You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2010/12/29 07:57:37 UTC
svn commit: r1053548 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Dec 29 06:57:36 2010
New Revision: 1053548
URL: http://svn.apache.org/viewvc?rev=1053548&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1053548&r1=1053547&r2=1053548&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Dec 29 06:57:36 2010
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201012281
+## khop-sc-neighbors.cf v 201012291
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:2(?:2\.168|3\.26)|13\.22)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b122\.168(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:21(?:3\.(?:2(?:26\.63|33\.64)|87\.74)|7\.118\.(?:8[123]|93)|8\.248\.64)|8(?:5\.26\.(?:2(?:25|32)|165)|9\.232\.105|0\.83\.238)|1(?:13\.162\.(?:24|5)6|09\.172\.40|78\.49\.255)|41\.(?:137\.24|254\.1)|77\.232\.14[23])\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:21(?:3\.(?:2(?:26\.63|33\.64)|87\.74)|7\.118\.(?:8[23]|93)|6\.157\.150|8\.248\.64)|8(?:5\.26\.(?:2(?:25|32)|165)|9\.232\.105|0\.83\.238)|1(?:09\.172\.40|78\.49\.255)|77\.232\.14[23]|58\.64\.187|91\.198\.86|41\.254\.1)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.(?:2(?:11|38)|199)|(?:0\.83\.23|2\.178\.6)9)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.(?:233\.6|87\.7)4)|03\.(?:152\.2|82\.95))|1(?:1(?:3\.(?:162\.67|30\.110)|2\.196\.252)|78\.49\.255|95\.91\.70)|6(?:1\.19\.6[67]|4\.187\.113)|9(?:1\.203\.67|8\.139\.91)|41\.(?:254\.[01]|95\.4)|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.(?:2(?:11|38)|199)|0\.83\.239)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.(?:87\.(?:74|88)|233\.64))|03\.(?:152\.2|82\.95))|1(?:1(?:3\.(?:162\.67|30\.110)|2\.196\.252)|95\.91\.70)|6(?:1\.19\.6[67]|4\.187\.113|5\.110\.50)|9(?:1\.203\.67|8\.139\.91)|41\.(?:254\.[01]|95\.4)|79\.106\.109)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|3(?:8\.78\.124|0\.60\.86)|91\.104\.135|89\.46\.246)|39\.210\.106|82\.172\.28)|3\.(?:1(?:07\.184\.193|51\.12\.69)|239\.44\.193)|0\.(?:127\.249\.121|41\.173\.125)|4\.1(?:26\.180\.118|65\.147\.23)|6\.2(?:01\.207\.191|9\.201\.234)|9\.236\.117\.210|2\.115\.132\.3)|1(?:(?:9\.207\.27\.23|6\.48\.159\.6|5\.93\.12\.2)0|0\.13(?:9\.(?:238\.18|56\.2)8|7\.66\.66)|1\.(?:224\.250\.13[245]|95\.70\.99)|(?:2\.146\.130|7\.3\.4)\.129|8\.96\.(?:111\.140|206\.3)|3\.167\.71\.14)|2(?:5\.(?:(?:162\.72\.8|20\.82\.19)6|88\.2\.197)|(?:\.197\.249\.23|1\.191\.7\.16)2|2\.(?:160\.206\.178|252\.234\.75)|4\.1(?:58\.110\.64|24\.43\.32)|8\.121\.191\.75|3\.27\.79\.11)|8(?:8\.9(?:5\.53\.106|2\.0\.194)|0\.228\.14\.46|7\.14\.5\.115)|4(?:0\.135\.131\.20|8\.244\.172\.12)2|78\.(?:49\.255\.10[34]|32\.64\.195)|68\.187\.(?:24\.98|95\.74)|09\.239\.33\.93|\.53\.11\.59)|2(?:1(?:2\.(?:1(?:1(?:8\.142\.7[67]|6\.164\.2)|99
