You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/10/27 07:57:19 UTC
svn commit: r1536058 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sun Oct 27 06:57:19 2013
New Revision: 1536058
URL: http://svn.apache.org/r1536058
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1536058&r1=1536057&r2=1536058&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sun Oct 27 06:57:19 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201310262
+## khop-sc-neighbors.cf v 201310272
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:117|9?5|46)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|46|95)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -81,7 +81,7 @@ score KHOP_SC_CIDR16 0.4 0.1 0.4 0.1
# crap, still empty 20130629@465k net
# crap, still empty 20130705@376k net. lowering for low vol -> .4 .1 .4 .1
-header KHOP_SC_TOP_CIDR16 Received =~ /___ FAILED TO POPULATE ___/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b8(?:5\.105|9\.121)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0.3
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:4(?:2\.11\.195|1\.0\.61)|84\.22\.172|03\.9\.157|21\.54\.54|94\.105\.9)|2(?:2(?:2\.122\.227|1\.4\.142)|06\.214\.72)|58\.254\.172|85\.204\.147)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:84\.22\.(?:172|230)|73\.44\.168|03\.9\.157|21\.54\.54|94\.105\.9|41\.0\.61)|2(?:2(?:2\.122\.227|1\.4\.142)|06\.214\.72)|31\.192\.108|85\.204\.147)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:8\.24\.17[45]|9\.96\.83)|0(?:3\.243\.50|9\.169\.88)|2(?:5\.60\.156|0\.84\.13)|1(?:2\.97\.24|0\.52\.0)|42\.11\.195)|(?:31\.192\.10|86\.57\.18)8|213\.132\.241|46\.102\.186|91\.218\.245|64\.79\.99)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:8\.24\.17[45]|9\.96\.83)|0(?:3\.243\.50|9\.169\.88)|2(?:5\.60\.156|0\.84\.13)|1(?:2\.97\.24|0\.52\.0)|42\.11\.195)|4(?:6\.102\.186|1\.254\.5)|213\.132\.241|91\.218\.245|64\.79\.99)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:1(?:30\.107\.235|63\.156\.109)|(?:97\.196\.16|41\.157\.)3)|2\.(?:1(?:84\.172\.244|64\.62\.8)|216\.46\.75)|9\.(?:42\.147\.114|193\.93\.25|37\.195\.59)|4\.(?:141\.253\.14|247\.23\.66|33\.22\.29)|5\.8(?:0\.227\.233|8\.119\.132|2\.241\.34)|6\.228\.65\.228)|9(?:9\.(?:96\.83\.1(?:3[012456789]|4[01235689]|5[0134])|30\.137\.1[67])|8\.24\.1(?:7(?:4\.16[37]|5\.[234]|3\.80)|80\.91)|5\.(?:2(?:06\.38\.48|52\.108\.6)|138\.195\.125)|4\.10(?:5\.9\.85|6\.16\.6)|2\.252\.213\.128|0\.107\.140\.77)|7(?:3\.2(?:12\.205\.158|00\.90\.196)|4\.(?:142\.53\.251|76\.130\.40)|7\.(?:1\.223\.73|69\.8\.50)|5\.96\.180\.175|6\.31\.14\.113)|0(?:3\.(?:243\.50\.5[0468]|9\.157\.12[679]|31\.241\.16)|1\.(?:15\.123\.255|44\.3\.50)|9\.169\.88\.1(?:3[69]|4[04]))|8(?:4\.(?:22\.(?:1(?:7(?:2\.14[45]|7\.51)|97\.216)|230\.213)|82\.179\.117)|8\.252\.0\.237|9\.38\.248\.41)|4(?:8\.223\.59\.187|0\.133\.45\.25|1\.0\.61\.166|\.63\.74\.204)|2(?:1\.(?:78\.119\.193|88\.54\.17)|
2\.182\.28\.245)|\.224\.163\.99)|2(?:0(?:2\.(?:1(?:1(?:7\.120\.(?:8[29]|24)|8\.236\.178)|(?:29\.216\.6|58\.39\.25)0|42\.203\.19)|5(?:2\.146\.38|3\.13\.187)|71\.136\.200|234\.40\.41)|0\.(?:(?:175\.56\.19|51\.45\.18)0|7(?:2\.11\.132|9\.27\.60))|3\.(?:23(?:9\.45\.202|8\.95\.11)|171\.233\.243)|1\.116\.199\.34)|1(?:1\.(?:23(?:4\.106\.54|7\.20\.39)|147\.211\.16)|3\.1(?:(?:71\.39\.15|95\.77\.11)4|32\.241\.13)|6\.(?:189\.101\.110|231\.140\.15)|2\.109\.182\.10|8\.151\.141\.75|0\.245\.89\.69)|2(?:1\.(?:4\.142\.(?:5[678]|41)|214\.208\.226)|2\.1(?:12\.150\.58|22\.227\.10)))|6(?:4\.79\.(?:99\.(?:2(?:4[02345789]|3[78]|5[01])|1(?:7[01234]|6\d))|107\.13)|1\.(?:1(?:35\.130\.240|05\.174\.4)|222\.113\.196)|9\.198\.197\.156|5\.60\.15\.173|7\.90\.21\.150)|9(?:1\.218\.245\.(?:6[6789]|7[0123]|8[89]|94)|3\.1(?:59\.160\.164|88\.8\.67)|8\.143\.158\.34)|8(?:(?:2\.117\.194\.22|5\.204\.147\.)9|(?:7\.106\.173\.11|1\.23\.106\.7)5|3\.3\.103\.227)|7(?:(?:6\.164\.199\.7|2\.35\.20\.13)1|4\.(?:216\.223\.82|92\.74\.230
