You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/09/23 08:59:15 UTC
svn commit: r1525514 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Mon Sep 23 06:59:15 2013
New Revision: 1525514
URL: http://svn.apache.org/r1525514
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1525514&r1=1525513&r2=1525514&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Mon Sep 23 06:59:15 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201309222
+## khop-sc-neighbors.cf v 201309232
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:3\.(?:30\.72|9\.157)|1\.15\.247)|12\.90\.222|78\.20\.148|21\.54\.54|38\.91\.79)|85\.25\.1(?:50|3)|211\.119\.86|58\.254\.172|64\.120\.169)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:1\.15\.2(?:47|51)|3\.30\.72)|12\.90\.222|78\.20\.148|21\.54\.54|38\.91\.79)|2(?:1(?:1\.119\.86|6\.155\.17)|21\.4\.142)|58\.254\.172|85\.25\.13)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:5\.60\.156|0\.84\.13)|98\.24\.17[45]|84\.82\.53)|2(?:06\.214\.(?:71|95)|13\.132\.241|21\.4\.142)|91\.218\.115|75\.75\.240|69\.64\.49)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:5\.60\.156|0\.84\.13)|98\.24\.17[45]|84\.82\.53)|2(?:06\.214\.(?:71|95)|13\.132\.241)|(?:75\.75\.24|85\.25\.15)0|91\.218\.115|69\.64\.49)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.(?:22\.(?:1(?:77\.5[12]|97\.216|1\.23)|27\.171)|82\.(?:53\.1(?:0[69]|43|1)|179\.117))|0\.(?:2(?:25\.148\.206|11\.179\.30)|166\.124\.90)|(?:8\.252\.0\.23|7\.75\.51\.6)7|9\.75\.63\.114)|9(?:0\.(?:10(?:7\.140\.77|9\.164\.81)|40\.40\.2)|8\.24\.1(?:7(?:4\.16[67]|5\.[234])|80\.91)|5\.(?:138\.195\.125|252\.108\.6)|9\.30\.137\.10[67]|2\.163\.193\.199|6\.203\.198\.130)|1(?:2\.(?:1(?:84\.172\.244|63\.150\.30)|94\.224\.236)|9\.(?:184\.214\.18|201\.16\.211|37\.195\.59)|8\.(?:46\.127\.36|175\.28\.3)|1\.249\.131\.159)|7(?:8\.(?:2(?:13\.110\.115|0\.148\.11)|168\.43\.130|63\.74\.6)|3\.2(?:12\.205\.158|00\.90\.196)|7\.(?:80\.102\.214|1\.223\.73))|2(?:1\.(?:1(?:34\.238\.129|81\.252\.228)|22\.127\.17)|2\.226\.95\.56|5\.46\.24\.62)|0(?:1\.(?:(?:8\.236\.24|44\.3\.5)0|15\.2(?:47\.163|51\.176))|3\.9\.157\.12[69])|4(?:8\.223\.59\.187|1\.0\.61\.166|\.63\.74\.204)|\.(?:215\.206\.24|85\.17\.8)2|38\.91\.(?:142\.235|79\.102))|2(?:1(?:1\.(?:1(?:7(?:2\.
