You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/01/31 07:57:56 UTC
svn commit: r1065494 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Mon Jan 31 06:57:56 2011
New Revision: 1065494
URL: http://svn.apache.org/viewvc?rev=1065494&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1065494&r1=1065493&r2=1065494&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Mon Jan 31 06:57:56 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201101301
+## khop-sc-neighbors.cf v 201101311
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:22|87|90)|201)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:8[79]|22)|201)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -39,7 +39,7 @@ score KHOP_SC_CIDR8 0.2 0.1 0.3 0.2
# 12.0753/0.0359 0.997 20100409 solo=12.1265/0.0412@0.997
# 12.1449/0.0139 0.999 20100410 net, solo=12.1966/0.0197@0.998, ->.2 .1 .3 .2
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|78|89)|95)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|78|90)|95)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:1(?:0\.13[69]|3\.167|8\.96)|2(?:3\.2[67]|2\.168|5\.160))(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:1(?:0\.13[69]|3\.167|8\.96)|2(?:3\.2[67]|2\.168))(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.162\.(?:237|96)|0\.139\.205|8\.96\.231)|7(?:3\.245\.79|8\.49\.255)|25\.162\.243|84\.154\.138)|8(?:1\.192\.2(?:11|38)|3\.149\.21|5\.26\.225)|21(?:(?:3\.233|8\.248)\.64|7\.118\.81)|7(?:7\.232\.14[23]|8\.108\.79)|9(?:3\.125\.40|8\.139\.91)|41\.(?:137\.24|254\.1)|58\.64\.187)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.1(?:62\.237|0\.166)|1\.68\.108|8\.96\.231)|7(?:3\.245\.79|8\.49\.255)|84\.154\.138|21\.54\.54)|21(?:(?:3\.233|8\.248)\.64|7\.118\.81)|7(?:7\.232\.14[23]|8\.108\.79)|8(?:1\.192\.238|5\.26\.225)|9(?:3\.125\.40|8\.139\.91)|62\.183\.85|41\.254\.1)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.(?:1(?:62\.2(?:4[46]|38)|0\.16[46])|61\.63)|4\.112\.244|1\.68\.108)|2(?:5\.234\.144|2\.55\.106)|8(?:4\.105\.195|0\.149\.8)|7(?:4\.36\.86|8\.32\.64)|01\.78\.23|95\.91\.70)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.2(?:11|38)|2\.178\.69)|2(?:1(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|3\.(?:2(?:26\.63|33\.64)|87\.74)|1\.147\.3)|03\.82\.95)|9(?:5\.129\.166|1\.203\.67|8\.139\.91)|6(?:3\.246\.155|9\.80\.238|1\.19\.66)|7(?:9\.106\.109|2\.46\.153)|41\.254\.[012])\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.(?:1(?:62\.2(?:4[46]|38)|0\.16[46])|61\.63)|4\.112\.244)|8(?:4\.105\.195|0\.149\.8)|7(?:4\.36\.86|8\.32\.64)|25\.234\.144|95\.91\.70)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:2[18]|4[16]|36?)