You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/09/18 07:57:15 UTC
svn commit: r1172202 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sun Sep 18 05:57:15 2011
New Revision: 1172202
URL: http://svn.apache.org/viewvc?rev=1172202&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1172202&r1=1172201&r2=1172202&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sun Sep 18 05:57:15 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201109171
+## khop-sc-neighbors.cf v 201109181
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:12[23]|41|59)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:13|22|90)|59)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -40,7 +40,7 @@ score KHOP_SC_CIDR8 0.3 0.1 0.3 0.1
# 12.1449/0.0139 0.999 20100410 net, solo=12.1966/0.0197@0.998, ->.2 .1 .3 .2
# 10.3554/0.0112 0.999 20110227@510k solo=10.3717/0.0119@0.999, ->.3 .1 .3 .1
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b1(?:1[37]|78|82)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|78|82)|41)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -93,7 +93,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:25\.110\.1(?:1[02579]|0[69]|22)|1(?:1\.224\.250|3\.162\.67))|2(?:23\.255\.226|13\.233\.64)|8(?:4\.235\.73|3\.149\.2)|60\.181\.162)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:25\.110\.1(?:0[1369]|1[0378]|22)|11\.224\.250)|2(?:23\.255\.226|13\.233\.64)|8(?:4\.235\.73|3\.149\.2))\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -112,7 +112,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[46])|2(?:3[12345]|41))|115\.248)|3\.149\.(?:3[458]?|4[456]|21))|1(?:2(?:5\.110\.(?:1(?:0[1357]|2[04]|11)|96)|2\.155\.36)|73\.245\.20[45]|09\.127\.86)|2(?:1(?:7\.118\.(?:8[13]|90)|3\.87\.74)|0(?:9\.205\.22[67]|2\.152\.243))|6(?:0\.181\.16[15]|1\.19\.66)|41\.254\.1)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[46])|2(?:3[12345]|41))|115\.248)|3\.149\.(?:3[458]?|4[4567]|21))|1(?:2(?:5\.110\.(?:1(?:1[159]|0[57]|2[04])|96)|2\.155\.36)|73\.245\.20[45]|09\.127\.86)|2(?:1(?:7\.118\.(?:8[13]|90)|3\.87\.74)|0(?:9\.205\.22[67]|2\.152\.243))|6(?:0\.181\.16[15]|1\.19\.66)|41\.254\.1)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -130,7 +130,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:2(?:5\.110\.(?:1(?:1(?:7\.(?:100|46|51)|5\.(?:16|93|8)|9\.(?:163|55)|3\.24[568]|0\.224|2\.203|1\.0)|0(?:7\.1(?:7[04]|06|89)|(?:3\.2|9\.)34|5\.1(?:2?4|07)|1\.73|6\.15)|2(?:0\.(?:1(?:12|7)|57)|2\.240|1\.91|4\.79))|96\.(?:1(?:02|94)|200))|3\.(?:19(?:3\.1(?:12\.177|78\.170)|5\.68\.72)|27\.255\.95)|4\.106\.113\.216)|1(?:4\.(?:4(?:3\.(?:198\.97|205\.83)|1\.232\.177|4\.113\.162)|27\.18(?:7\.120|3\.87))|1\.(?:224\.250\.(?:2(?:4[4567]|11)|1(?:17|31))|185\.231\.169)|8\.