You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/12/06 08:57:18 UTC
svn commit: r1548393 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Fri Dec 6 07:57:17 2013
New Revision: 1548393
URL: http://svn.apache.org/r1548393
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1548393&r1=1548392&r2=1548393&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Fri Dec 6 07:57:17 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20131252
+## khop-sc-neighbors.cf v 20131262
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:1[37]|90)|2)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|88)|46|2)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -42,7 +42,7 @@ score KHOP_SC_CIDR8 0.1 0.02 0.2 0.1
# 1.5335/0.5063 0.752 20130629@465k net, solo=1.5947/0.5379@0.748
# 2.0256/0.7432 0.732 20130705@376k solo=2.0429/0.7595@0.729, ->.1 .02 .2 .1
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:178|37|46|95)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|90)|37|95)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:2\.(?:197\.33|234\.40)|0\.146\.61)|1(?:3\.135\.113|1\.233\.64))|1(?:75\.4(?:3\.125|5\.173)|23\.249\.39)|5(?:8\.254\.1(?:68|72)|\.144\.179)|74\.222\.7)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:01\.(?:227\.247|15\.23)|75\.4(?:3\.125|5\.173)|92\.3\.138)|2(?:1(?:3\.135\.113|1\.233\.64)|0(?:0\.146\.61|2\.234\.40))|7(?:0\.98\.78|4\.222\.7)|5\.144\.179|65\.60\.15)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:9\.(?:229\.2(?:49|50)|116\.113|96\.82)|2\.183\.154)|2(?:(?:1\.17\.12|4\.95\.15)5|0\.84\.13)|7(?:3\.208\.245|5\.45\.173)|0(?:1\.50\.12|3\.20\.8)|10\.52\.[02]|58\.255\.7)|212\.67\.215|58\.19\.190)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:(?:1\.17\.12|4\.95\.15)5|3\.249\.39|0\.84\.13)|9(?:9\.(?:229\.2(?:49|50)|116\.113)|2\.183\.154)|0(?:1\.50\.12|3\.20\.8)|10\.52\.[02]|73\.208\.245|58\.255\.7)|212\.67\.215)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:2(?:1(?:6\.(?:86\.253|46\.75)|7\.161\.3)|20\.31\.133)|1(?:61\.232\.157|70\.181\.99))|8\.(?:(?:97\.196\.16|41\.157\.)3|163\.156\.109)|4\.(?:(?:247\.23\.6|4\.44\.20)6|32\.177\.77)|(?:0\.189\.168\.17|3\.130\.65\.16)1|9\.19(?:2\.255\.129|3\.93\.25))|8(?:4\.(?:22\.(?:1(?:97\.216|52\.8)|53\.(?:190|201))|82\.1(?:7(?:1\.234|9\.117)|23\.85))|0\.(?:149\.96\.1(?:69|70)|87\.43\.182)|3\.106\.1(?:45\.24|50\.78)|5\.25\.253\.24|8\.252\.0\.237|9\.112\.88\.65)|2(?:1\.(?:1(?:7\.125\.(?:1[12345679]|20)|81\.252\.228)|22\.127\.17)|4\.(?:95\.155\.(?:5[2389]|27|32)|16(?:5\.241\.90|0\.35\.2))|3\.249\.39\.(?:1[01]3|96|2)|2\.182\.28\.245|5\.75\.235\.127)|9(?:9\.(?:229\.2(?:49\.2(?:1[01234567]|0[56789])|50\.(?:10[123]|7[2356]))|116\.113\.16[34]|48\.166\.24)|0\.1(?:0(?:7\.140\.76|9\.164\.81)|4\.253\.30)|2\.183\.154\.178|3\.238\.111\.26)|7(?:3\.2(?:0(?:8\.245\.(?:10[16]|99)|0\.90\.196)|12\.205\.158)|5\.(?:43\.125\.7[4678]|96\.180\.11)|7\.(?:80\.104\
