You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/09/21 08:57:41 UTC
svn commit: r1525201 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sat Sep 21 06:57:40 2013
New Revision: 1525201
URL: http://svn.apache.org/r1525201
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1525201&r1=1525200&r2=1525201&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sat Sep 21 06:57:40 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201309202
+## khop-sc-neighbors.cf v 201309212
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:3\.(?:30\.72|9\.157)|1\.8\.236)|(?:99\.30\.13|84\.22\.2)7|12\.90\.222|78\.20\.148|21\.54\.54|38\.91\.79)|211\.119\.86|58\.254\.172|64\.120\.169)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:8\.24\.174|9\.30\.137)|(?:12\.90\.22|03\.30\.7)2|78\.20\.148|21\.54\.54|38\.91\.79|84\.22\.27|41\.0\.61)|211\.119\.86|58\.254\.172|64\.120\.169)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:5\.60\.156|0\.84\.13)|98\.24\.17[45]|01\.15\.247|84\.82\.53)|2(?:13\.132\.241|06\.214\.95|21\.4\.142)|91\.218\.115|75\.75\.240|69\.64\.49)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:5\.60\.156|0\.84\.13)|01\.15\.247|98\.24\.175|84\.82\.53)|2(?:13\.132\.241|06\.214\.95|21\.4\.142)|91\.218\.115|75\.75\.240|69\.64\.49|85\.25\.13)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /___ FAILED TO POPULATE ___/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.(?:22\.(?:1(?:7(?:2\.145|7\.51)|97\.216|1\.23)|2(?:30\.213|7\.171))|82\.(?:53\.1(?:0[69]|43|1)|179\.117|251\.100))|0\.(?:2(?:25\.148\.206|11\.179\.30)|166\.124\.90)|(?:8\.252\.0\.23|7\.75\.51\.6)7|9\.75\.63\.114)|9(?:0\.(?:10(?:7\.140\.77|9\.164\.81)|7\.128\.44)|8\.24\.1(?:7(?:4\.16[67]|5\.[234])|80\.91)|(?:5\.252\.108|4\.106\.16)\.6|9\.30\.137\.10[67]|2\.163\.193\.199|6\.203\.198\.130)|1(?:2\.(?:1(?:84\.172\.244|63\.150\.30)|220\.31\.132|94\.224\.236)|9\.(?:184\.214\.18|201\.16\.211|37\.195\.59)|8\.(?:46\.127\.36|175\.28\.3)|1\.249\.131\.159|6\.193\.90\.26)|7(?:8\.(?:2(?:13\.110\.115|0\.148\.11)|168\.43\.130|63\.74\.6)|3\.2(?:12\.205\.158|00\.90\.196)|7\.(?:80\.102\.214|1\.223\.73))|2(?:1\.(?:1(?:34\.238\.129|81\.252\.228|59\.11\.164)|22\.127\.17)|2\.226\.95\.56|5\.46\.24\.62)|0(?:1\.(?:(?:8\.236\.24|44\.3\.5)0|15\.2(?:47\.163|51\.176))|3\.9\.157\.12[69])|(?:38\.91\.79\.10|\.215\.206\.24)2|4(?:8\.223\.59\.187|1\.0\.61\.16
6))|2(?:1(?:1\.(?:1(?:7(?:2\.251\.168|4\.120\.123)|19\.86\.14[3678])|23\.152\.19)|3\.1(?:3(?:6\.105\.21[02]|2\.241\.13)|9(?:5\.77\.114|9\.248\.27))|8\.(?:2(?:41\.238\.141|3\.57\.66)|56\.37\.250)|9\.(?:239\.113\.97|147\.172\.2)|2\.(?:113\.32\.199|66\.60\.28)|0\.51\.23\.91)|0(?:6\.214\.95\.(?:7[2456789]|9[0134]|8\d|66)|3\.(?:171\.233\.243|239\.45\.202)|2\.(?:154\.192\.28|71\.136\.200)|8\.84\.135\.14[78]|1\.116\.199\.34)|2(?:1\.(?:214\.2(?:08\.226|14\.187)|4\.142\.(?:9[0123]|67))|2\.(?:174\.54\.164|218\.142\.49)|0\.68\.224\.45))|6(?:1\.(?:1(?:9\.255\.120|41\.21\.34)|3(?:8\.186\.117|3\.162\.92))|0\.(?:190\.(?:25\.42|43\.10)|214\.223\.178)|4\.(?:120\.169\.15[01]|206\.169\.165)|(?:6\.197\.212\.2|7\.90\.21\.1)50|9\.(?:198\.197\.156|64\.49\.109))|8(?:5\.(?:2(?:14\.249\.55|5\.13\.104)|17\.75\.15)|2\.(?:117\.194\.229|99\.246\.10)|8\.191\.154\.103|0\.91\.190\.188|7\.103\.170\.65)|9(?:3\.(?:1(?:59\.160\.164|84\.71\.66)|95\.98\.196)|1\.218\.115\.(?:5[234567]|3[48]|4[39])|8\.126\.249\.106|0\.83\.
