You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2014/04/07 08:57:48 UTC
svn commit: r1585406 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Mon Apr 7 06:57:47 2014
New Revision: 1585406
URL: http://svn.apache.org/r1585406
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1585406&r1=1585405&r2=1585406&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Mon Apr 7 06:57:47 2014
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20140452
+## khop-sc-neighbors.cf v 20140472
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|95|2)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|23|86)|2)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:4\.82\.1(?:23|71)|0\.222\.124)|7(?:9\.197\.186|5\.45\.174)|22\.13\.132|01\.9\.205)|2(?:1(?:2\.146\.101|3\.148\.5)|3\.94\.104)|63\.247\.82|72\.22\.74)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:7\.179\.121|9\.197\.186|5\.45\.174)|2(?:4\.156\.251|2\.13\.132|3\.64\.199)|8(?:0\.222\.124|4\.82\.171)|98\.143\.152)|2(?:1(?:0\.183\.179|2\.146\.101)|3\.94\.104))\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:0\.2(?:22\.12[123]|04\.194)|4\.(?:82\.179|22\.83))|0(?:3\.2(?:5\.14[56]|25\.80)|1\.14\.88)|98\.143\.1(?:5[02]|28)|73\.212\.205|17\.19\.74|20\.84\.13)|2(?:03\.191\.26|7\.123\.24)|5\.172\.248|84\.22\.11)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:3\.2(?:5(?:\.14[56]|0\.0)|25\.80)|1\.9\.205)|8(?:0\.2(?:22\.12[123]|04\.194)|9\.126\.130)|98\.143\.1(?:28|50)|77\.179\.62|17\.19\.74|20\.84\.13)|2(?:13\.148\.5|7\.123\.24)|(?:94\.20\.22|72\.22\.7)4|5\.172\.248|63\.247\.82|84\.22\.11)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:2(?:16\.(?:20\.50|8\.158)|20\.67\.130)|124\.27\.12)|0\.(?:45\.14(?:4\.163|0\.89)|170\.190\.194)|(?:3\.99\.177\.24|4\.247\.23\.6)6|9\.(?:201\.16\.211|82\.224\.242)|6\.1(?:12\.66\.102|93\.90\.26)|8\.(?:129\.166\.86|41\.157\.3)|7\.19\.74\.72)|2(?:1\.(?:1(?:3(?:4\.238\.129|6\.57\.163)|5(?:1\.122\.38|9\.11\.164)|81\.252\.228)|78\.88\.239)|5\.(?:(?:212\.216\.16|75\.235\.12)7|141\.142\.224)|3\.(?:64\.199\.2(?:3[16]|19)|200\.28\.77)|4\.1(?:56\.251\.12|60\.35\.)2|2\.49\.119\.188|0\.50\.86\.3)|9(?:8\.(?:1(?:43\.(?:1(?:5(?:0\.2(?:4[1345789]|5[012]|3[89])|2\.(?:1(?:0[078]|10)|9[1249]))|28\.1(?:3[29]|44)|\.237)|2\.184)|5\.73\.5[59])|24\.146\.72)|0\.(?:1(?:0(?:7\.140\.77|9\.164\.81)|22\.102\.42)|90\.2\.30)|3\.238\.111\.26|5\.138\.65\.113)|8(?:4\.(?:82\.1(?:7(?:1\.234|9\.117)|30\.23[57]|69\.11[46]|23\.85)|22\.(?:66\.138|83\.154))|0\.(?:2(?:50\.1(?:33\.5|81\.7)0|04\.194\.143)|70\.94\.67)|(?:9\.208\.57\.23|2\.172\.22\.5)9|7\.14\.1(?:38\
