## khop-sc-neighbors.cf v 201104301 ## Khopesh's syndication of SpamCop's top offenders and top offending networks. ## ## Spamassassin rules written by Adam Katz ## http://khopesh.com/Anti-spam ## khopesh on irc://irc.freenode.net/#spamassassin ## ## sa-update --gpgkey E8B493D6 --channel khop-bl.sa.khopesh.com ## ## These rules are Copyright 2001-2009 by Adam Katz ## Licensed under the Creative Commons Non-Commercial Share-alike License 2.0. ## The code that generated this output is GNU Affero General Public License v3. ## Source data (copyright Cisco subsidiary SpamCop.net) taken from links below. ## The author is receptive to relicensing requests for this and its generator. ## ## Frequent updates are needed for these rules, so they are marked 'nopublish' ## This keeps them from being automatically promoted to SpamAssassin proper ## from the testing system, which affirms their usefulness. You can check ## their efficiency at http://ruleqa.spamassassin.org/?rule=%2FKHOP_SC # http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56 # Due to the massive block size, this rule only examines the last untrusted header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:13|87)|41|95)(?:\.[012]?\d{1,2}){3}\b) / # and gets cleaned up a bit meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL) describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop tflags KHOP_SC_CIDR8 nopublish score KHOP_SC_CIDR8 0.3 0.1 0.3 0.1 # spam/ham s/o corpus # 12.3692/1.0099 0.925 20100211 .2 .1 .3 .2 -> .1 .01 .1 .01 # 8.9412/1.1532 0.886 20100325 # 9.4362/0.4074 0.959 20100329 # 11.8281/0.4788 0.961 20100401 without meta # 11.8578/0.4495 0.961 20100402 half meta (oops). decreased worst 4/8->4/7 # 7.8856/0.1388 0.983 20100403 meta, net, solo=7.9236/0.4189 # changed from rank by spam count to rank by hosts reported, back to 4/8 # 12.1963/0.0356 0.997 20100406 (wow) solo=12.2454/0.0408@0.997 # 12.0753/0.0359 0.997 20100409 solo=12.1265/0.0412@0.997 # 12.1449/0.0139 0.999 20100410 net, solo=12.1966/0.0197@0.998, ->.2 .1 .3 .2 # 10.3554/0.0112 0.999 20110227@510k solo=10.3717/0.0119@0.999, ->.3 .1 .3 .1 header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b1(?:17|78|89|90)(?:\.[012]?\d{1,2}){3}\b) / meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL) describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s tflags KHOP_SC_TOP_CIDR8 nopublish score KHOP_SC_TOP_CIDR8 0.2 0 0.2 0 # spam/ham s/o corpus # 15.6795/0.1173 0.993 20100211 .5 .4 .8 .6 -> .6 .5 .8 .5 # 11.0578/0.3614 0.968 20100325 # 13.7809/0.4860 0.966 20100329 .9 .1 .9 .1 masscheck promoted # 14.1773/0.4799 0.967 20100401 # 14.1807/0.4960 0.966 20100402 without meta # 14.0841/0.0926 0.993 20100402 added meta (wow!) # 14.2553/0.0424 0.997 20100403 net, solo=14.3609/0.4888@0.967 # 11.6252/0.1263 0.989 20100406 solo=11.7104/0.5366@0.956 # 11.5987/0.1295 0.989 20100409 