You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/02/02 07:58:07 UTC
svn commit: r1066352 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Feb 2 06:58:06 2011
New Revision: 1066352
URL: http://svn.apache.org/viewvc?rev=1066352&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1066352&r1=1066351&r2=1066352&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Feb 2 06:58:06 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20110211
+## khop-sc-neighbors.cf v 20110221
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:8[79]|22)|201)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:22|87)|201|95)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -39,7 +39,7 @@ score KHOP_SC_CIDR8 0.2 0.1 0.3 0.2
# 12.0753/0.0359 0.997 20100409 solo=12.1265/0.0412@0.997
# 12.1449/0.0139 0.999 20100410 net, solo=12.1966/0.0197@0.998, ->.2 .1 .3 .2
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|78|90)|95)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b1(?:17|78|89|90)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:1(?:0\.139|3\.167|8\.96)|2(?:3\.2[67]|2\.168))(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:1(?:0\.139|8\.96)|23\.2[67])|9(?:4\.159|2\.83))(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.1(?:62\.237|0\.166)|1\.68\.108|8\.96\.231)|7(?:3\.245\.79|8\.49\.255)|8(?:4\.154\.138|8\.65\.50)|21\.54\.54)|8(?:5\.26\.2(?:25|34)|1\.192\.238|3\.149\.21)|21(?:(?:3\.233|8\.248)\.64|7\.118\.81)|7(?:7\.232\.14[23]|8\.108\.79)|95\.129\.166|62\.183\.85|41\.254\.1)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.1(?:62\.237|0\.166)|1\.68\.108)|7(?:3\.245\.79|8\.49\.255)|01\.78\.31|21\.54\.54)|21(?:(?:3\.233|8\.248)\.64|7\.118\.(?:81|90))|8(?:5\.26\.2(?:25|34)|3\.149\.21)|95\.1(?:29\.166|54\.240)|77\.232\.14[23]|62\.183\.85)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.(?:1(?:62\.2(?:4[46]|38)|0\.16[46])|61\.63)|4\.112\.244)|8(?:4\.105\.195|0\.149\.8)|7(?:4\.36\.86|8\.32\.64)|25\.234\.144|95\.91\.70)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:2[18]|4[16]|36?)|1\.192\.2(?:11|38)|2\.178\.69)|2(?:1(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|3\.(?:2(?:26\.63|33\.64)|87\.(?:136|74))|1\.147\.3)|03\.82\.95)|6(?:3\.246\.155|9\.80\.238|1\.19\.66)|7(?:9\.106\.109|2\.46\.153)|41\.(?:254\.[012]|137\.24)|9(?:1\.203\.67|8\.139\.91))\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.(?:2(?:26\.63|33\.64)|87\.(?:136|74))|7\.(?:118\.(?:83|90)|66\.146|8\.225)|1\.147\.3)|03\.82\.95)|1(?:1(?:3\.(?:1(?:0\.16[246]|62\.246)|61\.63)|4\.112\.244)|(?:25\.234\.14|78\.32\.6)4|95\.91\.70)|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|1\.192\.2(?:11|38)|3\.149\.(?:36?