You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/09/07 08:57:50 UTC
svn commit: r1520735 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sat Sep 7 06:57:50 2013
New Revision: 1520735
URL: http://svn.apache.org/r1520735
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1520735&r1=1520734&r2=1520735&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sat Sep 7 06:57:50 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20130962
+## khop-sc-neighbors.cf v 20130972
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:2\.90\.222|6\.112\.66)|(?:73\.44\.18|03\.30\.7)2|83\.136\.146|21\.54\.54)|2(?:2(?:2\.92\.141|1\.4\.142)|18\.2\.129)|61\.1(?:36\.68|41\.21)|58\.254\.172)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:2\.90\.222|6\.112\.66)|(?:73\.44\.18|03\.30\.7)2|21\.54\.54)|2(?:1(?:7\.12\.113|8\.2\.129)|2(?:2\.92\.141|1\.4\.142))|(?:83\.167\.23|61\.141\.2)1|58\.254\.172)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:6\.192\.15|8\.20\.148)|2(?:5\.60\.156|0\.84\.13)|98\.24\.17[345]|19\.184\.214|03\.20\.8|41\.0\.61)|217\.12\.113|86\.111\.144|90\.150\.9)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:6\.192\.15|8\.20\.148)|2(?:5\.60\.156|0\.84\.13)|98\.24\.17[345]|19\.184\.214|03\.20\.8|41\.0\.61)|(?:79\.106\.10|90\.150\.)9|86\.111\.144|61\.136\.68)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:1(?:84\.172\.244|70\.181\.99|64\.62\.8)|216\.86\.253|90\.222\.134)|(?:0\.164\.70\.21|5\.71\.238\.14|7\.239\.107\.2)1|9\.(?:1(?:84\.214\.18|92\.252\.1)|201\.141\.81)|8\.(?:130\.107\.235|244\.239\.2|46\.127\.36)|6\.1(?:12\.(?:66\.102|5\.136)|93\.90\.26)|1\.68\.104\.132)|8(?:4\.(?:22\.(?:1(?:77\.5[12]|1\.23)|2(?:30\.213|7\.171))|82\.(?:53\.1(?:0[69]|1)|179\.117|214\.35)|146\.116\.129)|3\.1(?:36\.146\.110|01\.38\.202)|(?:7\.4\.111\.21|5\.19\.94\.2)8|0\.211\.179\.30|2\.234\.77\.23|9\.3\.25\.146)|7(?:3\.(?:44\.1(?:79\.(?:2(?:0[59]|[13]2|[45]4|27)|197)|82\.(?:2[034]|3[58]|17|42|9))|2(?:12\.205\.158|00\.90\.196))|7\.(?:5\.230\.114|69\.8\.50)|4\.36\.1(?:37\.170|64\.184)|6\.192\.15\.229|8\.20\.148\.11)|9(?:8\.24\.1(?:7(?:4\.16[67]|5\.[234]|3\.80)|80\.91)|9\.(?:30\.137\.10[67]|255\.11\.29)|5\.(?:138\.195\.12|245\.118\.)5|2\.163\.193\.199|4\.11\.24\.156|0\.0\.60\.238)|4(?:\.(?:52\.137\.(?:54|77)|139\.229\.36|63\.74\.204)|1\.(?:105\
