You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/09/18 08:57:48 UTC
svn commit: r1524309 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Sep 18 06:57:48 2013
New Revision: 1524309
URL: http://svn.apache.org/r1524309
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1524309&r1=1524308&r2=1524309&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Sep 18 06:57:48 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201309172
+## khop-sc-neighbors.cf v 201309182
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:8\.24\.173|9\.30\.137)|(?:12\.90\.22|03\.30\.7)2|7(?:3\.44\.179|7\.1\.223)|84\.(?:22\.27|82\.53)|21\.54\.54)|21(?:3\.132\.241|1\.119\.86)|58\.254\.172)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:3\.(?:30\.72|9\.157)|1\.15\.247)|84\.(?:22\.(?:17|2)7|82\.53)|99\.30\.137|21\.54\.54)|21(?:3\.132\.241|1\.119\.86)|58\.254\.172|98\.126\.249)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:5\.60\.156|0\.84\.13)|98\.24\.17[45]|84\.22\.177|01\.8\.236|12\.97\.24)|2(?:06\.214\.95|21\.4\.142)|(?:91\.218\.11|41\.254\.)5|75\.75\.240|50\.30\.47|69\.64\.49)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:5\.60\.156|0\.84\.13)|12\.9(?:0\.222|7\.24)|98\.24\.17[45]|01\.8\.236)|2(?:06\.214\.95|21\.4\.142)|91\.218\.115|75\.75\.240|50\.30\.47|69\.64\.49)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.(?:22\.(?:1(?:7(?:2\.14[56]|7\.5[12])|97\.216|1\.23)|2(?:3[07]\.213|8\.22[12]|28\.62|7\.171))|82\.(?:53\.1(?:0[69]|43|1)|179\.117|251\.100))|0\.2(?:25\.148\.206|11\.179\.30)|3\.(?:101\.38\.202|98\.23\.158)|9\.75\.63\.114)|1(?:2\.(?:1(?:(?:24\.38\.25|63\.150\.3)0|70\.181\.99)|21(?:6\.(?:105\.90|86\.253)|7\.161\.3))|9\.1(?:49\.148\.150|84\.214\.18|92\.252\.1)|(?:1\.249\.131\.15|3\.0\.85\.24)9|4\.45\.229\.27|6\.193\.90\.26|8\.175\.28\.3)|9(?:8\.24\.1(?:7(?:4\.(?:16[67]|57)|5\.[234]|3\.80)|80\.91)|9\.(?:30\.137\.10[67]|71\.215\.141)|2\.163\.193\.199|5\.138\.195\.125|0\.107\.140\.77)|0(?:1\.(?:1(?:5\.247\.163|3\.123\.62)|(?:8\.236\.24|44\.3\.5)0)|3\.9\.157\.12[679])|7(?:3\.2(?:12\.205\.158|00\.90\.196)|4\.36\.137\.170|8\.20\.148\.11|7\.1\.223\.73)|4(?:(?:8\.223\.59\.18|\.33\.121\.6)7|1\.0\.61\.166)|2(?:1\.(?:199\.12\.28|22\.127\.17)|5\.46\.24\.62)|\.(?:215\.206\.24|85\.17\.8)2|62\.216\.3\.1[4567])|2(?:2(?:1\.(?:2(?:14\.2(?:08\.
226|14\.187)|04\.223\.38|\.144\.135)|4\.142\.(?:9[0123]|6[479]|4[12]|7[01]))|0\.(?:188\.110\.129|68\.224\.45)|2\.1(?:22\.79\.103|74\.54\.164))|1(?:1\.(?:1(?:7(?:2\.251\.168|4\.120\.123)|19\.86\.1(?:4[357]|54)|91\.168\.166|57\.144\.27)|54\.17\.20[01]|232\.154\.6)|3\.1(?:32\.241\.13|99\.248\.27)|9\.147\.172\.2)|0(?:6\.214\.95\.(?:7[012456789]|6[689]|9[14]|80)|8\.(?:84\.135\.14[78]|76\.106\.66)|3\.(?:171\.233\.243|239\.45\.202)|2\.(?:137\.22|71\.136)\.200|7\.46\.132\.188))|6(?:(?:4\.120\.169\.14|5\.60\.15\.18)6|0\.(?:214\.223\.178|190\.43\.10)|9\.(?:198\.197\.156|64\.49\.109)|1\.(?:167\.120\.9|33\.162\.92)|7\.90\.21\.150)|9(?:1\.218\.115\.(?:4[012356789]|5[2456789]|3[45789]|10[89]|6[013])|3\.(?:159\.160\.164|95\.98\.196)|8\.126\.249\.106|0\.83\.184\.211|5\.155\.8\.219)|5(?:8\.2(?:37\.102\.214|13\.157\.68)|9\.1(?:88\.16\.101|0\.7\.16)|0\.30\.47\.(?:121|87))|7(?:5\.75\.240\.1(?:5[123]|3[89]|4\d)|7\.106\.232\.178|4\.143\.199\.46|2\.35\.20\.131)|82\.(?:11(?:7\.194\.229|4\.79\.254)|99\.246\
