You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2010/12/30 07:57:18 UTC
svn commit: r1053809 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Thu Dec 30 06:57:17 2010
New Revision: 1053809
URL: http://svn.apache.org/viewvc?rev=1053809&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1053809&r1=1053808&r2=1053809&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Thu Dec 30 06:57:17 2010
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201012291
+## khop-sc-neighbors.cf v 201012301
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b122\.168(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:09\.8|18\.9)6(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:21(?:3\.(?:2(?:26\.63|33\.64)|87\.74)|7\.118\.(?:8[23]|93)|6\.157\.150|8\.248\.64)|8(?:5\.26\.(?:2(?:25|32)|165)|9\.232\.105|0\.83\.238)|1(?:09\.172\.40|78\.49\.255)|77\.232\.14[23]|58\.64\.187|91\.198\.86|41\.254\.1)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.(?:2(?:26\.63|33\.64)|87\.74)|7\.118\.(?:8[23]|93)|8\.248\.64)|22\.33\.78)|8(?:5\.26\.(?:2(?:25|34)|165)|9\.232\.105|0\.83\.238)|1(?:12\.196\.252|78\.49\.255)|77\.232\.142|41\.137\.24|58\.64\.187)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.(?:2(?:11|38)|199)|0\.83\.239)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.(?:87\.(?:74|88)|233\.64))|03\.(?:152\.2|82\.95))|1(?:1(?:3\.(?:162\.67|30\.110)|2\.196\.252)|95\.91\.70)|6(?:1\.19\.6[67]|4\.187\.113|5\.110\.50)|9(?:1\.203\.67|8\.139\.91)|41\.(?:254\.[01]|95\.4)|79\.106\.109)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:2[18]|4[16]|38?)|1\.192\.(?:2(?:11|38)|199)|(?:0\.83\.23|2\.178\.6)9)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.(?:87\.(?:74|88|90)|233\.64))|03\.(?:152\.2|82\.95))|1(?:13\.(?:1(?:0\.16[23]|62\.67)|30\.110)|95\.91\.70)|6(?:4\.187\.113|5\.110\.50|1\.19\.66)|7(?:7\.232\.143|9\.106\.109)|9(?:1\.203\.67|8\.139\.91)|41\.(?:254\.[01]|95\.4))\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|(?:89\.46\.24|30\.60\.8)6)|39\.210\.106|82\.172\.28)|3\.(?:1(?:51\.12\.(?:69|70)|07\.184\.193)|239\.44\.193)|0\.(?:(?:210\.25\.2|41\.173\.1)25|127\.249\.121)|4\.(?:1(?:26\.180\.118|45\.216\.27)|44\.21\.48)|6\.2(?:01\.207\.191|9\.201\.234)|9\.236\.117\.210)|2(?:(?:1\.(?:1(?:47\.235\.2|91\.7\.16)|52\.152\.)|\.197\.249\.23)2|4\.(?:1(?:58\.110\.64|24\.43\.32)|89\.13\.104)|5\.(?:16(?:5\.187\.22|2\.72\.8)|20\.82\.19)6|2\.(?:160\.206\.178|252\.234\.75)|3\.(?:139\.187\.93|27\.79\.11)|8\.121\.191\.75)|1(?:0\.13(?:9\.(?:238\.18|56\.2)8|8\.146\.221|7\.66\.66)|8\.(?:13(?:1\.100\.180|6\.96\.214)|96\.206\.3)|1\.(?:224\.250\.13[245]|95\.70\.99)|(?:9\.207\.27\.23|6\.48\.159\.6)0|2\.146\.130\.129|3\.167\.71\.14)|8(?:8\.9(?:5\.53\.106|2\.0\.194)|7\.14\.5\.115)|6(?:8\.187\.(?:24\.98|95\.74)|3\.21\.100\.4)|4(?:0\.135\.131\.20|8\.244\.172\.12)2|78\.(?:49\.255\.10[34]|32\.64\.195)|09\.(?:166
