khopesh at apache
Aug 7, 2013, 11:57 PM
Post #1 of 1
(12 views)
Permalink
|
|
svn commit: r1511599 - /spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
|
|
Author: khopesh
Date: Thu Aug 8 06:57:18 2013
New Revision: 1511599
URL: http://svn.apache.org/r1511599
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1511599&r1=1511598&r2=1511599&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Thu Aug 8 06:57:18 2013
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20130872
+## khop-sc-neighbors.cf v 20130882
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@ meta __KHOP_SC_EXCLUSIONS __VIA_ML || __
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|86)|9[35])(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:11[37]|9[35])(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !__KHOP_SC_EXCLUSIONS
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -81,7 +81,7 @@ score KHOP_SC_CIDR16 0.4 0.1 0.4 0.1
# crap, still empty 20130629 [at] 465 net
# crap, still empty 20130705 [at] 376 net. lowering for low vol -> .4 .1 .4 .1
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:187\.111|85\.105)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b187\.111(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0.3
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR16 0.6 0.2 0.7 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:4\.4(?:2\.1(?:3[45789]|5[2345]|40)|4\.96)|6\.112\.66)|(?:90\.144\.22|20\.28\.)8|87\.4\.111)|2(?:02\.111\.175|10\.51\.44)|(?:41\.226\.1|82\.207\.5)1|61\.133\.125|54\.248\.80)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:4\.4(?:2\.1(?:3[46789]|4[01]|5[23])|4\.96)|6\.112\.66)|8(?:0\.211\.179|7\.4\.111)|90\.144\.228|68\.62\.183)|21(?:3\.132\.241|0\.51\.44)|61\.(?:133\.125|55\.156)|41\.226\.11)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.6 0 0.6 0
@@ -122,7 +122,7 @@ score KHOP_SC_CIDR24 0.6 0 0.6 0
# 0.4428/0 1.000 20130705 [at] 376 resume scores -> .6 0 .6 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:8\.244\.239|4\.42\.136)|9(?:0\.0\.60|3\.34\.8)|76\.192\.15|20\.84\.13|41\.0\.61)|2(?:1(?:3\.1(?:32\.241|64\.18)|7\.198\.3)|\.183\.155)|86\.111\.144)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:8\.244\.239|4\.42\.135|2\.97\.24)|9(?:0\.0\.60|3\.34\.8)|76\.192\.15|41\.0\.61)|2(?:1(?:3\.164\.18|7\.198\.3)|\.183\.155)|86\.111\.144|54\.248\.80)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0.5
@@ -142,7 +142,7 @@ score KHOP_SC_TOP_CIDR24 1.7 0.5 1.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:0\.(?:20(?:0\.211\.229|2\.116\.101)|14(?:4\.228\.198|7\.36\.33)|0\.(?:60\.238|19\.82))|2\.(?:1(?:63\.197\.135|98\.106\.162)|228\.102\.102)|3\.(?:95\.(?:90\.194|69\.58)|34\.8\.101)|5\.