You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2010/12/04 07:57:46 UTC
svn commit: r1042106 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sat Dec 4 06:57:45 2010
New Revision: 1042106
URL: http://svn.apache.org/viewvc?rev=1042106&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1042106&r1=1042105&r2=1042106&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sat Dec 4 06:57:45 2010
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20101231
+## khop-sc-neighbors.cf v 20101241
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:2(?:3\.2[67]|2\.168|5\.160)|1(?:3\.(?:169|22)|8\.96)|82\.177)|222\.253)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:2(?:3\.2[367]|2\.168|5\.160)|1(?:3\.169|8\.96)|82\.177)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:6\.(?:157\.14[68]|81\.70)|3\.(?:233\.6|88\.)4|7\.118\.82|1\.147\.3)|0(?:3\.217\.145|9\.51\.134))|1(?:13\.162\.(?:1(?:00|25)|237)|25\.16(?:3\.5[34]|2\.242))|41\.(?:137\.(?:24|63)|254\.1)|8(?:1\.192\.238|9\.232\.105)|9(?:5\.158\.184|1\.198\.86))\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.16(?:2\.(?:125|74)|7\.111)|8\.96\.250)|25\.16(?:2\.242|3\.53)|09\.172\.53|78\.32\.64)|2(?:1(?:3\.(?:233\.6|88\.)4|2\.199\.197|7\.118\.82)|0(?:3\.217\.145|9\.51\.134))|9(?:(?:1\.198\.8|3\.186\.9)6|5\.158\.184)|8(?:1\.192\.2(?:11|38)|9\.232\.105)|41\.(?:137\.(?:24|56|63)|254\.1)|64\.120\.98)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:13\.16(?:2\.(?:2(?:4[46]|[23]8)|7[47]|[59]6|67)|7\.111)|8(?:6\.2\.1(?:36|44)|8\.95\.50)|7(?:3\.236\.8|8\.32\.6)4|25\.162\.243|94\.170\.16)|2(?:1(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|3\.87\.7[46]|2\.199\.197|8\.248\.64|6\.38\.2)|0(?:3\.(?:152\.2|82\.95)|8\.100\.48))|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|1\.192\.(?:2(?:11|38)|199)|(?:0\.83\.23|2\.178\.6)9|3\.149\.(?:[24]1|35?))|7(?:7\.232\.14[23]|9\.106\.109)|6(?:1\.19\.6[67]|4\.187\.113)|9(?:5\.129\.166|1\.203\.67)|41\.254\.[01])\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|3\.(?:233\.64|87\.76)|8\.248\.64|6\.38\.2)|0(?:3\.(?:152\.2|82\.95)|0\.125\.169|8\.100\.48))|1(?:8(?:6\.2\.1(?:36|44)|4\.105\.195|8\.95\.50)|13\.162\.(?:2(?:4[046]|28)|[67]7|56)|25\.162\.243|73\.236\.84|94\.170\.16)|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|1\.192\.(?:2(?:11|38)|199)|(?:0\.83\.23|2\.178\.6)9|3\.149\.(?:[24]1|35?))|7(?:7\.232\.14[23]|9\.106\.109|4\.82\.212)|6(?:1\.19\.6[67]|4\.187\.113)|9(?:5\.129\.166|1\.203\.67)|41\.(?:254\.[01]|95\.4))\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|82\.194\.220)|91\.54\.12[01])|3\.