You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/06/18 07:58:03 UTC
svn commit: r1137130 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sat Jun 18 05:58:03 2011
New Revision: 1137130
URL: http://svn.apache.org/viewvc?rev=1137130&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1137130&r1=1137129&r2=1137130&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sat Jun 18 05:58:03 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201106171
+## khop-sc-neighbors.cf v 201106181
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -93,7 +93,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:1\.(?:230\.163|76\.50)|3\.217\.145)|13\.(?:110\.49|233\.64))|1(?:8(?:0\.232\.107|7\.92\.208)|19\.82\.65|24\.6\.181)|8(?:1\.93\.155|4\.53\.196|3\.149\.3)|78\.108\.79)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:7\.92\.208|2\.71\.45)|73\.245\.20[45]|19\.82\.65|24\.6\.181)|2(?:13\.(?:110\.49|233\.64)|03\.217\.145)|8(?:1\.93\.155|4\.53\.196|8\.191\.94)|78\.108\.79)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -112,7 +112,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:0\.232\.107|8\.165\.219|7\.45\.198)|1(?:1\.224\.250|8\.45\.115)|73\.245\.20[45])|8(?:5\.26\.(?:1(?:6[45]|84)|231)|3\.149\.(?:38?|21)|8\.191\.94)|9(?:1\.121\.(?:106|208)|4\.23\.242)|21(?:7\.118\.(?:81|90)|0\.59\.187)|61\.155\.5)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:0\.232\.107|8\.165\.219|7\.45\.198)|1(?:1\.224\.250|8\.45\.115)|73\.245\.20[45])|8(?:5\.26\.(?:1(?:6[45]|84)|231)|3\.149\.(?:38?|21))|21(?:7\.118\.(?:81|90)|0\.59\.187)|9(?:1\.121\.106|4\.23\.242)|61\.155\.5)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -130,7 +130,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:9\.(?:20(?:0\.(?:1(?:39\.233|46\.2)|84\.51)|2\.150\.92)|199\.210\.193|82\.65\.199)|8\.(?:4(?:5\.115\.1(?:33|42)|0\.201\.217|1\.208\.174)|233\.164\.84)|1\.2(?:24\.250\.1(?:3[245]|29)|53\.41\.76)|5\.2(?:3\.(?:14\.112|88\.199)|2\.125\.210)|4\.3(?:8\.201\.246|6\.29\.159)|2\.187\.97\.106|6\.36\.250\.143)|2(?:1\.(?:1(?:5(?:1\.140\.194|0\.105\.87)|47\.(?:135\.74|201\.27)|80\.(?:170\.203|50\.96)|78\.226\.229)|243\.204\.229)|4\.(?:123\.112\.151|56\.149\.35|7\.20\.77)|2\.(?:128\.71\.169|248\.11\.54)|5\.13(?:5\.148\.246|7\.24\.238)|3\.228\.80\.178)|9(?:0\.(?:(?:(?:246\.186\.2|18\.127\.)3|60\.203\.16)3|80\.239\.92)|5\.(?:1(?:91\.58\.1?4|3\.179\.28|61\.9\.2)|98\.166\.138)|6\.2(?:01\.196\.57|6\.153\.85)|3\.34\.173\.250|4\.44\.123\.212)|8(?:8\.(?:165\.(?:195\.14|219\.11)4|241\.66\.68)|2\.(?:211\.103\.153|71\.45\.230)|7\.(?:45\.198\.159|92\.208\.114)|6\.87\.115\.50|3\.83\.3\.254)|09\.(?:1(?:60\.141\.194|73\.37\.225)|2(?:29\.241\.137|
30\.56\.49)|8(?:7\.133\.245|6\.28\.228))|7(?:8\.(?:1(?:50\.153\.146|75\.80\.194)|219\.244\.132)|3\.244\.221\.228)|51\.45\.121\.222|4\.48\.94\.163)|2(?:1(?:3\.(?:1(?:75\.2(?:17\.246|01\.90)|10\.49\.174)|251\.169\.75)|1\.(?:107\.185\.163|226\.179\.152)|7\.1(?:59\.145\.115|14\.13\.127)|2\.(?:200\.117\.230|1\.103\.94)|0\.(?:125\.251\.1|59\.187\.44)|9\.8(?:4\.3\.113|5\.232\.5)|6\.17\.102\.48|8\.159\.75\.20)|0(?:3\.(?:7(?:0\.110\.70|3\.34\.247)|142\.24\.175)|1\.(?:230\.163\.194|76\.50\.82)|0\.4(?:6\.186\.82|5\.71\.36)|6\.81\.170\.129|7\.126\.56\.60|9\.239\.40\.14)|2(?:0\.(?:8(?:0\.1(?:(?:93\.15|45\.2)6|73\.52)|4\.29\.159)|71\.140\.2)|2\.1(?:02\.144\.18|64\.67\.31))|7\.96\.84\.8)|8(?:9\.(?:1(?:8(?:9\.169\.77|4\.1\.232)|(?:41\.4\.18|12\.8\.4)0|05\.236\.194)|2(?:05\.(?:46\.113|94\.86)|21\.26\.188))|5\.1(?:98\.1(?:64\.225|71\.103|86\.234)|86\.200\.179)|3\.1(?:4(?:2\.111\.2[23]8|9\.125\.36)|51\.4\.228)|0\.(?:227\.12\.166|77\.154\.135|80\.116\.129)|1\.(?:2(?:8\.96\.230|1\.5\.166)|93\.15
