You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/10/06 08:57:16 UTC
svn commit: r1529574 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sun Oct 6 06:57:16 2013
New Revision: 1529574
URL: http://svn.apache.org/r1529574
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1529574&r1=1529573&r2=1529574&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sun Oct 6 06:57:16 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20131052
+## khop-sc-neighbors.cf v 20131062
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:8[68]|17)|95)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|88)|9?5)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:3\.(?:251\.155|95\.90)|8\.24\.1(?:73|80))|16\.112\.66|21\.54\.54|01\.9\.49)|2(?:11\.119\.86|3\.91\.25)|41\.223\.26|77\.245\.4)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:3\.(?:251\.155|95\.90)|8\.24\.175)|16\.112\.66|21\.54\.54|01\.9\.49)|2(?:11\.119\.86|3\.91\.25)|61\.133\.125|41\.223\.26|77\.245\.4)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:98\.(?:24\.17[45]|50\.163)|2(?:5\.60\.156|0\.84\.13)|78\.20\.148|41\.0\.61)|21(?:3\.132\.241|6\.155\.17)|8(?:6\.111\.144|0\.86\.88)|91\.218\.245)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:98\.(?:24\.17[34]|50\.163)|25\.60\.156|78\.20\.148|41\.0\.61)|21(?:3\.132\.241|6\.155\.17)|8(?:6\.111\.144|0\.86\.88)|91\.218\.245)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:1(?:30\.107\.235|75\.28\.3)|69\.20(?:2\.111|5\.202)|244\.239\.2|97\.63\.227)|2\.(?:1(?:84\.172\.244|24\.15\.141)|216\.46\.75)|9\.(?:3(?:7\.195\.59|0\.39\.1)|184\.214\.18)|4\.1(?:13\.229\.146|41\.253\.14)|6\.1(?:12\.66\.102|93\.90\.26)|3\.21\.228\.230|5\.88\.119\.132)|9(?:8\.(?:24\.1(?:7(?:(?:8\.13|3\.8)0|4\.16[67]|5\.[234])|80\.91)|5(?:0\.163\.(?:19[458]|20[45])|2\.247\.103))|3\.(?:2(?:38\.111\.26|51\.155\.67)|95\.90\.194)|0\.(?:107\.140\.77|0\.60\.238)|9\.30\.137\.10[67]|2\.163\.193\.199|5\.226\.209\.132)|8(?:4\.(?:22\.(?:1(?:7(?:7\.5[12]|2\.146)|97\.216|52\.8)|2(?:30\.213|8\.222))|82\.123\.85)|7\.(?:111\.255\.130|51\.175\.122)|0\.(?:178\.56\.138|250\.192\.22)|9\.7(?:8\.155\.168|5\.63\.114)|3\.234\.60\.43|8\.240\.221\.2)|7(?:7\.(?:1(?:84\.140\.222|\.223\.73)|222\.66\.165|43\.210\.162)|8\.(?:168\.43\.130|20\.148\.11)|3\.212\.205\.158|2\.245\.44\.191|4\.36\.137\.170|6\.34\.52\.206)|2(?:1\.(?:1(?:99\.60\.110|2\.167\.95)|2
2\.127\.17)|2\.15(?:5\.167\.115|4\.57\.19)|4\.42\.124\.136|3\.63\.31\.13|5\.46\.24\.62)|0(?:1\.(?:15\.(?:242\.159|114\.8)|44\.3\.50|9\.49\.53)|3\.(?:24(?:6\.245\.40|4\.13\.37)|9\.157\.12[69]))|6(?:2\.216\.3\.1[45]|8\.63\.174\.108)|4(?:5\.255\.136\.22|1\.0\.61\.166)|\.93\.26\.97)|2(?:0(?:2\.(?:1(?:1(?:8\.236\.17[78]|7\.120\.24)|01\.228\.108|37\.22\.200|29\.52\.94)|29\.2(?:39\.210|14\.61|41\.58)|77\.180\.72)|3\.(?:1(?:56\.207\.249|71\.233\.243|43\.19\.154)|239\.45\.202)|1\.(?:2(?:45\.175\.217|21\.132\.83)|18\.107\.234)|0\.(?:(?:247\.100\.1|148\.94\.)78|41\.181\.170)|8\.84\.135\.14[78]|7\.194\.87\.105)|1(?:1\.(?:1(?:19\.86\.14[4579]|74\.120\.123)|234\.106\.54)|0\.(?:14\.(?:133\.202|70\.21)|51\.23\.91)|9\.(?:143\.207\.140|239\.227\.81)|3\.1(?:32\.241\.13|64\.18\.147)|6\.155\.17\.(?:[58]|1[034])|8\.56\.(?:161\.14|37\.250)|2\.144\.254\.122|7\.218\.43\.130)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|34\.24\.46)|192\.134\.91|0\.76\.99)|2\.(?:1(?:12\.150\.58|74\.155\.19)|35\.61\.196)|0\.22(?:7\.
