You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2014/02/26 08:57:21 UTC
svn commit: r1571953 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Feb 26 07:57:21 2014
New Revision: 1571953
URL: http://svn.apache.org/r1571953
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1571953&r1=1571952&r2=1571953&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Feb 26 07:57:21 2014
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201402252
+## khop-sc-neighbors.cf v 201402262
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:(?:18|4)6|9?5)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:18[68]|9?5)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:84\.(?:82\.17[19]|22\.197)|98\.143\.128|03\.25\.146)|(?:67\.210\.24|85\.17\.2)7|23\.(?:231\.48|94\.15)|46\.107\.24)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:84\.(?:82\.17[19]|22\.197)|98\.143\.128|03\.25\.146)|(?:67\.210\.24|85\.17\.2)7|2(?:12\.48\.79|3\.94\.15)|79\.135\.46)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:0\.234\.10[56]|8\.143\.150|4\.105\.9)|8(?:1\.66\.15[67]|3\.182\.39|4\.22\.53)|2(?:0\.(?:143\.5|84\.13)|5\.60\.156)|0(?:3\.25\.146|1\.9\.205)|41\.105\.68)|(?:9(?:1\.218\.24|4\.20\.22)|217\.76\.7)4|46\.1(?:02\.187|82\.92)|31\.192\.111|67\.205\.67)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:0\.(?:143\.[57]|84\.13)|5\.60\.156)|8(?:1\.66\.15[67]|3\.182\.39|4\.22\.53)|9(?:0\.234\.10[56]|8\.143\.150)|0(?:3\.25\.146|1\.9\.205)|41\.105\.68)|(?:9(?:1\.218\.24|4\.20\.22)|217\.76\.7)4|46\.1(?:0(?:2\.187|7\.24)|82\.92)|31\.192\.111|67\.205\.67)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.(?:82\.1(?:7(?:1\.234|9\.117)|23\.85)|22\.(?:53\.(?:190?|201)|197\.216)|154\.143\.69)|5\.(?:10\.203\.12[345]|25\.150\.212)|0\.184\.30\.226|2\.162\.73\.193|3\.106\.150\.78)|1(?:2\.(?:2(?:20\.67\.13|16\.20\.5)0|168\.218\.86|90\.239\.211)|9\.(?:201\.16\.211|73\.234\.242)|0\.45\.1(?:36\.181|40\.89)|3\.130\.65\.161|8\.41\.157\.3)|9(?:8\.143\.1(?:50\.2(?:4[789]|5[012]|39)|28\.1(?:39|44))|2\.2(?:08\.185\.1(?:06|14)|27\.235\.155)|5\.112\.144\.10|4\.105\.9\.85)|2(?:1\.(?:1(?:34\.238\.129|59\.11\.164)|78\.1(?:16\.243|26\.228))|2\.49\.119\.188|4\.54\.230\.123)|4(?:1\.105\.68\.2(?:5[02]|48)|9\.210\.138\.143)|0(?:6\.243\.239\.34|1\.9\.205\.130)|\.2(?:09\.242\.218|26\.84\.175)|73\.212\.20(?:5\.158|9\.30)|62\.220\.57\.202)|2(?:1(?:1\.(?:2(?:3(?:3\.(?:64\.110|71\.76)|4\.117\.149|2\.183\.58)|20\.194\.144)|1(?:15\.71\.(?:18|35)|69\.224\.17|72\.246\.78))|0\.(?:183\.179\.(?:3[89]|45)|219\.203\.226)|2\.(?:48\.79\.12[37]|87\.28\.201)|8\.(?:234\
.108\.13|38\.29\.68)|6\.231\.136\.1(?:06|15)|3\.135\.113\.197|7\.169\.178\.174|9\.140\.69\.122)|0(?:2\.(?:1(?:18\.236\.178|97\.68\.201)|2(?:07\.1\.234|34\.40\.41))|3\.(?:160\.60\.139|239\.125\.32))|2(?:1\.(?:1(?:65\.38\.226|78\.236\.19)|214\.2(?:08\.226|14\.187))|2\.106\.216\.100|0\.67\.90\.31)|7\.(?:117\.113\.20|255\.70\.61)|3\.94\.15\.143)|6(?:1\.(?:3(?:8\.186\.(?:117|210)|5\.92\.92)|43\.97\.132)|7\.(?:2(?:10\.247\.(?:20|8)|05\.67\.7)|159\.53\.61)|6\.35\.75\.(?:1[39]|27)|4\.71\.187\.22[23]|2\.65\.133\.43)|8(?:8\.(?:208\.229\.139|198\.199\.35)|5\.17\.27\.(?:1(?:2[123]|00)|98)|9\.207\.128\.162|4\.203\.244\.50|7\.226\.224\.34)|9(?:1\.218\.244\.(?:2(?:1[012345678]|0[2349]|4[0189]|2[248]|3[34])|1(?:9[1234567]|36))|5\.211\.135\.83)|3(?:1\.(?:192\.111\.(?:7[012456789]|9[0123489]|100|8\d|68)|220\.43\.158)|6\.250\.229\.3[345])|7(?:(?:(?:7\.106\.232\.1|8\.29\.4\.)7|4\.204\.163\.14)8|9\.135\.46\.174|2\.9\.97\.116)|5(?:8\.(?:1(?:51\.(?:171\.114|38\.107)|26\.157\.18)|225\.62\.145)|\.133\.177\.
