You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/01/05 07:57:42 UTC
svn commit: r1055318 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Jan 5 06:57:42 2011
New Revision: 1055318
URL: http://svn.apache.org/viewvc?rev=1055318&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1055318&r1=1055317&r2=1055318&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Jan 5 06:57:42 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20110141
+## khop-sc-neighbors.cf v 20110151
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b109\.86(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b178\.49(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:(?:3\.233|8\.248)\.64|7\.118\.(?:8[13]|93))|03\.152\.2|22\.33\.78)|8(?:5\.26\.(?:2(?:3[34]|25)|16[45])|9\.232\.105)|1(?:(?:22\.55\.10|98\.106\.2)6|78\.49\.255)|(?:58\.64\.18|91\.203\.6)7|77\.232\.14[23])\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.26\.(?:2(?:3[234]|25)|16[45])|9\.232\.105)|21(?:(?:3\.233|8\.248)\.64|7\.118\.(?:81|93))|1(?:78\.49\.255|98\.106\.26)|7(?:7\.232\.143|8\.138\.170)|(?:58\.64\.18|91\.203\.6)7)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[678]?|2[18]|4[16])|1\.192\.2(?:11|38)|0\.83\.23[89]|9\.232\.105|2\.178\.69)|1(?:1(?:3\.(?:10\.16[2378]|30\.110)|2\.196\.255)|9(?:3\.25\.121|5\.91\.70)|78\.49\.255)|21(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:74|89|90))|7(?:7\.232\.142|9\.106\.109)|41\.(?:254\.1|95\.4)|58\.64\.1(?:87|94)|98\.139\.91|61\.19\.66)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[678]?|2[18]|4[16])|1\.192\.2(?:11|38)|0\.83\.23[89]|9\.232\.105|2\.178\.69)|1(?:1(?:3\.(?:10\.16[234578]|30\.110)|2\.196\.255)|9(?:3\.25\.121|5\.91\.70)|22\.55\.106|78\.49\.255)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.(?:87\.(?:74|90)|94\.190))|03\.152\.2)|7(?:7\.232\.142|9\.106\.109)|41\.(?:254\.1|95\.4)|58\.64\.1(?:87|94)|98\.139\.91|61\.19\.66)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.1(?:6(?:1\.(?:40\.10|9\.2)|0\.253\.4)|8(?:2\.194\.220|9\.46\.246)|14\.6\.11)|4\.(?:1(?:26\.180\.118|58\.204\.250)|(?:44\.136\.17|50\.9\.11)4)|0\.(?:14(?:4\.113\.27|7\.7\.153)|210\.25\.225|30\.236\.34)|6\.(?:2(?:01\.207\.19|8\.52\.)1|12\.226\.34)|3\.(?:239\.44\.193|151\.12\.69)|8\.106\.26\.54)|2(?:1\.(?:(?:191\.7\.16|52\.152\.)2|78\.236\.38)|(?:4\.158\.110\.6|2\.128\.96\.5)4|3\.(?:27\.79\.11|7\.53\.55)|8\.121\.1(?:91\.182|43\.48)|5\.20\.82\.197)|7(?:8\.(?:(?:23\.151\.24|72\.81\.25)2|49\.(?:255\.104|95\.79)|124\.152\.226)|3\.20\.234\.92)|8(?:4\.105\.195\.(?:75|86)|9\.124\.131\.106|8\.230\.46\.230|6\.6\.161\.214)|09\.(?:22(?:7\.250\.128|9\.235\.135)|86\.(?:159\.53|55\.66)|166\.128\.5)|1(?:1\.224\.250\.13[245]|0\.138\.236\.87|5\.252\.69\.141)|4(?:0\.11(?:9\.164\.187|3\.183\.50)|8\.244\.172\.122)|68\.187\.24\.98)|2(?:1(?:6\.(?:157\.1(?:4(?:6\.(?:1(?:28|92)|64)|8\.(?:(?:19)?2|64))|5(?:0\.(?:1(?:28|92)|64|2)|4\.(?:19)?2))
