You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2014/01/10 08:57:43 UTC
svn commit: r1557049 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Fri Jan 10 07:57:43 2014
New Revision: 1557049
URL: http://svn.apache.org/r1557049
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1557049&r1=1557048&r2=1557049&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Fri Jan 10 07:57:43 2014
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20140192
+## khop-sc-neighbors.cf v 201401102
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:(?:98\.143\.12|83\.181\.3)8|73\.208\.(?:186|227)|63\.177\.132|21\.54\.54)|2(?:1(?:3\.135\.113|9\.140\.69)|0(?:2\.29\.178|6\.214\.87))|58\.25(?:1\.146|4\.172)|93\.119\.106|70\.98\.78)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:73\.208\.(?:186|227)|98\.143\.132|83\.181\.38|15\.80\.46|21\.54\.54)|2(?:06\.214\.87|19\.140\.69)|9(?:3\.119\.106|4\.242\.204)|58\.25(?:1\.146|4\.168)|70\.98\.78)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:8\.143\.1(?:32|50)|0\.234\.10[56])|(?:57\.250\.13|15\.82\.25|01\.50\.1)2|2(?:1\.17\.125|5\.60\.156|0\.84\.13)|8(?:1\.66\.15[67]|8\.73\.252)|62\.248\.79)|2(?:17\.(?:23\.12|8\.255)|22\.100\.234)|9(?:1\.218\.115|4\.20\.224)|46\.102\.186)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:8\.143\.1(?:28|50)|0\.234\.10[56])|2(?:1\.17\.125|5\.60\.156|0\.84\.13)|(?:57\.250\.13|15\.82\.25)2|6(?:3\.177\.132|2\.248\.79)|0(?:3\.243\.154|1\.50\.12)|81\.66\.15[67])|2(?:22\.100\.234|17\.8\.255)|9(?:1\.218\.115|4\.20\.224)|46\.102\.186)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:9\.(?:1(?:9(?:3\.(?:80\.21|93\.2)5|4\.153\.187)|10\.108\.92)|201\.1(?:41\.8|6\.21)1|42\.147\.114|82\.240\.62)|2\.(?:1(?:84\.172\.244|68\.218\.86)|2(?:16\.55\.16|20\.31\.13)2)|4\.(?:(?:247\.23\.6|4\.44\.20)6|141\.253\.14|32\.177\.77)|5\.8(?:2\.252\.220|8\.119\.132|0\.46\.233)|(?:6\.193\.90\.2|8\.46\.127\.3)6|0\.189\.168\.171|1\.207\.146\.125)|2(?:1\.(?:1(?:3(?:4\.238\.129|9\.233\.90|7\.91\.42)|5(?:8\.198\.78|9\.11\.164)|81\.2(?:37\.251|52\.228)|7\.125\.(?:1[34567]|20))|88\.54\.17)|2\.(?:1(?:82\.28\.245|55\.0\.44)|49\.119\.188)|(?:3\.231\.255\.20|4\.160\.35\.)2|5\.88\.123\.244)|9(?:8\.143\.1(?:50\.2(?:[35][02]|4[06]|29)|32\.23[57]|28\.136)|5\.(?:20(?:0\.171\.162|5\.237\.15)|64\.154\.102)|0\.(?:(?:107\.140\.7|54\.13\.10)6|8\.44\.77)|4\.1(?:77\.40\.195|06\.16\.6)|3\.109\.87\.251|9\.204\.46\.179)|73\.2(?:08\.(?:2(?:2(?:7\.(?:11|9)|2\.108)|15\.164)|186\.8[36])|12\.205\.158)|8(?:4\.(?:22\.197\.216|82\.179\.117)|3\.(?:181\.38\.90|98\
