You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/06/28 08:57:17 UTC
svn commit: r1497656 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Fri Jun 28 06:57:17 2013
New Revision: 1497656
URL: http://svn.apache.org/r1497656
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1497656&r1=1497655&r2=1497656&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Fri Jun 28 06:57:17 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201306272
+## khop-sc-neighbors.cf v 201306282
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -20,7 +20,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:2(?:01)?|117|93)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:9[35]|117|2)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -74,7 +74,7 @@ score KHOP_SC_CIDR16 1.0 0.2 1.0 0.2
# crap, still empty 20100410 bad scrape, script failed to populate rule
# crap, still empty 20110227 this is due to safety net exclusions -> 1 .2 1 .2
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b84\.126(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b8(?:4\.126|5\.105)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0.4
@@ -92,7 +92,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:4\.36\.16[47]|3\.192\.144|7\.1\.223)|03\.9\.158)|2(?:08\.71\.172|22\.236\.16|4\.127\.201)|65\.60\.15|50\.97\.3)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:4\.36\.16[047]|3\.192\.144|7\.1\.223)|03\.9\.158|58\.255\.2)|2(?:08\.71\.172|22\.236\.16|4\.127\.201))\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -111,7 +111,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.56\.2(?:4[89]|5[01])|0\.52\.[02])|7(?:4\.37\.1(?:48|67)|3\.192\.147)|84\.82\.(?:120|29)|25\.60\.156)|21(?:3\.230\.128|2\.48\.64)|37\.122\.20[89]|46\.32\.232)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.56\.2(?:4[89]|5[01])|2\.97\.24|0\.52\.0)|7(?:4\.37\.1(?:48|67)|3\.192\.147)|84\.82\.(?:120|29))|21(?:3\.230\.128|2\.48\.64)|37\.122\.208|46\.32\.232|50\.97\.3)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -129,7 +129,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:1(?:6(?:1\.232\.157|7\.170\.33)|86\.46\.107)|2(?:1(?:6\.55\.162|7\.161\.3)|20\.224\.59))|9\.(?:1(?:9(?:4\.153\.187|3\.93\.25)|49\.148\.150)|201\.141\.81)|8\.(?:1(?:66\.2(?:10\.111|33\.15)|14\.77\.116)|41\.157\.7)|4\.(?:45\.(?:2(?:37\.70|5\.83)|9\.184)|207\.113\.55)|5\.(?:115\.81\.138|88\.119\.132|90\.96\.85)|0\.1(?:65\.125\.152|89\.168\.171)|6\.1(?:24\.128\.138|12\.66\.102)|1\.254\.142\.218|7\.211\.91\.147|3\.0\.85\.249)|8(?:4\.(?:82\.(?:2(?:9\.3[34]|35\.212)|120\.2(?:10|35))|1(?:07\.58\.135|64\.130\.19)|22\.1(?:77\.50|0\.51))|0\.(?:2(?:25\.131\.176|11\.179\.30)|96\.16\.(?:7[02]|69))|8\.(?:168\.46\.53|252\.0\.237|95\.48\.216)|6\.(?:237\.39\.147|84\.207\.201)|9\.(?:169\.20\.202|39\.35\.168)|7\.4\.80\.188)|7(?:4\.3(?:7\.1(?:67\.1(?:03|11|22)|48\.77)|6\.16(?:0\.157|4\.184|7\.116))|3\.(?:232\.(?:45\.(?:4[01]|39)|26\.50)|192\.14(?:4\.105|7\.114))|8\.(?:20(?:7\.158\.230|\.148\.11)|33\.144\.132)|7\.(?:1\.223\.(?:10|7)3
