You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/03/27 07:57:20 UTC
svn commit: r1461426 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Mar 27 06:57:19 2013
New Revision: 1461426
URL: http://svn.apache.org/r1461426
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1461426&r1=1461425&r2=1461426&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Mar 27 06:57:19 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201303262
+## khop-sc-neighbors.cf v 201303272
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -20,7 +20,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|9[35])(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:13|86)|9[35])(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -92,7 +92,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:10\.(?:223\.111|51\.44)|\.135\.24[23]|21\.143\.46)|1(?:78\.89\.107|03\.9\.156|18\.97\.75)|37\.59\.136|5\.135\.224)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:8\.163\.23|3\.9\.15)6|76\.53\.112|20\.84\.13)|2(?:10\.(?:223\.111|51\.44)|\.135\.24[23])|37\.59\.136|5\.135\.224)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -111,7 +111,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:0\.(?:128\.2|84\.13)|5\.60\.156)|0(?:8\.163\.23|3\.9\.15)6|83\.(?:221\.1[23]|10\.80)|1(?:2\.97\.24|0\.52\.8))|21(?:0\.21\.225|7\.23\.1?2)|8(?:0\.36\.130|9\.218\.68)|46\.166\.179)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:0\.(?:128\.2|84\.13)|5\.60\.156)|83\.(?:221\.1[23]|10\.80)|1(?:2\.97\.24|0\.52\.8)|78\.89\.107|03\.9\.156)|21(?:0\.21\.225|7\.23\.1?2)|8(?:0\.36\.130|9\.218\.68)|46\.166\.179)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -129,7 +129,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:2(?:1\.(?:1(?:45\.120\.75|58\.198\.76|25\.63\.87)|22\.127\.17|66\.95\.156|49\.107\.2)|4\.(?:(?:243\.124\.20|42\.124\.13)6|1(?:25\.156\.52|36\.228\.3))|5\.(?:141\.204\.82|91\.11\.89)|0\.132\.132\.119|3\.30\.174\.61)|7(?:8\.(?:2(?:07\.158\.230|13\.33\.95)|1(?:63\.105\.52|51\.86\.1)|89\.107\.(?:164|66)|32\.223\.88|49\.170\.57|91\.254\.66)|6\.(?:31\.157\.173|53\.233\.76|8\.242\.91)|4\.137\.168\.212|3\.200\.90\.196|7\.73\.105\.23)|9(?:5\.(?:1(?:3(?:8\.195\.125|\.200\.218)|91\.1(?:66\.25|84\.82)|28\.253\.152)|29\.81\.30|94\.11\.17)|0\.(?:1(?:07\.140\.76|82\.52\.113)|0\.60\.238)|9\.(?:19\.108\.231|255\.11\.29)|4\.213\.122\.34)|1(?:8\.(?:2(?:44\.182\.94|6\.204\.182)|97\.(?:196\.163|75\.154))|6\.(?:112\.66\.102|90\.162\.116)|5\.2(?:49\.63\.164|2\.80\.197)|1\.68\.104\.133|4\.207\.113\.55|9\.180\.26\.110|2\.152\.252\.9)|8(?:8\.(?:1(?:2(?:7\.230\.28|8\.99\.94)|68\.46\.53)|252\.0\.237)|0\.(?:182\.167\.68|211\.179\.30)|3\.1(?:11\.21\.1
44|0\.80\.5)|7\.108\.240\.20|5\.5\.54\.77)|0(?:8\.163\.236\.208|9\.195\.54\.231|1\.44\.3\.50)|4(?:4\.76\.31\.172|\.63\.74\.204)|\.226\.83\.81)|2(?:1(?:1\.(?:1(?:1(?:1\.174\.98|5\.127\.32)|47\.211\.16|74\.179\.80|96\.186\.53)|23(?:6\.241\.13|8\.108\.11)3|58\.255\.121|63\.82\.175)|7\.(?:2(?:3\.(?:12\.1(?:8[58]|[09]7|19|43|61|74)|2\.10[238])|00\.184\.87)|97\.211\.20)|0\.(?:5(?:1\.44\.199|3\.47\.105|6\.23\.100)|2(?:23\.111\.8|45\.89\.69))|3\.(?:2(?:30\.128\.226|51\.186\.229)|186\.39\.43|81\.164\.57|0\.89\.6)|8\.(?:232\.111\.227|194\.91\.238)|6\.153\.136\.125|9\.223\.252\.150|2\.49\.70\.48)|0(?:0\.(?:2(?:47\.100\.178|06\.14\.26)|7(?:2\.11\.132|9\.27\.60)|142\.133\.21|68\.76\.69)|2\.(?:1(?:18\.236\.178|42\.203\.19|58\.39\.250)|71\.136\.200|44\.53\.64)|1\.(?:195\.239\.27|65\.114\.212|22\.7\.225|45\.114\.3)|3\.2(?:(?:28\.43\.20|49\.75\.1)7|36\.93\.142))|2(?:1\.(?:2(?:07\.220\.140|14\.208\.226)|1(?:43\.46\.13|39\.0\.67))|2\.1(?:74\.(?:255\.238|163\.2)|22\.79\.121)|0\.94\.235\.200)|\.