.52|1\.223\.73)|2\.245\.44\.122)|4(?:\.(?:220\.63\.66|35\.201\.15)|0\.137\.12\.102|8\.223\.59\.187)|0(?:1\.(?:227\.247\.37|15\.23\.249|44\.3\.50)|6\.3\.32\.153)|58\.255\.7\.(?:9[01234567]|8[56789]|6[689]|70))|2(?:0(?:2\.(?:1(?:(?:29\.216\.6|58\.39\.25)0|97\.33\.71)|(?:71\.136\.20|85\.110\.6)0|2(?:07\.1\.234|34\.40\.41)|53\.13\.187|64\.73\.148)|0\.(?:1(?:42\.133\.21|75\.56\.190)|7(?:2\.11\.132|9\.27\.60))|3\.(?:1(?:71\.233\.243|22\.52\.142)|234\.111\.248)|1\.(?:116\.199\.34|39\.214\.247))|1(?:1\.(?:23(?:2\.1(?:83\.58|54\.6)|3\.64\.110|0\.74\.17|\.152\.19)|1(?:74\.215\.100|15\.89\.141|47\.211\.16))|3\.1(?:35\.113\.197|71\.39\.154)|0\.1(?:83\.179\.38|3\.80\.212)|2\.67\.215\.(?:(?:15|9)0|66)|6\.23\.176\.91|9\.147\.172\.2|8\.38\.29\.68)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|\.144\.135)|153\.158\.37)|0\.128\.138\.245|2\.232\.130\.101))|5(?:9\.12(?:5\.(?:124\.216|240\.239)|4\.115\.88|\.17\.6)|8\.(?:12(?:0\.225\.155|6\.157\.18)|215\.207\.98)|\.61\.27\.254)|8(?:2\.(?:1(?:17\.194\.229|60\.13
7\.162)|207\.98\.107)|3\.(?:18\.234\.202|220\.51\.237)|9\.44\.108\.130|5\.185\.112\.6)|7(?:4\.222\.7\.2(?:43|50)|5\.180\.132\.120|7\.106\.232\.178|6\.72\.174\.223|2\.35\.20\.131|8\.36\.14\.195)|6(?:(?:0\.199\.178\.10|5\.60\.15\.17)3|(?:1\.106\.235\.18|7\.90\.21\.15)0|9\.198\.197\.156)|4(?:6\.(?:191\.237\.118|41\.131\.24)|9\.1\.224\.[79]|1\.137\.24\.4)|9(?:3\.1(?:57\.148\.102|18\.63\.243)|4\.230\.125\.253)|37\.123\.98\.115)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:2(?:1(?:6\.(?:86\.253|46\.75)|7\.161\.3)|20\.31\.133)|170\.181\.99)|8\.(?:(?:97\.196\.16|41\.157\.)3|163\.156\.109|217\.180\.116)|4\.(?:(?:247\.23\.6|4\.44\.20)6|32\.177\.77)|(?:0\.189\.168\.17|3\.130\.65\.16)1|9\.192\.255\.129)|2(?:1\.(?:1(?:7\.125\.(?:1[12345679]|20)|81\.252\.228)|22\.127\.17)|4\.(?:95\.155\.(?:5[2389]|27|32)|160\.35\.2)|5\.(?:75\.235\.12|143\.97\.9)7|3\.249\.39\.(?:1[01]3|96|2)|2\.182\.28\.245)|7(?:3\.2(?:0(?:8\.(?:245\.(?:10[16]|99)|186\.104)|0\.90\.196)|12\.205\.158)|5\.(?:43\.125\.7[4678]|96\.180\.11)|7\.(?:80\.104\.52|1\.223\.73)|2\.245\.44\.122)|9(?:9\.(?:229\.2(?:49\.2(?:1[01234567]|0[56789])|50\.(?:10[123]|7[2356]))|116\.113\.16[34])|0\.1(?:07\.140\.76|4\.253\.30)|2\.183\.154\.178|3\.238\.111\.26)|8(?:4\.(?:22\.(?:1(?:97\.216|52\.8)|53\.(?:190|201))|82\.1(?:7(?:1\.234|9\.117)|23\.85))|3\.106\.1(?:45\.24|50\.78)|5\.25\.253\.24|8\.252\.0\.237)|0(?:1\.(?:(?:15\.23\.24|79\.5\.1)9|227\.247\.37|44\.
3\.50)|6\.3\.32\.153)|4(?:\.(?:220\.63\.66|35\.201\.15)|0\.137\.12\.102|8\.223\.59\.187)|58\.255\.7\.(?:9[01234567]|8[5689]|6[89]|7\d))|2(?:1(?:1\.(?:1(?:7(?:4\.(?:120\.123|215\.100)|6\.76\.198)|15\.89\.141|47\.211\.16)|23(?:2\.1(?:83\.58|54\.6)|3\.64\.110|0\.74\.17|\.152\.19))|(?:0\.183\.179\.3|8\.38\.29\.6)8|3\.1(?:35\.113\.197|71\.39\.154)|2\.67\.215\.(?:(?:15|9)0|66)|6\.23\.176\.91|9\.147\.172\.2)|0(?:2\.(?:1(?:(?:29\.216\.6|58\.39\.25)0|97\.33\.71)|(?:71\.136\.20|85\.110\.6)0|2(?:07\.1\.234|34\.40\.41)|53\.13\.187|64\.73\.148)|0\.(?:7(?:2\.11\.132|9\.27\.60)|175\.56\.190)|3\.(?:234\.111\.248|122\.52\.142)|1\.116\.199\.34)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|\.144\.135)|153\.158\.37)|0\.128\.138\.245|2\.232\.130\.101))|6(?:0\.(?:19(?:9\.178\.103|6\.58\.189)|251\.31\.134)|1\.(?:106\.235\.180|38\.186\.117)|9\.198\.197\.156|5\.60\.15\.173|7\.90\.21\.150)|8(?:3\.(?:1(?:49\.124\.150|8\.234\.202)|220\.51\.237)|2\.(?:117\.194\.229|207\.98\.107)|9\.44\.108\.13[03]|5\.185\.112\.6)|5(?
:9\.12(?:5\.(?:124\.216|240\.239)|4\.115\.88|\.17\.6)|8\.(?:12(?:0\.225\.155|6\.157\.18)|215\.207\.98)|\.61\.27\.254)|7(?:4\.222\.7\.2(?:43|50)|7\.106\.232\.178|6\.72\.174\.223|2\.35\.20\.131)|4(?:6\.(?:191\.237\.118|41\.131\.24)|9\.1\.224\.[79]|1\.137\.24\.4)|93\.157\.148\.102|37\.123\.98\.115)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work