\.(?:29\.145|76\.14)|56\.51\.66|\.103\.94)|(?:31\.116\.2|66\.127\.)17|52\.129\.193|71\.150\.146)|6\.(?:157\.1(?:4(?:6\.(?:1(?:28|92)|64|2)|8\.2)|5(?:0\.(?:128|2)|4\.192))|81\.7(?:1\.(?:192|64)|3\.(?:128|2)|0\.(?:64|2)|2\.2))|1\.(?:1(?:86\.157\.59|47\.3\.74)|58\.59\.73)|0\.(?:212\.163\.42|91\.239\.10)|8\.(?:248\.44\.196|65\.219\.91)|7\.64\.98\.40)|0(?:2\.(?:1(?:52\.194\.129|02\.194\.78)|28\.66\.251|75\.36\.95)|3\.(?:217\.1(?:76\.6|47\.)5|177\.202\.180)|(?:8\.86\.229\.12|9\.62\.32\.21)9|0\.15(?:0\.182\.165|2\.113\.24)|1\.(?:144\.87\.45|251\.250\.3)|6\.193\.200\.47|4\.8\.46\.130|7\.212\.4\.26)|2(?:2\.2(?:32\.75\.116|52\.223\.2)|0\.231\.69\.13)|4\.106\.153\.180)|8(?:2\.(?:1(?:93\.140\.168|14\.87\.149)|2(?:39\.185\.75|07\.99\.94))|(?:5\.(?:154\.3\.14|43\.241\.)|6\.98\.23\.12)1|9\.(?:(?:87\.248\.4|7\.126\.2)2|251\.226\.16)|(?:0\.122\.199\.13|3\.142\.111\.22)8|1\.(?:199\.251\.196|218\.162\.247)|4\.(?:15\.191\.254|75\.178\.76)|8\.(?:255\.153\.106|59\.66\.58)|7\.2(?:26\.242\.7|5\.52\
.24))|6(?:5\.(?:1(?:10\.50\.181|85\.130\.79)|96\.162\.50)|9\.(?:1(?:36\.55\.210|81\.6\.32)|64\.155\.181)|2\.(?:214\.127\.148|105\.148\.62|33\.218\.49)|8\.(?:159\.141\.223|204\.69\.158|67\.95\.89)|4\.(?:50\.151\.(?:101|22)|187\.113\.23[04])|7\.(?:189\.214\.92|62\.168\.250)|0\.32\.101\.190|1\.112\.19\.81)|7(?:4\.(?:1(?:17\.211\.243|20\.242\.146)|50\.95\.1[07]|206\.27\.160|95\.54\.141)|1\.(?:230\.(?:221\.79|45\.78)|63\.145\.180|123\.47\.9)|6\.(?:161\.241\.115|29\.44\.251|3\.133\.86)|7\.(?:252\.229\.22|72\.122\.9)8|5\.(?:148\.7\.17|75\.168\.5)|0\.108\.253\.223|9\.143\.100\.252|2\.54\.21\.45)|9(?:1\.(?:1(?:9(?:5\.(?:136\.14|230\.13)|8\.175\.253|3\.199\.4)|21\.175\.20)|214\.83\.2)|4\.(?:2(?:45\.156\.33|3\.60\.124)|153\.232\.178|71\.16\.54)|2\.(?:103\.162\.252|247\.250\.234)|5\.1(?:67\.130\.157|54\.240\.98)|3\.1(?:55\.224\.206|26\.15\.49)|8\.197\.233\.144|9\.11\.169\.198)|41\.(?:137\.(?:(?:2[04]|56)\.4|63\.20[123])|206\.13\.3)|58\.150\.55\.59)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|(?:89\.46\.24|30\.60\.8)6)|39\.210\.106|82\.172\.28)|3\.(?:1(?:51\.12\.(?:69|70)|07\.184\.193)|239\.44\.193)|0\.(?:(?:210\.25\.2|41\.173\.1)25|127\.249\.121)|4\.(?:1(?:26\.180\.118|45\.216\.27)|44\.21\.48)|6\.2(?:01\.207\.191|9\.201\.234)|9\.236\.117\.210)|2(?:(?:1\.(?:1(?:47\.235\.2|91\.7\.16)|52\.152\.)|\.197\.249\.23)2|4\.(?:1(?:58\.110\.64|24\.43\.32)|89\.13\.104)|5\.(?:16(?:5\.187\.22|2\.72\.8)|20\.82\.19)6|2\.(?:160\.206\.178|252\.234\.75)|3\.(?:139\.187\.93|27\.79\.11)|8\.121\.191\.75)|1(?:0\.13(?:9\.(?:238\.18|56\.2)8|8\.146\.221|7\.66\.66)|8\.(?:13(?:1\.100\.180|6\.96\.214)|96\.206\.3)|1\.(?:224\.250\.13[245]|95\.70\.99)|(?:9\.207\.27\.23|6\.48\.159\.6)0|2\.146\.130\.129|3\.167\.71\.14)|8(?:8\.9(?:5\.53\.106|2\.0\.194)|7\.14\.5\.115)|6(?:8\.187\.(?:24\.98|95\.74)|3\.21\.100\.4)|4(?:0\.135\.131\.20|8\.244\.172\.12)2|78\.(?:49\.255\.10[34]|32\.64\.195)|09\.(?:166