|1\.192\.2(?:11|38)|2\.178\.69)|2(?:1(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|3\.(?:2(?:26\.63|33\.64)|87\.(?:136|74))|1\.147\.3)|03\.82\.95)|9(?:5\.129\.166|1\.203\.67|8\.139\.91)|6(?:3\.246\.155|9\.80\.238|1\.19\.66)|7(?:9\.106\.109|2\.46\.153)|41\.(?:254\.[012]|137\.24))\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:7(?:3\.(?:2(?:45\.79\.1(?:1[67]|09)|10\.25\.146|0\.18\.105)|169\.42\.77|8\.105\.6)|8\.(?:2(?:3(?:7\.187\.10|\.151\.242)|2\.55\.93)|49\.255\.10[34]|32\.64\.195)|4\.(?:36\.86\.1(?:1[2459]|2[23])|1\.(?:13\.86|48\.9)))|8(?:4\.1(?:54\.138\.(?:1(?:07|18)|99)|05\.195\.(?:7[23689]|94))|8\.(?:2(?:07\.130\.206|\.207\.93)|62\.69\.142)|7\.(?:66\.26\.141|73\.85\.149)|9\.22(?:1\.246\.2|0\.47\.1)9|0\.92\.174\.84)|1(?:1\.(?:224\.250\.13[45]|68\.108\.200)|3\.16(?:5\.129\.133|2\.237\.59)|2\.64\.180\.114|8\.96\.218\.55)|2(?:4\.(?:241\.255\.37|124\.43\.32)|(?:\.155\.164|1\.191\.7)\.162|3\.27\.79\.11)|9(?:5\.1(?:6(?:0\.253\.4|1\.9\.2)|35\.237\.20)|3\.226\.161\.154|0\.12\.80\.150)|47\.236\.238\.10|09\.166\.136\.1)|2(?:1(?:7\.(?:1(?:(?:51\.78\.13|94\.199\.2)4|23\.133\.72)|21\.247\.82)|6\.(?:1(?:67\.172\.29|76\.16\.202)|58\.41\.121)|2\.1(?:46\.157\.10|99\.29\.145|16\.164\.2)|9\.(?:157\.200\.19|255\.47\.215)|3\.(?:39\.250\.139|181\.48\.24)|1\.(?:
202\.2\.178|147\.3\.74)|8\.(?:248\.44\.1|94\.65\.)96|0\.212\.163\.42)|0(?:2\.(?:10(?:9\.133\.181|3\.204\.86)|9\.109\.172|28\.24\.99)|8\.1(?:01\.82\.201|31\.186\.2)|4\.(?:57\.97\.154|8\.46\.130)|0\.95\.162\.206|1\.144\.148\.82)|4\.(?:1(?:13\.85\.109|30\.222\.58)|22\.40\.109)|22\.252\.223\.2)|6(?:8\.(?:(?:5(?:7\.251\.23|8\.19\.18)|82\.113\.22)0|1(?:51\.32\.176|90\.19\.57)|36\.229\.134)|9\.(?:1(?:9(?:8\.(?:58\.62|35\.9)|9\.164\.222)|36\.(?:163\.75|55\.210))|64\.155\.181)|7\.(?:1(?:8(?:7\.215\.197|9\.242\.18)|77\.67\.112)|67\.202\.194)|5\.(?:(?:183\.197\.4|47\.145\.22)6|31\.22\.229)|6\.(?:163\.30\.180|76\.160\.18|94\.77\.202)|2\.(?:212\.216\.24|83\.172\.15)9|3\.246\.155\.(?:21[467]|44)|1\.142\.213\.158|4\.148\.129\.140)|7(?:1\.(?:2(?:39\.144\.233|01\.236\.22)|1(?:25\.12\.15|94\.68\.43)|58\.108\.122)|4\.(?:(?:254\.146\.12|14\.243\.1)5|50\.94\.234|66\.135\.23)|5\.(?:1(?:50\.241\.238|84\.127\.176)|24\.80\.117)|7\.(?:2(?:32\.142\.224|28\.214\.52)|92\.159\.102)|2\.(?:46\.153\.2(?:1[8
