You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/09/16 08:58:36 UTC
svn commit: r1523547 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Mon Sep 16 06:58:36 2013
New Revision: 1523547
URL: http://svn.apache.org/r1523547
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1523547&r1=1523546&r2=1523547&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Mon Sep 16 06:58:36 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201309152
+## khop-sc-neighbors.cf v 201309162
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:8[68]|13)|37)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:18[68]|37|5)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:(?:0(?:3\.30\.7|1\.9\.5)|12\.90\.22)2|84\.(?:22\.(?:230|11)|82\.53)|9(?:8\.24\.180|9\.30\.137)|(?:62\.216\.|77\.1\.22)3|21\.54\.54)|58\.254\.172)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:84\.(?:22\.(?:2(?:30|7)|11)|82\.53)|9(?:8\.24\.173|9\.30\.137)|(?:12\.90\.22|03\.30\.7)2|73\.44\.179|21\.54\.54)|58\.254\.172|69\.64\.49)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705@376k resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:5\.60\.156|0\.84\.13)|98\.24\.17[345]|84\.22\.177|01\.8\.236|12\.97\.24)|2(?:06\.214\.95|21\.4\.142)|7(?:9\.106\.109|5\.75\.240)|(?:91\.218\.11|41\.254\.)5|50\.30\.47)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:2(?:5\.60\.156|0\.84\.13)|98\.24\.17[45]|84\.22\.177|01\.8\.236|12\.97\.24|77\.1\.223)|2(?:06\.214\.95|21\.4\.142)|7(?:9\.106\.109|5\.75\.240)|(?:91\.218\.11|41\.254\.)5|50\.30\.47)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:1(?:68\.(?:218\.86|141\.5)|24\.38\.250|70\.181\.99)|21(?:6\.(?:105\.90|46\.75)|7\.161\.3))|9\.1(?:(?:49\.148\.15|97\.181\.12)0|84\.214\.18)|8\.1(?:30\.107\.235|75\.28\.3)|4\.4(?:5\.229\.27|\.44\.206)|0\.189\.168\.171|5\.82\.240\.23|6\.193\.90\.26|3\.0\.85\.249)|8(?:4\.(?:22\.(?:1(?:7(?:2\.14[56]|7\.5[12])|97\.216|1\.23)|2(?:3[07]\.213|8\.22[012]|28\.62|7\.171))|82\.(?:53\.1(?:0[69]|43|1)|179\.117|251\.100))|0\.2(?:25\.131\.176|11\.179\.30)|3\.98\.23\.158|9\.75\.63\.114)|7(?:3\.(?:44\.1(?:79\.(?:2(?:0[24]|2[05]|16)|199)|82\.(?:1[049]|28|3))|2(?:12\.205\.158|00\.90\.196))|7\.(?:69\.243\.74|1\.223\.73)|4\.36\.137\.170|8\.20\.148\.11)|9(?:8\.24\.1(?:7(?:4\.(?:16[67]|57)|5\.[234]|3\.80)|80\.91)|9\.(?:30\.137\.10[67]|71\.215\.141)|2\.163\.193\.199|5\.138\.195\.125|0\.107\.140\.77)|2(?:1\.(?:1(?:81\.237\.251|99\.12\.28|61\.20\.7)|22\.127\.17)|5\.(?:75\.235\.127|46\.24\.62))|0(?:1\.(?:(?:8\.236\.24|44\.3\.5)0|13\.123\.62|9\.52\
.119)|3\.9\.157\.12[679])|4(?:(?:8\.223\.59\.18|\.33\.121\.6)7|1\.0\.61\.166)|62\.216\.3\.1[4567]|\.85\.17\.82)|2(?:1(?:1\.(?:1(?:7(?:2\.251\.168|4\.120\.123|6\.61\.112)|1(?:9\.86\.14[357]|8\.37\.56)|91\.168\.166|57\.144\.27)|54\.17\.200)|3\.1(?:9(?:5\.77\.114|9\.248\.27)|32\.241\.13)|2\.156\.44\.134|0\.93\.48\.211|9\.147\.172\.2)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|04\.223\.38|\.144\.135)|4\.142\.(?:6[4579]|9[0123]|4[12]|7[01]))|2\.(?:1(?:22\.79\.103|74\.54\.164)|231\.33\.38)|0\.188\.110\.129)|0(?:6\.214\.95\.(?:6[689]|7[012]|9[14])|8\.(?:84\.135\.14[78]|76\.106\.66)|3\.(?:171\.233\.243|255\.15\.146)|2\.(?:137\.22|71\.136)\.200|7\.46\.132\.188))|6(?:1\.(?:16(?:6\.55\.153|7\.120\.9)|33\.162\.92)|0\.(?:214\.223\.178|190\.43\.10)|9\.(?:198\.197\.156|64\.49\.109)|5\.60\.15\.18[46]|4\.120\.169\.146|7\.90\.21\.150)|9(?:1\.218\.115\.(?:5[2456789]|3[45678]|10[89]|6[013])|3\.(?:159\.160\.164|95\.98\.196)|0\.83\.184\.211|5\.155\.8\.219)|7(?:5\.75\.240\.1(?:4[01234567]|3[89])|4\.143\.199\.
