You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/01/26 07:57:58 UTC
svn commit: r1063612 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Jan 26 06:57:57 2011
New Revision: 1063612
URL: http://svn.apache.org/viewvc?rev=1063612&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1063612&r1=1063611&r2=1063612&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Jan 26 06:57:57 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201101251
+## khop-sc-neighbors.cf v 201101261
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:22|87|90)|201)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:87|90)|201|59)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:1(?:0\.13[69]|3\.22|8\.96)|2(?:2\.168|3\.27))|92\.86)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:1(?:3\.(?:167|22)|0\.13[69]|8\.96)|2(?:5\.160|3\.27))(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.1(?:62\.(?:118|237|56)|0\.164)|8\.96\.2[35]1|0\.139\.205)|7(?:8\.49\.255|4\.36\.86)|25\.162\.243|88\.65\.50)|21(?:(?:3\.233|8\.248)\.64|7\.118\.(?:81|90))|7(?:4\.117\.211|7\.232\.142|8\.108\.79)|95\.1(?:29\.166|54\.240|37\.65)|8(?:1\.192\.238|5\.26\.225)|41\.(?:137\.24|254\.1)|58\.64\.187)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.(?:1(?:62\.(?:118|237|56)|0\.16[469])|61\.62)|8\.96\.2[35]1|0\.139\.205)|25\.162\.243|78\.49\.255|88\.65\.50)|9(?:5\.1(?:29\.166|54\.240|37\.65)|1\.198\.86|8\.139\.91)|21(?:(?:3\.233|8\.248)\.64|7\.118\.81)|8(?:1\.192\.2(?:11|38)|5\.26\.225)|7(?:7\.232\.142|8\.108\.79)|41\.(?:137\.24|254\.1)|58\.64\.187)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:13\.(?:1(?:62\.(?:24[46]|96)|0\.16[4569])|61\.62)|8(?:4\.1(?:05\.195|54\.138)|0\.149\.8)|2(?:5\.234\.144|2\.55\.106)|01\.78\.23|78\.32\.64|95\.91\.70)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.(?:2(?:11|38)|199)|0\.83\.23[89]|2\.178\.69)|2(?:1(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|3\.(?:2(?:26\.63|33\.64)|87\.74)|1\.147\.3)|0(?:9\.212\.153|3\.82\.95))|7(?:(?:7\.232\.14|2\.46\.15)3|9\.106\.109)|9(?:1\.203\.67|8\.139\.91)|6(?:9\.80\.238|1\.19\.66)|41\.(?:254\.[01]|95\.4))\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:4\.1(?:05\.195|54\.138)|0\.149\.8)|13\.1(?:62\.(?:24[46]|96)|0\.16[469])|2(?:5\.234\.144|2\.55\.106)|7(?:4\.36\.86|8\.32\.64)|01\.78\.23|95\.91\.70)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.(?:2(?:11|38)|199)|0\.83\.23[89]|2\.178\.69)|2(?:1(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|3\.(?:2(?:26\.63|33\.64)|87\.74)|1\.147\.3)|0(?:9\.212\.153|3\.82\.95))|7(?:(?:7\.232\.14|2\.46\.15)3|4\.117\.211|9\.106\.109)|9(?:1\.203\.67|8\.139\.91)|6(?:9\.80\.238|1\.19\.66)|41\.(?:254\.[01]|95\.4))\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.1(?:05\.195\.(?:7[039]|9[134]|8[07]|68)|54\.138\.1(?:1[39]|02))|(?:2\.72\.242\.21|7\.66\.26\.14)1|8\.(?:207\.130\.206|55\.230\.201)|9\.19\.74\.9|6\.0\.2\.48)|9(?:5\.(?:1(?:6(?:1\.(?:40\.10|9\.2)|0\.253\.4)|(?:82\.194\.2|35\.237\.)20)|28\.32\.4)|(?:3\.252\.195\.17|0\.30\.236\.3)4|4\.158\.204\.250|6\.201\.207\.191)|7(?:8\.(?:49\.255\.10[34]|23\.151\.242|32\.64\.195)|4\.(?:36\.86\.1(?:1[245]|2[346])|57\.158\.55)|3\.2(?:45\.79\.1(?:2[04]|07)|0\.18\.105))|2(?:1\.(?:52\.15(?:8\.245|2\.2)|191\.7\.162)|4\.1(?:58\.110\.64|24\.43\.32)|5\.2(?:0\.82\.196|34\.17\.14)|2\.160\.177\.22|3\.27\.79\.11)|1(?:1\.(?:224\.250\.13[245]|68\.108\.200)|8\.(?:233\.254\.112|96\.148\.30)|3\.16(?:0\.180\.103|2\.237\.59))|6(?:5\.(?:228\.175\.173|186\.188\.49)|1\.58\.148\.117)|09\.74\.134\.150|51\.23\.183\.179)|2(?:0(?:2\.(?:1(?:5(?:2\.(?:194\.128|201\.37)|1\.76\.226)|08\.3\.184)|28\.(?:66\.251|24\.99)|55\.191\.22)|3\.(?:2(?:47\.149\.151|17\.176\.
