You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2010/12/01 08:56:11 UTC
svn commit: r1040881 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Dec 1 07:56:11 2010
New Revision: 1040881
URL: http://svn.apache.org/viewvc?rev=1040881&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1040881&r1=1040880&r2=1040881&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Dec 1 07:56:11 2010
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201011302
+## khop-sc-neighbors.cf v 20101212
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:13|22|89)|59)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:22|89)|59|94)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:1(?:3\.(?:169|22)|0\.139|8\.96)|2(?:3\.2[67]|2\.168|5\.160))(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:1(?:3\.(?:169|22)|0\.139|8\.96)|2(?:3\.2[67]|2\.168|5\.160)|82\.177)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:6\.(?:157\.1(?:48|50)|81\.7[13])|3\.(?:(?:233\.6|88\.)4|186\.38)|7\.118\.82)|0(?:(?:5\.251\.15|7\.57\.12)2|3\.217\.145))|1(?:13\.16(?:2\.(?:23[17]|100|74)|7\.111)|25\.16(?:3\.5[34]|2\.242)|09\.172\.53)|8(?:(?:9\.232\.10|5\.26\.22)5|1\.192\.211|3\.149\.3)|9(?:5\.1(?:29\.166|58\.184)|1\.198\.86))\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:6\.(?:81\.7[23]|157\.148)|3\.(?:233\.6|88\.)4|7\.118\.8[23])|0(?:3\.217\.145|5\.251\.140|7\.57\.122))|1(?:13\.16(?:2\.(?:100|237|74)|7\.111)|25\.16(?:3\.5[34]|2\.242)|09\.172\.(?:31|53))|8(?:(?:9\.232\.10|5\.26\.22)5|1\.192\.2(?:11|38)|3\.149\.3)|9(?:5\.1(?:29\.166|58\.184)|1\.198\.86)|41\.137\.24)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:7\.(?:8\.2(?:25|36)|118\.90|66\.146)|6\.(?:81\.7[02]|157\.146|38\.2)|2\.199\.197|8\.248\.64|1\.147\.3|3\.87\.76)|0(?:3\.(?:152\.2|82\.95)|9\.51\.134))|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|1\.192\.(?:2(?:11|38)|199)|(?:0\.83\.23|2\.178\.6)9|3\.149\.(?:[24]1|35?))|1(?:13\.162\.(?:2(?:4[46]|28)|[59]6|[67]7|125)|86\.2\.1(?:36|44)|25\.162\.243|94\.170\.16|78\.32\.64)|7(?:7\.232\.14[23]|9\.106\.109)|6(?:4\.187\.113|1\.19\.66)|9(?:1\.203\.67|8\.139\.91)|41\.254\.[01])\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:7\.(?:8\.2(?:25|36)|118\.90|66\.146)|6\.(?:157\.1(?:46|50)|81\.70|38\.2)|2\.199\.197|8\.248\.64|1\.147\.3|3\.87\.76)|0(?:3\.(?:152\.2|82\.95)|9\.51\.134))|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|1\.192\.(?:2(?:11|38)|199)|(?:0\.83\.23|2\.178\.6)9|3\.149\.(?:[24]1|35?))|1(?:13\.162\.(?:2(?:4[46]|[23]8)|[59]6|[67]7|125)|86\.2\.1(?:36|44)|25\.162\.243|94\.170\.16|78\.32\.64)|7(?:7\.232\.14[23]|9\.106\.109)|6(?:1\.19\.6[67]|4\.187\.113)|41\.254\.