You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/12/30 08:57:37 UTC
svn commit: r1554165 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Mon Dec 30 07:57:36 2013
New Revision: 1554165
URL: http://svn.apache.org/r1554165
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1554165&r1=1554164&r2=1554165&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Mon Dec 30 07:57:36 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201312292
+## khop-sc-neighbors.cf v 201312302
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:117|9?5|46)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|46|5)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -81,7 +81,7 @@ score KHOP_SC_CIDR16 0.4 0.1 0.4 0.1
# crap, still empty 20130629@465k net
# crap, still empty 20130705@376k net. lowering for low vol -> .4 .1 .4 .1
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:188\.34|94\.96)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:188\.34|89\.137|94\.96)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0.3
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:2\.2(?:9\.17[89]|34\.40)|6\.214\.87)|2(?:2\.100\.234|0\.94\.235)|17\.13\.154)|1(?:21\.54\.5[48]|80\.149\.96|15\.80\.40|78\.32\.92)|58\.25(?:4\.1(?:68|72)|1\.146))\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:15\.8(?:8\.119|0\.40)|21\.54\.5[48]|80\.149\.96|01\.15\.30|78\.32\.92)|2(?:02\.2(?:9\.17[89]|34\.40)|17\.13\.154|20\.94\.235)|58\.254\.1(?:68|72))\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:(?:1\.17\.12|4\.95\.15)5|5\.60\.156|0\.84\.13)|9(?:8\.143\.1(?:32|50)|0\.234\.10[56])|1(?:5\.8(?:8\.119|0\.46)|2\.72\.13)|0(?:1\.50\.12|3\.20\.8)|81\.66\.15[67]|57\.250\.132|75\.96\.176)|(?:213\.135\.11|31\.14\.2)3|80\.193\.214|41\.254\.5|70\.98\.78)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:(?:1\.17\.12|4\.95\.15)5|5\.60\.156|0\.84\.13)|9(?:8\.143\.1(?:32|50)|0\.234\.10[56])|1(?:2\.72\.13|5\.80\.46)|0(?:1\.50\.12|3\.20\.8)|81\.66\.15[67]|57\.250\.132|75\.96\.176)|2(?:13\.135\.113|22\.100\.234)|80\.193\.214|31\.14\.23|41\.254\.5|70\.98\.78)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:1(?:63\.156\.109|29\.166\.86|42\.19\.172)|4(?:6\.127\.36|1\.157\.3)|97\.(?:196\.163|95\.185)|244\.128\.(?:178|205)|69\.205\.202)|2\.(?:2(?:16\.(?:(?:105\.9|30\.5)0|86\.253)|20\.31\.133)|184\.172\.244|90\.93\.[123])|9\.(?:110\.108\.92|201\.141\.81|42\.147\.114)|5\.8(?:0\.4(?:6\.190|0\.38)|8\.119\.132)|(?:0\.189\.168\.17|7\.102\.101\.21)1|4\.(?:141\.253\.14|247\.23\.66))|8(?:4\.(?:2(?:2\.(?:197\.216|53\.19)|\.170\.114)|82\.1(?:79\.117|23\.85))|8\.(?:35\.136\.254|252\.0\.237)|3\.(?:181\.38\.90|98\.235\.12)|0\.149\.96\.1(?:69|70)|9\.112\.88\.65)|2(?:1\.(?:1(?:7\.125\.(?:1[234567]|20)|58\.198\.78)|78\.119\.193)|5\.(?:131\.29\.100|88\.123\.244)|4\.95\.155\.(?:5[28]|27)|3\.140\.204\.252|2\.49\.12\.186|0\.50\.86\.3)|9(?:8\.143\.1(?:50\.2(?:3[012456]|2[89]|5[02]|47)|32\.23[57]|28\.139)|0\.(?:54\.13\.10|82\.89\.15)6|4\.1(?:77\.40\.195|06\.16\.6)|5\.205\.237\.15)|0(?:1\.(?:1(?:2\.33\.15|5\.30\.58)|79\.5\.19)|6\.3\.32\.153)|7(?:(?:
3\.212\.205\.15|8\.32\.92\.9)8|5\.96\.176\.204)|\.2(?:34\.38\.106|14\.41\.98|20\.158\.3)|(?:62\.242\.171\.15|31\.130\.69\.21)8|4(?:8\.223\.59\.140|\.63\.74\.204))|2(?:1(?:1\.(?:23(?:(?:7\.20\.3|\.152\.1)9|2\.92\.23)|(?:115\.89\.14|54\.17\.20)1)|0\.(?:183\.179\.38|51\.37\.162|61\.240\.21|0\.203\.76)|(?:(?:2\.144\.254|9\.140\.69)\.12|6\.191\.208\.20)2|8\.(?:1(?:1\.167\.126|07\.4\.117)|56\.49\.2)|3\.1(?:35\.113\.197|71\.39\.154)|7\.13\.154\.155)|0(?:2\.(?:1(?:(?:42\.203\.1|94\.119\.6)9|29\.216\.60)|(?:85\.215\.24|53\.13\.18)7|2(?:07\.1\.234|34\.40\.41)|71\.(?:136\.200|98\.62))|0\.(?:7(?:2\.11\.132|9\.27\.60)|111\.103\.68|47\.10\.209)|1\.(?:116\.199\.34|77\.202\.68)|3\.156\.207\.249)|2(?:2\.(?:1(?:0(?:0\.234\.251|9\.130\.95)|17\.219\.97)|7(?:3\.93\.153|8\.247\.67)|236\.16\.14)|1\.2(?:14\.2(?:08\.226|14\.187)|32\.144\.164)|0\.(?:94\.235\.200|68\.224\.45))|3\.253\.52\.134|4\.157\.46\.197)|8(?:1\.(?:192\.48\.16|211\.80\.2)2|8\.(?:196\.63\.25|85\.228\.66)|5\.185\.(?:244\.101|112\.8)|0\.193\
.214\.226|2\.117\.194\.229)|9(?:3\.1(?:8(?:4\.71\.66|8\.8\.67)|57\.148\.102)|(?:2\.50\.155\.21|4\.77\.199\.14)8|1\.247\.160\.10|5\.211\.135\.83)|6(?:0\.(?:25(?:1\.31\.134|0\.218\.2)|196\.(?:143\.153|58\.189))|9\.198\.197\.156|1\.38\.186\.117|7\.90\.21\.150)|4(?:1\.(?:137\.(?:2[04]|56)\.4|63\.166\.3)|9\.(?:1\.224\.[79]|218\.40\.27))|31\.14\.23\.(?:1(?:[78]|5[789]?|2?9|60?)|4[0235789]?|5[01567]?|2[013]|35)|5(?:9\.1(?:1\.98\.232|20\.76\.23|5\.76\.97)|8\.126\.157\.18)|7(?:7\.106\.232\.178|2\.35\.20\.131))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:1(?:63\.156\.109|29\.166\.86|42\.19\.172)|97\.(?:196\.163|95\.185)|244\.128\.178|69\.205\.202|46\.127\.36)|2\.(?:2(?:16\.(?:(?:105\.9|30\.5)0|48\.252)|20\.(?:31\.133|67\.130))|184\.172\.244)|5\.(?:8(?:0\.4(?:6\.190|0\.38)|8\.119\.132)|68\.15\.73)|(?:0\.189\.168\.17|7\.102\.101\.21)1|4\.(?:141\.253\.14|247\.23\.66)|9\.42\.147\.114)|2(?:1\.(?:1(?:5(?:1\.122\.45|8\.198\.78)|7\.125\.(?:1[234567]|20))|78\.119\.193)|4\.95\.155\.(?:5[28]|27)|3\.140\.204\.252|2\.182\.28\.245|5\.131\.29\.100|0\.50\.86\.3)|9(?:8\.143\.1(?:50\.2(?:3[012456]|2[89]|5[02]|47)|32\.23[57]|28\.139)|0\.(?:(?:54\.13\.10|82\.89\.15)6|24\.134\.65)|4\.1(?:77\.40\.195|06\.16\.6)|5\.205\.237\.15)|8(?:4\.(?:82\.1(?:79\.117|23\.85)|22\.197\.216)|8\.(?:35\.136\.254|252\.0\.237)|3\.(?:181\.38\.90|98\.235\.12)|0\.149\.96\.1(?:69|70)|9\.112\.88\.65)|7(?:3\.2(?:08\.2(?:27\.(?:10|9)|15\.164)|12\.205\.158)|5\.96\.176\.204|8\.32\.92\.98)|0(?:1\.(?:15\.30\.58|79\.5\.19)|
6\.3\.32\.153)|(?:62\.242\.171\.15|31\.130\.69\.21)8|4(?:8\.223\.59\.140|\.63\.74\.204)|\.2(?:34\.38\.106|14\.41\.98))|2(?:0(?:2\.(?:1(?:(?:30\.114\.13|29\.216\.6|58\.39\.25)0|(?:42\.203\.1|94\.119\.6)9|18\.236\.178)|(?:85\.215\.24|53\.13\.18)7|2(?:07\.1\.234|34\.40\.41)|71\.136\.200)|0\.(?:1(?:11\.103\.68|75\.56\.190)|7(?:2\.11\.132|9\.27\.60)|47\.10\.209)|1\.(?:1(?:16\.199\.34|95\.239\.27)|77\.202\.68))|1(?:1\.(?:23(?:(?:7\.20\.3|\.152\.1)9|2\.92\.23)|54\.17\.20[01]|115\.89\.141)|0\.(?:183\.179\.38|51\.37\.162|61\.240\.21|0\.203\.76)|(?:(?:2\.144\.254|9\.140\.69)\.12|6\.191\.208\.20)2|3\.(?:1(?:35\.113\.197|71\.39\.154)|81\.164\.57)|8\.1(?:1\.167\.126|07\.4\.117)|7\.13\.154\.155)|2(?:2\.(?:1(?:0(?:0\.234\.251|9\.130\.95)|17\.219\.97)|7(?:3\.93\.153|8\.247\.67))|1\.2(?:14\.2(?:08\.226|14\.187)|32\.144\.164)|0\.(?:94\.235\.200|68\.224\.45))|3\.253\.52\.134|4\.157\.46\.197)|6(?:0\.(?:25(?:1\.31\.134|0\.218\.2)|196\.58\.189)|1\.(?:106\.235\.180|38\.186\.117)|9\.198\.197\.156|7\.90\.21
\.150)|8(?:3\.(?:18\.234\.202|238\.208\.55)|0\.193\.214\.226|2\.117\.194\.229|1\.211\.80\.22|5\.185\.112\.8|8\.196\.63\.25)|3(?:1\.14\.23\.(?:1(?:[78]|5[789]?|2?9|60?)|4[0235789]?|5[0156789]?|2[013]|6[02]|35)|7\.123\.98\.115)|9(?:(?:2\.50\.155\.21|4\.77\.199\.14)8|3\.18(?:4\.71\.66|8\.8\.67)|1\.247\.160\.10)|4(?:1\.(?:137\.(?:2[04]|56)\.4|63\.166\.3)|9\.(?:1\.224\.[79]|218\.40\.27))|7(?:7\.106\.232\.178|2\.35\.20\.131|4\.9\.203\.186)|59\.1(?:1\.98\.232|20\.76\.23|5\.76\.97))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work