65)|153\.44\.130)|0\.(?:(?:152\.100\.19|51\.42\.24)3|95\.162\.206)|1\.(?:144\.(?:130\.21|87\.45)|232\.85\.222)|8\.(?:131\.186\.2|43\.232\.34|93\.33\.10)|4\.(?:111\.83\.51|8\.46\.130)|9\.212\.153\.2(?:1[12456]|09))|1(?:7\.(?:1(?:(?:23\.133\.7|9\.202\.3)2|51\.78\.134)|21\.247\.82|76\.2\.129)|3\.(?:2(?:33\.64\.172|21\.45\.84)|39\.250\.139|17\.159\.66)|6\.(?:157\.1(?:3[67]|29)\.2|81\.77\.64)|(?:0\.212\.163\.4|2\.3\.113\.)2|9\.25(?:3\.140\.124|5\.47\.215)|8\.248\.44\.196|1\.147\.3\.74)|4\.1(?:3(?:0\.222\.58|\.53\.131)|13\.85\.109)|22\.252\.223\.2|\.90\.21\.106)|7(?:2\.(?:(?:24(?:5\.178\.13|3\.69\.4)|54\.21\.4)5|46\.153\.2(?:2[012]|1[89])|11\.73\.36)|4\.(?:1(?:17\.211\.2(?:29|48)|4\.243\.15)|254\.146\.125|54\.239\.4)|7\.(?:2(?:28\.214\.52|45\.144\.38)|92\.159\.102|69\.137\.77)|5\.(?:150\.241\.238|73\.139\.30)|6\.161\.241\.115|1\.58\.108\.122|8\.43\.199\.140|9\.180\.45\.66)|8(?:2\.(?:1(?:9(?:3\.140\.168|9\.96\.97)|14\.65\.246)|213\.2\.82)|3\.1(?:4(?:2\.111\.228|3\.237\.240)|73\.164
\.10)|4\.(?:1(?:5\.191\.254|09\.98\.91)|229\.116\.243)|8\.(?:255\.153\.106|181\.196\.52)|0\.(?:230\.24\.126|95\.70\.173)|(?:5\.4\.71\.20|6\.36\.49\.)1|1\.255\.83\.190|9\.218\.52\.234)|6(?:8\.(?:5(?:7\.218\.185|8\.19\.180)|151\.32\.176|36\.229\.134)|4\.(?:12(?:0\.20\.13|7\.37\.6)8|207\.14\.133)|9\.(?:128\.87\.202|64\.155\.181|237\.58\.70)|3\.(?:246\.155\.(?:21[67]|44)|139\.163\.42)|(?:2\.212\.216|6\.143\.148)\.249|7\.58\.92\.55)|9(?:3\.(?:1(?:25\.(?:40\.15|3\.19)|90\.104\.7)|91\.196\.(?:132|99))|4\.(?:2(?:45\.156\.33|3\.60\.124)|97\.52\.85)|(?:1\.197\.184\.5|7\.77\.35\.)3|5\.1(?:54\.240\.98|67\.107\.2)|2\.103\.162\.252|8\.221\.201\.141|9\.182\.63\.145)|41\.(?:137\.(?:(?:24|30|56)\.4|63\.20[123])|206\.13\.3)|5(?:8\.(?:47\.128\.211|150\.55\.59)|0\.22\.11\.22))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:4\.1(?:05\.195\.(?:7[023689]|9[134]|8[07]|68)|54\.138\.(?:1(?:1[389]|0[27])|99))|8\.(?:207\.130\.206|55\.230\.201|97\.76\.210)|9\.221\.246\.29|7\.66\.26\.141)|7(?:3\.2(?:45\.79\.1(?:2[04]|07)|10\.25\.146|0\.18\.105|9\.247\.70)|8\.