You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/09/06 08:57:37 UTC
svn commit: r1520500 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Fri Sep 6 06:57:37 2013
New Revision: 1520500
URL: http://svn.apache.org/r1520500
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1520500&r1=1520499&r2=1520500&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Fri Sep 6 06:57:37 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20130952
+## khop-sc-neighbors.cf v 20130962
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:8[68]|13)|37)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:1[37]|88)|27)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -42,7 +42,7 @@ score KHOP_SC_CIDR8 0.1 0.02 0.2 0.1
# 1.5335/0.5063 0.752 20130629@465k net, solo=1.5947/0.5379@0.748
# 2.0256/0.7432 0.732 20130705@376k solo=2.0429/0.7595@0.729, ->.1 .02 .2 .1
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|78|90)|2)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|90)|37|2)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:7\.239\.107|5\.71\.238|6\.112\.66)|9(?:5\.245\.118|8\.24\.173)|03\.30\.72|21\.54\.54)|2(?:1(?:7\.12\.113|8\.2\.129)|22\.92\.141|\.183\.155)|61\.175\.223)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:2\.90\.222|6\.112\.66)|(?:73\.44\.18|03\.30\.7)2|83\.136\.146|21\.54\.54)|2(?:2(?:2\.92\.141|1\.4\.142)|18\.2\.129)|61\.1(?:36\.68|41\.21)|58\.254\.172)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:6\.192\.15|8\.20\.148)|4(?:\.139\.229|1\.0\.61)|98\.24\.17[45]|19\.184\.214|25\.60\.156|87\.4\.111|03\.20\.8)|86\.111\.144|90\.150\.9)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:6\.192\.15|8\.20\.148)|2(?:5\.60\.156|0\.84\.13)|98\.24\.17[345]|19\.184\.214|03\.20\.8|41\.0\.61)|217\.12\.113|86\.111\.144|90\.150\.9)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:1(?:24\.15\.141|70\.181\.99|68\.141\.5)|216\.86\.253|90\.222\.134)|6\.1(?:12\.(?:66\.102|5\.136)|24\.128\.138|93\.90\.26)|8\.(?:130\.107\.235|244\.239\.2|46\.127\.36)|7\.(?:131\.158\.34|239\.107\.21)|9\.(?:184\.214\.18|201\.141\.81)|1\.(?:68\.104\.132|30\.77\.129)|5\.(?:71\.238\.141|31\.137\.27)|0\.164\.70\.211)|9(?:5\.(?:2(?:29\.106\.222|45\.118\.5)|138\.195\.125)|8\.24\.1(?:7(?:4\.16[67]|5\.[234]|3\.80)|80\.91)|0\.(?:107\.140\.77|221\.18\.114|0\.60\.238)|9\.(?:30\.137\.107|255\.11\.29)|2\.163\.193\.199|4\.11\.24\.156)|8(?:4\.(?:22\.(?:1(?:77\.5[12]|1\.23)|2(?:30\.213|7\.171))|82\.(?:53\.1(?:06|1)|179\.117|214\.35))|3\.(?:1(?:36\.146\.110|01\.38\.202)|98\.23\.158)|0\.211\.179\.30|2\.234\.77\.23|7\.4\.111\.218|9\.3\.25\.146)|2(?:1\.(?:22\.(?:127\.17|34\.166)|134\.238\.129|78\.119\.193)|4\.(?:42\.124\.136|207\.34\.91)|2\.1(?:82\.28\.245|55\.12\.88)|5\.75\.235\.127|8\.134\.37\.121)|7(?:3\.2(?:12\.205\.158|00\.90\.196)|7\.
(?:5\.230\.114|69\.8\.50)|4\.36\.1(?:37\.170|64\.184)|6\.192\.15\.229|8\.20\.148\.11)|4(?:\.(?:52\.137\.(?:54|77)|139\.229\.3[46]|63\.74\.204)|1\.(?:105\.65\.10|0\.61\.166)|4\.76\.136\.228|8\.223\.59\.187)|0(?:(?:9\.228\.132\.14|1\.12\.245\.9)6|3\.9\.15(?:8\.1(?:47|81)|7\.126))|\.(?:2(?:2(?:0\.158\.3|6\.84\.27)|15\.206\.242|09\.163\.3)|93\.21\.147)|3(?:7\.116\.114\.52|8\.91\.176\.45)|68\.62\.178\.146)|2(?:1(?:1\.(?:1(?:7(?:2\.251\.168|4\.120\.123)|5(?:4\.151\.24|7\.114\.13)3|1(?:1\.250\.177|8\.37\.56))|232\.154\.6)|8\.(?:1(?:5(?:1\.141\.75|8\.3\.1|9\.9\.7)|48\.85\.130)|4\.100\.252|2\.129\.53)|2\.(?:1(?:44\.254\.122|56\.44\.134)|247\.140\.71|68\.44\.194)|3\.1(?:32\.241\.13|64\.18\.147|95\.77\.114)|0\.51\.44\.199|7\.12\.113\.67|9\.255\.77\.42)|0(?:0\.(?:1(?:42\.133\.21|75\.56\.190)|72\.11\.132|222\.4\.90)|(?:3\.171\.233\.24|8\.98\.25\.18)3|1\.116\.199\.34|2\.71\.136\.200)|2(?:2\.(?:100\.14(?:0\.4|\.3)|92\.141\.155|231\.33\.38|74\.200\.2)|1\.214\.208\.226|0\.94\.235\.200)|4\.237\.229\.