135\.24(?:3\.(?:187|210)|2\.1[26]2))|6(?:1\.(?:1(?:75\.223\.1(?:34|42)|33\.125\.162|10\.67\.125|47\.79\.111|66\.55\.153)|55\.156\.210|98\.131\.141)|6\.(?:84\.(?:50\.133|49\.9)|63\.178\.54)|0\.(?:173\.11\.121|244\.24\.156)|2\.146\.28\.212|9\.90\.120\.188)|8(?:9\.218\.(?:68\.(?:146|74|90)|224\.58|94\.166)|(?:0\.36\.130\.13|1\.23\.106\.7)5|4\.(?:15\.191\.254|54\.160\.128)|5\.2(?:14\.157\.75|02\.5\.110)|3\.14\.26\.98)|7(?:4\.(?:122\.227\.124|216\.223\.82|9\.203\.186)|2\.(?:9\.(?:150\.200|96\.115)|35\.20\.131)|7\.(?:106\.232\.178|79\.81\.50|41\.1\.12)|8\.157\.217\.65)|9(?:1\.(?:23(?:0\.216\.130|5\.126\.92)|194\.210\.50)|5\.(?:51\.156\.218|48\.24\.10)|4\.2(?:42\.243\.80|3\.2\.185)|3\.159\.160\.164|0\.83\.184\.211)|5(?:\.(?:1(?:35\.(?:224\.(?:69|70)|92\.150)|99\.140\.67)|9\.131\.21)|9\.(?:127\.204\.28|49\.79\.121|60\.7\.146)|8\.180\.26\.203)|4(?:6\.(?:1(?:66\.179\.107|37\.45\.105)|99\.253\.158|238\.24\.34|48\.191\.71)|1\.137\.24\.4)|3(?:1\.210\.47\.230|7\.59\.136\.203))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:2(?:44\.182\.94|6\.204\.182)|97\.(?:196\.163|75\.154))|4\.(?:141\.253\.14|207\.113\.55)|6\.(?:112\.66\.102|90\.162\.116)|5\.2(?:49\.63\.164|2\.80\.197)|9\.1(?:80\.26\.110|93\.93\.25)|1\.68\.104\.133)|7(?:8\.(?:2(?:07\.158\.230|13\.33\.95)|89\.107\.(?:164|66)|32\.223\.88|49\.170\.57|91\.254\.66)|6\.(?:53\.(?:112\.2(?:2[78]|31)|233\.76)|31\.157\.173)|4\.137\.168\.212|3\.200\.90\.196|7\.73\.105\.23)|2(?:1\.(?:1(?:5(?:6\.65\.187|8\.198\.76)|81\.251\.188|24\.124\.79|45\.120\.75)|22\.127\.17|66\.95\.156|49\.107\.2)|4\.(?:42\.124\.136|136\.228\.3)|0\.132\.132\.119|5\.141\.204\.82|3\.30\.174\.61)|9(?:5\.(?:1(?:3(?:8\.195\.125|\.200\.218)|91\.1(?:66\.25|84\.82)|28\.253\.152)|29\.81\.30|94\.11\.17)|9\.(?:19\.108\.231|255\.11\.29)|0\.(?:107\.140\.76|0\.60\.238)|4\.213\.122\.34)|8(?:8\.(?:1(?:27\.230\.28|68\.46\.53)|252\.0\.237)|(?:0\.211\.179\.3|7\.108\.240\.2)0|3\.1(?:11\.21\.144|0\.80\.5))|0(?:8\.163\.236\.208|9\.195\.54
\.231|1\.44\.3\.50)|4(?:4\.76\.31\.172|\.63\.74\.204)|\.226\.83\.81)|2(?:1(?:7\.(?:2(?:3\.(?:12\.1(?:8[58]|07|19|43|74)|2\.1(?:0[238]|3[37]|44|61))|00\.184\.87|19\.123\.59)|1(?:2\.113\.67|7\.35\.146)|97\.211\.20)|1\.(?:1(?:1(?:1\.174\.98|5\.127\.32)|47\.211\.16|96\.186\.53)|23(?:6\.241\.13|8\.108\.11)3|63\.82\.175)|3\.(?:2(?:30\.128\.226|51\.186\.229)|1(?:71\.39\.154|86\.39\.43)|81\.164\.57|0\.89\.6)|0\.(?:5(?:1\.44\.199|3\.47\.105|6\.23\.100)|2(?:23\.111\.8|45\.89\.69))|8\.