\.128\.5|239\.33\.93))|2(?:1(?:6\.(?:157\.1(?:4(?:6\.(?:1(?:28|92)|64|2)|8\.(?:64|2))|5(?:0\.(?:128|64|2)|4\.(?:19)?2))|81\.7(?:3\.(?:128|64|2)|1\.(?:192|64)|2\.(?:128|2)|0\.(?:64|2)))|2\.(?:1(?:99\.(?:29\.145|76\.14)|18\.142\.7[67]|56\.51\.66|\.103\.94)|52\.129\.193|71\.150\.146)|1\.(?:1(?:86\.157\.59|47\.3\.74)|58\.59\.73)|0\.(?:212\.163\.42|91\.239\.10)|8\.(?:248\.44\.196|65\.219\.91)|7\.64\.98\.40|9\.255\.18\.2)|0(?:2\.(?:28\.(?:66\.251|24\.99)|75\.36\.9[35]|108\.3\.184)|3\.(?:177\.202\.180|217\.176\.65)|0\.15(?:0\.182\.165|2\.113\.24)|1\.(?:163\.73\.92|251\.250\.3)|7\.(?:212\.4\.26|5\.89\.7)|8\.131\.186\.2|9\.62\.32\.219|4\.8\.46\.130)|2(?:2\.(?:252\.223\.2|33\.78\.50)|0\.231\.69\.1[34]))|9(?:1\.(?:1(?:9(?:5\.(?:230\.1[034]|136\.14)|8\.175\.253|3\.199\.4)|21\.175\.20)|2(?:14\.(?:128\.2[04]|83\.2)|03\.67\.212))|4\.(?:1(?:53\.232\.178|42\.4\.30)|2(?:45\.156\.33|3\.60\.124)|7(?:9\.49\.116|1\.16\.54))|5\.1(?:67\.130\.157|70\.183\.251|54\.240\.98)|2\.(?:103\.162\.252|247\.25
0\.234)|3\.1(?:55\.224\.206|26\.15\.49))|8(?:2\.(?:1(?:1(?:4\.87\.149|6\.32\.123)|93\.140\.168|04\.65\.73)|207\.99\.94)|5\.(?:(?:154\.3\.14|43\.241\.)1|90\.193\.240)|1\.(?:199\.251\.196|218\.162\.247)|3\.(?:142\.111\.228|234\.4\.254)|8\.(?:255\.153\.106|59\.66\.58)|0\.122\.199\.138|4\.15\.191\.254|6\.98\.23\.121|7\.226\.242\.7|9\.7\.126\.22)|7(?:4\.(?:1(?:17\.211\.243|20\.242\.146)|5(?:3\.229\.178|0\.95\.10)|95\.54\.141)|(?:6\.161\.241\.11|2\.54\.21\.4)5|7\.(?:228\.87\.159|72\.122\.98)|1\.(?:230\.45\.78|123\.47\.9)|5\.(?:148\.7\.17|75\.168\.5)|0\.108\.253\.223|9\.143\.100\.252)|6(?:4\.(?:50\.151\.(?:101|22)|187\.113\.23[04])|1\.(?:84\.148\.208|112\.19\.81)|2\.(?:105\.148\.62|33\.218\.49)|5\.(?:110\.50\.181|96\.162\.50)|8\.(?:204\.69\.158|67\.95\.89)|9\.136\.55\.210)|41\.(?:137\.(?:(?:24|30|56)\.4|63\.20[123])|206\.13\.3)|58\.150\.55\.59)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|(?:89\.46\.24|30\.60\.8)6)|39\.210\.106|82\.172\.28)|3\.(?:1(?:51\.12\.(?:69|70)|07\.184\.193)|239\.44\.193)|4\.(?:1(?:45\.216\.2[67]|26\.180\.118)|50\.9\.114)|0\.(?:(?:210\.25\.2|41\.173\.1)25|127\.249\.121)|6\.2(?:(?:01\.207\.19|8\.52\.)1|9\.201\.234)|9\.236\.117\.210)|2(?:(?:1\.(?:1(?:47\.235\.2|91\.7\.16)|52\.152\.)|\.197\.249\.23)2|5\.(?:16(?:(?:5\.187\.22|2\.72\.8)6|3\.74\.114)|20\.82\.196)|4\.(?:1(?:58\.110\.64|24\.43\.32)|89\.13\.104)|3\.(?:139\.187\.93|27\.79\.11)|2\.252\.234\.75)|1(?:0\.13(?:9\.(?:238\.18|56\.2)8|8\.146\.221|7\.66\.66)|8\.(?:13(?:1\.100\.180|6\.96\.214)|96\.206\.3)|(?:3\.167\.71\.1|9\.15\.94\.9)4|1\.224\.250\.13[245])|8(?:8\.(?:9(?:5\.53\.106|2\.0\.194)|230\.95\.227)|7\.14\.5\.115)|09\.(?:60\.201\.184|166\.128\.5|239\.33\.93|86\.55\.66)|4(?:0\.119\.164\.187|8\.244\.172\.122)|78\.(?:49\.255\.10[34]|32\.64\.195)|6(?:8\.187\.24\.98|3\.21\.100\.4)