184\.211)|7(?:5\.75\.240\.1(?:3[01234567]|5[12345678]|4[56789])|7\.106\.232\.178|8\.141\.66\.122|2\.35\.20\.131)|5(?:9\.(?:1(?:88\.16\.(?:9[159]|101)|0\.7\.16)|66\.250\.144)|8\.213\.157\.68)|37\.5(?:7\.(?:158\.32|90\.39)|9\.61\.117)|4(?:2\.121\.57\.248|1\.84\.135\.22))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|5\.(?:63\.(?:[89]|1[012345])|58\.134)|6\.207\.(?:6[0123]|1[345]|4[89]|5\d)|2\.(?:215\.(?:6[34]|44)|72\.13)|0\.(?:205\.3[25]|52\.[0123])|3\.56\.2(?:4[589]|5[01]|25)|9\.36\.21[23])|0(?:3\.(?:2(?:0\.3[79]|8\.184)|30\.72|1\.69|5\.27)|9\.127\.8[01]|8\.174\.193)|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|6\.(?:123\.135|37\.203)|1\.66\.15[67])|2(?:5\.(?:44\.24[01234567]|60\.156)|3\.136\.106|2\.155\.44)|9(?:0\.(?:113\.21[01]|234\.10[56])|7\.252\.[01])|30\.193\.1(?:46|65)|42\.234\.186|63\.125\.144)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.19(?:4\.115|1\.27)|2\.29\.17[67]|6\.246\.99)|22\.140\.15[89]|12\.34\.12|3\.106\.71)|5(?:8\.(?:50\.(?:1(?:[2345]|1[6789])|69)|19\.190)|9\.55\.254)|4(?:1\.254\.[1258]|9\.0\.11[89])|79\.106\.109|85\.153\.71)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|5\.(?:63\.(?:[89]|1[012345])|58\.133)|6\.207\.(?:6[0123]|1[345]|4[89]|5\d)|2\.(?:215\.(?:6[34]|44)|72\.13)|0\.(?:205\.3[25]|52\.[0123])|3\.56\.2(?:4[589]|5[01]|25)|9\.36\.21[23])|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|(?:2\.18\.22|8\.73\.25)2|6\.(?:123\.135|37\.203)|1\.66\.15[67])|0(?:3\.(?:2(?:0\.3[79]|8\.184)|30\.72|1\.69|5\.27)|9\.127\.8[01]|8\.174\.193)|2(?:5\.(?:44\.24[01234567]|60\.156)|3\.136\.106|2\.155\.44)|9(?:0\.(?:113\.21[01]|234\.10[56])|7\.252\.[01])|4(?:2\.234\.186|6\.0\.77)|30\.193\.1(?:46|65)|63\.125\.14[45])|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.19(?:4\.115|1\.27)|2\.29\.17[67]|6\.246\.99)|1(?:6\.155\.20|2\.34\.12)|22\.140\.15[89]|3\.106\.71)|5(?:8\.50\.(?:1(?:[2345]|1[6789])|69)|9\.55\.254)|4(?:1\.254\.[1258]|9\.0\.11[89])|79\.106\.109|85\.153\.71)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6