You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/09/20 08:58:02 UTC
svn commit: r1524918 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Fri Sep 20 06:58:01 2013
New Revision: 1524918
URL: http://svn.apache.org/r1524918
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1524918&r1=1524917&r2=1524918&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Fri Sep 20 06:58:01 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201309192
+## khop-sc-neighbors.cf v 201309202
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:18[68]|37|5)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:8[68]|13)|37)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:03\.(?:30\.72|9\.157)|84\.(?:22\.27|82\.53)|12\.90\.222|99\.30\.137|21\.54\.54)|(?:64\.120\.16|98\.126\.24)9|5(?:8\.254\.172|0\.30\.47)|211\.119\.86)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:3\.(?:30\.72|9\.157)|1\.8\.236)|(?:99\.30\.13|84\.22\.2)7|12\.90\.222|78\.20\.148|21\.54\.54|38\.91\.79)|211\.119\.86|58\.254\.172|64\.120\.169)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:5\.60\.156|0\.84\.13)|01\.(?:15\.247|8\.236)|98\.24\.17[45]|12\.97\.24)|2(?:13\.132\.241|06\.214\.95|21\.4\.142)|91\.218\.115|75\.75\.240|69\.64\.49)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:5\.60\.156|0\.84\.13)|98\.24\.17[45]|01\.15\.247|84\.82\.53)|2(?:13\.132\.241|06\.214\.95|21\.4\.142)|91\.218\.115|75\.75\.240|69\.64\.49)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:2(?:1(?:6\.105\.90|7\.161\.3)|20\.31\.132)|1(?:84\.172\.244|63\.150\.30|24\.7\.137)|94\.224\.236)|(?:0\.76\.43\.2|6\.193\.90\.)26|3\.(?:161\.78\.222|0\.85\.249)|1\.249\.131\.159|9\.149\.148\.150|8\.175\.28\.3)|8(?:4\.(?:22\.(?:1(?:7(?:7\.5[12]|2\.145)|97\.216|1\.23)|2(?:30\.213|7\.171|8\.222))|82\.(?:53\.1(?:06|43|1)|179\.117|251\.100))|0\.(?:2(?:25\.148\.206|11\.179\.30)|166\.124\.90)|3\.98\.23\.158|9\.75\.63\.114)|9(?:8\.24\.1(?:7(?:4\.16[67]|5\.[234]|3\.80)|80\.91)|0\.(?:107\.140\.77|7\.128\.44)|9\.30\.137\.10[67]|2\.163\.193\.199|6\.203\.198\.130|3\.33\.210\.41)|2(?:1\.(?:1(?:34\.238\.129|59\.11\.164)|22\.(?:127\.17|53\.226))|2\.(?:144\.11\.110|226\.95\.56)|3\.142\.218\.89|5\.46\.24\.62)|7(?:7\.(?:80\.102\.214|1\.223\.73)|8\.(?:20\.148\.11|63\.74\.6)|3\.212\.205\.158|4\.36\.137\.170)|0(?:1\.(?:(?:8\.236\.24|44\.3\.5)0|15\.247\.163)|3\.9\.157\.12[679])|\.(?:215\.206\.24|85\.17\.8)2|62\.216\.3\.1[45]|41\.0\.61\.166)|2