solo=11.6856/0.5731@0.953 # 11.6286/0.0475 0.996 20100410 net, solo=11.7224/0.6900@0.944, ->LE as above # 10.6798/0.1269 0.993 20110227@510k solo=10.6996/0.5918@0.948 -> .2 0 .2 0 # http://www.spamcop.net/w3m?action=map;net=bmaxcnt;mask=16777215;sort=spamcnt header KHOP_SC_CIDR16 Received =~ /___ FAILED TO POPULATE ___/ describe KHOP_SC_CIDR16 Relay CIDR /16 is among worst in SpamCop tflags KHOP_SC_CIDR16 nopublish score KHOP_SC_CIDR16 1.0 0.2 1.0 0.2 # spam/ham s/o corpus # 0.7444/0.0129 0.983 20100211 # 0.5943/0.0139 0.977 20100325 .6 .5 .9 .75 # 0.8767/0.0167 0.981 20100329 1.6 .5 1.6 .5 masscheck promoted # 0.6952/0.0011 0.998 20100401 increased worst offenders 6/12->9/15 @ 20100401 # 0.6814/0.0149 0.979 20100402 # 0.4399/0.0008 0.998 20100403 net run # 0.2102/0.0011 0.995 20100406 # 0 /0 0 20100409 (wha!?) # crap, still empty 20100410 bad scrape, script failed to populate rule # crap, still empty 20110227 this is due to safety net exclusions -> 1 .2 1 .2 header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:13\.169|23\.238)|95\.133)(?:\.[012]?\d{1,2}){2}\b)/ describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s tflags KHOP_SC_TOP_CIDR16 nopublish score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0.4 # spam/ham s/o corpus # 0.8862/0.0008 0.999 20100211 # 0.5738/0.0008 0.999 20100325 .9 .8 1.3 1.2 # 0.6658/0 1.000 20100329 2 .5 2 .5 masscheck promoted # 0.8374/0 1.000 20100401 # 1.1534/0 1.000 20100402 # 1.2077/0.0145 0.988 20100403 net run # 1.2155/0.0142 0.988 20100406 # 1.2779/0.0142 0.989 20100409 # 1.0611/0.0009 0.999 20100410 net # 0.5034/0 1.000 20110227@510k 2 .3 2 .4 # http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:5\.126\.227|9\.199\.200|4\.38\.242)|78\.49\.255|82\.255\.61|98\.106\.26|21\.54\.32)|2(?:1(?:3\.(?:108\.172|233\.64)|7\.118\.81)|0(?:3\.217\.145|8\.67\.58))|9(?:8\.139\.91|9\.192\.47)|(?:77\.221\.14|81\.9\.2)3)\.[012]?\d{1,2}\b)/ describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop tflags KHOP_SC_CIDR24 nopublish score KHOP_SC_CIDR24 0.1 0 0.1 0 # spam/ham s/o corpus # 0.1350/0 1.000 20100211 # 0.0798/0 1.000 20100325 .9 .8 1.3 1.2 # 0.0159/0 1.000 20100329 2.5 .6 2.5 .6 masscheck promoted # 0.1577/0 1.000 20100401 # added top host-count /24s, increased worst offenders 6/12->8/15 @ 20100401 # 0.1223/0 1.000 20100402 (oops, too small a pool) # host-count 84/64->84/50, offenders 8/15->10/20 @ 20100402 # 0.2547/0 1.000 20100403 net # 0.2126/0 1.000 20100406 # 0.2960/0 1.000 20100409 # 0.2905/0 1.000 20100410 net # 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0 header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:7\.(?:118\.(?:83|90)|66\.146|8\.225)|2\.199\.29|8\.213\.77|3\.87\.74)|0(?:8\.(?:43\.232|67\.57)|0\.234\.196|2\.152\.243|9\.205\.220))|8(?:5\.26\.(?:1(?:6[45]|8[46])|2(?:3[14]|41))|3\.149\.(?:38?