37|\.183\.155\.2)|6(?:1\.(?:1(?:75\.223\.1(?:3[49]|4[12])|(?:36\.68\.7|81\.252\.)6|66\.55\.153|41\.21\.34)|23(?:1\.218\.234|8\.148\.161)|3(?:8\.186\.117|6\.79\.99))|4\.(?:1(?:81\.43\.79|91\.34\.51|4\.85\.2)|71\.156\.216)|0\.(?:29\.(?:15\.194|75\.142)|191\.142\.233)|9\.(?:198\.197\.156|64\.49\.109)|5\.(?:125\.155\.90|60\.15\.184)|6\.96\.205\.133|2\.141\.37\.85|7\.90\.21\.150)|8(?:(?:(?:1\.15\.172\.1|4\.17\.27\.2)4|0\.70\.2\.18)5|3\.(?:167\.231\.(?:38|43)|238\.208\.55)|2\.(?:117\.194\.229|207\.51\.92)|6\.111\.144\.194|7\.103\.197\.93)|5(?:8\.(?:2(?:15\.176\.(?:109|210)|54\.172\.163)|150\.97\.242)|9\.(?:1(?:1\.237\.151|51\.37\.8|2\.17\.6)|8\.26\.22)|4\.216\.223\.122|\.39\.77\.125)|9(?:(?:1\.233\.188\.15|3\.159\.160\.16)4|5\.(?:78\.123\.159|159\.105\.2)|0\.(?:83\.184\.211|150\.9\.38)|2\.85\.161\.156|4\.77\.199\.148)|4(?:9\.(?:2(?:48\.113\.50|18\.46\.81)|159\.218\.39)|1\.(?:226\.11\.117|137\.24\.4)|2\.120\.18\.118)|7(?:9\.174\.204\.134|4\.216\.223\.82|2\.35\.20\.131)|37\.(?:1(?:59\.192\.
162|23\.98\.115)|59\.238\.178))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:1(?:84\.172\.244|70\.181\.99|64\.62\.8)|216\.86\.253|90\.222\.134)|(?:0\.164\.70\.21|5\.71\.238\.14|7\.239\.107\.2)1|9\.(?:1(?:84\.214\.18|92\.252\.1)|201\.141\.81)|8\.(?:130\.107\.235|244\.239\.2|46\.127\.36)|6\.1(?:12\.(?:66\.102|5\.136)|93\.90\.26)|1\.68\.104\.132)|8(?:4\.(?:22\.(?:1(?:77\.5[12]|1\.23)|2(?:30\.213|7\.171))|82\.(?:53\.1(?:0[69]|1)|179\.117|214\.35)|146\.116\.129)|3\.1(?:36\.146\.110|01\.38\.202)|(?:7\.4\.111\.21|5\.19\.94\.2)8|0\.211\.179\.30|2\.234\.77\.23|9\.3\.25\.146)|7(?:3\.(?:44\.1(?:79\.(?:2(?:0[59]|[13]2|[45]4|27)|197)|82\.(?:2[034]|3[58]|17|42|9))|2(?:12\.205\.158|00\.90\.196))|7\.(?:5\.230\.114|69\.8\.50)|4\.36\.1(?:37\.170|64\.184)|6\.192\.15\.229|8\.20\.148\.11)|9(?:8\.24\.1(?:7(?:4\.16[67]|5\.[234]|3\.80)|80\.91)|9\.(?:30\.137\.10[67]|255\.11\.29)|5\.(?:138\.195\.12|245\.118\.)5|2\.163\.193\.199|4\.11\.24\.156|0\.0\.60\.238)|4(?:\.(?:52\.137\.(?:54|77)|139\.229\.36|63\.74\.204)|1\.(?:105\
.65\.10|0\.61\.166)|4\.76\.136\.228|8\.223\.59\.187)|2(?:1\.(?:1(?:34\.238\.129|57\.3\.252)|22\.(?:127\.17|34\.166))|3\.(?:142\.218\.89|234\.230\.45)|4\.207\.34\.91)|0(?:3\.9\.15(?:8\.1(?:47|81)|7\.12[69])|(?:9\.228\.132\.14|1\.12\.245\.9)6)|\.(?:2(?:2(?:0\.158\.3|6\.84\.27)|15\.206\.242|09\.163\.3)|93\.21\.147)|62\.216\.3\.1[67])|2(?:1(?:8\.(?:1(?:5(?:1\.141\.75|8\.3\.1|9\.9\.7)|48\.85\.130)|2\.129\.53)|1\.(?:1(?:1(?:1\.250\.177|8\.37\.56)|74\.120\.123)|232\.154\.6)|2\.(?:1(?:44\.254\.122|56\.44\.134)|247\.140\.71)|3\.1(?:32\.241\.13|64\.18\.147|95\.77\.114)|0\.(?:109\.97\.63|51\.44\.199)|7\.12\.113\.67|9\.255\.77\.42)|2(?:2\.(?:1(?:00\.14(?:0\.4|\.3)|22\.79\.103)|92\.141\.155|231\.33\.38)|1\.(?:4\.142\.(?:9[013]|89)|214\.208\.226)|0\.94\.235\.200|3\.25\.242\.62)|0(?:0\.(?:1(?:42\.133\.21|75\.56\.190)|72\.11\.132|222\.4\.90)|3\.(?:171\.233\.243|234\.111\.248)|1\.116\.199\.34|2\.71\.136\.200|8\.98\.25\.183)|4\.237\.229\.37|\.183\.155\.2)|6(?:1\.(?:1(?:75\.223\.1(?:3[49]|4[12])|66\.5
