You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2014/01/04 08:58:24 UTC
svn commit: r1555330 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sat Jan 4 07:58:24 2014
New Revision: 1555330
URL: http://svn.apache.org/r1555330
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1555330&r1=1555329&r2=1555330&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sat Jan 4 07:58:24 2014
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20140132
+## khop-sc-neighbors.cf v 20140142
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -81,7 +81,7 @@ score KHOP_SC_CIDR16 0.4 0.1 0.4 0.1
# crap, still empty 20130629@465k net
# crap, still empty 20130705@376k net. lowering for low vol -> .4 .1 .4 .1
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:8(?:4\.228|9\.137)|190\.(?:192|247)|9(?:2\.84|4\.96))(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:8(?:4\.228|9\.137)|9(?:2\.84|4\.96)|190\.247)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0.3
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:3\.208\.22[27]|8\.32\.92)|0(?:1\.15\.30|6\.3\.32)|21\.54\.5[48])|2(?:1(?:3\.135\.113|2\.67\.215|9\.140\.69)|06\.214\.87)|80\.193\.214|91\.218\.115)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:1\.15\.30|6\.3\.32)|73\.208\.22[27]|21\.54\.5[48])|2(?:1(?:3\.135\.113|2\.67\.215|9\.140\.69)|06\.214\.87)|58\.25(?:1\.146|4\.172)|46\.102\.186)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:8\.143\.1(?:32|50)|0\.234\.10[56])|2(?:1\.17\.125|5\.60\.156|0\.84\.13)|03\.24(?:0\.254|3\.153)|15\.82\.2(?:44|52)|81\.66\.15[67]|57\.250\.132|75\.96\.176)|2(?:22\.100\.234|17\.23\.12|4\.244\.23)|(?:88\.196\.6|31\.14\.2)3|70\.98\.78)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:8\.143\.1(?:32|50)|0\.234\.10[56])|2(?:1\.17\.125|5\.60\.156|0\.84\.13)|15\.82\.2(?:44|52)|81\.66\.15[67]|03\.240\.254|57\.250\.132)|2(?:22\.100\.234|17\.23\.12|4\.244\.23)|9(?:1\.218\.115|4\.20\.224)|(?:88\.196\.6|31\.14\.2)3|70\.98\.78)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:1(?:29\.166\.86|42\.19\.172|63\.29\.53)|69\.205\.202|97\.95\.185)|2\.(?:2(?:20\.(?:224\.59|67\.130)|16\.48\.252)|184\.172\.244)|5\.(?:8(?:2\.2(?:44\.203|52\.220)|8\.119\.132)|68\.15\.73)|4\.(?:2(?:07\.113\.10|47\.23\.6)6|141\.253\.14)|0\.(?:189\.168\.171|45\.138\.138)|9\.(?:194\.153\.187|42\.147\.114)|1\.207\.163\.179|3\.161\.96\.211|6\.193\.90\.26)|2(?:1\.1(?:5(?:1\.122\.45|8\.198\.78)|7\.125\.(?:1[34567]|20)|81\.252\.228)|4\.95\.155\.(?:27|58)|2\.182\.28\.245|5\.143\.97\.97|0\.50\.86\.3)|9(?:8\.143\.1(?:50\.2(?:3[0125]|4[3679]|5[02]|29)|32\.23[57])|0\.(?:54\.13\.10|82\.89\.15)6|4\.1(?:77\.40\.195|06\.16\.6)|5\.205\.237\.15)|8(?:3\.1(?:06\.1(?:45\.24|50\.78)|81\.38\.90)|0\.149\.96\.1(?:69|70)|4\.82\.123\.85|8\.252\.0\.237)|7(?:3\.208\.2(?:2(?:2\.(?:10[689]|98)|7\.(?:10|9))|15\.164)|5\.96\.176\.204|8\.32\.92\.98)|4(?:0\.137\.(?:12\.10|207\.3)2|8\.223\.59\.140|\.63\.74\.204)|0(?:1\.(?:15\.30\.58|79\.5\.19)|6\.3\.32\.153)