.235\.12))|6(?:2\.248\.79\.(?:[2345689]|1[012345678])|3\.177\.132\.4[012])|4(?:8\.223\.59\.140|\.63\.74\.204)|0(?:6\.3\.32\.153|1\.79\.5\.19))|2(?:1(?:(?:9\.14(?:0\.69\.12|7\.172\.)|6\.191\.208\.20)2|0\.(?:183\.179\.3[89]|0\.203\.76)|1\.(?:169\.224\.17|232\.183\.58)|3\.(?:135\.113\.197|0\.39\.130)|7\.8\.255\.194|8\.38\.29\.68)|0(?:2\.(?:1(?:18\.236\.178|42\.203\.19|96\.96\.55)|2(?:07\.1\.234|34\.40\.41)|82\.202\.228|53\.13\.187|65\.220\.35|71\.98\.62)|0\.7(?:2\.11\.132|9\.27\.60)|1\.116\.199\.34)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|04\.223\.38)|165\.38\.226)|0\.(?:130\.142\.42|94\.235\.200)|2\.100\.234\.251|3\.25\.242\.104)|3\.88\.105\.11)|8(?:3\.(?:2(?:20\.51\.237|38\.208\.55)|18\.234\.202)|5\.1(?:85\.(?:244\.101|112\.8)|7\.80\.222)|8\.(?:255\.229\.10|196\.63\.25)|0\.187\.10(?:0\.102|9\.147)|9\.207\.128\.165|1\.192\.48\.162|2\.146\.33\.216|7\.226\.224\.34|6\.64\.142\.28)|9(?:1\.218\.115\.(?:1(?:6[23589]|8[6789]|9[289])|200)|4\.(?:242\.204\.16[46]|77\.199\.148)|3\.1(?:57\.148\.10
2|88\.8\.67)|5\.211\.135\.83)|4(?:6\.102\.186\.(?:1(?:9[012356789]|8[3489])|20[123456])|1\.(?:137\.24\.4|63\.166\.3)|9\.1\.224\.9)|7(?:(?:8\.47\.149\.10|1\.0\.121\.21)3|7\.106\.232\.178|0\.50\.252\.70|2\.35\.20\.131)|6(?:9\.198\.197\.156|0\.190\.92\.234|1\.19\.246\.93|7\.90\.21\.150)|5(?:8\.12(?:0\.225\.155|6\.157\.18)|9\.11\.98\.232|\.9\.131\.20)|37\.48\.66\.8)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:9\.(?:1(?:9(?:3\.(?:80\.21|93\.2)5|4\.153\.187)|10\.108\.92)|201\.141\.81|82\.240\.62)|2\.(?:2(?:16\.(?:105\.9|30\.5)0|20\.31\.132)|1(?:84\.172\.244|68\.218\.86))|8\.(?:1(?:63\.(?:156\.109|51\.66)|29\.166\.86)|46\.127\.36)|4\.(?:(?:247\.23\.6|4\.44\.20)6|141\.253\.14|32\.177\.77)|5\.8(?:2\.252\.220|8\.119\.132|0\.46\.233)|0\.1(?:70\.190\.194|89\.168\.171)|1\.207\.146\.125|6\.193\.90\.26|7\.6\.87\.29)|2(?:1\.(?:1(?:3(?:4\.238\.129|9\.233\.90|7\.91\.42)|5(?:8\.198\.78|9\.11\.164)|81\.2(?:37\.251|52\.228)|7\.125\.(?:1[34567]|20))|88\.54\.17)|(?:3\.231\.255\.20|4\.160\.35\.)2|5\.(?:131\.29\.100|88\.123\.244)|2\.49\.119\.188)|9(?:8\.143\.1(?:50\.2(?:3[02]|4[06]|29|52)|28\.136|32\.235)|5\.(?:20(?:0\.171\.162|5\.237\.15)|64\.154\.102)|0\.(?:1(?:10\.208\.23|07\.140\.7)6|8\.44\.77)|4\.1(?:77\.40\.195|06\.16\.6)|3\.109\.87\.251|9\.204\.46\.179)|8(?:4\.(?:22\.197\.216|82\.179\.117)|3\.(?:181\.38\.90|98\.235\.12)|0\.149\.96\.170)|73\.2(?
