You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2010/05/27 08:57:49 UTC
svn commit: r948692 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Thu May 27 06:57:49 2010
New Revision: 948692
URL: http://svn.apache.org/viewvc?rev=948692&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=948692&r1=948691&r2=948692&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Thu May 27 06:57:49 2010
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201005262
+## khop-sc-neighbors.cf v 201005272
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -57,7 +57,7 @@ score KHOP_SC_TOP_CIDR8 0.9 0.1 0.9 0.
# 11.6286/0.0475 0.996 20100410 net, solo=11.7224/0.6900@0.944, ->LE as above
# http://www.spamcop.net/w3m?action=map;net=bmaxcnt;mask=16777215;sort=spamcnt
-header KHOP_SC_CIDR16 Received =~ /(?-xism:\b(?:1(?:22\.16[1238]|15\.240)|89\.122)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_CIDR16 Received =~ /(?-xism:\b(?:122\.16[1238]|89\.122|95\.133)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_CIDR16 Relay CIDR /16 is among worst in SpamCop
tflags KHOP_SC_CIDR16 nopublish
score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:9(?:2\.(?:113|81)|5\.13[35])|12(?:2\.164|3\.27)|41\.(?:141|249)|59\.92)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:2(?:2\.164|3\.27)|15\.240)|9(?:2\.(?:113|81)|5\.135)|41\.(?:141|249)|59\.92)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:5\.93\.16|6\.40\.1)0|09\.(?:166\.128|95\.39)|14\.143\.48|21\.1\.37)|2(?:0(?:1\.220\.232|3\.87\.178)|1(?:3\.233\.64|7\.118\.82)|22\.237\.162)|41\.(?:2(?:14\.12|54\.1)|140\.252)|78\.138\.17[01]|82\.113\.121|67\.217\.50)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:1\.220\.232|3\.87\.178|0\.4\.167)|2(?:2\.237\.162|1\.143\.46)|1(?:3\.233\.64|7\.118\.82))|1(?:09\.(?:166\.1(?:28|36)|95\.39)|9(?:5\.93\.16|6\.40\.1)0|14\.143\.48|78\.49\.252|21\.1\.37)|41\.(?:140\.252|254\.1)|82\.113\.121)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.26\.(?:2(?:3[234]|41)|1(?:6[45]|86))|3\.1(?:49\.(?:21|3)|6\.167)|1\.192\.211|7\.252\.227|9\.232\.105|2\.178\.69)|1(?:1(?:5\.147\.2(?:03|37)|1\.224\.250|3\.22\.69|4\.79\.55)|96\.12\.2(?:4[2345]|3[36])|87\.45\.193|21\.54\.32)|2(?:1(?:7\.(?:8\.2(?:25|36)|118\.90)|3\.(?:233\.64|87\.76))|02\.