You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/12/31 08:57:33 UTC
svn commit: r1554383 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Tue Dec 31 07:57:32 2013
New Revision: 1554383
URL: http://svn.apache.org/r1554383
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1554383&r1=1554382&r2=1554383&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Tue Dec 31 07:57:32 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201312302
+## khop-sc-neighbors.cf v 201312312
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|46|5)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:8[68]|17)|5)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -81,7 +81,7 @@ score KHOP_SC_CIDR16 0.4 0.1 0.4 0.1
# crap, still empty 20130629@465k net
# crap, still empty 20130705@376k net. lowering for low vol -> .4 .1 .4 .1
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:188\.34|89\.137|94\.96)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:90\.(?:192|247)|88\.34)|9(?:2\.84|4\.96)|89\.137)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0.3
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:15\.8(?:8\.119|0\.40)|21\.54\.5[48]|80\.149\.96|01\.15\.30|78\.32\.92)|2(?:02\.2(?:9\.17[89]|34\.40)|17\.13\.154|20\.94\.235)|58\.254\.1(?:68|72))\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:1\.54\.5[48]|4\.95\.155)|8(?:0\.149\.96|9\.203\.69)|15\.88\.119|01\.15\.30|78\.32\.92)|2(?:02\.234\.40|19\.140\.69|20\.94\.235)|58\.254\.168|88\.196\.63)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:(?:1\.17\.12|4\.95\.15)5|5\.60\.156|0\.84\.13)|9(?:8\.143\.1(?:32|50)|0\.234\.10[56])|1(?:2\.72\.13|5\.80\.46)|0(?:1\.50\.12|3\.20\.8)|81\.66\.15[67]|57\.250\.132|75\.96\.176)|2(?:13\.135\.113|22\.100\.234)|80\.193\.214|31\.14\.23|41\.254\.5|70\.98\.78)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:8\.143\.1(?:32|50)|0\.234\.10[56])|2(?:1\.17\.125|5\.60\.156|0\.84\.13)|0(?:3\.2(?:43\.153|0\.8)|1\.50\.12)|1(?:2\.72\.13|5\.80\.46)|81\.66\.15[67]|57\.250\.132|75\.96\.176)|2(?:1(?:3\.135\.113|7\.13\.154)|22\.100\.234)|80\.193\.214|31\.14\.23|41\.254\.5|70\.98\.78)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:1(?:63\.156\.109|29\.166\.86|42\.19\.172)|97\.(?:196\.163|95\.185)|244\.128\.178|69\.205\.202|46\.127\.36)|2\.(?:2(?:16\.(?:(?:105\.9|30\.5)0|48\.252)|20\.(?:31\.133|67\.130))|184\.172\.244)|5\.(?:8(?:0\.4(?:6\.190|0\.38)|8\.119\.132)|68\.15\.73)|(?:0\.189\.168\.17|7\.102\.101\.21)1|4\.(?:141\.253\.14|247\.23\.66)|9\.42\.147\.114)|2(?:1\.(?:1(?:5(?:1\.122\.45|8\.198\.78)|7\.125\.(?:1[234567]|20))|78\.119\.193)|4\.95\.155\.(?:5[28]|27)|3\.140\.204\.252|2\.182\.28\.245|5\.131\.29\.100|0\.50\.86\.3)|9(?:8\.143\.1(?:50\.2(?:3[012456]|2[89]|5[02]|47)|32\.23[57]|28\.139)|0\.(?:(?:54\.13\.10|82\.89\.15)6|24\.134\.65)|4\.1(?:77\.40\.195|06\.16\.6)|5\.205\.237\.15)|8(?:4\.(?:82\.1(?:79\.117|23\.85)|22\.197\.216)|8\.(?:35\.136\.254|252\.0\.237)|3\.(?:181\.38\.90|98\.235\.12)|0\.149\.96\.1(?:69|70)|9\.112\.88\.65)|7(?:3\.2(?:08\.2(?:27\.(?:10|9)|15\.164)|12\.205\.158)|5\.96\.176\.204|8\.32\.92\.98)|0(?:1\.(?:15\.30\.58|79\.5\.19)|