:08\.(?:22(?:7\.(?:[89]|11)|2\.108)|186\.8[36])|12\.205\.158)|0(?:6\.(?:240\.240\.106|3\.32\.153)|1\.79\.5\.19)|62\.248\.79\.(?:[2345689]|1[012345678])|4(?:8\.223\.59\.140|\.63\.74\.204)|\.85\.17\.82)|2(?:1(?:(?:9\.14(?:0\.69\.12|7\.172\.)|6\.191\.208\.20)2|0\.(?:183\.179\.(?:3[89]|45)|211\.125\.13)|1\.(?:169\.224\.17|232\.183\.58)|3\.(?:135\.113\.197|0\.39\.130)|7\.(?:130\.26\.66|8\.255\.194)|8\.38\.29\.68)|0(?:2\.(?:1(?:9(?:4\.119\.69|6\.96\.55)|18\.236\.178)|2(?:07\.1\.234|34\.40\.41)|82\.202\.228|65\.220\.35|71\.98\.62)|0\.(?:47\.10\.209|79\.27\.60)|1\.116\.199\.34)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|04\.223\.38|34\.24\.46)|165\.38\.226)|2\.100\.234\.251|0\.94\.235\.200|3\.25\.242\.104)|3\.(?:254\.134\.222|88\.105\.11))|8(?:5\.1(?:85\.(?:244\.101|112\.8)|7\.80\.222)|3\.2(?:20\.51\.237|38\.208\.55)|8\.(?:255\.229\.10|196\.63\.25)|0\.187\.10(?:0\.102|9\.147)|2\.146\.33\.216|7\.226\.224\.34|6\.64\.142\.28)|9(?:1\.218\.115\.(?:1(?:8[6789]|6[589]|9[289]|35)|200)|4\.(?:242\.204\.1
6[34]|77\.199\.148)|3\.157\.148\.102|5\.211\.135\.83)|4(?:6\.102\.186\.(?:1(?:9[012356789]|8[89])|2(?:0[123456]|1[23]))|1\.(?:137\.(?:24\.4|0\.2)|63\.166\.3)|9\.1\.224\.9)|7(?:8\.(?:38\.109\.210|47\.149\.103)|7\.106\.232\.178|1\.0\.121\.213|2\.35\.20\.131)|6(?:0\.(?:190\.92\.2|251\.31\.1)34|9\.198\.197\.156|1\.19\.246\.93|7\.90\.21\.150)|5(?:8\.12(?:0\.225\.155|6\.157\.18)|9\.11\.98\.232|\.9\.131\.20)|37\.48\.66\.8)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:(?:12|8)[4567]|7[014589]?|[46][89]?|5[01]?)|6\.207\.(?:6[0123]|1[24]|4[89]|5\d)|2\.(?:215\.(?:6[34]|44)|72\.13)|3\.56\.2(?:4[89]|5[01])|9\.36\.21[23])|8(?:6\.(?:1(?:3\.[012356]|22\.4[567])|251\.14[123]|37\.203)|3\.9(?:3\.(?:1[12][45]|9[89])|5\.6[67])|1\.66\.15[67]|0\.255\.248|8\.73\.252)|2(?:(?:3\.136\.10|5\.60\.15)6|2\.155\.34|1\.54\.58)|9(?:0\.234\.10[56]|7\.252\.[01]|8\.50\.188)|0(?:9\.127\.8[06]|3\.240\.117)|30\.193\.1(?:47|65)|77\.36\.22)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|1(?:1\.91\.22[01]|2\.34\.12)|0(?:3\.191\.26|6\.214\.87)|3\.226\.18[45]|4\.244\.23)|58\.(?:5(?:0\.(?:1(?:[2345]|0[456789]|1\d)|68)|4\.18[4567])|19\.19[01])|41\.2(?:54\.[2568]|23\.162)|7(?:9\.106\.109|0\.98\.78)|88\.217\.18[01])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:(?:12|8)[4567]|7[589]?|4[89]?|5[01]?|6)|6\.207\.(?:6[0123]|1[24]|4[89]|5\d)|3\.56\.2(?:4[89]|5[01])|2\.215\.(?:6[34]|44)|9\.36\.21[23])|8(?:6\.(?:1(?:3\.[012356]|22\.4[567])|251\.14[123]|37\.203)|3\.9(?:3\.(?:1[12][45]|9[89])|5\.6[67])|1\.66\.15[67]|0\.255\.248|8\.73\.252)|2(?:(?:3\.136\.10|5\.60\.15)6|2\.155\.34|1\.54\.58)|9(?:0\.234\.10[56]|7\.252\.[01]|8\.50\.188)|0(?:9\.127\.8[06]|3\.240\.117)|77\.(?:137\.19|36\.22)|30\.193\.1(?:47|65))|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.19(?:4\.115|1\.26)|6\.214\.87)|11\.91\.22[01]|3\.226\.18[45]|4\.244\.23)|58\.(?:5(?:0\.1(?:[2345]|0[456789]|1\d)|4\.18[4567])|19\.19[01])|41\.2(?:54\.[2568]|23\.162)|7(?:9\.106\.109|0\.98\.78)|88\.217\.18[01])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6