You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2010/04/18 04:56:48 UTC
svn commit: r935292 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sun Apr 18 02:56:48 2010
New Revision: 935292
URL: http://svn.apache.org/viewvc?rev=935292&view=rev
Log:
auto-generated SpamCop neighbor rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=935292&r1=935291&r2=935292&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sun Apr 18 02:56:48 2010
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 2010041622
+## khop-sc-neighbors.cf v 2010041722
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -57,7 +57,7 @@ score KHOP_SC_TOP_CIDR8 0.9 0.1 0.9 0.
# 11.6286/0.0475 0.996 20100410 net, solo=11.7224/0.6900@0.944, ->LE as above
# http://www.spamcop.net/w3m?action=map;net=bmaxcnt;mask=16777215;sort=spamcnt
-header KHOP_SC_CIDR16 Received =~ /(?-xism:\b(?:1(?:1(?:5\.240|7\.197)|21\.247)|95\.133|59\.94)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_CIDR16 Received =~ /(?-xism:\b(?:1(?:2(?:1\.247|2\.173)|15\.240)|59\.9[245])(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_CIDR16 Relay CIDR /16 is among worst in SpamCop
tflags KHOP_SC_CIDR16 nopublish
score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:2(?:2\.16[38]|3\.27)|18\.96|83\.87)|41\.(?:141|249)|95\.135|59\.92)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:2(?:2\.16[38]|3\.27)|1(?:7\.197|8\.96)|83\.87)|41\.(?:141|249)|95\.135)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.(?:160\.112|22\.69)|8\.217\.216)|9(?:3\.108\.38|6\.40\.10))|2(?:1(?:3\.233\.64|7\.118\.82)|03\.8(?:7\.178|2\.80))|6(?:2\.95\.110|1\.7\.231)|78\.138\.1(?:6[89]|7[01])|93\.186\.96)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.(?:160\.112|22\.69)|8\.217\.216)|9(?:3\.108\.38|6\.40\.10))|2(?:1(?:3\.233\.64|7\.118\.82)|03\.8(?:7\.178|2\.94))|(?:89\.211\.4|93\.186\.9)6|6(?:2\.95\.110|1\.7\.231)|78\.138\.1(?:7[01]|68))\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:3\.82\.(?:9[234]|8[01])|2\.(?:152\.243|70\.54)|9\.222\.0)|1(?:3\.(?:(?:163\.11|87\.7)6|233\.64)|2\.63\.221|7\.118\.90))|1(?:1(?:5\.147\.(?:2(?:3[27]|02|29)|192)|2\.76\.5)|9(?:6\.12\.2(?:3[36]|4[45])|0\.104\.162)|73\.45\.96)|8(?:5\.26\.(?:1(?:6[45]|8[36])|23[2345])|1\.192\.211|9\.232\.105|2\.178\.69|3\.149\.3)|7(?:7\.232\.142|8\.138\.170|9\.106\.109|2\.21\.6)|41\.(?:2(?:23\.20|54\.)|140\.25)1|9(?:5\.129\.166|1\.203\.67)|62\.61\.164)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:2\.