You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/01/12 07:57:34 UTC
svn commit: r1057998 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Jan 12 06:57:33 2011
New Revision: 1057998
URL: http://svn.apache.org/viewvc?rev=1057998&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1057998&r1=1057997&r2=1057998&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Jan 12 06:57:33 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201101111
+## khop-sc-neighbors.cf v 201101121
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b178\.49(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:13\.167|09\.86|78\.49)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:(?:3\.233|8\.248)\.64|7\.118\.90|6\.81\.73)|20\.85\.242)|8(?:1\.192\.2(?:11|38)|5\.26\.2(?:25|34)|9\.232\.105|3\.149\.3)|1(?:78\.49\.255|93\.239\.44)|9(?:5\.154\.240|1\.203\.67)|77\.232\.14[23]|58\.64\.187)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:(?:3\.233|8\.248)\.64|6\.81\.73)|20\.85\.242|02\.108\.3)|8(?:(?:9\.232\.10|5\.26\.22)5|1\.192\.2(?:11|38)|3\.149\.3)|1(?:78\.49\.255|93\.239\.44)|9(?:5\.154\.240|1\.203\.67)|77\.232\.14[23])\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.2(?:11|38)|0\.83\.23[89]|9\.232\.105|2\.178\.69)|2(?:1(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|6\.(?:157\.150|86\.145)|3\.87\.74)|0(?:9\.(?:51\.150|190\.4)|3\.(?:152\.2|82\.95)))|1(?:1(?:3\.(?:10\.16[45]|30\.110)|2\.196\.253)|8(?:(?:0\.131|8\.95)\.53|4\.154\.138)|78\.49\.255|95\.91\.70)|7(?:4\.117\.211|7\.232\.142|9\.106\.109)|6(?:5\.110\.50|1\.19\.66)|41\.(?:254\.1|95\.4)|98\.139\.91)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.2(?:11|38)|0\.83\.23[89]|2\.178\.69)|2(?:1(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|6\.(?:157\.150|86\.145)|3\.87\.74)|0(?:9\.(?:51\.150|190\.4)|3\.(?:152\.2|82\.95)))|1(?:1(?:3\.(?:10\.16[45]|30\.110)|2\.196\.253)|8(?:4\.1(?:05\.195|54\.138)|8\.95\.53)|78\.49\.255|95\.91\.70)|7(?:4\.117\.211|9\.106\.109)|6(?:5\.110\.50|1\.19\.66)|41\.(?:254\.1|95\.4)|98\.139\.91)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|9\.2)|0\.253\.4)|8(?:2\.194\.220|9\.46\.246))|(?:34\.235\.21|82\.172\.2)8|24\.220\.2)|0\.1(?:60\.251\.210|44\.113\.27)|3\.(?:239\.44\.193|33\.236\.218)|6\.(?:201\.207\.191|0\.12\.35)|4\.213\.120\.1|8\.106\.26\.74)|2(?:3\.(?:1(?:38\.216\.149|92\.73\.28)|27\.79\.11)|4\.1(?:58\.110\.64|06\.53\.86)|2\.154\.(?:129\.82|24\.254)|8\.121\.191\.244|\.230\.125\.150|1\.191\.7\.162|5\.20\.82\.197)|8(?:8\.(?:95\.53\.1(?:0[235]|12)|132\.221\.57|2\.149\.191)|4\.1(?:54\.138\.1(?:0[189]|2[025]|16)|05\.195\.8[18])|(?:0\.179\.87|9\.10\.85)\.30)|7(?:8\.(?:49\.255\.(?:10[34]|95)|23\.151\.242|32\.64\.195)|3\.208\.120\.10[57]|4\.127\.66\.243)|1(?:1\.(?:224\.250\.13[245]|68\.108\.200)|2\.133\.198\.146|6\.236\.230\.110|8\.233\.254\.112)|09\.(?:8(?:6\.159\.53|7\.70\.225)|227\.250\.128))|2(?:1(?:6\.(?:8(?:1\.7(?:(?:1\.19|2\.)2|[03]\.(?:64|2))|6\.145\.1[78][78])|157\.1(?:5(?:0\.(?:192|64)|4\.2)|4(?:6\.192|8\.64)|38\.192
