You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2014/03/13 07:57:29 UTC
svn commit: r1577040 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Thu Mar 13 06:57:29 2014
New Revision: 1577040
URL: http://svn.apache.org/r1577040
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1577040&r1=1577039&r2=1577040&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Thu Mar 13 06:57:29 2014
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201403122
+## khop-sc-neighbors.cf v 201403132
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:4\.(?:22\.197|82\.179)|0\.222\.124)|(?:73\.212\.20|17\.19\.7)5|22\.13\.132)|3(?:1\.192\.111|6\.250\.229)|(?:98\.158\.23|72\.22\.7)4|212\.48\.79)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:4\.(?:82\.17[19]|22\.197)|0\.222\.124)|73\.212\.205|95\.216\.196|22\.13\.132)|21(?:3\.233\.64|7\.118\.81|2\.48\.79)|31\.220\.42|72\.22\.74|86\.98\.29)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:0\.222\.12[13]|1\.66\.15[67]|3\.182\.39|4\.22\.53)|2(?:3\.50\.208|5\.60\.156|0\.84\.13)|9(?:0\.234\.10[56]|8\.143\.150)|17\.19\.(?:217|72)|03\.25\.14[56])|9(?:(?:1\.218\.24|4\.20\.22)4|8\.172\.132)|7(?:4\.208\.99|7\.93\.241)|31\.220\.4[34]|217\.76\.74)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:0\.222\.12[13]|1\.66\.15[67]|3\.182\.39|4\.22\.53)|2(?:3\.50\.208|5\.60\.156|0\.84\.13)|17\.19\.(?:217|72)|03\.25\.14[56]|98\.143\.150)|9(?:(?:1\.218\.24|4\.20\.22)4|8\.172\.132)|7(?:4\.208\.99|7\.93\.241)|31\.220\.4[34]|217\.76\.74)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:7\.19\.(?:7(?:2\.1(?:43|81)|3\.(?:139|67)|4\.163|5\.111)|21(?:6\.212|7\.84))|(?:9\.(?:110\.108|226\.86)\.9|5\.88\.119\.13)2|2\.(?:216\.105\.90|90\.239\.211)|8\.4(?:6\.127\.36|1\.157\.3)|0\.45\.14(?:4\.163|0\.89)|3\.130\.65\.161)|8(?:4\.(?:82\.1(?:7(?:1\.234|9\.117)|31\.15[57]|23\.85)|22\.(?:53\.(?:190?|201)|197\.216))|5\.(?:10\.201\.1(?:6[78]|7[89])|25\.150\.212)|(?:7\.162\.253\.25|3\.86\.207\.13)0|2\.162\.73\.193|9\.54\.132\.56)|9(?:8\.(?:1(?:43\.1(?:50\.2(?:4[789]|5[012]|39)|28\.144)|75\.124\.7?8)|98\.122\.39)|5\.216\.196\.1(?:1[27]|23)|2\.3\.134\.(?:115|62)|3\.111\.141\.58)|2(?:1\.(?:1(?:24\.124\.148|34\.238\.129)|88\.54\.17)|3\.64\.199\.2(?:26|31)|2\.155\.165\.202|4\.54\.230\.123|5\.143\.97\.97)|0(?:7\.1(?:6(?:0\.73\.(?:196|210)|1\.28\.227)|58\.204\.120)|1\.(?:14\.(?:254\.74|90\.228)|9\.207\.205)|9\.64\.101\.57)|7(?:3\.2(?:12\.205\.158|39\.56\.14)|2\.245\.44\.122)|49\.210\.138\.143)|2(?:1(?:1\.(?:2(?:3(?:2\.1(?:83\.58|54\