(?:152\.243|70\.54)|3\.82\.(?:8[01]|9[24])|9\.222\.0)|1(?:3\.(?:(?:163\.11|87\.7)6|233\.64)|2\.63\.221|7\.118\.90))|8(?:5\.26\.(?:1(?:6[45]|83)|23[2345])|3\.149\.(?:28|3)|1\.192\.211|9\.232\.105|2\.178\.69)|1(?:9(?:6\.12\.2(?:3[36]|4[45])|0\.104\.162)|1(?:5\.147\.237|2\.76\.5)|73\.45\.96)|7(?:8\.138\.1(?:69|70)|7\.232\.142|9\.106\.109|2\.21\.6)|9(?:5\.129\.166|1\.203\.67)|41\.(?:140\.25|254\.)1|62\.61\.164)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:2(?:0(?:1\.(?:2(?:15\.112\.231|00\.178\.50|32\.107\.46)|(?:5(?:3\.133\.20|9\.92\.24)|43\.13\.8)6|1(?:0\.176\.43|44\.87\.36)|7\.225\.15)|0\.(?:11(?:1\.161\.194|6\.243\.197|7\.254\.129)|(?:95\.162\.20|6\.193\.9)0|210\.214\.176|3\.170\.217|80\.140\.61)|9\.(?:2(?:22\.0\.(?:1[369]|27|4)|54\.56\.106)|94\.196\.170)|3\.(?:126\.152\.242|229\.24\.25|59\.95\.113)|4\.(?:10\.139\.16[02]|202\.250\.207)|2\.(?:164\.52\.100|42\.133\.58)|6\.48\.103\.222|7\.255\.89\.50)|1(?:3\.(?:1(?:98\.11(?:1\.207|2\.90)|63\.116\.2(?:26|30)|86\.47\.150)|226\.144\.65)|7\.(?:7(?:6\.2\.129|7\.78\.2)|23\.188\.62|64\.100\.66)|6\.(?:155\.3(?:9\.(?:2[24]|14)|8\.233)|230\.133\.69)|9\.95\.(?:227\.218|148\.97|45\.81)|1\.1(?:91\.174\.141|71\.31\.100)|8\.(?:111\.179\.134|38\.29\.80)|0\.(?:112\.121\.12|5\.68\.20)|2\.63\.221\.10)|2(?:2\.(?:12(?:4\.156\.231|0\.16\.15)|252\.223\.2)|1\.143\.46\.33))|1(?:9(?:0\.(?:1(?:(?:49\.103\.23|04\.156\.9)8|91\.129\.191|61\.14\.132|7\.212
\.73)|41\.(?:1(?:71\.154|99\.252)|223\.167)|2(?:4\.150\.68|6\.67\.230|7\.80\.93)|34\.154\.204|86\.207\.218|96\.68\.179)|5\.(?:1(?:61\.(?:8\.1|9\.2)|89\.46\.253|74\.4\.209)|238\.191\.68)|3\.1(?:0(?:7\.184\.192|8\.38\.228)|98\.8\.211)|6\.(?:1\.209\.(?:69|83)|25\.26\.198)|4\.54\.52\.239)|2(?:2\.(?:25(?:2\.234\.74|5\.112\.2)|166\.61\.134|34\.215\.210)|1\.1(?:\.(?:37\.14[67]|18\.244)|68\.226\.231)|3\.140\.193\.203|5\.132\.54\.210)|1(?:(?:4\.32\.100\.12|9\.226\.84\.21|3\.160\.2\.5)8|5\.(?:118\.134\.54|68\.53\.45)|1\.224\.250\.13[34]|8\.217\.216\.132)|73\.(?:45\.96\.(?:2(?:0[34567]|1[49])|1(?:0[12]|9[24])|98)|1(?:61\.201\.15|2\.120\.21)7)|8(?:9\.(?:84\.174\.253|72\.230\.76)|6\.24\.(?:1[69]|21)\.3)|51\.(?:44\.239\.62|76\.20\.218)|63\.23\.104\.129|40\.109\.82\.93)|8(?:2\.(?:1(?:14\.(?:65|90)\.246|78\.173\.197|40\.91\.41)|75\.56\.80)|9\.(?:2(?:11\.46\.21[08]|32\.124\.80)|42\.116\.44|74\.181\.6)|0\.(?:179\.2(?:12\.151|31\.205)|93\.125\.186)|(?:7\.126\.68\.21|3\.3\.237\.19)5|5\.1(?:75\.
