You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2010/11/08 08:57:29 UTC
svn commit: r1032480 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Mon Nov 8 07:57:29 2010
New Revision: 1032480
URL: http://svn.apache.org/viewvc?rev=1032480&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1032480&r1=1032479&r2=1032480&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Mon Nov 8 07:57:29 2010
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20101172
+## khop-sc-neighbors.cf v 20101182
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:(?:18|5)9|41|94)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:13|89)|59|94)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:1(?:3\.22|8\.96)|78\.125)|89\.122)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:1(?:3\.22|8\.96)|78\.125|23\.26)|89\.122)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:(?:3\.217\.14|8\.82\.11)5|9\.144\.30)|1(?:3\.233\.64|7\.118\.82)|22\.124\.178|7\.96\.159)|1(?:74\.137\.41|80\.210\.39|94\.170\.16)|9(?:5\.129\.166|1\.203\.67)|8(?:9\.232\.105|3\.149\.3)|6(?:4\.187\.98|7\.15\.97)|79\.171\.16)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:9\.(?:144\.30|51\.134)|3\.217\.145|7\.57\.122)|1(?:3\.233\.64|7\.118\.82|2\.1\.113)|7\.96\.1[45]9|22\.124\.178)|1(?:25\.162\.243|73\.236\.119)|9(?:5\.129\.166|1\.203\.67)|8(?:9\.232\.105|3\.149\.3)|6(?:4\.187\.98|7\.15\.97))\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:7\.(?:8\.2(?:25|36)|118\.90|66\.146)|3\.87\.7[46]|8\.248\.64|2\.1\.113)|0(?:3\.(?:152\.2|82\.95)|7\.57\.122|9\.51\.134))|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|(?:0\.83\.23|2\.178\.6)9|3\.149\.(?:2[18]|36?|45)|1\.192\.2(?:11|38))|1(?:1(?:3\.162\.(?:246|67)|1\.224\.250)|(?:94\.135\.10|09\.69\.7)5|8(?:4\.154\.95|8\.135\.2))|7(?:4\.(?:117\.211|50\.95)|7\.232\.14[23]|9\.106\.109)|6(?:7\.230\.174|1\.19\.66|9\.65\.59)|41\.(?:254\.[01]|95\.4)|98\.139\.91)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:7\.(?:8\.2(?:25|36)|118\.90|66\.146)|8\.248\.64|3\.87\.76)|0(?:3\.(?:152\.2|82\.95)|8\.82\.115)|7\.96\.189)|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:2[18]|36?|45)|1\.192\.2(?:11|38)|2\.178\.69)|1(?:1(?:3\.162\.(?:246|67)|1\.224\.250)|8(?:4\.154\.95|8\.135\.2)|94\.1(?:35\.105|70\.16)|74\.137\.41)|7(?:4\.(?:117\.211|50\.95)|7\.232\.14[23]|9\.106\.109)|6(?:7\.230\.174|1\.19\.66|9\.65\.59)|41\.(?:254\.[01]|95\.4)|98\.139\.91)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|82\.129\.182|35\.237\.20)|209\.228\.70)|0\.(?:106\.130\.140|69\.155\.99)|3\.(?:107\.184\.193|238\.209\.1)|4\.1(?:35\.105\.1|70\.16\.85)|6\.201\.207\.185|9\.236\.117\.210)|1(?:1\.(?:224\.250\.1(?:3[012345]|29)|68\.108\.200)|5\.1(?:17\.35\.158|78\.61\.34)|4\.118\.94\.79)|2(?:2\.(?:252\.234\.74|155\.3\.162)|1\.52\.15(?:8\.245|2\.2)|4\.124\.43\.32|5\.20\.82\.195)|7(?:4\.1(?:37\.41\.2(?:38|41|52)|22\.105\.66)|3\.236\.119\.(?:2\d|19|30)|8\.32\.64\.195)|8(?:4\.154\.(?:95\.2(?:4[5789]|5[23])|41\.57)|2\.18\.31\.79)|63\.2(?:0\.94\.130|1\.100\.4)|59\.148\.96\.251)|2(?:0(?:0\.(?:1(?:08\.109\.179|41\.87\.135|52\.113\.24)|2(?:19\.168\.178|34\.200\.116))|1\.(?:1(?:44\.(?:130\.2|51\.4)1|16\.140\.246)|251\.250\.3)|8\.(?:82\.115\.1(?:8[34]|67|74)|110\.73\.34|38\.137\.6)|9\.(?:144\.30\.(?:19[67]|204)|51\.134\.21[234])|5\.251\.140\.186|2\.75\.38\.209|7\.57\.122\.80)|1(?:2\.(?:1(?:18\.142\.