(?:49\.255\.10[34]|23\.151\.242|32\.64\.195)|4\.36\.86\.1(?:1[2459]|2[2346]))|9(?:5\.1(?:6(?:1\.(?:40\.10|9\.2)|0\.253\.4)|(?:82\.194\.2|35\.237\.)20)|(?:3\.252\.195\.17|0\.30\.236\.3)4|4\.158\.204\.250|6\.201\.207\.191)|2(?:1\.(?:52\.15(?:8\.245|2\.2)|191\.7\.162)|4\.1(?:58\.110\.64|24\.43\.32)|5\.2(?:0\.82\.196|34\.17\.14)|3\.27\.79\.11)|1(?:1\.(?:224\.250\.13[45]|68\.108\.200)|8\.233\.254\.112|3\.162\.237\.59)|09\.74\.134\.150|51\.23\.183\.179|61\.58\.148\.117)|2(?:1(?:7\.(?:1(?:(?:23\.133\.7|9\.202\.3)2|51\.78\.134)|76\.2\.129)|6\.(?:1(?:57\.1(?:38\.19|29\.)|76\.16\.20)2|58\.41\.121)|3\.(?:39\.250\.139|17\.159\.66)|2\.(?:199\.29\.145|3\.113\.2)|8\.(?:248\.44\.1|94\.65\.)96|0\.212\.163\.42
|9\.255\.47\.215|1\.147\.3\.74)|0(?:2\.(?:1(?:52\.(?:194\.128|201\.37)|08\.3\.184)|28\.(?:66\.251|24\.99)|9\.109\.172)|4\.(?:111\.83\.51|57\.97\.154|8\.46\.130)|8\.(?:131\.186\.2|43\.232\.34)|9\.212\.153\.2(?:1[12456]|09)|1\.144\.(?:130\.21|87\.45)|0\.95\.162\.206|3\.153\.44\.130)|4\.(?:1(?:3(?:0\.222\.58|\.53\.131)|13\.85\.109)|22\.40\.109)|22\.252\.223\.2)|6(?:8\.(?:(?:43\.230\.4|63\.31\.15)1|151\.32\.176|36\.229\.134|58\.19\.180)|6\.(?:(?:58\.215\.7|96\.80\.18)2|143\.148\.249|76\.160\.18)|7\.(?:(?:169\.82\.23|58\.92\.5)5|225\.141\.154)|3\.(?:246\.155\.(?:21[67]|44)|139\.163\.42)|9\.(?:64\.155\.181|198\.58\.62|237\.58\.70)|4\.1(?:48\.129\.140|27\.37\.68)|1\.142\.213\.158|2\.212\.216\.249|5\.47\.145\.226)|7(?:2\.(?:(?:245\.178\.13|54\.21\.4)5|46\.153\.2(?:2[012]|1[89]))|5\.(?:2(?:4\.80\.11|11\.8\.9)7|150\.241\.238|73\.139\.30)|4\.(?:1(?:17\.211\.2(?:29|48)|4\.243\.15)|254\.146\.125)|7\.(?:(?:228\.214\.5|92\.159\.10)2|69\.137\.77)|1\.(?:58\.108\.122|125\.12\.15)|6\.161\.241\
.115|8\.43\.199\.140|9\.180\.45\.66)|8(?:2\.(?:1(?:9(?:3\.140\.168|9\.96\.97)|14\.65\.246)|213\.2\.82)|4\.(?:1(?:5\.191\.254|09\.98\.91)|229\.116\.2(?:10|43))|3\.1(?:4(?:2\.111\.228|3\.237\.240)|73\.164\.10)|0\.(?:(?:105\.193\.|230\.24\.1)26|95\.70\.173)|1\.(?:255\.83\.190|1\.194\.252)|8\.255\.153\.106|6\.36\.49\.1)|9(?:3\.(?:1(?:25\.(?:40\.15|3\.19)|55\.147\.186|90\.104\.7)|91\.196\.