6\.123|54\.6\.71)|1\.192\.48\.62|6\.72\.93\.138|4\.22\.56\.50)|6(?:(?:(?:7\.115\.179\.1|5\.163\.88\.)9|9\.(?:151\.79\.23|79\.214\.11))8|1\.(?:1(?:00\.228\.61|9\.71\.74)|247\.49\.142|7\.231\.230|9\.6\.245)|2\.(?:1(?:82\.108\.213|03\.171\.28)|95\.110\.33)|4\.(?:1(?:64\.228\.206|87\.119\.3)|70\.190\.10)|3\.253\.107\.166|0\.49\.236\.137)|7(?:7\.(?:1(?:20\.251\.37|92\.142\.63)|22(?:5\.177\.160|\.162\.99)|73\.139\.2)|6\.(?:1(?:03\.160\.74|72\.157\.10)|227\.84\.105)|9\.(?:29\.110\.27|87\.57\.186)|8\.1(?:50\.110\.1|09\.36\.)16|4\.92\.90\.58|2\.21\.6\.24)|9(?:5\.(?:188\.80\.244|77\.218\.249|51\.121\.90)|3\.(?:91\.196\.(?:132|99)|157\.148\.46)|1\.(?:150\.127\.93|214\.128\.24)|4\.(?:23\.203\.17|85\.241\.19)3|8\.244\.54\.105|7\.66\.79\.81)|41\.(?:2(?:0(?:5\.209\.70|6\.61\.243)|15\.18\.110|50\.251\.88)|190\.239\.178)|59\.(?:90\.214\.99|6\.146\.24))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:0\.(?:1(?:(?:83\.60\.25|7\.212\.7)3|(?:04\.156\.9|46\.1\.2)8|91\.129\.191|61\.14\.132)|41\.(?:1(?:71\.154|99\.252)|223\.167)|2(?:4\.150\.68|6\.67\.230|7\.80\.93)|34\.154\.204|86\.207\.218|96\.68\.179)|5\.(?:1(?:61\.(?:8\.1|9\.2)|89\.46\.253|74\.4\.209)|2(?:02\.81\.154|38\.191\.68))|3\.1(?:0(?:7\.184\.192|8\.38\.228)|98\.8\.211)|6\.(?:1\.209\.(?:69|83)|25\.26\.198)|4\.54\.52\.239)|2(?:2\.(?:25(?:2\.234\.74|5\.112\.2)|166\.61\.134|34\.215\.210)|1\.1(?:\.(?:18\.244|37\.147)|68\.226\.231)|3\.140\.193\.203|5\.132\.54\.210|4\.124\.43\.32)|1(?:(?:3\.16(?:7\.192\.20|0\.2\.5)|4\.32\.100\.12)8|8\.(?:169\.222\.230|217\.216\.132)|5\.(?:118\.134\.54|68\.53\.45)|1\.224\.250\.13[34])|7(?:3\.(?:45\.96\.(?:2(?:0[3567]|1[49])|1(?:0[12]|9[24])|98)|1(?:61\.201\.15|2\.120\.21)7|77\.241\.20)|8\.176\.234\.44)|8(?:9\.(?:160\.217\.246|84\.174\.253)|7\.141\.104\.226|6\.24\.1[69]\.3)|51\.(?:44\.239\.62|76\.20\.218)|63\.23\.104\.129|09\.188\.1\.