|80\.102\.214)|5\.197\.121\.20)|9(?:5\.(?:1(?:38\.195\.125|91\.184\.82)|29\.81\.30)|9\.(?:30\.137\.13[89]|168\.141\.98|255\.11\.29)|(?:3\.255\.143\.6|8\.15\.97\.4)3|2\.(?:198\.102\.44|74\.251\.118)|(?:0\.82\.89\.15|4\.106\.16\.)6)|2(?:1\.(?:1(?:81\.251\.188|56\.66\.110)|2(?:54\.171\.15|2\.127\.17)|78\.119\.193|88\.255\.202)|8\.1(?:21\.64\.1(?:01|33)|34\.37\.115)|3\.110\.175\.202|2\.166\.83\.78)|03\.9\.15(?:8\.1(?:10|47)|7\.181)|4(?:4\.76\.83\.111|\.33\.121\.67)|58\.255\.2\.6[078]|33\.242\.115\.39|\.226\.84\.175)|2(?:1(?:1\.(?:1(?:11\.250\.177|47\.211\.16|72\.242\.74)|2(?:38\.133\.138|06\.133\.94)|54\.17\.200)|3\.(?:1(?:71\.39\.154|32\.241\.7)|230\.128\.226)|8\.15(?:3\.247\.68|8\.3\.1|9\.9\.7)|7\.(?:200\.184\.87|198\.3\.238)|0\.(?:245\.89\.6|51\.44\.19)9|2\.(?:48\.64\.23|6\.152\.21)1|9\.145\.110\.118|6\.194\.34\.210)|0(?:0\.(?:14(?:8\.125\.247|2\.133\.21)|7(?:2\.11\.132|9\.27\.60)|27\.183\.163|47\.10\.209)|2\.(?:1(?:(?:58\.39\.25|20\.1\.3)0|42\.203\.19)|71\.136\.200)|3\.(?:2(
?:55\.15\.146|38\.95\.11)|155\.102\.2)|8\.(?:71\.172\.(?:8[56789]|91)|113\.254\.39)|1\.(?:22\.7\.225|45\.114\.3))|2(?:2\.(?:23(?:1\.57\.117|4\.3\.151|6\.16\.14)|100\.14(?:0\.4|\.3))|0\.9(?:0\.201\.143|4\.235\.200)|1\.214\.208\.226|3\.26\.193\.53)|4\.127\.201\.172)|8(?:(?:3\.18\.234\.20|2\.207\.51\.9)2|6\.(?:111\.144\.194|64\.171\.198)|(?:7\.236\.232\.23|\.33\.183\.)1|9\.121\.194\.27|1\.23\.106\.75)|6(?:1\.(?:1(?:05\.174\.6|47\.69\.79)|252\.138\.195|42\.104\.99|70\.83\.58|32\.38\.3)|5\.60\.15\.18[46]|0\.196\.58\.189)|9(?:3\.1(?:5(?:7\.148\.102|9\.191\.246)|88\.8\.67)|5\.(?:31\.44\.24|48\.24\.1)0|4\.75\.215\.64|6\.254\.22\.51)|7(?:8\.(?:138\.101\.4|29\.4\.78)|7\.106\.232\.178|6\.74\.186\.237|2\.35\.20\.131|4\.9\.203\.186)|5(?:9\.1(?:08\.47\.58|25\.64\.4)|8\.150\.97\.242|\.39\.220\.254|0\.97\.3\.89)|3(?:7\.(?:122\.20(?:8\.(?:148|237)|9\.89)|206\.210\.130)|6\.226\.2\.18)|4(?:6\.(?:182\.24\.130|20\.67\.244|32\.232\.86)|1\.137\.24\.4))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:2(?:1(?:6\.55\.162|7\.161\.3)|20\.224\.59)|186\.46\.107)|9\.(?:1(?:49\.148\.150|93\.93\.25)|201\.141\.81)|8\.(?:1(?:66\.210\.111|14\.77\.116)|41\.157\.7)|5\.(?:115\.81\.138|88\.119\.132|90\.96\.85)|4\.