You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2013/10/04 08:57:42 UTC
svn commit: r1529088 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Fri Oct 4 06:57:42 2013
New Revision: 1529088
URL: http://svn.apache.org/r1529088
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1529088&r1=1529087&r2=1529088&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Fri Oct 4 06:57:42 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20131032
+## khop-sc-neighbors.cf v 20131042
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -81,7 +81,7 @@ score KHOP_SC_CIDR16 0.4 0.1 0.4 0.1
# crap, still empty 20130629@465k net
# crap, still empty 20130705@376k net. lowering for low vol -> .4 .1 .4 .1
-header KHOP_SC_TOP_CIDR16 Received =~ /___ FAILED TO POPULATE ___/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b187\.111(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0.3
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:3\.(?:251\.155|95\.90)|8\.24\.180|9\.30\.137)|16\.112\.66|84\.22\.177|21\.54\.54)|2(?:11\.119\.86|21\.4\.142)|58\.254\.172|77\.245\.4)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:3\.(?:251\.155|95\.90)|8\.24\.180)|16\.112\.66|21\.54\.54|01\.9\.49)|2(?:11\.119\.86|21\.4\.142|3\.91\.25)|41\.223\.26|77\.245\.4)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:(?:69\.205\.20|244\.239\.)2|1(?:30\.107\.235|75\.28\.3))|2\.(?:1(?:84\.172\.244|24\.15\.141)|220\.249\.20)|9\.(?:3(?:7\.195\.59|0\.39\.1)|184\.214\.18)|5\.8(?:2\.242\.197|8\.119\.132)|6\.1(?:12\.66\.102|93\.90\.26)|3\.2(?:1\.228\.230|0\.30\.75))|8(?:4\.(?:22\.(?:1(?:7(?:7\.5[12]|2\.146)|97\.216|1\.23|52\.8)|2(?:(?:28\.6|8\.22)2|30\.213)|53\.190)|82\.123\.85)|7\.(?:111\.255\.130|51\.175\.122)|0\.(?:178\.56\.138|250\.192\.22)|9\.7(?:8\.155\.168|5\.63\.114)|3\.136\.128\.226|8\.240\.221\.2)|9(?:8\.(?:24\.1(?:7(?:(?:8\.13|3\.8)0|4\.16[67]|5\.[234])|80\.91)|5(?:0\.163\.(?:19[489]|20[45])|2\.247\.103)|44\.0\.157)|3\.(?:251\.155\.67|95\.90\.194)|0\.(?:107\.140\.77|0\.60\.238)|9\.30\.137\.10[67]|2\.163\.193\.199|5\.226\.209\.132)|7(?:7\.(?:1(?:84\.140\.222|\.223\.73)|43\.210\.162)|3\.2(?:12\.205\.158|32\.161\.36)|8\.2(?:13\.110\.115|0\.148\.11)|4\.36\.137\.170|6\.34\.52\.206)|2(?:1\.(?:1(?:99\.60\.110|2\.167\.95)|22\.127\.17)|2\