5\.140)|8\.1(?:9(?:1\.94\.230|8\.26\.162)|56\.24\.79)|7\.2(?:28\.122\.108|37\.210\.174)|2\.1(?:65\.149\.152|14\.80\.236)|4\.53\.196\.245)|9(?:1\.(?:1(?:21\.(?:1(?:06\.24|35\.66)|208\.138)|9(?:2\.165\.162|5\.230\.14))|20(?:5\.147\.194|2\.3\.82))|2\.(?:1(?:27\.141\.206|14\.67\.148)|24(?:1\.107\.205|2\.99\.182)|82\.227\.224)|3\.(?:7(?:3\.(?:91\.124|16\.63)|5\.215\.184|9\.87\.182|2\.249\.6)|125\.2\.169)|4\.(?:7(?:5\.243\.135|8\.224\.119)|2(?:3\.242\.67|5\.90\.84)|153\.232\.178)|5\.(?:(?:226\.(?:174\.1|37\.13)|83\.172\.7)3|170\.180\.251)|0\.189\.168\.214)|7(?:7\.(?:1(?:0(?:6\.232\.178|8\.98\.177)|2(?:0\.70\.195|2\.83\.252))|2(?:43\.116\.65|39\.255\.6))|8\.(?:9(?:7\.136\.11|6\.86\.13)3|108\.79\.154)|9\.(?:124\.92\.164|5\.202\.168)|4\.(?:204\.174\.2|86\.77\.)2|2\.55\.174\.13)|6(?:1\.(?:1(?:55\.5\.247|9\.250\.69)|60\.2(?:45\.155|14\.3)|8\.203\.58|35\.56\.2)|(?:3\.111\.248\.|5\.49\.36\.1)63|2\.1(?:61\.248\.197|49\.163\.43)|9\.161\.222\.131)|4(?:1\.1(?:4(?:0\.253\.108|1\.252\.125)|37\
.(?:2[04]|56)\.4)|6\.72\.141\.46)|59\.(?:1(?:(?:12\.239|89\.224)\.102|51\.228\.36)|21\.61\.238))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:8\.(?:4(?:5\.115\.1(?:33|42)|0\.201\.217|1\.208\.174)|233\.1(?:64\.84|73\.98)|169\.75\.96)|9\.(?:20(?:0\.(?:1(?:39\.233|46\.2)|84\.51)|2\.150\.92)|199\.210\.193|82\.65\.199)|1\.(?:2(?:24\.250\.1(?:29|35|8)|53\.4(?:0\.81|1\.76))|68\.111\.194)|5\.(?:2(?:3\.(?:14\.112|88\.199)|2\.125\.210)|119\.48\.226)|4\.3(?:8\.201\.246|6\.29\.159)|2\.187\.97\.106|6\.15\.159\.78)|2(?:1\.(?:1(?:5(?:1\.140\.194|0\.105\.87)|78\.226\.229|80\.170\.203|47\.201\.27)|243\.204\.229)|2\.(?:1(?:28\.71\.169|83\.228\.38)|(?:248\.11\.5|55\.106\.)4)|5\.(?:13(?:5\.148\.246|7\.24\.238)|229\.118\.228)|4\.(?:123\.112\.151|56\.149\.35|7\.20\.77)|3\.(?:228\.80\.178|195\.18\.42))|9(?:0\.(?:2(?:46\.186\.233|\.237\.100)|(?:60\.203\.16|18\.127\.3)3|80\.239\.92)|5\.(?:1(?:3\.179\.28|91\.58\.4|61\.9\.2)|98\.166\.138)|6\.2(?:01\.196\.57|6\.153\.85)|4\.44\.123\.212)|8(?:8\.(?:165\.(?:195\.14|219\.11)4|241\.66\.68)|2\.(?:211\.103\.153|71\.45\.230)|7\.(?:45\.198\.15
9|92\.208\.114)|6\.87\.115\.50|3\.83\.3\.254)|7(?:8\.(?:1(?:50\.153\.146|75\.80\.194)|219\.244\.132)|3\.244\.221\.228|5\.215\.185\.107)|09\.(?:2(?:29\.241\.137|30\.56\.49)|8(?:7\.133\.245|6\.28\.228)|160\.141\.194)|51\.45\.121\.222|4\.48\.94\.163)|2(?:1(?:3\.1(?:75\.2(?:17\.246|01\.90)|10\.49\.174|98\.64\.1)|0\.(?:216\.151\.98|125\.251\.1|59\.187\.44)|1\.(?:107\.185\.163|226\.179\.152)|7\.1(?:59\.145\.115|14\.13\.127)|2\.(?:200\.117\.230|1\.103\.94)|9\.8(?:4\.3\.113|5\.232\.5)|6\.17\.102\.48|8\.159\.75\.20)|0(?:1\.(?:(?:197\.104\.25|230\.163\.19)4|76\.50\.82)|0\.(?:4(?:6\.186\.82|5\.71\.36)|178\.100\.66)|3\.7(?:0\.110\.70|3\.34\.247)|7\.126\.56\.60|9\.239\.40\.14)|2(?:0\.(?:8(?:0\.1(?:(?:93\.15|45\.2)6|73\.52)|4\.29\.159)|71\.140\.2)|2\.1(?:02\.144\.18|64\.67\.31))|7\.96\.84\.8)|9(?:1\.(?:1(?:21\.(?:1(?:06\.24|35\.66)|208\.138)|9(?:2\.165\.162|5\.230\.14))|20(?:5\.147\.194|2\.3\.82))|3\.(?:7(?:3\.(?:91\.124|16\.63)|5\.215\.184|9\.87\.182|2\.249\.6)|1(?:57\.148\.102|25\.2\.16
9))|4\.(?:2(?:3(?:2\.8\.17|\.242\.6)7|5\.90\.84)|153\.232\.178|78\.224\.119)|5\.(?:226\.(?:174\.1|37\.13)3|83\.1(?:32\.91|72\.73)|170\.180\.251)|2\.(?:1(?:27\.141\.206|14\.67\.148)|24(?:1\.107\.205|2\.99\.182))|0\.189\.168\.214)|8(?:5\.(?:1(?:98\.1(?:64\.225|86\.234)|86\.200\.179)|238\.43\.242|30\.64\.99)|9\.(?:1(?:(?:41\.4\.18|12\.8\.4)0|84\.1\.232)|205\.(?:46\.113|94\.86))|3\.1(?:4(?:2\.111\.2[23]8|9\.125\.36)|51\.4\.228)|0\.(?:227\.12\.166|77\.154\.135|80\.116\.129)|1\.(?:2(?:8\.96\.230|1\.5\.166)|93\.155\.140)|2\.1(?:65\.149\.152|14\.80\.236)|4\.(?:53\.196\.245|22\.49\.166)|8\.19(?:1\.94\.230|8\.26\.162)|7\.228\.122\.108)|7(?:7\.(?:1(?:0(?:6\.232\.178|8\.98\.177)|2(?:0\.241\.28|2\.83\.252))|2(?:43\.116\.65|39\.255\.6))|8\.(?:9(?:7\.136\.11|6\.86\.13)3|108\.79\.154)|9\.(?:124\.92\.164|5\.202\.168)|4\.(?:204\.174\.2|86\.77\.)2|2\.55\.174\.13)|6(?:1\.(?:1(?:55\.5\.247|9\.250\.69)|47\.197\.124|60\.214\.3|35\.56\.2)|2\.161\.248\.197|3\.111\.248\.63)|4(?:1\.1(?:4(?:0\.253\.108