6\.3\.32\.153)|(?:62\.242\.171\.15|31\.130\.69\.21)8|4(?:8\.223\.59\.140|\.63\.74\.204)|\.2(?:34\.38\.106|14\.41\.98))|2(?:0(?:2\.(?:1(?:(?:30\.114\.13|29\.216\.6|58\.39\.25)0|(?:42\.203\.1|94\.119\.6)9|18\.236\.178)|(?:85\.215\.24|53\.13\.18)7|2(?:07\.1\.234|34\.40\.41)|71\.136\.200)|0\.(?:1(?:11\.103\.68|75\.56\.190)|7(?:2\.11\.132|9\.27\.60)|47\.10\.209)|1\.(?:1(?:16\.199\.34|95\.239\.27)|77\.202\.68))|1(?:1\.(?:23(?:(?:7\.20\.3|\.152\.1)9|2\.92\.23)|54\.17\.20[01]|115\.89\.141)|0\.(?:183\.179\.38|51\.37\.162|61\.240\.21|0\.203\.76)|(?:(?:2\.144\.254|9\.140\.69)\.12|6\.191\.208\.20)2|3\.(?:1(?:35\.113\.197|71\.39\.154)|81\.164\.57)|8\.1(?:1\.167\.126|07\.4\.117)|7\.13\.154\.155)|2(?:2\.(?:1(?:0(?:0\.234\.251|9\.130\.95)|17\.219\.97)|7(?:3\.93\.153|8\.247\.67))|1\.2(?:14\.2(?:08\.226|14\.187)|32\.144\.164)|0\.(?:94\.235\.200|68\.224\.45))|3\.253\.52\.134|4\.157\.46\.197)|6(?:0\.(?:25(?:1\.31\.134|0\.218\.2)|196\.58\.189)|1\.(?:106\.235\.180|38\.186\.117)|9\.198\.197\.156|7\.90\.21
\.150)|8(?:3\.(?:18\.234\.202|238\.208\.55)|0\.193\.214\.226|2\.117\.194\.229|1\.211\.80\.22|5\.185\.112\.8|8\.196\.63\.25)|3(?:1\.14\.23\.(?:1(?:[78]|5[789]?|2?9|60?)|4[0235789]?|5[0156789]?|2[013]|6[02]|35)|7\.123\.98\.115)|9(?:(?:2\.50\.155\.21|4\.77\.199\.14)8|3\.18(?:4\.71\.66|8\.8\.67)|1\.247\.160\.10)|4(?:1\.(?:137\.(?:2[04]|56)\.4|63\.166\.3)|9\.(?:1\.224\.[79]|218\.40\.27))|7(?:7\.106\.232\.178|2\.35\.20\.131|4\.9\.203\.186)|59\.1(?:1\.98\.232|20\.76\.23|5\.76\.97))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:1(?:63\.156\.109|29\.166\.86|42\.19\.172)|97\.(?:196\.163|95\.185)|244\.128\.178|69\.205\.202|46\.127\.36)|2\.(?:2(?:16\.(?:(?:105\.9|30\.5)0|48\.252)|20\.67\.130)|184\.172\.244)|5\.(?:8(?:2\.244\.203|8\.119\.132|0\.46\.190)|68\.15\.73)|(?:0\.189\.168\.17|3\.161\.96\.21)1|4\.(?:141\.253\.14|247\.23\.66)|9\.42\.147\.114)|9(?:8\.143\.1(?:50\.2(?:3[012456]|2[89]|4[37]|5[02])|32\.23[57]|28\.139)|0\.(?:(?:54\.13\.10|82\.89\.15)6|24\.134\.65)|4\.1(?:77\.40\.195|06\.16\.6)|5\.2(?:05\.237\.15|9\.81\.30))|2(?:1\.(?:1(?:5(?:1\.122\.45|8\.198\.78)|7\.125\.(?:1[34567]|20))|78\.119\.193)|4\.95\.155\.(?:5[28]|27)|3\.140\.204\.252|2\.182\.28\.245|0\.50\.86\.3)|8(?:4\.(?:82\.1(?:79\.117|23\.85)|22\.197\.216)|3\.1(?:06\.1(?:45\.24|50\.78)|81\.38\.90)|8\.(?:35\.136\.254|252\.0\.237)|0\.149\.96\.1(?:69|70))|7(?:3\.2(?:08\.2(?:2(?:2\.(?:106|98)|7\.(?:10|9))|15\.164)|12\.205\.158)|5\.96\.176\.204|8\.32\.92\.98)|0(?:1\.(?:15\.30\.58|79\.5\.1
9)|6\.3\.32\.153)|(?:62\.242\.171\.15|31\.130\.69\.21)8|4(?:8\.223\.59\.140|\.63\.74\.204)|\.2(?:34\.38\.106|14\.41\.98))|2(?:1(?:1\.(?:23(?:2\.92\.23|\.152\.19)|54\.17\.20[01]|115\.89\.141)|0\.(?:183\.179\.38|51\.37\.162|61\.240\.21|0\.203\.76)|(?:(?:2\.144\.254|9\.140\.69)\.12|6\.191\.208\.20)2|3\.(?:1(?:35\.113\.197|71\.39\.154)|81\.164\.57)|8\.(?:11\.167\.126|234\.108\.13)|7\.13\.154\.155)|0(?:2\.(?:1(?:(?:30\.114\.13|29\.216\.6|58\.39\.25)0|(?:42\.203\.1|94\.119\.6)9|18\.236\.178)|2(?:07\.1\.234|34\.40\.41)|71\.136\.200|53\.13\.187)|0\.(?:1(?:11\.103\.68|75\.56\.190)|7(?:2\.11\.132|9\.27\.60)|47\.10\.209)|1\.(?:1(?:16\.199\.34|95\.239\.27)|77\.202\.68))|2(?:2\.(?:1(?:00\.234\.251|17\.219\.97)|7(?:3\.93\.153|8\.247\.67))|1\.2(?:3(?:2\.144\.164|4\.24\.46)|14\.2(?:08\.226|14\.187))|0\.(?:94\.235\.200|68\.224\.45))|3\.253\.52\.134|4\.157\.46\.197)|9(?:3\.1(?:8(?:4\.71\.66|8\.8\.67)|57\.148\.102)|1\.2(?:18\.115\.13[023]|47\.160\.10)|(?:2\.50\.155\.21|4\.77\.199\.14)8|5\.211\.135\.83
)|6(?:0\.(?:25(?:1\.31\.134|0\.218\.2)|196\.58\.189)|1\.(?:106\.235\.180|38\.186\.117)|9\.198\.197\.156|5\.255\.80\.152|7\.90\.21\.150)|3(?:1\.14\.23\.(?:4[0235789]?|5[0156789]?|1[56789]|2[013]|6[02]|35)|6\.250\.228\.10[023]|7\.123\.98\.115)|8(?:3\.(?:18\.234\.202|238\.208\.55)|0\.193\.214\.226|2\.117\.194\.229|1\.211\.80\.22|8\.196\.63\.25)|4(?:1\.(?:137\.(?:2[04]|56)\.4|63\.166\.3)|9\.1\.224\.7)|7(?:7\.106\.232\.178|2\.35\.20\.131|4\.9\.203\.186)|59\.1(?:1\.98\.232|20\.76\.23|5\.76\.97))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work