You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/06/18 08:57:26 UTC
svn commit: r1494040 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Tue Jun 18 06:57:26 2013
New Revision: 1494040
URL: http://svn.apache.org/r1494040
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1494040&r1=1494039&r2=1494040&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Tue Jun 18 06:57:26 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201306172
+## khop-sc-neighbors.cf v 201306182
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -92,7 +92,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:(?:01\.101\.15|20\.128\.)2|1(?:5\.88\.119|2\.90\.90)|92\.119\.66)|2(?:1(?:3\.230\.128|0\.21\.225)|09\.223\.35)|6(?:1\.252\.13|4\.250\.11)8)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:4\.207\.113|5\.88\.119|2\.90\.90)|0(?:1\.101\.152|3\.9\.158)|80\.225\.131|92\.119\.66)|209\.(?:144\.27|223\.35)|61\.252\.138)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -111,7 +111,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:5\.60\.156|0\.84\.13)|5(?:1\.84\.131|8\.255\.2)|10\.52\.[02]|83\.221\.12|03\.9\.158)|2(?:08\.(?:71\.172|82\.114)|20\.94\.235|12\.48\.64)|6(?:6\.199\.224|5\.60\.15)|37\.122\.208)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:(?:83\.221\.1|58\.255\.)2|2(?:5\.60\.156|0\.84\.13)|10\.52\.[02])|2(?:1(?:3\.230\.128|2\.48\.64)|08\.(?:71\.172|82\.114)|20\.94\.235)|6(?:4\.250\.118|6\.199\.224|5\.60\.15)|37\.122\.208)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -129,7 +129,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:0\.(?:45\.(?:1(?:3(?:6\.181|8\.138)|40\.89)|244\.(?:4[04]|54))|165\.125\.152)|2\.(?:1(?:86\.(?:46\.107|16\.5)|04\.189\.110)|21(?:7\.228\.234|6\.102\.98))|8\.(?:1(?:14\.77\.116|71\.95\.234)|97\.196\.163)|4\.2(?:07\.113\.55|7\.191\.127)|5\.(?:88\.119\.132|22\.80\.197)|9\.(?:97\.151\.151|193\.93\.25)|7\.(?:20\.3\.231|6\.128\.27)|3\.0\.85\.249)|9(?:5\.(?:1(?:38\.195\.125|91\.184\.82)|29\.81\.30)|2\.1(?:87\.10(?:1\.125|2\.212)|63\.193\.205)|8\.(?:50\.164\.21[89]|84\.69\.217)|3\.194\.92\.242|9\.255\.11\.29|4\.106\.16\.6)|8(?:8\.(?:1(?:27\.230\.28|68\.46\.53)|252\.0\.237)|0\.2(?:11\.1(?:62\.254|79\.30)|25\.131\.176)|(?:3\.81\.152\.22|9\.39\.35\.16)8|7\.120\.127\.27|6\.6\.224\.69)|2(?:1\.(?:1(?:81\.251\.188|57\.3\.252)|22\.127\.17)|2\.165\.225\.177|4\.124\.236\.90|3\.201\.60\.83)|7(?:8\.(?:163\.105\.52|20\.148\.11)|7\.(?:80\.102\.214|37\.4\.146)|4\.36\.16(?:0\.157|4\.184))|0(?:3\.9\.15(?:7\.181|8\.147)|9\.236\.89\.141)|5(?:8\