222)|2(?:0(?:1\.(?:2(?:15\.112\.231|00\.178\.50|32\.107\.46)|(?:5(?:3\.133\.20|9\.92\.24)|43\.13\.8)6|1(?:0\.176\.43|44\.87\.36)|7\.225\.15)|0\.(?:11(?:1\.161\.194|6\.243\.197|7\.254\.129)|(?:95\.162\.20|6\.193\.9)0|210\.214\.176|3\.170\.217|80\.140\.61)|9\.(?:2(?:22\.0\.(?:1[36]|27|4)|54\.56\.106)|94\.196\.170)|2\.(?:1(?:64\.52\.100|84\.124\.19)|42\.133\.58)|3\.(?:126\.152\.242|229\.24\.25|59\.95\.113)|4\.(?:10\.139\.16[02]|202\.250\.207)|6\.48\.103\.222|7\.255\.89\.50)|1(?:3\.(?:1(?:98\.11(?:1\.207|2\.90)|63\.116\.2(?:26|30)|86\.47\.150)|226\.144\.65)|7\.(?:7(?:6\.2\.129|7\.78\.2)|174\.229\.221|64\.100\.66)|6\.(?:155\.3(?:9\.(?:2[24]|14)|8\.233)|230\.133\.69)|9\.95\.(?:227\.218|148\.97|45\.81)|1\.1(?:91\.174\.141|71\.31\.100)|8\.(?:111\.179\.134|38\.29\.80)|0\.(?:112\.121\.12|5\.68\.20)|2\.63\.221\.10)|2(?:2\.(?:12(?:4\.156\.231|0\.16\.15)|252\.223\.2)|1\.143\.46\.33))|8(?:2\.(?:1(?:14\.(?:65|90)\.246|78\.173\.197|40\.91\.41)|75\.56\.80)|9\.(?:211\.46\.21[08]|42\.116\.44|7
4\.181\.6)|0\.(?:179\.212\.151|93\.125\.186)|3\.(?:3\.237\.195|69\.117\.81)|5\.1(?:75\.6\.123|54\.6\.71)|7\.126\.68\.215|1\.192\.48\.62|6\.72\.93\.138|4\.22\.56\.50)|6(?:1\.(?:1(?:00\.228\.61|9\.71\.74)|7\.2(?:31\.23|41\.7)0|247\.49\.142|9\.6\.245)|(?:(?:7\.115\.179\.1|5\.163\.88\.)9|9\.(?:151\.79\.23|79\.214\.11))8|4\.(?:1(?:64\.228\.206|87\.119\.3)|70\.190\.10)|2\.(?:103\.171\.28|95\.110\.33)|3\.253\.107\.166|0\.49\.236\.137)|9(?:4\.(?:(?:23\.203\.17|85\.241\.19)3|76\.213\.81)|5\.(?:188\.80\.244|77\.218\.249|51\.121\.90)|1\.(?:150\.127\.93|214\.128\.24)|3\.(?:157\.148\.46|91\.196\.99)|8\.244\.54\.105|7\.66\.79\.81)|7(?:7\.(?:1(?:20\.251\.37|92\.142\.63)|22\.162\.99|73\.139\.2)|6\.(?:1(?:03\.160\.74|72\.157\.10)|227\.84\.105)|9\.(?:29\.110\.27|87\.57\.186)|8\.109\.36\.16|4\.92\.90\.58|2\.21\.6\.24)|41\.(?:2(?:06\.61\.243|15\.18\.110|50\.251\.88)|190\.239\.178)|59\.(?:90\.214\.99|6\.146\.24))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:7\.(?:2(?:4(?:1\.(?:2(?:2[48]|4[01]|5[23]|00|17|32)|1(?:7[68]|[59]2|44)?|8[02]?|6[45]|0)|2\.(?:[04]|1(?:32|40|96)|6[08]|7[23]|24?8|56))|0(?:0\.(?:179|208)|5\.9[89]|6\.2))|44\.2[01]|199\.144)|3\.(?:16(?:2\.(?:[79]7|80)|7\.[01]|6\.0)|22\.(?:[89]|6[89]|10)|56\.28)|9\.(?:1(?:00\.(?:1(?:4[57]|6[45])|21[124])|53\.7)|48\.19[23456789])|8\.(?:68\.(?:25[23]|196)|71\.(?:6?8|10|9))|5\.147\.(?:2(?:3[0127]|0[123]|29)|192)|1\.181\.1(?:3[678]|4[012])|6\.71\.21[46])|2(?:2\.168\.(?:2(?:2[2678]?