You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/06/07 08:57:18 UTC
svn commit: r1490522 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Fri Jun 7 06:57:17 2013
New Revision: 1490522
URL: http://svn.apache.org/r1490522
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1490522&r1=1490521&r2=1490522&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Fri Jun 7 06:57:17 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20130662
+## khop-sc-neighbors.cf v 20130672
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -20,7 +20,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|95|2)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:9[35]|117|2)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -39,7 +39,7 @@ score KHOP_SC_CIDR8 0.3 0.1 0.3 0.1
# 12.1449/0.0139 0.999 20100410 net, solo=12.1966/0.0197@0.998, ->.2 .1 .3 .2
# 10.3554/0.0112 0.999 20110227@510k solo=10.3717/0.0119@0.999, ->.3 .1 .3 .1
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|90)|37|93)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|86|90)|37)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -92,7 +92,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:0\.(?:128\.2|28\.8)|1\.54\.54)|03\.(?:30\.72|9\.158)|80\.211\.179|16\.112\.66|74\.36\.167)|2(?:11\.140\.12|22\.174\.15)5|8(?:2\.207\.51|3\.111\.92)|5\.39\.220)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:4\.36\.167|8\.20\.148)|2(?:1\.54\.54|0\.28\.8)|03\.(?:30\.72|9\.158)|80\.211\.179|16\.112\.66)|2(?:11\.140\.12|22\.174\.15)5|8(?:2\.207\.51|3\.111\.92)|5\.39\.220)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -111,7 +111,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.132\.241|0\.21\.225|7\.198\.3)|08\.(?:71\.172|82\.114))|1(?:12\.9(?:7\.3[6789]|0\.90)|51\.84\.131|78\.20\.148|20\.84\.13)|6(?:6\.199\.224|5\.60\.15))\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.132\.241|0\.21\.225|7\.198\.3)|08\.(?:71\.172|82\.114))|1(?:12\.9(?:7\.3[6789]|0\.90)|20\.(?:128\.2|84\.13)|51\.84\.131)|6(?:6\.199\.224|5\.60\.15))\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -129,7 +129,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:1(?:68\.218\.86|86\.46\.107)|90\.90\.(?:5[01]|4\d)|216\.45\.114)|(?:0\.165\.125\.15|1\.68\.104\.13|6\.112\.66\.10)2|5\.(?:88\.119\.132|22\.80\.197|90\.96\.85)|9\.1(?:84\.214\.18|93\.93\.25)|7\.2(?:11\.91\.147|0\.3\.231)|8\.114\.77\.116|3\.31\.42\.30)|8(?:8\.(?:1(?:27\.230\.28|68\.46\.53)|64\.184\.136|252\.0\.237)|4\.82\.