You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2014/04/11 08:58:03 UTC
svn commit: r1586586 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Fri Apr 11 06:58:03 2014
New Revision: 1586586
URL: http://svn.apache.org/r1586586
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1586586&r1=1586585&r2=1586586&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Fri Apr 11 06:58:03 2014
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201404102
+## khop-sc-neighbors.cf v 201404112
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:(?:3\.182\.3|4\.82\.17)9|0\.222\.124)|2(?:4\.156\.251|2\.13\.132)|79\.197\.186|01\.9\.205|94\.105\.9)|21(?:0\.217\.150|3\.252\.247)|63\.247\.82|72\.22\.74)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:0\.222\.124|9\.105\.238|3\.182\.39)|2(?:4\.156\.251|2\.13\.132|3\.64\.199)|01\.14\.253)|21(?:0\.(?:183\.179|217\.150)|3\.252\.247|7\.108\.148)|63\.247\.82)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:03\.2(?:5(?:\.14[56]|0\.0)|25\.80)|8(?:0\.222\.12[123]|4\.82\.171)|98\.143\.1(?:28|50)|57\.250\.149|77\.179\.62|17\.19\.74|20\.84\.13)|2(?:1(?:3\.(?:252\.247|148\.5)|2\.146\.101|7\.108\.148)|02\.62\.16|7\.123\.24)|46\.166\.179|5\.172\.248|94\.20\.224)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:03\.2(?:5(?:\.14[56]|0\.0)|25\.80)|8(?:0\.222\.12[123]|4\.82\.17[19])|9(?:8\.143\.1(?:28|50)|4\.105\.9)|77\.179\.62|17\.19\.74|20\.84\.13)|2(?:1(?:2\.146\.101|3\.252\.247)|02\.62\.16|7\.123\.24)|46\.166\.179|5\.172\.248|94\.20\.224)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:2(?:16\.(?:(?:105\.9|20\.5)0|8\.158)|20\.224\.59)|1(?:63\.149\.29|24\.27\.12))|0\.(?:170\.190\.194|34\.231\.188|87\.218\.206|45\.140\.79)|(?:6\.112\.66\.10|7\.19\.74\.7)2|9\.(?:201\.16\.211|82\.224\.242)|5\.(?:88\.119\.132|95\.101\.66)|8\.4(?:6\.127\.36|1\.157\.7)|3\.130\.65\.161)|8(?:4\.(?:82\.1(?:7(?:1\.234|9\.117)|30\.235|69\.114)|22\.66\.138)|0\.2(?:04\.194\.143|50\.181\.70)|9\.1(?:05\.238\.126|12\.88\.65)|7\.14\.138\.142|2\.172\.22\.59|3\.35\.209\.11|5\.12\.14\.247|8\.64\.185\.64)|2(?:1\.(?:1(?:8(?:1\.252\.228|6\.153\.33|9\.62\.186)|34\.238\.129)|78\.1(?:1(?:2\.3|6\.7)7|44\.158))|3\.(?:64\.199\.2(?:1[89]|[23]6)|200\.28\.77)|(?:2\.224\.104\.15|5\.141\.199\.24)5|4\.156\.251\.122)|9(?:8\.1(?:43\.(?:1(?:50\.2(?:4[12345789]|5[012]|38)|28\.1(?:3[29]|44)|\.237)|2\.184)|5\.73\.5[59])|5\.(?:138\.65\.113|230\.113\.7)|2\.227\.182\.207|3\.238\.111\.26|4\.105\.9\.85|7\.253\.6\.68)|7(?:(?:3\.21(?:2\.205\.15|3\.80\.3)|8\.19\.109\