5\.153|36\.68\.76|41\.21\.34)|23(?:1\.218\.234|8\.148\.161)|3(?:8\.186\.117|6\.79\.99))|4\.(?:1(?:81\.43\.79|91\.34\.51|4\.85\.2)|71\.156\.216)|5\.(?:60\.15\.18[46]|125\.155\.90)|9\.(?:198\.197\.156|64\.49\.109)|2\.141\.37\.85|7\.90\.21\.150)|5(?:9\.(?:1(?:(?:0\.7\.1|2\.17\.)6|1\.237\.151|51\.37\.8)|8\.26\.22)|8\.(?:2(?:15\.176\.210|54\.172\.163)|150\.97\.242)|4\.216\.223\.122)|9(?:5\.(?:78\.123\.159|159\.105\.2|48\.24\.10)|0\.(?:83\.184\.211|150\.9\.38)|3\.159\.160\.164|2\.85\.161\.156|4\.77\.199\.148)|8(?:3\.(?:167\.231\.(?:38|43)|238\.208\.55)|2\.117\.194\.229|6\.111\.144\.194|7\.103\.197\.93)|4(?:9\.(?:2(?:48\.113\.50|18\.46\.81)|159\.218\.39)|1\.137\.24\.4)|7(?:9\.174\.204\.134|4\.216\.223\.82|2\.35\.20\.131)|37\.(?:1(?:59\.192\.162|23\.98\.115)|59\.238\.178))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|3\.(?:56\.2(?:4[589]|5[01]|25)|18(?:7\.1[67]|5\.6))|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|4\.1(?:08\.2(?:03|14)|34\.189)|5\.63\.(?:[89]|1[012345])|2\.215\.(?:6[34]|44)|0\.52\.[0123]|9\.36\.21[23])|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|6\.(?:123\.135|37\.203)|8\.(?:165\.168|73\.252)|1\.66\.15[67]|2\.18\.222)|2(?:5\.(?:44\.24[134567]|60\.156)|(?:1\.54\.[45]|2\.155\.4)4|3\.(?:136\.106|30\.165)|4\.107\.127)|9(?:0\.(?:113\.2(?:1[01]|09)|234\.10[56])|7\.2(?:5(?:2\.[01]|4\.224)|16\.21))|0(?:3\.(?:2(?:0\.(?:37|8)|8\.184)|30\.72|1\.69|5\.27)|9\.127\.8[016])|7(?:3\.232\.19|7\.47\.106)|30\.193\.1(?:46|65)|42\.234\.186)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:2\.(?:29\.17[67]|153\.84)|3\.(?:82\.8[17]|194\.115))|1(?:3\.55\.1[01]5|2\.34\.12)|22\.140\.157)|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|
69|70)|19\.19[01])|9\.(?:55\.254|99\.136))|4(?:1\.2(?:23\.16[01]|54\.[1258])|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|3\.(?:56\.2(?:4[589]|5[01]|25)|18(?:7\.1[67]|5\.6))|6\.207\.(?:6[0123]|1[235]|4[89]|5\d)|4\.1(?:08\.2(?:03|14)|34\.189)|5\.63\.(?:[89]|1[012345])|2\.215\.(?:6[34]|44)|0\.52\.[0123]|9\.36\.21[23])|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|6\.(?:123\.135|37\.203)|8\.(?:165\.168|73\.252)|1\.66\.15[67]|2\.18\.222)|2(?:5\.(?:44\.24[1347]|60\.156)|(?:1\.54\.[45]|2\.155\.4)4|3\.(?:136\.106|30\.165)|4\.107\.127)|9(?:0\.(?:113\.2(?:1[01]|09)|234\.10[56])|7\.2(?:5(?:2\.[01]|4\.224)|16\.21))|0(?:3\.(?:2(?:0\.(?:37|8)|8\.184)|30\.72|1\.69|5\.27)|9\.127\.8[016])|7(?:3\.232\.19|7\.47\.106)|30\.193\.1(?:46|65)|42\.234\.186)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.(?:82\.8[17]|194\.115)|2\.(?:153\.84|29\.176))|22\.140\.157|12\.34\.12)|58\.50\.(?:1(?:[2345]|0[456789]|1[016789])|69|70)|4(?:1\.2(?:54\.[1258]|2
3\.161)|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6