You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/01/28 07:57:54 UTC
svn commit: r1064469 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Fri Jan 28 06:57:54 2011
New Revision: 1064469
URL: http://svn.apache.org/viewvc?rev=1064469&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1064469&r1=1064468&r2=1064469&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Fri Jan 28 06:57:54 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201101271
+## khop-sc-neighbors.cf v 201101281
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:87|90)|201|59)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:22|87|90)|201)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:1(?:0\.13[69]|3\.167|8\.96)|25\.160)|92\.8[16])(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:1(?:0\.13[69]|3\.167|8\.96)|2(?:2\.168|5\.160|3\.27))|92\.8[16])(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.1(?:62\.(?:237|96)|0\.16[69])|8\.96\.2(?:03|31)|0\.139\.205|1\.68\.108)|25\.162\.243|78\.49\.255|88\.65\.50)|8(?:1\.192\.2(?:11|38)|5\.26\.225|3\.149\.3)|21(?:(?:3\.233|8\.248)\.64|7\.118\.81)|7(?:7\.232\.142|8\.108\.79)|9(?:1\.198\.86|8\.139\.91)|41\.(?:137\.24|254\.1)|58\.64\.187)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.162\.(?:237|96)|1\.68\.108|8\.96\.231)|25\.162\.243|78\.49\.255|88\.65\.50)|2(?:1(?:(?:3\.233|8\.248)\.64|7\.118\.(?:81|90))|09\.212\.153)|8(?:1\.192\.238|3\.149\.21|5\.26\.225)|7(?:7\.232\.142|8\.108\.79)|41\.(?:137\.24|254\.1)|58\.64\.187|98\.139\.91)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:13\.(?:1(?:0\.16[469]|62\.24[46])|61\.63)|8(?:4\.1(?:05\.195|54\.138)|0\.149\.8)|2(?:5\.234\.144|2\.55\.106)|7(?:4\.36\.86|8\.32\.64)|01\.78\.23|95\.91\.70)|2(?:1(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|3\.(?:2(?:26\.63|33\.64)|87\.74)|1\.147\.3)|0(?:9\.212\.153|3\.82\.95))|8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.2(?:11|38)|2\.178\.69)|7(?:(?:7\.232\.14|2\.46\.15)3|4\.117\.211|9\.106\.109)|9(?:5\.129\.166|1\.203\.67|8\.139\.91)|6(?:3\.246\.155|9\.80\.238|1\.19\.66)|41\.(?:254\.[012]|95\.4))\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.(?:1(?:62\.2(?:4[46]|38)|0\.16[469])|61\.63)|4\.112\.244)|2(?:5\.234\.144|2\.55\.106)|7(?:4\.36\.86|8\.32\.64)|84\.105\.195|01\.78\.23|95\.91\.70)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.2(?:11|38)|0\.83\.238|2\.178\.69)|2(?:1(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|3\.(?:2(?:26\.63|33\.64)|87\.