You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/10/16 08:59:51 UTC
svn commit: r1532657 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Oct 16 06:59:51 2013
New Revision: 1532657
URL: http://svn.apache.org/r1532657
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1532657&r1=1532656&r2=1532657&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Oct 16 06:59:51 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201310142
+## khop-sc-neighbors.cf v 201310162
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|88)|46|95)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|46|95)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:84\.22\.177|98\.24\.178|21\.54\.54|41\.0\.61)|2(?:1(?:1\.119\.86|7\.118\.81)|21\.4\.142)|9(?:1\.214\.131|8\.143\.158)|(?:58\.254\.17|49\.218\.3)2|6(?:5\.60\.15|9\.64\.54))\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:(?:62\.210\.25|75\.96\.18)0|(?:84\.22\.17|12\.90\.3)7|98\.24\.178|21\.54\.54)|9(?:1\.214\.131|8\.143\.158)|58\.254\.1(?:68|72)|217\.118\.81|31\.192\.108|65\.60\.15)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:78\.124\.1(?:1[012567]|2[1235]|0[689])|1(?:2\.(?:215\.4|97\.2)4|1\.68\.32)|98\.(?:24\.17[45]|50\.163)|2(?:5\.60\.156|0\.84\.13)|57\.250\.81|84\.22\.172)|9(?:1\.2(?:18\.245|35\.142)|3\.119\.105)|21(?:3\.13(?:2\.241|9\.7)|6\.155\.17)|86\.57\.1(?:8[6789]|90)|41\.254\.5)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:78\.124\.1(?:2[123456]|0[46789]|1[12568])|98\.(?:24\.17[45]|50\.163)|2(?:5\.60\.156|0\.84\.13)|57\.250\.81|84\.22\.172|12\.97\.24)|9(?:1\.2(?:18\.245|35\.142)|3\.119\.105)|2(?:13\.13(?:2\.241|9\.7)|21\.4\.142)|86\.57\.18[679]|41\.254\.5)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.(?:22\.(?:1(?:7(?:2\.14[145]|7\.5[12])|97\.216|1\.23|52\.8)|2(?:30\.213|28\.62)|53\.190)|82\.1(?:79\.117|23\.85))|3\.10(?:6\.1(?:45\.24|50\.78)|0\.193\.8)|8\.2(?:40\.221\.1[12]|52\.0\.237)|9\.75\.63\.114)|9(?:8\.(?:24\.1(?:7(?:(?:8\.13|3\.8)0|4\.16[67]|5\.[234])|80\.91)|50\.163\.(?:197|202))|5\.(?:2(?:52\.108\.6|9\.81\.30)|138\.195\.125)|9\.30\.137\.10[67]|0\.107\.140\.77|4\.106\.16\.6)|1(?:2\.(?:2(?:20\.(?:2(?:24\.59|49\.20)|67\.130)|16\.46\.75)|1(?:84\.172\.244|70\.181\.99))|(?:5\.82\.242\.15|0\.10\.12\.9)8|8\.97\.196\.163|9\.201\.16\.211|6\.193\.90\.26)|7(?:7\.(?:1(?:84\.140\.222|\.223\.73)|69\.8\.50)|3\.2(?:12\.205\.158|00\.90\.196)|4\.(?:142\.53\.251|36\.187\.172)|5\.(?:96\.180\.100|106\.80\.34)|2\.245\.44\.122)|2(?:1\.(?:1(?:81\.252\.228|59\.11\.164|25\.71\.25)|22\.127\.17)|(?:4\.160\.35\.|5\.46\.24\.6)2|2\.182\.28\.245|3\.142\.218\.89)|4(?:\.(?:35\.201\.15|63\.74\.204)|8\.223\.59\.187|1\.0\.61\.166)|0(?:1\.(?:129\.2
