You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2012/12/23 08:57:41 UTC
svn commit: r1425436 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sun Dec 23 07:57:40 2012
New Revision: 1425436
URL: http://svn.apache.org/viewvc?rev=1425436&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1425436&r1=1425435&r2=1425436&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sun Dec 23 07:57:40 2012
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201212222
+## khop-sc-neighbors.cf v 201212232
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -92,7 +92,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:3\.18(?:8\.200|7\.63)|8\.184\.75)|10\.(?:168\.50|21\.244)|23\.130\.158)|1(?:9(?:0\.223\.5|8\.51\.22)3|03\.9\.15[67]|20\.128\.2)|6(?:4\.120\.230|9\.162\.89)|70\.39\.165|8\.23\.190)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:3\.187\.63|8\.184\.75)|10\.(?:168\.50|21\.244))|1(?:9(?:0\.223\.5|8\.51\.22)3|03\.9\.15[67])|6(?:3\.141\.216|4\.120\.230|9\.162\.89)|70\.39\.165|8\.23\.190)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -111,7 +111,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:0\.52\.[012]|2\.97\.24)|06\.10\.151|78\.18\.244|20\.84\.13|97\.252\.0)|6(?:6\.197\.19[57]|9\.162\.104)|4(?:1\.254\.[158]|6\.45\.182)|8(?:4\.235\.9[12]|\.23\.190)|2(?:08\.184\.75|\.114\.81)|70\.39\.165|5\.9\.149)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:0\.52\.[02]|2\.97\.24)|78\.18\.244|20\.84\.13|97\.252\.0)|6(?:6\.197\.19[57]|9\.162\.104)|4(?:1\.254\.[15]|6\.45\.182)|8(?:4\.235\.9[12]|\.23\.190)|2(?:08\.184\.75|\.114\.81)|70\.39\.165|5\.9\.149)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -129,7 +129,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.1(?:(?:45\.153\.15|33\.201\.6)9|20\.80\.212)|5\.(?:156\.236\.215|249\.168\.189|66\.85\.110)|9\.(?:97\.131\.(?:1[278]|2[034])|200\.73\.34)|8\.(?:122\.178\.91|97\.58\.166)|4\.(?:112\.177\.5|247\.23\.6)6|3\.(?:114\.123\.24|31\.28\.)7|6\.254\.250\.234|7\.34\.72\.51)|8(?:8\.(?:1(?:2(?:7\.227\.224|2\.86\.206)|65\.148\.97)|75\.223\.43)|7\.(?:(?:115\.52\.4|65\.220\.1)0|0\.208\.213)|4\.82\.94\.22[78]|3\.136\.128\.226|1\.28\.210\.67)|9(?:0\.(?:8(?:2\.89\.156|5\.96\.173|\.246\.177)|1(?:07\.139\.10|51\.76\.172)|223\.53\.198)|5\.161\.(?:40\.10|9\.2)|4\.158\.204\.250|8\.51\.223\.126)|7(?:8\.(?:18\.24(?:4\.(?:[149]3|2[19]|5?7|34|62)|2\.1[49])|(?:79\.187\.11|33\.202\.2)0)|6\.(?:31\.111\.181|8\.141\.93)|7\.99\.210\.6)|2(?:0\.88\.(?:20(?:7\.198|3\.1)|197\.41)|1\.(?:175\.226\.188|8\.152\.242)|5\.208\.21(?:3\.151|\.47)|4\.128\.46\.38)|0(?:3\.9\.157\.(?:2(?:1[49]|04|26|41)|1(?:22|55|63|99)|41|6)|6\.18(?:6\.20\.127|7\.94\.86)|9\.236\.87