|34\.255\.246\.102|62\.242\.171\.158|\.234\.38\.106)|2(?:1(?:1\.(?:23(?:0\.74\.17|\.152\.19)|54\.17\.20[01]|115\.89\.141)|8\.(?:1(?:1\.167\.126|59\.9\.7)|234\.108\.13|71\.140\.226)|0\.(?:1(?:83\.179\.4[45]|76\.252\.201)|0\.203\.76)|7\.(?:23\.12\.(?:1(?:5[34]|61)|202)|13\.154\.155)|3\.(?:1(?:35\.113\.197|71\.39\.154)|81\.164\.57)|(?:6\.191\.208\.20|9\.140\.69\.12)2|2\.(?:144\.254\.122|67\.215\.159))|0(?:2\.(?:1(?:(?:30\.114\.13|29\.216\.6|58\.39\.25)0|18\.236\.178|42\.203\.19)|2(?:07\.1\.234|34\.40\.41)|71\.136\.200|53\.13\.187)|0\.(?:1(?:11\.103\.68|75\.56\.190)|7(?:2\.11\.132|9\.27\.60))|1\.(?:116\.199\.34|77\.202\.68)|3\.23(?:8\.64\.250|9\.45\.202))|2(?:1\.(?:2(?:3(?:2\.144\.164|4\.24\.46)|14\.2(?:08\.226|14\.187))|1(?:53\.158\.37|65\.38\.226))|2\.(?:100\.234\.251|99\.202\.239|73\.93\.153)|0\.(?:94\.235\.200|68\.224\.45))|4\.157\.46\.197)|8(?:3\.(?:18\.234\.202|238\.208\.55)|8\.(?:255\.229\.10|196\.63\.25)|1\.(?:192\.48\.16|211\.80\.2)2|0\.193\.214\.226|2\.117\.194\.229|9\.207\.12
8\.165|5\.185\.112\.8)|6(?:(?:5\.255\.80\.15|0\.250\.218\.)2|1\.(?:106\.235\.180|84\.94\.15)|9\.198\.197\.156|7\.90\.21\.150)|3(?:1\.14\.23\.(?:4[0235789]|5[0156789]|2[013]|1[89]|6[02]|35)|6\.250\.228\.10[023]|7\.123\.98\.115)|7(?:7\.106\.232\.178|5\.129\.57\.164|0\.50\.252\.70|2\.35\.20\.131|4\.9\.203\.186)|9(?:1\.218\.115\.1(?:3[023]|6[23])|4\.77\.199\.148|5\.211\.135\.83|3\.188\.8\.67)|5(?:9\.1(?:2(?:5\.240\.239|0\.76\.23)|1\.98\.232)|0\.199\.80\.33|8\.64\.207\.80)|4(?:1\.(?:137\.2[04]\.4|63\.166\.3)|6\.102\.186\.18[34]))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:2(?:20\.(?:224\.59|67\.130)|16\.(?:48\.25|55\.16)2)|184\.172\.244)|(?:4\.2(?:07\.113\.10|47\.23\.6)|6\.193\.90\.2)6|8\.(?:1(?:29\.166\.86|63\.29\.53)|97\.95\.185)|9\.(?:194\.153\.187|201\.16\.211|42\.147\.114)|5\.8(?:2\.2(?:44\.203|52\.220)|8\.119\.132)|(?:0\.189\.168\.17|3\.161\.96\.21)1|1\.207\.163\.179)|2(?:1\.1(?:5(?:1\.122\.45|8\.198\.78|9\.11\.164)|3(?:4\.238\.129|7\.91\.42)|7\.125\.(?:1[34567]|20)|81\.252\.228)|4\.(?:95\.155\.(?:27|58)|160\.35\.2)|5\.(?:88\.123\.244|143\.97\.97)|2\.1(?:82\.28\.245|55\.0\.44)|0\.50\.86\.3)|9(?:8\.143\.1(?:50\.2(?:4[03679]|3[0125]|5[02]|29)|32\.23[57])|0\.(?:8(?:2\.89\.156|\.44\.77)|54\.13\.106)|5\.20(?:0\.171\.162|5\.237\.15)|4\.1(?:77\.40\.195|06\.16\.6))|8(?:3\.1(?:06\.1(?:45\.24|50\.78)|81\.38\.90)|0\.149\.96\.1(?:69|70)|4\.82\.123\.85|8\.252\.0\.237)|7(?:3\.208\.2(?:2(?:2\.(?:10[689]|98)|7\.(?:10|9))|15\.164)|5\.96\.176\.204)|4(?:0\.137\.(?:12\.10|207\.3)2|8\.223\.59\.140|\.63