\.(?:175|47)|44\.3\.50)|3\.9\.157\.12[679])|\.2(?:15\.206\.242|24\.163\.99)|37\.116\.235\.187|68\.63\.174\.108)|2(?:0(?:2\.(?:1(?:(?:29\.216\.6|37\.22\.20|58\.39\.25)0|17\.120\.24|42\.203\.19)|71\.136\.200|234\.40\.41)|3\.(?:1(?:56\.207\.249|71\.233\.243)|238\.64\.250)|1\.(?:1(?:16\.199\.34|95\.239\.27)|221\.132\.83)|0\.(?:7(?:2\.11\.132|9\.27\.60)|51\.45\.180)|8\.84\.135\.14[78]|7\.194\.87\.105)|1(?:1\.(?:1(?:1(?:9\.86\.14[456789]|8\.37\.56)|74\.120\.123|47\.211\.16)|234\.122\.10)|3\.1(?:(?:71\.39\.15|95\.77\.11)4|3(?:2\.241\.13|9\.7\.95))|0\.(?:1(?:83\.179\.3[89]|7\.248\.78)|245\.89\.69)|6\.1(?:55\.17\.(?:11|6)|89\.101\.110)|8\.15(?:1\.141\.75|8\.3\.1))|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|34\.24\.46)|4\.142\.(?:5[678]|41))|0\.130\.142\.42))|9(?:1\.(?:2(?:18\.245\.(?:7[123456789]|8[1235789]|6[678]|9[24])|35\.142\.2(?:4[345678]|2[35]))|194\.99\.242)|3\.1(?:19\.105\.[234567]|59\.160\.164|88\.8\.67)|8\.143\.158\.[45]3)|6(?:9\.(?:1(?:63\.229\.13|98\.197\.15)6|64\.54\.115)|(?:6\.96\.
205\.13|5\.60\.15\.17)3|(?:0\.21\.209|7\.90\.21)\.150|1\.105\.174\.6)|7(?:2\.(?:166\.187\.139|35\.20\.131)|4\.(?:216\.223\.82|9\.203\.186)|8\.(?:31\.74\.211|29\.4\.78)|7\.106\.232\.178|6\.74\.186\.237)|8(?:2\.(?:1(?:17\.194\.22|89\.158\.6)9|99\.246\.10)|(?:7\.106\.173\.11|1\.23\.106\.7)5|0\.73\.71\.248|3\.3\.103\.227)|4(?:9\.(?:218\.3(?:2\.130|3\.159)|1\.224\.9)|1\.137\.24\.4)|3(?:7\.(?:206\.210\.130|123\.98\.115)|1\.220\.42\.77))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.22\.(?:1(?:7(?:2\.14[145]|7\.5[12])|97\.216|1\.23|52\.8)|2(?:30\.213|28\.62)|53\.190)|3\.(?:10(?:6\.1(?:45\.24|50\.78)|0\.193\.8)|98\.75\.72)|8\.2(?:40\.221\.1[12]|52\.0\.237)|9\.38\.248\.41)|1(?:2\.(?:2(?:20\.(?:2(?:24\.59|49\.20)|31\.133|67\.130)|1(?:7\.228\.234|6\.46\.75))|1(?:61\.232\.157|84\.172\.244))|8\.(?:130\.107\.235|97\.196\.163)|9\.201\.16\.211|6\.193\.90\.26|0\.10\.12\.98)|7(?:7\.(?:1(?:84\.140\.222|\.223\.73)|69\.8\.50)|3\.2(?:12\.205\.158|00\.90\.196)|4\.(?:142\.53\.251|36\.187\.172)|5\.96\.18(?:0\.100|8\.83)|2\.245\.44\.122)|9(?:8\.(?:24\.1(?:7(?:(?:8\.13|3\.8)0|4\.16[67]|5\.[234])|80\.91)|50\.163\.202|98\.112\.27)|5\.(?:138\.195\.125|252\.108\.6)|0\.107\.140\.77|4\.106\.16\.6)|2(?:1\.(?:1(?:59\.11\.164|25\.71\.25)|22\.127\.17)|5\.(?:133\.17\.164|46\.24\.62)|2\.182\.28\.245|4\.160\.35\.2)|4(?:\.(?:35\.201\.15|63\.74\.204)|8\.223\.59\.187|1\.0\.61\.166)|6(?:2\.210\.250\.(?:4[1469]|5[136]|3[68]|60)|8\.63\.174
