You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2010/06/02 08:57:26 UTC
svn commit: r950389 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Jun 2 06:57:26 2010
New Revision: 950389
URL: http://svn.apache.org/viewvc?rev=950389&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=950389&r1=950388&r2=950389&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Jun 2 06:57:26 2010
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20100612
+## khop-sc-neighbors.cf v 20100622
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -57,7 +57,7 @@ score KHOP_SC_TOP_CIDR8 0.9 0.1 0.9 0.
# 11.6286/0.0475 0.996 20100410 net, solo=11.7224/0.6900@0.944, ->LE as above
# http://www.spamcop.net/w3m?action=map;net=bmaxcnt;mask=16777215;sort=spamcnt
-header KHOP_SC_CIDR16 Received =~ /(?-xism:\b(?:9(?:4\.179|5\.134|3\.73)|1(?:22\.162|78\.95)|82\.200)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_CIDR16 Received =~ /(?-xism:\b(?:1(?:17\.197|22\.173|96\.206)|9(?:5\.13|3\.7)3|59\.92)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_CIDR16 Relay CIDR /16 is among worst in SpamCop
tflags KHOP_SC_CIDR16 nopublish
score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:22\.1(?:6[38]|73)|15\.240)|9(?:5\.13[25]|2\.113)|41\.(?:141|249))(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:22\.16[238]|15\.240)|9(?:5\.13[25]|2\.113)|41\.(?:141|249))(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:2(?:2\.124\.178|1\.143\.46)|1(?:3\.233\.64|7\.118\.82)|03\.87\.178)|1(?:95\.93\.160|09\.95\.39|21\.1\.37)|8(?:2\.113\.121|0\.65\.16)|78\.138\.17[01]|41\.140\.252|67\.217\.50|93\.186\.96)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:(?:09\.95\.3|13\.22\.6)9|9(?:5\.93\.16|6\.40\.1)0|21\.(?:54\.32|1\.37))|2(?:2(?:2\.124\.178|1\.143\.46)|1(?:3\.233\.64|7\.118\.82)|03\.87\.178)|7(?:8\.138\.17[01]|7\.74\.36)|8(?:2\.113\.121|0\.65\.16)|41\.140\.252|93\.186\.96)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.(?:108\.172|233\.64|87\.76)|7\.(?:8\.2(?:25|36)|118\.90))|0(?:2\.(?:70\.5[1489]|152\.243)|1\.220\.232|9\.239\.47))|8(?:5\.26\.(?:2(?:3[234]|41)|1(?:64|86))|3\.149\.(?:21|3)|1\.192\.211|7\.252\.227|9\.232\.105|2\.178\.69)|1(?:1(?:1\.224\.250|5\.147\.237|3\.22\.69|4\.79\.55)|96\.12\.2(?:4[2345]|3[36]))|7(?:7\.232\.14[23]|8\.138\.17[01]|4\.208\.166|9\.106\.109)|9(?:5\.129\.166|1\.203\.67|2\.39\.79)|61\.(?:19\.(?:66|71)|97\.32)|41\.2(?:23\.20|54\.)1)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:2\.