122)|4(?:6\.1(?:0(?:2\.187\.2(?:[5678]|2[89])|7\.24\.210)|82\.92\.133)|1\.137\.24\.4))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.(?:82\.1(?:7(?:1\.234|9\.117)|32\.203|23\.85)|22\.(?:53\.(?:190?|201)|197\.216)|154\.143\.69)|5\.(?:10\.203\.12[345]|25\.150\.212)|2\.1(?:62\.73\.193|72\.22\.59)|0\.184\.30\.226)|1(?:2\.(?:16(?:4\.175\.22|8\.218\.86)|90\.239\.211|216\.20\.50)|9\.(?:201\.16\.211|73\.234\.242)|3\.130\.65\.161|8\.41\.157\.3)|2(?:1\.(?:1(?:34\.238\.129|59\.11\.164)|78\.1(?:16\.243|26\.228)|88\.54\.17)|4\.(?:111\.189\.130|54\.230\.123)|2\.49\.119\.188)|9(?:8\.143\.1(?:50\.2(?:4[789]|5[012]|39)|28\.1(?:39|44))|2\.227\.235\.155|5\.112\.144\.10)|0(?:6\.243\.239\.34|1\.9\.205\.130|7\.150\.55\.35)|4(?:1\.105\.68\.2(?:5[02]|48)|9\.210\.138\.143)|7(?:3\.212\.205\.158|7\.80\.104\.52)|62\.(?:220\.57\.202|105\.18\.60)|\.2(?:09\.242\.218|26\.84\.175))|2(?:1(?:1\.(?:1(?:15\.71\.(?:18|35)|69\.224\.17|72\.246\.78)|2(?:3(?:2\.183\.58|3\.71\.76)|20\.194\.144))|0\.(?:21(?:7\.150\.19|9\.203\.22)6|183\.179\.(?:3[89]|45))|2\.(?:48\.79\.12[37]|87\.28\.201)|3\.135\.
113\.197|6\.231\.136\.106|7\.169\.178\.174|9\.140\.69\.122|8\.38\.29\.68)|0(?:2\.(?:1(?:09\.114\.192|97\.68\.201)|2(?:07\.1\.234|34\.40\.41))|3\.(?:160\.60\.139|239\.125\.32))|2(?:1\.(?:1(?:65\.38\.226|78\.236\.19)|214\.208\.226)|2\.106\.216\.100|0\.67\.90\.31)|7\.(?:117\.113\.20|255\.70\.61)|3\.94\.15\.143)|6(?:7\.(?:2(?:10\.2(?:24\.(?:196|214)|47\.(?:20|8))|(?:22\.132\.18|05\.67\.)7)|159\.53\.61)|1\.(?:3(?:8\.186\.(?:117|210)|5\.92\.92)|43\.97\.132)|6\.35\.75\.(?:1[39]|27|32)|4\.71\.187\.22[23])|9(?:1\.218\.244\.(?:2(?:1[01235678]|2[234568]|0[2349]|4[019]|3[34])|1(?:9[123467]|36))|5\.211\.135\.83)|8(?:5\.17\.27\.(?:1(?:2[123]|00)|98)|9\.207\.128\.162|4\.203\.244\.50|7\.226\.224\.34|8\.198\.199\.35)|3(?:1\.(?:192\.111\.(?:7[012456789]|8[012345789]|100|9\d|68)|220\.43\.158)|6\.250\.229\.3[2345])|5(?:8\.(?:1(?:51\.(?:171\.114|38\.107)|26\.157\.18)|225\.62\.145)|\.133\.177\.122)|4(?:6\.1(?:0(?:2\.187\.2(?:[5678]|2[89])|7\.24\.210)|82\.92\.133)|1\.137\.24\.4)|7(?:(?:(?:7\.106\.232\.1|8
\.29\.4\.)7|4\.204\.163\.14)8|9\.135\.46\.174))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|6\.207\.(?:6[0123]|4[89]|5\d)|5\.63\.1[014]|9\.36\.21[23])|8(?:6\.(?:1(?:3\.[01234567]|22\.4[4567])|37\.203)|3\.9(?:3\.11[45]|5\.6[67])|1\.66\.15[67]|8\.73\.252)|7(?:7\.(?:1(?:37\.19|1\.55)|36\.22)|1\.80\.1(?:6[89]|7[01]))|0(?:3\.2(?:40\.252|55\.193)|9\.127\.80)|9(?:0\.234\.10[56]|9\.19\.92)|2(?:3\.136\.10|5\.60\.15)6|30\.193\.14[67]|54\.65\.32)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|(?:01\.220\.24|12\.34\.1)2|4\.244\.23)|58\.(?:5(?:0\.1(?:[2345]|0[456789]|1\d)|4\.18[4567])|19\.19[01])|95\.83\.2(?:49|53)|41\.254\.[2568]|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|6\.207\.(?:6[0123]|4[89]|5\d)|5\.63\.(?:1[045]|8)|9\.36\.21[23])|8(?:6\.(?:1(?:3\.[01234567]|22\.4[4567])|37\.203)|3\.9(?:3\.11[45]|5\.6[67])|1\.66\.15[67]|8\.73\.252)|7(?:7\.(?:1(?:37\.19|1\.55)|36\.(?:17|22))|1\.80\.1(?:6[89]|7[01]))|0(?:3\.2(?:5(?:5\.19|3\.2)3|40\.252)|9\.127\.80)|9(?:0\.(?:234\.10[56]|113\.209)|9\.19\.92)|2(?:3\.136\.10|5\.60\.15)6|30\.193\.14[67]|54\.65\.32)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|(?:01\.220\.24|12\.34\.1)2|4\.244\.23)|58\.(?:5(?:0\.1(?:[2345]|0[456789]|1\d)|4\.18[4567])|19\.19[01])|95\.83\.2(?:49|53)|41\.254\.[2568]|79\.106\.109)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6