You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/01/08 07:57:44 UTC
svn commit: r1056630 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sat Jan 8 06:57:43 2011
New Revision: 1056630
URL: http://svn.apache.org/viewvc?rev=1056630&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1056630&r1=1056629&r2=1056630&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sat Jan 8 06:57:43 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20110171
+## khop-sc-neighbors.cf v 20110181
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:22|89|90)|94)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b1(?:8[79]|22|90)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.26\.(?:2(?:3[234]|25)|164)|9\.232\.105)|21(?:(?:3\.233|8\.248)\.64|7\.118\.81)|1(?:78\.49\.255|98\.106\.26)|7(?:7\.232\.143|8\.138\.170)|9(?:1\.203\.67|8\.139\.91)|58\.64\.187)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:21(?:(?:3\.233|8\.248)\.64|7\.118\.(?:81|93))|8(?:5\.26\.(?:2(?:3[24]|25)|164)|9\.232\.105)|9(?:5\.154\.240|1\.203\.67|8\.139\.91)|1(?:78\.49\.255|98\.106\.26)|7(?:7\.232\.143|8\.138\.170)|58\.64\.187)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.2(?:11|38)|0\.83\.23[89]|9\.232\.105|2\.178\.69)|1(?:13\.(?:10\.16[23478]|30\.110)|9(?:3\.25\.121|5\.91\.70)|22\.55\.106|78\.49\.255)|21(?:7\.(?:118\.(?:9[03]|83)|8\.2(?:3[68]|25)|66\.146)|3\.(?:94\.190|87\.74))|7(?:7\.232\.142|9\.106\.109)|41\.(?:254\.1|95\.4)|58\.64\.194|61\.19\.66)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.2(?:11|38)|0\.83\.23[89]|9\.232\.105|2\.178\.69)|1(?:1(?:3\.(?:10\.16[2378]|30\.110)|2\.196\.253)|9(?:3\.25\.121|5\.91\.70)|22\.55\.106|78\.49\.255)|21(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|3\.(?:94\.190|87\.74)|6\.157\.150)|7(?:7\.232\.142|9\.106\.109)|41\.(?:254\.1|95\.4)|58\.64\.194|61\.19\.66)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|9\.2)|0\.253\.4)|8(?:2\.194\.220|9\.46\.246)|14\.6\.11)|(?:34\.235\.21|82\.172\.2)8)|0\.(?:1(?:60\.251\.210|44\.113\.27)|210\.25\.225|30\.236\.34)|6\.(?:2(?:(?:01\.207\.19|8\.52\.)1|5\.8\.174)|12\.226\.34)|4\.(?:126\.180\.118|213\.120\.1|50\.9\.114)|3\.(?:239\.44\.193|151\.12\.69)|8\.106\.26\.7[67])|2(?:(?:2\.154\.24\.25|4\.158\.110\.6)4|1\.(?:191\.7\.162|78\.236\.38)|8\.121\.143\.48|\.230\.125\.150|5\.20\.82\.197|3\.27\.79\.11)|1(?:1\.(?:224\.250\.13[245]|68\.108\.200)|2\.133\.198\.146|8\.233\.254\.112|3\.162\.248\.93)|7(?:8\.(?:49\.255\.(?:104|95)|23\.151\.242|32\.64\.195)|4\.12(?:0\.38\.170|7\.66\.242))|8(?:8\.(?:132\.221\.57|95\.53\.112)|4\.154\.138\.116|6\.6\.161\.214)|09\.(?:22(?:7\.250\.128|9\.235\.135)|8(?:6\.159\.53|7\.70\.225))|4(?:0\.119\.164\.187|8\.244\.172\.122)|68\.187\.24\.98)|2(?:1(?:6\.(?:157\.1(?:4(?:6\.(?:1(?:28|92)|64)|8\.(?:192|64))|5(?:0\.(?:(?:19)?2|64)|4\.2))|8(?:1\.
