20\.84\.13)|2(?:08\.(?:71\.172|82\.114)|10\.21\.225)|(?:66\.199|72\.42)\.224|46\.32\.233|80\.36\.130)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -129,7 +129,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:90\.90\.(?:2[0123]|1[67])|186\.46\.107)|5\.(?:88\.(?:119\.132|247\.131)|22\.80\.197)|4\.(?:207\.113\.55|46\.193\.148)|7\.(?:102\.116\.253|20\.3\.231)|3\.(?:132\.128\.85|31\.42\.30)|0\.165\.125\.152|8\.97\.196\.163|9\.193\.93\.25)|8(?:4\.82\.(?:1(?:5(?:9\.237|4\.51)|20\.235|09\.14)|29\.3[34])|9\.(?:1(?:08\.118\.194|\.181\.53)|39\.35\.168|75\.63\.114)|0\.(?:1(?:59\.216\.41|76\.11\.202)|225\.131\.176)|8\.(?:1(?:27\.230\.28|68\.46\.53)|252\.0\.237)|6\.226\.48\.16)|7(?:8\.(?:1(?:48\.210\.173|68\.43\.130)|2(?:11\.46\.190|0\.148\.11))|3\.(?:192\.144\.105|212\.250\.230)|4\.36\.167\.116|7\.1\.223\.103)|9(?:5\.1(?:38\.195\.125|91\.184\.82)|0\.(?:107\.140\.77|82\.89\.156)|8\.23\.145\.114|9\.255\.11\.29|4\.106\.16\.6)|0(?:8\.(?:174\.62\.168|62\.62\.235)|3\.9\.15(?:7\.181|6\.89)|1\.44\.12\.250|9\.195\.23\.55)|21\.181\.2(?:37\.251|51\.188)|33\.242\.115\.44)|2(?:0(?:8\.(?:82\.114\.(?:4[4579]|2[359]|5[13]|39)|71\.172\.(?:8[4578
9]|9[1234])|113\.254\.39)|2\.(?:1(?:09\.133\.181|42\.203\.19|58\.39\.250)|71\.136\.200|29\.241\.57)|3\.(?:(?:93\.108\.14|155\.102\.)2|2(?:55\.15\.146|10\.83\.23))|0\.(?:(?:142\.133\.2|94\.77\.)1|7(?:2\.11\.132|9\.27\.60))|9\.190\.73\.156|1\.45\.114\.3)|1(?:0\.(?:2(?:1\.225\.2(?:3[5689]|44)|45\.89\.69)|5(?:1\.44\.199|6\.23\.100))|1\.(?:1(?:(?:36\.104\.20|47\.211\.1)6|15\.68\.32)|54\.17\.201)|3\.(?:230\.128\.226|171\.39\.154|81\.164\.57)|6\.15(?:3\.136\.125|8\.66\.190)|7\.(?:198\.3\.238|24\.246\.35)|2\.6\.152\.211)|2(?:2\.(?:2(?:11\.91\.20|36\.16\.14)|174\.(?:155\.19|54\.164)|92\.112\.66)|1\.(?:1(?:94\.128\.22[34]|32\.35\.7)|2(?:32\.247\.27|\.144\.135))|0\.94\.235\.200|3\.4\.233\.162)|4\.127\.201\.172)|6(?:1\.(?:1(?:6(?:4\.42\.158|6\.55\.153)|87\.186\.150|55\.159\.9)|2(?:8\.114\.3[56]|52\.138\.195)|7(?:8\.109\.61|0\.83\.58)|98\.131\.141)|6\.(?:199\.22(?:4\.(?:[368]|1[0123468])|7\.197)|96\.213\.13[48]|84\.49\.9)|4\.(?:120\.170\.138|71\.130\.190)|(?:2\.13\.171|9\.65\.43)\.46|0\.
