You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2014/02/06 08:57:27 UTC
svn commit: r1565102 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Thu Feb 6 07:57:27 2014
New Revision: 1565102
URL: http://svn.apache.org/r1565102
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1565102&r1=1565101&r2=1565102&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Thu Feb 6 07:57:27 2014
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20140252
+## khop-sc-neighbors.cf v 20140262
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:[25]|1(?:17|90))(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:[25]|117|46)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -42,7 +42,7 @@ score KHOP_SC_CIDR8 0.1 0.02 0.2 0.1
# 1.5335/0.5063 0.752 20130629@465k net, solo=1.5947/0.5379@0.748
# 2.0256/0.7432 0.732 20130705@376k solo=2.0429/0.7595@0.729, ->.1 .02 .2 .1
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:178|37|46|95)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|90)|37|95)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:7\.223\.15[67]|3\.212\.205)|9(?:2\.208\.18|9\.204\.4)5|84\.(?:22\.197|82\.179)|20\.84\.13)|22(?:1\.23(?:2\.247|8\.21)|0\.164\.162)|6(?:1\.163\.101|0\.29\.104)|91\.214\.131)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:7\.223\.15[67]|3\.212\.205)|9(?:2\.208\.18|9\.204\.4)5|84\.(?:22\.197|82\.179)|20\.84\.13)|6(?:1\.163\.101|0\.29\.104)|221\.23(?:2\.247|8\.21)|91\.214\.131|81\.92\.126)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:216\.(?:20\.50|46\.75|76\.74|8\.158)|17(?:3\.175\.13|1\.126\.9)3|90\.239\.211)|6\.(?:255\.241\.111|112\.66\.102)|8\.(?:244\.239\.2|97\.186\.94)|0\.45\.14(?:4\.163|0\.89)|9\.201\.16\.211|3\.199\.80\.47|4\.247\.23\.66)|8(?:4\.(?:22\.(?:1(?:97\.216|52\.8)|53\.(?:190?|201))|82\.1(?:7(?:1\.234|9\.117|2\.62)|23\.85)|1(?:07\.159\.15|54\.91\.24)4)|5\.2(?:4\.232\.(?:193|206)|5\.150\.212)|3\.106\.150\.78|2\.172\.22\.57)|9(?:8\.(?:143\.1(?:50\.2(?:4[0789]|5[012]|39)|28\.144)|246\.46\.27)|2\.208\.185\.1(?:7[89]|69)|3\.109\.69\.1(?:4[59]|50)|0\.107\.140\.76|9\.204\.45\.181|4\.105\.9\.85)|2(?:5\.(?:(?:141\.142\.22|88\.123\.24)4|93\.77\.125)|1\.1(?:3(?:4\.238\.129|7\.91\.42)|59\.11\.164)|4\.(?:54\.230\.123|160\.35\.2)|3\.200\.28\.77)|7(?:3\.2(?:08\.(?:186\.8[3456]|215\.164)|12\.205\.158)|7\.67\.82\.111)|(?:63\.177\.132\.14|\.209\.216\.11)4|0(?:1\.9\.206\.207|9\.3\.159\.178))|2(?:1(?:1\.(?:2(?:3(?:3\.(?:64\.110|71\.76)|2\.138\.171|8\.1