|21)|2\.178\.69)|1(?:95\.191\.58|19\.82\.65)|7(?:7\.111\.34|9\.124\.92)|9(?:1\.195\.87|3\.125\.2)|61\.19\.6[67])\.[012]?\d{1,2}\b)/ describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s tflags KHOP_SC_TOP_CIDR24 nopublish score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5 # spam/ham s/o corpus # 0.2528/0.0092 0.965 20100211 # 0.2231/0.0112 0.952 20100325 1.7 1.5 1.9 1.8 # 0.0249/0 1.000 20100329 2.7 .6 2.7 .6 masscheck promoted # 0.1594/0 1.000 20100401 # 0.6448/0 1.000 20100402 (wow!) # 0.6896/0 1.000 20100403 net # 0.6255/0.0045 0.993 20100406 # 0.7261/0.0045 0.994 20100409 # 0.7447/0.0054 0.993 20100410 net # 0.5722/0 1.000 20110227@510k 2.7 .5 2.7 .5 # http://www.spamcop.net/w3m?action=hoshame header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:4\.(?:4(?:0\.(?:183\.100|216\.246)|7\.(?:217\.109|3\.5)|2\.208\.188)|3(?:8\.242\.24|9\.1\.1)7|25\.161\.23)|9\.(?:1(?:99\.200\.147|58\.136\.19)|20(?:3\.156\.164|0\.84\.197)|82\.65\.199)|8\.(?:39\.(?:123\.3|80\.57)|233\.172\.244|40\.59\.216)|5\.(?:2(?:2\.125\.21|52\.2\.14)0|126\.227\.18)|7\.2(?:40\.248|39\.69)\.34|3\.160\.196\.110|0\.76\.103\.221|1\.243\.218\.12|2\.104\.146\.46)|8(?:8\.(?:12(?:3\.129\.144|7\.132\.11|8\.0\.78)|24(?:1\.66\.68|9\.49\.43))|3\.(?:10(?:4\.162\.167|6\.110\.131)|8(?:3\.167\.109|2\.249\.65))|9\.(?:(?:32\.58\.2|59\.33\.1)41|60\.14\.132|75\.14\.186)|7\.(?:45\.241\.(?:27|30)|5\.198\.158|35\.71\.51)|6\.(?:215\.210\.169|112\.250\.14)|2\.(?:50\.24\.13|71\.28\.24)3)|2(?:1\.(?:1(?:4(?:8\.139\.199|4\.27\.84)|51\.87\.82)|50\.16\.11)|3\.2(?:36\.147\.206|05\.171\.98|55\.250\.2)|5\.(?:137\.(?:24\.23|68\.14)8|230\.3\.122)|2\.16(?:0\.175\.161|9\.67\.58)|4\.123\.167\.140)|9(?:5\.(?:1(?:8(?:2\.1(?:55\.214|94\.200)|9\.2(?:15\.21|34\.25)0)|91\.58\.[45]|61\.9\.2)|5\.41\.190)|0\.1(?:66\.146\.171|58\.100\.65)|4\.150\.165\.243|3\.77\.221\.219)|7(?:8\.(?:2(?:1(?:2\.7(?:3\.177|9\.185)|4\.183\.76)|00\.95\.22)|140\.234\.195|76\.222\.70|95\.70\.46)|3\.248\.145\.214)|09\.(?:1(?:88\.13\.193|94\.198\.24)|70\.184\.22)|63\.152\.102\.208|58\.250\.33\.227|4\.48\.108\.173)|2(?:1(?:8\.(?:2(?:1(?:2\.(?:58\.137|9\.231)|3\.77\.68)|48\.65\.140)|163\.90\.199)|3\.(?:1(?:41\.141\.72|71\.35\.131|11\.85\.40)|227\.227\.115|56\.32\.164)|0\.(?:219\.245\.97|66\.139\.115|89\.78\.226|126\.14\.1)|2\.(?:1(?:99\.29\.145|\.105\.136)|5\.19\.(?:216|71))|1\.(?:1(?:78\.61\.203|52\.51\.62)|76\.90\.57)|7\.(?:1(?:2\.71\.200|47\.17\.67)|97\.184\.2)|6\.138\.200\.18)|0(?:3\.(?:1(?:28\.167\.100|07\.154\.2|97\.77\.37)|2(?:17\.145\.62|50\.88\.125))|2\.(?:62\.106\.166|137\.150\.5|55\.191\.22)|1\.(?:238\.108\.70|51\.232\.248)|0\.234\.196\.(?:2(?:33|46)|188)|8\.43\.232\.34)|2(?:0\.(?:1(?:3(?:0\.181\.45|5\.222\.97)|1(?:7\.196\.12|9\.56\.14))|80\.173\.52)|2\.124\.198\.167)|7\.251\.86\.163|\.144\.112\.181)|8(?:9\.(?:1(?:0(?:5\.158\.103|1\.232\.58)|20\.128\.52)|207\.72\.109)|2\.(?:1(?:93\.139\.246|14\.79\.163)|207\.119\.171|80\.232\.242)|0\.