(?:1(?:1\.(?:1(?:19\.86\.1(?:4[378]|54)|72\.251\.168|91\.168\.166|57\.144\.27)|54\.17\.200)|3\.1(?:3(?:6\.105\.21[02]|2\.241\.13)|99\.248\.27)|9\.(?:239\.113\.97|147\.172\.2)|2\.(?:113\.32\.199|66\.60\.28)|8\.23\.57\.66)|0(?:6\.214\.95\.(?:7[012456789]|8[0123456]|6[689]|94)|3\.(?:171\.233\.243|239\.45\.202)|2\.(?:154\.192\.28|21\.182\.12)|8\.84\.135\.14[78]|7\.46\.132\.188)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|04\.223\.38)|4\.142\.(?:9[0123]|67))|2\.174\.54\.164|0\.68\.224\.45))|6(?:1\.(?:3(?:8\.186\.117|3\.162\.92)|19\.255\.120)|4\.(?:120\.169\.15[01]|206\.169\.165)|0\.(?:214\.223\.178|190\.43\.10)|6\.197\.212\.250|9\.64\.49\.109)|5(?:9\.(?:1(?:88\.16\.(?:9[159]|101)|0\.7\.16)|66\.250\.144)|8\.2(?:37\.102\.214|13\.157\.68)|0\.30\.47\.87)|8(?:(?:7\.103\.170\.6|5\.17\.75\.1)5|9\.1(?:35\.192\.40|20\.75\.51)|8\.191\.154\.103|2\.99\.246\.10)|9(?:1\.218\.115\.(?:5[23456789]|3[4589]|10[89]|4[039]|6[013])|(?:8\.126\.249\.10|3\.95\.98\.19)6)|7(?:5\.75\.240\.1(?:5[1234567]|3[89]|4\d)|7\.10
6\.232\.178|9\.134\.233\.195|8\.141\.66\.122)|4(?:1\.(?:84\.135\.22|137\.24\.4)|2\.121\.57\.248)|37\.5(?:7\.(?:158\.32|90\.39)|9\.61\.117))\b)/
+header KHOP_SC_TOP200 Received =~ /___ FAILED TO POPULATE ___/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|5\.(?:63\.(?:[89]|1[012345])|58\.13[34])|6\.207\.(?:6[0123]|1[345]|4[89]|5\d)|2\.(?:215\.(?:6[34]|44)|72\.13)|0\.(?:205\.3[25]|52\.[0123])|3\.56\.2(?:4[589]|5[01]|25)|9\.36\.21[23])|0(?:3\.(?:2(?:8\.184|0\.39)|30\.72|1\.69|5\.27)|9\.127\.8[01]|8\.174\.193)|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|6\.(?:123\.135|37\.203)|1\.66\.15[67])|2(?:5\.(?:44\.24[01234567]|60\.156)|3\.136\.106|2\.155\.44)|9(?:0\.(?:113\.21[01]|234\.10[56])|7\.252\.[01])|(?:42\.234\.18|77\.47\.10)6|30\.193\.1(?:46|65)|63\.125\.144)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.19(?:4\.115|1\.27)|2\.29\.17[67]|6\.246\.99)|22\.140\.15[89]|3\.106\.71)|5(?:8\.(?:50\.(?:1(?:[2345]|1[6789])|69|71)|19\.19[01])|9\.55\.254)|4(?:1\.254\.[1258]|9\.0\.11[89])|79\.106\.109|85\.153\.71)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|5\.(?:63\.(?:[89]|1[012345])|58\.134)|6\.207\.(?:6[0123]|1[345]|4[89]|5\d)|2\.(?:215\.(?:6[34]|44)|72\.13)|0\.(?:205\.3[25]|52\.[0123])|3\.56\.2(?:4[589]|5[01]|25)|9\.36\.21[23])|0(?:3\.(?:2(?:0\.3[79]|8\.184)|30\.72|1\.69|5\.27)|9\.127\.8[01]|8\.174\.193)|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|6\.(?:123\.135|37\.203)|1\.66\.15[67])|2(?:5\.(?:44\.24[01234567]|60\.156)|3\.136\.106|2\.155\.44)|9(?:0\.(?:113\.21[01]|234\.10[56])|7\.252\.[01])|30\.193\.1(?:46|65)|42\.234\.186|63\.125\.144)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.19(?:4\.115|1\.27)|2\.29\.17[67]|6\.246\.99)|22\.140\.15[89]|12\.34\.12|3\.106\.71)|5(?:8\.(?:50\.(?:1(?:[2345]|1[6789])|69)|19\.190)|9\.55\.254)|4(?:1\.254\.[1258]|9\.0\.11[89])|79\.106\.109|85\.153\.71)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6