.15(?:5\.167\.115|4\.57\.19)|4\.(?:42\.124\.136|160\.35\.2)|5\.(?:75\.235\.127|46\.24\.62))|0(?:1\.(?:15\.(?:2(?:42\.159|54\.32)|114\.8)|44\.3\.50|9\.49\.53)|3\.9\.157\.12[69])|4(?:1\.(?:255\.161\.102|0\.61\.166)|5\.255\.136\.22)|62\.216\.3\.1[45]|\.93\.26\.97)|2(?:0(?:2\.(?:1(?:01\.228\.108|18\.236\.177|37\.22\.200|29\.52\.94)|29\.2(?:39\.210|14\.61|41\.58)|62\.67\.250|77\.180\.72)|3\.(?:1(?:56\.207\.249|71\.233\.243|43\.19\.154)|23(?:9\.45\.202|8\.95\.11))|0\.(?:(?:247\.100\.1|148\.94\.)78|41\.181\.170)|1\.(?:2(?:21\.132\.83|48\.65\.81)|18\.107\.234)|6\.214\.(?:71\.3[5678]|67\.10)|8\.84\.135\.14[78]|7\.194\.87\.105)|1(?:1\.(?:1(?:19\.86\.14[356]|74\.120\.123)|23(?:4\.106\.54|2\.92\.23))|0\.(?:14\.(?:133\.202|70\.21)|51\.23\.91)|9\.(?:143\.207\.140|239\.227\.81)|3\.1(?:32\.241\.13|64\.18\.147)|8\.(?:151\.141\.75|56\.161\.14)|6\.155\.17\.(?:[58]|1[04])|2\.144\.254\.122)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|34\.24\.46)|(?:192\.134\.9|4\.142\.4)1)|2\.(?:1(?:12\.150\.58|22\.227\.10|7
4\.155\.19)|35\.61\.196)|0\.227\.90\.238)|3\.(?:229\.11\.26|91\.25\.82))|6(?:0\.(?:21(?:4\.223\.178|\.209\.150)|19(?:0\.136\.90|1\.35\.42))|1\.(?:13(?:2\.229\.115|3\.125\.162)|55\.156\.210)|2\.(?:231\.181|141\.37)\.85|3\.216\.146\.37|5\.60\.15\.173|8\.180\.96\.1)|9(?:1\.(?:218\.245\.(?:7[1245678]|8[14578]|9[34]|66)|197\.220\.230)|4\.(?:24\.245\.104|77\.199\.148)|5\.1(?:67\.178\.165|59\.105\.2)|3\.1(?:23\.54\.138|84\.71\.66))|8(?:0\.(?:86\.88\.1(?:13|26)|73\.71\.248|240\.35\.5)|6\.111\.144\.194|9\.105\.129\.12|2\.146\.43\.38)|7(?:7\.2(?:23\.243\.122|45\.4\.58)|5\.75\.225\.(?:10[01]|9[89]))|4(?:2\.121\.117\.153|1\.223\.26\.11|6\.22\.173\.86)|58\.246\.43\.122)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:1(?:30\.107\.235|75\.28\.3)|69\.20(?:2\.111|5\.202)|244\.239\.2)|2\.(?:1(?:84\.172\.244|24\.15\.141)|216\.46\.75)|9\.(?:3(?:7\.195\.59|0\.39\.1)|184\.214\.18)|5\.8(?:2\.242\.197|8\.119\.132)|6\.1(?:12\.66\.102|93\.90\.26)|3\.2(?:1\.228\.230|0\.30\.75))|8(?:4\.(?:22\.(?:1(?:7(?:7\.5[12]|2\.146)|97\.216|1\.23|52\.8)|2(?:(?:28\.6|8\.22)2|30\.213)|53\.190)|82\.123\.85)|7\.(?:111\.255\.130|51\.175\.122)|0\.(?:178\.56\.138|250\.192\.22)|9\.7(?:8\.155\.168|5\.63\.114)|8\.24(?:0\.221\.2|4\.47\.67)|3\.136\.128\.226)|9(?:8\.(?:24\.1(?:7(?:(?:8\.13|3\.8)0|4\.16[67]|5\.[234])|80\.91)|5(?:0\.163\.(?:19[489]|20[45])|2\.247\.103))|3\.(?:251\.155\.67|95\.90\.194)|0\.(?:107\.140\.77|0\.60\.238)|9\.30\.137\.10[67]|2\.163\.193\.199|5\.226\.209\.132)|7(?:7\.(?:1(?:84\.140\.222|\.223\.73)|222\.66\.165|43\.210\.162)|3\.2(?:12\.205\.158|32\.161\.36)|4\.36\.137\.170|6\.34\.52\.206|8\.20\.148\.11)|2(?:1\.(?:1(?:99\.60\.110|2\.167\.95)|22\.127\.