(?:195\.239\.169|235\.63\.152|77\.154\.135|90\.120\.7)|5\.(?:185\.155\.69|25\.135\.200|37\.118\.166)|8\.(?:(?:204\.14\.|80\.59\.6)3|119\.250\.114)|1\.(?:192\.114\.13|9\.23\.22)3|4\.(?:63\.119\.34|22\.8\.137)|3\.239\.39\.166|6\.35\.201\.200)|9(?:3\.(?:1(?:2(?:5\.2\.169|7\.12\.10)|57\.148\.102|90\.104\.7)|7(?:8\.140\.87|3\.16\.63))|1\.(?:1(?:44\.186\.138|24\.0\.145)|2(?:13\.240\.240|02\.11\.91))|5\.1(?:91\.(?:238\.243|153\.7)|80\.215\.102|7\.47\.108)|2\.24(?:2\.97\.102|5\.38\.44)|4\.23(?:3\.133\.1|2\.13\.)15|9\.192\.47\.69)|7(?:7\.(?:1(?:11\.34\.143|21\.83\.180)|2(?:21\.143\.162|46\.55\.34)|66\.192\.37)|(?:8\.154\.243\.15|9\.124\.92\.16)4)|6(?:2\.(?:33\.(?:191\.144|49\.41)|141\.122\.146)|1\.(?:19\.251\.68|78\.29\.47)|0\.199\.201\.120|6\.197\.244\.25)|4(?:1\.1(?:37\.(?:24|30|56)\.4|95\.87\.8)|6\.(?:183\.83\.169|39\.1\.56))|5(?:9\.1(?:04\.141\.42|20\.25\.101)|8\.149\.10\.243)|38\.105\.20\.163)\b)/ describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs tflags KHOP_SC_TOP200 nopublish score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work # spam/ham s/o corpus # 1.2552/0 1.000 20100211 # 0.8558/0 1.000 20100325 3.4 3.2 3.7 3.5 # 0.1265/0 1.000 20100329 4 0 4 0 masscheck promoted # 0.7066/0 1.000 20100401 # 0.6558/0 1.000 20100403 net # 0.6211/0 1.000 20100406 # 0.5307/0 1.000 20100409 # 0.5617/0 1.000 20100410 net # 0.3655/0 1.000 20110227@510k # Spamhaus DROP, http://www.spamhaus.org/drop/ header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567])|198\.1(?:7[6789]|9[01]|8\d))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:5[01]|46)|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]?|13|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.97?)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|29)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567])|\.0\.0\.[0123])|58\.83\.(?:[89]|1[012345]))\b)/ describe KHOP_SPAMHAUS_DROP Relay listed in Spamhaus Don't Route Or Peer List tflags KHOP_SPAMHAUS_DROP nopublish score KHOP_SPAMHAUS_DROP 1 0.2 1 0.2 # spam/ham s/o corpus # 0.0349/0.0029 0.924 20110227@510k header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567])|198\.1(?:7[6789]|9[01]|8\d))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:5[01]|46)|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]?|13|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.97?)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|29)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567])|\.0\.0\.[0123])|58\.83\.(?:[89]|1[012345]))\b)/ describe KHOP_SPAMHAUS_DROP_LE Relay listed in Spamhaus Don't Route Or Peer List tflags KHOP_SPAMHAUS_DROP_LE nopublish score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 # adds to KHOP_SPAMHAUS_DROP # spam/ham s/o corpus # 0.0241/0 1.000 20110227@510k # PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop), # as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:2(?:1(?:7\.