(?:23(?:3\.1(?:80\.242|\.26)|2\.201\.35)|97\.15\.18)|2\.1(?:05\.113\.217|33\.146\.164)|7\.(?:239\.10\.18|6\.130\.230)|3\.193\.186\.90|9\.69\.172\.89)|9(?:5\.(?:1(?:61\.(?:40\.10|9\.2)|44\.251\.28)|98\.185\.138|205\.141\.3)|0\.2(?:00\.145\.42|6\.118\.123)|4\.126\.183\.120|6\.217\.241\.101|9\.115\.164\.38|3\.84\.22\.14)|78\.(?:(?:219\.192\.1|46\.130\.)4|79\.1(?:8\.232|3\.83)|151\.241\.155)|8(?:8\.(?:231\.142\.229|168\.46\.53)|2\.71\.15\.170|0\.94\.93\.5)|09\.(?:(?:227\
.239\.1|70\.184\.)22|68\.234\.4))|2(?:1(?:1\.(?:4(?:7\.102\.187|5\.126\.81)|226\.179\.152|107\.49\.126)|9\.(?:7(?:0\.4(?:2\.227|3\.245)|6\.237\.44)|147\.19\.50)|2\.113\.44\.238|8\.248\.44\.196|7\.26\.6\.74)|0(?:(?:1\.211\.137\.10|3\.160\.55\.8|7\.157\.30\.6)6|2\.(?:126\.91\.246|29\.129\.160)|0\.2(?:04\.32\.177|20\.196\.15)|4\.236\.121\.172|9\.239\.40\.14)|2(?:2\.(?:124\.1(?:54\.170|98\.167)|231\.57\.191)|0\.190\.61\.12)|\.3(?:8\.97\.22|7\.7\.4)7|7\.110\.203\.29|4\.79\.106\.38)|9(?:1\.(?:1(?:8(?:6\.207\.210|8\.112\.1)|21\.7(?:5\.209|4\.33))|2(?:06\.126\.241|23\.136\.253|14\.18\.6))|3\.(?:7(?:3\.1(?:32\.79|6\.63)|2\.239\.221|4\.232\.137)|1(?:57\.148\.102|90\.107\.236))|5\.(?:1(?:72\.124\.182|40\.204\.53|91\.153\.7)|(?:226\.174\.1|76\.237\.4)3|83\.130\.82)|2\.(?:1(?:27\.141\.206|14\.65\.149)|246\.152\.179)|4\.2(?:45\.156\.33|0\.106\.27))|8(?:9\.(?:1(?:(?:69\.206\.16|23\.126\.5)7|41\.4\.180)|205\.46\.113)|3\.2(?:16\.204\.25|29\.48\.222|38\.238\.71|\.31\.136)|7\.(?:2(?:21\.156\.3
0|04\.79\.21)|97\.237\.206)|8\.(?:103\.121\.212|247\.21\.121|81\.231\.124)|6\.(?:122\.61\.204|57\.251\.55)|1\.(?:23\.193\.107|9\.70\.100)|5\.221\.180\.218|2\.151\.210\.15|4\.20\.241\.123|0\.55\.219\.2)|6(?:0\.181\.16(?:1\.1(?:16|22|35)|(?:2\.6|7\.2)4|6\.2(?:02|11)|5\.2(?:40|1))|1\.(?:2(?:0\.149\.111|16\.205\.92|27\.186\.65)|47\.197\.124)|2\.(?:1(?:28\.152\.150|48\.76\.45)|33\.191\.66|77\.64\.15)|9\.(?:171\.130\.190|73\.172\.155)|4\.(?:62\.128\.247|235\.50\.19)|6\.234\.232\.130|8\.37\.252\.194|5\.98\.224\.52)|7(?:7\.(?:1(?:06\.232\.17|20\.241\.2)8|81\.199\.69|35\.28\.17)|8\.(?:1(?:29\.170\.41|07\.82\.98)|97\.191\.68)|9\.124\.92\.164)|4(?:1\.(?:137\.(?:2[04]|56)\.|208\.106\.24)4|6\.(?:186\.9\.237|55\.176\.98))|5(?:9\.126\.177\.154|8\.227\.41\.247))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:2(?:5\.110\.(?:1(?:1(?:3\.(?:2(?:4[568]|20)|132)|9\.(?:1(?:0[78]|63)|55)|5\.(?:(?:20|9)3|16|8)|8\.(?:162|207|88)|7\.(?:100|46|51)|4\.(?:211|59)|6\.1(?:04|59)|0\.224|2\.203|1\.0)|0(?:7\.1(?:7[04]|06|89)|(?:3\.2|9\.)34|5\.1(?:2?4|07)|1\.(?:164|73)|6\.15)|2(?:0\.(?:1(?:12|7)|57)|2\.240|1\.91|4\.79))|96\.(?:1(?:02|94)|200))|3\.(?:19(?:3\.112\.177|5\.68\.72)|27\.255\.95)|4\.106\.113\.216|2\.117\.44\.238)|1(?:8\.