You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/01/01 07:57:18 UTC
svn commit: r1054203 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sat Jan 1 06:57:18 2011
New Revision: 1054203
URL: http://svn.apache.org/viewvc?rev=1054203&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1054203&r1=1054202&r2=1054203&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sat Jan 1 06:57:18 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201012311
+## khop-sc-neighbors.cf v 20110111
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:22|90)|9[24])(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:22|89|90)|94)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:(?:09\.8|18\.9)6|22\.168|88\.161)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:22\.168|88\.161|09\.86)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.(?:2(?:26\.63|33\.64)|87\.74)|7\.118\.(?:8[23]|9[03])|8\.248\.64)|22\.33\.78)|8(?:5\.26\.(?:2(?:3[34]|25)|165)|9\.232\.105|0\.83\.238)|1(?:09\.172\.40|78\.49\.255)|77\.232\.14[23]|58\.64\.187)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:7\.118\.(?:8[23]|9[03])|3\.2(?:26\.63|33\.64)|6\.157\.1(?:46|50)|8\.248\.64)|22\.33\.78)|8(?:5\.26\.(?:2(?:25|34)|165)|9\.232\.105|0\.83\.238)|(?:58\.64\.18|91\.203\.6)7|77\.232\.14[23]|178\.49\.255)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.(?:87\.(?:8[089]|9[02]|74)|233\.64))|0(?:3\.(?:152\.2|82\.95)|0\.125\.171))|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:2[18]|4[16]|38?)|(?:0\.83\.23|2\.178\.6)9|1\.192\.2(?:11|38)|9\.232\.105)|1(?:1(?:3\.(?:10\.16[23]|30\.110)|2\.196\.255)|95\.91\.70)|6(?:4\.187\.113|5\.110\.50|1\.19\.66)|41\.(?:254\.[01]|95\.4)|79\.106\.109|58\.64\.194|91\.203\.67)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:2[18]|4[16]|38?)|(?:0\.83\.23|2\.178\.6)9|1\.192\.2(?:11|38)|9\.232\.105)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[089]|9[02]|74))|0(?:3\.(?:152\.2|82\.95)|0\.125\.171))|1(?:1(?:3\.(?:10\.16[23]|30\.110)|2\.196\.255)|95\.91\.70)|6(?:4\.187\.113|5\.110\.50|1\.19\.66)|7(?:7\.232\.142|9\.106\.109)|41\.(?:254\.[01]|95\.4)|58\.64\.194)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|(?:89\.46\.24|30\.60\.8)6)|39\.210\.106|82\.172\.28)|0\.(?:1(?:27\.249\.121|47\.7\.153)|(?:210\.25\.2|41\.173\.1)25)|3\.(?:1(?:51\.12\.(?:69|70)|07\.184\.193)|239\.44\.193)|6\.2(?:(?:01\.207\.19|8\.52\.)1|9\.201\.234)|4\.1(?:26\.180\.118|45\.216\.27))|2(?:5\.(?:16(?:(?:5\.187\.22|2\.72\.8)6|3\.74\.114)|20\.82\.196)|(?:1\.(?:191\.7\.16|52\.152\.)|\.197\.249\.23)2|4\.(?:1(?:58\.110\.64|24\.43\.32)|89\.13\.104)|2\.252\.234\.75|3\.27\.79\.11)|1(?:0\.13(?:9\.(?:238\.18|56\.2)8|8\.146\.221|7\.66\.66)|8\.(?:13(?:1\.100\.180|6\.96\.214)|96\.206\.3)|(?:3\.167\.71\.1|9\.15\.94\.9)4|1\.224\.250\.13[245]|5\.78\.0\.207|7\.6\.2\.108)|8(?:8\.(?:9(?:5\.53\.106|2\.0\.194)|230\.95\.227)|4\.105\.195\.(?:75|86)|7\.14\.5\.115)|4(?:0\.11(?:9\.164\.187|3\.183\.50)|8\.244\.172\.122)|09\.(?:60\.201\.184|239\.33\.93|86\.55\.66)|6(?:8\.187\.24\.98|3\.21\.100\.4)|78\.49\.255\.10[34])|2(?:1(?:6\.(?