17)|2\.15(?:5\.167\.115|4\.57\.19)|4\.(?:42\.124\.136|160\.35\.2)|3\.63\.31\.13|5\.46\.24\.62)|0(?:1\.(?:15\.(?:242\.159|114\.8)|44\.3\.50|9\.49\.53)|3\.(?:9\.157\.12[69]|246\.245\.40))|6(?:2\.216\.3\.1[45]|8\.63\.174\.108)|41\.0\.61\.166|\.93\.26\.97)|2(?:0(?:2\.(?:1(?:1(?:8\.236\.177|7\.120\.24)|01\.228\.108|37\.22\.200|29\.52\.94)|29\.2(?:39\.210|14\.61|41\.58)|77\.180\.72)|1\.(?:1(?:8\.107\.234|95\.239\.27)|2(?:21\.132\.83|48\.65\.81))|3\.(?:1(?:56\.207\.249|71\.233\.243|43\.19\.154)|239\.45\.202)|0\.(?:(?:247\.100\.1|148\.94\.)78|41\.181\.170)|8\.84\.135\.14[78]|7\.194\.87\.105)|1(?:1\.(?:1(?:19\.86\.14[3579]|74\.120\.123)|23(?:4\.106\.54|2\.92\.23))|0\.(?:14\.(?:133\.202|70\.21)|51\.23\.91)|9\.(?:143\.207\.140|239\.227\.81)|3\.1(?:32\.241\.13|64\.18\.147)|8\.(?:151\.141\.75|56\.161\.14)|6\.155\.17\.(?:[58]|1[04])|2\.144\.254\.122|7\.218\.43\.130)|2(?:1\.(?:2(?:14\.2(?:08\.226|14\.187)|34\.24\.46)|192\.134\.91|0\.76\.99)|2\.(?:1(?:12\.150\.58|22\.227\.10|74\.155\.19)|35\.61\.19
6)|0\.227\.90\.238)|\.18(?:6\.230\.30|3\.155\.2)|3\.91\.25\.82)|6(?:0\.(?:21(?:4\.223\.178|\.209\.150)|19(?:0\.136\.90|1\.35\.42))|1\.(?:13(?:2\.229\.115|3\.125\.162)|55\.156\.210)|2\.(?:231\.181|141\.37)\.85|9\.198\.197\.156|3\.216\.146\.37|5\.60\.15\.173)|9(?:1\.(?:218\.245\.(?:7[12345678]|8[14578]|6[67]|9[34])|197\.220\.230)|4\.(?:24\.245\.104|77\.199\.148)|5\.1(?:67\.178\.165|59\.105\.2)|3\.1(?:23\.54\.138|84\.71\.66))|8(?:0\.(?:86\.88\.1(?:13|26)|73\.71\.248|240\.35\.5)|2\.1(?:17\.194\.229|46\.43\.38)|6\.111\.144\.194|9\.105\.129\.12)|4(?:1\.(?:22(?:0\.28\.138|3\.26\.11)|84\.135\.22)|2\.121\.117\.153|6\.22\.173\.86)|5(?:8\.246\.43\.122|9\.151\.37\.8)|77\.2(?:23\.243\.122|45\.4\.58))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -178,7 +178,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|7[0245789]?|4[89]?|5[01]?|6)|68\.32)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|2\.215\.(?:6[34]|44)|0\.52\.[0123]|9\.36\.21[23])|8(?:3\.9(?:3\.11[45]|5\.6[67])|6\.(?:123\.135|37\.203)|1\.66\.15[67]|2\.18\.222)|0(?:3\.(?:2(?:0\.3[79]|8\.184)|1\.69|5\.27)|9\.127\.8[01])|7(?:7\.(?:47\.10|86\.4)6|3\.44\.232)|9(?:0\.234\.10[56]|7\.252\.[01])|25\.(?:44\.247|60\.156)|30\.193\.1(?:46|65))|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.(?:194\.115|82\.81)|2\.29\.17[89])|1(?:6\.155\.(?:20|54|63)|2\.34\.12))|58\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|68)|19\.19[01])|4(?:1\.254\.[1258]|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:1(?:1\.(?:176\.(?:(?:12|8)[4567]|7[0245789]?|4[89]?|5[01]?|6)|68\.32)|6\.207\.(?:1[2345]|6[0123]|4[89]|5\d)|5\.63\.(?:[89]|1[012345])|3\.56\.2(?:4[89]|5[01])|2\.215\.(?:6[34]|44)|0\.52\.[0123]|9\.36\.21[23])|8(?:3\.9(?:3\.11[45]|5\.6[67])|6\.(?:123\.135|37\.203)|1\.66\.15[67]|2\.18\.222)|0(?:3\.(?:2(?:40\.117|8\.184)|7\.243|1\.69|5\.27)|9\.127\.8[01])|7(?:7\.(?:47\.10|86\.4)6|3\.44\.232)|9(?:0\.234\.10[56]|7\.252\.[01])|30\.193\.1(?:46|65)|25\.60\.156)|2(?:7\.20\.(?:[89]|1(?:0[0123]?|[28][89]|[39][01]|7[6789]|1)|24[01234567]|4[0123]|5[6789])|0(?:3\.(?:194\.115|82\.81)|2\.29\.17[89])|1(?:6\.155\.(?:20|54|63)|2\.34\.12))|58\.(?:50\.(?:1(?:[2345]|0[456789]|1[016789])|68)|19\.19[01])|4(?:1\.254\.[1258]|9\.0\.11[89])|79\.106\.109)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6