.6)|\.152\.19)|18\.27\.112)|1(?:(?:74\.178\.17|15\.71\.3)5|69\.224\.17)|36\.8\.130)|0\.(?:183\.179\.38|48\.156\.227)|9\.(?:140\.69\.122|92\.57\.210)|8\.(?:234\.17\.176|38\.29\.68)|(?:3\.247\.47|2\.48\.79)\.212)|0(?:2\.(?:2(?:07\.1\.234|34\.40\.41)|179\.0\.201|64\.73\.148)|3\.(?:144\.218\.139|239\.125\.32))|3\.(?:94\.1(?:01\.137|5\.143)|234\.241\.52)|2(?:1\.178\.236\.19|2\.78\.247\.67)|7\.255\.70\.61|\.230\.25\.144)|6(?:1\.(?:1(?:06\.235\.18[08]|35\.130\.240|9\.246\.93)|38\.186\.(?:117|210))|7\.(?:210\.224\.(?:196|37)|196\.49\.196)|4\.(?:27\.28\.1[67]|191\.75\.46)|2\.113\.242\.151|0\.8\.103\.245|9\.65\.13\.26)|3(?:1\.(?:220\.4(?:4\.(?:2(?:0[369]|17)|1(?:69|76)|8[356]|51|60)|3\.(?:2(?:04|22)|9[67]|53)|2\.(?:205|46)|\.(?:47|90))|1(?:92\.111\.9[0124678]|31\.31\.72))|6\.250\.229\.4[0123]|8\.89\.160\.100)|9(?:1\.218\.244\.(?:2(?:2[3468]|0[239]|1[268]|4[089]|3[34])|19[124567])|8\.1(?:58\.234\.(?:2[05]|19)|72\.132\.244)|5\.211\.(?:233\.135|142\.22)|4\.177\.39\.126)|8(?:4\.(?:200\.213\.137|1
24\.94\.101)|5\.17\.(?:24\.(?:102|94)|190\.36)|(?:6\.98\.29\.25|8\.34\.250\.8)1|3\.149\.102\.229|9\.174\.235\.6)|7(?:7\.(?:106\.232\.178|93\.241\.234)|2\.(?:9\.103\.142|22\.74\.51)|4\.208\.99\.235|8\.29\.4\.78)|5(?:(?:0\.115\.168\.6|9\.4\.113\.11|\.135\.43\.5)7|8\.2(?:25\.62\.145|46\.179\.82))|4(?:2\.61\.87\.126|1\.137\.24\.4))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:7\.19\.(?:7(?:2\.1(?:43|81)|3\.(?:139|67)|4\.163|5\.111)|21(?:6\.212|7\.84))|9\.(?:2(?:01\.16\.211|26\.86\.92)|110\.108\.92)|2\.(?:216\.(?:105\.90|8\.158)|90\.239\.211)|8\.4(?:6\.127\.36|1\.157\.3)|0\.45\.14(?:4\.163|0\.89)|3\.130\.65\.161|5\.88\.119\.132)|8(?:4\.(?:82\.1(?:7(?:1\.234|9\.117)|31\.157|23\.85)|22\.(?:53\.(?:190?|201)|197\.216))|5\.(?:10\.201\.1(?:7[89]|68)|25\.150\.212)|(?:7\.162\.253\.25|3\.86\.207\.13)0|9\.(?:112\.88\.65|54\.132\.56)|2\.172\.22\.59)|2(?:1\.(?:1(?:24\.124\.148|34\.238\.129|59\.11\.164)|88\.54\.17)|2\.(?:155\.165\.202|49\.119\.188)|3\.64\.199\.2(?:26|31)|4\.54\.230\.123|5\.143\.97\.97)|9(?:8\.(?:1(?:43\.1(?:50\.2(?:4[789]|5[012]|39)|28\.144)|75\.124\.7?8)|98\.122\.39)|2\.2(?:27\.165\.126|10\.211\.68)|5\.216\.196\.1(?:1[278]|2[34]))|0(?:7\.1(?:6(?:1\.2(?:7\.116|8\.227)|0\.73\.(?:196|210))|58\.204\.120)|1\.(?:14\.(?:254\.74|90\.228)|9\.207\.205)|9\.(?:201\.133\.166|64\.101\.57))|7(?:3\.2(?:12\.20
5\.158|39\.56\.14)|2\.245\.(?:44\.122|30\.76)))|2(?:1(?:1\.(?:2(?:3(?:2\.1(?:83\.58|54\.6)|\.152\.19)|18\.27\.112)|1(?:74\.178\.17[59]|69\.224\.17|15\.71\.35)|36\.8\.130)|0\.(?:183\.179\.(?:38|45)|48\.156\.227)|9\.(?:140\.69\.122|92\.57\.210)|8\.(?:234\.17\.176|38\.29\.68)|(?:3\.247\.47|2\.48\.79)\.212)|0(?:2\.(?:2(?:07\.1\.234|34\.40\.41)|179\.0\.201)|3\.(?:144\.218\.139|239\.125\.32)|9\.208\.101\.22)|2(?:1\.(?:214\.208\.226|178\.236\.19)|2\.78\.247\.67)|3\.(?:234\.241\.52|94\.15\.143)|7\.255\.70\.61|\.230\.25\.144)|6(?:1\.(?:1(?:06\.2(?:35\.188|6\.226)|35\.130\.240|9\.246\.93)|38\.186\.(?:117|210))|4\.(?:1(?:11\.26\.15|91\.75\.46)|27\.28\.1[67])|(?:7\.196\.49\.19|9\.65\.13\.2)6|2\.113\.242\.151|0\.8\.103\.245)|8(?:3\.(?:149\.1(?:02\.229|24\.135)|96\.97\.10)|4\.(?:200\.213\.137|124\.94\.101)|5\.17\.(?:24\.(?:102|94)|190\.36)|6\.(?:64\.142\.28|98\.29\.251)|9\.(?:174\.235\.6|233\.4\.75)|8\.34\.250\.81)|9(?:1\.2(?:18\.244\.(?:2(?:0[239]|4[089]|3[34]|12)|19[124567])|35\.244\.24)|8\.1(?