.65\.10|0\.61\.166)|4\.76\.136\.228|8\.223\.59\.187)|2(?:1\.(?:1(?:34\.238\.129|57\.3\.252)|22\.(?:127\.17|34\.166))|3\.(?:142\.218\.89|234\.230\.45)|4\.207\.34\.91)|0(?:3\.9\.15(?:8\.1(?:47|81)|7\.12[69])|(?:9\.228\.132\.14|1\.12\.245\.9)6)|\.(?:2(?:2(?:0\.158\.3|6\.84\.27)|15\.206\.242|09\.163\.3)|93\.21\.147)|62\.216\.3\.1[67])|2(?:1(?:8\.(?:1(?:5(?:1\.141\.75|8\.3\.1|9\.9\.7)|48\.85\.130)|2\.129\.53)|1\.(?:1(?:1(?:1\.250\.177|8\.37\.56)|74\.120\.123)|232\.154\.6)|2\.(?:1(?:44\.254\.122|56\.44\.134)|247\.140\.71)|3\.1(?:32\.241\.13|64\.18\.147|95\.77\.114)|0\.(?:109\.97\.63|51\.44\.199)|7\.12\.113\.67|9\.255\.77\.42)|2(?:2\.(?:1(?:00\.14(?:0\.4|\.3)|22\.79\.103)|92\.141\.155|231\.33\.38)|1\.(?:4\.142\.(?:9[013]|89)|214\.208\.226)|0\.94\.235\.200|3\.25\.242\.62)|0(?:0\.(?:1(?:42\.133\.21|75\.56\.190)|72\.11\.132|222\.4\.90)|3\.(?:171\.233\.243|234\.111\.248)|1\.116\.199\.34|2\.71\.136\.200|8\.98\.25\.183)|4\.237\.229\.37|\.183\.155\.2)|6(?:1\.(?:1(?:75\.223\.1(?:3[49]|4[12])|66\.5
5\.153|36\.68\.76|41\.21\.34)|23(?:1\.218\.234|8\.148\.161)|3(?:8\.186\.117|6\.79\.99))|4\.(?:1(?:81\.43\.79|91\.34\.51|4\.85\.2)|71\.156\.216)|5\.(?:60\.15\.18[46]|125\.155\.90)|9\.(?:198\.197\.156|64\.49\.109)|2\.141\.37\.85|7\.90\.21\.150)|5(?:9\.(?:1(?:(?:0\.7\.1|2\.17\.)6|1\.237\.151|51\.37\.8)|8\.26\.22)|8\.(?:2(?:15\.176\.210|54\.172\.163)|150\.97\.242)|4\.216\.223\.122)|9(?:5\.(?:78\.123\.159|159\.105\.2|48\.24\.10)|0\.(?:83\.184\.211|150\.9\.38)|3\.159\.160\.164|2\.85\.161\.156|4\.77\.199\.148)|8(?:3\.(?:167\.231\.(?:38|43)|238\.208\.55)|2\.117\.194\.229|6\.111\.144\.194|7\.103\.197\.93)|4(?:9\.(?:2(?:48\.113\.50|18\.46\.81)|159\.218\.39)|1\.137\.24\.4)|7(?:9\.174\.204\.134|4\.216\.223\.82|2\.35\.20\.131)|37\.(?:1(?:59\.192\.162|23\.98\.115)|59\.238\.178))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.(?:22\.(?:1(?:77\.5[12]|97\.216|1\.23)|2(?:30\.213|7\.171))|82\.(?:53\.1(?:06|1)|179\.117)|146\.116\.129)|3\.(?:1(?:0(?:6\.116\.109|1\.38\.202)|36\.146\.110)|98\.(?:23\.158|75\.72))|(?:7\.4\.111\.21|5\.19\.94\.2)8|0\.211\.179\.30|8\.17\.153\.192|2\.234\.77\.23)|1(?:2\.(?:1(?:84\.172\.244|70\.181\.99|64\.62\.8)|216\.86\.253|90\.222\.134)|9\.(?:1(?:84\.214\.18|92\.252\.1)|201\.141\.81)|1\.(?:68\.104\.132|94\.144\.177)|6\.1(?:12\.66\.102|93\.90\.26)|8\.(?:244\.239\.2|46\.127\.36))|7(?:3\.(?:44\.1(?:82\.(?:2[014]|3[48]|50?|17|42|9)|79\.(?:2(?:[45]4|09|12)|197))|2(?:12\.205\.158|00\.90\.196))|8\.20(?:7\.158\.230|\.148\.11)|4\.36\.1(?:37\.170|64\.184)|7\.(?:1\.223\.73|69\.8\.50)|6\.192\.15\.229)|9(?:8\.(?:24\.1(?:7(?:4\.16[67]|5\.[234]|3\.80)|80\.91)|52\.247\.103)|2\.1(?:86\.157\.(?:79|92)|63\.193\.199)|9\.(?:30\.137\.10[67]|255\.11\.29)|5\.138\.195\.125)|2(?:1\.(?:1(?:5(?:9\.11\.164|7\.3\.252)|34\.238\.129|2\.167\.95)|22\.127\.