(?:70\.5[1489]|152\.243)|21\.211\.143)|7(?:7\.232\.14[23]|4\.208\.166|8\.138\.171|9\.106\.109|2\.21\.7)|41\.(?:2(?:54\.[012]|23\.201)|140\.251)|9(?:5\.129\.166|1\.203\.67)|61\.19\.66)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.26\.(?:2(?:3[234]|41)|1(?:6[45]|86))|3\.1(?:49\.(?:21|3)|6\.167)|1\.192\.211|7\.252\.227|9\.232\.105|2\.178\.69)|2(?:1(?:7\.(?:8\.2(?:25|36)|118\.90)|3\.(?:233\.64|87\.76))|02\.(?:70\.5[1489]|152\.243)|21\.211\.143)|1(?:1(?:1\.224\.250|5\.147\.237|3\.22\.69|4\.79\.55)|96\.12\.2(?:4[2345]|3[36])|21\.54\.32)|7(?:7\.232\.14[23]|8\.138\.17[01]|4\.208\.166|9\.106\.109|2\.21\.7)|41\.(?:2(?:54\.[012]|23\.201)|140\.251)|9(?:5\.129\.166|1\.203\.67|2\.39\.79)|61\.19\.66)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:0\.(?:1(?:4(?:9\.229\.141|4\.74\.94)|82\.122\.218|\.129\.232)|(?:75\.130\.25|80\.209\.17)1|26\.(?:67\.230|97\.26)|59\.62\.156)|5\.(?:1(?:61\.(?:8\.1|9\.2)|\.106\.231)|202\.81\.154|5\.124\.250)|4\.(?:1(?:22\.150\.161|35\.105\.232)|204\.203\.16|50\.9\.114)|3\.(?:10(?:7\.184\.192|8\.38\.228)|251\.95\.104))|1(?:5\.(?:95\.25\.4[23]|117\.35\.158|248\.81\.91|68\.15\.83)|(?:0\.45\.144\.22|6\.39\.56\.)7|2\.1(?:62\.214\.78|85\.70\.224)|1\.224\.250\.1(?:3[01234]|29)|4\.143\.48\.225|7\.16\.145\.24)|8(?:7\.(?:45\.193\.223|75\.128\.118|85\.135\.190)|8\.(?:124\.129\.126|61\.252\.238|20\.248\.84)|6\.24\.(?:2[13]|19)\.3|0\.73\.149\.142|9\.35\.100\.97)|2(?:(?:4\.105\.75\.13|8\.134\.57\.7)5|2\.(?:252\.234\.74|34\.215\.210)|5\.(?:20\.82\.197|7\.192\.146)|1\.1(?:27\.183\.70|\.18\.244)|3\.30\.110\.96)|7(?:4\.1(?:23\.26\.10[028]|33\.46\.243)|3\.(?:161\.201\.157|224\.212\.72))|64\.124\.141\.15[45]|51\.76\.29\.214)|2(?:1(?:1\.(?:1(?:9(?:1\.17
4\.141|9\.79\.198)|79\.124\.160|3\.204\.1)|247\.(?:239\.239|97\.135))|3\.(?:2(?:2(?:6\.144\.65|1\.5\.201)|51\.170\.46)|133\.177\.5)|2\.1(?:23\.219\.162|75\.110\.68|56\.51\.66)|9\.(?:70\.(?:78\.163|93\.129)|95\.148\.97)|0\.(?:102\.140\.231|93\.109\.205)|7\.(?:76\.2\.129|26\.6\.64)|6\.155\.39\.1[25])|0(?:1\.(?:1(?:16\.140\.246|44\.130\.21|0\.176\.43)|2(?:20\.232\.61|32\.107\.46)|59\.92\.246)|3\.(?:1(?:71\.240\.10|29\.219\.5|53\.39\.18)|2(?:13\.174\.37|49\.81\.4))|9\.(?:2(?:39\.47\.205|54\.56\.106)|94\.196\.170)|0\.(?:(?:80\.140\.6|70\.23\.5)1|111\.161\.194)|2\.144\.185\.170)|2(?:2\.(?:12(?:4\.1(?:56\.231|78\.158)|0\.16\.15)|2(?:37\.162\.200|52\.223\.2))|0\.