(?:70\.5[1489]|152\.243)|1\.220\.232|9\.239\.47)|1(?:7\.(?:8\.2(?:25|36)|118\.90)|3\.(?:233\.64|87\.76)))|8(?:5\.26\.(?:2(?:3[234]|41)|1(?:64|86))|3\.149\.(?:21|3)|1\.192\.211|7\.252\.227|9\.232\.105|2\.178\.69)|1(?:1(?:1\.224\.250|5\.147\.237|4\.79\.55)|96\.12\.2(?:4[2345]|3[36]))|7(?:7\.232\.14[23]|8\.138\.17[01]|4\.208\.166|9\.106\.109)|61\.(?:19\.(?:66|71)|97\.32)|9(?:5\.129\.166|1\.203\.67)|41\.2(?:23\.20|54\.)1)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:8(?:2\.194\.195|9\.46\.253)|\.106\.231|61\.9\.2)|58\.249\.158|93\.160\.136|28\.0\.233)|3\.(?:1(?:0(?:7\.(?:184\.192|80\.11)|8\.38\.228)|98\.8\.211)|251\.95\.104)|4\.(?:1(?:35\.105\.232|58\.206\.90)|204\.203\.16|50\.9\.114)|0\.(?:75\.226\.239|144\.74\.94|26\.97\.26)|6\.(?:201\.207\.182|15\.226\.75))|2(?:4\.(?:1(?:05\.75\.135|23\.34\.4)|232\.147\.4)|5\.(?:2(?:0\.82\.197|14\.39\.14)|128\.6\.253)|1\.1(?:27\.1(?:73\.215|83\.70)|\.18\.24[24])|2\.2(?:01\.85\.141|52\.234\.74)|3\.(?:143\.217\.90|30\.110\.96)|\.(?:68\.137\.216|97\.188\.17)|8\.134\.57\.75)|1(?:5\.(?:248\.102\.197|95\.25\.4[23]|117\.35\.158)|1\.224\.250\.(?:1(?:3[01234]|29)|71)|2\.185\.70\.224|9\.200\.177\.2)|8(?:(?:0\.151\.249\.18|8\.61\.252\.23)8|6\.24\.(?:1[6789]|2[013])\.3)|74\.(?:123\.(?:26\.(?:102|98)|41\.2)|46\.134\.40))|2(?:1(?:7\.(?:1(?:7(?:4\.2(?:29\.22|32\.1)1|3\.21\.5)|39\.104\.218)|76\.2\.129|26\.6\.64)|1\.(?:1(?:9(?:1\.174\.141|9\.79\.198)
|0\.17\.19|3\.204\.1)|247\.239\.239)|2\.1(?:(?:11\.203\.24|56\.51\.6)6|23\.219\.162)|0\.(?:105\.155\.33|81\.170\.197|93\.109\.205)|3\.2(?:2(?:6\.144\.65|1\.5\.201)|51\.170\.46)|8\.248\.44\.196)|0(?:1\.(?:1(?:16\.140\.246|44\.130\.21)|220\.232\.(?:50|61))|9\.(?:2(?:39\.47\.205|54\.56\.106)|94\.196\.170)|0\.(?:107\.125\.82|80\.140\.61)|3\.15(?:2\.207\.120|3\.39\.18)|8\.53\.132\.180|2\.78\.174\.16)|2(?:2\.(?:2(?:37\.162\.200|52\.223\.2)|124\.1(?:56\.231|78\.158))|0\.255\.122\.21|1\.143\.46\.33)|4\.107\.57\.1)|8(?:3\.(?:1(?:0(?:1\.72\.196|3\.156\.3)|6(?:5\.193\.19|\.167\.1)4)|2(?:34\.113\.114|40\.139\.195))|2\.(?:1(?:14\.(?:7(?:9\.163|0\.54)|89\.162|90\.246)|93\.140\.168|69\.73\.11)|230\.229\.21)|0\.(?:5(?:7\.187\.143|3\.32\.122)|93\.12(?:5\.186|4\.1)|200\.249\.32|65\.16\.71)|1\.(?:2(?:03\.166\.155|1\.115\.38)|(?:192\.37\.18|84\.95\.12)6)|4\.(?:5(?:1\.(?:38\.178|21\.46)|4\.142\.173)|19\.180\.207)|9\.(?:(?:122\.208\.16|78\.70\.21)0|42\.111\.163)|7\.252\.227\.(?:7[26]|8[48]|[39]2|
