You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2010/04/07 04:57:07 UTC
svn commit: r931413 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Apr 7 02:57:07 2010
New Revision: 931413
URL: http://svn.apache.org/viewvc?rev=931413&view=rev
Log:
auto-generated SpamCop neighbor rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=931413&r1=931412&r2=931413&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Apr 7 02:57:07 2010
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201004522
+## khop-sc-neighbors.cf v 201004622
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:22|89)|201|94)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:122|201|59|94)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
tflags KHOP_SC_CIDR8 nopublish
@@ -36,7 +36,7 @@ score KHOP_SC_CIDR8 0.1 0.01 0.1 0.01
# changed from rank by spam count to rank by hosts reported, back to 4/8
# Due to the massive block size, this rule only examines untrusted relays
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:17|90)|59|95)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:17|89|90)|95)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -50,7 +50,7 @@ score KHOP_SC_TOP_CIDR8 0.9 0.1 0.9 0.
# 14.2553/0.0424 spam/ham, 0.997 s/o @ 20100403 net, solo=14.3609/0.4888
# http://www.spamcop.net/w3m?action=map;net=bmaxcnt;mask=16777215;sort=spamcnt
-header KHOP_SC_CIDR16 Received =~ /(?-xism:\b(?:123\.26|93\.87)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_CIDR16 Received =~ /(?-xism:\b122\.163(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_CIDR16 Relay CIDR /16 is among worst in SpamCop
tflags KHOP_SC_CIDR16 nopublish
score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
@@ -62,7 +62,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0.6814/0.0149 spam/ham, 0.979 s/o @ 20100402
# 0.4399/0.0008 spam/ham, 0.998 s/o @ 20100403 net run
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:2(?:2\.16[23]|3\.2[78])|8[36]\.87|18\.96)|59\.92|92\.47)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:2(?:3\.2[78]|2\.162)|8[36]\.87|18\.96|78\.93)|59\.92|92\.47)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -75,7 +75,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:(?:1\.191\.17|3\.233\.6)4|7\.118\.82)|21\.143\.46|03\.82\.81)|6(?:4\.187\.117|8\.232\.189|1\.7\.231)|(?:121\.54\.3|41\.214\.1)2|8(?:9\.232\.105|3\.149\.3)|78\.138\.171)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:(?:1\.191\.17|3\.233\.6)4|7\.118\.82)|03\.82\.8[01]|21\.143\.46)|6(?:4\.187\.117|8\.232\.189)|8(?:9\.232\.105|3\.149\.3)|78\.138\.17[01]|41\.214\.12)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -88,7 +88,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# host-count 84/64->84/50, offenders 8/15->10/20 @ 20100402