33\.138)|18\.27\.11[02])|1(?:72\.246\.78|15\.71\.35))|2\.(?:146\.101\.154|220\.9\.235)|9\.(?:238\.181\.120|147\.172\.2)|8\.(?:234\.108\.13|38\.29\.68)|6\.107\.159\.9[27]|3\.135\.113\.197|7\.13\.154\.155)|2(?:1\.2(?:3(?:2\.247\.27|8\.21\.251|4\.24\.46)|14\.208\.226)|2\.(?:106\.216\.100|200\.182\.65|99\.202\.239)|0\.(?:164\.162\.22|67\.90\.31))|0(?:2\.(?:1(?:94\.119\.69|79\.0\.88)|234\.40\.41)|3\.23(?:0\.112\.44|9\.45\.202)|5\.164\.26\.36))|9(?:1\.218\.(?:115\.(?:1(?:7[012356789]|8[012345678]|3[3456]|6\d|09|10)|54)|24(?:5\.(?:[456789]|2\d?|1\d|30?)|4\.4))|4\.(?:232\.184\.67|77\.199\.148)|3\.90\.102\.194)|6(?:1\.(?:1(?:06\.235\.18[09]|63\.101\.42|41\.21\.34)|3(?:8\.186\.117|5\.92\.92))|0\.(?:190\.92\.234|29\.104\.197)|6\.35\.85\.46)|5(?:9\.(?:4\.113\.116|15\.76\.97)|8\.151\.171\.114|0\.193\.157\.62)|8(?:1\.(?:92\.126\.40|80\.52\.1)|9\.218\.255\.194|5\.185\.112\.8)|4(?:6\.1(?:91\.237\.118|82\.92\.6)|1\.(?:137\.24\.4|63\.166\.3))|7(?:(?:7\.106\.232\.1|8\.29\.4\.)78|4\.91\.31\.2(?:29|30))
|3(?:7\.(?:157\.196\.54|48\.66\.20)|8\.89\.160\.133))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.(?:22\.(?:1(?:97\.216|52\.8)|53\.(?:190?|201))|82\.1(?:7(?:1\.234|9\.117|2\.62)|23\.85)|1(?:07\.159\.15|54\.91\.24)4)|5\.2(?:5\.1(?:49\.236|50\.212)|4\.232\.(?:193|206))|7\.162\.253\.250|3\.106\.150\.78|2\.172\.22\.57)|1(?:2\.(?:216\.(?:20\.50|76\.74|8\.158)|17(?:3\.175\.13|1\.126\.9)3)|6\.(?:255\.241\.111|112\.66\.102)|8\.(?:244\.239\.2|97\.186\.94)|5\.248\.188\.149|0\.45\.144\.163|9\.201\.16\.211|3\.199\.80\.47|4\.247\.23\.66)|9(?:8\.(?:143\.1(?:50\.2(?:4[0789]|5[012]|39)|28\.144)|246\.46\.27)|(?:3\.109\.69\.14|4\.105\.9\.8)5|2\.208\.185\.(?:178|211)|0\.107\.140\.76|9\.204\.45\.181)|2(?:5\.(?:(?:141\.142\.22|88\.123\.24)4|93\.77\.125)|1\.1(?:3(?:4\.238\.129|7\.91\.42)|59\.11\.164)|4\.(?:54\.230\.123|160\.35\.2)|3\.200\.28\.77)|73\.2(?:08\.(?:186\.8[3456]|215\.164)|12\.205\.158)|01\.9\.206\.207|\.209\.242\.218)|2(?:1(?:1\.(?:2(?:3(?:3\.(?:64\.110|71\.76)|2\.138\.171)|18\.27\.11[02])|1(?:69\.224\.17|72\.246\.78))|2\.(?:146
\.101\.154|220\.9\.235)|9\.(?:238\.181\.120|147\.172\.2)|3\.135\.113\.197|6\.107\.159\.92|7\.13\.154\.155|8\.38\.29\.68)|2(?:1\.2(?:3(?:2\.247\.27|8\.21\.251)|14\.2(?:08\.226|14\.187))|2\.(?:106\.216\.100|200\.182\.65|99\.202\.239)|0\.(?:164\.162\.22|67\.90\.31))|0(?:2\.(?:1(?:94\.119\.69|79\.0\.88)|234\.40\.41)|3\.230\.112\.4[45]|5\.164\.26\.36)|3\.238\.207\.130)|9(?:1\.218\.(?:115\.(?:1(?:8[012345678]|3[3456]|[67]\d|09|10)|54)|24(?:5\.(?:[456789]|1[013456789]|2\d?|30?)|4\.4))|3\.(?:115\.85\.22[6789]|90\.102\.194)|4\.(?:232\.184\.67|77\.199\.148))|6(?:1\.(?:1(?:06\.235\.18[09]|63\.101\.42)|3(?:8\.186\.117|5\.92\.92)|43\.97\.132|98\.77\.169)|0\.(?:190\.92\.234|29\.104\.197))|8(?:(?:3\.150\.92\.2|5\.185\.112\.)8|1\.(?:92\.126\.40|80\.52\.1)|9\.218\.255\.194|4\.203\.244\.50)|3(?:7\.(?:157\.196\.54|48\.66\.20)|1\.192\.111\.(?:6[89]|7[01])|8\.89\.160\.133)|7(?:(?:7\.106\.232\.1|8\.29\.4\.)78|4\.91\.31\.2(?:29|30)|6\.72\.246\.166)|5(?:8\.151\.171\.114|0\.193\.157\.62|9\.15\.76\.97)|41\.(
?:137\.24\.4|63\.166\.3))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work