|8(?:1\.7(?:(?:1\.19|0\.)2|2\.(?:128|2)|3\.(?:64|2))|6\.145\.18[02]))|2\.(?:1(?:99\.(?:104\.162|29\.145)|18\.142\.7[67])|200\.126\.244|71\.150\.146|87\.183\.10)|3\.(?:1(?:8(?:4\.2(?:24\.37|54\.13)|6\.38\.38)|38\.85\.60|67\.23\.58)|79\.125\.122)|7\.(?:1(?:75\.123\.40|14\.9\.171)|76\.2\.129)|(?:8\.248\.44\.19|9\.255\.18\.3)6|0\.(?:212\.163\.42|91\.239\.10)|1\.2(?:12\.168\.16|02\.2\.178))|0(?:2\.(?:1(?:52\.194\.129|08\.3\.184)|28\.(?:66\.251|24\.99)|75\.36\.9[35])|3\.(?:2(?:52\.161\.179|17\.176\.65)|177\.246\.22|91\.117\.3)|4\.(?:188\.168\.11|8\.46\.130)|1\.251\.250\.3|6\.47\.210\.75|8\.131\.186\.2|7\.5\.89\.7)|2(?:2\.(?:252\.223\.2|33\.78\.50)|0\.231\.69\.1[34]))|8(?:2\.(?:1(?:14\.(?:8(?:6\.122|7\.149)|7(?:6\.210|9\.86))|93\.140\.16[48])|207\.99\.94)|9\.(?:1(?:06\.161\.130|20\.204\.16)|237\.(?:60\.130|26\.2))|7\.(?:2(?:52\.228\.249|26\.242\.7)|103\.236\.121)|8\.(?:255\.153\.106|135\.83\.108)|3\.14(?:2\.111\.228|3\.237\.240)|5\.(?:232\.28\.204|154\.3\.141)|6\.98\.(?:23\.121|60\
.97)|4\.15\.191\.254|0\.95\.70\.173)|9(?:1\.(?:1(?:9(?:5\.(?:230\.1[01]|136\.14)|8\.(?:175\.253|86\.7))|49\.162\.228|21\.175\.20)|2(?:14\.(?:1(?:28\.2[01]|6\.42)|83\.2)|0(?:2\.25\.138|3\.67\.212)))|4\.(?:2(?:45\.156\.(?:33|55)|3\.60\.124)|1(?:27\.251\.121|42\.4\.30)|79\.4(?:9\.116|\.3))|2\.(?:24(?:7\.250\.234|3\.187\.50)|50\.192\.54)|3\.(?:91\.196\.(?:132|99)|126\.15\.49)|5\.154\.240\.98)|7(?:7\.(?:23(?:2\.142\.210|9\.254\.2)|72\.122\.98)|(?:8\.138\.170\.16|4\.50\.95\.1)0|5\.(?:147\.243\.238|211\.48\.91)|9\.1(?:43\.100\.252|72\.21\.125)|2\.(?:54\.21\.45|90\.89\.80)|0\.108\.253\.223|6\.161\.241\.115|1\.123\.47\.9)|6(?:2\.(?:183\.110\.247|24\.79\.40)|1\.1(?:39\.151\.18|12\.19\.81)|7\.1(?:9\.102\.194|5\.126\.22)|4\.(?:50\.151\.101|78\.2\.10)|5\.110\.50\.17[01]|9\.64\.155\.181)|41\.(?:137\.(?:(?:24|30|56)\.4|63\.20[123])|206\.13\.3))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|9\.2)|0\.253\.4)|8(?:2\.194\.220|9\.46\.246)|14\.6\.11)|82\.172\.28)|0\.(?:1(?:4(?:4\.113\.27|7\.7\.153)|60\.251\.210)|210\.25\.225|30\.236\.34|79\.219\.40)|4\.(?:1(?:26\.180\.118|58\.204\.250)|(?:44\.136\.17|50\.9\.11)4)|6\.(?:2(?:01\.207\.19|8\.52\.)1|12\.226\.34)|8\.106\.26\.(?:54|77)|3\.239\.44\.193)|2(?:(?:2\.1(?:54\.24\.2|28\.96\.)5|4\.158\.110\.6)4|1\.(?:(?:191\.7\.16|52\.152\.)2|78\.236\.38)|8\.121\.143\.48|\.230\.125\.150|5\.20\.82\.197|3\.27\.79\.11)|09\.(?:8(?:6\.(?:159\.53|55\.66)|7\.70\.225)|22(?:7\.250\.128|9\.235\.135))|1(?:1\.224\.250\.13[245]|2\.133\.198\.146|8\.233\.254\.112)|8(?:4\.105\.195\.(?:75|86)|9\.124\.131\.106|6\.6\.161\.214)|4(?:0\.11(?:9\.164\.187|3\.183\.50)|8\.244\.172\.122)|78\.(?:49\.(?:255\.104|95\.79)|23\.151\.242)|68\.187\.24\.98)|2(?:1(?:6\.(?:157\.1(?:4(?:6\.(?:1(?:28|92)|64)|8\.(?:192|64))|5[04]\.(?:19)?2)|8(?:1\.7(?:(?:1\.19|2\.)2|[03]\.(?:64|2))|6\.14