(?:11|7)4)|1\.147\.3)|03\.82\.95)|7(?:(?:7\.232\.14|2\.46\.15)3|9\.106\.109)|9(?:5\.129\.166|1\.203\.67|8\.139\.91)|6(?:3\.246\.155|9\.80\.238|1\.19\.66)|41\.254\.[012])\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.1(?:05\.195\.(?:7[023689]|9[134]|8[07]|68)|54\.138\.(?:1(?:1[389]|0[27])|99))|8\.(?:207\.130\.206|55\.230\.201|97\.76\.210)|9\.22(?:1\.246\.2|0\.47\.1)9|7\.66\.26\.141|6\.0\.2\.48)|7(?:3\.(?:2(?:45\.79\.1(?:2[04]|07)|10\.25\.146|0\.18\.105|9\.247\.70)|15\.60\.189)|8\.(?:23(?:7\.187\.10|\.151\.242)|49\.255\.10[34]|32\.64\.195)|4\.36\.86\.1(?:1[2459]|2[2346]))|9(?:5\.1(?:6(?:1\.(?:40\.10|9\.2)|0\.253\.4)|(?:82\.194\.2|35\.237\.)20)|6\.201\.207\.191|0\.30\.236\.34)|2(?:(?:1\.(?:191\.7\.16|52\.152\.)|4\.124\.43\.3)2|2\.252\.234\.75|5\.20\.82\.196|3\.27\.79\.11)|1(?:1\.(?:224\.250\.13[45]|68\.108\.200)|3\.162\.237\.59)|09\.74\.134\.150|51\.23\.183\.179|61\.58\.148\.117)|2(?:1(?:7\.(?:1(?:(?:23\.133\.7|9\.202\.3)2|51\.78\.134)|21\.247\.82|76\.2\.129)|6\.(?:1(?:57\.1(?:38\.19|29\.)|76\.16\.20)2|58\.41\.121)|3\.(?:1(?:7\.159\.66|81\.48\.24)|39\.250\.139)|2\.(?:1(?:39\.101\.56|99\.29\.145)|3\.113\.2)|8\.(?:248\.44\.1|94\.65
\.)96|0\.212\.163\.42|9\.255\.47\.215|1\.147\.3\.74)|0(?:2\.(?:1(?:5(?:2\.(?:194\.128|201\.37)|1\.76\.226)|0(?:3\.204\.86|8\.3\.184))|9\.109\.172|28\.24\.99)|0\.(?:95\.162\.206|51\.42\.243)|9\.212\.153\.2(?:1[12456]|09)|1\.144\.130\.21|8\.131\.186\.2|4\.8\.46\.130)|4\.(?:1(?:3(?:0\.222\.58|\.53\.131)|13\.85\.109|0\.26\.43)|22\.40\.109)|22\.252\.223\.2)|6(?:8\.(?:1(?:51\.32\.176|90\.19\.57)|5(?:7\.218\.185|8\.19\.180)|36\.229\.134)|4\.(?:1(?:48\.129\.140|27\.37\.68)|207\.14\.133)|6\.(?:5(?:6\.34\.240|8\.215\.72)|143\.148\.249)|7\.(?:1(?:69\.82\.235|84\.0\.64)|225\.141\.154)|9\.(?:199\.164\.222|219\.222\.93|64\.155\.181)|3\.(?:246\.155\.(?:21[67]|44)|173\.119\.179)|1\.142\.213\.158|2\.212\.216\.249|5\.47\.145\.226)|8(?:2\.(?:1(?:9(?:3\.140\.168|9\.96\.97)|14\.(?:65\.246|79\.163))|213\.2\.82)|4\.(?:1(?:5\.191\.254|09\.98\.91)|229\.116\.243|51\.44\.66)|3\.1(?:4(?:2\.111\.228|3\.237\.240)|73\.164\.10)|0\.(?:(?:105\.193\.|230\.24\.1)26|95\.70\.173)|1\.(?:255\.83\.190|1\.194\.252|9