9]|2[01])|245\.178\.135)|6\.(?:1(?:26\.40\.233|05\.19\.41)|21\.49\.149)|8\.151\.198\.121)|8(?:4\.(?:1(?:09\.202\.211|5\.191\.254)|204\.147\.82|51\.44\.66)|2\.(?:1(?:93\.140\.168|14\.79\.163)|213\.2\.82)|8\.(?:255\.153\.106|166\.51\.100|40\.102\.242)|3\.1(?:42\.111\.228|73\.164\.10)|5\.(?:107\.232\.20|249\.31\.24)9|7\.(?:126\.253\.24|69\.167\.150)|1\.(?:255\.83\.190|90\.161\.73)|0\.9(?:7\.199\.131|5\.70\.173)|6\.(?:111\.21\.168|36\.49\.1))|9(?:8\.(?:2(?:2(?:1\.201\.141|3\.186\.34)|0(?:6\.90\.151|8\.81\.28))|17\.181\.236)|3\.(?:1(?:25\.40\.15|90\.104\.7|57\.47\.1)|91\.196\.(?:132|99))|2\.(?:1(?:03\.162\.252|26\.214\.177)|25\.125\.7)|5\.(?:154\.240\.98|48\.104\.170|62\.161\.69)|9\.1(?:70\.201\.206|82\.63\.145)|4\.23(?:6\.202\.13|\.60\.124)|6\.(?:52\.205\.2|226\.4\.6)0|7\.92\.204\.31)|4(?:1\.137\.(?:(?:24|30|56)\.4|63\.20[123])|6\.17\.121\.1)|5(?:8\.1(?:85\.35\.121|50\.55\.59)|9\.167\.126\.19)|38\.112\.61\.60)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.1(?:54\.138\.(?:1(?:07|18)|99)|05\.195\.7[268])|8\.(?:2(?:07\.130\.206|\.207\.93)|62\.69\.142)|7\.(?:7(?:3\.85\.149|5\.174\.41)|66\.26\.141)|9\.(?:22(?:1\.246\.2|0\.47\.1)9|42\.32\.210)|0\.92\.174\.84)|7(?:3\.(?:2(?:45\.79\.1(?:1[67]|09)|10\.25\.146|0\.18\.105)|169\.42\.77|8\.105\.6)|4\.(?:36\.86\.1(?:1[59]|22)|1\.(?:13\.86|48\.9))|8\.(?:49\.255\.104|32\.64\.195|22\.55\.93))|2(?:\.1(?:55\.164\.162|90\.129\.198)|4\.(?:241\.255\.37|124\.43\.32)|2\.252\.234\.75|1\.191\.7\.162|3\.27\.79\.11)|1(?:1\.(?:224\.250\.13[45]|68\.108\.200)|3\.16(?:5\.129\.133|2\.237\.59)|2\.64\.180\.114|8\.96\.218\.55)|9(?:5\.1(?:6(?:0\.253\.4|1\.9\.2)|35\.237\.20)|0\.(?:12\.80\.150|26\.113\.55)|3\.226\.161\.154)|47\.236\.238\.10|09\.66\.192\.32)|2(?:1(?:7\.(?:1(?:(?:51\.78\.13|94\.199\.2)4|23\.133\.72)|21\.247\.82)|6\.(?:1(?:67\.172\.29|76\.16\.202)|58\.41\.121)|9\.(?:157\.200\.19|255\.47\.215)|3\.(?:39\.250\.139|181\.48\.24)|2\.1(?:46\.157\.
10|16\.164\.2)|1\.(?:202\.2\.178|147\.3\.74)|8\.(?:248\.44\.1|94\.65\.)96)|0(?:(?:3\.(?:212\.209\.24|86\.10\.23)|0\.95\.162\.20)6|1\.(?:144\.148\.82|0\.105\.144)|2\.(?:103\.204\.86|28\.24\.99)|8\.1(?:01\.82\.201|31\.186\.2)|5\.209\.97\.153|4\.57\.97\.154)|4\.(?:1(?:(?:51\.19\.20|0\.26\.4)3|13\.85\.109|26\.237\.57|30\.222\.58)|22\.40\.109)|22\.252\.223\.2)|6(?:7\.(?:1(?:8(?:7\.215\.197|9\.242\.18)|7(?:6\.137\.22|7\.67\.11)2)|205\.199\.18|67\.202\.194)|8\.(?:(?:5(?:7\.251\.23|8\.19\.18)|45\.227\.11)0|1(?:51\.32\.176|90\.19\.57)|36\.229\.134)|9\.(?:1(?:9(?:9\.164\.222|8\.35\.9)|36\.(?:163\.75|55\.210))|64\.155\.181)|5\.(?:(?:183\.197\.4|47\.145\.22)6|3(?:7\.160\.106|1\.22\.229))|2\.(?:21(?:2\.216\.249|4\.127\.148)|62\.237\.148|83\.172\.159)|6\.(?:163\.30\.180|76\.160\.18|94\.77\.202)|3\.246\.155\.(?:21[467]|44)|1\.142\.213\.158|4\.148\.129\.140)|8(?:4\.(?:1(?:09\.202\.211|5\.191\.254)|204\.147\.82|51\.44\.66)|5\.(?:1(?:07\.232\.209|12\.166\.174)|249\.31\.249)|2\.(?:1(?:93\.140\
