You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2014/02/14 08:57:30 UTC
svn commit: r1568211 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Fri Feb 14 07:57:29 2014
New Revision: 1568211
URL: http://svn.apache.org/r1568211
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1568211&r1=1568210&r2=1568211&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Fri Feb 14 07:57:29 2014
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201402132
+## khop-sc-neighbors.cf v 201402142
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:[25]|(?:18|4)6)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:(?:18|4)6|9?5)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -42,7 +42,7 @@ score KHOP_SC_CIDR8 0.1 0.02 0.2 0.1
# 1.5335/0.5063 0.752 20130629@465k net, solo=1.5947/0.5379@0.748
# 2.0256/0.7432 0.732 20130705@376k solo=2.0429/0.7595@0.729, ->.1 .02 .2 .1
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|90)|37|95)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|90)|37|2)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:98\.(?:143\.128|246\.46)|73\.208\.215|03\.25\.146|23\.64\.199)|(?:217\.13\.15|60\.29\.10)4|3(?:1\.192\.111|7\.48\.66)|50\.193\.157|74\.91\.31)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:98\.143\.128|23\.64\.199|85\.8\.107)|2(?:10\.183\.179|3\.231\.48)|6(?:9\.162\.115|0\.29\.104)|5(?:0\.193\.157|\.255\.64)|37\.48\.66)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:0\.234\.10[56]|8\.143\.150)|8(?:1\.66\.15[67]|3\.182\.39)|1(?:8\.244\.239|6\.112\.66)|2(?:0\.143\.5|5\.93\.77)|03\.25\.14[56]|73\.208\.186)|(?:221\.238\.2|31\.192\.11|61\.163\.10)1|9(?:3\.115\.85|4\.20\.224)|79\.124\.58)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:0\.234\.10[56]|8\.143\.150)|8(?:1\.66\.15[67]|3\.182\.39)|1(?:8\.244\.239|6\.112\.66)|2(?:0\.143\.5|5\.93\.77)|03\.25\.14[56])|(?:221\.238\.2|31\.192\.11|61\.163\.10)1|9(?:3\.115\.85|4\.20\.224)|79\.124\.58)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:2(?:1(?:6\.(?:86\.253|30\.50)|7\.161\.3)|20\.224\.59)|1(?:84\.172\.244|59\.101\.37|63\.149\.29))|4\.(?:141\.253\.14|247\.23\.66|32\.177\.77|4\.31\.90)|(?:5\.88\.119\.13|6\.112\.66\.10|8\.244\.239\.)2|3\.1(?:30\.65\.161|96\.70\.128)|9\.42\.147\.114)|9(?:8\.(?:143\.1(?:50\.2(?:4[0789]|5[012]|39)|28\.1(?:39|44))|246\.46\.27)|2\.(?:129\.253\.174|208\.183\.198|3\.46\.236)|3\.(?:109\.69\.149|238\.111\.26|35\.58\.205)|0\.107\.140\.76|7\.253\.6\.68)|8(?:(?:7\.162\.253|3\.23\.230)\.250|4\.(?:22\.53\.190|82\.123\.85)|5\.(?:25\.150\.212|8\.107\.51)|0\.67\.207\.162|8\.73\.128\.28)|2(?:5\.(?:88\.123\.244|93\.77\.125|46\.24\.62)|1\.(?:151\.122\.38|88\.54\.17)|8\.140\.219\.105|3\.200\.28\.77|4\.160\.35\.2)|78\.(?:175\.159\.93|248\.43\.106))|2(?:1(?:0\.(?:2(?:17\.150\.19[56]|09\.18\.73|8\.96\.54)|183\.179\.(?:3[89]|44)|51\.23\.91)|1\.(?:2(?:1(?:8\.27\.112|\.100\.250)|20\.194\.144|3\.152\.19)|115\.71\.18)|(?:3\.135\.113\.19|2\.98\.171\.