\.108)|0(?:3\.9\.157\.12[679]|1\.44\.3\.50)|\.2(?:15\.206\.242|24\.163\.99)|37\.116\.235\.187)|2(?:0(?:2\.(?:1(?:(?:29\.216\.6|37\.22\.20|58\.39\.25)0|17\.120\.24|42\.203\.19)|71\.136\.200|234\.40\.41)|3\.1(?:5(?:6\.207\.249|5\.102\.2)|71\.233\.243)|0\.(?:7(?:2\.11\.132|9\.27\.60)|51\.45\.180)|1\.1(?:16\.199\.34|95\.239\.27)|8\.84\.135\.14[78])|1(?:1\.(?:1(?:1(?:9\.86\.14[45678]|8\.37\.56)|47\.211\.16)|23(?:4\.122\.10|0\.74\.17))|3\.1(?:(?:71\.39\.15|95\.77\.11)4|3(?:2\.241\.13|9\.7\.95))|0\.(?:183\.179\.(?:38|44)|245\.89\.69)|6\.1(?:89\.101\.110|55\.17\.11)|8\.75\.153\.156)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|34\.24\.46)|4\.142\.(?:5[678]|41)|153\.158\.37)|0\.(?:130\.142\.42|68\.224\.45)))|9(?:1\.(?:2(?:18\.245\.(?:8[02356789]|7[356789]|6[678]|9[024])|35\.142\.24[345678])|194\.99\.242)|3\.1(?:19\.105\.[234567]|59\.160\.164|88\.8\.67)|8\.143\.158\.(?:4[236]|53))|7(?:2\.(?:166\.187\.139|35\.20\.131)|4\.(?:216\.223\.82|93\.63\.149)|8\.(?:31\.74\.211|29\.4\.78)|7\.106\.232\.178|6\.7
4\.186\.237)|8(?:2\.(?:1(?:17\.194\.22|89\.158\.6)9|99\.246\.10)|(?:7\.106\.173\.11|1\.23\.106\.7)5|3\.3\.103\.227)|6(?:(?:6\.96\.205\.13|5\.60\.15\.17)3|9\.1(?:63\.229\.13|98\.197\.15)6|(?:0\.21\.209|7\.90\.21)\.150)|3(?:1\.(?:192\.108\.13[012]|220\.42\.77)|7\.(?:206\.210\.130|123\.98\.115))|4(?:9\.(?:218\.3(?:2\.130|3\.159)|1\.224\.9)|1\.137\.24\.4))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|7[679]?|4[89]?|5[01]?|68?)|68\.32)|6\.207\.(?:6[0123]|1[23]|4[89]|5\d)|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|2\.(?:215\.44|72\.13)|9\.36\.21[23]|0\.52\.[023])|0(?:3\.(?:2(?:40\.(?:117|252)|6\.29)|7\.243|5\.27)|9\.127\.8[016])|8(?:3\.9(?:3\.11[45]|5\.6[67])|1\.66\.15[67]|6\.37\.203)|2(?:(?:3\.136\.10|5\.60\.15)6|2\.155\.44)|9(?:0\.234\.10[56]|8\.50\.174|7\.252\.0)|30\.193\.1(?:46|65)|77\.47\.106)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.194\.115|7\.199\.166|2\.29\.179)|1(?:6\.155\.(?:20|54|63)|2\.34\.12))|58\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|70)|19\.19[01])|4(?:1\.254\.[1258]|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|2\.(?:215\.(?:6[34]|44)|72\.13)|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|0\.52\.[0123]|9\.36\.21[23])|2(?:5\.(?:44\.245|60\.156)|3\.136\.106|4\.107\.127|2\.155\.44)|0(?:3\.(?:2(?:40\.(?:117|252)|6\.29)|5\.27)|9\.127\.8[016])|8(?:3\.9(?:3\.11[45]|5\.6[67])|1\.66\.15[67]|6\.37\.203)|9(?:0\.234\.10[56]|8\.50\.174|7\.252\.0)|30\.193\.1(?:46|65))|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.194\.115|7\.199\.166|2\.29\.179)|1(?:6\.155\.(?:20|54|63)|2\.34\.12))|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|7[01]|69)|19\.19[01])|9\.55\.25[235]|\.39\.221)|4(?:1\.254\.[1258]|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6