(?:255\.132\.156|67\.124\.241|149\.56\.69|82\.69\.23)|1\.143\.46\.33)|4\.107\.57\.1)|8(?:2\.1(?:14\.(?:7(?:9\.163|0\.54)|90\.246)|(?:78\.168|93\.140)\.168|69\.73\.11)|9\.(?:2(?:21\.200\.201|31\.178\.16)|129\.117\.194|81\.115\.173|78\.70\.210)|0\.(?:5(?:7\.187\.143|3\.32\.122)|93\.125\.186|65\.16\.71)|3\.(?:1(?:36\.59\.137|6\
.167\.14)|240\.139\.195)|1\.(?:192\.103\.84|21\.115\.38|57\.206\.89)|5\.1(?:26\.221\.147|93\.198\.36|54\.6\.71)|7\.252\.227\.(?:7[26]|32|88|4)|4\.51\.(?:38\.178|21\.46)|6\.148\.27\.221)|6(?:1\.(?:9(?:7\.32\.104|\.202\.65)|100\.228\.61|50\.240\.58|7\.241\.70)|4\.(?:16(?:4\.228\.206|5\.253\.230)|244\.130\.98)|7\.(?:1(?:15\.179\.198|62\.212\.147)|217\.50\.44)|(?:2\.103\.171\.2|9\.151\.79\.23)8|5\.3(?:9\.182\.16[67]|8\.95\.242)|8\.184\.77\.157)|7(?:4\.(?:9(?:3\.213\.145|2\.90\.58)|208\.166\.151|86\.21\.208)|2\.(?:51\.44\.(?:23|78)|130\.91\.162|21\.7\.79)|8\.(?:(?:235\.1\.17|88\.233\.8)5|40\.254\.1)|9\.(?:187\.150\.122|4\.210\.14)|0\.234\.125\.150|6\.227\.84\.105|7\.23\.50\.83)|9(?:4\.(?:2(?:12\.16\.61|3\.6\.143)|103\.147\.82)|1\.(?:214\.128\.2[04]|90\.126\.180)|7\.(?:102\.254\.25|66\.79\.8)1|3\.91\.196\.(?:132|99))|41\.(?:2(?:1(?:5\.18\.23|0\.32\.1)4|20\.241\.58)|190\.239\.178)|5(?:9\.(?:90\.214\.99|6\.146\.24)|8\.27\.132\.51))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:0\.(?:1(?:4(?:9\.229\.141|4\.74\.94)|82\.122\.218|\.129\.232)|(?:75\.130\.25|80\.209\.17)1|26\.(?:67\.230|97\.26))|5\.(?:1(?:61\.(?:8\.1|9\.2)|\.106\.231)|(?:35\.109\.|5\.124\.2)50|202\.81\.154)|3\.(?:10(?:7\.(?:184\.192|80\.11)|8\.38\.228)|251\.95\.104)|4\.(?:1(?:22\.150\.161|35\.105\.232)|50\.9\.114)|2\.153\.163\.61)|2(?:5\.(?:2(?:0\.82\.197|14\.39\.14)|7\.192\.146)|(?:4\.105\.75\.13|8\.134\.57\.7)5|2\.(?:252\.234\.74|34\.215\.210)|3\.(?:237\.252\.35|30\.110\.96)|1\.1(?:27\.183\.70|\.18\.244))|1(?:5\.(?:95\.25\.4[23]|117\.35\.158|68\.15\.83)|1\.224\.250\.(?:1(?:3[01234]|29)|71)|(?:2\.185\.70\.2|7\.16\.145\.)24|8\.161\.241\.130|4\.143\.48\.225)|8(?:8\.(?:124\.129\.126|61\.252\.238)|7\.(?:45\.193\.223|85\.135\.190)|9\.(?:105\.61\.143|35\.100\.97)|0\.73\.149\.142|6\.24\.2[13]\.3)|7(?:4\.1(?:23\.26\.10[02]|33\.46\.243)|3\.(?:161\.201\.157|224\.212\.72))|64\.124\.141\.15[45]|09\.169\.26\.83|51\.76\.29\.214)|2(?:1(?:1\.(?