|21)|2\.178\.69)|7(?:9\.106\.109|2\.46\.153)|41\.(?:254\.[012]|137\.24)|6(?:3\.246\.155|1\.19\.66)|9(?:1\.203\.67|8\.139\.91))\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:8\.(?:2(?:07\.130\.206|\.207\.93)|72\.196\.114|62\.69\.142)|7\.(?:7(?:3\.85\.149|5\.174\.41)|36\.138\.76|66\.26\.141)|4\.1(?:54\.138\.(?:1(?:07|18)|99)|05\.195\.7[268])|9\.(?:220\.47\.19|42\.32\.210)|0\.92\.174\.84)|9(?:5\.(?:1(?:6(?:0\.253\.4|1\.9\.2)|82\.194\.223|35\.237\.20|4\.0\.197|55\.1\.55)|95\.2\.245)|4\.(?:150\.113\.81|24\.174\.44)|0\.(?:12\.80\.150|26\.113\.55)|3\.226\.161\.154|8\.106\.183\.189)|7(?:4\.(?:1(?:21\.154\.1|\.13\.8)6|36\.86\.1(?:1[59]|22))|3\.2(?:45\.79\.1(?:1[67]|09)|10\.25\.146|0\.18\.105)|8\.(?:49\.255\.104|32\.64\.195|22\.55\.93))|2(?:4\.(?:241\.255\.37|124\.43\.32)|1\.1(?:91\.7\.162|\.252\.148)|\.1(?:55\.164\.16|99\.5\.)2|2\.252\.234\.75|3\.27\.79\.11)|1(?:1\.(?:224\.250\.13[45]|68\.108\.200)|3\.16(?:5\.129\.133|2\.237\.59)|6\.109\.172\.165)|09\.(?:237\.216\.117|66\.192\.32)|47\.236\.238\.10)|2(?:1(?:7\.(?:1(?:(?:51\.78\.13|94\.199\.2)4|15\.195\.160|2\.160\.22)|21\.247\.82)|(?:8\.(?:248\.44
\.1|94\.65\.)9|0\.122\.170\.)6|3\.(?:39\.250\.139|181\.48\.24)|6\.(?:176\.16\.202|58\.41\.121)|2\.1(?:46\.157\.10|16\.164\.2)|1\.(?:202\.2\.178|147\.3\.74)|9\.255\.47\.215)|0(?:8\.(?:1(?:01\.82\.201|31\.186\.2)|93\.33\.10)|(?:1\.0\.105\.14|4\.57\.97\.15)4|9\.(?:97\.216\.173|20\.71\.184)|0\.(?:234\.220\.32|80\.13\.66)|2\.(?:103\.204\.86|28\.24\.99)|5\.209\.97\.153|6\.188\.209\.18|3\.86\.10\.236|7\.42\.17\.240)|4\.1(?:(?:51\.19\.20|0\.26\.4)3|30\.222\.58)|22\.252\.223\.2)|8(?:4\.(?:1(?:09\.202\.211|5\.191\.254)|2(?:42\.134\.37|2\.53\.130)|51\.44\.66)|8\.(?:16(?:2\.180\.223|6\.51\.100)|255\.153\.106|40\.102\.242)|3\.1(?:(?:68\.104\.7|73\.164\.1)0|42\.111\.228)|5\.1(?:07\.232\.209|12\.166\.174)|1\.(?:255\.83\.190|66\.233\.121)|2\.1(?:93\.140\.168|14\.79\.163)|7\.(?:126\.253\.24|69\.167\.150)|9\.2(?:00\.169\.108|55\.61\.93)|0\.9(?:7\.199\.131|5\.70\.173)|6\.(?:111\.21\.168|36\.49\.1))|6(?:2\.(?:21(?:2\.216\.249|4\.127\.148)|62\.237\.148|83\.172\.159)|8\.(?:(?:45\.227\.11|58\.19\.
18)0|1(?:51\.32\.176|90\.19\.57))|9\.(?:1(?:99\.164\.222|36\.55\.210)|64\.155\.181)|5\.(?:3(?:7\.160\.106|1\.22\.229)|183\.197\.46)|7\.(?:176\.137\.222|205\.199\.18|67\.202\.194)|(?:4\.148\.129\.14|6\.163\.30\.18)0|1\.1(?:42\.213\.158|9\.249\.216)|3\.246\.155\.(?:21[467]|44))|9(?:8\.(?:2(?:0(?:6\.90\.151|8\.81\.28)|23\.186\.34)|17\.181\.236)|3\.(?:1(?:25\.40\.15|90\.104\.7)|91\.196\.(?:132|99))|2\.1(?:2(?:6\.214\.177|5\.131\.16)|03\.162\.252)|5\.(?:154\.240\.98|48\.104\.170|62\.161\.69)|1\.1(?:97\.184\.194|21\.28\.86)|4\.23(?:6\.202\.13|\.245\.124)|9\.170\.201\.206|7\.92\.204\.31|6\.226\.4\.60)|7(?:7\.