7(?:(?:1\.19|2\.)2|[03]\.(?:64|2))|6\.145\.178))|2\.(?:1(?:99\.(?:104\.162|29\.145)|07\.98\.194|18\.142\.77)|7(?:1\.150\.146|6\.80\.165)|8(?:6\.255\.203|7\.183\.10))|3\.(?:1(?:8(?:4\.2(?:24\.37|54\.13)|6\.38\.38)|67\.23\.58|94\.245\.2)|94\.190\.1[124])|(?:8\.248\.44\.19|9\.95\.192\.16)6|1\.(?:202\.2\.178|147\.3\.74)|0\.91\.239\.10|7\.76\.2\.129)|0(?:2\.(?:1(?:22\.20\.50|33\.49\.59)|28\.(?:66\.251|24\.99)|75\.3(?:8\.209|6\.93))|3\.(?:1(?:7(?:2\.246\.60|7\.246\.22)|93\.137\.3)|217\.176\.65|91\.117\.3)|4\.(?:188\.168\.11|8\.46\.130)|9\.210\.195\.190|1\.55\.165\.134|0\.88\.236\.33|8\.131\.186\.2)|2(?:0\.231\.69\.14|2\.252\.223\.2)|4\.177\.65\.188)|9(?:1\.(?:1(?:9(?:5\.(?:230\.1[01]|136\.14)|8\.(?:175\.253|86\.7))|49\.162\.228|21\.175\.20)|2(?:0(?:2\.25\.138|3\.67\.212)|14\.128\.2[01]))|5\.(?:1(?:54\.(?:240\.98|96\.147)|69\.208\.117)|84\.229\.157)|2\.24(?:(?:1\.150\.25|7\.250\.23)4|(?:3\.187\.5|2\.97\.1)0)|4\.(?:2(?:45\.156\.55|3\.60\.124)|140\.139\.240)|3\.1(?:5(?:5\.194\.176|9\
.243\.49)|90\.104\.7)|0\.176\.72\.198|6\.45\.176\.194|8\.172\.16\.180)|8(?:9\.(?:2(?:15\.(?:189\.170|89\.143)|37\.(?:60\.130|26\.2))|103\.16\.232|6\.19\.96)|7\.(?:2(?:(?:26\.242\.|46\.5\.10)7|32\.123\.158|52\.228\.249)|103\.236\.121)|2\.1(?:14\.(?:7(?:6\.210|9\.86)|86\.122)|93\.140\.16[48])|8\.(?:255\.153\.106|101\.165\.75)|(?:5\.14\.11\.6|1\.191\.0\.)3|0\.(?:95\.70\.173|65\.16\.71)|6\.9(?:3\.38\.236|8\.23\.121)|3\.142\.111\.228|4\.15\.191\.254)|7(?:7\.(?:2(?:32\.142\.210|43\.91\.12)|12(?:1\.85\.68|3\.74\.19))|8\.(?:1(?:29\.222\.202|54\.7\.54)|90\.234\.17)|(?:6\.161\.241\.11|2\.54\.21\.4)5|9\.1(?:43\.100\.252|72\.15\.251)|0\.108\.253\.223|5\.211\.48\.91|4\.50\.95\.10)|6(?:4\.(?:1(?:48\.129\.14|20\.55\.11)0|50\.151\.101)|2\.(?:2(?:21\.154\.62|4\.79\.40)|183\.110\.247)|1\.1(?:39\.151\.18|12\.19\.81|26\.28\.97)|9\.64\.155\.181)|4(?:1\.1(?:37\.(?:(?:24|30|56)\.4|63\.20[123])|88\.127\.1)|6\.47\.74\.27)|58\.150\.55\.59)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|9\.2)|0\.253\.4)|8(?:2\.194\.220|9\.46\.246)|14\.6\.11)|(?:34\.235\.21|82\.172\.2)8|24\.220\.2)|0\.(?:1(?:60\.251\.210|44\.113\.27)|210\.25\.225|30\.236\.34)|6\.(?:2(?:01\.207\.191|5\.8\.174)|12\.226\.34)|4\.(?:213\.120\.1|50\.9\.114)|8\.106\.26\.7[67]|3\.239\.44\.193)|2(?:8\.121\.1(?:91\.(?:182|244)|43\.48)|1\.(?:191\.7\.162|78\.236\.38)|2\.154\.(?:129\.82|24\.254)|4\.158\.110\.64|\.230\.125\.150|5\.20\.82\.197)|1(?:1\.(?:224\.250\.13[245]|68\.108\.200)|2\.13(?:3\.198\.146|7\.163\.218)|8\.233\.254\.112|3\.162\.248\.93)|7(?:8\.(?:49\.255\.(?:10[34]|32|95)|23\.151\.242|32\.64\.195)|3\.208\.120\.10[57]|4\.127\.66\.242)|8(?:8\.(?:132\.221\.57|95\.53\.112)|4\.154\.138\.116|0\.179\.87\.30|6\.6\.161\.214)|09\.(?:(?:227\.250\.12|169\.67\.7)8|8(?:6\.159\.53|7\.70\.225))|40\.119\.164\.187|68\.187\.24\.98)|2(?:1(?:6\.(?:157\.1(?:4(?:6\.(?:1(?:28|92)|64)|8\.(?:192|64))|5(?:0\.(?:(?:19)?2|64)|4\.2))|8(?
