You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/01/04 07:57:18 UTC
svn commit: r1054917 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Tue Jan 4 06:57:18 2011
New Revision: 1054917
URL: http://svn.apache.org/viewvc?rev=1054917&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1054917&r1=1054916&r2=1054917&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Tue Jan 4 06:57:18 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20110131
+## khop-sc-neighbors.cf v 20110141
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:09\.8|18\.9)6(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b109\.86(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:(?:3\.233|8\.248)\.64|7\.118\.(?:8[123]|93))|22\.33\.78)|8(?:5\.26\.(?:2(?:3[34]|25)|16[45])|9\.232\.105)|1(?:22\.55\.106|78\.49\.255)|(?:58\.64\.18|91\.203\.6)7|77\.232\.143)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:(?:3\.233|8\.248)\.64|7\.118\.(?:8[13]|93))|03\.152\.2|22\.33\.78)|8(?:5\.26\.(?:2(?:3[34]|25)|16[45])|9\.232\.105)|1(?:(?:22\.55\.10|98\.106\.2)6|78\.49\.255)|(?:58\.64\.18|91\.203\.6)7|77\.232\.14[23])\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[678]?|2[18]|4[16])|1\.192\.2(?:11|38)|0\.83\.23[89]|9\.232\.105|2\.178\.69)|1(?:1(?:3\.(?:10\.16[2378]|30\.110)|2\.196\.255)|9(?:3\.25\.121|5\.91\.70)|78\.49\.255)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:74|89|90))|03\.152\.2)|7(?:7\.232\.142|9\.106\.109)|6(?:5\.110\.50|1\.19\.66)|41\.(?:254\.1|95\.4)|58\.64\.194|98\.139\.91)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[678]?|2[18]|4[16])|1\.192\.2(?:11|38)|0\.83\.23[89]|9\.232\.105|2\.178\.69)|1(?:1(?:3\.(?:10\.16[2378]|30\.110)|2\.196\.255)|9(?:3\.25\.121|5\.91\.70)|78\.49\.255)|21(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:74|89|90))|7(?:7\.232\.142|9\.106\.109)|41\.(?:254\.1|95\.4)|58\.64\.1(?:87|94)|98\.139\.91|61\.19\.66)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:4\.(?:1(?:26\.180\.118|58\.204\.250|45\.216\.27)|(?:44\.136\.17|50\.9\.11)4)|0\.(?:(?:210\.25\.2|41\.173\.1)25|147\.7\.153|30\.236\.34|79\.219\.40)|6\.(?:2(?:(?:01\.207\.19|8\.52\.)1|9\.201\.234)|12\.226\.34)|5\.1(?:6(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|89\.46\.246)|3\.(?:239\.44\.193|151\.12\.69)|8\.106\.26\.54)|2(?:1\.(?:(?:191\.7\.16|52\.152\.)2|78\.236\.38)|2\.1(?:60\.206\.178|28\.96\.54)|4\.(?:158\.110\.6|89\.13\.10)4|8\.121\.1(?:91\.182|43\.48)|5\.20\.82\.19[67]|3\.27\.79\.11)|7(?:8\.(?:49\.(?:255\.10[34]|95\.79)|124\.152\.226|23\.151\.242)|3\.20\.234\.92)|09\.(?:22(?:7\.250\.128|9\.235\.135)|86\.(?:159\.53|55\.66)|166\.128\.5)|8(?:(?:9\.124\.131|8\.95\.53)\.106|4\.105\.195\.(?:75|86))|1(?:5\.(?:252\.69\.141|78\.0\.207)|1\.224\.250\.13[245])|4(?:0\.11(?:9\.164\.187|3\.183\.50)|8\.244\.172\.122)|68\.187\.24\.98)|2(?:1(?:6\.(?:157\.1(?:4(?:6\.(?:1(?:28|92)|64)|8\.(?:(?:19)?2|64))|5(?:0\.(?:1(?:28|92)|64|2)|4\.(?:
19)?2))|8(?:1\.7(?:[03]\.(?:64|2)|2\.(?:128|2)|1\.192)|6\.145\.18[02]))|2\.(?:1(?:99\.(?:104\.162|29\.145)|18\.142\.7[67])|200\.126\.244|71\.150\.146|87\.183\.10)|3\.18(?:4\.2(?:24\.37|54\.13)|6\.38\.38)|0\.(?:212\.163\.42|91\.239\.10)|8\.(?:248\.44\.196|65\.219\.91)|1\.2(?:12\.168\.16|02\.2\.178)|7\.(?:114\.9\.171|76\.2\.129)|9\.255\.18\.36)|0(?:2\.(?:1(?:52\.194\.129|08\.3\.184)|75\.3(?:6\.9[35]|8\.209)|28\.(?:66\.251|24\.99))|3\.(?:2(?:52\.161\.179|17\.176\.65)|91\.117\.3)|4\.(?:188\.168\.11|8\.46\.130)|0\.152\.113\.24|1\.251\.250\.3|6\.47\.210\.75|8\.131\.186\.2|7\.5\.89\.7)|2(?:2\.(?:252\.223\.2|33\.78\.50)|0\.231\.69\.1[34]))|9(?:1\.(?:1(?:9(?:5\.(?:230\.1[01]|136\.14)|8\.(?:175\.253|86\.7))|49\.162\.228|21\.175\.20)|2(?:14\.(?:1(?:28\.2[01]|6\.42)|83\.2)|0(?:2\.25\.138|3\.67\.212)))|4\.(?:2(?:45\.156\.(?:33|55)|3\.60\.124)|1(?:53\.232\.178|42\.4\.30)|79\.4(?:9\.116|\.3))|2\.(?:50\.1(?:46\.7|92\.5)|247\.250\.23)4|3\.(?:91\.196\.(?:132|99)|126\.15\.49)|5\.1(?:54\.240\.9
8|70\.100\.6))|8(?:2\.(?:1(?:14\.(?:8(?:6\.122|7\.149)|7(?:6\.210|9\.86))|93\.140\.16[48])|207\.99\.94)|7\.(?:2(?:52\.228\.249|26\.242\.7)|103\.236\.121)|3\.14(?:2\.111\.228|3\.237\.240)|5\.(?:232\.28\.204|154\.3\.141)|9\.(?:120\.204\.16|237\.26\.2)|6\.98\.(?:23\.121|60\.97)|8\.255\.153\.106|4\.15\.191\.254|0\.95\.70\.173)|7(?:7\.(?:23(?:2\.142\.210|9\.254\.2)|72\.122\.98)|5\.(?:147\.243\.238|211\.48\.91)|4\.(?:117\.211\.243|50\.95\.10)|2\.(?:54\.21\.45|90\.89\.80)|0\.108\.253\.223|6\.161\.241\.115|9\.143\.100\.252|1\.123\.47\.9)|6(?:4\.(?:(?:148\.129\.14|78\.2\.1)0|50\.151\.101)|1\.1(?:39\.151\.18|12\.19\.81|26\.28\.97)|7\.1(?:9\.102\.194|5\.126\.22)|5\.110\.50\.1(?:7[01]|81)|9\.64\.155\.181)|41\.(?:137\.(?:(?:24|30|56)\.4|63\.20[123])|206\.13\.3))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.1(?:6(?:1\.(?:40\.10|9\.2)|0\.253\.4)|8(?:2\.194\.220|9\.46\.246)|14\.6\.11)|4\.(?:1(?:26\.180\.118|58\.204\.250)|(?:44\.136\.17|50\.9\.11)4)|0\.(?:14(?:4\.113\.27|7\.7\.153)|210\.25\.225|30\.236\.34)|6\.(?:2(?:01\.207\.19|8\.52\.)1|12\.226\.34)|3\.(?:239\.44\.193|151\.12\.69)|8\.106\.26\.54)|2(?:1\.(?:(?:191\.7\.16|52\.152\.)2|78\.236\.38)|(?:4\.158\.110\.6|2\.128\.96\.5)4|3\.(?:27\.79\.11|7\.53\.55)|8\.121\.1(?:91\.182|43\.48)|5\.20\.82\.197)|7(?:8\.(?:(?:23\.151\.24|72\.81\.25)2|49\.(?:255\.104|95\.79)|124\.152\.226)|3\.20\.234\.92)|8(?:4\.105\.195\.(?:75|86)|9\.124\.131\.106|8\.230\.46\.230|6\.6\.161\.214)|09\.(?:22(?:7\.250\.128|9\.235\.135)|86\.(?:159\.53|55\.66)|166\.128\.5)|1(?:1\.224\.250\.13[245]|0\.138\.236\.87|5\.252\.69\.141)|4(?:0\.11(?:9\.164\.187|3\.183\.50)|8\.244\.172\.122)|68\.187\.24\.98)|2(?:1(?:6\.(?:157\.1(?:4(?:6\.(?:1(?:28|92)|64)|8\.(?:(?:19)?2|64))|5(?:0\.(?:1(?:28|92)|64|2)|4\.(?:19)?2))
