You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2014/01/27 08:58:20 UTC
svn commit: r1561596 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Mon Jan 27 07:58:20 2014
New Revision: 1561596
URL: http://svn.apache.org/r1561596
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1561596&r1=1561595&r2=1561596&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Mon Jan 27 07:58:20 2014
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201401262
+## khop-sc-neighbors.cf v 201401272
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:117|9?5|46)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:[25]|117|46)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -42,7 +42,7 @@ score KHOP_SC_CIDR8 0.1 0.02 0.2 0.1
# 1.5335/0.5063 0.752 20130629@465k net, solo=1.5947/0.5379@0.748
# 2.0256/0.7432 0.732 20130705@376k solo=2.0429/0.7595@0.729, ->.1 .02 .2 .1
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|90)|37|2)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:78|90)|37|95)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:(?:2(?:0\.84|4\.42)\.1|84\.22\.5)3|73\.208\.215)|21(?:0\.183\.179|8\.159\.195|9\.139\.38)|6(?:1\.163\.101|0\.29\.104)|75\.144\.81|37\.48\.66)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:84\.22\.(?:197|53)|34\.255\.250|23\.64\.199)|6(?:1\.163\.101|0\.29\.104|9\.175\.40)|2(?:10\.183\.179|21\.238\.21)|75\.144\.81)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:1\.(?:50\.1[23]|9\.207)|3\.246\.195)|2(?:5\.(?:60\.156|93\.77)|0\.143\.54)|9(?:0\.234\.10[56]|8\.143\.150)|(?:73\.208\.18|16\.112\.6)6|81\.66\.15[67]|34\.255\.250|57\.14\.103)|9(?:1\.218\.245|4\.20\.224)|(?:31\.192\.11|74\.91\.3)1|2(?:21\.238\.21|17\.23\.6))\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:1\.(?:50\.1[23]|9\.207)|3\.246\.195)|9(?:0\.234\.10[56]|8\.143\.150)|2(?:0\.84\.13|5\.93\.77)|73\.208\.(?:186|215)|81\.66\.15[67]|34\.255\.250|16\.112\.66|57\.14\.103)|9(?:1\.218\.245|4\.20\.224)|(?:31\.192\.11|74\.91\.3)1|217\.23\.6)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:2(?:17\.180\.116|44\.239\.2)|4(?:6\.127\.36|1\.157\.3)|163\.156\.109)|2\.(?:216\.(?:105\.90|86\.253|46\.75)|1(?:84\.172\.244|68\.218\.86))|5\.(?:8(?:8\.119\.132|5\.64\.210)|92\.125\.186)|9\.(?:1(?:10\.108\.92|93\.93\.25)|42\.147\.114)|4\.(?:141\.253\.14|247\.23\.66|32\.177\.77)|(?:3\.130\.65\.16|7\.19\.75\.23)1|6\.1(?:12\.66\.102|93\.90\.26))|2(?:1\.(?:1(?:5(?:8\.198\.78|9\.11\.164)|34\.(?:238\.12|190\.5)9|81\.237\.251)|88\.54\.17)|2\.(?:147\.232\.10|49\.119\.18)8|5\.(?:131\.29\.100|93\.77\.125)|4\.(?:42\.13\.230|160\.35\.2)|3\.64\.199\.2(?:19|37))|8(?:4\.(?:22\.(?:1(?:97\.216|52\.8)|53\.(?:190?|201))|82\.1(?:7(?:1\.234|9\.117)|23\.85)|107\.159\.154)|8\.2(?:19\.14\.43|6\.102\.92)|2\.172\.22\.5[79]|3\.98\.235\.12)|9(?:8\.1(?:43\.150\.2(?:4[0789]|5[012]|39)|2\.80\.87)|0\.(?:107\.140\.76|90\.193\.202)|7\.(?:159\.16\.5|253\.6\.6)8|3\.109\.69\.147|5\.62\.172\.242)|0(?:1\.(?:9\.20(?:7\.(?:11|23)9|6\.167)|14\.88\.119|50\.12\.1