190\.25\.42|8\.115\.192\.7)|8(?:(?:0\.(?:36\.130\.13|70\.2\.18)|1\.15\.172\.14)5|3\.(?:18\.234\.202|238\.208\.55|3\.103\.227)|7\.236\.232\.231|5\.214\.90\.114)|7(?:2\.(?:42\.224\.(?:[579]|1[0123468]|2[024])|35\.20\.131)|8\.136\.93\.251|4\.9\.203\.186)|4(?:6\.(?:32\.23(?:2\.144|3\.22)|182\.24\.130)|2\.121\.127\.201|9\.159\.221\.6)|5(?:8\.(?:254\.168\.(?:5[689]|6[013])|151\.149\.118)|\.39\.220\.234)|9(?:2\.255\.235\.215|1\.205\.52\.253|5\.48\.24\.10)|37\.(?:206\.210\.13|122\.211\.2)0)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:90\.90\.2[0123]|186\.46\.107|216\.102\.98)|5\.(?:88\.(?:119\.132|247\.131)|22\.80\.197)|4\.(?:207\.113\.55|46\.193\.148)|8\.(?:114\.77\.116|97\.196\.163)|9\.19(?:2\.252\.1|3\.93\.25)|0\.45\.1(?:36\.181|40\.89)|3\.31\.42\.30|7\.20\.3\.231)|8(?:4\.82\.(?:1(?:5(?:9\.237|4\.51)|20\.235|09\.14)|29\.3[34])|8\.(?:1(?:27\.230\.28|68\.46\.53)|252\.0\.237)|0\.(?:225\.131\.176|176\.11\.202)|9\.(?:108\.118\.194|39\.35\.168)|3\.101\.38\.202)|7(?:3\.(?:192\.144\.105|212\.250\.230)|8\.(?:148\.210\.173|211\.46\.190)|4\.36\.167\.116|7\.1\.223\.103)|9(?:5\.1(?:38\.195\.125|91\.184\.82)|(?:0\.82\.89\.15|4\.106\.16\.)6|8\.23\.145\.114|9\.255\.11\.29)|2(?:1\.(?:181\.2(?:37\.251|51\.188)|78\.180\.19)|2\.165\.225\.177|3\.0\.199\.126)|0(?:8\.(?:174\.62\.168|62\.62\.235)|3\.9\.15(?:7\.181|6\.89)|9\.195\.23\.55)|3(?:0\.255\.190\.22|3\.242\.115\.4)4|51\.84\.131\.107|49\.255\.3\.158|\.234\.3\.13)|2(?:1(?:0\.(?:2(?:1\.225\.2(?:3[059]|4[24]|
27|53)|45\.89\.69)|5(?:1\.44\.199|6\.23\.100))|3\.(?:1(?:71\.39\.154|32\.241\.7|86\.39\.43)|230\.128\.226|81\.164\.57)|1\.(?:1(?:36\.104\.20|47\.211\.1)6|54\.17\.201)|9\.(?:68\.209\.240|80\.238\.185)|7\.(?:198\.3\.238|24\.246\.35)|6\.153\.136\.125|8\.234\.108\.13|2\.6\.152\.211)|0(?:8\.(?:82\.114\.(?:5[13579]|4[4579]|2[359])|71\.172\.(?:8[45789]|9[1234])|113\.254\.39)|3\.(?:(?:93\.108\.14|155\.102\.)2|2(?:55\.15\.146|10\.83\.23))|0\.(?:(?:142\.133\.2|94\.77\.)1|7(?:2\.11\.132|9\.27\.60))|2\.(?:1(?:42\.203\.19|58\.39\.250)|71\.136\.200)|1\.(?:22\.7\.225|45\.114\.3))|2(?:0\.(?:130\.231\.172|94\.235\.200)|1\.1(?:94\.128\.22[34]|32\.35\.7)|2\.174\.155\.19)|4\.127\.201\.172)|6(?:1\.(?:1(?:64\.42\.158|10\.156\.4)|7(?:8\.109\.61|0\.83\.58)|252\.138\.195|98\.131\.141)|6\.(?:199\.224\.(?:[68]|1[01234568]|20)|96\.213\.13[48]|84\.49\.9)|(?:(?:2\.13\.171|9\.65\.43)\.4|0\.247\.79\.22)6|4\.(?:120\.1(?:70\.138|81\.94)|71\.130\.190)|8\.115\.192\.7)|8(?:(?:1\.(?:15\.172\.14|23\.106\.7)|0\.(?
:36\.130\.13|70\.2\.18))5|3\.(?:18\.234\.202|238\.208\.55|3\.103\.227)|7\.(?:106\.242\.230|236\.232\.231)|5\.214\.90\.114)|7(?:2\.(?:42\.224\.(?:1[012346789]|2[024]|7)|35\.20\.131)|6\.74\.186\.237|8\.136\.93\.251|4\.9\.203\.186)|4(?:6\.(?:32\.23(?:2\.144|3\.22|4\.78)|182\.24\.130)|9\.159\.221\.6|1\.137\.24\.4)|5(?:8\.2(?:54\.168\.(?:5[6789]|6[013])|37\.102\.214)|\.39\.220\.254)|37\.(?:206\.210\.13|122\.211\.2)0|9(?:4\.249\.59\.13|5\.48\.24\.10))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work