You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/10/09 08:57:21 UTC
svn commit: r1530510 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Oct 9 06:57:21 2013
New Revision: 1530510
URL: http://svn.apache.org/r1530510
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1530510&r1=1530509&r2=1530510&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Oct 9 06:57:21 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20131082
+## khop-sc-neighbors.cf v 20131092
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:3\.(?:251\.155|95\.90)|8\.24\.173)|16\.112\.66|21\.54\.54|01\.9\.49)|69\.64\.5[49]|211\.119\.86|91\.235\.142|77\.245\.4)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:3\.(?:251\.155|95\.90)|8\.24\.173)|16\.112\.66|21\.54\.54|01\.9\.49)|8(?:6\.111\.144|0\.86\.88)|91\.235\.142|69\.64\.59|77\.245\.4)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:98\.(?:24\.17[45]|50\.163)|25\.60\.156|78\.20\.148|41\.0\.61)|21(?:3\.132\.241|6\.155\.17)|8(?:6\.111\.144|0\.86\.88)|91\.218\.245)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:98\.(?:24\.17[45]|50\.163)|25\.60\.156|78\.20\.148|41\.0\.61)|21(?:3\.132\.241|1\.119\.86|6\.155\.17)|91\.218\.245|69\.64\.54)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:(?:69\.205\.20|244\.239\.)2|1(?:30\.107\.235|75\.28\.3)|97\.63\.227)|9\.(?:1(?:84\.214\.18|93\.93\.25)|3(?:7\.195\.59|0\.39\.1))|2\.(?:1(?:84\.172\.244|24\.15\.141|64\.62\.8)|216\.46\.75)|5\.82\.2(?:42\.158|54\.254)|3\.21\.228\.230|6\.112\.66\.102)|9(?:8\.(?:24\.1(?:7(?:(?:8\.13|3\.8)0|4\.16[67]|5\.[234])|80\.91)|5(?:0\.163\.(?:19[4578]|20[034])|2\.247\.103))|3\.(?:251\.155\.67|95\.90\.194)|5\.2(?:26\.209\.132|52\.108\.6)|0\.(?:107\.140\.77|0\.60\.238)|9\.30\.137\.10[67]|2\.163\.193\.199)|8(?:4\.(?:22\.(?:1(?:7(?:2\.14[46]|7\.5[12])|97\.216|52\.8)|230\.213)|82\.123\.85)|(?:0\.250\.192\.2|8\.240\.221\.)2|7\.(?:111\.255\.130|51\.175\.122)|9\.78\.155\.168|3\.234\.60\.43)|7(?:7\.(?:1(?:84\.140\.222|\.223\.73)|222\.66\.165|43\.210\.162)|8\.(?:168\.43\.130|20\.148\.11)|3\.212\.205\.158|2\.245\.44\.191|4\.36\.137\.170|6\.34\.52\.206)|2(?:1\.(?:1(?:99\.60\.110|2\.167\.95)|22\.127\.17)|2\.15(?:5\.167\.115|4\.57\.19)|4\.42\.124\.
136|3\.63\.31\.13|5\.46\.24\.62)|0(?:3\.(?:24(?:6\.245\.40|4\.13\.37)|9\.157\.12[69])|1\.(?:44\.3\.50|9\.49\.53))|6(?:2\.216\.3\.1[45]|8\.63\.174\.108)|4(?:5\.255\.136\.22|1\.0\.61\.166)|\.(?:215\.206\.242|93\.26\.97))|2(?:0(?:2\.(?:1(?:1(?:8\.236\.17[78]|7\.120\.24)|01\.228\.108|37\.22\.200|29\.52\.94)|29\.2(?:39\.210|14\.61|41\.58)|77\.180\.72)|1\.(?:2(?:45\.175\.217|21\.132\.83)|18\.107\.234)|0\.(?:(?:247\.100\.1|148\.94\.)78|41\.181\.170)|3\.1(?:56\.207\.249|71\.233\.243|43\.19\.154)|8\.84\.135\.14[78]|7\.194\.87\.105)|1(?:8\.(?:56\.(?:161\.14|37\.250)|151\.141\.75)|3\.1(?:32\.241\.13|64\.18\.147)|6\.155\.17\.(?:[56]|1[0234])|0\.14\.(?:133\.202|70\.21)|1\.119\.86\.14[4579]|2\.144\.254\.122|7\.218\.43\.130|9\.239\.227\.81)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|34\.24\.46)|192\.134\.91|0\.76\.99)|2\.(?:174\.155\.19|35\.61\.196)|0\.22(?:7\.90\.238|5\.11\.77))|\.18(?:6\.230\.30|3\.155\.2)|3\.91\.25\.82)|6(?:1\.(?:1(?:3(?:2\.229\.115|3\.125\.162)|05\.174\.6)|55\.156\.210)|0\.(?:19(?
