You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2010/12/11 07:58:20 UTC
svn commit: r1044574 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sat Dec 11 06:58:20 2010
New Revision: 1044574
URL: http://svn.apache.org/viewvc?rev=1044574&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1044574&r1=1044573&r2=1044574&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sat Dec 11 06:58:20 2010
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201012101
+## khop-sc-neighbors.cf v 201012111
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:2(?:3\.2[367]|2\.168)|1(?:3\.169|8\.96)|78\.125|90\.166)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:(?:90\.16|18\.9)6|23\.2[67]|78\.125)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:(?:3\.233|8\.248)\.64|6\.157\.148)|0(?:3\.217\.145|8\.100\.48|2\.28\.24))|1(?:7(?:3\.208\.110|8\.49\.255)|40\.135\.131|09\.172\.53|93\.23\.140|63\.20\.94)|8(?:(?:9\.232\.10|5\.26\.22)5|0\.65\.16)|7(?:7\.232\.143|4\.82\.212|8\.108\.79)|9(?:5\.129\.16|1\.198\.8|3\.186\.9)6|61\.126\.28|41\.254\.1)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.(?:186\.38|233\.64)|6\.157\.148|8\.248\.64)|0(?:3\.217\.145|2\.28\.24))|1(?:7(?:3\.208\.110|8\.49\.255)|09\.172\.53|93\.23\.140)|8(?:1\.192\.2(?:11|38)|5\.26\.(?:164|225)|9\.232\.105)|9(?:5\.129\.16|1\.198\.8|3\.186\.9)6|7(?:7\.232\.143|8\.108\.79)|6(?:1\.126\.28|9\.64\.155)|41\.254\.1)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|1\.192\.(?:2(?:11|38)|199)|3\.149\.(?:2[18]|35?|41)|0\.(?:83\.239|95\.70)|2\.178\.69)|1(?:13\.1(?:62\.(?:2(?:2[78]|46)|[67]7|125)|0\.16[78])|9(?:9\.236\.117|4\.170\.16)|7(?:3\.236\.8|8\.32\.6)4|88\.95\.50)|2(?:1(?:7\.(?:118\.(?:8[23]|90)|8\.2(?:25|36)|66\.146)|3\.(?:233\.64|87\.76)|1\.147\.3)|03\.(?:152\.2|82\.95))|6(?:1\.19\.6[67]|6\.197\.203)|7(?:7\.232\.142|9\.106\.109)|41\.(?:254\.[013]|95\.4)|91\.203\.67)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|0\.(?:83\.239|65\.16|95\.70)|1\.192\.(?:2(?:11|38)|199)|3\.149\.(?:2[18]|35?|41)|2\.178\.69)|2(?:1(?:7\.(?:118\.(?:8[23]|90)|8\.2(?:25|36)|66\.146)|3\.(?:233\.64|87\.76)|1\.147\.3)|03\.(?:152\.2|82\.95))|1(?:13\.1(?:62\.(?:2(?:2[78]|46)|[67]7|125)|0\.16[78])|9(?:9\.236\.117|4\.170\.16)|40\.135\.131|78\.32\.64)|6(?:1\.19\.6[67]|6\.197\.203)|7(?:7\.232\.142|9\.106\.109)|41\.(?:254\.[013]|95\.4)|91\.203\.67)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:16(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|91\.54\.12[01]|88\.112\.219)|4\.1(?:58\.206\.