.168|14\.79\.163)|213\.2\.82)|6\.(?:1(?:88\.143\.201|11\.21\.168)|36\.49\.1)|8\.(?:255\.153\.106|166\.51\.100|40\.102\.242)|3\.1(?:42\.111\.228|73\.164\.10)|7\.(?:126\.253\.24|69\.167\.150)|0\.9(?:7\.199\.131|5\.70\.173)|1\.255\.83\.190)|7(?:1\.(?:2(?:0(?:1\.236\.22|2\.18\.190)|39\.144\.233)|1(?:25\.12\.15|94\.68\.43)|58\.108\.122)|5\.(?:1(?:50\.241\.238|84\.127\.176)|61\.200\.125|24\.80\.117)|6\.(?:1(?:26\.40\.233|05\.19\.41)|21\.49\.149|30\.91\.104)|2\.(?:46\.153\.2(?:1[89]|2[01])|245\.178\.135)|7\.(?:228\.214\.5|92\.159\.10)2|4\.(?:50\.94\.234|66\.135\.23)|8\.151\.198\.121|0\.25\.46\.60)|9(?:8\.(?:2(?:2(?:1\.201\.141|3\.186\.34|7\.88\.133)|0(?:6\.90\.151|8\.81\.28))|17\.181\.236)|2\.(?:1(?:03\.162\.252|26\.214\.177)|25\.125\.7)|3\.(?:1(?:25\.40\.15|90\.104\.7)|91\.196\.132)|5\.(?:154\.240\.98|48\.104\.170|62\.161\.69)|9\.1(?:70\.201\.206|82\.63\.145)|6\.(?:52\.205\.2|226\.4\.6)0|4\.236\.202\.13|7\.92\.204\.31)|4(?:1\.137\.(?:(?:24|30|56)\.4|63\.20[123])|6\.17\.121\.1)|58\
.1(?:85\.35\.121|50\.55\.59))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.1(?:62\.(?:2(?:2[58]|4[46]|38)|118|96)|0\.16[4569])|9\.15(?:9\.2(?:1[5789]|0[028]|20)|3\.12|6\.26)|7\.2(?:00\.1(?:7[67]|94)|41\.(?:248|81))|0\.49\.(?:193|205)|6\.71\.14[58])|2(?:2\.(?:163\.23|55\.106)|5\.23(?:4\.144|5\.192)|1\.101\.206)|9(?:0\.110\.155|6\.202\.214|5\.91\.70)|8(?:8\.146\.(?:127|255)|0\.149\.8))|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:[89]|3[2678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|9\.204\.1(?:37|53)|0\.83\.23[89]|2\.178\.69)|2(?:1(?:3\.(?:87\.(?:1(?:14|36)|8[01789]|9[012]|74)|226\.63)|7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|8\.156\.80)|0(?:(?:1\.191\.1|3\.82\.)95|2\.152\.243|0\.85\.24))|59\.9(?:9\.(?:1(?:5[234]|2[89]|30)|56)|7\.21[68]|8\.152)|41\.(?:2(?:54\.[012]|09\.65)|95\.(?:[48]|1?2))|6(?:1\.19\.6[567]|6\.87\.0)|91\.203\.67)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.1(?:62\.(?:2(?:2[58]|4[46]|38)|118)|0\.16[469])|9\.15(?:9\.(?:2(?:1[05789]|0[028]|20)|199)|3\.12)|7\.2(?:00\.1(?:7[67]|94)|41\.(?:248|81))|0\.49\.(?:193|205)|6\.71\.145)|2(?:2\.(?:163\.23|55\.106)|5\.23(?:4\.144|5\.192)|1\.101\.206)|9(?:0\.110\.155|6\.202\.214|5\.91\.70)|8(?:8\.146\.(?:127|255)|0\.149\.8))|2(?:1(?:3\.(?:87\.(?:1(?:14|36)|8[01789]|9[012]|74)|162\.68|226\.63)|7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|8\.156\.80|2\.3\.128)|0(?:(?:1\.191\.1|3\.82\.)95|2\.152\.243|0\.85\.24))|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:[89]|3[2678]?|4[156]|2[18])|1\.192\.(?:2(?:1[15]|38)|199)|2\.1(?:32\.211|78\.69)|9\.204\.1(?:37|53)|0\.83\.23[89])|59\.9(?:9\.(?:1(?:5[234]|2[89]|30)|56)|7\.21[68]|8\.152)|41\.(?:2(?:54\.[012]|09\.65)|95\.(?:[248]|1[02]))|6(?:1\.19\.6[567]|6\.87\.0)|91\.203\.67)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8