32)|6\.245\.2(?:40\.205|50\.6))|7(?:3\.2(?:08\.(?:186\.8[3456]|215\.164)|12\.205\.158)|2\.245\.62\.172)|63\.177\.132\.144|47\.175\.214\.72)|2(?:1(?:1\.(?:17(?:4\.(?:178\.175|215\.100)|2\.251\.168)|232\.154\.6)|9\.(?:1(?:4(?:0\.69\.12|7\.172\.)2|39\.38\.49)|238\.181\.120)|7\.23\.6\.(?:1(?:6[89]|08|46)|21[23])|(?:3\.135\.113\.19|6\.172\.98\.16)7|8\.15(?:9\.195\.251|1\.141\.75)|0\.183\.179\.(?:3[89]|4[45])|2\.220\.1\.15)|2(?:1\.2(?:3(?:2\.247\.27|8\.21\.251)|14\.2(?:08\.226|14\.187)|04\.223\.38)|2\.(?:1(?:00\.234\.251|22\.227\.10)|232\.130\.101|35\.61\.196))|0(?:2\.(?:2(?:07\.1\.234|34\.40\.41)|137\.22\.200|64\.73\.148|71\.98\.62)|3\.2(?:30\.112\.4[45]|52\.154\.246))|3\.2(?:54\.134\.17|45\.26\.9)6|7\.120\.103\.37|4\.48\.219\.49)|9(?:1\.218\.245\.(?:[456789]|2[012346789]?|1[012345689]|30?)|3\.(?:1(?:57\.148\.102|84\.71\.66)|90\.102\.194)|(?:2\.50\.155\.21|4\.77\.199\.14)8)|3(?:1\.1(?:92\.111\.(?:2(?:1[23456789]|2[01])|1(?:9[012]|8[89]))|70\.106\.90|86\.87\.231)|7\.48\.6(?:5\.121|6\.2))|
6(?:1\.(?:1(?:63\.101\.42|41\.21\.34|9\.246\.93)|98\.77\.169)|0\.(?:190\.92\.234|29\.104\.197)|9\.175\.40\.106)|7(?:8\.(?:36\.14\.195|29\.4\.78)|4\.91\.31\.2(?:29|30)|7\.106\.232\.178|5\.144\.81\.177|6\.72\.254\.222)|5(?:8\.(?:126\.157\.18|246\.179\.82)|9\.125\.240\.239|\.79\.81\.19[56])|85\.1(?:7\.27\.1(?:09|10)|85\.112\.8)|41\.137\.24\.4)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:2(?:17\.180\.116|44\.239\.2)|4(?:6\.127\.36|1\.157\.3)|163\.156\.109|97\.186\.94)|2\.(?:216\.(?:105\.90|86\.253|46\.75)|1(?:84\.172\.244|68\.218\.86)|90\.239\.211)|9\.(?:1(?:10\.108\.92|93\.93\.25)|42\.147\.114|82\.231\.126)|(?:0\.45\.156\.10|3\.130\.65\.16|7\.19\.75\.23)1|4\.(?:141\.253\.14|247\.23\.66)|5\.8(?:8\.119\.132|5\.64\.210)|6\.1(?:12\.66\.102|93\.90\.26))|8(?:4\.(?:22\.(?:1(?:97\.216|52\.8)|53\.(?:190?|201))|82\.1(?:7(?:1\.234|9\.117)|23\.85)|107\.159\.154)|8\.2(?:19\.14\.43|6\.102\.92)|7\.162\.253\.250|2\.172\.22\.57|3\.98\.235\.12)|2(?:1\.(?:1(?:34\.(?:238\.12|190\.5)9|81\.237\.251|58\.198\.78)|88\.54\.17)|5\.(?:75\.235\.127|93\.77\.125)|4\.(?:42\.13\.230|160\.35\.2)|3\.64\.199\.2(?:3[79]|19)|2\.49\.119\.188)|9(?:8\.1(?:43\.1(?:50\.2(?:4[0789]|5[012]|39)|28\.144)|2\.80\.87)|0\.(?:107\.140\.76|90\.193\.202)|7\.(?:159\.16\.5|253\.6\.6)8|3\.109\.69\.14[57]|5\.62\.172\.242)|7(?:3\.2(?:08\.(?:186\.8[3456]|215\.1
64)|12\.205\.158)|(?:2\.245\.62\.17|7\.80\.104\.5)2)|0(?:1\.(?:(?:9\.207\.(?:11|23)|14\.88\.11)9|50\.12\.132)|6\.245\.2(?:40\.205|50\.6))|63\.177\.132\.1(?:44|65)|47\.175\.214\.72)|2(?:1(?:9\.(?:1(?:4(?:0\.69\.12|7\.172\.)2|39\.38\.49)|238\.181\.120)|8\.(?:15(?:9\.195\.251|1\.141\.75)|36\.254\.141)|1\.17(?:4\.(?:178\.175|215\.100)|2\.251\.168)|7\.23\.6\.(?:1(?:6[89]|08|46)|21[23])|(?:3\.135\.113\.19|6\.172\.98\.16)7|0\.183\.179\.(?:3[89]|4[45])|2\.220\.1\.15)|0(?:2\.(?:1(?:37\.22\.200|94\.119\.69)|2(?:07\.1\.234|34\.40\.41)|64\.73\.148|71\.98\.62)|3\.(?:2(?:3(?:0\.112\.4[45]|9\.125\.32)|52\.154\.246)|146\.140\.77))|2(?:1\.2(?:3(?:2\.247\.27|8\.21\.251)|14\.2(?:08\.226|14\.187)|04\.223\.38)|2\.(?:1(?:00\.234\.251|22\.227\.10)|35\.61\.196)|0\.(?:164\.162\.22|68\.224\.45))|3\.(?:245\.26\.96|94\.104\.59)|7\.120\.103\.37|4\.48\.219\.49)|9(?:3\.(?:1(?:57\.148\.102|84\.71\.66)|90\.102\.194)|1\.218\.245\.(?:[456789]|2[012346789]?|1\d|30?)|(?:2\.50\.155\.21|4\.77\.199\.14)8)|6(?:1\.(?:1(?:63
\.101\.42|41\.21\.34|9\.246\.93)|38\.186\.117)|0\.(?:190\.92\.234|29\.104\.197)|9\.175\.40\.106)|7(?:8\.(?:36\.14\.195|29\.4\.78)|4\.91\.31\.2(?:29|30)|7\.106\.232\.178|5\.144\.81\.177|6\.72\.254\.222)|3(?:1\.1(?:92\.111\.(?:1(?:9[012]|8[89])|221)|70\.106\.90|86\.87\.231)|7\.48\.6(?:5\.121|6\.2))|5(?:\.79\.81\.19[56]|8\.246\.179\.82|9\.36\.20\.159)|85\.1(?:7\.27\.1(?:09|10)|85\.112\.8)|4(?:6\.191\.237\.118|1\.137\.24\.4))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work