))|3(?:1\.192\.108\.1(?:3[34568]|4[123]|61)|7\.123\.98\.115)|46\.102\.186\.(?:[89]|1[34]))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:1(?:30\.107\.235|63\.156\.109)|(?:97\.196\.16|41\.157\.)3)|2\.(?:1(?:84\.172\.244|64\.62\.8)|216\.46\.75)|9\.(?:42\.147\.114|193\.93\.25|37\.195\.59)|4\.(?:141\.253\.14|247\.23\.66)|6\.(?:228\.65\.228|193\.90\.26)|5\.8(?:0\.227\.233|2\.241\.34))|9(?:9\.(?:96\.83\.1(?:3[012456789]|4[01235689]|5[0134689])|30\.137\.1[67])|8\.24\.1(?:7(?:4\.16[37]|5\.[234]|3\.80)|80\.91)|5\.2(?:06\.38\.48|52\.108\.6)|4\.10(?:5\.9\.85|6\.16\.6))|7(?:3\.2(?:12\.205\.158|00\.90\.196)|4\.(?:142\.53\.251|76\.130\.40)|7\.(?:1\.223\.73|69\.8\.50)|5\.96\.180\.175|6\.31\.14\.113)|0(?:3\.(?:243\.50\.(?:5[468]|63)|9\.157\.12[679]|31\.241\.16)|1\.(?:15\.123\.255|44\.3\.50)|9\.169\.88\.1(?:3[69]|4[04]))|8(?:4\.(?:22\.(?:1(?:7(?:2\.14[45]|7\.51)|97\.216)|230\.213)|82\.179\.117)|8\.252\.0\.237)|4(?:8\.223\.59\.187|0\.133\.45\.25|1\.0\.61\.166|\.63\.74\.204)|2(?:2\.182\.28\.245|1\.88\.54\.17|0\.50\.86\.3)|\.224\.163\.99)|2(?:0(?:2\.(?:1(?:1(?:7\.120\.(?:8[
29]|24)|8\.236\.178)|(?:29\.216\.6|58\.39\.25)0|42\.203\.19)|5(?:2\.146\.38|3\.13\.187)|71\.136\.200|234\.40\.41)|0\.(?:(?:175\.56\.19|51\.45\.18)0|7(?:2\.11\.132|9\.27\.60))|3\.171\.233\.243|1\.116\.199\.34)|1(?:1\.(?:23(?:4\.106\.54|7\.20\.39)|147\.211\.16)|3\.1(?:(?:71\.39\.15|95\.77\.11)4|32\.241\.13)|6\.(?:189\.101\.110|231\.140\.15)|2\.109\.182\.10|8\.151\.141\.75|0\.245\.89\.69)|2(?:1\.(?:2(?:14\.208\.226|04\.223\.38)|4\.142\.(?:5[678]|41))|2\.(?:1(?:12\.150\.58|22\.227\.10)|231\.57\.104))|4\.(?:153\.129\.102|237\.229\.37))|6(?:4\.79\.(?:99\.(?:2(?:4[02345789]|3[78]|5[01])|1(?:7[01234]|6\d))|107\.13)|1\.1(?:35\.130\.240|05\.174\.4)|9\.198\.197\.156|0\.251\.31\.134|5\.60\.15\.173|7\.90\.21\.150|8\.64\.166\.67)|8(?:(?:2\.117\.194\.22|5\.204\.147\.)9|(?:7\.106\.173\.11|1\.23\.106\.7)5|3\.(?:18\.234\.202|3\.103\.227)|4\.22\.61\.190)|9(?:1\.218\.245\.(?:6[6789]|7[0123])|3\.1(?:59\.160\.164|88\.8\.67)|8\.143\.158\.34)|7(?:(?:6\.164\.199\.7|2\.35\.20\.13)1|4\.(?:216\.223\.82|92\.74\
.230))|3(?:1\.192\.108\.1(?:4[123]|3[68])|7\.123\.98\.115)|4(?:6\.102\.186\.(?:[89]|1[34678])|9\.218\.33\.215))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|0\.(?:205\.3[34]|52\.[0123])|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|2\.215\.(?:6[34]|44)|9\.36\.21[23])|0(?:3\.(?:2(?:4(?:0\.(?:117|252)|2\.7)|6\.29)|7\.243|5\.27)|9\.127\.8[01])|8(?:3\.9(?:3\.(?:11[45]|98)|5\.6[67])|1\.66\.15[67])|25\.(?:44\.24[01234567]|60\.156)|9(?:0\.234\.10[56]|2\.95\.63)|7(?:3\.44\.168|7\.36\.22)|30\.193\.165)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|1(?:1\.91\.22[01]|2\.34\.12))|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|6[89]|7[01])|19\.19[01])|9\.55\.25[2345])|4(?:1\.254\.[25]|6\.249\.82)|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|0\.(?:205\.3[234]|52\.[0123])|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|2\.215\.(?:6[34]|44)|9\.36\.21[23])|0(?:3\.(?:2(?:4(?:0\.(?:117|252)|2\.7)|6\.29)|7\.243|5\.27)|9\.127\.8[01])|8(?:3\.9(?:3\.(?:11[45]|98)|5\.6[67])|1\.66\.15[67])|25\.(?:44\.24[01234567]|60\.156)|9(?:0\.234\.10[56]|7\.252\.0)|7(?:3\.44\.168|7\.36\.22)|30\.193\.1(?:46|65))|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|1(?:1\.91\.22[01]|2\.34\.12))|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|7[01]|69)|19\.19[01])|9\.55\.25[2345])|4(?:1\.254\.[258]|6\.249\.82)|79\.106\.109|37\.0\.120)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6