(?:1(?:07\.184\.193|40\.209\.26)|227\.11\.116|6\.12\.65)|4\.1(?:26\.180\.118|65\.147\.23|70\.16\.85)|0\.(?:124\.0\.130|234\.12\.87|30\.236\.34)|6\.201\.207\.191|9\.236\.117\.210)|1(?:3\.16(?:2\.125\.229|0\.113\.54|1\.16\.80)|1\.(?:224\.250\.13[45]|68\.108\.200)|7\.2(?:11\.83\.131|40\.236\.34)|8\.233\.254\.112)|2(?:1\.(?:52\.15(?:8\.245|2\.2)|191\.7\.162)|4\.1(?:58\.110\.64|24\.43\.32)|2\.252\.234\.74|5\.20\.82\.195|3\.27\.79\.11)|8(?:8\.(?:95\.50\.14[28]|230\.26\.12)|(?:0\.188\.253\.1|7\.9\.156\.5)0|4\.105\.195\.69)|7(?:8\.(?:166\.131\.119|32\.64\.195)|3\.236\.84\.1(?:38|41)|4\.49\.73\.23)|63\.2(?:0\.(?:94\.130|8\.5)|1\.100\.4)|5(?:0\.176\.101\.24|3\.19\.157\.)1|40\.135\.131\.202)|2(?:1(?:6\.(?:157\.1(?:5(?:0\.(?:1(?:28|92)|64)|4\.(?:1(?:28|92)|2))|4[68]\.(?:1(?:28|92)|64|2))|81\.7(?:0\.(?:1(?:28|92)|64|2)|2\.(?:128|64|2)|1\.(?:192|64)|3
\.(?:64|2))|38\.2\.1(?:6[579]|7[019]))|2\.1(?:99\.197\.121|18\.142\.77|82\.1\.249)|0\.(?:212\.163\.42|91\.239\.10)|7\.(?:128\.191\.20|76\.2\.12)9|1\.(?:147\.3\.74|58\.59\.73)|8\.248\.44\.196|9\.147\.208\.34|3\.186\.38\.38)|0(?:1\.(?:1(?:16\.140\.246|44\.130\.21)|251\.250\.3)|2\.(?:75\.36\.9[35]|183\.233\.4|28\.24\.99)|0\.1(?:08\.109\.179|52\.113\.24)|8\.1(?:00\.48\.[59]|31\.186\.2)|3\.1(?:50\.231\.|90\.36\.2)45|5\.251\.152\.142|9\.51\.134\.214|6\.53\.73\.196|7\.57\.122\.80)|2(?:2\.(?:83\.211\.201|252\.223\.2)|1\.120\.224\.146|0\.231\.69\.13)|7\.38\.1(?:(?:18\.13|4\.21)4|2\.149)|4\.105\.128\.138)|8(?:2\.(?:1(?:93\.140\.168|14\.79\.163|50\.185\.32|40\.91\.41)|213\.2\.170|79\.26\.204)|0\.(?:9(?:5\.70\.173|3\.124\.1)|65\.16\.71)|8\.(?:146\.221\.210|255\.153\.106)|4\.(?:15\.191\.254|72\.249\.190)|3\.1(?:42\.111\.228|6\.167\.14)|1\.24\.123\.188|9\.161\.158\.80|5\.43\.241\.1|6\.98\.74\.26)|7(?:6\.(?:1(?:61\.241\.115|75\.225\.157)|3\.92\.158|4\.95\.222)|7\.(?:232\.6(?:9\.160|8\.23)|
92\.159\.102)|2\.(?:242\.74\.138|54\.21\.45)|4\.(?:82\.212\.149|50\.95\.17)|8\.(?:100\.36\.138|40\.254\.1)|0\.108\.253\.223|1\.230\.221\.79|5\.150\.73\.177)|9(?:3\.(?:9(?:1\.196\.(?:132|99)|5\.168\.122)|1(?:59\.243\.49|88\.9\.34))|1\.(?:1(?:87\.103\.60|93\.199\.4)|214\.83\.2)|4\.1(?:9\.254\.143|42\.234\.1)|8\.215\.107\.19)|6(?:4\.1(?:87\.113\.2(?:2[6789]|3[123])|20\.98\.14[78])|1\.1(?:39\.151\.18|12\.19\.81|26\.28\.97)|(?:2\.193\.216\.5|5\.24\.211\.12)8|9\.64\.155\.181|8\.71\.135\.90)|5(?:8\.250\.11(?:6\.1(?:09|23)|8\.(?:224|62)|7\.1(?:57|3)|9\.64)|9\.(?:144\.125\.157|25\.182\.92))|41\.(?:137\.(?:(?:2[04]|56)\.4|63\.20[123])|206\.13\.3))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:2(?:1(?:6\.