(?:2(?:2(?:8\.214\.52|1\.71\.99)|43\.231\.55)|9(?:2\.159\.102|3\.222\.5))|2\.(?:4(?:6\.153\.2(?:1[89]|2[01])|7\.254\.50)|52\.186\.60)|4\.(?:50\.(?:27\.125|94\.234)|208\.167\.179|86\.134\.138)|6\.(?:105\.19\.41|21\.49\.149|30\.91\.104)|5\.(?:184\.127\.176|61\.200\.125)|1\.239\.144\.233|0\.25\.46\.60)|4(?:1\.137\.(?:(?:24|30|56)\.4|63\.20[123])|6\.17\.121\.1)|5(?:8\.1(?:85\.35\.1
21|50\.55\.59)|9\.158\.239\.2))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:0\.253\.4|1\.9\.2)|35\.237\.20|4\.0\.197|55\.1\.55)|95\.2\.245)|4\.(?:150\.113\.81|24\.174\.44)|0\.1(?:06\.130\.14|2\.80\.15)0|3\.226\.161\.154|8\.106\.183\.189|6\.40\.84\.102)|8(?:8\.(?:(?:154\.157\.10|72\.196\.11)4|2(?:07\.130\.206|\.207\.93)|62\.69\.142)|7\.(?:(?:66\.26\.1|75\.174\.)41|45\.193\.174|36\.138\.76)|9\.(?:220\.47\.19|42\.32\.210)|0\.92\.174\.84)|2(?:(?:\.1(?:55\.164\.16|99\.5\.)|8\.121\.191\.18)2|1\.(?:1(?:91\.7\.162|\.252\.148)|52\.152\.2)|4\.(?:241\.255\.37|124\.43\.32)|2\.252\.234\.75|3\.27\.79\.11)|7(?:8\.(?:(?:49\.255\.10|137\.9\.8)4|32\.64\.195|22\.55\.93)|3\.2(?:45\.79\.1(?:1[67]|09)|10\.25\.146|0\.18\.105)|4\.1(?:21\.154\.1|\.13\.8)6)|1(?:1\.(?:224\.250\.13[45]|68\.108\.200)|3\.16(?:5\.129\.133|2\.237\.59)|6\.109\.172\.165)|09\.(?:237\.216\.117|166\.136\.1)|47\.236\.238\.10)|2(?:1(?:7\.(?:1(?:(?:51\.78\.13|94\.199\.2)4|15\.195\.160|2\.160\.22)|2(?:1\.247\.8|3\.48\.)2)|2\.(?:1(?:46\
.157\.10|99\.29\.145)|40\.179\.22|67\.210\.18)|(?:8\.(?:248\.44\.1|94\.65\.)9|0\.122\.170\.)6|3\.(?:39\.250\.139|181\.48\.24)|1\.(?:202\.2\.178|147\.3\.74)|9\.255\.47\.215)|0(?:2\.(?:28\.24\.99|64\.77\.93|75\.53\.17)|9\.(?:97\.216\.173|20\.71\.184)|0\.(?:234\.220\.32|80\.13\.66)|7\.(?:42\.17\.240|57\.124\.67)|8\.1(?:01\.82\.201|31\.186\.2)|1\.(?:0\.105\.144|22\.56\.36)|5\.209\.97\.153|6\.188\.209\.18|3\.86\.10\.236)|4\.(?:1(?:(?:51\.19\.20|0\.26\.4)3|30\.222\.58)|21\.128\.14)|22\.252\.223\.2)|8(?:4\.(?:2(?:04\.147\.82|42\.134\.37|2\.53\.130)|1(?:09\.202\.211|5\.191\.254)|51\.44\.66)|9\.(?:2(?:(?:00\.169\.10|11\.39\.5)8|55\.61\.93)|123\.41\.124)|8\.(?:1(?:62\.180\.223|90\.12\.240)|255\.153\.106)|3\.1(?:(?:68\.104\.7|73\.164\.1)0|42\.111\.228)|1\.(?:255\.83\.190|66\.233\.121)|7\.1(?:06\.251\.156|26\.253\.24)|0\.9(?:7\.199\.131|5\.70\.173)|6\.(?:111\.21\.168|36\.49\.1)|2\.193\.140\.168|5\.107\.232\.209|\.24\.182\.120)|6(?:2\.(?:21(?:2\.216\.249|4\.127\.148)|(?:83\.172\.15|1\.20