|3[146]|4[029]|0[57]|1[09]|9)|[37]0)|3\.(?:2(?:7\.(?:21[13]|80)|8\.143)|18\.1(?:65|72)))|9(?:6\.12\.2(?:4[2345]|3[36])|0\.104\.162)|83\.(?:93\.[0123]|87\.115))|5(?:9\.(?:9(?:9\.(?:1(?:2[89]|5[23]|30|84|6)|2(?:[45]|10)|32|40|56|64)|7\.2(?:0[89]|1[67])|8\.1(?:[59]2|44)|3\.129)|164\.12)|8\.18(?:6\.(?:217|12)|7\.8))|2(?:1(?:9\.13(?:8\.211|9\.123)|7\.(?:118\.90|8\.225)|3\.87\.76)|0(?:3\.82\.(?:8[012]|9[234])|2\.(?:152\.243|70\.54))|21\
.234\.(?:16|20))|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|(?:1\.192\.21|4\.36\.13)1|3\.149\.(?:4[45]|28|3)|9\.232\.105|2\.178\.69)|41\.(?:2(?:54\.[12]|23\.201)|1(?:40\.251|89\.193))|6(?:1\.19\.6[567]|2\.61\.164)|7(?:7\.232\.142|9\.106\.109))\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:7\.(?:2(?:4(?:1\.(?:2(?:5[23]?|2[48]|4[01]|00|17|32)|1(?:7[678]|[48]4|[59]2|20)?|8[012]?|6[45]|56|0)|2\.(?:[08]|1(?:4[04]|3?2|9?6|04)|2(?:4?8|04)|4[04]?|6[08]|7[23]|56?))|0(?:0\.(?:1(?:28|46|79)|208)|5\.(?:14[45]|9[69])|4\.(?:8[12]|113)|6\.(?:[23]|16)))|1(?:9(?:9\.(?:1(?:4[45]|7)|48)|7\.(?:6[456]|9[67])|6\.1(?:33|80))|\.233)|44\.2[01])|3\.(?:16(?:7\.(?:1(?:83)?|32|0)|2\.(?:[79]7|80)|8\.[026]|6\.[25])|22\.(?:[89]|6[89]|10)|56\.28)|9\.(?:100\.(?:1(?:4[567]|6[45])|2(?:1[0124]|09))|48\.19[23456789])|8\.(?:68\.(?:2(?:4[89]|5[23])|196)|71\.(?:[89]|10))|5\.147\.(?:2(?:3[0127]|0[123]|29)|192)|1\.181\.1(?:3[6789]|4[0123]))|2(?:2\.1(?:6(?:8\.(?:2(?:[79]|1[014569]?|2[126789]?|4[02479]|0[5789]|3[1469]|5[05]?)|3[01]|6[89]|171)|3\.185)|72\.1(?:16|21))|3\.(?:2(?:7\.(?:2(?:1[0123467]|09|6)|8[01])|8\.14[13])|18\.1(?:6[25]|75|94)))|9(?:6\.(?:12\.2(?:4[2345]|3[36])|28\.247)|0\.104\.162)|83\.(?:87\.(?:115|220)|93\.[0123])
)|5(?:9\.(?:9(?:9\.(?:1(?:2[89]|5[23]|8[45]|30|6)|2(?:[45]|[01]0)|5[67]|6[45]|[37]2|40)|8\.(?:1(?:2[89]|9[23]|36|44|52)|200|8)|7\.2(?:0[089]|1[67])|4\.(?:11[345]|41)|3\.1(?:29|31))|164\.(?:[89]|1?2))|8\.18(?:6\.(?:1[24]|217)|7\.(?:[89]|35)))|2(?:1(?:9\.13(?:9\.12[013]|8\.21[18])|3\.(?:132\.255|87\.76)|7\.(?:118\.90|8\.225))|0(?:3\.82\.(?:8[012]|9[234])|2\.(?:152\.243|70\.54))|2(?:1\.234\.(?:[78]4|16|20)|2\.253\.2))|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|(?:1\.192\.21|4\.36\.13)1|3\.149\.(?:28|45|3)|9\.232\.105|2\.178\.69)|41\.(?:1(?:31\.2(?:2[456789]|3[145])|40\.251|89\.193|91\.20)|2(?:54\.[12]|23\.201))|7(?:7\.(?:64\.11[89]?|232\.142)|8\.138\.170|9\.106\.109)|6(?:1\.19\.6[567]|2\.61\.164)|9(?:1\.203\.6|2\.39\.7)7)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8