.142|40\.106)|8\.64\.185\.(?:55|64))|7(?:3\.2(?:25\.121\.1[34]|12\.205\.158|55\.235\.221)|9\.197\.186\.(?:199|63)|2\.245\.44\.122|7\.179\.121\.77|8\.19\.109\.228)|0(?:3\.2(?:3\.124\.22[79]|5\.146\.125|1\.41\.84)|1\.(?:14\.88\.10|9\.205\.39)|6\.187\.48\.161|9\.201\.138\.6)|6(?:2\.2(?:51\.119\.103|48\.101\.17)|7\.160\.36\.118|6\.111\.72\.71)|(?:38\.91\.226\.1|\.85\.17\.)82|48\.235\.147\.69)|2(?:1(?:1\.(?:1(?:74\.178\.177|15\.71\.35)|2(?:18\.27\.112|33\.64\.110))|(?:2\.146\.101\.15|3\.148\.5\.24)4|8\.(?:234\.108\.13|36\.254\.151)|9\.(?:147\.172\.|93\.11\.16)2|0\.183\.179\.(?:39|45)|6\.144\.240\.67)|0(?:3\.2(?:40\.225\.115|39\.125\.32)|7\.(?:194\.87\.105|42\.178\.67)|2\.(?:96\.155\.25|234\.40\.4)1|1\.221\.132\.83)|2(?:2\.(?:1(?:06\.216\.101|17\.219\.97)|201\.132\.28|74\.200\.2)|1\.2(?:14\.2(?:08\.226|14\.187)|34\.24\.46))|7\.1(?:23\.24\.2(?:3[27]|27)|51\.127\.13)|3\.(?:94\.104\.81|239\.0\.24)|4\.180\.19\.180)|6(?:7\.(?:159\.(?:34\.6[01]|59\.58)|209\.228\.(?:9[015]|89))|1\.(?:106\.2(?:35
\.18[08]|6\.226)|38\.186\.210)|3\.247\.82\.(?:19[4569]|20[2456])|6\.(?:199\.236\.165|55\.143\.130)|0\.2(?:47\.27\.119|9\.104\.197)|5\.23\.156\.12[45]|4\.6\.243\.99|2\.4\.27\.92)|9(?:(?:5\.154\.217\.13|2\.51\.109\.18)1|1\.(?:241\.187\.204|187\.213\.57)|4\.(?:250\.248\.199|77\.199\.148)|3\.(?:90\.102\.194|184\.71\.66))|7(?:8\.(?:3(?:6\.14\.195|9\.178\.2)|29\.4\.78)|7\.106\.232\.178|2\.22\.74\.51)|4(?:6\.(?:249\.47\.(?:29|35)|191\.237\.118)|1\.(?:33\.169\.36|137\.24\.4))|8(?:(?:1\.169\.150\.22|0\.241\.95\.21)8|5\.1(?:7\.132\.115|85\.30\.163))|5(?:8\.(?:151\.171\.114|246\.179\.82)|\.255\.(?:86\.2(?:18|25)|74\.33))|37\.48\.66\.1[89])\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:2(?:1\.1(?:8(?:1\.252\.228|6\.153\.33|9\.62\.186)|34\.238\.129|59\.11\.164)|5\.(?:(?:212\.216\.16|75\.235\.12)7|141\.142\.224)|3\.(?:64\.199\.2(?:1[89]|[23]6)|200\.28\.77)|4\.1(?:56\.251\.12|60\.35\.)2|2\.49\.119\.188)|9(?:8\.1(?:43\.(?:1(?:5(?:0\.2(?:4[1345789]|5[012]|3[89])|2\.(?:1(?:07|10)|9[149]))|28\.1(?:3[29]|44)|\.237)|2\.184)|5\.73\.5[59])|0\.10(?:7\.140\.77|9\.164\.81)|2\.227\.182\.207|3\.238\.111\.26|5\.138\.65\.113)|1(?:2\.(?:2(?:16\.(?:20\.50|8\.158)|20\.67\.130)|124\.27\.12)|0\.(?:170\.190\.194|87\.218\.206|45\.140\.79)|(?:6\.112\.66\.10|7\.19\.74\.7)2|3\.(?:130\.65\.161|99\.177\.246)|9\.(?:201\.16\.211|82\.224\.242))|8(?:4\.(?:82\.1(?:7(?:1\.234|9\.117)|(?:30\.23|23\.8)5|69\.11[46])|22\.(?:66\.138|83\.154))|0\.2(?:50\.1(?:33\.5|81\.7)0|04\.194\.143)|7\.14\.1(?:38\.142|40\.106)|2\.172\.22\.59|8\.64\.185\.64|5\.12\.14\.35)|7(?:3\.2(?:12\.205\.158|25\.121\.13)|7\.179\.(?:121\.77|62\.35)|9\.197\.186\.(?:199|63)|4\.137\.