|8(?:1\.7(?:(?:1\.19|0\.)2|2\.(?:128|2)|3\.(?:64|2))|6\.145\.18[02]))|2\.(?:1(?:99\.(?:104\.162|29\.145)|18\.142\.7[67])|200\.126\.244|71\.150\.146|87\.183\.10)|3\.(?:1(?:8(?:4\.2(?:24\.37|54\.13)|6\.38\.38)|38\.85\.60|67\.23\.58)|79\.125\.122)|7\.(?:1(?:75\.123\.40|14\.9\.171)|76\.2\.129)|(?:8\.248\.44\.19|9\.255\.18\.3)6|0\.(?:212\.163\.42|91\.239\.10)|1\.2(?:12\.168\.16|02\.2\.178))|0(?:2\.(?:1(?:52\.194\.129|08\.3\.184)|28\.(?:66\.251|24\.99)|75\.36\.9[35])|3\.(?:2(?:52\.161\.179|17\.176\.65)|177\.246\.22|91\.117\.3)|4\.(?:188\.168\.11|8\.46\.130)|1\.251\.250\.3|6\.47\.210\.75|8\.131\.186\.2|7\.5\.89\.7)|2(?:2\.(?:252\.223\.2|33\.78\.50)|0\.231\.69\.1[34]))|8(?:2\.(?:1(?:14\.(?:8(?:6\.122|7\.149)|7(?:6\.210|9\.86))|93\.140\.16[48])|207\.99\.94)|9\.(?:1(?:06\.161\.130|20\.204\.16)|237\.(?:60\.130|26\.2))|7\.(?:2(?:52\.228\.249|26\.242\.7)|103\.236\.121)|8\.(?:255\.153\.106|135\.83\.108)|3\.14(?:2\.111\.228|3\.237\.240)|5\.(?:232\.28\.204|154\.3\.141)|6\.98\.(?:23\.121|60\
.97)|4\.15\.191\.254|0\.95\.70\.173)|9(?:1\.(?:1(?:9(?:5\.(?:230\.1[01]|136\.14)|8\.(?:175\.253|86\.7))|49\.162\.228|21\.175\.20)|2(?:14\.(?:1(?:28\.2[01]|6\.42)|83\.2)|0(?:2\.25\.138|3\.67\.212)))|4\.(?:2(?:45\.156\.(?:33|55)|3\.60\.124)|1(?:27\.251\.121|42\.4\.30)|79\.4(?:9\.116|\.3))|2\.(?:24(?:7\.250\.234|3\.187\.50)|50\.192\.54)|3\.(?:91\.196\.(?:132|99)|126\.15\.49)|5\.154\.240\.98)|7(?:7\.(?:23(?:2\.142\.210|9\.254\.2)|72\.122\.98)|(?:8\.138\.170\.16|4\.50\.95\.1)0|5\.(?:147\.243\.238|211\.48\.91)|9\.1(?:43\.100\.252|72\.21\.125)|2\.(?:54\.21\.45|90\.89\.80)|0\.108\.253\.223|6\.161\.241\.115|1\.123\.47\.9)|6(?:2\.(?:183\.110\.247|24\.79\.40)|1\.1(?:39\.151\.18|12\.19\.81)|7\.1(?:9\.102\.194|5\.126\.22)|4\.(?:50\.151\.101|78\.2\.10)|5\.110\.50\.17[01]|9\.64\.155\.181)|41\.(?:137\.(?:(?:24|30|56)\.4|63\.20[123])|206\.13\.3))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:9\.(?:2(?:1[0136789]|0[12349]|2[0123])|19[2359])|5\.(?:3[489]|4[16]?|9[89]|23|6)|3\.(?:8[489]?|9[236]?|15|2)|2\.246)|6\.71\.(?:[67]|1(?:[01379]|4[46789]|50?)?|2(?:[346]|1[678]?|0?9|22)?|5[03568]?|44)|3\.(?:1(?:62\.(?:24[46]|56|67)|0\.16[2378])|30\.110)|0\.49\.(?:193|205))|25\.23(?:4\.144|5\.192)|88\.135\.2|95\.91\.70)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|(?:0\.83\.23|2\.178\.6)9|7\.252\.243)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|41\.(?:254\.[01]|95\.[48])|61\.19\.6[567]|59\.99\.152)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:9\.(?:2(?:1[3679]|0[124]|22)|19[23])|3\.(?:9[26]?|8)|5\.(?:23|34)|2\.246)|3\.(?:1(?:62\.(?:244|67)|0\.16[2378])|30\.110)|6\.71\.(?:[56]|2(?:[34]|1[78])?|1(?:48|50)|44)|0\.49\.(?:193|205))|25\.23(?:4\.144|5\.192)|88\.135\.2|95\.91\.70)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[2678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|(?:0\.83\.23|2\.178\.6)9|7\.252\.243)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|41\.(?:254\.[01]|95\.[48])|61\.19\.6[56])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8