You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/01/11 07:57:37 UTC
svn commit: r1057500 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Tue Jan 11 06:57:36 2011
New Revision: 1057500
URL: http://svn.apache.org/viewvc?rev=1057500&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1057500&r1=1057499&r2=1057500&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Tue Jan 11 06:57:36 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201101101
+## khop-sc-neighbors.cf v 201101111
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:4\.154\.138|0\.131\.53)|9(?:3\.239\.44|8\.106\.26)|78\.49\.255)|2(?:1(?:(?:3\.233|8\.248)\.64|7\.118\.9[03])|20\.85\.242|09\.190\.4)|8(?:5\.26\.2(?:25|34)|9\.232\.105|3\.149\.21)|9(?:5\.154\.240|1\.203\.67)|77\.232\.143|58\.64\.187)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:(?:3\.233|8\.248)\.64|7\.118\.90|6\.81\.73)|20\.85\.242)|8(?:1\.192\.2(?:11|38)|5\.26\.2(?:25|34)|9\.232\.105|3\.149\.3)|1(?:78\.49\.255|93\.239\.44)|9(?:5\.154\.240|1\.203\.67)|77\.232\.14[23]|58\.64\.187)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.(?:2(?:11|38)|199)|0\.83\.23[89]|9\.232\.105|2\.178\.69)|2(?:1(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|6\.(?:157\.150|81\.73)|3\.(?:94\.190|87\.74))|03\.152\.2)|1(?:1(?:3\.(?:10\.164|30\.110)|2\.196\.253)|78\.49\.255|95\.91\.70)|7(?:4\.117\.211|7\.232\.142|9\.106\.109)|41\.(?:254\.1|95\.4)|98\.139\.91|61\.19\.66)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.2(?:11|38)|0\.83\.23[89]|9\.232\.105|2\.178\.69)|2(?:1(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|6\.(?:157\.150|86\.145)|3\.87\.74)|0(?:9\.(?:51\.150|190\.4)|3\.(?:152\.2|82\.95)))|1(?:1(?:3\.(?:10\.16[45]|30\.110)|2\.196\.253)|8(?:(?:0\.131|8\.95)\.53|4\.154\.138)|78\.49\.255|95\.91\.70)|7(?:4\.117\.211|7\.232\.142|9\.106\.109)|6(?:5\.110\.50|1\.19\.66)|41\.(?:254\.1|95\.4)|98\.139\.91)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|9\.2)|0\.253\.4)|8(?:2\.194\.220|9\.46\.246))|(?:34\.235\.21|82\.172\.2)8|24\.220\.2)|0\.(?:1(?:60\.251\.210|44\.113\.27)|30\.236\.34|2\.229\.20)|6\.(?:2(?:01\.207\.191|5\.8\.174)|12\.226\.34|0\.12\.35)|4\.(?:213\.120\.1|50\.9\.114)|8\.106\.26\.(?:45|74)|3\.239\.44\.193)|2(?:3\.1(?:38\.216\.149|92\.73\.28)|4\.1(?:58\.110\.64|06\.53\.86)|2\.154\.(?:129\.82|24\.254)|8\.121\.191\.244|\.230\.125\.150|1\.191\.7\.162|5\.20\.82\.197)|1(?:1\.(?:224\.250\.13[245]|68\.108\.200)|2\.133\.198\.146|6\.236\.230\.110|8\.233\.254\.112|3\.162\.248\.93)|8(?:8\.(?:132\.221\.57|2\.149\.191|95\.53\.112)|4\.154\.138\.1(?:0[19]|16|22)|(?:0\.179\.87|9\.10\.85)\.30)|7(?:8\.(?:49\.255\.(?:10[34]|32|95)|23\.151\.242|32\.64\.195)|3\.208\.120\.10[57]|4\.127\.66\.243)|09\.(?:8(?:6\.159\.53|7\.70\.225)|227\.250\.128))|2(?:1(?:6\.(?:157\.1(?:5(?:0\.(?:192|64)|4\.2)|4(?:6\.192|8\.64)|38\.192)|8(?:1\.7(?:(?:1\.19|2\.)2|[03]\.