\.13)|4\.139\.187\.17)|2(?:1(?:0\.(?:2(?:11\.109\.183|45\.89\.7)|168\.50\.1[69]|61\.125\.211|83\.80\.98)|7\.(?:1(?:18\.81\.(?:18|23)|29\.36\.184)|219\.1(?:23\.59|32\.15))|8\.(?:5(?:6\.156\.222|9\.157\.199)|3\.207\.199|28\.84\.52)|3\.(?:55\.7(?:2\.14|6\.18)|230\.128\.226)|1\.1(?:07\.139\.227|94\.191\.253)|9\.147\.172\.2)|2(?:1\.(?:1(?:2(?:2\.29\.147|\.101\.195)|59\.215\.31)|2(?:14\.208\.226|38\.12\.243))|0\.(?:1(?:74\.209\.178|94\.44\.75)|84\.54\.248)|2\.(?:1(?:74\.255\.238|97\.214\.91)|73\.25\.71))|0(?:2\.1(?:0(?:7\.228\.152|5\.134\.53)|62\.78\.180)|3\.1(?:10\.161\.70|87\.63\.249|60\.62\.98)|(?:7\.112\.125\.2|8\.39\.168\.1)46)|7\.100\.236\.5|\.114\.81\.233)|6(?:1\.1(?:5(?:8\.174\.200|5\.41\.55)|3(?:1\.11\.5|3\.41\.4)2|47\.115\.55)|6\.(?:197\.19(?:7\.(?:2[03567]|18|30)|5\.2(?:1[89]|22))|35\.67\.85)|9\.(?:162\.(?:104\.(?:[457]|10)|89\.2(?:1[26]|20))|63\.218\.250)|0\.(?:191\.(?:150\.102|21\.164)|214\.122\.85)|7\.2(?:12\.183\.(?:24[02]|73)|22\.156\.93)|4\.(?:120\.230\.23[56]|238
\.233\.89)|3\.141\.216\.1(?:59|61|76)|5\.34\.37\.37)|8(?:4\.(?:15\.191\.254|228\.25\.247|90\.62\.183)|(?:9\.71\.113\.13|6\.126\.23\.6)8|1\.169\.172\.67|5\.234\.22\.126|3\.0\.192\.202|7\.98\.226\.33|\.33\.183\.1)|9(?:1\.(?:205\.63\.194|103\.79\.88)|3\.(?:157\.148\.10|95\.218\.4)2|5\.(?:159\.105\.2|22\.24\.61)|4\.156\.73\.176)|4(?:6\.(?:45\.182\.(?:7[345]|68|80)|180\.54\.184)|1\.(?:137\.2[04]\.|208\.106\.24)4|\.30\.75\.22)|5(?:\.9\.(?:149\.14[67]|214\.233)|9\.6(?:7\.107\.89|0\.7\.146)|4\.248\.146\.226|8\.210\.51\.82)|7(?:(?:7\.(?:106\.232\.17|223\.137\.1)|8\.29\.4\.7)8|2\.55\.191\.114|0\.49\.80\.83))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.1(?:(?:45\.153\.15|33\.201\.6)9|20\.80\.212)|5\.(?:156\.236\.215|249\.168\.189|66\.85\.110)|9\.(?:97\.131\.(?:1[278]|2[034])|200\.73\.34)|8\.(?:122\.178\.91|97\.58\.166)|4\.(?:112\.177\.5|247\.23\.6)6|3\.(?:114\.123\.24|31\.28\.)7|7\.(?:20\.3\.23|34\.72\.5)1|6\.254\.250\.234)|9(?:0\.(?:8(?:2\.89\.156|5\.96\.173|\.246\.177)|2(?:01\.101\.50|23\.53\.198)|107\.139\.10)|5\.(?:161\.(?:40\.10|9\.2)|81\.140\.87)|4\.158\.204\.250|8\.51\.223\.126)|8(?:8\.(?:1(?:2(?:7\.227\.224|2\.86\.206)|65\.(?:148\.9|242\.)7)|75\.223\.43)|7\.(?:0\.208\.213|115\.52\.40)|4\.82\.94\.22[78]|3\.136\.128\.226|1\.28\.210\.67)|7(?:8\.(?:18\.24(?:4\.(?:[149]3|2[19]|5?7|34|62)|2\.14)|33\.202\.20)|6\.(?:9\.(?:22\.226|40\.240)|31\.111\.181))|0(?:3\.9\.157\.(?:2(?:2[06]|14)|1(?:22|63)|41|6)|6\.18(?:6\.20\.127|7\.94\.86)|9\.236\.87\.13)|2(?:4\.128\.(?:46\.38|87\.62)|0\.88\.20(?:7\.198|3\.1)|1\.8\.152\.242|5\.208\.21\.47)|4\.139\.187\.17)|2(?:1(?:8\.(?:5