(?:138\.195\.125|242\.161\.161)|7\.220\.193\.38|9\.255\.11\.29)|7(?:6\.(?:1(?:00\.110\.74|92\.15\.229)|28\.49\.192)|7\.(?:5\.230\.114|1\.223\.73|69\.8\.50)|4\.36\.1(?:6(?:0\.157|4\.184)|37\.170)|3\.2(?:42\.113\.185|00\.90\.196)|8\.20(?:7\.158\.230|\.148\.11))|1(?:6\.(?:112\.(?:66\.102|5\.136)|58\.65\.226)|1\.(?:240\.99\.193|30\.77\.129)|8\.(?:244\.239\.2|46\.127\.36)|2\.216\.105\.90|5\.156\.236\.13|7\.131\.158\.34|9\.184\.214\.18|4\.27\.40\.187)|2(?:3\.(?:30\.1(?:10\.106|29\.54)|234\.230\.45)|1\.(?:22\.(?:127\.17|34\.166)|12\.167\.95)|4\.2(?:24\.242\.102|32\.136\.55)|2\.(?:225\.36\.101|154\.57\.20)|0\.(?:193\.27\.25|28\.8\.19)4)|8(?:0\.(?:211\.17(?:0\.86|9\.30)|92\.170\.173)|3\.(?:136\.146\.110|238\.169\.86)|7\.(?:111\.255\.130|4\.111\.218)|4\.22
\.1(?:77\.5[12]|1\.23)|8\.127\.230\.28|6\.226\.48\.16)|4(?:8\.2(?:23\.59\.180|47\.195\.4)|\.(?:220\.56\.66|63\.74\.204)|1\.0\.61\.16[56])|0(?:3\.9\.158\.1(?:10|47|81)|8\.166\.205\.163|1\.99\.28\.194|6\.186\.18\.55)|\.(?:2(?:15\.206\.242|24\.164\.19)|34\.181\.22|93\.21\.147)|(?:57\.56\.178\.6|68\.62\.183\.7)3|37\.135\.11(?:5\.228|7\.20))|2(?:1(?:7\.(?:1(?:2\.(?:248\.238|113\.67)|98\.3\.238|6\.9\.173)|21(?:8\.43\.130|9\.123\.59))|1\.(?:1(?:40\.207\.100|57\.114\.133)|232\.59\.155|87\.190\.186|44\.103\.11)|8\.(?:1(?:08\.222\.217|92\.175\.84)|4\.100\.252|2\.129\.53)|3\.1(?:(?:64\.18\.14|32\.241\.)7|40\.116\.188|99\.238\.22)|0\.(?:51\.(?:44\.(?:199|48)|3\.42)|45\.117\.249)|9\.(?:14(?:3\.244\.170|6\.2\.105)|240\.39\.201)|2\.(?:(?:26\.134\.11|138\.144\.)5|6\.152\.211))|0(?:2\.(?:1(?:(?:37\.22\.20|58\.39\.25)0|09\.133\.181|11\.175\.97|42\.203\.19)|29\.241\.(?:33|60)|71\.136\.200|65\.216\.52)|1\.(?:1(?:8\.(?:107\.234|95\.158)|95\.239\.27)|2(?:34\.158\.154|45\.175\.177))|0\.(?:1(?:1(?:3\.187\.
2|\.218\.1)42|42\.133\.21)|247\.100\.178|31\.105\.172)|3\.(?:196\.170\.194|239\.45\.202)|8\.113\.254\.39)|2(?:1\.(?:19(?:4\.(?:128\.22[34]|43\.10)|2\.134\.91)|2(?:14\.2(?:08\.226|21\.148)|\.144\.135)|6\.120\.211)|2\.(?:29\.45\.27|74\.200\.2)|0\.143\.121\.154)|(?:4\.127\.201\.17|\.183\.155\.)2)|6(?:1\.(?:1(?:3(?:3\.125\.162|6\.68\.76)|77\.248\.202|55\.159\.9|89\.20\.21)|238\.148\.161|55\.156\.210|77\.210\.75)|0\.(?:2(?:14\.223\.178|9\.75\.142)|190\.136\.90|8\.63\.5[12]|5\.254\.168)|6\.(?:137\.207\.205|203\.32\.54|35\.65\.48)|(?:2\.141\.113\.|7\.90\.21\.1)50|9\.198\.197\.156|5\.60\.15\.173)|8(?:5\.(?:2(?:14\.242\.208|34\.22\.126)|120\.148\.111)|2\.(?:2(?:21\.102\.245|07\.51\.92)|114\.79\.254)|(?:3\.111\.92\.12|1\.176\.35\.7)0|6\.111\.144\.194|8\.150\.211\.196|7\.103\.197\.93|4\.17\.27\.245)|4(?:1\.(?:22(?:0\.28\.138|6\.11\.117)|78\.77\.253|84\.135\.22)|6\.(?:229\.192\.208|105\.31\.6))|9(?:3\.1(?:23\.54\.138|84\.71\.66)|1\.212\.124\.153|5\.159\.105\.2)|5(?:4\.2(?:4(?:7\.19\.145|8\.80\.