(?:1(?:5(?:9\.237|4\.51)|20\.235)|29\.3[34])|0\.2(?:25\.131\.176|11\.179\.30)|3\.101\.220\.202)|7(?:8\.(?:1(?:48\.210\.173|51\.86\.1)|2(?:11\.46\.189|0\.148\.11))|3\.(?:44\.(?:144\.148|244\.20)|192\.144\.105|212\.222\.69)|4\.36\.167\.116|7\.1\.223\.73)|9(?:5\.1(?:38\.195\.125|91\.184\.82)|(?:0\.82\.89\.15|4\.106\.16\.)6|9\.(?:255\.11\.29|83\.93\.18)|3\.193\.68\.2)|0(?:3\.9\.15(?:7\.181|8\.165|6\.89)|9\.(?:236\.87\.176|75\.166\.29)|8\.61\.55\.16[79])|2(?:1\.(?:1(?:81\.2(?:37\.251|51\.188)|34\.238\.129)|22\.127\.17)|0\.28\.8\.194)|5(?:1\.84\.131\.107|8\.255\.2\.66)|33\.242\.115\.44|\.226\.84\.175)|
2(?:1(?:3\.(?:2(?:30\.128\.226|51\.186\.229)|1(?:71\.39\.154|32\.241\.7)|0\.89\.6)|8\.(?:1(?:5(?:3\.247\.68|8\.3\.1)|06\.182\.6)|(?:249\.161\.3|56\.161\.1)4)|0\.(?:5(?:1\.44\.199|6\.23\.100)|13\.210\.82|245\.89\.69|93\.48\.211)|1\.(?:14(?:0\.125\.197|7\.211\.16)|2(?:06\.133\.94|22\.53\.83))|2\.(?:251\.120\.212|6\.152\.211|48\.65\.54)|7\.(?:219\.123\.59|198\.3\.238)|6\.153\.136\.125|9\.139\.38\.49)|0(?:8\.(?:82\.114\.(?:5[13579]|4[457])|71\.172\.(?:9[1234]|8[479])|113\.254\.39)|2\.(?:1(?:42\.203\.19|58\.39\.250)|29\.238\.196|71\.136\.200)|0\.(?:(?:142\.133\.2|94\.77\.)1|7(?:2\.11\.132|9\.27\.60))|3\.(?:(?:93\.108\.14|155\.102\.)2|255\.15\.146)|1\.(?:217\.154\.74|45\.114\.3)|9\.190\.73\.155)|2(?:1\.(?:2(?:07\.220\.140|14\.208\.226|31\.135\.149)|1(?:94\.128\.223|32\.35\.7))|2\.(?:174\.155\.19|236\.16\.14)|0\.94\.235\.200)|4\.127\.201\.172)|8(?:(?:1\.(?:15\.172\.14|23\.106\.7)|0\.(?:36\.130\.13|70\.2\.18))5|9\.(?:207\.1(?:29\.(?:39|74)|30\.34)|32\.226\.102)|3\.(?:111\.92\.120|23
8\.208\.55|3\.103\.227)|4\.(?:235\.57\.122|54\.161\.225)|2\.2(?:21\.102\.245|07\.51\.92)|7\.236\.232\.231)|6(?:1\.1(?:05\.174\.[46]|33\.125\.162|64\.42\.158)|4\.(?:120\.(?:170\.13|225\.15)8|71\.130\.190)|6\.199\.224\.(?:2[1345689]|17|30)|(?:2\.13\.171\.4|5\.60\.15\.18)6|3\.141\.227\.24[35]|0\.29\.75\.142|8\.115\.192\.7)|5(?:\.(?:39\.220\.2(?:4[28]|28|34)|159\.229\.2(?:4[47]|53))|8\.2(?:1(?:1\.138\.27|3\.157\.68)|40\.65\.66)|9\.60\.7\.146)|9(?:1\.21(?:1\.127\.125|2\.124\.153)|2\.(?:253\.123\.95|51\.109\.182)|3\.188\.8\.67|5\.48\.24\.10)|7(?:2\.(?:(?:35\.20\.13|42\.224\.2)1|55\.188\.73)|4\.9\.203\.186)|4(?:6\.32\.234\.168|1\.65\.74\.66)|37\.(?:206\.210\.13|122\.208\.9)0)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:21(?:6\.(?:45\.114|55\.162|30\.50)|7\.161\.3)|1(?:68\.218\.86|86\.46\.107)|90\.90\.(?:5[01]|4\d))|(?:0\.165\.125\.15|1\.68\.104\.13|6\.112\.66\.10)2|8\.