You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/10/24 08:57:57 UTC
svn commit: r1535289 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Thu Oct 24 06:57:57 2013
New Revision: 1535289
URL: http://svn.apache.org/r1535289
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1535289&r1=1535288&r2=1535289&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Thu Oct 24 06:57:57 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201310232
+## khop-sc-neighbors.cf v 201310242
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:117|27?|46)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:[25]|117|46)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -81,7 +81,7 @@ score KHOP_SC_CIDR16 0.4 0.1 0.4 0.1
# crap, still empty 20130629@465k net
# crap, still empty 20130705@376k net. lowering for low vol -> .4 .1 .4 .1
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:222\.239|94\.153)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b222\.239(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0.3
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:8\.24\.173|4\.105\.9)|12\.9(?:0\.37|7\.24)|84\.22\.17[27]|42\.11\.195|03\.9\.157)|58\.254\.1(?:68|72)|31\.192\.108|91\.214\.131)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:8\.24\.173|4\.105\.9)|12\.9(?:0\.37|7\.24)|84\.22\.172|03\.9\.157)|22(?:2\.122\.227|1\.4\.142)|58\.254\.1(?:68|72)|31\.192\.108)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:78\.124\.1(?:0[4789]|1[123])|9(?:8\.24\.17[45]|9\.96\.83)|0(?:3\.243\.50|9\.169\.88)|2(?:5\.60\.156|0\.84\.13)|42\.11\.195|12\.97\.24)|2(?:13\.132\.241|21\.4\.142)|(?:31\.192\.10|86\.57\.18)8|91\.218\.245|64\.79\.99)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:8\.24\.17[45]|9\.96\.83)|0(?:3\.243\.50|9\.169\.88)|2(?:5\.60\.156|0\.84\.13)|1(?:2\.97\.24|0\.52\.0)|78\.124\.1(?:0[49]|11)|42\.11\.195)|(?:31\.192\.10|86\.57\.18)8|213\.132\.241|91\.218\.245|64\.79\.99)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:8\.(?:2(?:4\.1(?:7(?:4\.16[37]|5\.[234]|3\.80)|80\.91)|7\.111\.103)|49\.73\.123)|9\.(?:30\.137\.1[67]|96\.83\.13[01]|193\.252\.127)|5\.(?:138\.195\.125|252\.108\.6)|4\.10(?:5\.9\.85|6\.16\.6)|0\.107\.140\.77)|1(?:8\.(?:(?:97\.196\.16|41\.157\.)3|130\.107\.235)|5\.8(?:2\.24(?:6\.172|1\.34)|8\.119\.132)|2\.(?:168\.218\.86|217\.161\.3)|9\.(?:42\.147\.114|37\.195\.59)|4\.(?:247\.23\.66|33\.22\.29)|6\.48\.159\.51)|8(?:4\.(?:22\.(?:1(?:7(?:2\.14[145]|7\.51)|97\.216|1\.23|52\.8)|230\.213|53\.190)|82\.1(?:79\.117|23\.85))|8\.(?:168\.46\.53|252\.0\.237)|3\.106\.116\.109|9\.38\.248\.41)|7(?:3\.2(?:12\.205\.158|00\.90\.196)|7\.(?:1\.223\.73|69\.8\.50)|5\.96\.18(?:0\.175|8\.83)|4\.142\.53\.251)|0(?:3\.(?:243\.50\.5[0468]|9\.157\.12[679])|9\.169\.88\.136|1\.44\.3\.50)|2(?:5\.(?:143\.97\.97|46\.24\.62)|2\.182\.28\.245|1\.88\.54\.17)|4(?:0\.198\.75\.131|8\.223\.59\.187|1\.0\.61\.166|\.63\.74\.204)|38\.91\.158\.85|\.215\.206\.242)|2(?:1(?:1\
