You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/01/09 07:57:22 UTC
svn commit: r1056886 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sun Jan 9 06:57:22 2011
New Revision: 1056886
URL: http://svn.apache.org/viewvc?rev=1056886&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1056886&r1=1056885&r2=1056886&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sun Jan 9 06:57:22 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20110181
+## khop-sc-neighbors.cf v 20110191
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:21(?:(?:3\.233|8\.248)\.64|7\.118\.(?:81|93))|8(?:5\.26\.(?:2(?:3[24]|25)|164)|9\.232\.105)|9(?:5\.154\.240|1\.203\.67|8\.139\.91)|1(?:78\.49\.255|98\.106\.26)|7(?:7\.232\.143|8\.138\.170)|58\.64\.187)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.26\.(?:2(?:3[24]|25)|164)|9\.232\.105|3\.149\.21)|1(?:9(?:3\.239\.44|8\.106\.26)|78\.49\.255|80\.131\.53)|21(?:(?:3\.233|8\.248)\.64|7\.118\.93)|7(?:7\.232\.143|8\.138\.170)|9(?:5\.154\.240|1\.203\.67)|58\.64\.187)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.2(?:11|38)|0\.83\.23[89]|9\.232\.105|2\.178\.69)|1(?:1(?:3\.(?:10\.16[2378]|30\.110)|2\.196\.253)|9(?:3\.25\.121|5\.91\.70)|22\.55\.106|78\.49\.255)|21(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|3\.(?:94\.190|87\.74)|6\.157\.150)|7(?:7\.232\.142|9\.106\.109)|41\.(?:254\.1|95\.4)|58\.64\.194|61\.19\.66)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[68]?|2[18]|4[16])|1\.192\.(?:2(?:11|38)|199)|0\.83\.23[89]|9\.232\.105|2\.178\.69)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|6\.(?:157\.150|81\.73)|3\.(?:94\.190|87\.74))|03\.152\.2)|1(?:1(?:3\.(?:10\.16[478]|30\.110)|2\.196\.253)|78\.49\.255|95\.91\.70)|7(?:7\.232\.142|9\.106\.109)|41\.(?:254\.1|95\.4)|98\.139\.91|61\.19\.66)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|9\.2)|0\.253\.4)|8(?:2\.194\.220|9\.46\.246)|14\.6\.11)|(?:34\.235\.21|82\.172\.2)8|24\.220\.2)|0\.(?:1(?:60\.251\.210|44\.113\.27)|210\.25\.225|30\.236\.34)|6\.(?:2(?:01\.207\.191|5\.8\.174)|12\.226\.34)|4\.(?:213\.120\.1|50\.9\.114)|8\.106\.26\.7[67]|3\.239\.44\.193)|2(?:8\.121\.1(?:91\.(?:182|244)|43\.48)|1\.(?:191\.7\.162|78\.236\.38)|2\.154\.(?:129\.82|24\.254)|4\.158\.110\.64|\.230\.125\.150|5\.20\.82\.197)|1(?:1\.(?:224\.250\.13[245]|68\.108\.200)|2\.13(?:3\.198\.146|7\.163\.218)|8\.233\.254\.112|3\.162\.248\.93)|7(?:8\.(?:49\.255\.(?:10[34]|32|95)|23\.151\.242|32\.64\.195)|3\.208\.120\.10[57]|4\.127\.66\.242)|8(?:8\.(?:132\.221\.57|95\.53\.112)|4\.154\.138\.116|0\.179\.87\.30|6\.6\.161\.214)|09\.(?:(?:227\.250\.12|169\.67\.7)8|8(?:6\.159\.53|7\.70\.225))|40\.119\.164\.187|68\.187\.24\.98)|2(?:1(?:6\.(?:157\.1(?:4(?:6\.(?:1(?:28|92)|64)|8\.(?:192|64))|5(?:0\.(?:(?:19)?2|64)|4\.2))|8(?