(?:118\.(?:83|90)|66\.146|8\.225)|3\.87\.(?:1(?:3[37]|14|29|41)|74))|0(?:1\.191\.198|2\.152\.243|3\.82\.95)|22\.84\.177)|1(?:8(?:3\.93\.(?:[0135]|2[01]?)|0\.(?:232\.10|149\.)8)|13\.(?:162\.(?:246|74)|56\.28)|25\.23(?:4\.144|5\.192)|01\.79\.50)|8(?:5\.(?:26\.(?:1(?:6[45]|8[46])|2(?:3[12345]|41))|115\.248)|3\.149\.(?:4[4567]|3[68]?|21)|(?:0\.83\.23|2\.178\.6)9)|41\.(?:189\.193|95\.4)|61\.19\.66)\.[012]?\d{1,2}\b)/ describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits tflags KHOP_PSBL_CIDR24 nopublish score KHOP_PSBL_CIDR24 2 0.6 2 0.6 # spam/ham s/o corpus # 0.5363/0 1.000 20100401 # 0.7486/0 1.000 20100402 # 0.7317/0 1.000 20100403 net run. min hosts 73->65 # 0.9316/0 1.000 20100406 # 0.9473/0 1.000 20100409 # 0.9545/0 1.000 20100410 net # 0.6985/0.0014 0.998 20110227@510k 2 .6 2 .6 # test for ruleqa, 20100409, http://ruleqa.spamassassin.org/?rule=/KHOP_SPAMMY meta __KHOP_SPAMMY_CIDR24 KHOP_PSBL_CIDR24||KHOP_SC_CIDR24||KHOP_SC_TOP_CIDR24 # est. 1.2/0.0050@.996, floor: 1.0/0.0112@.989, ceiling: 1.4/0@1 # spam/ham s/o corpus # 1.2645/0.0054 0.996 20100410 net # 1.1562/0.0058 0.995 20100417 net # 1.1332/0.5023 0.693 20110227@510k meta __KHOP_SPAMMY_CIDR16 KHOP_SC_CIDR16||KHOP_SC_TOP_CIDR16 # est. 1.4/0.02@.986, floor: 1.3/0.0312@.977, ceiling: 2.0/0.0150@.993 # spam/ham s/o corpus # 1.0611/0.0009 0.999 20100410 net # 1.9539/0.0152 0.992 20100417 net # 0.5034/0 1.000 20110227@510k meta __KHOP_SPAMMY_CIDR8 KHOP_SC_CIDR8||KHOP_SC_TOP_CIDR8 # est. 23.7/0.15@.994, floor: 23/0.2685@.988, ceiling: 26.5/0.0789@.997 # spam/ham s/o corpus # 23.7686/0.0614 0.997 20100410 net # 22.2300/0.0616 0.997 20100417 net # 21.0352/0.1381 0.993 20110227@510k meta __KHOP_SPAMMY_SUBNET __KHOP_SPAMMY_CIDR24||__KHOP_SPAMMY_CIDR16 # est. 26.2/0.175@.993, floor: 24.5/0.5@.980, ceiling: 30.1/0.1@.997 # spam/ham s/o corpus # 25.6744/0.0677 0.997 20100410 net, beat estimated ceiling (for ham)! # 23.7846/0.0826 0.997 20100417 net, beat ceiling ham, but beat floor spam # 23.7505/0.1041 0.996 20100418 too much ham, nixing /8, new est. 3.0/.02@.993 # 1.6366/0.5023 0.765 20110227@510k # Bump these up to compensate for expected but absent overlap (94+% noted below) if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) ) score KHOP_SC_CIDR8 (0) (0.2) (0) (0.2) # BRBL(98%) score KHOP_SC_TOP_CIDR8 (0) (0.9) (0) (0.9) # BRBL(98%) score KHOP_SC_CIDR16 (0) (1.5) (0) (1.5) # BRBL(99%), PBL(98%) score KHOP_SC_TOP_CIDR16 (0) (1.7) (0) (1.7) # BRBL(99%), PBL(94%) score KHOP_SC_CIDR24 (0) (0.9) (0) (0.9) # SC(99) BRBL(96) MSPIKE(96) score KHOP_SC_TOP_CIDR24 (0) (2.5) (0) (2.5) # MSPIKE(99) SC(98) BRBL(97) ... # PSBL(97) HOSTKARMA(97) score KHOP_SC_TOP200 (0) (4.4) (0) (4.4) # SC(99) PSBL(99) ... # HOSTKARMA(99) SEMBLACK(99) BRBL(98) MSPIKE(94) score KHOP_SPAMHAUS_DROP (0) (3) (0) (3) # SBL(78) score KHOP_PSBL_CIDR24 (0) (1.5) (0) (1.5) # BRBL(98) XBL(95) endif