.22)8|7\.179\.(?:121\.77|62\.35)|9\.197\.186\.(?:199|63)|4\.137\.132\.164)|0(?:(?:6\.245\.250|9\.201\.138)\.6|3\.2(?:5\.146\.125|1\.41\.84)|7\.150\.41\.11|1\.9\.205\.39)|\.(?:2(?:09\.242\.218|26\.84\.175)|11\.66\.70|85\.17\.82)|6(?:2\.2(?:16\.227\.1|48\.101\.)17|8\.62\.203\.221)|4(?:8\.235\.147\.69|\.220\.59\.63)|58\.255\.2\.160)|2(?:1(?:0\.(?:21(?:7\.150\.19[56]|9\.203\.226)|183\.179\.(?:3[89]|44))|1\.(?:23(?:3\.64\.110|\.152\.19)|174\.178\.177)|8\.(?:147\.191\.179|202\.219\.75|85\.252\.186)|(?:2\.146\.101\.15|3\.148\.5\.24)4|7\.1(?:08\.148\.77|47\.92\.16)|6\.168\.137\.80|9\.147\.172\.2)|2(?:2\.(?:1(?:17\.219\.97|86\.43\.105)|201\.132\.28)|0\.(?:160\.24(?:7\.130|0\.95)|67\.90\.31)|1\.214\.208\.226)|7\.1(?:5(?:0\.160\.134|1\.127\.13|7\.251\.8)|23\.24\.2(?:3[27]|27))|3\.(?:94\.10(?:1\.(?:73|95)|4\.81)|228\.64\.(?:3[789]|40))|0(?:(?:0\.52\.182\.23|4\.68\.120\.15)6|2\.234\.40\.41))|6(?:3\.247\.82\.(?:19[4569]|20[2456])|2\.(?:113\.242\.253|75\.207\.4)|1\.106\.2(?:35\.180|6\.226)|7\.209\
.228\.(?:9[01]|89)|5\.23\.156\.12[45]|0\.247\.27\.119|9\.46\.221\.50|4\.31\.52\.55)|7(?:(?:9\.180\.167\.19|2\.22\.74\.5)1|7\.(?:106\.232\.178|74\.50\.36)|8\.(?:36\.14\.195|29\.4\.78)|4\.204\.163\.148|0\.98\.79\.216)|9(?:3\.(?:90\.102\.194|184\.71\.66|57\.84\.18)|1\.(?:241\.187\.204|187\.213\.57)|2\.51\.109\.181|4\.41\.52\.65)|4(?:6\.1(?:66\.179\.(?:5[023579]|4[24567])|91\.237\.118)|1\.(?:137\.2[04]\.4|33\.169\.36))|8(?:5\.1(?:7\.132\.11[05]|85\.30\.163)|0\.241\.95\.218|3\.239\.83\.102|4\.40\.22\.99)|5(?:8\.(?:2(?:10\.206\.239|46\.179\.82)|151\.171\.114)|0\.30\.45\.223)|3(?:6\.39\.246\.33|7\.29\.108\.70))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:8\.1(?:43\.(?:1(?:50\.2(?:4[12345789]|5[012]|3[89])|28\.1(?:3[29]|44)|\.237)|2\.(?:184|222))|5\.(?:102\.(?:6[678]|70)|96\.22[789]|73\.5[59]))|5\.(?:138\.65\.113|230\.113\.7)|4\.1(?:58\.204\.250|05\.9\.85)|2\.227\.182\.207|3\.238\.111\.26|7\.253\.6\.68)|1(?:2\.(?:1(?:84\.172\.244|63\.149\.29|24\.27\.12)|2(?:16\.105\.90|20\.224\.59))|0\.(?:34\.231\.188|87\.218\.206|45\.140\.79)|(?:6\.112\.66\.10|7\.19\.74\.7)2|5\.(?:88\.119\.132|95\.101\.66)|8\.4(?:6\.127\.36|1\.157\.7)|3\.130\.65\.161)|2(?:1\.(?:1(?:8(?:1\.252\.228|6\.153\.33|9\.62\.186)|34\.238\.129)|78\.1(?:(?:26\.22|44\.15)8|1(?:2\.3|6\.7)7)|254\.172\.108)|3\.(?:64\.199\.2(?:1[89]|2[26]|36)|200\.28\.77)|(?:2\.224\.104\.15|5\.141\.199\.24)5|4\.156\.251\.122)|8(?:4\.(?:82\.1(?:7(?:1\.234|9\.117)|(?:30\.23|23\.8)5)|22\.(?:53\.190?|66\.138))|9\.1(?:05\.238\.126|12\.88\.65)|2\.1(?:62\.73\.193|72\.22\.59)|0\.250\.181\.70|3\.35\.209\.11|5\.12\.14\.247)|0(?:1\.(?:14\.253\.20|9\.205
