You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/01/02 07:57:20 UTC
svn commit: r1054359 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sun Jan 2 06:57:19 2011
New Revision: 1054359
URL: http://svn.apache.org/viewvc?rev=1054359&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1054359&r1=1054358&r2=1054359&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sun Jan 2 06:57:19 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20110111
+## khop-sc-neighbors.cf v 20110121
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:22\.168|88\.161|09\.86)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:09\.8|18\.9)6(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:7\.118\.(?:8[23]|9[03])|3\.2(?:26\.63|33\.64)|6\.157\.1(?:46|50)|8\.248\.64)|22\.33\.78)|8(?:5\.26\.(?:2(?:25|34)|165)|9\.232\.105|0\.83\.238)|(?:58\.64\.18|91\.203\.6)7|77\.232\.14[23]|178\.49\.255)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:(?:3\.233|8\.248)\.64|7\.118\.8[123])|22\.33\.78)|8(?:5\.26\.(?:2(?:3[34]|25)|16[45])|9\.232\.105)|1(?:22\.55\.106|78\.49\.255)|(?:58\.64\.18|91\.203\.6)7|77\.232\.14[23])\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:2[18]|4[16]|38?)|(?:0\.83\.23|2\.178\.6)9|1\.192\.2(?:11|38)|9\.232\.105)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[089]|9[02]|74))|0(?:3\.(?:152\.2|82\.95)|0\.125\.171))|1(?:1(?:3\.(?:10\.16[23]|30\.110)|2\.196\.255)|95\.91\.70)|6(?:4\.187\.113|5\.110\.50|1\.19\.66)|7(?:7\.232\.142|9\.106\.109)|41\.(?:254\.[01]|95\.4)|58\.64\.194)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[678]?|2[18]|4[16])|1\.192\.2(?:11|38)|0\.83\.23[89]|9\.232\.105|2\.178\.69)|2(?:1(?:7\.(?:118\.(?:9[03]|83)|8\.2(?:3[68]|25)|66\.146)|3\.87\.(?:9[02]|74|89))|03\.152\.2)|1(?:1(?:3\.(?:10\.16[2378]|30\.110)|2\.196\.255)|9(?:3\.25\.121|5\.91\.70))|7(?:7\.232\.142|9\.106\.109)|6(?:5\.110\.50|1\.19\.66)|41\.(?:254\.1|95\.4)|58\.64\.194|98\.139\.91)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|(?:89\.46\.24|30\.60\.8)6)|39\.210\.106|82\.172\.28)|0\.(?:1(?:27\.249\.121|47\.7\.153)|(?:210\.25\.2|41\.173\.1)25)|6\.(?:2(?:(?:01\.207\.19|8\.52\.)1|9\.201\.234)|12\.226\.34)|3\.(?:1(?:51\.12\.(?:69|70)|07\.184\.193)|239\.44\.193)|4\.1(?:26\.180\.118|58\.204\.250|45\.216\.27))|2(?:5\.(?:16(?:(?:5\.187\.22|2\.72\.8)6|3\.74\.114)|20\.82\.196)|2\.(?:160\.206\.178|252\.234\.75)|4\.(?:158\.110\.6|89\.13\.10)4|1\.(?:191\.7\.16|52\.152\.)2|3\.(?:27\.79\.11|7\.53\.55))|1(?:0\.13(?:9\.(?:238\.18|56\.2)8|8\.146\.221|7\.66\.66)|8\.(?:13(?:1\.100\.180|6\.96\.214)|96\.206\.3)|(?:3\.167\.71\.1|9\.15\.94\.9)4|1\.224\.250\.13[245]|5\.78\.0\.207|7\.6\.2\.108)|8(?:8\.(?:9(?:5\.53\.106|2\.0\.194)|230\.(?:46\.230|95\.227))|4\.105\.195\.(?:75|86)|7\.14\.5\.115)|09\.(?:2(?:29\.235\.135|39\.33\.93)|166\.128\.5|86\.55\.66)|7(?:8\.(?:49\.255\.10[34]|124\.152\.226)|3\.20\.234\.92)|4(?:0\.11(?