0\.161\.73)|7\.(?:126\.253\.24|70\.187\.147)|8\.255\.153\.106|6\.36\.49\.1)|7(?:2\.(?:(?:245\.178\.13|54\.21\.4)5|46\.153\.2(?:2[012]|1[89]))|4\.(?:1(?:17\.211\.2(?:29|48)|4\.243\.15)|254\.146\.125)|7\.(?:2(?:32\.142\.224|28\.214\.52)|92\.159\.102)|5\.(?:150\.241\.238|211\.8\.97)|6\.161\.241\.115|1\.58\.108\.122|9\.180\.45\.66)|9(?:3\.(?:1(?:25\.(?:40\.15|3\.19)|55\.147\.186|90\.104\.7)|91\.196\.(?:132|99))|4\.(?:2(?:3(?:6\.202\.13|\.60\.124)|45\.156\.33)|97\.52\.85)|5\.1(?:70\.183\.255|54\.240\.98)|8\.2(?:21\.201\.141|08\.81\.28)|2\.103\.162\.252|9\.170\.201\.206)|4(?:1\.137\.(?:(?:24|30|56)\.4|63\.20[123])|6\.17\.121\.1)|5(?:8\.1(?:85\.35\.121|50\.55\.59)|9\.167\.126\.19))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:2(?:1(?:7\.(?:1(?:(?:23\.133\.7|9\.202\.3)2|51\.78\.134)|21\.247\.82|76\.2\.129)|6\.(?:1(?:(?:76\.16\.20|57\.129\.)2|67\.172\.29)|58\.41\.121)|3\.(?:1(?:7\.159\.66|81\.48\.24)|39\.250\.139)|2\.(?:1(?:39\.101\.56|99\.29\.145)|3\.113\.2)|9\.(?:157\.200\.19|255\.47\.215)|8\.(?:248\.44\.1|94\.65\.)96|0\.212\.163\.42|1\.147\.3\.74)|0(?:2\.(?:1(?:52\.(?:194\.128|201\.37)|03\.204\.86)|(?:55\.191\.2|9\.109\.17)2|28\.24\.99)|0\.(?:152\.100\.193|95\.162\.206)|8\.1(?:31\.186\.2|89\.6\.130)|9\.212\.153\.21[456]|4\.8\.46\.130)|4\.(?:1(?:3(?:(?:9\.10\.22|\.53\.13)1|0\.222\.58)|13\.85\.109|26\.237\.57)|22\.40\.109)|2(?:0\.253\.2\.175|2\.252\.223\.2))|1(?:7(?:8\.(?:2(?:3(?:7\.187\.10|\.151\.242)|2\.55\.93)|49\.255\.10[34]|32\.64\.195)|3\.(?:2(?:10\.25\.146|0\.18\.105|9\.247\.70)|15\.60\.189)|4\.36\.86\.1(?:1[2459]|2[23]))|8(?:4\.1(?:05\.195\.(?:7[023689]|9[134])|54\.138\.(?:1(?:1[89]|07)|99))|8\.(?:207\.130\.206|62\.69\.142|97\.76\.210)|9\.2
21\.246\.29|0\.92\.174\.84|7\.66\.26\.141)|2(?:(?:1\.(?:191\.7\.16|52\.152\.)|4\.124\.43\.3)2|\.190\.129\.198|5\.20\.82\.196|3\.27\.79\.11)|9(?:5\.1(?:6(?:1\.(?:40\.10|9\.2)|0\.253\.4)|35\.237\.20)|3\.226\.161\.154)|1(?:1\.(?:224\.250\.13[45]|68\.108\.200)|3\.162\.237\.59|6\.109\.172\.57)|61\.58\.148\.117)|6(?:8\.(?:1(?:51\.32\.176|90\.19\.57)|5(?:7\.218\.185|8\.19\.180)|36\.229\.134)|2\.(?:21(?:2\.216\.249|4\.127\.148)|83\.172\.159)|7\.(?:18(?:1\.235\.159|4\.0\.64)|225\.141\.154)|9\.(?:199\.164\.222|219\.222\.93|64\.155\.181)|3\.(?:246\.155\.(?:21[67]|44)|139\.163\.42)|6\.(?:143\.148\.249|56\.34\.240)|4\.1(?:48\.129\.140|27\.37\.68)|5\.(?:47\.145\.226|31\.22\.229)|1\.142\.213\.158)|9(?:5\.(?:1(?:05\.223\.140|70\.183\.255|54\.240\.98)|48\.104\.170|62\.161\.69)|3\.(?:1(?:55\.147\.186|25\.40\.15|90\.104\.7)|91\.196\.(?:132|99))|8\.(?:2(?:2(?:1\.201\.141|3\.186\.34)|08\.81\.28)|17\.181\.236)|4\.(?:2(?:3(?:6\.202\.13|\.60\.124)|45\.156\.33)|97\.52\.85)|2\.1(?:03\.162\.252|27\.24