:157\.1(?:4(?:6\.(?:1(?:28|92)|2)|8\.(?:(?:19)?2|64))|5(?:0\.(?:128|64|2)|4\.2))|81\.7(?:[23]\.(?:128|2)|1\.(?:192|64)|0\.(?:64|2)))|2\.(?:1(?:(?:18\.142\.7|56\.51\.6)6|99\.29\.145)|200\.126\.244|52\.129\.193|71\.150\.146|87\.183\.10)|0\.(?:212\.163\.42|91\.239\.10)|8\.(?:248\.44\.196|65\.219\.91)|7\.(?:114\.9\.171|64\.98\.40)|9\.255\.18\.(?:36|2)|1\.186\.157\.59|3\.79\.125\.122)|0(?:2\.(?:1(?:0(?:2\.194\.78|8\.3\.184)|52\.194\.129)|28\.(?:66\.251|24\.99)|75\.36\.9[356])|3\.(?:177\.202\.180|217\.176\.65)|0\.152\.113\.24|1\.251\.250\.3|8\.131\.186\.2|9\.62\.32\.219|4\.8\.46\.130|7\.5\.89\.7)|2(?:2\.(?:252\.223\.2|33\.78\.50)|0\.231\.69\.1[34]))|9(?:1\.(?:1(?:9(?:5\.(?:230\.1[03]|136\.14)|8\.175\.253|3\.199\.4)|(?:49\.173\.10|21\.175\.2)0)|2(?:14\.(?:1(?:28\.2[04]|6\.42)|83\.2)|03\.67\.212))|4\.(?:2(?:3(?:2\.11\.11|\.60\.12)4|45\.156\.33)|7(?:3\.247\.47|9\.49\.116|1\.16\.54)|1(?:53\.232\.178|42\.4\.30))|3\.(?:1(?:55\.224\.206|26\.15\.49)|91\.196\.99)|5\.1(?:70\.1(?:83\.251|00\
.6)|54\.240\.98)|2\.247\.250\.234)|8(?:2\.(?:1(?:1(?:4\.(?:8(?:6\.122|7\.149)|7(?:6\.210|9\.86))|6\.32\.123)|93\.140\.168|04\.65\.73)|207\.99\.94)|3\.(?:14(?:2\.111\.228|3\.237\.240)|234\.4\.254)|5\.(?:(?:154\.3\.14|43\.241\.)1|90\.193\.240)|1\.(?:199\.251\.196|218\.162\.247)|7\.(?:103\.236\.121|226\.242\.7)|0\.(?:251\.113\.47|95\.70\.173)|8\.255\.153\.106|4\.15\.191\.254|6\.98\.23\.121)|7(?:4\.(?:5(?:3\.229\.178|0\.95\.10)|117\.211\.243)|7\.(?:2(?:28\.87\.159|39\.254\.2)|72\.122\.98)|(?:6\.161\.241\.11|2\.54\.21\.4)5|0\.108\.253\.223|9\.143\.100\.252|1\.123\.47\.9|5\.148\.7\.17)|6(?:2\.(?:1(?:05\.148\.62|96\.56\.130)|33\.218\.49)|4\.(?:187\.113\.230|50\.151\.101|64\.127\.212)|1\.(?:84\.(?:148\.208|41\.215)|112\.19\.81)|5\.110\.50\.1(?:7[01]|81))|41\.(?:137\.(?:(?:24|30|56)\.4|63\.20[123])|206\.13\.3)|58\.150\.55\.59)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|(?:89\.46\.24|30\.60\.8)6)|39\.210\.106|82\.172\.28)|0\.(?:1(?:27\.249\.121|47\.7\.153)|(?:210\.25\.2|41\.173\.1)25)|6\.(?:2(?:(?:01\.207\.19|8\.52\.)1|9\.201\.234)|12\.226\.34)|3\.(?:1(?:51\.12\.(?:69|70)|07\.184\.193)|239\.44\.193)|4\.1(?:26\.180\.118|58\.204\.250|45\.216\.27))|2(?:5\.(?:16(?:(?:5\.187\.22|2\.72\.8)6|3\.74\.114)|20\.82\.196)|2\.(?:160\.206\.178|252\.234\.75)|4\.(?:158\.110\.6|89\.13\.10)4|1\.(?:191\.7\.16|52\.152\.)2|3\.(?:27\.79\.11|7\.53\.55))|1(?:0\.13(?:9\.(?:238\.18|56\.2)8|8\.146\.221|7\.66\.66)|8\.(?:13(?:1\.100\.180|6\.96\.214)|96\.206\.3)|(?:3\.167\.71\.1|9\.15\.94\.9)4|1\.224\.250\.13[245]|5\.78\.0\.207|7\.6\.2\.108)|8(?:8\.(?:9(?:5\.53\.106|2\.0\.194)|230\.(?:46\.230|95\.227))|4\.105\.195\.(?:75|86)|7\.14\.5\.115)|09\.(?:2(?:29\.235\.135|39\.33\.93)|166\.128\.5|86\.55\.66)|7(?:8\.(?:49\.255\.10[34]|124\.152\.226)|3\.20\.234\.92)|4(?:0\.11(?