:9\.164\.187|3\.183\.50)|8\.244\.172\.122)|6(?:8\.187\.24\.98|3\.21\.100\.4))|2(?:1(?:6\.(?:157\.1(?:4(?:6\.(?:1(?:28|92)|2)|8\.(?:(?:19)?2|64))|5(?:0\.(?:128|64|2)|4\.2))|81\.7(?:[23]\.(?:128|2)|1\.(?:192|64)|0\.(?:64|2)))|2\.(?:1(?:18\.142\.76|99\.29\.145)|200\.126\.244|71\.150\.146|87\.183\.10)|0\.(?:212\.163\.42|91\.239\.10)|8\.(?:248\.44\.196|65\.219\.91)|7\.(?:114\.9\.171|64\.98\.40)|1\.186\.157\.59|3\.79\.125\.122|9\.255\.18\.36)|0(?:2\.(?:1(?:52\.194\.129|08\.3\.184)|28\.(?:66\.251|24\.99)|75\.36\.9[35])|3\.(?:(?:112\.195\.15|217\.176\.6)5|91\.117\.3)|0\.152\.113\.24|1\.251\.250\.3|8\.131\.186\.2|9\.62\.32\.219|4\.8\.46\.130|7\.5\.89\.7)|2(?:2\.(?:252\.223\.2|33\.78\.50)|0\.231\.69\.1[34]))|9(?:1\.(?:1(?:9(?:5\.(?:230\.1[03]|136\.14)|8\.175\.253|3\.199\.4)|49\.1(?:62\.228|73\.100)|21\.175\.20)|2(?:14\.(?:1(?:28\.2[04]|6\.42)|83\.2)|0(?:0\.216\.193|3\.67\.212)))|4\.(?:1(?:53\.232\.178|42\.4\.30)|2(?:45\.156\.33|3\.60\.124)|79\.4(?:9\.116|\.3))|3\.(?:1(?:55\.224\.206|0
0\.72\.241|26\.15\.49)|91\.196\.(?:132|99))|5\.1(?:70\.1(?:83\.251|00\.6)|54\.240\.98)|2\.(?:247\.250\.23|50\.146\.7)4)|8(?:2\.(?:1(?:1(?:4\.(?:7(?:6\.210|9\.86)|87\.149)|6\.32\.123)|93\.140\.168|04\.65\.73)|207\.99\.94)|3\.(?:14(?:2\.111\.228|3\.237\.240)|234\.4\.254)|5\.(?:(?:154\.3\.14|43\.241\.)1|90\.193\.240)|7\.(?:103\.236\.121|226\.242\.7)|1\.218\.162\.247|8\.255\.153\.106|4\.15\.191\.254|0\.95\.70\.173|6\.98\.23\.121)|7(?:4\.(?:5(?:3\.229\.178|0\.95\.10)|117\.211\.243)|7\.(?:23(?:2\.142\.210|9\.254\.2)|72\.122\.98)|(?:6\.161\.241\.11|2\.54\.21\.4)5|0\.108\.253\.223|9\.143\.100\.252|1\.123\.47\.9|5\.148\.7\.17)|6(?:4\.(?:187\.113\.230|50\.151\.101|64\.127\.212)|1\.(?:84\.(?:148\.208|41\.215)|112\.19\.81)|5\.110\.50\.1(?:7[01]|81)|2\.105\.148\.62)|41\.(?:137\.(?:(?:24|30|56)\.4|63\.20[123])|206\.13\.3)|58\.150\.55\.59)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|(?:89\.46\.24|30\.60\.8)6)|82\.172\.28)|4\.(?:1(?:26\.180\.118|58\.204\.250|45\.216\.27)|(?:44\.136\.17|50\.9\.11)4)|6\.(?:2(?:(?:01\.207\.19|8\.52\.)1|9\.201\.234)|12\.226\.34)|0\.(?:(?:210\.25\.2|41\.173\.1)25|147\.7\.153)|3\.(?:151\.12\.(?:69|70)|239\.44\.193)|8\.106\.26\.38)|2(?:(?:1\.(?:191\.7\.16|52\.152\.)|8\.121\.191\.18)2|2\.1(?:60\.206\.178|28\.96\.54)|4\.(?:158\.110\.6|89\.13\.10)4|5\.20\.82\.196|3\.27\.79\.11)|1(?:0\.13(?:9\.(?:238\.18|56\.2)8|7\.66\.66)|5\.(?:252\.69\.141|78\.0\.207)|1\.224\.250\.13[245]|8\.96\.206\.3|7\.6\.2\.108)|8(?:8\.9(?:5\.53\.106|2\.0\.194)|4\.105\.195\.(?:75|86)|6\.141\.140\.1)|7(?:8\.(?:49\.255\.10[34]|124\.152\.226|23\.151\.242)|3\.20\.234\.92)|09\.(?:2(?:29\.235\.135|39\.33\.93)|166\.128\.5|86\.55\.66)|4(?:0\.11(?:9\.164\.187|3\.183\.50)|8\.244\.172\.122)|6(?:8\.187\.24\.98|3\.21\.100\.4))|2(?:1(?:6\.(?:157\.1(?:4(?:6\.(?:1(?:28|