:1(?:9(?:1\.174\.141|9\.79\.198)|79\.124\.160|3\.204\.1)|247\.(?:239\.239|97\.135))|3\.(?:2(?:2(?:6\.144\.65|1\.5\.201)|51\.170\.46)|1(?:28\.85\.162|33\.177\.5))|0\.(?:10(?:2\.140\.231|5\.155\.33)|81\.170\.197|93\.109\.205)|2\.(?:1(?:23\.219\.162|56\.51\.66)|217\.22\.88)|7\.(?:173\.21\.5|76\.2\.129|26\.6\.64)|9\.70\.(?:78\.163|93\.129)|6\.155\.39\.12)|0(?:1\.(?:1(?:16\.140\.246|44\.130\.21|0\.176\.43)|(?:232\.107\.|59\.92\.2)46)|3\.(?:1(?:71\.240\.10|53\.39\.18)|2(?:13\.174\.37|49\.81\.4))|9\.(?:2(?:39\.47\.205|54\.56\.106)|94\.196\.170)|0\.(?:111\.161\.194|80\.140\.61))|2(?:2\.(?:2(?:37\.162\.200|52\.223\.2)|124\.1(?:56\.231|78\.158))|0\.(?:255\.132\.156|67\.124\.241|149\.56\.69|82\.69\.23)|1\.143\.46\.33)|4\.107\.57\.1)|8(?:9\.(?:2(?:21\.200\.201|31\.178\.16)|(?:42\.111\.16|81\.115\.17)3|129\.117\.194|78\.70\.210)|2\.1(?:14\.(?:7(?:9\.163|0\.54)|90\.246)|44\.220\.236|93\.140\.168|69\.73\.11)|0\.(?:5(?:7\.187\.143|3\.32\.122)|93\.125\.186|65\.16\.71)|5\.(?:1(?:26\.221\.147|
7\.137\.16|54\.6\.71)|214\.42\.242)|1\.(?:2(?:03\.166\.155|1\.115\.38)|192\.103\.84)|7\.252\.227\.(?:7[26]|8[48]|32|4)|3\.(?:240\.139\.195|16\.167\.14)|4\.51\.(?:38\.178|21\.46)|6\.148\.27\.221|\.7\.26\.142)|6(?:1\.(?:1(?:00\.228\.61|9\.71\.74)|9(?:7\.32\.104|\.202\.65)|50\.240\.58|7\.241\.70)|7\.(?:1(?:15\.179\.198|62\.212\.147)|2(?:01\.56\.113|17\.50\.44))|4\.(?:16(?:4\.228\.206|5\.253\.230)|244\.130\.98)|(?:2\.103\.171\.2|9\.151\.79\.23)8|5\.3(?:9\.182\.167|8\.95\.242)|8\.184\.77\.157)|7(?:4\.(?:9(?:3\.213\.145|2\.90\.58)|86\.21\.2(?:08|14)|208\.166\.151)|8\.(?:(?:235\.1\.17|88\.233\.8)5|40\.254\.1)|2\.(?:51\.44\.(?:23|78)|21\.7\.79)|0\.(?:234\.125\.150|45\.225\.238)|9\.187\.150\.122|6\.227\.84\.105|7\.23\.50\.83)|9(?:4\.(?:2(?:3\.(?:2(?:02\.79|3\.18)|6\.143)|12\.16\.61)|103\.147\.82)|1\.(?:214\.128\.2[04]|90\.126\.180)|7\.(?:102\.254\.25|66\.79\.8)1|3\.91\.196\.(?:132|99))|41\.(?:21(?:5\.18\.23|0\.32\.1)4|190\.239\.178)|5(?:8\.27\.132\.51|9\.6\.146\.24))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:7\.(?:2(?:0(?:6\.(?:3[23489]?|1[678]|4[08]|5?0|9)|4\.(?:8[012346]|11[2459]|9[678])|5\.(?:1(?:4[456]|00|28)|9[67])|0\.(?:144|225)|1\.(?:48|50))|4(?:2\.(?:1(?:4[01]|9?6|32)|2(?:04|8)|6[089]|7[23])|1\.