.10)|41\.(?:84\.135\.22|137\.24\.4))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:1(?:84\.172\.244|63\.150\.30|24\.7\.137)|21(?:6\.105\.90|7\.161\.3)|94\.224\.236)|(?:0\.76\.43\.2|6\.193\.90\.)26|3\.(?:161\.78\.222|0\.85\.249)|1\.249\.131\.159|9\.149\.148\.150|4\.45\.229\.27|8\.175\.28\.3)|8(?:4\.(?:22\.(?:1(?:7(?:7\.5[12]|2\.145)|97\.216|1\.23)|2(?:8\.22[12]|30\.213|28\.62|7\.171))|82\.(?:53\.1(?:06|43|1)|179\.117|251\.100))|0\.2(?:25\.148\.206|11\.179\.30)|3\.98\.23\.158|9\.75\.63\.114)|9(?:8\.24\.1(?:7(?:4\.16[67]|5\.[234]|3\.80)|80\.91)|0\.(?:107\.140\.77|7\.128\.44)|9\.30\.137\.10[67]|2\.163\.193\.199|6\.203\.198\.130|3\.33\.210\.41)|2(?:1\.(?:22\.(?:127\.17|53\.226)|134\.238\.129)|2\.(?:144\.11\.110|226\.95\.56)|3\.142\.218\.89|5\.46\.24\.62)|0(?:1\.(?:1(?:5\.247\.163|3\.123\.62)|(?:8\.236\.24|44\.3\.5)0)|3\.9\.157\.12[679])|7(?:8\.(?:20\.148\.11|63\.74\.6)|3\.212\.205\.158|4\.36\.137\.170|7\.1\.223\.73)|\.(?:215\.206\.24|85\.17\.8)2|62\.216\.3\.1[45]|41\.0\.61\.166)|2(?:1(?:1\.(?:1(?:19\.86\.1
(?:4[357]|54)|72\.251\.168|91\.168\.166|57\.144\.27)|54\.17\.200)|3\.1(?:3(?:6\.105\.21[02]|2\.241\.13)|99\.248\.27)|9\.(?:239\.113\.97|147\.172\.2)|2\.113\.32\.199|8\.23\.57\.66)|0(?:6\.214\.95\.(?:7[012456789]|8[0123]|6[689]|9[14])|3\.(?:171\.233\.243|239\.45\.202)|2\.1(?:37\.22\.200|54\.192\.28)|8\.84\.135\.14[78]|7\.46\.132\.188|0\.87\.98\.235)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|04\.223\.38)|4\.142\.(?:9[0123]|67))|2\.174\.54\.164|0\.68\.224\.45))|6(?:1\.(?:3(?:8\.186\.117|3\.162\.92)|19\.255\.120)|4\.(?:120\.169\.1(?:46|50)|206\.169\.165)|0\.(?:214\.223\.178|190\.43\.10)|6\.197\.212\.250|9\.64\.49\.109)|9(?:1\.218\.115\.(?:5[12456789]|4[013679]|3[4589]|10[89]|6[013])|(?:8\.126\.249\.10|3\.95\.98\.19)6|5\.155\.8\.219)|5(?:9\.(?:1(?:88\.16\.(?:9[159]|101)|0\.7\.16)|66\.250\.144)|8\.2(?:37\.102\.214|13\.157\.68)|0\.30\.47\.87)|8(?:(?:7\.103\.170\.6|5\.17\.75\.1)5|9\.1(?:35\.192\.40|20\.75\.51)|8\.191\.154\.103|2\.99\.246\.10)|7(?:5\.75\.240\.1(?:5[12345]|3[89]|4\d)|7\.106\.232
\.178|9\.134\.233\.195|8\.141\.66\.122)|4(?:1\.(?:84\.135\.22|137\.24\.4)|2\.121\.57\.248)|37\.5(?:7\.(?:158\.32|90\.39)|9\.61\.117))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|5\.(?:63\.(?:[89]|1[012345])|58\.13[234])|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|0\.(?:205\.3[25]|52\.[0123])|3\.56\.2(?:4[589]|5[01]|25)|2\.215\.(?:6[34]|44)|9\.36\.21[23])|0(?:3\.(?:2(?:8\.184|0\.39)|30\.72|7\.243|5\.27)|9\.127\.8[01])|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|1\.66\.15[67]|6\.123\.135)|2(?:5\.(?:44\.24[01234567]|60\.156)|2\.155\.44)|9(?:0\.234\.10[56]|7\.252\.[01])|(?:42\.234\.18|77\.47\.10)6|30\.193\.1(?:46|65)|63\.125\.144)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:2\.29\.17[67]|3\.194\.115|6\.246\.99)|22\.140\.15[89]|3\.106\.71)|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[06789])|6[89]|71)|19\.190)|9\.55\.254)|4(?:1\.254\.[258]|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|5\.(?:63\.(?:[89]|1[012345])|58\.13[34])|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|2\.(?:215\.(?:6[34]|44)|72\.13)|0\.(?:205\.3[25]|52\.[0123])|3\.56\.2(?:4[589]|5[01]|25)|9\.36\.21[23])|0(?:3\.(?:2(?:8\.184|0\.39)|30\.72|7\.243|1\.69|5\.27)|9\.127\.8[01])|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|1\.66\.15[67]|6\.123\.135)|2(?:5\.(?:44\.24[01234567]|60\.156)|3\.136\.106|2\.155\.44)|9(?:0\.234\.10[56]|7\.252\.[01])|(?:42\.234\.18|77\.47\.10)6|30\.193\.1(?:46|65)|63\.125\.144)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:2\.29\.17[67]|3\.194\.115|6\.246\.99)|22\.140\.15[89]|3\.106\.71)|5(?:8\.(?:50\.(?:1(?:[2345]|1[6789]|0[46])|6[89]|71)|19\.19[01])|9\.55\.254)|4(?:1\.254\.[1258]|9\.0\.11[89])|79\.106\.109|85\.153\.71)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6