(?:54|78|90)|26\.180\.118|65\.147\.23|70\.16\.85)|6\.2(?:8\.(?:243\.140|52\.1)|01\.207\.191)|3\.1(?:07\.184\.193|40\.209\.26)|0\.(?:94\.122\.196|30\.236\.34)|9\.236\.117\.210)|1(?:1\.(?:224\.250\.13[245]|68\.108\.200)|(?:8\.233\.254\.11|6\.197\.130\.)2|3\.16(?:7\.111\.207|1\.16\.80)|5\.(?:117\.35\.158|78\.3\.221)|7\.211\.83\.131)|8(?:8\.(?:95\.50\.1[45]4|187\.148\.42|230\.95\.227)|4\.(?:105\.195\.74|76\.219\.223)|0\.188\.253\.10|9\.35\.45\.218)|2(?:(?:4\.(?:158\.110\.6|49\.3\.20)|2\.252\.234\.7)4|1\.(?:191\.7\.16|52\.152\.)2|5\.20\.82\.195|3\.27\.79\.11)|7(?:3\.(?:2(?:08\.110\.(?:[568]|10)|36\.84\.1(?:3[29]|40))|166\.141\.252)|8\.32\.64\.195)|5(?:(?:9\.148\.96\.25|3\.19\.157\.)1|1\.95\.106\.144)|63\.2(?:0\.(?:94\.130|8\.5)|1\.100\.4)|40\.135\.131\.202|09\.166\.128\.6)|2(?:1(?:2\.(?:1(?:18\.142\.77|74\.232\.22|56\.51\.66)|52\.129
\.193|2\.195\.221)|6\.(?:1(?:57\.1(?:38\.19|48\.)2|20\.134\.108)|38\.2\.176)|1\.(?:1(?:3\.204\.1|47\.3\.74)|24\.222\.117|58\.59\.73)|0\.(?:212\.163\.42|91\.239\.10)|3\.1(?:35\.188\.223|86\.38\.38)|8\.2(?:12\.76\.103|48\.44\.196)|7\.76\.2\.129)|0(?:1\.(?:1(?:16\.140\.246|44\.130\.21)|2(?:33\.186\.220|51\.250\.3))|0\.(?:1(?:08\.109\.179|52\.113\.24)|95\.162\.206|88\.236\.33)|2\.(?:1(?:52\.194\.129|83\.233\.4)|28\.24\.99|75\.36\.93)|7\.(?:57\.122\.80|67\.35\.142)|8\.(?:87\.241\.226|100\.48\.7)|3\.217\.176\.65|4\.8\.46\.130)|2(?:2\.(?:12(?:4\.178\.158|2\.157\.90)|252\.223\.2)|0\.(?:231\.(?:127\.9|69\.13)|130\.204\.91))|4\.(?:105\.128\.138|82\.128\.237)|\.51\.57\.119)|8(?:0\.(?:9(?:7\.199\.131|5\.70\.173)|122\.199\.138|237\.98\.122|65\.16\.71)|2\.(?:1(?:93\.140\.168|14\.79\.163)|234\.55\.31)|4\.(?:2(?:04\.162\.138|2\.52\.13)|15\.191\.254)|9\.1(?:01\.237\.124|61\.141\.147|85\.210\.171)|3\.1(?:42\.111\.2[23]8|6\.167\.14)|5\.(?:232\.28\.204|90\.193\.240)|6\.1(?:00\.245\.242|24\.162\
.65)|8\.(?:255\.153\.106|177\.32\.62)|1\.(?:156\.56\.237|91\.22\.21)|\.12\.242\.4)|9(?:1\.(?:2(?:0(?:0\.(?:156\.95|44\.146)|3\.13\.195)|14\.(?:128\.24|83\.2))|1(?:9(?:5\.(?:136\.14|230\.13)|3\.199\.4)|49\.173\.100))|3\.(?:1(?:2(?:5\.40\.15|6\.15\.49|3\.0\.6)|59\.243\.49|88\.9\.34)|91\.196\.(?:132|99))|4\.(?:245\.156\.3|79\.4\.)3|8\.102\.189\.182|2\.241\.182\.36)|7(?:7\.(?:2(?:32\.6(?:9\.160|8\.24)|40\.118\.142)|92\.159\.102)|(?:6\.161\.241\.11|9\.135\.199\.10|2\.54\.21\.4)5|4\.(?:(?:82\.212\.14|212\.153\.)2|53\.229\.178)|8\.(?:4(?:0\.254\.1|1\.94\.42)|242\.171\.123)|(?:0\.108\.253\.22|5\.118\.35\.6)3|1\.(?:230\.221\.7|123\.47\.)9)|6(?:2\.(?:2(?:05\.169\.50|40\.36\.187)|1(?:73\.41\.19|93\.216\.5)8)|1\.1(?:39\.151\.