:0\.136\.90|1\.35\.42)|21\.209\.150)|9\.(?:64\.5(?:4\.115|9\.111)|198\.197\.156)|3\.216\.146\.37|2\.141\.37\.85|5\.60\.15\.173|7\.90\.21\.150)|9(?:1\.(?:218\.245\.(?:8[023456789]|7[12359]|9[0134]|6[69])|197\.220\.230)|4\.(?:24\.245\.104|77\.199\.148)|5\.1(?:67\.178\.165|59\.105\.2)|3\.123\.54\.138)|8(?:0\.(?:73\.71\.248|86\.88\.113|240\.35\.5)|2\.1(?:17\.194\.229|46\.43\.38)|4\.(?:241\.37\.199|95\.244\.11)|6\.111\.144\.194|9\.105\.129\.12)|4(?:(?:2\.121\.117\.1|9\.248\.113\.)53|1\.22(?:0\.28\.138|3\.26\.11)|6\.22\.173\.86)|7(?:(?:2\.35\.20\.13|8\.31\.74\.21)1|7\.2(?:23\.243\.122|45\.4\.58))|58\.246\.43\.122)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:9\.(?:1(?:84\.214\.18|93\.93\.25)|3(?:7\.195\.59|0\.39\.1))|2\.(?:1(?:84\.172\.244|24\.15\.141|64\.62\.8)|216\.46\.75)|8\.(?:(?:69\.205\.20|244\.239\.)2|97\.63\.227|175\.28\.3)|5\.82\.2(?:42\.158|54\.254)|3\.21\.228\.230|4\.141\.253\.14|6\.112\.66\.102)|9(?:8\.(?:24\.1(?:7(?:(?:8\.13|3\.8)0|4\.16[67]|5\.[34])|80\.91)|5(?:0\.163\.(?:20[0234]|19[578])|2\.247\.103))|3\.(?:251\.155\.67|95\.90\.194)|5\.2(?:26\.209\.132|52\.108\.6)|0\.(?:107\.140\.77|0\.60\.238)|9\.30\.137\.10[67]|2\.163\.193\.199|4\.106\.16\.6)|8(?:4\.(?:22\.(?:1(?:7(?:2\.14[46]|7\.5[12])|97\.216|52\.8)|230\.213)|82\.123\.85)|(?:0\.250\.192\.2|8\.240\.221\.)2|7\.(?:111\.255\.130|51\.175\.122)|9\.78\.155\.168|3\.234\.60\.43)|7(?:7\.(?:1(?:84\.140\.222|\.223\.73)|222\.66\.165|43\.210\.162)|8\.(?:168\.43\.130|20\.148\.11)|2\.245\.44\.191|4\.36\.137\.170|6\.34\.52\.206)|2(?:1\.(?:1(?:99\.60\.110|2\.167\.95)|22\.127\.17)|2\.15(?:5\.167\.115|4\.57\.19)|3\.(?:142\.218\.8
9|63\.31\.13)|4\.42\.124\.136|5\.46\.24\.62)|0(?:3\.(?:24(?:6\.245\.40|4\.13\.37)|9\.157\.12[69])|1\.(?:44\.3\.50|9\.49\.53))|6(?:2\.216\.3\.1[45]|8\.63\.174\.108)|4(?:5\.255\.136\.22|1\.0\.61\.166)|\.(?:215\.206\.242|93\.26\.97))|2(?:0(?:2\.(?:1(?:1(?:8\.236\.17[78]|7\.120\.24)|01\.228\.108|37\.22\.200|29\.52\.94)|29\.2(?:39\.210|14\.61|41\.58)|77\.180\.72)|1\.(?:2(?:45\.175\.217|21\.132\.83)|18\.107\.234)|0\.(?:(?:247\.100\.1|148\.94\.)78|41\.181\.170)|3\.1(?:56\.207\.249|71\.233\.243|43\.19\.154)|8\.84\.135\.14[78]|7\.194\.87\.105)|1(?:8\.(?:56\.(?:161\.14|37\.250)|151\.141\.75)|3\.1(?:32\.241\.13|64\.18\.147)|6\.155\.17\.(?:[56]|1[0123])|0\.14\.(?:133\.202|70\.21)|1\.119\.86\.14[4579]|2\.144\.254\.122|7\.218\.43\.130|9\.239\.227\.81)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|34\.24\.46)|192\.134\.91)|2\.(?:174\.155\.19|35\.61\.196)|0\.22(?:7\.90\.238|5\.11\.77))|\.18(?:6\.230\.30|3\.155\.2)|3\.91\.25\.82)|6(?:1\.(?:1(?:3(?:2\.229\.115|3\.125\.162)|05\.174\.6)|55\.156\.210)|0\.(?:19