:1\.7(?:(?:1\.19|2\.)2|[03]\.(?:64|2))|6\.145\.178))|3\.(?:1(?:8(?:4\.2(?:24\.37|54\.13)|6\.38\.38)|67\.23\.58|94\.245\.2)|94\.190\.1[124])|2\.(?:1(?:07\.98\.194|18\.142\.77|99\.29\.145)|71\.150\.146|87\.183\.10)|(?:8\.248\.44\.19|9\.95\.192\.16)6|1\.(?:202\.2\.178|147\.3\.74)|0\.91\.239\.10|7\.76\.2\.129)|0(?:2\.(?:1(?:08\.3\.184|22\.20\.50)|28\.(?:66\.251|24\.99)|75\.3(?:8\.209|6\.93)|41\.167\.241)|3\.(?:1(?:72\.246\.60|93\.137\.3)|217\.176\.65|91\.117\.3)|4\.(?:188\.168\.11|8\.46\.130)|9\.210\.195\.190|7\.210\.85\.122|0\.88\.236\.33)|2(?:0\.231\.69\.14|2\.252\.223\.2)|4\.177\.65\.188)|9(?:1\.(?:1(?:9(?:5\.(?:230\.1[01]|136\.14)|8\.(?:175\.253|86\.7))|49\.162\.228|21\.175\.20)|2(?:0(?:2\.25\.138|3\.67\.212)|14\.128\.2[01]))|5\.(?:1(?:54\.(?:240\.98|96\.147)|69\.208\.117)|84\.229\.157)|2\.24(?:(?:1\.150\.25|7\.250\.23)4|(?:3\.187\.5|2\.97\.1)0)|4\.(?:1(?:40\.139\.24|89\.133\.23)0|23\.60\.124)|3\.1(?:5(?:5\.194\.176|9\.243\.49)|90\.104\.7)|0\.176\.72\.198|6\.45\.176\.194|8\.
172\.16\.180)|8(?:9\.(?:2(?:15\.(?:189\.170|89\.143)|37\.(?:60\.130|26\.2))|103\.16\.232|6\.19\.96)|7\.2(?:(?:26\.242\.|46\.5\.10)7|32\.123\.158|52\.228\.249)|2\.1(?:(?:51\.115\.22|14\.76\.21)0|93\.140\.16[48])|8\.(?:255\.153\.106|101\.165\.75)|(?:5\.14\.11\.6|1\.191\.0\.)3|0\.(?:95\.70\.173|65\.16\.71)|6\.9(?:3\.38\.236|8\.23\.121)|3\.142\.111\.228|4\.15\.191\.254)|7(?:8\.(?:1(?:2(?:9\.222\.20|8\.14\.14)2|54\.7\.54)|90\.234\.17)|7\.(?:2(?:32\.142\.210|43\.91\.12)|121\.85\.68|69\.137\.77)|(?:6\.161\.241\.11|2\.54\.21\.4)5|9\.1(?:43\.100\.252|72\.15\.251)|0\.108\.253\.223|5\.211\.48\.91|4\.50\.95\.10)|6(?:2\.(?:2(?:21\.154\.62|4\.79\.40)|183\.110\.247)|1\.1(?:39\.151\.18|12\.19\.81|26\.28\.97)|4\.1(?:48\.129\.14|20\.55\.11)0|6\.11\.239\.234|9\.64\.155\.181)|4(?:1\.1(?:37\.(?:(?:24|30|56)\.4|63\.20[123])|88\.127\.1)|6\.(?:17\.121\.1|47\.74\.27))|58\.150\.55\.59)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|9\.2)|0\.253\.4)|8(?:2\.194\.220|9\.46\.246))|(?:34\.235\.21|82\.172\.2)8|24\.220\.2)|0\.(?:1(?:60\.251\.210|44\.113\.27)|2(?:10\.25\.225|\.229\.20)|30\.236\.34)|6\.(?:2(?:01\.207\.191|5\.8\.174)|12\.226\.34)|4\.(?:213\.120\.1|50\.9\.114)|8\.106\.26\.(?:4[35]|[57]4)|3\.239\.44\.193|9\.239\.254\.78)|2(?:1\.(?:191\.7\.162|78\.236\.38)|4\.1(?:58\.110\.64|06\.53\.86)|2\.154\.(?:129\.82|24\.254)|8\.121\.1(?:91\.244|43\.48)|\.230\.125\.150|3\.192\.73\.28|5\.20\.82\.197)|1(?:1\.(?:224\.250\.13[245]|68\.108\.200)|2\.13(?:3\.198\.146|7\.163\.218)|8\.233\.254\.112|3\.162\.248\.93)|7(?:8\.(?:49\.255\.(?:10[34]|32|95)|23\.151\.242|32\.64\.195)|3\.208\.120\.10[57]|4\.127\.66\.243)|8(?:8\.(?:132\.221\.57|95\.53\.112)|(?:0\.179\.87|9\.10\.85)\.30|4\.154\.138\.116|6\.6\.161\.214)|09\.(?:(?:227\.250\.12|169\.67\.7)8|8(?:6\.159\.53|7\.70\.225)))|2(?:1(?:6\.(?:157\.1(?:5(?:0\.(?:192|64)|4\.2)|4(?:6\.192|8\.64)