76|64\.71\.128|\.113\.91)|52\.129\.193)|(?:3\.1(?:51\.89\.11|86\.38\.3)|6\.157\.152\.12)8|1\.(?:1(?:3\.204\.1|47\.3\.74)|208\.214\.124)|7\.(?:173\.21\.5|76\.2\.129)|8\.248\.44\.196|0\.91\.239\.10)|2(?:0\.(?:152\.137\.124|231\.69\.13)|2\.(?:124\.178\.158|252\.223\.2))|4\.207\.15\.55)|8(?:7\.(?:2(?:3(?:7\.201\.132|9\.24\.214)|2(?:6\.242\.7|9\.73\.98)|52\.227\.(?:40?|60))|101\.230\.38)|9\.1(?:61\.(?:1(?:41\.147|58\.80)|2(?:06\.1|23\.2)47)|87\.131\.41)|2\.(?:1(?:93\.140\.168|40\.91\.41)|213\.2\.170)|3\.(?:1(?:42\.111\.228|6\.167\.14)|234\.74\.98)|0\.(?:253\.99\.22|65\.16\.71)|6\.(?:36\.49\.1|98\.6\.15)|8\.255\.153\.106|5\.90\.193\.240)|6(?:1\.(?:1(?:39\.151\.(?:18|22)|55\.170\.16|12\.19\.81|26\.28\.97)|47\.60\.228)|7\.(?:230\.174\.1(?:5[1789]|7[479]|8[36]|[34]5|66)|15\.97\.31)|2\.(?:1(?:29\.201\.209|19\.28\.251)|28\.70\.68)|9\.6(?:5\.59\.(?:[458]|2[127]|16)|4\.155\.181)|4\.(?:187\.98\.7[13]|71\.229\.14))|7(?:4\.(?:5(?:0\.(?:95\.1[07]|85\.15)|2\.87\.162)|117\.211\.1(?:3[57]|45|50
)|82\.198\.157|211\.64\.48)|8\.(?:1(?:00\.36\.138|59\.121\.15)|46\.78\.78)|6\.(?:73\.101\.2(?:18|22)|161\.241\.115)|7\.(?:232\.69\.160|92\.159\.102)|9\.171\.16\.5[58]|0\.108\.253\.223|2\.54\.21\.45)|9(?:3\.(?:9(?:1\.1(?:44\.98|96\.99)|5\.168\.122)|1(?:78\.205\.238|26\.15\.49))|1\.1(?:21\.8\.117|93\.199\.4)|5\.172\.147\.15|4\.102\.5\.20)|41\.(?:137\.(?:(?:24|30|56)\.4|63\.20[123])|76\.168\.1)|59\.25\.182\.92)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|82\.129\.182|35\.237\.20)|209\.228\.70)|3\.(?:107\.184\.193|238\.209\.1)|0\.(?:124\.67\.252|69\.155\.99)|4\.1(?:35\.105\.1|70\.16\.85)|6\.201\.207\.185|9\.236\.117\.210)|1(?:1\.(?:224\.250\.1(?:3[012345]|29)|68\.108\.200)|5\.1(?:17\.35\.158|78\.61\.34)|3\.162\.237\.103|4\.118\.94\.79)|2(?:1\.(?:52\.15(?:8\.245|2\.2)|35\.174\.114)|2\.(?:252\.234\.74|155\.3\.162)|4\.124\.43\.32|5\.20\.82\.195)|7(?:4\.1(?:37\.41\.2(?:4[18]|38|52)|22\.105\.66)|3\.236\.119\.(?:2\d|19|30)|8\.32\.64\.195)|8(?:4\.154\.(?:95\.2(?:4[789]|5[23]|32)|41\.57)|2\.18\.31\.79)|63\.2(?:0\.(?:66\.202|94\.130|8\.5)|1\.100\.4)|59\.148\.96\.251|09\.196\.193\.3)|2(?:0(?:0\.(?:2(?:19\.168\.178|34\.200\.116)|1(?:08\.109\.179|41\.87\.135))|1\.(?:1(?:44\.(?:130\.2|51\.4)1|16\.140\.246)|251\.250\.3)|9\.(?:144\.30\.(?:19[67]|204)|51\.134\.21[234])|8\.(?:82\.115\.1(?:8[134]|67|74)|38\.137\.6)|(?:7\.57\.122\.8|4\.8\.