(?:232\.111\.227|194\.91\.238)|6\.153\.136\.125|9\.223\.252\.150|2\.49\.70\.48)|0(?:0\.(?:2(?:47\.100\.178|06\.14\.26)|7(?:2\.11\.132|9\.27\.60)|142\.133\.21|68\.76\.69)|2\.(?:1(?:18\.236\.178|42\.203\.19|58\.39\.250)|71\.136\.200|44\.53\.64)|1\.(?:1(?:95\.239\.27|8\.93\.170)|65\.114\.212|22\.7\.225|45\.114\.3)|3\.2(?:(?:28\.43\.20|49\.75\.1)7|36\.93\.142)|9\.238\.180\.166|8\.113\.254\.39)|2(?:1\.(?:2(?:07\.220\.140|14\.208\.226)|1(?:43\.46\.13|39\.0\.67))|2\.1(?:74\.(?:255\.238|163\.2)|22\.79\.121)|0\.94
\.235\.200)|\.1(?:35\.24(?:3\.(?:187|210)|2\.1[26]2)|83\.155\.2))|6(?:1\.(?:1(?:3(?:3\.125\.162|8\.104\.30)|75\.223\.1(?:34|42)|10\.67\.125|66\.55\.153)|55\.156\.210|98\.131\.141)|6\.84\.(?:50\.133|49\.9)|2\.146\.28\.212|9\.90\.120\.188)|8(?:9\.218\.(?:68\.(?:146|74|90)|224\.58|94\.166)|(?:0\.36\.130\.13|1\.23\.106\.7)5|4\.(?:15\.191\.254|54\.160\.128)|5\.2(?:14\.157\.75|02\.5\.110)|3\.3\.103\.227)|9(?:1\.(?:23(?:0\.216\.130|5\.126\.92)|194\.210\.50)|5\.(?:51\.156\.218|48\.24\.10)|4\.2(?:42\.243\.80|3\.2\.185)|3\.159\.160\.164|0\.83\.184\.211)|7(?:4\.(?:122\.227\.124|216\.223\.82|9\.203\.186)|2\.(?:35\.20\.131|9\.150\.200)|7\.(?:106\.232\.178|41\.1\.12)|8\.157\.217\.65|9\.165\.252\.66)|5(?:\.(?:1(?:35\.(?:224\.(?:69|70)|92\.150)|99\.140\.67)|9\.131\.21)|9\.(?:127\.204\.28|49\.79\.121|60\.7\.146)|8\.180\.26\.203)|4(?:6\.(?:1(?:66\.179\.107|37\.45\.105)|99\.253\.158|238\.24\.34|48\.191\.71)|1\.137\.24\.4)|3(?:1\.210\.47\.230|7\.59\.136\.203))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -163,7 +163,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:0\.(?:205\.3[2345]|52\.8)|5\.63\.(?:[89]|1[012345])|2\.215\.(?:6[34]|44)|8\.186\.86)|2(?:1\.63\.(?:18|23)|3\.136\.106|2\.155\.42)|78\.172\.(?:1(?:5[234]|8[36])|229)|9(?:0\.121\.23[89]|7\.252\.[01])|0(?:8\.174\.193|3\.9\.158)|86\.123\.13[35]|30\.193\.165)|2(?:0(?:0\.(?:77\.172|85\.23)|7\.103\.16[01])|1(?:2\.5\.158|7\.76\.69))|8(?:5\.26\.(?:184|231)|3\.149\.(?:48|3)|4\.235\.9[12])|4(?:1\.2(?:54\.[58]|23\.161)|6\.227\.191)|3(?:7\.17\.11[2345]|1\.7\.125)|(?:79\.106\.10|5\.44\.3)9)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:2\.215\.(?:6[34]|44)|0\.52\.[028]|5\.63\.1[02]|8\.186\.86)|78\.172\.(?:1(?:5[234]|8[36])|229)|2(?:2\.155\.42|5\.60\.156)|83\.221\.1[23]|30\.193\.165|09\.127\.81|97\.252\.0)|(?:79\.106\.10|217\.76\.6|5\.44\.3)9|4(?:1\.254\.[158]|6\.227\.191)|85\.(?:115\.248|26\.184)|37\.17\.11[2345])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6