251\.168|4\.120\.123)|19\.86\.14[3678])|23\.152\.19)|3\.1(?:3(?:6\.105\.21[02]|2\.241\.13)|9(?:5\.77\.114|9\.248\.27))|8\.(?:2(?:41\.238\.141|3\.57\.66)|56\.37\.250)|2\.(?:113\.32\.199|66\.60\.28)|9\.147\.172\.2|0\.51\.23\.91)|0(?:6\.214\.(?:95\.(?:7[0456789]|6[6789]|9[0134]|8\d)|71\.3[45])|0\.(?:7(?:2\.11\.132|9\.27\.60)|51\.45\.180)|3\.(?:171\.233\.243|239\.45\.202)|2\.(?:154\.192\.28|71\.136\.200)|8\.84\.135\.14[78]|1\.116\.199\.34)|2(?:1\.(?:214\.2(?:08\.226|14\.187)|4\.142\.9[013])|2\.(?:174\.54\.164|218\.142\.49)|0\.(?:142\.119\.8|68\.224\.4)5))|6(?:1\.(?:1(?:9\.255\.120|41\.21\.34)|38\.186\.117)|0\.(?:190\.(?:25\.42|43\.10)|214\.223\.178)|4\.(?:120\.169\.15[01]|206\.169\.165)|(?:6\.197\.212\.2|7\.90\.21\.1)50|9\.(?:198\.197\.156|64\.49\.109))|9(?:3\.(?:1(?:8(?:4\.71\.66|8\.8\.67)|59\.160\.164)|95\.98\.196)|1\.218\.115\.(?:5[234567]|4[39])|8\.126\.249\.106|0\.83\.184\.211)|8(?:5\.(?:25\.1(?:50\.162|3\.104)|17\.75\.15)|2\.(?:117\.194\.229|99\.246\.10)|8\.191\.154\.103|0\.91\.19
0\.188|7\.103\.170\.65)|7(?:5\.75\.240\.1(?:5[12345678]|4[189]|3\d)|7\.91\.229\.144|8\.141\.66\.122|2\.35\.20\.131)|5(?:9\.(?:1(?:88\.16\.(?:9[59]|101)|0\.7\.16)|66\.250\.144)|8\.213\.157\.68)|37\.5(?:7\.(?:158\.32|90\.39)|9\.61\.117)|41\.84\.135\.22)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.(?:22\.(?:1(?:77\.5[12]|97\.216|1\.23)|27\.171)|82\.(?:53\.1(?:0[69]|43|1)|179\.117))|0\.(?:2(?:25\.148\.206|11\.179\.30)|166\.124\.90)|(?:8\.252\.0\.23|7\.75\.51\.6)7|9\.75\.63\.114)|9(?:0\.(?:10(?:7\.140\.77|9\.164\.81)|40\.40\.2)|8\.24\.1(?:7(?:4\.16[67]|5\.[234])|80\.91)|5\.(?:138\.195\.125|252\.108\.6)|9\.30\.137\.10[67]|2\.163\.193\.199|6\.203\.198\.130)|1(?:8\.(?:(?:97\.196\.16|175\.28\.)3|46\.127\.36)|9\.(?:184\.214\.18|201\.16\.211|37\.195\.59)|2\.(?:220\.31\.132|94\.224\.236))|7(?:8\.(?:2(?:13\.110\.115|0\.148\.11)|168\.43\.130|63\.74\.6)|3\.2(?:12\.205\.158|00\.90\.196)|7\.(?:1\.223\.73|69\.8\.50))|2(?:1\.(?:1(?:34\.238\.129|81\.252\.228)|22\.127\.17)|5\.(?:75\.235\.127|46\.24\.62)|2\.226\.95\.56)|0(?:1\.(?:15\.2(?:47\.163|51\.176)|44\.3\.50)|3\.9\.157\.12[69])|4(?:8\.223\.59\.187|1\.0\.61\.166|\.63\.74\.204)|\.(?:215\.206\.24|85\.17\.8)2|38\.91\.(?:142\.235|79\.102))|2(?:1(?:1\.(?:1(?:7(?:2\.251\.168|4\.120\.12
3)|19\.86\.14[3678])|23\.152\.19)|3\.1(?:3(?:6\.105\.21[02]|2\.241\.13)|9(?:5\.77\.114|9\.248\.27))|8\.(?:2(?:41\.238\.141|3\.57\.66)|56\.37\.250)|0\.(?:183\.179\.44|245\.89\.69|51\.23\.91)|2\.(?:113\.32\.199|66\.60\.28)|9\.147\.172\.2|6\.155\.17\.3)|0(?:6\.214\.(?:95\.(?:6[6789]|9[0134]|7[089]|8\d)|71\.(?:3[456789]|40))|2\.(?:1(?:29\.216\.60|42\.203\.19|54\.192\.28)|71\.136\.200)|0\.