))|3\.(?:1(?:8(?:4\.254\.13|6\.38\.38)|09\.88\.100|67\.23\.58)|94\.190\.1[124])|2\.(?:1(?:18\.142\.77|99\.29\.145)|71\.150\.146|66\.127\.17)|(?:8\.248\.44\.19|9\.95\.192\.16)6|1\.(?:202\.2\.178|147\.3\.74)|0\.91\.239\.10|7\.76\.2\.129)|0(?:2\.(?:1(?:08\.3\.184|22\.20\.50)|28\.(?:66\.251|24\.99)|75\.3(?:8\.209|6\.93)|41\.167\.241)|3\.(?:1(?:(?:53\.44\.13|72\.246\.6)0|93\.137\.3)|217\.176\.65)|9\.(?:190\.(?:4\.13[04589]|1\.173)|51\.150\.1(?:8[679]|90))|4\.(?:188\.168\.11|8\.46\.130)|8\.(?:131\.186\.2|3\.138\.103)|7\.210\.85\.122|0\.88\.236\.33)|22\.252\.223\.2|4\.177\.65\.188)|8(?:6\.(?:9(?:3\.38\.236|8\.23\.121)|57\.159\.150|64\.189\.65)|2\.1(?:(?:51\.115\.22|14\.76\.21)0|93\.140\.16[48])|0\.(?:9(?:5\.70\.173|7\.51\.66)|65\.16\.71)|9\.2(?:37\.(?:60\.130|26\.2)|15\.189\.170)|8\.(?:255\.153\.106|101\.165\.75)|3\.14(?:2\.111\.228|3\.237\.240)|7\.252\.228\.249|4\.15\.191\.254|1\.191\.0\.3)|9(?:1\.(?:1(?:9(?:8\.(?:175\.253|86\.7)|5\.230\.11)|21\.175\.20)|2(?:08\.97\.22|16\.72\.24)
6)|(?:4\.2(?:00\.27\.1|3\.60\.12)|2\.247\.250\.23)4|3\.1(?:5(?:5\.194\.176|9\.243\.49)|90\.104\.7)|5\.(?:154\.(?:240\.98|96\.147)|63\.38\.7)|0\.176\.72\.198)|7(?:8\.(?:1(?:2(?:9\.222\.20|8\.14\.14)2|11\.176\.131)|90\.234\.17)|4\.(?:117\.211\.2(?:4[269]|3[38]|52)|50\.95\.10)|(?:6\.161\.241\.11|2\.54\.21\.4)5|7\.(?:121\.85\.68|69\.137\.77)|0\.108\.253\.223)|6(?:2\.(?:2(?:21\.154\.62|4\.79\.40)|183\.110\.247)|5\.110\.50\.1(?:7[249]|6[18]|83)|4\.1(?:48\.129\.14|20\.55\.11)0|9\.64\.155\.181|1\.126\.28\.97|6\.96\.80\.182)|4(?:1\.(?:1(?:37\.(?:(?:24|30|56)\.4|63\.203)|89\.229\.164)|205\.223\.146)|6\.(?:17\.121\.1|47\.74\.27))|58\.150\.55\.59)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|9\.2)|0\.253\.4)|8(?:2\.194\.220|9\.46\.246))|(?:34\.235\.21|82\.172\.2)8|24\.220\.2)|0\.(?:144\.113\.27|42\.164\.192|30\.236\.34)|6\.(?:2(?:01\.207\.19|8\.52\.)1|0\.12\.35)|3\.239\.44\.193|8\.106\.26\.74)|8(?:4\.1(?:54\.138\.1(?:0[1289]|1[369]|2[025])|05\.195\.8[01678])|8\.(?:95\.53\.1(?:0[2359]|1[02])|132\.221\.57|2\.149\.191)|(?:0\.179\.87|9\.10\.85)\.30)|2(?:(?:2\.154\.129\.8|1\.191\.7\.16)2|3\.1(?:38\.216\.149|92\.73\.28)|4\.1(?:58\.110\.64|06\.53\.86)|8\.121\.191\.244|\.230\.125\.150|5\.20\.82\.197)|1(?:1\.(?:224\.250\.13[245]|68\.108\.200)|2\.133\.198\.146|6\.236\.230\.110|8\.233\.254\.112)|7(?:8\.(?:49\.255\.(?:10[34]|95)|23\.151\.242|32\.64\.195)|4\.123\.92\.59)|09\.(?:227\.250\.128|86\.159\.53))|2(?:1(?:6\.(?:8(?:1\.7(?:(?:1\.19|2\.)2|[03]\.(?:64|2))|6\.145\.1(?:8[3678]|7[78]))|157\.1(?:5(?:0\.(?:192|64)|4\.2)|4(?:6\.192|8\.64)))|2\.(?:1(?:18\.142\.77|99\.29\.145)|71\.150\.146|66\.