132\.164|2\.245\.44\.122|8\.19\.109\.228)|0(?:6\.(?:187\.48\.161|245\.250\.6)|3\.2(?:5\.146\.125|1\.41\.84)|1\.(?:14\.88\.10|9\.205\.39)|9\.201\.138\.6)|6(?:2\.2(?:(?:16\.227\.1|48\.101\.)17|51\.119\.103)|7\.160\.36\.118)|\.(?:2(?:09\.242\.218|26\.84\.175)|85\.17\.82)|4(?:8\.235\.147\.69|\.220\.59\.63)|38\.91\.226\.182)|2(?:1(?:0\.(?:21(?:7\.150\.195|9\.203\.226)|183\.179\.(?:3[89]|45))|1\.(?:2(?:18\.27\.112|33\.64\.110)|174\.178\.177)|(?:2\.146\.101\.15|3\.148\.5\.24)4|8\.(?:147\.191\.179|36\.254\.151)|6\.1(?:44\.240\.67|68\.137\.80)|7\.14(?:6\.67\.42|7\.92\.16)|9\.147\.172\.2)|2(?:1\.2(?:14\.2(?:08\.226|14\.187)|34\.24\.46)|2\.(?:117\.219\.97|201\.132\.28|74\.200\.2)|0\.(?:160\.240\.95|67\.90\.31))|0(?:(?:0\.52\.182\.23|4\.68\.120\.15)6|2\.(?:96\.155\.25|234\.40\.4)1|1\.221\.132\.83|7\.194\.87\.105)|3\.(?:2(?:28\.64\.(?:38|40)|39\.0\.24)|94\.10(?:1\.73|4\.81))|7\.1(?:23\.24\.2(?:3[27]|27)|51\.127\.13)|4\.180\.19\.180)|6(?:7\.(?:159\.(?:34\.6[01]|59\.58)|209\.228\.(?:9[015]|89))|1\
.(?:106\.2(?:35\.18[08]|6\.226)|38\.186\.210)|2\.(?:113\.242\.253|75\.207\.4|4\.27\.92)|3\.247\.82\.(?:19[4569]|20[2456])|0\.2(?:47\.27\.119|9\.104\.197)|4\.(?:31\.52\.55|6\.243\.99)|5\.23\.156\.12[45]|9\.46\.221\.50)|9(?:(?:5\.154\.217\.13|2\.51\.109\.18)1|1\.(?:241\.187\.204|187\.213\.57)|4\.(?:250\.248\.199|77\.199\.148)|3\.(?:90\.102\.194|184\.71\.66))|4(?:6\.(?:1(?:91\.237\.118|82\.83\.194)|229\.192\.208)|1\.(?:33\.169\.36|137\.24\.4))|7(?:(?:9\.180\.167\.19|2\.22\.74\.5)1|8\.(?:36\.14\.195|29\.4\.78)|7\.106\.232\.178)|8(?:5\.1(?:7\.132\.115|85\.30\.163)|1\.169\.150\.228|4\.40\.22\.99)|3(?:7\.(?:48\.66\.1[89]|29\.108\.70)|6\.250\.86\.6[23])|58\.(?:2(?:10\.206\.239|46\.179\.82)|151\.171\.114))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|6\.207\.(?:6[0123]|4[89]|5\d)|2\.215\.6[34])|8(?:6\.(?:1(?:3\.[01234567]|22\.4[4567])|37\.203)|8\.73\.252)|9(?:0\.113\.209|2\.95\.63|9\.19\.92)|77\.(?:(?:36\.[12]|54\.14)7|11\.55)|0(?:3\.251\.157|9\.127\.80)|2(?:3\.136\.10|5\.60\.15)6|30\.193\.1(?:47|65))|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.191\.2[56]|1\.220\.243|2\.62\.16)|12\.5\.158|4\.244\.23)|5(?:8\.50\.1(?:[2345]|0[456789]|1\d)|\.172\.248)|9(?:4\.230\.93|0\.174\.2)|41\.254\.[2568])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|6\.207\.(?:6[0123]|4[89]|5\d)|2\.215\.(?:6[34]|44)|3\.185\.15)|8(?:6\.1(?:3\.[01234567]|22\.4[4567])|8\.73\.252)|2(?:(?:3\.136\.10|5\.60\.15)6|2\.155\.43)|0(?:3\.25(?:1\.157|0\.0)|9\.127\.80)|77\.(?:(?:36\.[12]|54\.14)7|11\.55)|9(?:0\.113\.208|2\.95\.63)|30\.193\.1(?:47|65))|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.191\.2[56]|1\.220\.243|2\.62\.16)|12\.5\.158|4\.244\.23)|5(?:8\.50\.1(?:[2345]|1[0136789]|0[456789])|\.1(?:02\.253|72\.248))|9(?:4\.230\.93|0\.174\.2)|41\.254\.[2568])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6