17)|3\.(?:142\.218\.89|234\.230\.45)|2\.49\.119\.188|4\.207\.34\.91)|4(?:\.(?:52\.137\.(?:54|77)|45\.130\.155|63\.74\.204)|4\.76\.136\.228|8\.223\.59\.187|1\.0\.61\.166)|0(?:3\.9\.15(?:7\.12[69]|8\.181)|1\.12\.2(?:45\.96|27\.0))|37\.11(?:6\.1(?:22\.218|12\.51)|7\.69\.226)|\.2(?:(?:09\.163|20\.158)\.3|15\.206\.242)|62\.216\.3\.1[4567])|2(?:1(?:1\.(?:1(?:1(?:1\.250\.177|8\.37\.56)|40\.207\.100|74\.120\.123|57\.144\.27)|232\.154\.6)|8\.(?:1(?:48\.85\.130|58\.3\.1)|56\.161\.14|2\.129\.53)|3\.1(?:(?:71\.39\.15|95\.77\.11)4|32\.241\.13)|0\.(?:109\.97\.63|246\.155\.2)|2\.156\.44\.134|7\.12\.113\.67|9\.255\.77\.42)|0(?:0\.(?:7(?:2\.11\.132|9\.27\.60)|175\.56\.190)|2\.(?:142\.203\.19|52\.236\.162|71\.136\.200)|3\.(?:171\.233\.243|234\.111\.248)|8\.(?:84\.135\.14[78]|98\.25\.183)|1\.116\.199\.34)|2(?:1\.(?:214\.2(?:08\.226|21\.148)|4\.142\.(?:9[013]|8[89]))|2\.(?:1(?:22\.79\.10|00\.14\.)3|92\.141\.155|231\.33\.38)|0\.(?:94\.235\.200|68\.224\.45)|3\.25\.242\.62)|4\.237\.229\.37|\.183\.155\.2)|
6(?:1\.(?:1(?:4(?:3\.158\.24|1\.21\.3)4|75\.223\.141|36\.68\.76)|3(?:8\.186\.117|6\.79\.99)|55\.156\.210)|5\.(?:60\.15\.18[46]|125\.155\.90)|9\.(?:198\.197\.156|64\.49\.109)|6\.96\.205\.133|0\.29\.75\.142|2\.141\.37\.85|7\.90\.21\.150)|8(?:3\.(?:167\.231\.(?:38|43)|238\.208\.55)|(?:9\.222\.181\.22|1\.15\.172\.14)5|2\.(?:117\.194\.229|99\.246\.10)|5\.120\.148\.111|6\.111\.144\.194|0\.73\.71\.248)|5(?:9\.(?:1(?:0\.7\.1|2\.17\.)6|8\.26\.22)|8\.2(?:15\.176\.210|54\.172\.163)|\.(?:102\.156\.|39\.77\.1)25|0\.30\.4(?:2\.187|7\.121))|9(?:0\.(?:83\.184\.211|150\.9\.38)|3\.1(?:59\.160\.164|88\.8\.67)|5\.(?:78\.123\.159|48\.24\.10)|2\.85\.161\.156)|3(?:7\.(?:123\.98\.115|59\.238\.178)|1\.216\.178\.142)|7(?:9\.174\.204\.134|4\.216\.223\.82|2\.35\.20\.131)|4(?:9\.159\.218\.39|1\.137\.24\.4))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|3\.(?:56\.2(?:4[589]|5[01]|25)|18(?:7\.1[67]|5\.6))|6\.207\.(?:6[0123]|1[235]|4[89]|5\d)|4\.1(?:08\.2(?:03|14)|34\.189)|5\.63\.(?:[89]|1[012345])|2\.215\.(?:6[34]|44)|0\.52\.[0123]|9\.36\.21[23])|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|6\.(?:123\.135|37\.203)|8\.(?:165\.168|73\.252)|1\.66\.15[67]|2\.18\.222)|2(?:5\.(?:44\.24[1347]|60\.156)|(?:1\.54\.[45]|2\.155\.4)4|3\.(?:136\.106|30\.165)|4\.107\.127)|9(?:0\.(?:113\.2(?:1[01]|09)|234\.10[56])|7\.2(?:5(?:2\.[01]|4\.224)|16\.21))|0(?:3\.(?:2(?:0\.(?:37|8)|8\.184)|30\.72|1\.69|5\.27)|9\.127\.8[016])|7(?:3\.232\.19|7\.47\.106)|30\.193\.1(?:46|65)|42\.234\.186)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.(?:82\.8[17]|194\.115)|2\.(?:153\.84|29\.176))|22\.140\.157|12\.34\.12)|58\.50\.(?:1(?:[2345]|0[456789]|1[016789])|69|70)|4(?:1\.2(?:54\.[1258]|2
3\.161)|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|3\.(?:56\.2(?:4[589]|5[01]|25)|18(?:7\.1[67]|5\.6))|6\.207\.(?:6[0123]|1[235]|4[89]|5\d)|4\.1(?:08\.2(?:03|14)|34\.189)|5\.63\.(?:[89]|1[012345])|2\.215\.(?:6[34]|44)|0\.52\.[0123]|9\.36\.21[23])|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|6\.(?:123\.135|37\.203)|8\.(?:165\.168|73\.252)|1\.66\.15[67]|2\.18\.222)|2(?:5\.(?:44\.24[1347]|60\.156)|(?:2\.155\.4|1\.54\.5)4|3\.(?:136\.106|30\.165)|4\.107\.127)|0(?:3\.(?:2(?:0\.(?:37|8)|8\.184)|30\.72|7\.243|1\.69|5\.27)|9\.127\.8[016])|9(?:0\.(?:113\.2(?:1[01]|09)|234\.10[56])|7\.25(?:2\.[01]|4\.224))|7(?:7\.47\.10[26]|3\.232\.19)|30\.193\.1(?:46|65)|42\.234\.186)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.(?:82\.8[17]|194\.115)|2\.(?:153\.84|29\.176))|1(?:3\.55\.105|2\.34\.12)|22\.140\.157)|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|69|70)|19\.19
[01])|9\.55\.254)|4(?:1\.2(?:23\.16[01]|54\.[1258])|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6