|1\.252\.125)|37\.(?:2[04]|56)\.4)|6\.72\.141\.46)|59\.(?:1(?:(?:12\.239|89\.224)\.102|51\.228\.36)|21\.61\.238))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -147,14 +147,14 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# Spamhaus DROP, http://www.spamhaus.org/drop/
-header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123
]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3
\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|
0\.(?:141|230)|2\.147|5\.190)|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|13|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|09\.(?:94\.21[2345]|196\.140))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|8
1\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:1(?:45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:2(?:0(?:
1\.(?:[457]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789])|6[4567]?)|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|6\.(?:1(?:4?1|22|90)|232|7?3)|1\.(?:6[4567]|8[89]|9[01])|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:4[69]|5[01])|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:64\.(?:1[013]|3[789]|9[89]?|5[69]|45|61)|21(?:[67]|5\.14[0123])))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:5
0\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|2\.1(?:9\.(?:[0789]|2(?:[01236789]|5[012345]?|4[89]?)?|6[01234567]?|[1345]\d?)|8(?:2\.15[23456789]|\.252)|22\.(?:3[23456789]|7[23]))|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|\.0\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|9\.(?:114\.97?|45\.14)|6\.55\.(?:140|243)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345])|31\.222\.20[0
1234567])\b)/
+header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123
]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3
\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|
0\.(?:141|230)|2\.147|5\.190)|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|13|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|09\.(?:94\.21[2345]|196\.140))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|8
1\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:1(?:45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:2(?:0(?:
1\.(?:[457]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789])|6[4567]?)|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|6\.(?:1(?:4?1|22|90)|232|7?3)|1\.(?:6[4567]|8[89]|9[01])|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:4[69]|5[01])|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:64\.(?:1[013]|3[789]|9[89]?|5[69]|45|61)|21(?:[67]|5\.14[0123])))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:5
0\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|2\.1(?:9\.(?:[0789]|2(?:[01236789]|5[012345]?|4[89]?)?|6[01234567]?|[1345]\d?)|8(?:2\.15[23456789]|\.252)|22\.(?:3[23456789]|7[23]))|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|\.0\.(?:[0789]|[12345]\d?|6[0123]?)|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|9\.(?:114\.97?|45\.14)|6\.55\.(?:140|243)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345])|31\.222\.20[01234567])\b)/
describe KHOP_SPAMHAUS_DROP Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP nopublish
score KHOP_SPAMHAUS_DROP 1 0.2 1 0.2
# spam/ham s/o corpus
# 0.0349/0.0029 0.924 20110227@510k
-header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789
]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20
[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|