15)7|(?:7\.13\.154\.15|8\.151\.141\.7)5|9\.14(?:0\.69\.12|7\.172\.)2)|2(?:1\.(?:2(?:3(?:2\.247\.27|8\.21\.251)|14\.2(?:08\.226|14\.187))|178\.236\.19)|0\.(?:(?:164\.162\.2|255\.37\.15)2|68\.224\.45)|2\.(?:7(?:8\.247\.67|4\.200\.2)|200\.182\.65))|0(?:2\.(?:1(?:30\.114\.130|97\.68\.201)|(?:82\.202\.22|77\.108\.5)8|234\.40\.41)|9\.(?:239\.115\.85|50\.156\.232)|0\.206\.12\.250)|3\.231\.48\.(?:10|72)|7\.151\.127\.13|4\.48\.219\.49)|6(?:0\.(?:190\.92\.234|29\.104\.197)|1\.(?:163\.101\.42|38\.252\.21)|9\.(?:65\.48\.125|9\.42\.219))|5(?:9\.1(?:2(?:0\.66\.83|5\.41\.70)|0\.248\.207)|0\.193\.157\.62|8\.151\.38\.107|\.255\.64\.246)|7(?:9\.124\.58\.1(?:5[012345678]|[34]\d)|(?:7\.106\.232\.1|8\.29\.4\.)78|2\.9\.107\.69)|3(?:1\.1(?:92\.111\.(?:[789]\d|6[89]|100)|86\.87\.231)|7\.48\.66\.(?:18?|24|3))|8(?:7\.204\.110\.176|4\.203\.244\.50|5\.185\.112\.8)|9(?:3\.115\.85\.2(?:4[012345]|3\d)|4\.77\.199\.148)|4(?:6\.182\.92\.117|1\.137\.24\.4))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:1(?:48\.206\.195|84\.172\.244|59\.101\.37|63\.149\.29)|216\.(?:(?:105\.9|30\.5)0|86\.253))|4\.(?:141\.253\.14|247\.23\.66|32\.177\.77|4\.31\.90)|8\.(?:163\.29\.53|244\.239\.2|46\.127\.36)|6\.(?:112\.66\.102|48\.159\.51)|0\.189\.168\.171|3\.196\.70\.128|5\.88\.119\.132|9\.42\.147\.114)|9(?:2\.(?:1(?:19\.174\.(?:13|9)|29\.253\.174)|208\.183\.198|3\.46\.236)|8\.(?:143\.1(?:50\.2(?:4[0789]|5[012]|39)|28\.144)|246\.46\.27)|3\.(?:109\.69\.14[79]|238\.111\.26|35\.58\.205)|0\.107\.140\.76|5\.205\.237\.15|7\.253\.6\.68)|8(?:4\.(?:107\.159\.154|82\.123\.85)|8\.(?:138\.237\.211|73\.128\.28)|(?:7\.162\.253|3\.23\.230)\.250|5\.(?:25\.150\.212|8\.107\.51)|0\.67\.207\.162)|2(?:5\.(?:88\.123\.244|93\.77\.125)|1\.(?:151\.122\.38|88\.54\.17)|3\.(?:64\.199\.22|200\.28\.7)7|8\.140\.219\.105|4\.160\.35\.2|\.172\.93\.58)|4(?:8\.223\.59\.140|\.63\.74\.204)|78\.(?:175\.159\.93|248\.43\.106)|09\.236\.89\.2(?:18|27))|2(?:1(?:1\.(?:2(?:1(?:8\.27\
.112|\.100\.250)|20\.194\.144|3\.152\.19)|53\.209\.117|115\.71\.18|44\.103\.11)|0\.(?:183\.179\.(?:3[89]|4[45])|2(?:09\.18\.73|8\.96\.54)|51\.23\.91)|9\.(?:14(?:0\.69\.12|7\.172\.)2|238\.181\.120)|(?:7\.13\.154\.15|8\.151\.141\.7)5|3\.1(?:35\.113\.197|71\.39\.154)|2\.98\.171\.157)|0(?:2\.(?:1(?:30\.114\.130|97\.68\.201)|(?:82\.202\.22|77\.108\.5)8|234\.40\.41)|0\.(?:7(?:2\.11\.132|9\.27\.60)|206\.12\.250)|9\.(?:239\.115\.85|50\.156\.232)|1\.164\.155\.14)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|38\.21\.251)|178\.236\.19)|2\.(?:7(?:8\.247\.67|4\.200\.2)|200\.182\.65)|0\.(?:255\.37\.152|68\.224\.45))|3\.231\.48\.(?:10|72)|4\.48\.219\.49)|6(?:1\.(?:3(?:8\.252\.21|5\.92\.92)|163\.101\.42)|9\.(?:2\.182\.236|65\.48\.125|9\.42\.219)|8\.65\.2(?:40\.25[023]|52\.18[78])|0\.(?:190\.92\.234|29\.104\.197)|7\.(?:210\.247\.25|90\.21\.150)|4\.235\.49\.183)|5(?:9\.(?:1(?:2(?:0\.(?:66\.8|76\.2)3|5\.41\.70)|0\.248\.207)|4\.113\.117)|\.255\.64\.24[689]|0\.193\.157\.62|8\.64\.200\.150)|8(?:3\.(?:18\.234\.
202|238\.208\.55)|2\.117\.194\.229|7\.204\.110\.176|4\.203\.244\.50|5\.185\.112\.8)|7(?:7\.(?:106\.232\.178|89\.162\.82)|2\.(?:35\.20\.131|9\.107\.69)|4\.122\.196\.16|8\.29\.4\.78)|9(?:3\.(?:1(?:15\.85\.2(?:4[012345]|3[789])|88\.8\.67)|90\.102\.194)|4\.77\.199\.148)|3(?:1\.192\.111\.(?:[789]\d|6[89]|100)|7\.48\.66\.(?:18?|24|3))|4(?:6\.182\.92\.117|1\.137\.24\.4))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work