(?:7(?:2\.11\.132|9\.27\.60)|51\.45\.180)|8\.84\.135\.14[78]|3\.171\.233\.243|1\.116\.199\.34)|2(?:1\.(?:214\.2(?:08\.226|14\.187)|4\.142\.9[13])|0\.(?:142\.119\.8|68\.224\.4)5|2\.174\.54\.164))|6(?:1\.(?:1(?:9\.255\.120|41\.21\.34)|38\.186\.117)|0\.(?:190\.(?:25\.42|43\.10)|214\.223\.178)|4\.(?:120\.169\.15[01]|206\.169\.165)|(?:6\.197\.212\.2|7\.90\.21\.1)50|9\.(?:198\.197\.156|64\.49\.109))|8(?:2\.(?:1(?:17\.194\.22|89\.158\.6)9|99\.246\.10)|5\.(?:25\.1(?:50\.162|3\.104)|17\.75\.15)|8\.191\.154\.103|0\.91\.190\.188|3\.18\.234\.202|7\.103\.170\.65)|9(?:3\.(?:1(?:8(?:4\.71\.66|8\.8\.67)|59\.160\.164)|9
5\.98\.196)|1\.218\.115\.(?:5[234567]|49)|8\.126\.249\.106|0\.83\.184\.211)|7(?:5\.75\.240\.1(?:5[2345678]|3\d|41)|7\.91\.229\.144|8\.141\.66\.122|2\.35\.20\.131)|5(?:9\.(?:1(?:88\.16\.(?:9[59]|101)|0\.7\.16)|66\.250\.144)|8\.213\.157\.68)|37\.5(?:7\.(?:158\.32|90\.39)|9\.61\.117)|41\.84\.135\.22)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|5\.(?:63\.(?:[89]|1[012345])|58\.133)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|2\.(?:215\.(?:6[34]|44)|72\.13)|3\.56\.2(?:4[589]|5[01]|25)|0\.52\.[0123]|9\.36\.21[23])|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|6\.(?:123\.135|37\.203)|1\.66\.15[67]|2\.18\.222)|0(?:3\.(?:2(?:0\.3[79]|8\.184)|30\.72|1\.69|5\.27)|9\.127\.8[01]|8\.174\.193)|2(?:5\.(?:44\.24[01234567]|60\.156)|3\.136\.106|2\.155\.44)|9(?:0\.(?:113\.21[01]|234\.10[56])|7\.252\.[01])|4(?:2\.234\.186|6\.0\.77)|30\.193\.1(?:46|65)|63\.125\.14[45])|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.19(?:4\.115|1\.27)|2\.29\.17[67]|6\.246\.99)|1(?:6\.155\.20|2\.34\.12)|22\.140\.158|3\.106\.71)|5(?:8\.(?:50\.(?:1(?:[2345]|1[6789])|6[89]|7[01])|19\.191)|9\.55\.254)|4(?:1\.254\.[1258]|9\.0\.11[89])|79\.106\.109|85\.153\.71)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|5\.(?:63\.(?:[89]|1[012345])|58\.133)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|2\.(?:215\.(?:6[34]|44)|72\.13)|3\.56\.2(?:4[589]|5[01]|25)|0\.52\.[0123]|9\.36\.21[23])|8(?:3\.93\.(?:9[78]|115|69|84)|(?:2\.18\.22|8\.73\.25)2|6\.(?:123\.135|37\.203)|1\.66\.15[67])|0(?:3\.(?:2(?:0\.3[79]|8\.184)|30\.72|7\.243|1\.69|5\.27)|9\.127\.8[01]|8\.174\.193)|2(?:5\.(?:44\.24[01234567]|60\.156)|3\.136\.106|2\.155\.44)|9(?:0\.(?:113\.21[01]|234\.10[56])|7\.252\.[01])|30\.193\.1(?:46|65)|63\.125\.14[45]|42\.234\.186)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.19(?:4\.115|1\.27)|2\.29\.17[67]|6\.246\.99)|1(?:6\.155\.20|2\.34\.12)|22\.140\.158|3\.106\.71)|5(?:8\.(?:50\.(?:1(?:[2345]|1[6789])|6[89]|7[01])|19\.19[01])|9\.55\.254)|4(?:1\.254\.[1258]|9\.0\.11[89])|79\.106\.109|85\.153\.71)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6