4?4)|5\.(?:118\.193\.158|214\.42\.242)|8\.85\.97\.38|\.7\.26\.142)|6(?:7\.(?:1(?:59\.14\.(?:114|90)|92\.124\.76)|2(?:05\.103\.169|17\.50\.44))|1\.(?:(?:97\.32\.10|19\.71\.7)4|50\.240\.58|7\.230\.226)|(?:8\.184\.77\.15|6\.7\.217\.16)7|4\.(?:165\.253\.230|244\.130\.98)|9\.(?:151\.79\.238|49\.230\.3)|2\.(?:174\.85\.186|76\.93\.4)|5\.38\.95\.242)|9(?:1\.(?:1(?:(?:21\.6\.22|49\.173\.)2|93\.199\.4)|2(?:14\.128\.2[04]|07\.42\.4))|4\.(?:1(?:59\.162\.185|03\.147\.82)|2(?:12\.16\.61|3\.202\.79)|85\.241\.193)|3\.(?:9(?:1\.196\.(?:132|99)|5\.168\.122)|185\.69\.182|46\.193\.27)|0\.149\.32\.88|5\.53\.248\.42)|7(?:4\.(?:8(?:2\.51\.193|6\.21\.214)|208\.166\.151|92\.90\.58)|0\.(?:234\.125\.150|38\.31\.187)|9\.1(?:87\.150\.122|25\.61\.58)|7\.(?:23\.50\.83|73\.139\.2)|8\.(?:40\.254\.1|88\.236\.6)|1\.43\.55\.194|2\.51\.44\.231)|41\.1(?:90\.239\.178|41\.255\.22)|58\.27\.132\.51)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:8(?:2\.194\.195|9\.46\.253)|\.106\.231|61\.9\.2)|88\.112\.1(?:00|12)|93\.160\.136|28\.0\.233)|0\.(?:2(?:4\.197\.21|7\.80\.9)3|144\.7(?:0\.130|4\.94)|75\.226\.239)|4\.(?:1(?:35\.105\.232|58\.206\.90)|204\.203\.16|50\.9\.114)|3\.1(?:0(?:7\.(?:184\.192|80\.11)|8\.38\.228)|98\.8\.211)|6\.(?:201\.207\.182|15\.226\.75))|2(?:1\.(?:1(?:27\.173\.215|\.18\.24[24])|50\.16\.11)|2\.(?:2(?:01\.85\.141|52\.234\.74)|3\.253\.253)|4\.(?:1(?:05\.75\.135|23\.34\.4)|232\.147\.4)|5\.(?:2(?:0\.82\.197|14\.39\.14)|128\.6\.253)|3\.(?:143\.217\.90|30\.110\.96)|\.(?:68\.137\.216|97\.188\.17)|8\.134\.57\.75)|1(?:5\.(?:248\.102\.197|95\.25\.4[23]|117\.35\.158)|1\.224\.250\.(?:1(?:3[01234]|29)|71)|(?:8\.102\.163\.23|2\.185\.70\.22)4|9\.200\.177\.2)|8(?:(?:0\.151\.249\.18|8\.61\.252\.23)8|6\.24\.(?:1[6789]|2[013])\.3)|74\.(?:123\.(?:26\.98|41\.2)|46\.134\.40))|2(?:1(?:7\.(?:17(?:4\.2(?:29\.22|32\.1)1|3\.21\.5)|76\.2\.129|26\.6\.64)|1\.(?:
1(?:9(?:1\.174\.141|9\.79\.198)|3\.204\.1)|247\.239\.239)|(?:2\.1(?:11\.203\.24|56\.51\.6)|8\.248\.44\.19)6|0\.(?:105\.155\.33|81\.170\.197|93\.109\.205)|3\.2(?:2(?:6\.144\.65|1\.5\.201)|51\.170\.46))|0(?:1\.(?:1(?:16\.140\.246|44\.130\.21)|220\.232\.(?:50|61))|3\.1(?:53\.(?:44\.130|39\.18)|99\.72\.228|17\.89\.46)|0\.(?:(?:80\.140\.6|70\.23\.5)1|107\.125\.82)|9\.(?:239\.47\.205|94\.196\.170)|8\.53\.132\.(?:2(?:38|51)|180)|2\.78\.174\.16)|2(?:2\.(?:2(?:37\.162\.200|52\.223\.2)|124\.1(?:56\.231|78\.158))|0\.(?:255\.122\.21|82\.69\.23)|1\.143\.46\.33)|4\.107\.57\.1)|8(?:3\.