(?:157\.1(?:5(?:0\.(?:1(?:28|92)|64)|4\.192)|4(?:6\.(?:1(?:28|92)|2)|8\.2))|81\.7(?:0\.(?:128|64|2)|(?:1\.19|2\.)2|3\.(?:64|2))|38\.2\.1(?:7[0169]|6[579]))|2\.1(?:99\.197\.121|18\.142\.77|74\.232\.22|82\.1\.249)|0\.(?:212\.163\.42|91\.239\.10)|7\.(?:128\.191\.20|76\.2\.12)9|1\.(?:147\.3\.74|58\.59\.73)|8\.248\.44\.196|9\.147\.208\.34|3\.186\.38\.38)|0(?:0\.(?:1(?:08\.109\.179|52\.113\.24)|95\.162\.206|88\.236\.33)|1\.(?:1(?:16\.140\.246|44\.130\.21)|251\.250\.3)|2\.(?:75\.36\.9[35]|183\.233\.4|28\.24\.99)|8\.1(?:00\.48\.[579]|31\.186\.2)|(?:7\.57\.122\.8|4\.8\.46\.13)0|3\.1(?:50\.231\.|90\.36\.2)45|9\.51\.134\.214|6\.53\.73\.196)|2(?:0\.(?:130\.204\.91|231\.69\.13)|2\.(?:83\.211\.201|252\.223\.2)|1\.120\.224\.146)|7\.38\.1(?:(?:18\.13|4\.21)4|2\.149)|4\.(?:105\.128\.13|64\.74\.5)8)|1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|82\.194\.220)|91\.54\.12[01]|83\.235\.207)|4\.1(?:(?:26\.180\.11|58\.206\.5)8|
65\.147\.23|70\.16\.85)|3\.(?:(?:140\.209\.2|227\.11\.11)6|6\.12\.65)|0\.(?:124\.0\.130|30\.236\.34)|6\.201\.207\.191|9\.236\.117\.210)|1(?:1\.(?:224\.250\.13[45]|68\.108\.200)|7\.2(?:11\.83\.131|40\.236\.34)|3\.16(?:2\.125\.229|1\.16\.80)|8\.233\.254\.112)|2(?:1\.(?:52\.15(?:8\.245|2\.2)|191\.7\.162)|(?:2\.252\.234\.7|4\.158\.110\.6)4|5\.20\.82\.195|3\.27\.79\.11)|8(?:8\.(?:95\.50\.14[248]|187\.148\.42)|(?:0\.188\.253\.1|7\.9\.156\.5)0|4\.105\.195\.(?:69|74))|7(?:8\.(?:166\.131\.119|32\.64\.195)|3\.236\.84\.1(?:4[01]|38)|4\.49\.73\.23)|63\.2(?:0\.(?:94\.130|8\.5)|1\.100\.4)|5(?:0\.176\.101\.24|3\.19\.157\.)1|40\.135\.131\.202|09\.166\.136\.0)|8(?:2\.(?:1(?:93\.140\.168|14\.79\.163|50\.185\.32|40\.91\.41)|79\.26\.204)|4\.(?:1(?:24\.34\.100|5\.191\.254)|72\.249\.190)|0\.(?:9(?:5\.70\.173|3\.124\.1)|65\.16\.71)|8\.(?:146\.221\.210|255\.153\.106)|5\.(?:90\.193\.240|43\.241\.1)|3\.142\.111\.228|9\.161\.141\.147|6\.98\.74\.26)|9(?:3\.(?:1(?:(?:59\.(?:243\.4|49\.21)|26\.15\.4)9|88
\.9\.34)|9(?:1\.196\.(?:132|99)|5\.168\.122))|4\.(?:1(?:9\.254\.143|42\.234\.1)|(?:245\.156\.3|79\.4\.)3)|1\.(?:193\.199\.4|214\.83\.2)|2\.241\.182\.36|8\.215\.107\.19|5\.20\.219\.73)|7(?:7\.(?:232\.6(?:9\.160|8\.23)|92\.159\.102)|4\.(?:82\.212\.14[29]|50\.95\.17)|8\.(?:242\.171\.123|100\.36\.138)|6\.(?:161\.241\.115|4\.95\.222)|5\.1(?:50\.73\.177|18\.35\.63)|0\.108\.253\.223|2\.54\.21\.45)|6(?:4\.1(?:87\.113\.2(?:3[123]|2[89])|20\.98\.1(?:4[78]|50))|1\.1(?:39\.151\.18|12\.19\.81|26\.28\.97)|8\.(?:184\.96\.139|71\.135\.90)|2\.193\.216\.58|9\.64\.155\.181|5\.119\.8\.186)|5(?:8\.250\.11(?:6\.1(?:09|23)|8\.