9\.2)23|0\.(?:141|230)|2\.147|5\.190)|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|13|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|09\.(?:94\.21[2345]|196\.140))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[
01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:1(?:45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:
2(?:0(?:1\.(?:[457]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789])|6[4567]?)|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|6\.(?:1(?:4?1|22|90)|232|7?3)|1\.(?:6[4567]|8[89]|9[01])|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:4[69]|5[01])|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:64\.(?:1[013]|3[789]|9[89]?|5[69]|45|61)|21(?:[67]|5\.14[0123])))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?
))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|2\.1(?:9\.(?:[0789]|2(?:[01236789]|5[012345]?|4[89]?)?|6[01234567]?|[1345]\d?)|8(?:2\.15[23456789]|\.252)|22\.(?:3[23456789]|7[23]))|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|\.0\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|9\.(?:114\.97?|45\.14)|6\.55\.(?:140|243)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345])|31\.2
22\.20[01234567])\b)/
+header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789
]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20
[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|
9\.2)23|0\.(?:141|230)|2\.147|5\.190)|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|13|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|09\.(?:94\.21[2345]|196\.140))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[
01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:1(?:45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:
2(?:0(?:1\.(?:[457]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789])|6[4567]?)|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|6\.(?:1(?:4?1|22|90)|232|7?3)|1\.(?:6[4567]|8[89]|9[01])|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:4[69]|5[01])|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:64\.(?:1[013]|3[789]|9[89]?|5[69]|45|61)|21(?:[67]|5\.14[0123])))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?
))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|2\.1(?:9\.(?:[0789]|2(?:[01236789]|5[012345]?|4[89]?)?|6[01234567]?|[1345]\d?)|8(?:2\.15[23456789]|\.252)|22\.(?:3[23456789]|7[23]))|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|\.0\.(?:[0789]|[12345]\d?|6[0123]?)|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|9\.(?:114\.97?|45\.14)|6\.55\.(?:140|243)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345])|31\.222\.20[01234567])\b)/
describe KHOP_SPAMHAUS_DROP_LE Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP_LE nopublish
score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 # adds to KHOP_SPAMHAUS_DROP
@@ -164,7 +164,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:2(?:1(?:3\.87\.(?:1(?:2[01389]|3[467]|42)|7[46])|7\.(?:118\.(?:83|90)|66\.146))|23\.252\.1(?:6[013578]|7[01235])|02\.152\.243)|1(?:1(?:4\.112\.2(?:3[016789]|2[67])|1\.224\.250|3\.162\.77)|25\.23(?:4\.144|5\.192)|80\.232\.107)|8(?:5\.(?:26\.(?:1(?:6[45]|8[46]|55)|2[34]1)|115\.248)|3\.149\.(?:[89]|4[4567]|3[68]?|21))|(?:36\.37\.23|61\.19\.6)6|41\.189\.57)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:2(?:1(?:3\.87\.(?:1(?:2[01389]|3[467]|42)|7[46])|7\.(?:118\.(?:83|90)|66\.146))|23\.252\.1(?:6[0134578]|7[01235])|02\.152\.243)|1(?:1(?:4\.112\.2(?:3[016789]|2[67])|1\.224\.250|3\.162\.77)|25\.23(?:4\.144|5\.192)|80\.232\.107)|8(?:5\.(?:26\.(?:1(?:6[45]|8[46]|55)|2[34]1)|115\.248)|3\.149\.(?:[89]|4[4567]|3[68]?|21))|(?:36\.37\.23|61\.19\.6)6)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6