(?:1(?:0(?:1\.72\.196|3\.156\.3)|6(?:5\.193\.19|\.167\.1)4|42\.111\.228)|2(?:34\.113\.114|40\.139\.195))|2\.(?:1(?:14\.(?:7(?:9\.163|0\.54)|89\.162|90\.246)|(?:40\.91\.4|69\.73\.1)1|93\.140\.168)|230\.229\.21)|0\.(?:5(?:7\.187\.143|3\.32\.122)|93\.12(?:5\.186|4\.1)|65\.16\.71)|4\.5(?:1\.(?:21\.(?:12|46)|38\.178)|4\.142\.173)|1\.(?:(?:192\.37\.18|84\.95\.12)6|21\.115\.38)|9\.(?:32\.198\.145|42\.111\.163|78\.70
\.210)|7\.252\.227\.(?:7[26]|8[48]|[39]2|4?4)|5\.(?:118\.193\.158|214\.42\.242)|8\.85\.97\.38|\.7\.26\.142)|9(?:1\.(?:2(?:07\.(?:210\.62|42\.4)|14\.128\.2[04])|1(?:(?:21\.6\.22|49\.173\.)2|93\.199\.4))|3\.(?:9(?:1\.196\.(?:132|99)|5\.168\.122)|185\.69\.182)|4\.(?:2(?:12\.16\.61|3\.202\.79)|103\.147\.82)|5\.(?:155\.219\.127|53\.248\.42)|0\.149\.32\.88)|6(?:7\.(?:1(?:59\.14\.(?:9[01]|114)|92\.124\.76)|2(?:05\.103\.169|17\.50\.44))|1\.(?:(?:97\.32\.10|19\.71\.7)4|7\.230\.226)|4\.(?:165\.253\.230|244\.130\.98)|2\.(?:174\.85\.186|76\.93\.4)|5\.38\.95\.242|6\.7\.217\.167|9\.49\.230\.3)|7(?:4\.(?:8(?:2\.51\.193|6\.21\.214)|208\.166\.151|92\.90\.58)|7\.(?:23\.50\.83|73\.139\.2)|8\.(?:40\.254\.1|88\.236\.6)|0\.234\.125\.150|9\.125\.61\.58)|41\.14(?:0\.252\.[135]|1\.255\.22)|58\.27\.132\.51)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:7\.(?:2(?:4(?:1\.(?:1(?:44|52)|56)|2\.(?:196|28))|01\.49)|19(?:7\.96|8\.32))|5\.147\.(?:2(?:3[0127]|0[123]|29)|192)|3\.(?:22\.(?:10|9)|162\.77)|9\.48\.198|4\.79\.55)|9(?:6\.12\.2(?:4[345]|3[36])|4\.230\.146)|(?:22\.168\.25|88\.135\.)2)|8(?:5\.26\.(?:2(?:3[2345]|41)|1(?:6[45]|86))|3\.149\.(?:2[18]|4[45]|32?)|2\.1(?:13\.121|78\.69)|1\.192\.(?:199|211)|9\.232\.105)|2(?:1(?:7\.(?:8\.2(?:25|36)|118\.90)|2\.23\.104|3\.87\.76)|02\.(?:70\.5[489]|152\.243))|5(?:9\.9(?:8\.1(?:28|92)|9\.1(?:28|60))|8\.187\.8)|41\.(?:2(?:54\.[012]|23\.201)|140\.251)|7(?:7\.232\.14[23]|8\.138\.17[01])|9(?:2\.39\.(?:65|79)|1\.203\.67)|61\.19\.66)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:8(?:5\.26\.(?:2(?:3[2345]|41)|1(?:6[45]|86))|3\.149\.(?:2[18]|32?|44)|2\.1(?:13\.121|78\.69)|1\.192\.(?:199|211)|9\.232\.105)|1(?:1(?:5\.147\.2(?:3[127]|0[13]|29)|7\.2(?:01\.49|41\.56)|4\.79\.55)|9(?:6\.12\.2(?:4[345]|3[36])|4\.230\.146)|88\.135\.2)|2(?:1(?:7\.(?:8\.2(?:25|36)|118\.90)|2\.23\.104|3\.87\.76)|02\.(?:70\.5[489]|152\.243))|41\.(?:2(?:54\.[012]|23\.201)|140\.251)|7(?:7\.232\.14[23]|8\.138\.17[01])|92\.39\.(?:65|79)|58\.187\.8|61\.19\.66)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8