(?:132|99))|4\.(?:2(?:45\.156\.33|3\.60\.124)|97\.52\.85)|8\.2(?:21\.201\.141|08\.81\.28)|2\.103\.162\.252|9\.170\.201\.206|5\.154\.240\.98|7\.77\.35\.3)|5(?:8\.(?:47\.128\.211|150\.55\.59)|9\.167\.126\.19|0\.22\.11\.22)|41\.(?:137\.(?:(?:24|30|56)\.4|63\.20[123])|206\.13\.3))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.(?:15(?:9\.(?:2(?:1[14589]|0[2458]|2[12])|19[38])|3\.(?:[57]|1[258]?|8[38]?|91)|5\.(?:(?:10|3)3|2))|206\.243)|3\.1(?:62\.(?:2(?:4[46]|25|38)|[59]6|118)|0\.16[4569])|7\.2(?:4(?:1\.(?:8[01]|248|64)|2\.0)|00\.1(?:77|94))|6\.71\.(?:21[568]|148)|0\.49\.(?:193|205))|2(?:2\.(?:163\.23|55\.106)|5\.23(?:4\.144|5\.192))|8(?:8\.146\.127|4\.151\.63|0\.149\.8)|95\.91\.70)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[2678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|9\.204\.1(?:37|53)|0\.83\.23[89]|2\.178\.69)|2(?:1(?:3\.(?:87\.(?:(?:11|7)4|8[01789]|9[012])|226\.63)|7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146))|0(?:(?:1\.191\.1|3\.82\.)95|2\.152\.243|0\.85\.24))|59\.9(?:9\.(?:1(?:5[2345]|2[89]|30)|60)|7\.21[68]|8\.152)|41\.(?:95\.(?:[248]|1[02])|254\.[012])|6(?:1\.19\.6[567]|6\.87\.0))\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.(?:15(?:9\.(?:2(?:1[14589]|0[2458]|21)|19[389])|3\.(?:1[25]?|83?|7)|5\.(?:101|33))|206\.243)|3\.1(?:62\.(?:2(?:2[58]|4[46]|38)|118|87|96)|0\.16[4569])|7\.2(?:00\.1(?:9[24]|77)|41\.(?:248|81))|6\.71\.(?:2(?:09|16)|14[58])|0\.49\.(?:193|205))|2(?:2\.(?:163\.23|55\.106)|5\.23(?:4\.144|5\.192))|8(?:8\.146\.(?:127|255)|4\.151\.63|0\.149\.8)|95\.91\.70)|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[678]?|2[18]|4[16]|8)|1\.192\.(?:2(?:1[15]|38)|199)|9\.204\.1(?:37|53)|0\.83\.23[89]|2\.178\.69)|2(?:1(?:3\.(?:87\.(?:(?:11|7)4|8[01789]|9[012])|226\.63)|7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146))|0(?:(?:1\.191\.1|3\.82\.)95|2\.152\.243|0\.85\.24))|59\.9(?:9\.(?:1(?:5[2345]|28|30)|60)|7\.21[68]|8\.152)|41\.(?:95\.(?:[248]|1[02])|254\.[012])|6(?:1\.19\.6[567]|6\.87\.0))\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8