# 0.2547/0 spam/ham, 1.000 s/o @ 20100403 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:5\.147\.(?:2(?:3[017]|0[13]|29)|192)|1\.224\.250|7\.242\.28|3\.22\.69)|9(?:6\.12\.2(?:3[36]|4[45])|0\.104\.162)|89\.112\.218|73\.45\.96)|2(?:0(?:3\.82\.(?:8[012]|9[234])|2\.(?:152\.243|70\.54)|9\.222\.0)|1(?:3\.(?:163\.11|87\.7)6|2\.63\.221|7\.118\.90))|8(?:5\.26\.(?:1(?:6[45]|83)|23[2345])|1\.192\.211|9\.232\.105|2\.178\.69|3\.149\.3)|7(?:(?:4\.217\.22|7\.232\.14)2|8\.138\.170|9\.106\.109|2\.21\.6)|41\.(?:2(?:23\.20|54\.)|140\.25)1|6(?:2\.61\.164|1\.19\.66)|91\.203\.67)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:5\.147\.(?:2(?:3[017]|0[13])|192)|1\.224\.250|7\.242\.28|3\.22\.69)|9(?:6\.12\.2(?:3[36]|4[45])|0\.104\.162)|89\.112\.218|73\.45\.96)|2(?:0(?:3\.82\.(?:8[012]|9[234])|2\.(?:152\.243|70\.54)|9\.222\.0)|1(?:3\.(?:163\.11|87\.7)6|2\.63\.221|7\.118\.90))|8(?:5\.26\.(?:1(?:6[45]|8[36])|23[2345])|1\.192\.211|9\.232\.105|2\.178\.69|3\.149\.3)|7(?:(?:4\.217\.22|7\.232\.14)2|8\.138\.170|9\.106\.109|2\.21\.6)|6(?:1\.(?:19\.66|7\.231)|2\.61\.164)|41\.(?:2(?:23\.20|54\.)|140\.25)1|91\.203\.67)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -101,7 +101,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:0\.(?:1(?:49\.103\.238|83\.62\.154|7\.212\.73)|41\.(?:171\.154|223\.167)|34\.154\.204|26\.67\.230|96\.68\.179)|5\.(?:1(?:61\.(?:8\.1|9\.2)|89\.46\.253)|202\.81\.154|95\.223\.26|5\.41\.190|88\.93\.92)|3\.(?:10(?:7\.184\.192|8\.38\.228)|40\.244\.211)|6\.(?:25\.26\.198|46\.252\.82|1\.209\.83)|4\.(?:219\.211\.88|0\.252\.175))|2(?:2\.(?:16(?:0\.179\.190|6\.61\.134)|252\.2(?:46\.23|34\.7)4)|1\.(?:1\.(?:37\.14[67]|18\.244)|242\.103\.202)|3\.1(?:40\.250\.254|6\.147\.68)|4\.124\.(?:43\.32|5\.218)|5\.22\.85\.134|\.191\.88\.50)|1(?:9\.(?:110\.(?:107\.10|85\.126)|226\.84\.218|75\.19\.230)|(?:2\.221\.100\.17|8\.131\.153\.8)2|5\.1(?:18\.134\.54|40\.76\.100)|1\.224\.250\.1(?:3[01234]|29)|3\.(?:22\.69\.245|160\.2\.58))|7(?:3\.(?:45\.96\.(?:2(?:1[0234689]|0[569])|1(?:9[45789]|02)|9[89])|71\.51\.84)|4\.121\.63\.133)|8(?:9\.(?:1(?:12\.218\.234|60\.12\.245)|84\.174\.253)|6\.24\.(?:1[6789]|2[013])\.3)|51\.(?:44\.239\.62|76\.31\.58)|68\.18
7\.214\.66)|2(?:0(?:3\.(?:1(?:2(?:6\.152\.24|1\.88\.16)2|01\.104\.69)|249\.162\.7|59\.95\.113)|1\.(?:2(?:00\.178\.50|32\.107\.46)|(?:59\.92\.24|43\.13\.8)6|10\.176\.43)|9\.(?:2(?:22\.0\.(?:1[015]|2[16]|30?)|54\.56\.106)|94\.196\.170)|2\.(?:(?:164\.52\.10|87\.47\.13)0|4(?:2\.133\.58|3\.181\.7))|0\.(?:104\.58\.227|23\.18\.172|80\.140\.61|6\.193\.89)|6\.48\.103\.222|7\.255\.89\.50)|1(?:3\.(?:1(?:98\.(?:11(?:1\.207|3\.144|2\.90)|25\.33)|63\.116\.2(?:26|30))|226\.144\.65)|1\.(?:1(?:91\.174\.141|71\.31\.100)|24\.209\.253)|7\.(?:1(?:74\.229\.221|14\.11\.35)|76\.[24]\.129)|2\.(?:(?:175\.53\.1|63\.221\.)10|52\.148\.109)|6\.(?:155\.39\.(?:2[01]|13)|230\.133\.69)|9\.95\.(?:227\.218|148\.97))|2(?:0\.(?:2(?:27\.46\.186|31\.69\.13)|149\.255\.194)|2\.(?:124\.156\.231|252\.223\.2)|1\.143\.(?:109\.250|46\.33))|4\.97\.212\.210)|6(?:1\.(?:1(?:00\.228\.61|7\.76\.197|9\.71\.74)|7\.2(?:31\.23|41\.7)0)|(?:(?:9\.151\.79\.2|5\.167\.56\.)3|7\.115\.179\.19)8|4\.(?:(?:237\.33\.[23]|70\.190\.1)0|187\.11