.(?:1(?:7(?:4\.120\.123|6\.76\.198)|47\.211\.16)|23(?:4\.106\.54|0\.74\.17|7\.20\.39))|0\.(?:1(?:83\.179\.45|7\.248\.78)|2(?:45\.89\.69|17\.56\.2)|56\.23\.100)|3\.1(?:(?:71\.39\.15|95\.77\.11)4|32\.241\.13)|6\.(?:189\.101\.110|231\.140\.15)|8\.151\.141\.75|7\.96\.37\.18)|0(?:2\.(?:1(?:(?:29\.216\.6|58\.39\.25)0|42\.203\.19)|71\.136\.200|82\.202\.228|234\.40\.41|53\.13\.187)|3\.(?:2(?:3(?:9\.45\.202|8\.95\.11)|46\.196\.33)|171\.233\.243)|0\.(?:(?:175\.56\.19|51\.45\.18)0|7(?:2\.11\.132|9\.27\.60))|1\.1(?:16\.199\.34|95\.239\.27))|2(?:2\.(?:1(?:12\.150\.58|22\.227\.10|00\.140\.4)|239\.255\.70)|1\.(?:2(?:14\.208\.22|34\.24\.4)6|4\.142\.(?:5[678]|41))|0\.67\.90\.31))|6(?:1\.(?:1(?:35\.130\.240|9\.246\.93)|222\.113\.196)|4\.79\.(?:99\.16[012345678]|107\.13)|9\.198\.197\.156|7\.90\.21\.150)|9(?:1\.218\.245\.(?:7[012378]|8[03789]|6[6789]|9[234])|3\.1(?:59\.160\.164|88\.8\.67)|0\.83\.184\.211|8\.143\.158\.49)|8(?:1\.(?:144\.152\.51|23\.106\.75)|3\.(?:238\.208\.55|3\.103\.227)|2\.117\.194\.2
29|7\.106\.173\.115)|7(?:(?:6\.164\.199\.7|2\.35\.20\.13)1|4\.(?:216\.223\.82|92\.74\.230)|8\.29\.4\.78)|3(?:1\.192\.108\.1(?:3[013456789]|5[01234789]|6[01]|4\d)|7\.123\.98\.115)|59\.12(?:5\.116\.144|4\.115\.88)|41\.137\.24\.4)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:1(?:30\.107\.235|63\.156\.109)|9(?:7\.196\.163|5\.121\.66)|41\.157\.3)|5\.8(?:2\.24(?:6\.172|1\.34)|0\.227\.233|8\.119\.132)|9\.(?:42\.147\.114|193\.93\.25|37\.195\.59)|2\.(?:184\.172\.244|217\.161\.3)|4\.(?:247\.23\.66|33\.22\.29)|3\.21\.228\.230)|9(?:8\.(?:2(?:4\.1(?:7(?:4\.16[37]|5\.[234]|3\.80)|80\.91)|7\.111\.103)|49\.73\.123)|9\.(?:96\.83\.13[012456789]|30\.137\.1[67])|5\.(?:138\.195\.125|252\.108\.6)|4\.10(?:5\.9\.85|6\.16\.6)|0\.107\.140\.77)|8(?:4\.(?:22\.(?:1(?:7(?:2\.14[145]|7\.51)|97\.216)|230\.213)|82\.1(?:79\.117|23\.85))|8\.(?:168\.46\.53|252\.0\.237)|9\.38\.248\.41)|7(?:3\.2(?:12\.205\.158|00\.90\.196)|7\.(?:1\.223\.73|69\.8\.50)|4\.142\.53\.251|5\.96\.180\.175)|0(?:3\.(?:243\.50\.5[0468]|9\.157\.12[679]|31\.241\.16)|9\.169\.88\.1(?:3[69]|40)|1\.44\.3\.50)|4(?:0\.1(?:98\.75\.131|33\.45\.25)|8\.223\.59\.187|1\.0\.61\.166|\.63\.74\.204)|2(?:5\.(?:143\.97\.97|46\.24\.62)|2\.182\.28\.245|1\.88\.54\.17)|38\.9
1\.158\.85)|2(?:0(?:2\.(?:1(?:1(?:8\.236\.178|7\.120\.24)|(?:29\.216\.6|58\.39\.25)0|42\.203\.19)|71\.136\.200|82\.202\.228|234\.40\.41|53\.13\.187)|3\.(?:2(?:3(?:9\.45\.202|8\.95\.11)|46\.196\.33)|196\.170\.194)|0\.(?:(?:175\.56\.19|51\.45\.18)0|7(?:2\.11\.132|9\.27\.60))|1\.1(?:16\.199\.34|95\.239\.27))|1(?:1\.(?:1(?:47\.211\.16|76\.76\.198)|23(?:4\.106\.54|7\.20\.39))|3\.1(?:(?:71\.39\.15|95\.77\.11)4|32\.241\.13)|0\.(?:17\.248\.78|245\.89\.69|56\.23\.100)|6\.(?:189\.101\.110|231\.140\.15)|8\.151\.141\.75)|2(?:1\.(?:2(?:14\.208\.22|34\.24\.4)6|4\.142\.(?:5[678]|41))|2\.(?:1(?:12\.150\.58|22\.227\.10)|239\.255\.70)))|6(?:4\.79\.(?:99\.(?:1(?:7[01234]|6\d)|23[78])|107\.13)|1\.(?:1(?:35\.130\.240|9\.246\.93)|222\.113\.196)|9\.198\.197\.156|7\.90\.21\.150)|8(?:1\.(?:144\.152\.51|23\.106\.75)|3\.(?:238\.208\.55|3\.103\.227)|2\.117\.194\.229|7\.106\.173\.115)|9(?:1\.218\.245\.(?:7[01238]|6[6789]|8[3789]|94)|3\.1(?:59\.160\.164|88\.8\.67)|0\.83\.184\.211)|7(?:(?:6\.164\.199\.7|2\.35\.20
\.13)1|4\.(?:216\.223\.82|92\.74\.230)|8\.29\.4\.78)|3(?:1\.192\.108\.1(?:4[12346789]|5[0124789]|3[034568]|6[01])|7\.123\.98\.115)|59\.12(?:5\.116\.144|4\.115\.88)|41\.137\.24\.4)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work