90\.238|5\.11\.77))|\.18(?:6\.230\.30|3\.155\.2)|4\.172\.17\.78|3\.91\.25\.82)|9(?:1\.(?:218\.245\.(?:7[12356789]|8[0123478]|9[34]|66)|197\.220\.230)|4\.(?:24\.245\.104|77\.199\.148)|5\.1(?:67\.178\.165|59\.105\.2)|3\.1(?:23\.54\.138|84\.71\.66))|6(?:1\.(?:13(?:2\.229\.115|3\.125\.162)|55\.156\.210)|0\.(?:19(?:0\.136\.90|1\.35\.42)|21\.209\.150)|3\.216\.146\.37|2\.141\.37\.85|5\.60\.15\.173)|8(?:0\.(?:86\.88\.1(?:13|26)|73\.71\.248|240\.35\.5)|4\.(?:241\.37\.199|95\.244\.11)|6\.111\.144\.194|9\.105\.129\.12|2\.146\.43\.38)|4(?:1\.(?:22(?:0\.28\.138|3\.26\.11)|84\.135\.22)|(?:2\.121\.117\.1|9\.248\.113\.)53|6\.22\.173\.86)|77\.2(?:23\.243\.122|45\.4\.58)|58\.246\.43\.122)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:(?:69\.205\.20|244\.239\.)2|1(?:30\.107\.235|75\.28\.3)|97\.63\.227)|9\.(?:1(?:84\.214\.18|93\.93\.25)|3(?:7\.195\.59|0\.39\.1))|2\.(?:1(?:84\.172\.244|24\.15\.141)|216\.46\.75)|4\.1(?:13\.229\.146|41\.253\.14)|6\.1(?:12\.66\.102|93\.90\.26)|3\.21\.228\.230|5\.88\.119\.132)|9(?:8\.(?:24\.1(?:7(?:(?:8\.13|3\.8)0|4\.16[67]|5\.[234])|80\.91)|5(?:0\.163\.(?:19[458]|20[04])|2\.247\.103))|3\.(?:251\.155\.67|95\.90\.194)|0\.(?:107\.140\.77|0\.60\.238)|9\.30\.137\.10[67]|2\.163\.193\.199|5\.226\.209\.132)|8(?:4\.(?:22\.(?:1(?:7(?:2\.14[46]|7\.52)|97\.216|52\.8)|230\.213)|82\.123\.85)|7\.(?:111\.255\.130|51\.175\.122)|0\.(?:178\.56\.138|250\.192\.22)|9\.7(?:8\.155\.168|5\.63\.114)|3\.234\.60\.43|8\.240\.221\.2)|7(?:7\.(?:1(?:84\.140\.222|\.223\.73)|222\.66\.165|43\.210\.162)|8\.(?:168\.43\.130|20\.148\.11)|3\.212\.205\.158|2\.245\.44\.191|4\.36\.137\.170|6\.34\.52\.206)|2(?:1\.(?:1(?:99\.60\.110|2\.167\.95)|22\.127\.17)|2\.15(?:
5\.167\.115|4\.57\.19)|4\.42\.124\.136|3\.63\.31\.13|5\.46\.24\.62)|0(?:3\.(?:24(?:6\.245\.40|4\.13\.37)|9\.157\.12[69])|1\.(?:15\.242\.159|44\.3\.50|9\.49\.53))|6(?:2\.216\.3\.1[45]|8\.63\.174\.108)|4(?:5\.255\.136\.22|1\.0\.61\.166)|\.(?:215\.206\.242|93\.26\.97))|2(?:0(?:2\.(?:1(?:1(?:8\.236\.17[78]|7\.120\.24)|01\.228\.108|37\.22\.200|29\.52\.94)|29\.2(?:39\.210|14\.61|41\.58)|77\.180\.72)|3\.(?:1(?:56\.207\.249|71\.233\.243|43\.19\.154)|239\.45\.202)|1\.(?:2(?:45\.175\.217|21\.132\.83)|18\.107\.234)|0\.(?:(?:247\.100\.1|148\.94\.)78|41\.181\.170)|8\.84\.135\.14[78]|7\.194\.87\.105)|1(?:0\.(?:14\.(?:133\.202|70\.21)|51\.23\.91)|9\.(?:143\.207\.140|239\.227\.81)|3\.1(?:32\.241\.13|64\.18\.147)|8\.56\.(?:161\.14|37\.250)|6\.155\.17\.(?:1[034]|5)|1\.119\.86\.14[4579]|2\.144\.254\.122|7\.218\.43\.130)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|34\.24\.46)|192\.134\.91|0\.76\.99)|2\.(?:1(?:12\.150\.58|74\.155\.19)|35\.61\.196)|0\.22(?:7\.90\.238|5\.11\.77))|\.18(?:6\.230\.30|3\.155\.2)|4