[01]|91\.203\.67)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:2(?:1(?:6\.(?:157\.1(?:5(?:0\.(?:1(?:28|92)|64|2)|4\.(?:1(?:28|92)|2))|4[68]\.(?:1(?:28|92)|64|2))|81\.7(?:[02]\.(?:1(?:28|92)|64|2)|3\.(?:128|64|2)|1\.(?:192|64))|38\.2\.1(?:7[019]|67)|69\.15\.60)|2\.1(?:99\.197\.121|18\.142\.77|82\.1\.249)|1\.(?:1(?:3\.204\.1|47\.3\.74)|58\.59\.73)|0\.(?:212\.163\.42|91\.239\.10)|7\.(?:128\.191\.20|76\.2\.12)9|9\.147\.(?:208\.34|172\.2)|8\.248\.44\.196|3\.186\.38\.38)|0(?:1\.(?:1(?:16\.140\.246|44\.130\.21|5\.147\.54)|251\.250\.3)|5\.(?:251\.1(?:40\.1(?:88|90)|52\.142)|178\.152\.10)|2\.(?:183\.233\.4|28\.24\.99|75\.36\.93)|3\.1(?:50\.231\.|90\.36\.2)45|9\.51\.134\.21[456]|0\.108\.109\.179|7\.57\.122\.80|8\.131\.186\.2)|4\.(?:1(?:05\.128\.138|3\.245\.107|2\.61\.99)|64\.74\.58)|2(?:2\.(?:83\.211\.201|252\.223\.2)|0\.231\.69\.13))|1(?:9(?:5\.(?:16(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|91\.54\.12[01])|0\.(?:2(?:41\.128\.175|34\.12\.87)|124\.0\.130|30\.236\.34)|3\.(?:1(?:07\.184\.193|40\.209\.26)
|227\.11\.116|6\.12\.65)|4\.1(?:65\.147\.23|70\.16\.85)|6\.201\.207\.191|9\.236\.117\.210)|1(?:1\.(?:224\.250\.135|68\.108\.200)|7\.2(?:11\.83\.131|40\.236\.34)|3\.16(?:0\.113\.54|1\.16\.80)|8\.233\.254\.112)|2(?:4\.1(?:58\.110\.64|24\.43\.32)|1\.52\.15(?:8\.245|2\.2)|2\.252\.234\.74|5\.20\.82\.195|3\.27\.79\.11)|8(?:(?:0\.188\.253\.1|7\.9\.156\.5)0|8\.230\.26\.12)|7(?:8\.(?:166\.131\.119|32\.64\.195)|4\.49\.73\.23)|63\.2(?:0\.(?:94\.130|8\.5)|1\.100\.4)|40\.135\.131\.202|50\.101\.137\.35)|8(?:2\.(?:1(?:93\.140\.168|14\.79\.163|50\.185\.32|40\.91\.41)|213\.(?:2\.170|32\.2)|79\.26\.204)|9\.161\.(?:2(?:06\.147|40\.212)|1(?:41\.147|58\.80))|4\.(?:1(?:21\.66\.147|5\.191\.254)|72\.249\.190)|0\.(?:9(?:5\.70\.173|3\.124\.1)|65\.16\.71)|3\.1(?:42\.111\.228|3\.197\.130|6\.167\.14)|6\.(?:28\.125\.23|98\.74\.26))|6(?:1\.1(?:39\.151\.(?:18|22)|42\.213\.158|12\.19\.81|26\.28\.97)|4\.1(?:87\.113\.2(?:2[6789]|3[13])|79\.106\.186)|(?:6\.117\.247\.17|5\.24\.211\.12)8|9\.(?:249\.192\.192|64\.
155\.181)|2\.1(?:19\.28\.251|93\.216\.58)|0\.191\.93\.219|8\.71\.135\.90)|7(?:6\.(?:1(?:61\.241\.115|75\.225\.157)|4\.95\.222)|7\.(?:232\.6(?:9\.160|8\.23)|92\.159\.102)|(?:5\.150\.73\.17|4\.50\.95\.1)7|2\.(?:242\.74\.138|54\.21\.45)|0\.108\.253\.223|8\.100\.36\.138)|9(?:3\.(?:9(?:5\.168\.122|1\.196\.99)|1(?:59\.243\.49|88\.9\.34))|1\.(?:1(?:87\.103\.60|93\.199\.4)|214\.83\.2)|8\.2(?:28\.145\.162|15\.107\.19)|2\.241\.182\.36|4\.19\.254\.143)|5(?:8\.250\.11(?:9\.(?:185|211|64)|6\.1(?:09|23)|8\.(?:224|62)|7\.1(?:57|3))|9\.(?:144\.125\.157|25\.182\.92))|41\.(?:137\.(?:(?:2[04]|30|56)\.4|63\.20[123])|206\.13\.3))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:2(?:1(?:6\.