211)|35\.106\.157)|9\.8\.26\.22)|7(?:2\.35\.20\.131|9\.188\.87\.18)|37\.(?:28\.165\.107|59\.238\.178))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:0\.(?:20(?:0\.211\.229|2\.116\.101)|14(?:4\.228\.198|7\.36\.33)|0\.(?:60\.238|19\.82))|2\.(?:1(?:63\.197\.135|98\.106\.162)|228\.102\.102)|3\.(?:95\.(?:90\.194|69\.58)|34\.8\.101)|5\.242\.161\.161|7\.220\.193\.38|6\.3\.181\.162|9\.255\.11\.29)|2(?:1\.(?:2(?:2\.(?:127\.17|34\.166)|6\.229\.197)|12\.167\.95)|3\.(?:234\.230\.45|30\.110\.106)|4\.2(?:24\.242\.102|32\.136\.55)|2\.(?:225\.36\.101|154\.57\.20)|0\.(?:193\.27\.25|28\.8\.19)4|5\.75\.235\.127)|1(?:6\.(?:112\.(?:66\.102|5\.136)|58\.65\.226)|1\.(?:240\.99\.193|30\.77\.129)|8\.(?:244\.239\.2|46\.127\.36)|0\.93\.215\.186|2\.216\.105\.90|5\.156\.236\.13|7\.131\.158\.34|9\.184\.214\.18|4\.27\.40\.187)|7(?:6\.(?:1(?:00\.110\.74|92\.15\.229)|28\.49\.192)|7\.(?:5\.230\.114|1\.223\.73|69\.8\.50)|4\.36\.1(?:6(?:0\.157|4\.184)|37\.170)|3\.2(?:42\.113\.185|00\.90\.196)|8\.20(?:7\.158\.230|\.148\.11))|8(?:0\.(?:211\.17(?:0\.86|9\.30)|92\.170\.173)|3\.(?:136\.146\.110|238\.169\.86)|7\.(
?:111\.255\.130|4\.111\.218)|8\.127\.230\.28|4\.22\.177\.52|6\.226\.48\.16)|4(?:\.(?:(?:52\.137\.5|63\.74\.20)4|220\.56\.66)|8\.2(?:23\.59\.180|47\.195\.4)|1\.0\.61\.16[56])|0(?:3\.9\.158\.1(?:10|47|81)|8\.166\.205\.163|1\.99\.28\.194|6\.186\.18\.55)|\.(?:2(?:15\.206\.242|24\.164\.19)|34\.181\.22|93\.21\.147)|37\.1(?:35\.(?:11(?:5\.228|7\.20)|82\.99)|17\.74\.115)|(?:57\.56\.178\.6|68\.62\.183\.7)3)|2(?:1(?:7\.(?:1(?:2\.(?:248\.238|113\.67)|98\.3\.238|6\.9\.173)|21(?:8\.43\.130|9\.123\.59)|97\.194\.222)|1\.(?:1(?:40\.207\.100|57\.114\.133)|232\.59\.155|87\.190\.186|44\.103\.11)|8\.(?:1(?:08\.222\.217|92\.175\.84)|4\.100\.252|2\.129\.53)|2\.(?:(?:26\.134\.11|138\.144\.)5|6\.152\.211|73\.75\.242)|3\.1(?:(?:64\.18\.14|32\.241\.)7|40\.116\.188|99\.238\.22)|0\.(?:51\.(?:44\.(?:199|48)|3\.42)|45\.117\.249)|9\.(?:14(?:3\.244\.170|6\.2\.105)|240\.39\.201))|0(?:2\.(?:1(?:(?:37\.22\.20|58\.39\.25)0|09\.133\.181|11\.175\.97|42\.203\.19)|(?:71\.136\.20|29\.241\.6)0|65\.216\.52)|0\.(?:(?:11(?:3\.
187\.2|\.218\.1)4|31\.105\.17)2|247\.100\.178)|1\.(?:2(?:34\.158\.154|45\.175\.177)|18\.(?:107\.234|95\.158))|3\.(?:196\.170\.194|239\.45\.202))|2(?:1\.(?:19(?:4\.(?:128\.22[34]|43\.10)|2\.134\.91)|2(?:14\.2(?:08\.226|21\.148)|\.144\.135)|6\.120\.211)|2\.(?:29\.45\.27|74\.200\.2))|(?:4\.127\.201\.17|\.183\.155\.)2)|6(?:1\.(?:1(?:3(?:3\.125\.162|6\.68\.76)|77\.248\.202|55\.159\.9|89\.20\.21)|238\.148\.161|55\.156\.210|77\.210\.75)|0\.(?:2(?:14\.223\.178|9\.75\.142)|190\.136\.90|8\.63\.5[12]|5\.254\.168)|6\.(?:137\.207\.205|203\.32\.54|35\.65\.48)|9\.198\.197\.156|2\.141\.113\.50|5\.60\.15\.173)|8(?:5\.(?:2(?:14\.242\.208|34\.22\.126)|120\.148\.111)|2\.(?:2(?:21\.102\.245|07\.51\.92)|114\.79\.254)|(?:3\.111\.92\.12|1\.176\.35\.7)0|6\.111\.144\.194|8\.150\.211\.196|7\.103\.197\.93|4\.17\.27\.245)|4(?:1\.(?:22(?:0\.28\.138|6\.11\.117)|78\.77\.253|84\.135\.22)|6\.(?:229\.192\.208|105\.31\.6))|5(?:4\.2(?:4(?:7\.19\.145|8\.80\.211)|35\.106\.157)|8\.215\.176\.210|9\.8\.26\.22)|9(?:3\.1(?:23
\.54\.138|84\.71\.66)|5\.15(?:4\.106\.18|9\.105\.2)|1\.212\.124\.153)|7(?:2\.35\.20\.131|9\.188\.87\.18)|37\.59\.238\.178)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
|