(?:45\.2(?:37\.70|5\.83)|207\.113\.55)|0\.1(?:65\.125\.152|89\.168\.171)|6\.1(?:24\.128\.138|12\.66\.102)|7\.211\.91\.147|3\.0\.85\.249)|8(?:4\.(?:82\.(?:2(?:9\.3[34]|35\.212)|120\.2(?:10|35))|22\.1(?:1\.[45]|77\.50|0\.51)|107\.58\.135)|0\.(?:2(?:25\.131\.176|11\.179\.30)|96\.16\.(?:7[02]|69))|8\.(?:168\.46\.53|252\.0\.237|95\.48\.216)|6\.(?:237\.39\.147|84\.207\.201)|9\.(?:169\.20\.202|39\.35\.168)|7\.(?:120\.127\.27|4\.80\.188)|3\.81\.152\.228)|7(?:4\.3(?:6\.16(?:0\.157|4\.184|7\.116)|7\.1(?:67\.1(?:03|22)|48\.77))|8\.(?:(?:163\.105\.5|33\.144\.13)2|20(?:7\.158\.230|\.148\.11))|3\.(?:192\.14(?:4\.105|7\.114)|232\.45\.4[01])|7\.(?:80\.102\.214|1\.223\.73)|6\.61\.143\.(?:13|60)|5\.197\.121\.20)|9(?:5\.(?:1(?:38\.19
5\.125|91\.184\.82)|29\.81\.30)|9\.(?:30\.137\.13[89]|168\.141\.98|255\.11\.29)|2\.(?:198\.102\.(?:35|44)|74\.251\.118)|(?:3\.255\.143\.6|8\.15\.97\.4)3|(?:0\.82\.89\.15|4\.106\.16\.)6)|2(?:1\.(?:1(?:81\.251\.188|56\.66\.110)|2(?:54\.171\.15|2\.127\.17)|78\.119\.193|88\.255\.202)|8\.1(?:21\.64\.1(?:01|33)|34\.37\.115)|3\.110\.175\.202|2\.166\.83\.78)|03\.9\.15(?:8\.1(?:10|47)|7\.181|6\.89)|4(?:4\.76\.83\.111|\.33\.121\.67)|58\.255\.2\.6[0278]|33\.242\.115\.39)|2(?:0(?:0\.(?:14(?:8\.125\.247|2\.133\.21)|7(?:2\.11\.132|9\.27\.60)|35\.151\.24|47\.10\.209)|8\.(?:71\.172\.(?:8[579]|9[124])|82\.114\.2[35]|113\.254\.39)|2\.(?:1(?:42\.203\.19|58\.39\.250)|71\.136\.200)|3\.(?:2(?:55\.15\.146|38\.95\.11)|155\.102\.2)|1\.(?:22\.7\.225|45\.114\.3))|1(?:1\.(?:1(?:11\.250\.177|47\.211\.16)|206\.133\.94|54\.17\.200)|3\.(?:1(?:71\.39\.154|32\.241\.7)|230\.128\.226)|8\.15(?:3\.247\.68|8\.3\.1|9\.9\.7)|7\.(?:200\.184\.87|198\.3\.238)|0\.(?:245\.89\.6|51\.44\.19)9|2\.(?:48\.64\.23|6\.152\.21)1
|9\.145\.110\.118|6\.194\.34\.210)|2(?:2\.(?:23(?:1\.57\.117|4\.3\.151|6\.16\.14)|100\.14(?:0\.4|\.3))|0\.9(?:0\.201\.143|4\.235\.200)|1\.214\.208\.226|3\.26\.193\.53)|4\.127\.201\.172)|8(?:(?:3\.18\.234\.20|2\.207\.51\.9)2|(?:8\.208\.249\.9|1\.23\.106\.7)5|6\.(?:111\.144\.194|64\.171\.198)|7\.(?:236\.232\.231|97\.215\.67)|9\.121\.194\.27|\.33\.183\.1)|9(?:3\.1(?:5(?:7\.148\.102|9\.191\.246)|88\.8\.67)|5\.(?:(?:31\.44\.24|48\.24\.1)0|86\.4\.79)|4\.189\.183\.70|6\.254\.22\.51)|6(?:1\.(?:252\.138\.195|147\.69\.79|70\.83\.58|32\.38\.3)|3\.141\.239\.216|0\.196\.58\.189|5\.60\.15\.184)|7(?:8\.(?:138\.101\.4|29\.4\.78)|7\.106\.232\.178|6\.74\.186\.237|2\.35\.20\.131|4\.9\.203\.186)|5(?:\.(?:39\.220\.254|82\.192\.73)|9\.1(?:08\.47\.58|25\.64\.4)|8\.150\.97\.242|0\.97\.3\.89)|3(?:7\.(?:122\.20(?:8\.(?:148|237)|9\.89)|206\.210\.130)|6\.226\.2\.18)|4(?:6\.(?:32\.232\.(?:18|86)|182\.24\.130|20\.67\.244)|1\.137\.24\.4))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work