:9\.164\.187|3\.183\.50)|8\.244\.172\.122)|6(?:8\.187\.24\.98|3\.21\.100\.4))|2(?:1(?:6\.(?:157\.1(?:4(?:6\.(?:1(?:28|92)|2)|8\.(?:(?:19)?2|64))|5(?:0\.(?:128|64|2)|4\.2))|81\.7(?:[23]\.(?:128|2)|1\.(?:192|64)|0\.(?:64|2)))|2\.(?:1(?:18\.142\.76|99\.29\.145)|200\.126\.244|71\.150\.146|87\.183\.10)|0\.(?:212\.163\.42|91\.239\.10)|8\.(?:248\.44\.196|65\.219\.91)|7\.(?:114\.9\.171|64\.98\.40)|1\.186\.157\.59|3\.79\.125\.122|9\.255\.18\.36)|0(?:2\.(?:1(?:52\.194\.129|08\.3\.184)|28\.(?:66\.251|24\.99)|75\.36\.9[35])|3\.(?:(?:112\.195\.15|217\.176\.6)5|91\.117\.3)|0\.152\.113\.24|1\.251\.250\.3|8\.131\.186\.2|9\.62\.32\.219|4\.8\.46\.130|7\.5\.89\.7)|2(?:2\.(?:252\.223\.2|33\.78\.50)|0\.231\.69\.1[34]))|9(?:1\.(?:1(?:9(?:5\.(?:230\.1[03]|136\.14)|8\.175\.253|3\.199\.4)|49\.1(?:62\.228|73\.100)|21\.175\.20)|2(?:14\.(?:1(?:28\.2[04]|6\.42)|83\.2)|0(?:0\.216\.193|3\.67\.212)))|4\.(?:1(?:53\.232\.178|42\.4\.30)|2(?:45\.156\.33|3\.60\.124)|79\.4(?:9\.116|\.3))|3\.(?:1(?:55\.224\.206|0
0\.72\.241|26\.15\.49)|91\.196\.(?:132|99))|5\.1(?:70\.1(?:83\.251|00\.6)|54\.240\.98)|2\.(?:247\.250\.23|50\.146\.7)4)|8(?:2\.(?:1(?:1(?:4\.(?:7(?:6\.210|9\.86)|87\.149)|6\.32\.123)|93\.140\.168|04\.65\.73)|207\.99\.94)|3\.(?:14(?:2\.111\.228|3\.237\.240)|234\.4\.254)|5\.(?:(?:154\.3\.14|43\.241\.)1|90\.193\.240)|7\.(?:103\.236\.121|226\.242\.7)|1\.218\.162\.247|8\.255\.153\.106|4\.15\.191\.254|0\.95\.70\.173|6\.98\.23\.121)|7(?:4\.(?:5(?:3\.229\.178|0\.95\.10)|117\.211\.243)|7\.(?:23(?:2\.142\.210|9\.254\.2)|72\.122\.98)|(?:6\.161\.241\.11|2\.54\.21\.4)5|0\.108\.253\.223|9\.143\.100\.252|1\.123\.47\.9|5\.148\.7\.17)|6(?:4\.(?:187\.113\.230|50\.151\.101|64\.127\.212)|1\.(?:84\.(?:148\.208|41\.215)|112\.19\.81)|5\.110\.50\.1(?:7[01]|81)|2\.105\.148\.62)|41\.(?:137\.(?:(?:24|30|56)\.4|63\.20[123])|206\.13\.3)|58\.150\.55\.59)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:9\.(?:2(?:0[12345679]|1[036789]|2[0123])|19[23456789])|5\.(?:1(?:0[023]|11)|3[4689]|4[16]?|9[89]|23?|6)|3\.(?:9[2346]?|8[189]|15?|6)|2\.246|6\.20)|6\.71\.(?:2(?:[3469]|1[12678]?|09?|22)?|1(?:[012379]|4[456789]|50?)?|5[268]?|4[34]|61?|7)|3\.1(?:62\.(?:24[46]|6[57]|[59]6)|0\.16[28])|0\.49\.(?:193|205)|7\.241\.248)|25\.23(?:4\.144|5\.192)|88\.135\.2|95\.91\.70)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|(?:0\.83\.23|2\.178\.6)9|9\.204\.137)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|41\.(?:95\.(?:[248]|10)|254\.[012])|59\.(?:9(?:7\.217|9\.152)|103\.25)|61\.19\.6[567])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:9\.(?:2(?:0[12345679]|1[036789]|2[0123])|19[23456789])|5\.(?:1(?:0[023]|11)?|3[4689]|4[146]?|9[89]|23?|6)|3\.(?:[26]|8[12589]?|9[2346]?|1[25]?)|2\.246|6\.20)|6\.71\.(?:[07]|2(?:[34569]|1[012678]?|09?|22)?|1(?:[012379]|4[456789]|50?)?|5[0168]?|4[34]?|61?)|3\.1(?:62\.(?:24[46]|6[57]|[59]6)|0\.16[238])|0\.49\.(?:193|205)|7\.241\.248)|25\.23(?:4\.144|5\.192)|88\.135\.2|95\.91\.70)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|(?:0\.83\.23|2\.178\.6)9|7\.252\.243)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|41\.(?:95\.(?:[248]|10)|254\.[012])|61\.19\.6[567]|59\.99\.152)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8