\.39)|3\.2(?:5\.146\.125|1\.41\.84)|6\.245\.250\.6|7\.150\.41\.11)|7(?:3\.21(?:2\.205\.15|3\.80\.3)8|7\.179\.(?:121\.77|62\.35)|4\.137\.132\.164|9\.197\.186\.63)|\.(?:2(?:09\.242\.218|26\.84\.175)|11\.66\.70|85\.17\.82)|6(?:2\.2(?:16\.227\.1|48\.101\.)17|8\.62\.203\.221)|4(?:8\.235\.147\.69|\.220\.59\.63))|2(?:1(?:0\.(?:21(?:7\.150\.19[56]|9\.203\.226)|183\.179\.(?:3[89]|44))|8\.(?:147\.191\.179|202\.219\.75|85\.252\.186)|(?:2\.146\.101\.15|3\.148\.5\.24)4|1\.(?:53\.209\.117|23\.152\.19)|7\.1(?:08\.148\.77|47\.92\.16)|6\.168\.137\.80|9\.147\.172\.2)|2(?:0\.(?:6(?:8\.224\.45|7\.90\.31)|160\.24(?:7\.130|0\.95))|2\.(?:1(?:17\.219\.97|86\.43\.105)|201\.132\.28)|1\.214\.208\.226)|0(?:(?:0\.52\.182\.23|4\.68\.120\.15)6|3\.201\.172\.162|2\.234\.40\.41)|3\.(?:94\.10(?:1\.(?:73|95)|4\.81)|228\.64\.(?:3[789]|40))|7\.1(?:5(?:0\.160\.134|7\.251\.8)|23\.24\.2(?:3[27]|27)))|7(?:8\.(?:3(?:6\.14\.195|9\.178\.2)|29\.4\.78)|(?:9\.180\.167\.19|2\.22\.74\.5)1|7\.(?:106\.232\.178|74\.50\.36)|4\.204\.163
\.148|0\.98\.79\.216)|6(?:2\.(?:113\.242\.253|75\.207\.4|4\.27\.92)|3\.247\.82\.(?:19[4569]|20[2456])|0\.247\.27\.119|9\.46\.221\.50|1\.84\.94\.15)|8(?:5\.1(?:7\.132\.11[05]|85\.30\.163)|0\.241\.95\.218|3\.239\.83\.102|9\.46\.102\.45|4\.40\.22\.99)|9(?:1\.2(?:41\.187\.204|02\.25\.219)|3\.(?:90\.102\.194|57\.84\.18)|2\.51\.109\.181|4\.41\.52\.65)|4(?:6\.1(?:66\.179\.(?:5[023579]|4[24567])|91\.237\.118)|1\.137\.2[04]\.4)|5(?:8\.2(?:10\.206\.239|46\.179\.82)|0\.30\.45\.223)|3(?:8\.89\.160\.188|6\.39\.246\.33|7\.29\.108\.70))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|6\.207\.(?:6[0123]|4[89]|5\d)|2\.215\.(?:6[34]|44)|3\.185\.15)|0(?:3\.2(?:5(?:1\.157|3\.21|0\.0)|40\.252)|9\.127\.80)|9(?:4\.2(?:19\.240|28\.32)|0\.113\.20[89]|7\.252\.0)|8(?:6\.1(?:3\.[01234567]|22\.4[4567])|8\.73\.252)|2(?:(?:3\.136\.10|5\.60\.15)6|2\.155\.4[34])|77\.(?:53\.140|11\.55|36\.17)|30\.193\.1(?:47|65))|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:1\.220\.243|3\.205\.38|2\.62\.16)|12\.(?:73\.15[89]|5\.158)|4\.244\.23)|5(?:8\.50\.1(?:[2345]|0[456789]|1[016789])|\.1(?:02\.253|72\.248))|9(?:(?:1\.250\.24|4\.230\.9)3|0\.174\.2)|(?:31\.210\.9|84\.247\.)1|41\.254\.[2568]|64\.187\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:[67]|(?:12|8)[4567]|4[89]?|5[01]?)|6\.207\.(?:6[0123]|4[89]|5\d)|2\.215\.(?:6[34]|44)|3\.185\.15)|9(?:(?:2\.227\.17|9\.19\.9)2|4\.2(?:19\.240|28\.32)|0\.113\.20[89])|0(?:3\.2(?:5(?:1\.157|3\.21|0\.0)|40\.252)|9\.127\.80)|8(?:6\.1(?:3\.[01234567]|22\.4[4567])|8\.73\.252)|2(?:(?:3\.136\.10|5\.60\.15)6|2\.155\.4[34])|77\.(?:53\.140|11\.55|36\.17)|30\.193\.1(?:47|65))|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:1\.220\.243|3\.205\.38|2\.62\.16)|12\.(?:73\.15[89]|5\.158)|4\.244\.23)|5(?:8\.50\.1(?:[2345]|1[01256789]|0[456789])|\.1(?:02\.253|72\.248))|9(?:1\.250\.24|4\.230\.9|5\.83\.25)3|3(?:7\.237\.168|1\.210\.91)|41\.254\.[2568]|64\.187\.109|84\.247\.1)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6