.255\.2\.6[4689]|1\.84\.131\.107)|3(?:3\.242\.115\.44|8\.91\.88\.93)|\.220\.158\.3)|2(?:1(?:1\.(?:1(?:(?:91\.168\.16|47\.211\.1)6|1(?:1\.250\.177|5\.68\.32)|72\.242\.74)|232\.154\.6|54\.17\.201)|0\.(?:2(?:10\.123\.(?:244|47)|45\.89\.69)|5(?:1\.44\.199|6\.23\.100))|3\.(?:1(?:71\.39\.154|32\.241\.7)|230\.128\.226)|7\.(?:1(?:49\.52\.12|98\.3\.238)|200\.184\.87)|9\.(?:145\.110\.118|80\.238\.185)|2\.(?:48\.64\.14|6\.152\.21)1|8\.145\.135\.137)|0(?:8\.(?:82\.114\.(?:5[13579]|4[4579]|25)|71\.172\.(?:8[456789]|9[134])|113\.254\.39)|0\.(?:14(?:8\.125\.247|2\.133\.21)|7(?:2\.11\.132|9\.27\.60)|94\.77\.1)|2\.(?:1(?:58\.(?:39\.250|52\.84)|42\.203\.19)|71\.136\.200)|9\.(?:223\.35\.20[2346]|144\.27\.22[68])|3\.(?:255\.15\.146|155\.102\.2)|6\.217\.105\.67|1\.45\.114\.3)|2(?:0\.(?:225\.127\.41|94\.235\.200|178\.97\.2)|1\.(?:214\.208\.226|143\.50\.219)|2\.2(?:53\.182\.139|36\.16\.14)|3\.26\.193\.53)|4\.127\.201\.172)|6(?:1\.(?:2(?:52\.138\.195|30\.90\.19)|(?:164\.42\.1|70\.83\.)58|38\.186\.1
17|98\.131\.141)|6\.(?:199\.22(?:4\.(?:[689]|1[0123456]|20)|7\.197)|84\.49\.9)|4\.250\.118\.15[23]|0\.251\.11\.26|5\.60\.15\.184|8\.115\.192\.7)|8(?:(?:1\.(?:15\.172\.14|23\.106\.7)|9\.78\.121\.3)5|3\.(?:18\.234\.202|238\.208\.55|3\.103\.227)|8\.(?:250\.233\.164|198\.1\.177)|6\.64\.171\.198|7\.97\.215\.67)|9(?:1\.(?:187\.96\.104|214\.83\.2)|5\.(?:48\.24\.10|86\.4\.79)|2\.253\.123\.95|4\.189\.183\.70|3\.188\.8\.67)|7(?:2\.(?:35\.20\.131|42\.224\.25|55\.188\.73)|6\.74\.186\.237|1\.188\.63\.88|4\.9\.203\.186)|3(?:7\.(?:122\.2(?:0(?:8\.169|9\.74)|11\.100)|(?:206\.210\.13|46\.224\.25)0)|1\.13\.211\.28)|5(?:9\.1(?:5\.76\.97|0\.7\.16)|8\.151\.149\.118|\.245\.95\.203)|4(?:1\.(?:137\.24\.4|41\.86\.6)|6\.182\.24\.130))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:21(?:6\.(?:1(?:81\.110|02\.98)|8\.158)|7\.228\.234)|1(?:86\.(?:46\.107|16\.5)|04\.189\.110))|0\.(?:45\.(?:1(?:3(?:6\.181|8\.138)|40\.89)|244\.(?:4[04]|54))|165\.125\.152)|8\.(?:1(?:14\.77\.116|71\.95\.234)|97\.196\.163)|(?:4\.207\.113\.5|9\.193\.93\.2)5|5\.(?:88\.119\.132|22\.80\.197)|3\.0\.85\.249|7\.6\.128\.27)|9(?:5\.(?:1(?:38\.195\.125|91\.184\.82)|29\.81\.30)|2\.1(?:87\.10(?:1\.125|2\.212)|63\.193\.205)|8\.(?:50\.164\.21[89]|84\.69\.217)|9\.(?:30\.137\.13[89]|255\.11\.29)|3\.1(?:94\.92\.242|64\.254\.3)|4\.106\.16\.6)|8(?:8\.(?:1(?:27\.230\.28|68\.46\.53)|252\.0\.237)|0\.2(?:11\.1(?:62\.254|79\.30)|25\.131\.176)|(?:3\.81\.152\.22|9\.39\.35\.16)8|7\.120\.127\.27|6\.6\.224\.69)|7(?:4\.(?:3(?:6\.16(?:0\.157|4\.184)|7\.148\.77)|90\.83\.42)|8\.(?:163\.105\.52|20\.148\.11)|3\.192\.144\.105|7\.37\.4\.146)|2(?:1\.(?:1(?:81\.251\.188|28\.31\.93|57\.3\.252)|22\.127\.17)|2\.165\.225\.177|3\.201\.60\.83)|0(?:3\.9\.15(?:
7\.181|8\.147)|9\.236\.89\.141)|5(?:8\.255\.2\.6[4689]|1\.84\.131\.107)|3(?:3\.242\.115\.44|8\.91\.88\.93)|\.220\.158\.3)|2(?:0(?:8\.(?:71\.172\.(?:8[456789]|9[1234])|82\.114\.(?:5[13579]|4[4579])|113\.254\.39)|0\.(?:14(?:8\.125\.247|2\.133\.21)|7(?:2\.11\.132|9\.27\.60)|94\.77\.1)|2\.(?:1(?:58\.(?:39\.250|52\.84)|42\.203\.19)|71\.136\.200)|9\.(?:2(?:23\.35\.20[23456]|39\.114\.172)|144\.27\.22[689])|3\.(?:255\.15\.146|155\.102\.2)|6\.217\.105\.67|1\.45\.114\.3)|1(?:1\.(?:1(?:(?:91\.168\.16|47\.211\.1)6|15\.68\.32)|232\.154\.6|54\.17\.201)|0\.(?:2(?:10\.123\.47|45\.89\.69)|5(?:1\.44\.199|6\.23\.100))|3\.(?:1(?:71\.39\.154|32\.241\.7)|230\.128\.226)|7\.(?:1(?:49\.52\.12|98\.3\.238)|200\.184\.87)|9\.(?:145\.110\.118|80\.238\.185)|2\.(?:48\.64\.14|6\.152\.21)1|8\.145\.135\.137)|2(?:2\.(?:2(?:53\.182\.139|36\.16\.14)|161\.201\.132)|1\.(?:214\.208\.226|143\.50\.219)|0\.(?:94\.235\.200|178\.97\.2))|4\.127\.201\.172)|6(?:1\.(?:(?:164\.42\.1|70\.83\.)58|252\.138\.195|38\.186\.117|98\
.131\.141)|6\.(?:199\.224\.(?:[689]|1[012345679]|20)|84\.49\.9)|4\.250\.118\.15[23]|5\.60\.15\.184|8\.115\.192\.7)|8(?:(?:1\.(?:15\.172\.14|23\.106\.7)|9\.78\.121\.3)5|3\.(?:18\.234\.202|238\.208\.55|3\.103\.227)|8\.250\.233\.164|6\.64\.171\.198|4\.22\.61\.190|7\.97\.215\.67)|9(?:1\.(?:187\.96\.104|214\.83\.2)|5\.(?:48\.24\.10|86\.4\.79)|2\.253\.123\.95|4\.189\.183\.70|3\.188\.8\.67)|7(?:2\.(?:35\.20\.131|42\.224\.25|55\.188\.73)|6\.74\.186\.237|1\.188\.63\.88|4\.9\.203\.186)|3(?:7\.(?:(?:206\.210\.13|46\.224\.25)0|122\.2(?:08\.169|11\.100))|1\.13\.211\.28)|4(?:1\.(?:137\.24\.4|41\.86\.6)|6\.182\.24\.130)|5(?:9\.1(?:5\.76\.97|0\.7\.16)|8\.232\.221\.43))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -163,7 +163,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:9\.3(?:9\.19[234567]|6\.213)|0\.(?:205\.3[25]|52\.8)|3\.56\.2(?:4[89]|5[01])|2\.215\.44)|7(?:8\.172\.(?:1(?:5[234]|8[36])|229)|7\.47\.121)|2(?:1\.(?:54\.54|63\.16)|0\.84\.13)|03\.2(?:3\.248|0\.37)|42\.11\.228|83\.221\.13)|27\.(?:20\.(?:1(?:[28][89]|[39][01]|0[0123]|7[6789])|24[01234567])|187\.20[01236])|3(?:7\.(?:17\.11[2345]|59\.212)|1\.192\.243)|58\.50\.1(?:1[6789]|2)|91\.213\.148|85\.153\.31)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:(?:12|8)[4567]|7[01245689]|4[89]|5[01]|69)|9\.3(?:9\.19[234567]|6\.21[23])|6\.207\.(?:6[0123]|4[89]|5\d)|3\.56\.2(?:4[589]|5[01]|25)|0\.(?:52\.[01238]|89\.208))|8(?:3\.(?:93\.(?:69|84)|221\.1[23])|(?:6\.123\.13|8\.165\.8)3)|0(?:3\.(?:2(?:3\.248|0\.37)|30\.73)|9\.127\.81|0\.42\.28)|2(?:1\.63\.1[6789]|5\.60\.156|0\.84\.13|3\.136\.0)|77\.47\.1(?:06|21))|2(?:7\.(?:20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|15(?:0\.16[12]|7\.252))|(?:02\.231\.24|13\.143\.5)8)|5(?:8\.50\.1(?:[2345]|1[6789])|9\.55\.25[2345]|\.135\.202)|85\.153\.2[48]|46\.234\.175|37\.59\.212)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6