(?:(?:9\.157\.19|7\.11\.10)9|6\.1(?:56\.222|62\.23))|3\.207\.199|28\.84\.52)|0\.(?:2(?:11\.109\.183|45\.89\.7)|168\.50\.1[69]|61\.125\.211|83\.80\.98)|7\.(?:1(?:29\.36\.184|18\.81\.18)|219\.1(?:23\.59|32\.15))|3\.(?:55\.7(?:2\.14|6\.18)|230\.128\.226)|1\.1(?:07\.139\.227|94\.191\.253)|2\.227\.159\.133|9\.147\.172\.2)|2(?:1\.(?:1(?:2(?:2\.29\.147|\.101\.195)|59\.215\.31)|2(?:14\.208\.226|38\.12\.243))|0\.(?:1(?:74\.209\.178|94\.44\.75)|84\.54\.248)|2\.(?:1(?:74\.255\.238|97\.214\.91)|73\.25\.71))|0(?:2\.1(?:0(?:7\.228\.152|5\.134\.53)|62\.78\.180)|3\.1(?:10\.161\.70|87\.63\.249|60\.62\.98)|7\.(?:112\.125\.246|55\.16\.148)|8\.39\.168\.146|5\.129\.20\.58)|7\.100\.236\.5|\.114\.81\.233)|6(?:6\.(?:197\.19(?:7\.(?:2[03567]|18|30)|5\.2(?:1[89]|22))|203\.32\.54|35\.67\.85)|1\.1(?:5(?:8\.174\.200|5\.41\.55)|3(?:1\.11\.5|3\.41\.4)2|47\.115\.55)|9\.(?:162\.(?:104\.(?:[457]|10)|89\.2(?:1[26]|20))|63\.218\.250)|0\.(?:191\.(?:150\.102|21\.164)|214\.122\.85)|7\.2(?:12\.183\.(?:24[02]|73)|2
2\.156\.93)|4\.(?:120\.230\.23[56]|238\.233\.89)|(?:2\.149\.162\.5|5\.34\.37\.3)7|3\.141\.216\.1(?:59|61|76))|8(?:4\.(?:15\.191\.254|90\.62\.183)|7\.(?:101\.31\.198|98\.226\.33)|1\.169\.172\.67|5\.234\.22\.126|9\.71\.113\.138|\.33\.183\.1)|9(?:1\.(?:2(?:05\.63\.194|28\.198\.82)|121\.101\.46)|3\.(?:157\.148\.10|95\.218\.4)2|5\.(?:159\.105\.2|22\.24\.61))|5(?:\.9\.(?:149\.14[67]|214\.233)|9\.6(?:7\.107\.89|0\.7\.146)|4\.248\.146\.226|0\.57\.100\.149|8\.210\.51\.82)|4(?:6\.(?:45\.182\.(?:7[345]|68|80)|180\.54\.184)|1\.(?:137\.2[04]\.|208\.106\.24)4|\.30\.75\.22)|7(?:2\.(?:55\.1(?:79\.113|91\.114)|89\.229\.44)|7\.106\.232\.178|0\.49\.80\.83)|37\.110\.107\.125)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -163,7 +163,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:2(?:1\.63\.(?:1[6789]|21)|3\.54\.1(?:89|90))|8(?:8\.(?:113\.192|42\.13)|6\.123\.13[35])|1(?:2\.215\.6[345]|0\.52\.[0123])|9(?:7\.252\.[01]|8\.15\.123)|30\.193\.14[57])|2(?:0(?:0\.(?:77\.17[23]|85\.23)|3\.194\.115|6\.214\.89)|1(?:7\.(?:1(?:74\.15|18\.8)3|76\.69)|3\.87\.241)|23\.(?:130\.158|255\.231))|8(?:5\.(?:26\.(?:18[34]|231)|153\.83)|3\.149\.(?:[239]|48)|4\.235\.9[12])|4(?:1\.(?:2(?:54\.[158]|23\.161)|190\.3)|6\.227\.191|9\.123\.98)|63\.223\.(?:117|89|90)|37\.110\.211|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:2(?:1\.63\.(?:1[6789]|2[01])|3\.54\.1(?:89|90))|8(?:8\.(?:113\.192|42\.13)|6\.123\.13[35])|1(?:2\.215\.(?:6[345]|44)|0\.52\.[0123])|9(?:7\.252\.[01]|8\.15\.123)|30\.193\.14[57])|2(?:0(?:0\.(?:77\.17[23]|85\.23)|3\.194\.115|6\.214\.89)|1(?:7\.(?:174\.153|76\.69)|3\.87\.241)|23\.(?:255\.2(?:24|31)|130\.158))|8(?:5\.(?:26\.(?:18[34]|231)|153\.83)|3\.149\.(?:[239]|48)|4\.235\.9[12])|4(?:1\.(?:2(?:54\.[158]|23\.161)|190\.3)|6\.227\.191|9\.123\.98)|63\.223\.(?:117|89|90)|37\.110\.211|79\.106\.109)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6