:58\.234\.2[059]|72\.132\.244)|5\.211\.(?:233\.135|142\.22)|4\.177\.39\.126)|3(?:1\.(?:220\.4(?:4\.(?:2(?:0[369]|17)|1(?:69|76)|8[356]|51|60)|3\.(?:2(?:04|22)|9[67]|53)|2\.(?:205|46)|\.(?:47|90))|131\.31\.72)|6\.250\.229\.4[0123])|7(?:7\.(?:106\.232\.178|93\.241\.234)|4\.2(?:21\.220\.146|08\.99\.235)|2\.(?:9\.103\.135|22\.74\.51)|8\.29\.4\.78)|5(?:8\.(?:2(?:25\.62\.145|46\.179\.82)|151\.171\.114)|(?:0\.115\.168\.6|9\.4\.113\.11|\.135\.43\.5)7)|4(?:2\.61\.87\.126|1\.137\.24\.4))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|6\.207\.(?:6[0123]|4[89]|5\d)|(?:2\.215\.[46]|5\.63\.1)4|4\.108\.203)|8(?:6\.(?:1(?:3\.[01234567]|22\.4[4567])|37\.203)|1\.66\.15[67]|8\.73\.252)|9(?:0\.(?:113\.20[89]|234\.10[56])|2\.95\.63|7\.252\.1|9\.19\.92)|0(?:3\.2(?:5(?:1\.157|3\.23)|40\.252)|9\.127\.8[06])|7(?:1\.80\.1(?:6[89]|7[01])|7\.(?:54\.147|11\.55))|2(?:(?:3\.136\.10|5\.60\.15)6|2\.155\.34)|30\.193\.1(?:4[67]|65)|54\.65\.32)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:1\.220\.24[23]|2\.29\.17[67]|3\.191\.26)|12\.5\.158|4\.244\.23)|5(?:8\.5(?:0\.1(?:[2345]|0[456789]|1\d)|4\.18[4567])|9\.55\.253)|9(?:5\.83\.2(?:49|53)|4\.230\.93)|41\.254\.[2568]|79\.106\.109|31\.210\.91)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|201\.1(?:5[0578]|49))|6\.207\.(?:6[0123]|4[89]|5\d)|2\.215\.(?:6[34]|44)|4\.108\.203)|8(?:6\.(?:1(?:3\.[01234567]|22\.4[4567])|37\.203)|1\.66\.15[67]|8\.73\.252)|9(?:0\.(?:113\.20[89]|234\.10[56])|7\.252\.[01]|2\.95\.63|9\.19\.92)|0(?:3\.2(?:5(?:1\.157|3\.23)|40\.252)|9\.127\.8[06])|2(?:(?:3\.136\.10|5\.60\.15)6|2\.155\.(?:34|43))|30\.193\.1(?:4[67]|65)|54\.65\.32|77\.11\.55)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:1\.220\.24[23]|2\.29\.17[67]|3\.191\.26)|12\.5\.158|4\.244\.23)|5(?:8\.5(?:0\.1(?:[2345]|0[456789]|1\d)|4\.18[4567])|9\.55\.25[34]|\.172\.248)|9(?:5\.83\.2(?:49|53)|4\.230\.93)|41\.(?:254\.[2568]|177\.246)|31\.210\.91|79\.170\.54)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6