(?:224|62)|7\.1(?:57|3))|9\.(?:144\.125\.157|25\.182\.92))|41\.(?:137\.(?:(?:2[04]|56)\.4|63\.20[123])|206\.13\.3))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.1(?:6(?:2\.(?:1(?:2[0458]|1[78]|3[29]|00|41)|2(?:2[4578]|4[3456]|3[48])|6[157]|7[479]|9[67]|56|87)|8\.1(?:[15]|3[07]|4[13])|9\.18[0123]|7\.111)|85\.2)|9\.15(?:9\.(?:2(?:0[0124689]|1[12345]|2[0123])|19[2356789])|3\.(?:[0346]|1[23469]|8[4579]?|9[0258]?)|5\.(?:9[6789]|10[01])|6\.(?:17|20))|7\.(?:2(?:0(?:0\.(?:2(?:1[024]|0[89])|17[89])|3\.144)|4(?:1\.(?:24[89]|8[01]|144)|2\.28))|19(?:8\.(?:8[79]|90)|9\.50))|6\.71\.(?:2(?:[67]|1[2468]|2[23]|09?)|1(?:4[579]|51|0)?|30|8)|0\.49\.(?:193|205)|8\.71\.9)|8(?:0\.194\.0|6\.2\.136|8\.135\.2)|25\.(?:162\.243|234\.144)|\.53\.14[89])|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|7[46]|90)|8\.248\.64|2\.95\.7)|0(?:3\.(?:1(?:28\.250|52\.2)|82\.95)|2\.152\.243)|22\.25(?:2\.15[89]|3\.179))|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|2\.1(?:28\.(?:5[45]|87)|78\.69)|1\.192\.(?:2(?:1[15]|38)|199)|3\.149\.(?:4[135]|2[18]|35?)|9\.204\.1(?:37|53
)|8\.255\.113|0\.83\.239)|5(?:9\.9(?:9\.(?:1(?:5[2345]|2[89]|3[01])|5[6789]|[46]0)|7\.2(?:1[067]|0[89])|8\.1(?:28|44|52))|8\.186\.14)|41\.(?:2(?:54\.[012]|02\.198)|95\.[48])|6(?:1\.19\.6[567]|6\.87\.[0258])|9(?:2\.39\.7[479]|1\.203\.67)|77\.232\.14[23])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.1(?:6(?:2\.(?:1(?:1[78]|2[45]|3[29]|00|41)|2(?:2[4578]|4[0346]|3[48])|6[157]|7[479]|9[67]|56|87)|8\.1(?:4[13]|37|5)|9\.18[0123]|7\.111)|85\.2)|9\.15(?:9\.(?:2(?:0[0124689]|1[123459]|2[0123])|19[2356789])|3\.(?:8[14579]?|1[2369]?|9[0358]|3)|5\.(?:9[6789]|10[01])|6\.(?:2[02]|17))|7\.(?:2(?:00\.(?:2(?:1[024]|0[89])|1(?:60|78|93))|41\.(?:24[89]|8[01]|144))|19(?:8\.(?:8[79]|90)|9\.5[45]))|6\.71\.(?:2(?:[0567]|1[2468]|23)|1(?:4[579]|51|0)?|8)|0\.49\.(?:193|205)|8\.71\.9)|8(?:0\.194\.0|6\.2\.136|8\.135\.2)|25\.(?:162\.243|234\.144)|\.53\.14[89])|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|2\.1(?:28\.(?:5[45]|87)|78\.69)|3\.149\.(?:3[57]?|4[135]|2[18])|9\.2(?:04\.1(?:37|53)|32\.105)|1\.192\.(?:2(?:1[15]|38)|199)|8\.255\.113|0\.83\.239)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|7[46]|9[01])|8\.248\.64|2\.95\.7)|0(?:3\.(?:1(?:28\.250|52\.2)|82\.95)|2\.152\.243)|22\.25(?:2\.
15|3\.17)9)|5(?:9\.9(?:9\.(?:1(?:5[234]|2[89]|3[01])|5[6789]|40)|7\.2(?:1[067]|0[89])|8\.1(?:44|52))|8\.186\.14)|6(?:6\.87\.[01258]|1\.19\.6[567])|9(?:2\.39\.7[47]|1\.203\.67)|41\.(?:254\.[012]|95\.[48])|77\.232\.14[23])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8