6\.13)9|62\.237\.148)|8\.(?:(?:5(?:4\.111\.13|8\.19\.18)|45\.227\.11)0|1(?:51\.32\.176|90\.19\.57))|9\.(?:1(?:99\.164\.222|36\.55\.210)|64\.155\.181)|5\.(?:3(?:7\.160\.106|1\.22\.229)|183\.197\.46)|7\.(?:17(?:6\.137\.22|7\.67\.11)2|67\.202\.194)|(?:0\.199\.201\.12|4\.148\.129\.14)0|6\.1(?:43\.148\.249|63\.30\.180)|3\.246\.155\.(?:21[467]|44)|1\.19\.249\.216)|7(?:4\.(?:50\.(?:27\.125|94\.234|85\.16)|208\.167\.179|75\.104\.232|86\.134\.138)|7\.(?:2(?:2(?:8\.214\.52|1\.71\.99)|43\.231\.55)|9(?:2\.159\.102|3\.222\.5))|2\.(?:4(?:6\.153\.2(?:1[89]|2[01])|7\.254\.50)|(?:3\.247\.10|52\.186\.6)0)|5\.(?:1(?:26\.237\.130|84\.127\.176)|61\.200\.125)|(?:6\.21\.49\.14|9\.29\.4\.3)9|0\.(?:45\.101\.42|25\.46\.60))|9(?:3\.(?:1(?:25\.40\.15|90\.104\.7)|91\.196\.(?:132|99))|8\.(?:1(?:42\.216\.41|7\.181\.236)|206\.90\.151)|5\.(?:154\.240\.98|48\.104\.170|62\.161\.69)|1\.1(?:21\.(?:28\.86|9\.8)|97\.184\.194)|2\.1(?:03\.162\.252|26\.214\.177)|4\.23(?:6\.202\.13|\.245\.124)|6\.226\.4\.60)|4(?:1\.1
37\.(?:(?:24|30|56)\.4|63\.20[123])|6\.17\.121\.1)|59\.158\.239\.2)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.1(?:62\.(?:2(?:2[589]|4[46]|38)|118|87)|0\.16[469])|7\.2(?:4(?:1\.(?:8[01]|248)|2\.28)|00\.1(?:7[67]|94))|9\.15(?:9\.(?:2(?:1[05789]|0[028]|20)|19[79])|3\.12)|0\.49\.(?:193|205)|4\.112\.244|6\.71\.145)|2(?:2\.(?:163\.23|55\.106)|5\.23(?:4\.144|5\.192)|1\.101\.206)|9(?:0\.110\.155|6\.202\.214|5\.91\.70)|8(?:8\.146\.(?:127|255)|0\.149\.8)|01\.78\.31)|2(?:1(?:3\.(?:87\.(?:1(?:14|28|36)|8[01789]|9[012]|74)|162\.68|226\.63)|7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|8\.156\.80)|0(?:(?:1\.191\.1|3\.82\.)95|(?:0\.85\.2|8\.54\.1)4|2\.152\.243))|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:[89]|3[2678]?|4[156]|2[18])|1\.192\.(?:2(?:1[15]|38)|199)|9\.204\.1(?:37|53)|0\.83\.23[89]|2\.178\.69)|59\.9(?:9\.(?:1(?:5[234]|2[89]|30)|56)|7\.21[68]|8\.152)|41\.(?:2(?:54\.[012]|09\.65)|95\.(?:[248]|1[02]))|6(?:1\.19\.6[567]|6\.87\.0)|91\.203\.67)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.1(?:62\.(?:2(?:2[589]|4[46]|38)|118|87)|0\.16[2469])|7\.2(?:4(?:1\.(?:8[01]|248)|2\.28)|00\.17[67])|9\.159\.2(?:1[05]|08)|0\.49\.(?:193|205)|4\.112\.244)|2(?:2\.(?:163\.23|55\.106)|5\.23(?:4\.144|5\.192)|1\.101\.206)|8(?:8\.146\.(?:127|255)|0\.149\.8)|9(?:6\.202\.214|5\.91\.70)|78\.49\.255)|2(?:1(?:3\.(?:87\.(?:1(?:14|28|36)|8[0189]|9[012]|74)|162\.68|226\.63)|7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|8\.156\.80)|0(?:(?:1\.191\.1|3\.82\.)95|(?:0\.85\.2|8\.54\.1)4|2\.152\.243))|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:[89]|3[2678]?|4[156]|2[18])|1\.192\.(?:2(?:1[15]|38)|199)|9\.204\.1(?:37|53)|0\.83\.23[89]|2\.178\.69)|59\.9(?:9\.(?:1(?:5[234]|2[89]|30)|56)|7\.216|8\.152)|41\.(?:2(?:54\.[012]|09\.65)|95\.(?:[48]|1?2))|6(?:1\.19\.6[567]|6\.87\.0)|91\.203\.67)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8