:1\.7(?:(?:1\.19|2\.)2|[03]\.(?:64|2))|6\.145\.178))|3\.(?:1(?:8(?:4\.2(?:24\.37|54\.13)|6\.38\.38)|67\.23\.58|94\.245\.2)|94\.190\.1[124])|2\.(?:1(?:07\.98\.194|18\.142\.77|99\.29\.145)|71\.150\.146|87\.183\.10)|(?:8\.248\.44\.19|9\.95\.192\.16)6|1\.(?:202\.2\.178|147\.3\.74)|0\.91\.239\.10|7\.76\.2\.129)|0(?:2\.(?:1(?:08\.3\.184|22\.20\.50)|28\.(?:66\.251|24\.99)|75\.3(?:8\.209|6\.93)|41\.167\.241)|3\.(?:1(?:72\.246\.60|93\.137\.3)|217\.176\.65|91\.117\.3)|4\.(?:188\.168\.11|8\.46\.130)|9\.210\.195\.190|7\.210\.85\.122|0\.88\.236\.33)|2(?:0\.231\.69\.14|2\.252\.223\.2)|4\.177\.65\.188)|9(?:1\.(?:1(?:9(?:5\.(?:230\.1[01]|136\.14)|8\.(?:175\.253|86\.7))|49\.162\.228|21\.175\.20)|2(?:0(?:2\.25\.138|3\.67\.212)|14\.128\.2[01]))|5\.(?:1(?:54\.(?:240\.98|96\.147)|69\.208\.117)|84\.229\.157)|2\.24(?:(?:1\.150\.25|7\.250\.23)4|(?:3\.187\.5|2\.97\.1)0)|4\.(?:1(?:40\.139\.24|89\.133\.23)0|23\.60\.124)|3\.1(?:5(?:5\.194\.176|9\.243\.49)|90\.104\.7)|0\.176\.72\.198|6\.45\.176\.194|8\.
172\.16\.180)|8(?:9\.(?:2(?:15\.(?:189\.170|89\.143)|37\.(?:60\.130|26\.2))|103\.16\.232|6\.19\.96)|7\.2(?:(?:26\.242\.|46\.5\.10)7|32\.123\.158|52\.228\.249)|2\.1(?:(?:51\.115\.22|14\.76\.21)0|93\.140\.16[48])|8\.(?:255\.153\.106|101\.165\.75)|(?:5\.14\.11\.6|1\.191\.0\.)3|0\.(?:95\.70\.173|65\.16\.71)|6\.9(?:3\.38\.236|8\.23\.121)|3\.142\.111\.228|4\.15\.191\.254)|7(?:8\.(?:1(?:2(?:9\.222\.20|8\.14\.14)2|54\.7\.54)|90\.234\.17)|7\.(?:2(?:32\.142\.210|43\.91\.12)|121\.85\.68|69\.137\.77)|(?:6\.161\.241\.11|2\.54\.21\.4)5|9\.1(?:43\.100\.252|72\.15\.251)|0\.108\.253\.223|5\.211\.48\.91|4\.50\.95\.10)|6(?:2\.(?:2(?:21\.154\.62|4\.79\.40)|183\.110\.247)|1\.1(?:39\.151\.18|12\.19\.81|26\.28\.97)|4\.1(?:48\.129\.14|20\.55\.11)0|6\.11\.239\.234|9\.64\.155\.181)|4(?:1\.1(?:37\.(?:(?:24|30|56)\.4|63\.20[123])|88\.127\.1)|6\.(?:17\.121\.1|47\.74\.27))|58\.150\.55\.59)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[2678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|0\.83\.23[89]|7\.252\.243|2\.178\.69)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|1(?:1(?:3\.(?:10\.16[2378]|30\.110)|4\.216\.102)|9(?:3\.25\.121|5\.91\.70)|25\.23(?:4\.144|5\.192)|88\.135\.2)|41\.(?:254\.[01]|95\.[48])|61\.19\.6[56])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[2678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|0\.83\.23[89]|7\.252\.243|2\.178\.69)|1(?:1(?:3\.(?:10\.16[2378]|30\.110)|4\.216\.10[23])|2(?:5\.23(?:4\.144|5\.192)|2\.55\.106)|9(?:3\.25\.121|5\.91\.70)|88\.135\.2)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|41\.(?:95\.[48]|254\.1)|61\.19\.6[56]|77\.232\.143)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8