\.172\.17\.78|3\.91\.25\.82)|6(?:1\.(?:13(?:2\.229\.115|3\.125\.162)|55\.156\.210)|0\.(?:19(?:0\.136\.90|1\.35\.42)|21\.209\.150)|2\.(?:141\.37\.85|212\.89\.74)|3\.216\.146\.37|5\.60\.15\.173|9\.64\.59\.111)|9(?:1\.(?:218\.245\.(?:7[12356789]|9[034]|8\d)|197\.220\.230)|4\.(?:24\.245\.104|77\.199\.148)|5\.1(?:67\.178\.165|59\.105\.2)|3\.1(?:23\.54\.138|84\.71\.66))|8(?:0\.(?:73\.71\.248|86\.88\.113|240\.35\.5)|4\.(?:241\.37\.199|95\.244\.11)|6\.111\.144\.194|9\.105\.129\.12|2\.146\.43\.38)|4(?:1\.(?:22(?:0\.28\.138|3\.26\.11)|84\.135\.22)|(?:2\.121\.117\.1|9\.248\.113\.)53|6\.22\.173\.86)|7(?:7\.2(?:23\.243\.122|45\.4\.58)|8\.31\.74\.211)|58\.246\.43\.122)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|7[0245789]?|4[89]?|5[01]?|6)|68\.32)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|2\.215\.(?:6[34]|44)|0\.52\.[0123]|9\.36\.21[23])|8(?:3\.9(?:3\.11[45]|5\.6[67])|6\.(?:123\.135|37\.203)|1\.66\.15[67]|2\.18\.222)|0(?:3\.(?:2(?:40\.117|8\.184)|7\.243|1\.69|5\.27)|9\.127\.8[01])|9(?:0\.(?:234\.10[56]|113\.210)|7\.252\.[01])|7(?:7\.(?:47\.10|86\.4)6|3\.44\.232)|30\.193\.1(?:46|65)|25\.60\.156)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.(?:194\.115|82\.81)|2\.29\.17[89])|1(?:6\.155\.(?:20|54|63)|2\.34\.12))|58\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|68)|19\.19[01])|4(?:1\.2(?:54\.[1258]|23\.161)|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|7[25789]?|4[89]?|5[01]?|6)|68\.32)|6\.207\.(?:6[0123]|4[89]|5\d|12)|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|2\.215\.(?:6[34]|44)|0\.52\.[0123]|9\.36\.21[23])|8(?:3\.9(?:3\.11[45]|5\.6[67])|(?:2\.18\.22|8\.73\.25)2|6\.(?:123\.135|37\.203)|1\.66\.15[67])|0(?:3\.(?:2(?:40\.117|8\.184)|7\.243|1\.69|5\.27)|9\.127\.8[01])|7(?:7\.(?:47\.10|86\.4)6|3\.44\.232)|9(?:0\.234\.10[56]|7\.252\.[01])|30\.193\.1(?:46|65)|25\.60\.156)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.(?:194\.115|82\.81)|2\.29\.17[89])|1(?:6\.155\.(?:20|54|63)|2\.34\.12))|58\.(?:50\.1(?:[2345]|0[456789]|1[016789])|19\.19[01])|4(?:1\.2(?:54\.[1258]|23\.161)|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6