127\.17)|3\.1(?:8(?:4\.254\.13|6\.38\.38)|09\.88\.100)|(?:8\.248\.44\.19|9\.95\.192\.16)6|1\.1(?:3\.204\.1|47\.3\.74)|0\.91\.239\.10|7\.76\.2\.129)|0(?:2\.(?:1(?:52\.194\.128|08\.3\.184|22\.20\.50)|28\.(?:66\.251|24\.99)|41\.167\.241|75\.36\.93)|9\.(?:190\.(?:4\.1(?:3[0124589]|28)|1\.173)|51\.150\.1(?:8[679]|90))|3\.(?:153\.44\.130|217\.176\.65|91\.117\.3)|4\.(?:188\.168\.11|8\.46\.130)|8\.(?:131\.186\.2|3\.138\.103)|0\.88\.236\.33|1\.144\.51\.41)|22\.252\.223\.2)|8(?:6\.(?:9(?:3\.38\.236|8\.23\.121)|57\.159\.150|64\.189\.65)|3\.1(?:4(?:2\.111\.228|3\.237\.240)|10\.218\.221)|2\.1(?:93\.140\.16[48]|51\.115\.220|14\.79\.163)|0\.(?:9(?:5\.70\.173|7\.51\.66)|65\.16\.71)|9\.2(?:37\.(?:60\.130|26\.2)|18\.52\.234)|8\.(?:255\.153\.106|101\.165\.75)|5\.(?:90\.193\.240|154\.3\.141)|4\.15\.191\.254)|9(?:1\.(?:1(?:9(?:8\.(?:175\.253|86\.7)|5\.230\.11)|21\.175\.20)|208\.97\.226)|3\.1(?:5(?:5\.194\.176|9\.243\.49)|90\.104\.7)|4\.(?:2(?:00\.27\.1|3\.60\.12)4|140\.139\.240)|5\.(?:154\.240\.
98|63\.38\.7)|2\.247\.250\.234|0\.176\.72\.198)|7(?:4\.(?:117\.211\.2(?:4[269]|3[38]|52)|50\.95\.10)|8\.1(?:2(?:9\.222\.20|8\.14\.14)2|11\.176\.131)|(?:6\.161\.241\.11|2\.54\.21\.4)5|7\.(?:121\.85\.68|69\.137\.77)|0\.108\.253\.223)|6(?:2\.(?:1(?:83\.110\.247|18\.154\.64)|24\.79\.40)|5\.110\.50\.1(?:7[249]|6[18]|83)|4\.1(?:48\.129\.14|20\.55\.11)0|3\.138\.72\.178|9\.64\.155\.181|6\.96\.80\.182)|4(?:1\.(?:1(?:37\.(?:(?:24|30|56)\.4|63\.203)|89\.229\.164)|20(?:5\.223\.146|6\.13\.3))|6\.17\.121\.1)|58\.150\.55\.59)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[2678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|9\.204\.1(?:37|53)|0\.83\.23[89]|7\.252\.243|2\.178\.69)|1(?:1(?:3\.(?:10\.16[2378]|30\.110)|6\.71\.218)|2(?:5\.23(?:4\.144|5\.192)|2\.55\.106)|9(?:3\.25\.121|5\.91\.70)|80\.131\.24)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|41\.(?:95\.(?:[48]|10)|254\.1)|61\.19\.6[56])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[2678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|9\.204\.1(?:37|53)|0\.83\.23[89]|7\.252\.243|2\.178\.69)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:(?:11|7)4|8[01789]|9[012]))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|1(?:1(?:3\.(?:10\.16[278]|30\.110)|6\.71\.218)|2(?:5\.23(?:4\.144|5\.192)|2\.55\.106)|9(?:3\.25\.121|5\.91\.70)|80\.131\.24)|41\.(?:95\.(?:[48]|10)|254\.[01])|61\.19\.6[567])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8