46|2\.35\.20\.131)|5(?:0\.30\.47\.(?:121|87)|8\.213\.157\.68|9\.8\.26\.22)|4(?:1\.(?:84\.135\.22|137\.24\.4)|2\.121\.121\.42)|82\.(?:11(?:7\.194\.229|4\.79\.254)|99\.246\.10)|37\.123\.98\.115)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:2\.(?:1(?:6(?:3\.150\.30|8\.218\.86)|24\.38\.250|70\.181\.99)|21(?:6\.(?:105\.90|86\.253|46\.75)|7\.161\.3))|9\.1(?:49\.148\.150|84\.214\.18|92\.252\.1)|(?:1\.249\.131\.15|3\.0\.85\.24)9|8\.1(?:30\.107\.235|75\.28\.3)|4\.4(?:5\.229\.27|\.44\.206)|0\.189\.168\.171|6\.193\.90\.26)|8(?:4\.(?:22\.(?:1(?:7(?:2\.14[56]|7\.5[12])|97\.216|1\.23)|2(?:3[07]\.213|8\.22[012]|28\.62|7\.171))|82\.(?:53\.1(?:06|43|1)|179\.117|251\.100))|0\.2(?:25\.131\.176|11\.179\.30)|3\.98\.23\.158|9\.75\.63\.114)|9(?:8\.24\.1(?:7(?:4\.(?:16[67]|57)|5\.[234]|3\.80)|80\.91)|9\.(?:30\.137\.10[67]|71\.215\.141)|2\.163\.193\.199|5\.138\.195\.125|0\.107\.140\.77)|7(?:3\.(?:44\.179\.(?:2(?:0[24]|16|25)|199)|2(?:12\.205\.158|00\.90\.196))|4\.36\.137\.170|8\.20\.148\.11|7\.1\.223\.73)|0(?:1\.(?:(?:8\.236\.24|44\.3\.5)0|13\.123\.62|9\.52\.119)|3\.9\.157\.12[679])|2(?:1\.(?:1(?:81\.237\.251|99\.12\.28|61\.20\.7)|22\.127\.17)|5\.75\.235\.127)|4(?:1\.0\.61\.166|\.33\
.121\.67)|\.(?:215\.206\.24|85\.17\.8)2|62\.216\.3\.1[4567])|2(?:1(?:1\.(?:1(?:7(?:2\.251\.168|4\.120\.123|6\.61\.112)|1(?:9\.86\.14[357]|8\.37\.56)|91\.168\.166|57\.144\.27)|54\.17\.20[01])|3\.1(?:32\.241\.13|99\.248\.27)|2\.156\.44\.134|0\.93\.48\.211|9\.147\.172\.2)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|04\.223\.38|\.144\.135)|4\.142\.(?:9[0123]|6[479]|4[12]|7[01]))|2\.(?:1(?:22\.79\.103|74\.54\.164)|231\.33\.38)|0\.188\.110\.129)|0(?:6\.214\.95\.(?:7[0124567]|6[689]|9[14])|8\.(?:84\.135\.14[78]|76\.106\.66)|3\.(?:171\.233\.243|239\.45\.202)|2\.137\.22\.200|7\.46\.132\.188))|6(?:0\.(?:214\.223\.178|190\.43\.10)|9\.(?:198\.197\.156|64\.49\.109)|1\.(?:167\.120\.9|33\.162\.92)|5\.60\.15\.18[46]|4\.120\.169\.146|7\.90\.21\.150)|9(?:1\.218\.115\.(?:5[2456789]|3[456789]|4[0123]|10[89]|6[013])|3\.(?:159\.160\.164|95\.98\.196)|0\.83\.184\.211|5\.155\.8\.219)|7(?:5\.75\.240\.1(?:3[89]|4\d|51)|7\.106\.232\.178|4\.143\.199\.46|2\.35\.20\.131)|5(?:8\.2(?:37\.102\.214|13\.157\.68)|0\.30\.47\
.(?:121|87))|82\.(?:11(?:7\.194\.229|4\.79\.254)|99\.246\.10)|41\.(?:84\.135\.22|137\.24\.4))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|5\.(?:63\.(?:[89]|1[012345])|58\.134)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|0\.(?:205\.3[25]|52\.[0123])|3\.56\.2(?:4[589]|5[01]|25)|2\.215\.(?:6[34]|44)|9\.36\.21[23])|2(?:5\.(?:44\.24[01234567]|60\.156)|3\.136\.106|4\.107\.127|2\.155\.44)|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|1\.66\.15[67]|6\.123\.135)|0(?:3\.(?:2(?:8\.184|0\.39)|30\.72|7\.243)|9\.127\.8[01])|9(?:0\.234\.10[56]|7\.252\.[01])|30\.193\.1(?:46|65)|77\.47\.10[26]|42\.234\.186|63\.125\.144)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:2\.29\.17[67]|3\.194\.115|6\.246\.99)|22\.140\.15[89])|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|6[89]|71)|19\.190)|9\.55\.254)|4(?:1\.254\.[1258]|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|[46][89]?|5[01]?|7\d?)|68\.32)|5\.(?:63\.(?:[89]|1[012345])|58\.134)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|0\.(?:205\.3[25]|52\.[0123])|3\.56\.2(?:4[589]|5[01]|25)|2\.215\.(?:6[34]|44)|9\.36\.21[23])|2(?:5\.(?:4(?:4\.24[01234567]|2\.202)|60\.156)|3\.136\.106|2\.155\.44)|8(?:3\.93\.(?:1[12]5|9[78]|69|84)|1\.66\.15[67]|6\.123\.135)|0(?:3\.(?:2(?:8\.184|0\.39)|30\.72|5\.27)|9\.127\.8[01])|9(?:0\.234\.10[56]|7\.252\.[01])|(?:42\.234\.18|77\.47\.10)6|30\.193\.1(?:46|65)|63\.125\.144)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:2\.29\.17[67]|3\.194\.115|6\.246\.99)|22\.140\.15[89])|5(?:8\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|6[89]|71)|19\.190)|9\.55\.254)|4(?:1\.254\.[1258]|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6