)|2(?:1(?:6\.(?:157\.1(?:4(?:6\.(?:1(?:28|92)|2)|8\.(?:64|2))|5(?:0\.(?:128|64|2)|4\.2))|81\.7(?:[23]\.(?:128|2)|1\.(?:192|64)|0\.(?:64|2)))|2\.(?:1(?:18\.142\.7[67]|99\.29\.145|56\.51\.66|\.103\.94)|200\.126\.244|52\.129\.193|71\.150\.146|87\.183\.10)|0\.(?:212\.163\.42|91\.239\.10)|8\.(?:248\.44\.196|65\.219\.91)|1\.1(?:86\.157\.59|47\.3\.74)|9\.255\.18\.(?:36|2)|3\.79\.125\.122|7\.64\.98\.40)|0(?:2\.(?:1(?:0(?:2\.194\.78|8\.3\.184)|52\.194\.129)|28\.(?:66\.251|24\.99)|75\.36\.9[35])|3\.(?:1(?:12\.195\.155|77\.202\.180)|217\.176\.65)|7\.(?:212\.4\.26|5\.89\.7)|0\.152\.113\.24|1\.251\.250\.3|8\.131\.186\.2|9\.62\.32\.219|4\.8\.46\.130)|2(?:2\.(?:252\.223\.2|33\.78\.50)|0\.231\.69\.1[34]))|9(?:1\.(?:1(?:9(?:5\.(?:230\.1[034]|136\.14)|(?:3\.199|4\.163)\.4|8\.175\.253)|21\.175\.20)|2(?:14\.(?:128\.2[04]|83\.2)|03\.67\.212))|4\.(?:7(?:3\.247\.47|9\.49\.116|1\.16\.54)|1(?:53\.232\.178|42\.4\.30)|2(?:45\.156\.33|3\.60\.124))|3\.(?:1(?:55\.224\.206|26\.15\.49)|91\.196\.99)|2\.(?:1
03\.162\.252|247\.250\.234)|5\.1(?:70\.183\.251|54\.240\.98))|8(?:2\.(?:1(?:1(?:4\.(?:76\.210|87\.149)|6\.32\.123)|93\.140\.168|04\.65\.73)|207\.99\.94)|5\.(?:(?:154\.3\.14|43\.241\.)1|90\.193\.240)|1\.(?:199\.251\.196|218\.162\.247)|0\.(?:122\.199\.138|251\.113\.47)|3\.(?:142\.111\.228|234\.4\.254)|9\.(?:21\.73\.14|7\.126\.22)|8\.255\.153\.106|4\.15\.191\.254|6\.98\.23\.121|7\.226\.242\.7)|6(?:2\.(?:1(?:05\.148\.62|96\.56\.130)|33\.218\.49)|1\.(?:84\.(?:148\.208|41\.215)|112\.19\.81)|4\.(?:187\.113\.23[04]|50\.151\.101)|5\.(?:110\.50\.181|96\.162\.50)|8\.(?:35\.175\.10|67\.95\.89))|7(?:4\.(?:5(?:3\.229\.178|0\.95\.10)|117\.211\.243)|(?:6\.161\.241\.11|2\.54\.21\.4)5|7\.(?:228\.87\.159|72\.122\.98)|0\.108\.253\.223|9\.143\.100\.252|1\.123\.47\.9|5\.148\.7\.17)|41\.(?:137\.(?:(?:24|30|56)\.4|63\.20[123])|206\.13\.3)|58\.150\.55\.59)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:9\.(?:2(?:0[1249]|1[0689]|2[0123])|19[234579])|5\.(?:102|23?|4?6|34|99)|3\.(?:9[34]?|15|20)|2\.246)|6\.71\.(?:1(?:[01389]|4[56789]|50?)|2(?:[034689]|18?)?|58?|63?|32|43|7)|3\.(?:1(?:62\.(?:24[46]|6[57]|[59]6|132)|0\.168)|30\.110)|7\.2(?:00\.192|41\.248)|0\.49\.(?:193|205))|25\.23(?:4\.144|5\.192)|88\.135\.2|95\.91\.70)|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:3[678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|(?:0\.83\.23|2\.178\.6)9|9\.204\.153)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|59\.(?:9(?:9\.15[23]|7\.217)|103\.25)|41\.(?:254\.[012]|95\.[248])|61\.19\.6[567])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:9\.(?:2(?:1[03689]|0[1249]|2[0123])|19[234589])|5\.(?:3[46]|4[26]|9[89]|23?|6)|3\.(?:9[234]?|15?|20|82)|2\.246)|6\.71\.(?:[78]|1(?:[013789]|4[456789]|50?)?|2(?:[0349]|1[168]?)?|5[2678]?|6[13]?|3[25]|4[34])|3\.(?:1(?:62\.(?:24[46]|6[57]|[59]6)|0\.168)|30\.110)|0\.49\.(?:193|205)|7\.241\.248)|25\.23(?:4\.144|5\.192)|88\.135\.2|95\.91\.70)|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:3[678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|(?:0\.83\.23|2\.178\.6)9|9\.204\.1(?:37|53))|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|41\.(?:95\.(?:[248]|10)|254\.[012])|59\.9(?:9\.15[23]|7\.217)|61\.19\.6[567])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8