(?:114\.77\.116|97\.196\.163)|5\.(?:88\.119\.132|22\.80\.197)|9\.1(?:84\.214\.18|93\.93\.25)|7\.2(?:11\.91\.147|0\.3\.231)|3\.(?:0\.85\.249|31\.42\.30))|8(?:8\.(?:1(?:27\.230\.28|68\.46\.53)|252\.0\.237)|0\.2(?:25\.131\.176|11\.179\.30)|4\.82\.(?:29\.3[34]|154\.51)|3\.106\.116\.109|1\.65\.236\.250)|7(?:8\.(?:1(?:48\.210\.173|51\.86\.1)|20\.148\.11)|3\.(?:192\.144\.105|212\.222\.69|44\.244\.20)|7\.1\.223\.(?:10|7)3|4\.36\.167\.116)|9(?:5\.1(?:38\.195\.125|91\.184\.82)|(?:0\.82\.89\.15|4\.106\.16\.)6|9\.(?:255\.11\.29|83\.93\.18)|3\.193\.68\.2)|0(?:3\.9\.15(?:7\.181|8\.165|6\.89)|9\.(?:236\.87\.176|75\.166\.29)|8\.61\.55\.16[79])|2(?:1\.(?:1(?:81\.2(?:37\.251|51\.188)|34\.238\.129)|22\.127\.17)|0\.28\.8\.194)|5(?:8\.255\.2\.6[46]|1\.84\.131\.107)|33\.242\.115\.44|\
.226\.84\.175)|2(?:1(?:3\.(?:2(?:30\.128\.226|51\.186\.229)|1(?:71\.39\.154|32\.241\.7)|0\.89\.6)|8\.(?:1(?:5(?:3\.247\.68|8\.3\.1)|06\.182\.6)|(?:249\.161\.3|56\.161\.1)4)|0\.(?:5(?:1\.44\.199|6\.23\.100)|13\.210\.82|245\.89\.69|93\.48\.211)|1\.(?:1(?:4(?:0\.125\.197|7\.211\.16)|76\.61\.112)|206\.133\.94)|2\.(?:251\.120\.212|6\.152\.211|48\.65\.54)|7\.(?:219\.123\.59|198\.3\.238)|9\.(?:68\.209\.240|139\.38\.49)|6\.153\.136\.125)|0(?:8\.(?:71\.172\.(?:8[46789]|9[1234])|82\.114\.(?:5[13579]|4[457])|113\.254\.39)|0\.(?:14(?:8\.125\.247|2\.133\.21)|7(?:2\.11\.132|9\.27\.60)|94\.77\.1)|2\.(?:1(?:42\.203\.19|58\.39\.250)|29\.238\.196|71\.136\.200)|3\.(?:255\.15\.146|93\.108\.142)|1\.(?:217\.154\.74|45\.114\.3)|9\.190\.73\.155)|2(?:1\.(?:2(?:07\.220\.140|14\.208\.226|31\.135\.149)|1(?:94\.128\.223|32\.35\.7))|2\.(?:174\.155\.19|236\.16\.14)|0\.94\.235\.200)|4\.127\.201\.172)|6(?:1\.(?:1(?:05\.174\.[46]|33\.125\.162|64\.42\.158)|252\.138\.195|32\.38\.3)|4\.(?:120\.(?:170\.13|225\.1
5)8|71\.130\.190)|6\.199\.22(?:4\.(?:2[1345689]?|30)|7\.198)|(?:2\.13\.171\.4|5\.60\.15\.18)6|3\.141\.227\.24[56]|0\.29\.75\.142|8\.115\.192\.7)|8(?:3\.(?:111\.92\.120|238\.208\.55|3\.103\.227)|(?:1\.15\.172\.14|0\.70\.2\.18)5|4\.(?:235\.57\.122|54\.161\.225)|9\.(?:207\.130\.34|32\.226\.102)|2\.2(?:21\.102\.245|07\.51\.92)|7\.236\.232\.231|6\.64\.171\.198)|9(?:1\.21(?:1\.127\.125|2\.124\.153)|2\.(?:253\.123\.95|51\.109\.182)|3\.188\.8\.67|5\.48\.24\.10)|5(?:8\.2(?:1(?:1\.138\.27|3\.157\.68)|40\.65\.66)|\.39\.220\.2(?:28|34|42)|9\.60\.7\.146)|7(?:2\.(?:35\.20\.131|55\.188\.73)|4\.9\.203\.186)|4(?:6\.32\.234\.168|1\.65\.74\.66)|37\.(?:206\.210\.13|122\.208\.9)0)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work