(?:157\.1(?:5(?:0\.(?:1(?:28|92)|64|2)|4\.(?:1(?:28|92)|2))|4[68]\.(?:1(?:28|92)|64|2))|81\.7(?:0\.(?:1(?:28|92)|64|2)|[23]\.(?:128|64|2)|1\.(?:192|64))|38\.2\.1(?:7[019]|6[79]))|2\.1(?:99\.197\.121|18\.142\.77|82\.1\.249)|0\.(?:212\.163\.42|91\.239\.10)|7\.(?:128\.191\.20|76\.2\.12)9|1\.(?:147\.3\.74|58\.59\.73)|9\.147\.(?:208\.34|172\.2)|8\.248\.44\.196|3\.186\.38\.38)|0(?:1\.(?:1(?:16\.140\.246|44\.130\.21)|251\.250\.3)|5\.(?:251\.1(?:40\.188|52\.142)|178\.152\.10)|2\.(?:183\.233\.4|28\.24\.99|75\.36\.93)|3\.1(?:50\.231\.|90\.36\.2)45|8\.1(?:31\.186\.2|00\.48\.9)|9\.51\.134\.21[45]|0\.108\.109\.179|6\.53\.73\.196|7\.57\.122\.80)|2(?:2\.(?:83\.211\.201|252\.223\.2)|0\.231\.69\.13)|4\.(?:1(?:05\.128\.138|3\.245\.107)|64\.74\.58)|7\.38\.1(?:(?:18\.13|4\.21)4|2\.149))|1(?:9(?:5\.(?:16(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|91\.54\.12[01])|3\.(?:1(?:07\.184\.193|40\.209\.26)|227\.11\.116|6\.12\.65)|0\.(?:124\.0\.130|23
4\.12\.87|30\.236\.34)|4\.1(?:65\.147\.23|70\.16\.85)|6\.201\.207\.191|9\.236\.117\.210)|1(?:1\.(?:224\.250\.135|68\.108\.200)|7\.2(?:11\.83\.131|40\.236\.34)|3\.16(?:0\.113\.54|1\.16\.80)|8\.233\.254\.112)|2(?:4\.1(?:58\.110\.64|24\.43\.32)|1\.52\.15(?:8\.245|2\.2)|2\.252\.234\.74|5\.20\.82\.195|3\.27\.79\.11)|8(?:(?:0\.188\.253\.1|7\.9\.156\.5)0|8\.(?:230\.26\.12|95\.50\.148))|7(?:8\.(?:166\.131\.119|32\.64\.195)|3\.236\.84\.141|4\.49\.73\.23)|63\.2(?:0\.(?:94\.130|8\.5)|1\.100\.4)|50\.1(?:76\.101\.241|01\.137\.35)|40\.135\.131\.202)|8(?:2\.(?:1(?:93\.140\.168|14\.79\.163|50\.185\.32|40\.91\.41)|213\.(?:2\.170|32\.2)|79\.26\.204)|4\.(?:1(?:21\.66\.147|5\.191\.254)|72\.249\.190)|0\.(?:9(?:5\.70\.173|3\.124\.1)|65\.16\.71)|3\.1(?:42\.111\.228|3\.197\.130|6\.167\.14)|9\.161\.(?:2(?:06\.147|40\.212)|158\.80)|5\.43\.241\.1|6\.98\.74\.26)|6(?:1\.1(?:39\.151\.(?:18|22)|12\.19\.81|26\.28\.97)|(?:6\.117\.247\.17|5\.24\.211\.12)8|4\.187\.113\.2(?:2[6789]|3[123])|2\.1(?:19\.28\.251|9
3\.216\.58)|8\.(?:189\.163\.18|71\.135\.90)|0\.191\.93\.219|9\.64\.155\.181)|7(?:6\.(?:1(?:61\.241\.115|75\.225\.157)|4\.95\.222)|7\.(?:232\.6(?:9\.160|8\.23)|92\.159\.102)|(?:5\.150\.73\.17|4\.50\.95\.1)7|2\.(?:242\.74\.138|54\.21\.45)|8\.(?:100\.36\.138|40\.254\.1)|0\.108\.253\.223)|9(?:3\.(?:9(?:1\.196\.(?:132|99)|5\.168\.122)|1(?:59\.243\.49|88\.9\.34))|1\.(?:1(?:(?:49\.173\.10|87\.103\.6)0|93\.199\.4)|214\.83\.2)|4\.1(?:9\.254\.143|42\.234\.1))|5(?:8\.250\.11(?:9\.(?:2(?:11|5)|185|64)|6\.1(?:09|23)|8\.(?:224|62)|7\.1(?:57|3))|9\.(?:144\.125\.157|25\.182\.92))|41\.(?:137\.(?:(?:2[04]|56)\.4|63\.20[123])|206\.13\.3))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.