\.74\.204)|0(?:1\.(?:15\.30\.58|79\.5\.19)|6\.3\.32\.153)|34\.255\.246\.102|62\.248\.79\.[23]|\.234\.38\.106)|2(?:1(?:7\.(?:23\.12\.(?:1(?:5[34]|61)|202)|13\.154\.155|8\.255\.194)|0\.(?:1(?:83\.179\.(?:4[45]|39)|76\.252\.201)|0\.203\.76)|(?:9\.14(?:0\.69\.12|7\.172\.)|6\.191\.208\.20)2|3\.(?:1(?:35\.113\.197|71\.39\.154)|81\.164\.57)|1\.(?:54\.17\.20[01]|115\.89\.141|230\.74\.17)|8\.(?:234\.108\.13|71\.140\.226|159\.9\.7)|2\.(?:144\.254\.122|67\.215\.159))|0(?:2\.(?:1(?:(?:30\.114\.13|29\.216\.6|58\.39\.25)0|18\.236\.178|42\.203\.19)|2(?:07\.1\.234|34\.40\.41)|71\.136\.200|53\.13\.187)|0\.(?:1(?:11\.103\.68|75\.56\.190)|7(?:2\.11\.132|9\.27\.60))|1\.(?:116\.199\.34|77\.202\.68)|3\.23(?:8\.64\.250|9\.45\.202))|2(?:1\.(?:2(?:3(?:2\.144\.164|4\.24\.46)|14\.2(?:08\.226|14\.187))|1(?:53\.158\.37|65\.38\.226))|2\.(?:100\.234\.251|99\.202\.239|73\.93\.153)|0\.(?:130\.142\.42|68\.224\.45))|4\.157\.46\.197)|8(?:3\.(?:18\.234\.202|238\.208\.55)|8\.(?:255\.229\.10|196\.63\.25)|1\.(?:192\.48\.1
6|211\.80\.2)2|0\.193\.214\.226|2\.117\.194\.229|9\.207\.128\.165|6\.64\.142\.28)|9(?:1\.218\.115\.1(?:6[23589]|3[023]|8[67])|3\.1(?:57\.148\.102|88\.8\.67)|4\.77\.199\.148|5\.211\.135\.83)|6(?:1\.(?:106\.235\.180|84\.94\.15)|9\.198\.197\.156|5\.255\.80\.152|7\.90\.21\.150)|7(?:7\.106\.232\.178|5\.129\.57\.164|0\.50\.252\.70|2\.35\.20\.131|4\.9\.203\.186)|5(?:9\.1(?:25\.240\.239|1\.98\.232)|0\.199\.80\.33|8\.64\.207\.80)|3(?:1\.14\.23\.(?:5[0156789]|4[5789]|6[02])|7\.123\.98\.115)|4(?:1\.(?:137\.2[04]\.4|63\.166\.3)|6\.102\.186\.18[348]))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:(?:12|8)[4567]|7[124578]?|[46][89]?|5[01]?)|6\.207\.(?:6[0123]|1[234]|4[89]|5\d)|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|9\.36\.21[23]|0\.205\.35|2\.215\.44)|8(?:3\.9(?:3\.(?:1[12][45]|9[89])|5\.6[67])|6\.(?:251\.14[123]|37\.203)|1\.66\.15[67])|2(?:(?:3\.136\.10|5\.60\.15)6|2\.155\.34|1\.54\.58)|9(?:0\.234\.10[56]|7\.252\.[01]|8\.50\.188)|0(?:3\.24(?:0\.117|3\.190)|9\.127\.8[06])|30\.193\.1(?:4[67]|65)|77\.36\.22)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.191\.26|6\.214\.87)|4\.244\.23)|58\.(?:50\.1(?:[2345]|0[456789]|1\d)|19\.19[01])|7(?:9\.106\.109|0\.98\.78)|41\.254\.[2568]|88\.217\.18[01])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.176\.(?:(?:12|8)[4567]|7[01245789]?|[46][89]?|5[01]?)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|2\.215\.[46]4|9\.36\.21[23]|0\.205\.35)|8(?:3\.9(?:3\.(?:1[12][45]|9[89])|5\.6[67])|6\.(?:251\.14[123]|37\.203)|1\.66\.15[67]|0\.255\.248)|2(?:(?:3\.136\.10|5\.60\.15)6|2\.155\.34|1\.54\.58)|0(?:3\.24(?:(?:0\.11|2\.)7|3\.190)|9\.127\.8[06])|9(?:0\.234\.10[56]|7\.252\.[01]|8\.50\.188)|30\.193\.1(?:4[67]|65)|77\.36\.22)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.191\.26|6\.214\.87)|4\.244\.23)|58\.(?:5(?:0\.(?:1(?:[2345]|0[456789]|1\d)|68|70)|4\.18[456])|19\.19[01])|41\.2(?:54\.[2568]|23\.162)|7(?:9\.106\.109|0\.98\.78)|88\.217\.18[01])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6