|38\.192)|8(?:1\.7(?:(?:1\.19|2\.)2|[03]\.(?:64|2))|6\.145\.178))|3\.(?:1(?:8(?:4\.2(?:24\.37|54\.13)|6\.38\.38)|67\.23\.58|94\.245\.2)|94\.190\.1[124])|2\.(?:1(?:07\.98\.194|99\.29\.145)|71\.150\.146)|(?:8\.248\.44\.19|9\.95\.192\.16)6|1\.(?:202\.2\.178|147\.3\.74)|0\.91\.239\.10|7\.76\.2\.129)|0(?:2\.(?:1(?:08\.3\.184|22\.20\.50)|28\.(?:66\.251|24\.99)|75\.3(?:8\.209|6\.93)|41\.167\.241)|3\.(?:1(?:72\.246\.60|93\.137\.3)|217\.176\.65|91\.117\.3)|4\.(?:188\.168\.11|8\.46\.130)|9\.210\.195\.190|7\.210\.85\.122|0\.88\.236\.33)|22\.252\.223\.2|4\.177\.65\.188)|9(?:1\.(?:1(?:9(?:5\.(?:230\.1[01]|136\.14)|8\.(?:175\.253|86\.7))|21\.175\.20)|20(?:3\.67\.(?:212|94)|2\.25\.138))|5\.(?:1(?:54\.(?:240\.98|96\.147)|69\.208\.117)|(?:84\.229\.15|63\.38\.)7)|4\.(?:2(?:(?:00\.27\.1|3\.60\.12)4|45\.156\.50)|189\.133\.230)|3\.1(?:5(?:5\.(?:194\.176|254\.37)|9\.243\.49)|90\.104\.7)|2\.24(?:(?:1\.150\.25|7\.250\.23)4|2\.97\.10)|8\.17(?:5\.218\.118|2\.16\.180)|0\.176\.72\.198|6\.45\.176\.194)|
8(?:9\.(?:2(?:15\.(?:189\.170|89\.143)|37\.(?:60\.130|26\.2))|103\.16\.232|6\.19\.96)|7\.2(?:4(?:4\.225\.4|6\.5\.107)|32\.123\.158|52\.228\.249|26\.242\.7)|2\.1(?:(?:51\.115\.22|14\.76\.21)0|93\.140\.16[48])|8\.(?:255\.153\.106|101\.165\.75)|(?:5\.14\.11\.6|1\.191\.0\.)3|0\.(?:95\.70\.173|65\.16\.71)|6\.9(?:3\.38\.236|8\.23\.121)|3\.142\.111\.228|4\.15\.191\.254)|7(?:7\.(?:2(?:32\.142\.210|43\.91\.12)|121\.85\.68|69\.137\.77|77\.36\.113)|8\.(?:1(?:2(?:9\.222\.20|8\.14\.14)2|54\.7\.54)|90\.234\.17)|(?:6\.161\.241\.11|2\.54\.21\.4)5|9\.1(?:43\.100\.252|72\.15\.251)|0\.108\.253\.223|5\.211\.48\.91|4\.50\.95\.10)|6(?:2\.(?:2(?:21\.154\.62|4\.79\.40)|183\.110\.247)|1\.1(?:39\.151\.18|12\.19\.81|26\.28\.97)|4\.1(?:48\.129\.14|20\.55\.11)0|6\.11\.239\.234|9\.64\.155\.181)|4(?:1\.1(?:37\.(?:(?:24|30|56)\.4|63\.20[123])|88\.127\.1)|6\.(?:17\.121\.1|47\.74\.27))|58\.150\.55\.59)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[2678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|0\.83\.23[89]|7\.252\.243|2\.178\.69)|1(?:1(?:3\.(?:10\.16[2378]|30\.110)|4\.216\.10[23])|2(?:5\.23(?:4\.144|5\.192)|2\.55\.106)|9(?:3\.25\.121|5\.91\.70)|88\.135\.2)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|41\.(?:95\.[48]|254\.1)|61\.19\.6[56]|77\.232\.143)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:3[2678]?|2[18]|4[16])|1\.192\.(?:2(?:1[15]|38)|199)|0\.83\.23[89]|7\.252\.243|2\.178\.69)|1(?:1(?:3\.(?:10\.16[2378]|30\.110)|4\.216\.10[23])|2(?:5\.23(?:4\.144|5\.192)|2\.55\.106)|9(?:3\.25\.121|5\.91\.70)|80\.131\.24)|2(?:1(?:7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|3\.87\.(?:8[01789]|9[012]|74))|0(?:3\.(?:152\.2|82\.95)|2\.152\.243))|41\.(?:95\.[48]|254\.1)|61\.19\.6[56])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8