(?:0\.136\.90|1\.35\.42)|21\.209\.150)|9\.(?:64\.5(?:4\.115|9\.111)|198\.197\.156)|2\.(?:141\.37\.85|212\.89\.74)|3\.216\.146\.37|5\.60\.15\.173|7\.90\.21\.150)|9(?:1\.(?:218\.245\.(?:7[12356789]|8[01259]|9[0134]|6[679])|197\.220\.230)|4\.(?:24\.245\.104|77\.199\.148)|5\.1(?:67\.178\.165|59\.105\.2)|3\.123\.54\.138)|8(?:0\.(?:73\.71\.248|86\.88\.113|240\.35\.5)|2\.1(?:17\.194\.229|46\.43\.38)|4\.(?:241\.37\.199|95\.244\.11)|6\.111\.144\.194|9\.105\.129\.12)|4(?:(?:2\.121\.117\.1|9\.248\.113\.)53|1\.22(?:0\.28\.138|3\.26\.11)|6\.22\.173\.86)|7(?:(?:2\.35\.20\.13|8\.31\.74\.21)1|7\.2(?:23\.243\.122|45\.4\.58))|58\.246\.43\.122)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|68\.32)|6\.207\.(?:6[0123]|4[89]|5\d)|5\.63\.(?:[89]|1[012345])|2\.(?:215\.44|72\.13)|0\.52\.[0123]|3\.56\.24[89]|9\.36\.21[23])|8(?:3\.9(?:3\.11[45]|5\.6[67])|6\.(?:123\.135|37\.203)|1\.66\.15[67]|2\.18\.222)|0(?:3\.(?:2(?:40\.(?:117|252)|8\.184)|1\.69|5\.27)|9\.127\.8[01])|7(?:7\.(?:47\.10|86\.4)6|3\.44\.232)|9(?:0\.234\.10[56]|7\.252\.0)|30\.193\.1(?:46|65)|25\.60\.156)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|1(?:6\.155\.(?:20|54|63)|2\.34\.12)|0(?:2\.29\.17[89]|3\.194\.115))|58\.(?:50\.1(?:[2345]|0[456789]|1[016789])|19\.19[01])|4(?:1\.2(?:54\.[1258]|23\.161)|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|7[25789]?|4[89]?|5[01]?|69?)|68\.32)|6\.207\.(?:6[0123]|1[23]|4[89]|5\d)|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|2\.(?:215\.44|72\.13)|0\.52\.[0123]|9\.36\.21[23])|8(?:3\.9(?:3\.11[45]|5\.6[67])|(?:2\.18\.22|8\.73\.25)2|6\.(?:123\.135|37\.203)|1\.66\.15[67])|0(?:3\.(?:2(?:40\.(?:117|252)|8\.184)|7\.243|1\.69|5\.27)|9\.127\.8[016])|9(?:0\.234\.10[56]|7\.252\.[01]|8\.50\.174)|7(?:7\.(?:47\.10|86\.4)6|3\.44\.232)|2(?:3\.136\.10|5\.60\.15)6|30\.193\.1(?:46|65))|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:2\.29\.17[89]|3\.194\.115|7\.199\.166)|1(?:6\.155\.(?:20|54|63)|2\.34\.12))|58\.(?:50\.1(?:[2345]|0[456789]|1[016789])|19\.19[01])|4(?:1\.2(?:54\.[1258]|23\.161)|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6