(?:64|2))|6\.145\.178))|3\.(?:1(?:8(?:4\.254\.13|6\.38\.38)|09\.88\.100|67\.23\.58|94\.245\.2)|94\.190\.1[124])|2\.(?:1(?:07\.98\.194|18\.142\.77|99\.29\.145)|71\.150\.146|87\.183\.10)|(?:8\.248\.44\.19|9\.95\.192\.16)6|1\.(?:202\.2\.178|147\.3\.74)|0\.91\.239\.10|7\.76\.2\.129)|0(?:2\.(?:1(?:08\.3\.184|22\.20\.50)|28\.(?:66\.251|24\.99)|75\.3(?:8\.209|6\.93)|41\.167\.241)|9\.(?:190\.(?:4\.13[58]|1\.173)|51\.150\.1(?:8[67]|90)|210\.195\.190)|3\.(?:1(?:72\.246\.60|93\.137\.3)|217\.176\.65|91\.117\.3)|4\.(?:188\.168\.11|8\.46\.130)|8\.(?:131\.186\.2|3\.138\.103)|7\.210\.85\.122|0\.88\.236\.33)|22\.252\.223\.2|4\.177\.65\.188)|9(?:1\.(?:1(?:9(?:5\.(?:230\.1[01]|136\.14)|8\.(?:175\.253|86\.7))|21\.175\.20)|2(?:03\.67\.212|16\.72\.246))|3\.1(?:5(?:5\.(?:194\.176|254\.37)|9\.243\.49)|90\.104\.7)|(?:2\.24(?:1\.150\.25|7\.250\.23)|6\.45\.176\.19)4|4\.2(?:(?:00\.27\.1|3\.60\.12)4|45\.156\.50)|5\.(?:154\.(?:240\.98|96\.147)|63\.38\.7)|0\.1(?:80\.141\.157|76\.72\.198))|8(?:9\.(?:2(?:15
\.(?:189\.170|89\.143)|37\.(?:60\.130|26\.2))|103\.16\.232)|2\.1(?:(?:51\.115\.22|14\.76\.21)0|93\.140\.16[48])|7\.2(?:32\.123\.158|52\.228\.249|46\.5\.107)|0\.(?:9(?:5\.70\.173|7\.51\.66)|65\.16\.71)|8\.(?:255\.153\.106|101\.165\.75)|6\.9(?:3\.38\.236|8\.23\.121)|3\.142\.111\.228|4\.15\.191\.254|1\.191\.0\.3)|7(?:8\.(?:1(?:2(?:9\.222\.20|8\.14\.14)2|54\.7\.54)|90\.234\.17)|7\.(?:121\.85\.68|243\.91\.12|69\.137\.77|77\.36\.113)|4\.(?:117\.211\.2(?:4[26]|33)|50\.95\.10)|(?:6\.161\.241\.11|2\.54\.21\.4)5|0\.108\.253\.223)|6(?:2\.(?:2(?:21\.154\.62|4\.79\.40)|183\.110\.247)|1\.1(?:39\.151\.18|12\.19\.81|26\.28\.97)|4\.1(?:48\.129\.14|20\.55\.11)0|5\.110\.50\.1(?:7[29]|61)|9\.64\.155\.181|6\.96\.80\.182)|4(?:1\.137\.(?:(?:24|30|56)\.4|63\.20[123])|6\.(?:17\.121\.1|47\.74\.27))|58\.150\.55\.59)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|9\.2)|0\.253\.4)|8(?:2\.194\.220|9\.46\.246))|(?:34\.235\.21|82\.172\.2)8|24\.220\.2)|0\.1(?:60\.251\.210|44\.113\.27)|3\.(?:239\.44\.193|33\.236\.218)|6\.(?:201\.207\.191|0\.12\.35)|4\.213\.120\.1|8\.106\.26\.74)|2(?:3\.(?:1(?:38\.216\.149|92\.73\.28)|27\.79\.11)|4\.1(?:58\.110\.64|06\.53\.86)|2\.154\.(?:129\.82|24\.254)|8\.121\.191\.244|\.230\.125\.150|1\.191\.7\.162|5\.20\.82\.197)|8(?:8\.(?:95\.53\.1(?:0[235]|12)|132\.221\.57|2\.149\.191)|4\.1(?:54\.138\.1(?:0[189]|2[025]|16)|05\.195\.8[18])|(?:0\.179\.87|9\.10\.85)\.30)|7(?:8\.(?:49\.255\.(?:10[34]|95)|23\.151\.242|32\.64\.195)|3\.208\.120\.10[57]|4\.127\.66\.243)|1(?:1\.(?:224\.250\.13[245]|68\.108\.200)|2\.133\.198\.146|6\.236\.230\.110|8\.233\.254\.112)|09\.(?:8(?:6\.159\.53|7\.70\.225)|227\.250\.128))|2(?:1(?:6\.(?:8(?:1\.7(?:(?:1\.19|2\.)2|[03]\.(?:64|2))|6\.145\.1[78][78])|157\.1(?:5(?:0\.(?:192|64)|4\.2)|4(?:6\.192|8\.64)|38\.192