\.128\.5|239\.33\.93))|2(?:1(?:6\.(?:157\.1(?:4(?:6\.(?:1(?:28|92)|64|2)|8\.(?:64|2))|5(?:0\.(?:128|64|2)|4\.(?:19)?2))|81\.7(?:3\.(?:128|64|2)|1\.(?:192|64)|2\.(?:128|2)|0\.(?:64|2)))|2\.(?:1(?:99\.(?:29\.145|76\.14)|18\.142\.7[67]|56\.51\.66|\.103\.94)|52\.129\.193|71\.150\.146)|1\.(?:1(?:86\.157\.59|47\.3\.74)|58\.59\.73)|0\.(?:212\.163\.42|91\.239\.10)|8\.(?:248\.44\.196|65\.219\.91)|7\.64\.98\.40|9\.255\.18\.2)|0(?:2\.(?:28\.(?:66\.251|24\.99)|75\.36\.9[35]|108\.3\.184)|3\.(?:177\.202\.180|217\.176\.65)|0\.15(?:0\.182\.165|2\.113\.24)|1\.(?:163\.73\.92|251\.250\.3)|7\.(?:212\.4\.26|5\.89\.7)|8\.131\.186\.2|9\.62\.32\.219|4\.8\.46\.130)|2(?:2\.(?:252\.223\.2|33\.78\.50)|0\.231\.69\.1[34]))|9(?:1\.(?:1(?:9(?:5\.(?:230\.1[034]|136\.14)|8\.175\.253|3\.199\.4)|21\.175\.20)|2(?:14\.(?:128\.2[04]|83\.2)|03\.67\.212))|4\.(?:1(?:53\.232\.178|42\.4\.30)|2(?:45\.156\.33|3\.60\.124)|7(?:9\.49\.116|1\.16\.54))|5\.1(?:67\.130\.157|70\.183\.251|54\.240\.98)|2\.(?:103\.162\.252|247\.25
0\.234)|3\.1(?:55\.224\.206|26\.15\.49))|8(?:2\.(?:1(?:1(?:4\.87\.149|6\.32\.123)|93\.140\.168|04\.65\.73)|207\.99\.94)|5\.(?:(?:154\.3\.14|43\.241\.)1|90\.193\.240)|1\.(?:199\.251\.196|218\.162\.247)|3\.(?:142\.111\.228|234\.4\.254)|8\.(?:255\.153\.106|59\.66\.58)|0\.122\.199\.138|4\.15\.191\.254|6\.98\.23\.121|7\.226\.242\.7|9\.7\.126\.22)|7(?:4\.(?:1(?:17\.211\.243|20\.242\.146)|5(?:3\.229\.178|0\.95\.10)|95\.54\.141)|(?:6\.161\.241\.11|2\.54\.21\.4)5|7\.(?:228\.87\.159|72\.122\.98)|1\.(?:230\.45\.78|123\.47\.9)|5\.(?:148\.7\.17|75\.168\.5)|0\.108\.253\.223|9\.143\.100\.252)|6(?:4\.(?:50\.151\.(?:101|22)|187\.113\.23[04])|1\.(?:84\.148\.208|112\.19\.81)|2\.(?:105\.148\.62|33\.218\.49)|5\.(?:110\.50\.181|96\.162\.50)|8\.(?:204\.69\.158|67\.95\.89)|9\.136\.55\.210)|41\.(?:137\.(?:(?:24|30|56)\.4|63\.20[123])|206\.13\.3)|58\.150\.55\.59)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:9\.(?:2(?:1[0689]|0[149]|2[123])|19[2379])|5\.(?:3[34]|4[46]|98|6)|3\.8?9)|6\.71\.(?:1(?:[089]|4[678])|2(?:[369]|18?)?|3[25]|63?|44|7)|3\.1(?:62\.(?:(?:[59]|24)6|6[57]|132|77)|0\.168)|7\.2(?:00\.192|41\.248)|0\.49\.(?:193|205))|25\.23(?:4\.144|5\.192)|88\.135\.2|95\.91\.70)|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|(?:0\.83\.23|2\.178\.6)9|9\.204\.153)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|41\.(?:254\.[012]|95\.[48])|59\.9(?:9\.15[23]|7\.217)|61\.19\.6[567])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:9\.(?:2(?:0[1249]|1[0689]|2[0123])|19[234579])|5\.(?:102|23?|4?6|34|99)|3\.(?:9[34]?|15|20)|2\.246)|6\.71\.(?:1(?:[01389]|4[56789]|50?)|2(?:[034689]|18?)?|58?|63?|32|43|7)|3\.(?:1(?:62\.(?:24[46]|6[57]|[59]6|132)|0\.168)|30\.110)|7\.2(?:00\.192|41\.248)|0\.49\.(?:193|205))|25\.23(?:4\.144|5\.192)|88\.135\.2|95\.91\.70)|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:3[678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|(?:0\.83\.23|2\.178\.6)9|9\.204\.153)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|59\.(?:9(?:9\.15[23]|7\.217)|103\.25)|41\.(?:254\.[012]|95\.[248])|61\.19\.6[567])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8