46\.13)0|5\.251\.140\.186|2\.75\.38\.209)|1(?:2\.(?:1(?:18\.142\.76|64\.71\.128|\.113\.91)|52\.129\.193)|(?:6\.157\.152\.12|3\.186\.38\.3)8|7\.(?:173\.21\.5|76\.2\.129)|1\.1(?:3\.204\.1|47\.3\.74)|8\.248\.44\.196|0\.91\.239\.10|9\.235\.2\.91)|2(?:0\.(?:152\.137\.124|231\.69\.13)|2\.(?:124\.178\.158|252\.223\.2))|4\.207\.15\.55)|8(?:7\.(?:2(?:3(?:7\.201\.132|9\.24\.214)|2(?:6\.242\.7|9\.73\.98)|52\.227\.[46]0)|101\.230\.38)|9\.1(?:61\.(?:1(?:41\.147|99\.235|58\.80)|2(?:06\.1|23\.2)47)|87\.131\.41)|2\.(?:1(?:93\.140\.168|40\.91\.41)|213\.2\.170)|3\.1(?:42\.111\.228|6\.167\.14)|0\.(?:253\.99\.22|65\.16\.71)|6\.(?:36\.49\.1|98\.6\.15)|8\.255\.153\.106|5\.90\.193\.240)|7(?:4\.(?:5(?:0\.(?:95\.1[07]|85\.15)|2\.87\.162)|117\.211\.1(?:3[57]|5[07]|45)|211\.64\.48)|8\.(?:1(?:00\.36\.138|59\.121\.15)|46\.78\.78)|6\.(?:73\.101\.2(?:18|22)|161\.241\.115)|7\.(?:232\.69\.160|92\.159\.102)|(?:9\.171\.16\.5|2\.54\.21\.4)5|0\.108\.253\.223)|6(?:1\.(?:1(?:39\.151\.(?:18|22)|55\.170\.16|12\.19\
.81|26\.28\.97)|47\.60\.228)|7\.(?:230\.174\.1(?:5[189]|7[479]|8[36]|[34]5|66)|15\.97\.31)|9\.6(?:5\.59\.(?:[58]|2[127]|1[16])|4\.155\.181)|2\.1(?:29\.201\.209|19\.28\.251)|4\.187\.98\.7[13])|9(?:3\.(?:9(?:1\.1(?:44\.98|96\.99)|5\.168\.122)|1(?:78\.205\.238|26\.15\.49))|5\.172\.147\.15|1\.193\.199\.4|7\.90\.155\.57|4\.102\.5\.20)|41\.(?:137\.(?:(?:24|30|56)\.4|63\.20[123])|76\.168\.1)|59\.25\.182\.92)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:7\.(?:2(?:0(?:0\.(?:1(?:6[13567]|8[01234]|7[6789]|9[2345])|2(?:1[01234]|0[89]))|4\.144)|4(?:1\.(?:2(?:4[89]|24|32)|8[01]|144)|2\.0))|19(?:8\.(?:8[12356]|34|93)|9\.(?:5[01258]|4[89])))|9\.15(?:9\.(?:2(?:0[012356789]|1[01234567]|2[013])|19[256789])|3\.(?:[0235]|9[013568]?|1[45789]|8[469]?)|5\.(?:1(?:00|1)|9[679]|3)|6\.17)|3\.(?:16(?:2\.(?:1(?:2[458]|1[78]|4[13]|00|39)|2(?:4[3456]|2[578]|34)|6[57]|7[79]|[59]6)|8\.(?:10|88)|9\.18[012]|7\.111)|22\.8)|6\.71\.(?:[58]|2(?:1[4589]|0[89]?|2[23]|8)|1(?:[2679]|4[58]?|5[01]?)|3[24]|43)|0\.49\.(?:193|205)|5\.147\.229|8\.71\.[89])|8(?:0\.(?:210\.(?:39|43)|194\.[01])|3\.16\.1(?:4[89]|5[01])|8\.135\.2)|2(?:5\.(?:23(?:4\.144|5\.192)|162\.243)|3\.2(?:8\.14[012]|7\.55))|94\.230\.146)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:82|90)|66\.146)|3\.87\.(?:8[01789]|7[46]|194|90)|2\.(?:23\.10[45]|95\.7)|8\.248\.64)|0(?:3\.(?:152\.2|82\.95)|2\.152\.243)|(?:22\.252|7\.96)\.159)|8(?:5