92)|64|2)|8\.(?:(?:19)?2|64))|5(?:0\.(?:1(?:28|92)|64|2)|4\.(?:19)?2))|8(?:1\.7(?:3\.(?:128|64|2)|1\.(?:192|64)|2\.(?:128|2)|0\.(?:64|2))|6\.145\.18[02]))|2\.(?:1(?:18\.142\.7[67]|99\.29\.145)|200\.126\.244|71\.150\.146|87\.183\.10)|3\.(?:18(?:4\.254\.13|6\.38\.38)|79\.125\.122)|0\.(?:212\.163\.42|91\.239\.10)|1\.(?:186\.157\.59|202\.2\.178)|8\.(?:248\.44\.196|65\.219\.91)|7\.(?:114\.9\.171|64\.98\.40)|9\.255\.18\.36)|0(?:2\.(?:1(?:52\.194\.129|08\.3\.184)|75\.3(?:6\.9[35]|8\.209)|28\.(?:66\.251|24\.99))|3\.(?:217\.176\.65|91\.117\.3)|0\.152\.113\.24|1\.251\.250\.3|6\.47\.210\.75|8\.131\.186\.2|9\.62\.32\.219|4\.8\.46\.130|7\.5\.89\.7)|2(?:2\.(?:252\.223\.2|33\.78\.50)|0\.231\.69\.1[34]))|9(?:1\.(?:1(?:9(?:5\.(?:230\.1[03]|136\.14)|8\.175\.253)|49\.162\.228|21\.175\.20)|2(?:0(?:0\.216\.193|2\.25\.138|3\.67\.212)|14\.(?:128\.2[014]|83\.2)))|4\.(?:1(?:53\.232\.178|42\.4\.30)|2(?:45\.156\.33|3\.60\.124)|79\.4(?:9\.116|\.3))|3\.(?:1(?:55\.224\.206|26\.15\.49)|91\.196\.(?:132|99)
)|2\.(?:24(?:7\.250\.234|2\.97\.10)|50\.146\.74)|5\.1(?:54\.240\.98|70\.100\.6))|8(?:2\.(?:1(?:1(?:4\.(?:8(?:6\.122|7\.149)|7(?:6\.210|9\.86))|6\.32\.123)|93\.140\.16[48])|207\.99\.94)|7\.(?:2(?:52\.228\.249|26\.242\.7)|103\.236\.121)|5\.(?:(?:154\.3\.14|43\.241\.)1|232\.28\.204)|3\.14(?:2\.111\.228|3\.237\.240)|6\.98\.(?:23\.121|60\.97)|8\.255\.153\.106|4\.15\.191\.254|0\.95\.70\.173)|7(?:4\.(?:5(?:3\.229\.178|0\.95\.10)|117\.211\.243)|(?:6\.161\.241\.11|2\.54\.21\.4)5|7\.(?:239\.254\.2|72\.122\.98)|0\.108\.253\.223|9\.143\.100\.252|1\.123\.47\.9)|6(?:4\.(?:(?:187\.113\.23|78\.2\.1)0|50\.151\.101)|(?:9\.64\.155\.1|1\.112\.19\.)81|7\.1(?:9\.102\.194|5\.126\.22)|5\.110\.50\.1(?:7[01]|81))|41\.(?:137\.(?:(?:24|30|56)\.4|63\.20[123])|206\.13\.3)|58\.150\.55\.59)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:9\.(?:2(?:0[12345679]|1[036789]|2[0123])|19[23456789])|5\.(?:1(?:0[023]|11)?|3[4689]|4[146]?|9[89]|23?|6)|3\.(?:[26]|8[12589]?|9[2346]?|1[25]?)|2\.246|6\.20)|6\.71\.(?:[07]|2(?:[34569]|1[012678]?|09?|22)?|1(?:[012379]|4[456789]|50?)?|5[0168]?|4[34]?|61?)|3\.1(?:62\.(?:24[46]|6[57]|[59]6)|0\.16[238])|0\.49\.(?:193|205)|7\.241\.248)|25\.23(?:4\.144|5\.192)|88\.135\.2|95\.91\.70)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|(?:0\.83\.23|2\.178\.6)9|7\.252\.243)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|41\.(?:95\.(?:[248]|10)|254\.[012])|61\.19\.6[567]|59\.99\.152)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:9\.(?:2(?:0[12345679]|1[036789]|2[0123])|19[23456789])|5\.(?:1(?:02)?|4[1246]?|3[4689]|2[35]?|9[89]|6)|3\.(?:[26]|8[124589]?|9[2346]?|1[25]?)|2\.246|6\.20)|6\.71\.(?:[07]|2(?:[3456]|1[012678]?|0?9|22)?|1(?:[012379]|4[46789]|50?)?|5[035678]?|4[34]?|61?|35)|3\.(?:1(?:62\.(?:24[46]|6[57]|[59]6)|0\.16[238])|30\.110)|0\.49\.(?:193|205)|7\.241\.248)|25\.23(?:4\.144|5\.192)|88\.135\.2|95\.91\.70)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|(?:0\.83\.23|2\.178\.6)9|7\.252\.243)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|41\.(?:95\.(?:[48]|10)|254\.[01])|59\.(?:103\.25|99\.152)|61\.19\.6[567])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8