5\.18[02]))|2\.(?:1(?:99\.(?:104\.162|29\.145)|18\.142\.7[67])|7(?:1\.150\.146|6\.80\.165)|200\.126\.244|87\.183\.10)|3\.(?:1(?:8(?:4\.2(?:24\.37|54\.13)|6\.38\.38)|67\.23\.58)|94\.190\.1[124])|7\.(?:1(?:75\.123\.40|14\.9\.171)|76\.2\.129)|(?:8\.248\.44\.19|9\.255\.18\.3)6|0\.(?:212\.163\.42|91\.239\.10)|1\.202\.2\.178)|0(?:2\.(?:1(?:(?:52\.194\.12|33\.49\.5)9|08\.3\.184)|28\.(?:66\.251|24\.99)|75\.3(?:8\.209|6\.93))|3\.(?:1(?:7(?:2\.246\.60|7\.246\.22)|93\.137\.3)|2(?:52\.161\.179|17\.176\.65)|91\.117\.3)|(?:0\.88\.236\.3|1\.251\.250\.)3|4\.(?:188\.168\.11|8\.46\.130)|9\.210\.195\.190|8\.131\.186\.2)|2(?:0\.231\.69\.14|2\.252\.223\.2)|4\.177\.65\.188)|9(?:1\.(?:1(?:9(?:5\.(?:230\.1[01]|136\.14)|8\.(?:175\.253|86\.7))|49\.162\.228|21\.175\.20)|2(?:0(?:2\.25\.138|3\.67\.212)|14\.(?:128\.2[01]|83\.2)))|3\.(?:1(?:5(?:5\.194\.176|9\.243\.49)|26\.15\.49|90\.104\.7)|91\.196\.99)|4\.(?:2(?:45\.156\.55|3\.60\.124)|79\.49\.116|142\.4\.30)|2\.(?:24(?:7\.250\.234|3\.187\.50)|50\.192\.5
4)|5\.1(?:54\.(?:240\.98|96\.147)|69\.208\.117)|0\.176\.72\.198|6\.45\.176\.194|8\.172\.16\.180)|8(?:2\.(?:1(?:14\.(?:7(?:6\.210|9\.86)|86\.122)|93\.140\.16[48])|207\.99\.94)|9\.(?:1(?:06\.161\.130|20\.204\.16)|2(?:15\.189\.170|37\.26\.2))|7\.(?:2(?:52\.228\.249|26\.242\.7)|103\.236\.121)|8\.(?:1(?:01\.165\.75|35\.83\.108)|255\.153\.106)|3\.14(?:2\.111\.228|3\.237\.240)|4\.15\.191\.254|0\.95\.70\.173|6\.98\.23\.121)|7(?:7\.(?:23(?:2\.142\.210|9\.254\.2)|121\.85\.68)|9\.1(?:43\.100\.252|72\.21\.125|10\.129\.8)|5\.(?:147\.243\.238|211\.48\.91)|2\.(?:54\.21\.45|90\.89\.80)|0\.108\.253\.223|6\.161\.241\.115|8\.90\.234\.17|1\.123\.47\.9|4\.50\.95\.10)|6(?:1\.1(?:39\.151\.18|12\.19\.81|26\.28\.97)|(?:4\.50\.151\.10|9\.64\.155\.18)1|2\.(?:183\.110\.247|24\.79\.40)|5\.110\.50\.17[01])|4(?:1\.(?:137\.(?:(?:24|30|56)\.4|63\.20[123])|206\.13\.3)|6\.47\.74\.27)|58\.150\.55\.59)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:9\.(?:2(?:1[3679]|0[124]|22)|19[23])|3\.(?:9[26]?|8)|5\.(?:23|34)|2\.246)|3\.(?:1(?:62\.(?:244|67)|0\.16[2378])|30\.110)|6\.71\.(?:[56]|2(?:[34]|1[78])?|1(?:48|50)|44)|0\.49\.(?:193|205))|25\.23(?:4\.144|5\.192)|88\.135\.2|95\.91\.70)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[2678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|(?:0\.83\.23|2\.178\.6)9|7\.252\.243)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|41\.(?:254\.[01]|95\.[48])|61\.19\.6[56])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:9\.(?:2(?:0[24]|16|22)|19[23])|2\.246)|3\.(?:1(?:0\.16[2378]|62\.67)|30\.110)|6\.71\.(?:2(?:18|4)|150|6)|4\.216\.102|0\.49\.205)|9(?:3\.25\.121|5\.91\.70)|25\.23(?:4\.144|5\.192)|88\.135\.2)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[2678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|(?:0\.83\.23|2\.178\.6)9|7\.252\.243)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|41\.(?:254\.[01]|95\.[48])|61\.19\.6[56])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8