\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:3[267]?|4[345]|2[18])|9\.2(?:04\.1(?:37|53)|32\.105)|1\.192\.(?:2(?:1[15]|38)|199)|2\.1(?:28\.5[45]|78\.69)|0\.83\.239)|5(?:9\.9(?:9\.(?:1(?:5[234]|2[89])|5[678]|40)|7\.2(?:0[89]|16)|8\.1(?:44|52))|8\.18(?:6\.14|7\.8))|41\.(?:2(?:54\.[012]|02\.194)|95\.[248]|191\.27)|9(?:2\.39\.(?:7[079]|65)|5\.154\.116)|77\.232\.14[23]|61\.19\.6[567])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:7\.(?:2(?:0(?:0\.(?:1(?:6[12356]|7[6789]|8[0123]|9[2345])|2(?:1[01234]|0[89]))|4\.144)|41\.(?:2(?:4[89]|17|28)|8[01]|144))|19(?:8\.(?:8[1356]|34|93)|9\.(?:5[015]|187|49)))|3\.(?:16(?:2\.(?:1(?:2[458]|1[78]|4[13]|00|38)|2(?:4[3456]|2[578]|3[48])|7[4679]|6[57]|[59]6)|8\.(?:1(?:36|0)|88)|9\.18[0123]|7\.111)|22\.8)|9\.15(?:9\.(?:2(?:1[01234567]|2[013]|0\d)|19[245679])|3\.(?:[0235]|1[1345789]|9[134568]?|8[69]?)|5\.(?:1(?:00|1)|3[36]?|9[679]|8)|6\.17)|6\.71\.(?:[58]|2(?:[58]|1[4589]|0[89]?|2[23])|1(?:[26789]|4[4589]?|51?)|3[24]|43)|0\.49\.(?:193|205)|5\.147\.229|8\.71\.[89])|8(?:0\.(?:210\.(?:39|43)|194\.[01])|3\.16\.1(?:5[01]|49)|8\.135\.2)|2(?:5\.(?:23(?:4\.144|5\.192)|162\.243)|3\.2(?:8\.14[012]|7\.55))|94\.230\.146)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.90|66\.146)|2\.(?:23\.10[45]|60\.73|95\.7)|3\.87\.(?:8[01789]|7[46]|90)|8\.248\.64)|0(?:3\.(?:152\.2|82\.95)|2\.152\.243)|22\.25(?:2\.159|4\.78)|7\.96\.159
)|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:3[267]?|4[345]|2[18])|9\.2(?:04\.1(?:37|53)|32\.105)|1\.192\.(?:2(?:1[15]|38)|199)|2\.1(?:28\.5[45]|78\.69)|0\.83\.239)|5(?:9\.9(?:9\.(?:1(?:5[234]|2[89])|5[678]|40)|7\.2(?:0[89]|16)|8\.152)|8\.18(?:6\.(?:220|14)|7\.8))|41\.(?:2(?:0(?:2\.19|9\.6)4|54\.[012])|95\.[248]|191\.27)|92\.39\.(?:7[079]|65)|77\.232\.14[23]|61\.19\.6[567])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8