))|3\.(?:1(?:8(?:4\.254\.13|6\.38\.38)|09\.88\.100|67\.23\.58)|94\.190\.1[124])|2\.(?:1(?:18\.142\.77|99\.29\.145)|71\.150\.146|66\.127\.17)|(?:8\.248\.44\.19|9\.95\.192\.16)6|1\.(?:202\.2\.178|147\.3\.74)|0\.91\.239\.10|7\.76\.2\.129)|0(?:2\.(?:1(?:08\.3\.184|22\.20\.50)|28\.(?:66\.251|24\.99)|75\.3(?:8\.209|6\.93)|41\.167\.241)|3\.(?:1(?:(?:53\.44\.13|72\.246\.6)0|93\.137\.3)|217\.176\.65)|9\.(?:190\.(?:4\.13[04589]|1\.173)|51\.150\.1(?:8[679]|90))|4\.(?:188\.168\.11|8\.46\.130)|8\.(?:131\.186\.2|3\.138\.103)|7\.210\.85\.122|0\.88\.236\.33)|22\.252\.223\.2|4\.177\.65\.188)|8(?:6\.(?:9(?:3\.38\.236|8\.23\.121)|57\.159\.150|64\.189\.65)|2\.1(?:(?:51\.115\.22|14\.76\.21)0|93\.140\.16[48])|0\.(?:9(?:5\.70\.173|7\.51\.66)|65\.16\.71)|9\.2(?:37\.(?:60\.130|26\.2)|15\.189\.170)|8\.(?:255\.153\.106|101\.165\.75)|3\.14(?:2\.111\.228|3\.237\.240)|7\.252\.228\.249|4\.15\.191\.254|1\.191\.0\.3)|9(?:1\.(?:1(?:9(?:8\.(?:175\.253|86\.7)|5\.230\.11)|21\.175\.20)|2(?:08\.97\.22|16\.72\.24)
6)|(?:4\.2(?:00\.27\.1|3\.60\.12)|2\.247\.250\.23)4|3\.1(?:5(?:5\.194\.176|9\.243\.49)|90\.104\.7)|5\.(?:154\.(?:240\.98|96\.147)|63\.38\.7)|0\.176\.72\.198)|7(?:8\.(?:1(?:2(?:9\.222\.20|8\.14\.14)2|11\.176\.131)|90\.234\.17)|4\.(?:117\.211\.2(?:4[269]|3[38]|52)|50\.95\.10)|(?:6\.161\.241\.11|2\.54\.21\.4)5|7\.(?:121\.85\.68|69\.137\.77)|0\.108\.253\.223)|6(?:2\.(?:2(?:21\.154\.62|4\.79\.40)|183\.110\.247)|5\.110\.50\.1(?:7[249]|6[18]|83)|4\.1(?:48\.129\.14|20\.55\.11)0|9\.64\.155\.181|1\.126\.28\.97|6\.96\.80\.182)|4(?:1\.(?:1(?:37\.(?:(?:24|30|56)\.4|63\.203)|89\.229\.164)|205\.223\.146)|6\.(?:17\.121\.1|47\.74\.27))|58\.150\.55\.59)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[2678]?|2[18]|4[16])|1\.192\.(?:2(?:11|38)|199)|0\.83\.23[89]|7\.252\.243|2\.178\.69)|1(?:1(?:3\.(?:10\.16[2378]|30\.110)|4\.216\.102)|2(?:5\.23(?:4\.144|5\.192)|2\.55\.106)|9(?:3\.25\.121|5\.91\.70)|80\.131\.24)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|41\.(?:95\.[48]|254\.1)|61\.19\.6[56])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[2678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|9\.204\.1(?:37|53)|0\.83\.23[89]|7\.252\.243|2\.178\.69)|1(?:1(?:3\.(?:10\.16[2378]|30\.110)|6\.71\.218)|2(?:5\.23(?:4\.144|5\.192)|2\.55\.106)|9(?:3\.25\.121|5\.91\.70)|80\.131\.24)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|41\.(?:95\.(?:[48]|10)|254\.1)|61\.19\.6[56])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8