7\.97)|9\.1(?:70\.201\.206|94\.74\.37)|6\.(?:52\.205\.2|226\.4\.6)0|7\.92\.204\.31)|8(?:2\.(?:1(?:14\.(?:65\.246|79\.163)|93\.140\.168)|213\.2\.82)|4\.(?:1(?:5\.191\.254|09\.98\.91)|229\.116\.243|51\.44\.66)|3\.1(?:4(?:2\.111\.228|3\.237\.240)|73\.164\.10)|0\.(?:9(?:7\.199\.131|5\.70\.173)|105\.193\.26)|7\.(?:126\.253\.24|70\.187\.147)|1\.(?:255\.83\.190|90\.161\.73)|8\.255\.153\.106|5\.249\.31\.249|6\.36\.49\.1)|7(?:5\.(?:1(?:50\.241\.238|84\.127\.176|44\.42\.241)|2(?:4\.80\.11|11\.8\.9)7)|2\.(?:(?:245\.178\.13|54\.21\.4)5|46\.153\.2(?:1[89]|2[01]))|1\.(?:(?:211\.46\.18|38\.17\.21)7|58\.108\.122|125\.12\.15)|7\.(?:2(?:32\.142\.224|28\.214\.52)|92\.159\.102)|6\.1(?:0(?:3\.116\.136|5\.19\.41)|26\.40\.233)|4\.(?:254\.146\.12|14\.243\.1)5)|5(?:8\.1(?:85\.35\.121|50\.55\.59)|9\.167\.126\.19|7\.66\.84\.53)|4(?:1\.137\.(?:(?:24|30|56)\.4|63\.20[123])|6\.17\.121\.1))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.(?:15(?:9\.(?:2(?:0[0258]|1[5789]|2[01])|198)|3\.(?:12|8)|5\.101|6\.26)|206\.243)|3\.1(?:62\.(?:2(?:2[58]|4[46]|38)|118|96)|0\.16[4569])|7\.2(?:00\.1(?:9[24]|77)|41\.(?:248|81))|0\.49\.(?:193|205)|6\.71\.14[58])|2(?:2\.(?:163\.23|55\.106)|5\.23(?:4\.144|5\.192))|8(?:8\.146\.(?:127|255)|4\.151\.63|0\.149\.8)|95\.91\.70)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:[89]|3[2678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|9\.204\.1(?:37|53)|0\.83\.23[89]|2\.178\.69)|2(?:1(?:3\.(?:87\.(?:(?:11|7)4|8[01789]|9[012])|226\.63)|7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146))|0(?:(?:1\.191\.1|3\.82\.)95|2\.152\.243|0\.85\.24))|41\.(?:2(?:54\.[012]|09\.65)|95\.(?:[48]|1?2)|199\.113)|59\.9(?:9\.(?:1(?:5[2345]|2[89]|30)|60)|7\.21[68])|6(?:1\.19\.6[567]|6\.87\.0))\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.(?:15(?:9\.(?:2(?:1[45789]|0[258]|2[01])|19[278])|3\.(?:12|83)|5\.101|6\.26)|206\.243)|3\.1(?:62\.(?:2(?:4[456]|2[58]|38)|118)|0\.16[4569])|7\.2(?:00\.1(?:9[24]|77)|41\.(?:248|81))|6\.71\.1(?:4[58]|50)|0\.49\.(?:193|205))|2(?:2\.(?:163\.23|55\.106)|5\.23(?:4\.144|5\.192))|8(?:8\.146\.(?:127|255)|0\.149\.8)|9(?:6\.202\.214|5\.91\.70))|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:[89]|3[2678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|9\.204\.1(?:37|53)|0\.83\.23[89]|2\.178\.69)|2(?:1(?:3\.(?:87\.(?:(?:11|7)4|8[01789]|9[012])|226\.63)|7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146))|0(?:(?:1\.191\.1|3\.82\.)95|2\.152\.243|0\.85\.24))|59\.9(?:9\.1(?:5[2345]|2[89]|30)|7\.21[68]|8\.152)|41\.(?:2(?:54\.[012]|09\.65)|95\.(?:[48]|1?2))|6(?:1\.19\.6[567]|6\.87\.0))\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8