7\.69)|3\.25(?:3\.107\.166|5\.22\.42)|8\.232\.189\.(?:4[12]|37)|0\.49\.236\.137|2\.48\.207\.129)|8(?:2\.(?:1(?:14\.(?:7(?:9\.163|0\.54)|65\.246)|40\.91\.41)|66\.65\.144)|0\.(?:1(?:79\.231\.205|22\.70\.11)|93\.125\.186)|9\.(?:161\.141\.147|211\.46\.210)|3\.(?:175\.88\.18|234\.89\.2)|4\.22\.(?:56\.50|63\.74)|5\.154\.5\.90|8\.85\.97\.38)|7(?:7\.(?:120\.251\.37|22\.162\.99|73\.139\.2)|6\.(?:103\.160\.74|227\.84\.105)|(?:9\.101\.99\.15|2\.21\.6\.2)4|8\.40\.254\.1)|9(?:(?:8\.126\.149\.9|7\.66\.79\.8)1|1\.1(?:98\.175\.252|50\.127\.93)|3\.91\.196\.(?:132|99)|4\.75\.240\.140)|41\.2(?:04\.190\.12|15\.18\.110)|5(?:8\.27\.196\.8|9\.6\.146\.2)4)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:0\.(?:1(?:49\.103\.238|83\.62\.154|7\.212\.73)|41\.(?:171\.154|223\.167)|34\.154\.204|26\.67\.230|96\.68\.179)|5\.(?:1(?:61\.(?:8\.1|9\.2)|89\.46\.253)|2(?:02\.81\.154|38\.191\.68)|95\.223\.26|5\.41\.190|88\.93\.92)|3\.10(?:7\.184\.192|8\.38\.228)|4\.(?:219\.211\.88|0\.252\.175)|6\.(?:46\.252\.82|1\.209\.83))|1(?:9\.(?:226\.(?:161\.154|84\.218)|110\.(?:107\.10|85\.126)|75\.19\.230)|(?:2\.221\.100\.17|8\.131\.153\.8)2|5\.1(?:18\.134\.54|40\.76\.100)|3\.16(?:9\.103\.202|0\.2\.58)|1\.224\.250\.13[012345])|2(?:2\.(?:16(?:0\.179\.190|6\.61\.134)|252\.234\.74)|1\.(?:1\.(?:37\.14[67]|18\.244)|242\.103\.202)|3\.1(?:40\.250\.254|6\.147\.68)|4\.124\.(?:43\.32|5\.218)|5\.22\.85\.134|\.191\.88\.50)|8(?:9\.(?:1(?:12\.218\.234|60\.12\.245)|84\.174\.253)|6\.24\.(?:1[6789]|2[013])\.3)|73\.(?:45\.96\.(?:2(?:1[023689]|0[15689])|1(?:9[45789]|0[02])|99)|12\.38\.254)|5(?:5\.212\.105\.12|1\.44\.239\.6)2|68\.187\.214\.66)|2(?:0(?:1\.(?:2(?:
32\.107\.46|51\.94\.67)|(?:59\.92\.24|43\.13\.8)6|10\.176\.43)|9\.(?:2(?:22\.0\.(?:1[015]|2[16]|30?|7)|54\.56\.106)|94\.196\.170)|0\.(?:1(?:17\.254\.129|04\.58\.227|41\.87\.135)|80\.140\.61)|2\.(?:(?:164\.52\.10|87\.47\.13)0|4(?:2\.133\.58|3\.181\.7))|3\.(?:12(?:6\.152\.24|1\.88\.16)2|249\.162\.7)|6\.48\.103\.222|7\.255\.89\.50|8\.41\.230\.54)|1(?:3\.(?:1(?:98\.(?:11(?:1\.207|3\.144|2\.90)|25\.33)|63\.116\.2(?:26|30)|84\.250\.233)|226\.144\.65)|1\.(?:1(?:91\.174\.141|71\.31\.100)|24\.209\.253)|7\.(?:1(?:74\.229\.221|14\.11\.35)|76\.2\.129)|9\.(?:95\.(?:227\.218|148\.97)|252\.48\.67)|6\.(?:155\.39\.(?:2[01]|13)|230\.133\.69)|2\.(?:175\.53\.1|63\.221\.)10)|2(?:2\.(?:124\.156\.231|252\.223\.2)|0\.2(?:27\.46\.186|31\.69\.13)|1\.143\.46\.33)|4\.97\.212\.210)|6(?:4\.(?:1(?:87\.11(?:7\.69|9\.2)|64\.228\.206)|(?:237\.33\.[23]|70\.190\.1)0)|1\.(?:1(?:00\.228\.61|7\.76\.197|9\.71\.74)|7\.2(?:31\.23|41\.7)0)|(?:(?:9\.151\.79\.2|5\.167\.56\.)3|7\.115\.179\.19)8|3\.25(?:3\.107\.166|5\.22
\.42)|8\.232\.189\.(?:4[12]|37)|0\.49\.236\.137|2\.48\.207\.129)|8(?:2\.(?:1(?:14\.(?:65\.246|70\.54)|40\.91\.41)|66\.65\.144)|9\.(?:(?:211\.46\.21|90\.153\.20)0|161\.141\.147)|0\.(?:1(?:79\.231\.205|22\.70\.11)|93\.125\.186)|3\.(?:175\.88\.18|234\.89\.2)|5\.1(?:8\.140\.45|54\.5\.90)|4\.22\.(?:56\.50|63\.74)|8\.85\.97\.38|1\.22\.8\.62)|7(?:7\.(?:2(?:41\.17\.120|2\.162\.99)|120\.251\.37|73\.139\.2)|6\.(?:103\.160\.74|227\.84\.105)|(?:9\.101\.99\.15|2\.21\.6\.2)4)|9(?:(?:8\.126\.149\.9|7\.66\.79\.8)1|3\.91\.196\.(?:132|99)|1\.150\.127\.93|4\.75\.240\.140)|41\.2(?:04\.190\.12|15\.18\.110)|5(?:8\.27\.196\.8|9\.6\.146\.2)4)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work