(?:1(?:44|52)|22[48]|5[67])))|19(?:9\.(?:[023567]|1(?:4[45]|0)?|48?)|7\.(?:9[68]|53|64)|8\.3[235]|6\.161))|8\.(?:68\.2(?:4[89]|5[23])|71\.(?:[89]|10))|3\.(?:162\.(?:[67]7|96)|22\.(?:6?9|10|8))|5\.147\.(?:2(?:3[0127]|0[123]|29)|192)|9\.48\.19[2456789])|2(?:2\.1(?:68\.(?:2(?:0[578]|1[03]|4[47]|5[12])|1[68]|30)|72\.124)|3\.27\.216)|9(?:6\.12\.2(?:4[2345]|3[36])|4\.230\.146)|8(?:9\.124\.31|8\.135\.2))|5(?:9\.9(?:9\.(?:1(?:3[0123]|8[456]|2[89]|52|6)|40|57)|8\.1(?:2[89]|3[01]|[59]2|44)|3\.(?:[1279]|3[23459])|7\.2(?:2[45]|17)|4\.112)|8\.1(?:8(?:6\.21[78]|7\.8)|0\.170))|2(?:1(?:3\.(?:87\.(?:194|76)|108\.172)|7\.(?:8\.2(?:25|36)|118\.90)|2\.23\.10[45])|0(?:2\.(?:70\.5[489]|152\.243)|1\.191\.195)|21\.211\.143)|8(?:5\.
26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:2[18]|4[45]|32?)|1\.192\.(?:199|211)|9\.232\.105|2\.178\.69)|41\.(?:2(?:54\.[0123]|23\.201)|1(?:40\.251|89\.193))|9(?:2\.39\.(?:65|77)|1\.203\.67)|78\.138\.17[01]|61\.19\.6[567])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:7\.(?:2(?:0(?:4\.(?:8[012347]|11[2459]|9[678]|225)|6\.(?:3[249]?|1[678]|4[018]|5?0|9)|5\.(?:1(?:4[456]|00|28)|9[67])|1\.(?:4[89]|50)|0\.(?:144|225))|4(?:2\.(?:1(?:4[04]|9?6|32)|2(?:04|8)|6[089]|44|72)|1\.(?:1(?:44|52|76)|2(?:2[48]|16)|5[67]|80)))|19(?:7\.(?:6[46]|9[68]|53)|9\.(?:[02367]|5?1|48)|8\.(?:3[235]|1)|6\.1(?:34|61)))|8\.(?:68\.(?:2(?:4[89]|5[23])|166)|71\.(?:10|8))|3\.(?:162\.(?:[67]7|96)|22\.(?:6?9|10|8))|5\.147\.(?:2(?:3[0127]|0[123]|29)|192)|9\.48\.19[23456789])|22\.16(?:8\.(?:2(?:1[0138]|0[589]|4[457]|5[123]|2)|1[68]|30)|1\.82)|9(?:6\.12\.2(?:4[2345]|3[36])|4\.230\.146)|88\.135\.2)|5(?:9\.9(?:9\.(?:1(?:3[013]|8[456]|2[89]|52|6)|5[67]|25|40)|8\.1(?:2[89]|3[01]|[59]2|44)|3\.(?:[679]|3[2459])|4\.11[235])|8\.18(?:6\.21[78]|7\.8))|2(?:1(?:3\.(?:87\.(?:194|76)|108\.172)|7\.(?:8\.2(?:25|36)|118\.90)|2\.23\.10[45])|0(?:2\.(?:70\.5[489]|152\.243)|1\.191\.195)|21\.211\.143)|8(?:5\.26\.(?:1(?:6[45]|8
[36])|2(?:3[2345]|41))|3\.149\.(?:2[18]|4[45]|32?)|2\.1(?:13\.121|78\.69)|1\.192\.(?:199|211)|9\.232\.105)|41\.(?:2(?:54\.[0123]|23\.201)|1(?:40\.251|89\.193))|9(?:2\.39\.(?:7[79]|65)|1\.203\.67)|7(?:8\.138\.17[01]|7\.232\.142)|61\.19\.6[567])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8