(?:1(?:6(?:2\.(?:2(?:2[4578]|4[3456]|3[48]|18)|1(?:2[0458]|00|17|41)|6[157]|7[479]|9[67]|56|87)|8\.1(?:[15]|42?|37)|9\.18[013]|7\.111)|85\.2)|22\.8)|7\.(?:2(?:0(?:0\.(?:1(?:6[02]|7[79]|93)|2(?:1[014]|0[89]))|3\.144)|4(?:1\.(?:24[89]|8[012]|144)|2\.28))|19(?:8\.(?:8[49]|90)|9\.50))|9\.15(?:9\.(?:2(?:1[012456]|0[2489]|2[023])|19[23567])|3\.(?:[0346]|8[14579]?|9[02358]?|1[359]?)|5\.(?:9[6789]|10[01]))|6\.71\.(?:2(?:1[24568]|2[23]|09?|7)|1(?:4[4579]|51|0)?|30|8)|0\.49\.(?:193|205)|8\.71\.9)|2(?:5\.(?:162\.243|234\.144)|3\.(?:18\.167|27\.160))|8(?:6\.2\.1(?:36|44)|0\.194\.0|8\.135\.2)|\.53\.14[89])|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:4[1345]|3[56]?|2[18])|2\.1(?:28\.(?:5[45]|87)|78\.69)|9\.2(?:04\.1(?:37|53)|32\.105)|1\.192\.(?:2(?:1[15]|38)|199)|8\.255\.113|0\.83\.239)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.90|66\.146)|3\.87\.(?:8[0789]|7[46]|90)|8\.248\.64|2\.95\.7)|0(?:3\.(?:1(?:28
\.250|52\.2)|82\.95)|2\.152\.(?:194|243))|22\.25(?:2\.15|4\.7)8)|5(?:9\.9(?:9\.(?:1(?:5[2345]|2[89]|3[01])|5[6789]|40)|8\.1(?:9[23]|28|44|52)|7\.2(?:1[067]|0[89]))|8\.186\.(?:220|14))|41\.(?:2(?:54\.[012]|02\.198)|199\.113|95\.[48])|6(?:1\.19\.6[567]|6\.87\.[058])|77\.232\.14[23]|92\.39\.7[479])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.(?:1(?:6(?:2\.(?:1(?:2[0458]|1[78]|3[39]|00|41)|2(?:2[24578]|4[3456]|3[48]|18)|6[157]|7[479]|9[67]|56|87)|8\.1(?:[15]|3[078]|42?)|7\.(?:111|48)|9\.18[0123])|85\.2)|22\.8)|7\.(?:2(?:0(?:0\.(?:1(?:6[027]|7[79]|93)|2(?:1[014]|0[89]))|3\.144)|4(?:1\.(?:24[89]|8[012]|144)|2\.28))|19(?:8\.(?:8[479]|90)|9\.50))|9\.15(?:9\.(?:2(?:1[012456]|0[02489]|2[0123])|19[235678])|3\.(?:[03456]|8[14579]?|9[02358]?|1[3569]?)|5\.(?:9[6789]|10[01])|6\.20)|6\.71\.(?:2(?:[67]|1[24568]|2[23]|09?)|1(?:4[4579]|51|0)?|30|8)|0\.49\.(?:193|205)|8\.71\.9)|2(?:5\.(?:162\.243|234\.144)|3\.(?:18\.167|27\.160))|8(?:6\.2\.1(?:36|44)|0\.194\.0|8\.135\.2)|\.53\.14[89])|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:4[1345]|3[56]?|2[18])|2\.1(?:28\.(?:5[45]|87)|78\.69)|9\.2(?:04\.1(?:37|53)|32\.105)|1\.192\.(?:2(?:1[15]|38)|199)|8\.255\.113|0\.83\.239)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.90|66\.146)|3\.87\.(?:8[0789]|7[46]|90)
|8\.248\.64|2\.95\.7)|0(?:3\.(?:1(?:28\.250|52\.2)|82\.95)|2\.152\.(?:194|243))|22\.25(?:2\.15|4\.7)8)|5(?:9\.9(?:9\.(?:1(?:5[2345]|2[89]|3[01])|5[6789]|40)|8\.1(?:9[23]|28|44|52)|7\.2(?:1[067]|0[89]))|8\.186\.(?:220|14))|41\.(?:2(?:54\.[012]|02\.198)|199\.113|95\.[48])|9(?:2\.39\.(?:7[479]|65)|1\.203\.67)|6(?:1\.19\.6[567]|6\.87\.[0258])|77\.232\.14[23])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8