(?:18|22)|12\.19\.81|26\.28\.97)|4\.1(?:87\.113\.235|20\.98\.150)|6\.(?:197\.203\.117|232\.25\.81)|8\.(?:71\.135\.90|67\.95\.76)|5\.110\.50\.1(?:58|61)|9\.64\.155\.181)|41\.(?:137\.(?:(?:2[04]|56)\.4|63\.20[123])|206\.13\.3)|5(?:8\.248\.28\.196|9\.23\.166\.178))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:16(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|91\.54\.12[01]|78\.60\.54)|4\.1(?:58\.206\.(?:78|90)|26\.180\.118|65\.147\.23|70\.16\.85)|3\.(?:1(?:07\.184\.193|40\.209\.26)|227\.11\.116)|6\.2(?:8\.(?:243\.140|52\.1)|01\.207\.191)|0\.(?:94\.122\.196|30\.236\.34)|9\.236\.117\.210)|1(?:1\.(?:224\.250\.13[45]|68\.108\.200)|(?:8\.233\.254\.11|6\.197\.130\.)2|5\.(?:117\.35\.158|78\.3\.221)|3\.162\.2(?:18\.196|37\.172)|7\.211\.83\.131|9\.15\.94\.94)|2(?:(?:2\.252\.234\.7|4\.158\.110\.6)4|5\.(?:165\.54\.134|20\.82\.195)|3\.(?:139\.186\.17|27\.79\.11)|1\.(?:191\.7\.16|52\.152\.)2)|8(?:8\.(?:187\.148\.42|230\.95\.227|95\.50\.154)|0\.188\.253\.10|4\.76\.219\.223|7\.75\.174\.41|9\.35\.45\.218)|7(?:3\.(?:2(?:08\.110\.(?:[568]|10)|36\.84\.13[29])|166\.141\.252)|8\.(?:49\.255\.104|32\.64\.195))|63\.2(?:0\.(?:94\.130|8\.5)|1\.100\.4)|5(?:1\.95\.106\.144|9\.148\.96\.251)|40\.135\.131\.202|09\.166\.128\.6)|2(?:1(?:2\.(?:1(?:18\.142\.77|
74\.232\.22|56\.51\.66)|2\.195\.221)|1\.(?:1(?:3\.204\.1|47\.3\.74)|24\.222\.117|58\.59\.73)|0\.(?:2(?:45\.234\.130|12\.163\.42)|91\.239\.10)|6\.1(?:57\.1(?:38\.19|48\.)2|20\.134\.108)|9\.(?:94\.175\.135|147\.172\.2)|3\.18(?:4\.224\.37|6\.38\.38)|7\.(?:114\.9\.171|76\.2\.129)|8\.248\.44\.196)|0(?:2\.(?:1(?:52\.194\.129|83\.233\.4)|75\.3(?:6\.9[23]|8\.204)|28\.24\.99)|0\.(?:1(?:08\.109\.179|52\.113\.24)|95\.162\.206)|1\.(?:1(?:16\.140\.246|44\.130\.21)|251\.250\.3)|3\.217\.176\.65|8\.87\.241\.226|7\.67\.35\.142|4\.8\.46\.130)|2(?:0\.(?:231\.(?:127\.9|69\.13)|130\.204\.91)|2\.(?:124\.178\.158|252\.223\.2))|4\.(?:1(?:05\.128\.13|61\.207\.)8|82\.128\.237))|8(?:0\.(?:9(?:7\.199\.131|5\.70\.173)|122\.199\.138|237\.98\.122|65\.16\.71)|9\.(?:1(?:01\.237\.124|61\.141\.147)|232\.133\.150)|4\.(?:2(?:04\.162\.138|2\.52\.13)|15\.191\.254)|1\.(?:9(?:1\.22\.21|3\.6\.33)|156\.56\.237)|3\.1(?:42\.111\.2[23]8|6\.167\.14)|2\.1(?:93\.140\.168|14\.79\.163)|5\.(?:232\.28\.204|90\.193\.240)|8\.(?:
255\.153\.106|177\.32\.62)|\.12\.242\.4)|9(?:1\.(?:2(?:0(?:0\.(?:156\.95|44\.146)|3\.13\.195)|14\.(?:128\.24|83\.2))|1(?:9(?:5\.(?:136\.14|230\.13)|3\.199\.4)|49\.173\.100))|3\.(?:1(?:2(?:5\.40\.15|6\.15\.49|3\.0\.6)|59\.243\.49|88\.9\.34)|91\.196\.(?:132|99))|4\.(?:2(?:45\.156\.33|00\.27\.14)|79\.4\.3)|8\.(?:102\.189\.182|230\.238\.84)|0\.179\.2(?:13\.226|8\.243)|2\.241\.182\.36|9\.11\.169\.198)|7(?:7\.(?:23(?:2\.6(?:9\.160|8\.24)|9\.254\.2)|92\.159\.102)|6\.1(?:61\.241\.115|14\.13\.254)|4\.(?:53\.229\.178|212\.153\.2)|8\.(?:242\.171\.123|40\.254\.1)|2\.(?:236\.172\.50|54\.21\.45)|1\.(?:230\.221\.7|123\.47\.)9|0\.108\.253\.223|9\.135\.199\.105)|6(?:6\.(?:19(?:7\.203\.11|0\.66\.6)7|39\.160\.158|232\.25\.81)|2\.(?:2(?:14\.127\.148|05\.169\.50)|193\.216\.58)|1\.1(?:39\.151\.(?:18|22)|12\.19\.81|26\.28\.97)|5\.110\.50\.1(?:58|61)|4\.187\.113\.235|8\.67\.95\.7[67]|9\.64\.155\.181|7\.135\.5\.227)|41\.(?:137\.(?:(?:2[04]|56)\.4|63\.20[123])|206\.13\.3)|5(?:8\.248\.28\.196|9\.23\.1
66\.178))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.1(?:6(?:2\.(?:2(?:2[4578]|3[48]|4[46])|6[57]|7[47]|9[67]|56|87)|9\.181)|85\.2)|7\.2(?:41\.(?:144|248|81)|00\.2(?:1[01]|09))|9\.159\.(?:2(?:0[01]|23)|199)|6\.71\.(?:2(?:16|7)|150?)|0\.49\.(?:193|205)|8\.68\.252)|8(?:6\.2\.136|8\.135\.2)|25\.23(?:4\.144|5\.192)|\.53\.149)|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:3[57]?|4[156]|2[18])|9\.2(?:04\.1(?:37|53)|32\.105)|1\.192\.(?:2(?:1[15]|38)|199)|2\.1(?:28\.5[45]|78\.69)|0\.83\.239)|2(?:1(?:7\.(?:118\.(?:8[23]|90)|8\.2(?:3[68]|25)|66\.146)|3\.87\.(?:8[01789]|9[012]|7[46]|197)|8\.248\.64)|0(?:3\.(?:152\.2|82\.95)|2\.152\.243|8\.54\.14))|5(?:9\.9(?:9\.(?:1(?:5[234]|2[89]|30)|5[78])|8\.152)|8\.186\.14)|9(?:5\.129\.166|1\.203\.67|2\.39\.74)|6(?:6\.87\.[012458]|1\.19\.6[567])|41\.(?:254\.[012]|95\.[48])|77\.232\.142)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.1(?:6(?:2\.(?:2(?:2[4578]|3[48]|4[46])|6[57]|7[47]|9[67]|124|56|87)|9\.181)|0\.168|85\.2)|9\.15(?:9\.(?:2(?:0[012]|17|23)|19[39])|5\.39)|7\.2(?:00\.(?:2(?:09|10)|194)|41\.(?:248|81))|6\.71\.(?:1(?:50?|49)|2(?:16|7))|0\.49\.(?:193|205))|8(?:6\.2\.136|8\.135\.2)|25\.23(?:4\.144|5\.192)|\.53\.149)|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:3[57]?|4[156]|2[18])|1\.192\.(?:2(?:1[15]|38)|199)|2\.1(?:28\.5[45]|78\.69)|9\.204\.1(?:37|53)|0\.83\.239)|2(?:1(?:7\.(?:118\.(?:8[23]|90)|8\.2(?:3[68]|25)|66\.146)|3\.87\.(?:8[01789]|9[012]|7[46]|197)|8\.248\.64)|0(?:3\.(?:152\.2|82\.95)|2\.152\.243|8\.54\.14))|5(?:9\.9(?:9\.(?:1(?:5[2345]|2[89]|30)|5[78])|7\.209|8\.152)|8\.186\.14)|6(?:6\.87\.[0124568]|1\.19\.6[567])|41\.(?:254\.[012]|95\.[48])|9(?:5\.129\.166|1\.203\.67)|77\.232\.142)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8