(?:23(?:3\.1(?:80\.242|\.26)|2\.201\.35)|40\.236\.134|97\.15\.18)|1\.(?:224\.250\.(?:2(?:4[4567]|1[15])|117)|185\.231\.169)|7\.(?:2(?:11\.83\.131|39\.10\.18)|6\.130\.230)|4\.27\.18(?:7\.120|3\.87)|2\.133\.146\.164|3\.193\.186\.90|9\.69\.172\.89)|9(?:5\.(?:1(?:61\.(?:40\.10|9\.2)|44\.251\.28)|98\.185\.138|205\.141\.3)|0\.2(?:00\.145\.42|6\.118\.123)|4\.126\.183\.120|6\.217\.241\.101|3\.84\.22\.14)|8(?:8\.(?:231\.142\.229|168\.46\.53|55\.215\.38)|4\.107\.177\.82|2\.71\.15\.170|0\.94\.93\.5)|78\.(?:79\.1(?:8\.232|3\.83)|15
1\.241\.155|219\.192\.14)|09\.(?:(?:227\.239\.1|70\.184\.)22|68\.234\.4))|2(?:1(?:1\.(?:4(?:7\.102\.187|5\.126\.81)|226\.179\.152|107\.49\.126)|9\.(?:7(?:0\.4(?:2\.227|3\.245)|6\.237\.44)|147\.19\.50)|7\.2(?:5\.215\.228|6\.6\.74)|8\.248\.44\.196|2\.78\.227\.53)|0(?:2\.(?:126\.91\.246|29\.129\.160)|7\.(?:218\.237\.18|157\.30\.66)|4\.236\.121\.172|0\.220\.196\.15|3\.160\.55\.86|9\.239\.40\.14)|22\.(?:124\.1(?:54\.170|98\.167)|231\.57\.191)|7\.110\.203\.29|4\.79\.106\.38)|9(?:1\.(?:1(?:8(?:6\.207\.210|8\.112\.1)|21\.7(?:5\.209|4\.33)|90\.232\.8)|2(?:06\.126\.241|23\.136\.253|14\.18\.6))|3\.(?:7(?:3\.1(?:32\.79|6\.63)|2\.239\.221|4\.232\.137)|1(?:57\.148\.102|90\.107\.236))|5\.(?:(?:226\.174\.1|76\.237\.4)3|1(?:40\.204\.53|91\.153\.7)|83\.130\.82)|2\.(?:1(?:27\.141\.206|14\.65\.149)|246\.152\.179)|4\.2(?:45\.156\.33|0\.106\.27))|8(?:9\.(?:1(?:(?:69\.206\.16|23\.126\.5)7|41\.4\.180)|205\.46\.113)|3\.2(?:3(?:9\.158\.165|8\.238\.71)|16\.204\.25|29\.48\.222)|7\.(?:2(?:21\.156\.30|04
\.79\.21)|97\.237\.206)|6\.(?:(?:57\.251\.5|98\.93\.14)5|122\.61\.204)|5\.(?:221\.180\.218|198\.105\.70)|8\.(?:103\.121\.212|81\.231\.124)|1\.23\.193\.107|2\.151\.210\.15|4\.20\.241\.123|0\.55\.219\.2)|6(?:1\.(?:2(?:0\.149\.111|27\.186\.65)|(?:47\.197\.12|12\.19\.8)4)|2\.(?:1(?:28\.152\.150|48\.76\.45)|33\.191\.66|77\.64\.15)|0\.181\.16(?:1\.1(?:16|22|35)|5\.2(?:40|1)|2\.64)|9\.(?:171\.130\.190|73\.172\.155)|8\.37\.252\.194|5\.98\.224\.52)|7(?:7\.(?:1(?:06\.232\.17|20\.241\.2)8|81\.199\.69|35\.28\.17)|8\.(?:129\.170\.41|97\.191\.68)|9\.124\.92\.164)|4(?:1\.(?:137\.(?:2[04]|56)\.|208\.106\.24)4|6\.(?:186\.9\.237|55\.176\.98))|5(?:9\.126\.177\.154|8\.227\.41\.247))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -147,14 +147,14 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# Spamhaus DROP, http://www.spamhaus.org/drop/
-header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456
789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89]|3\.14[4567])|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|4\.(
?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|1\.136\.22|0\.170)|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]
\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|88\.(?:2(?:12\.(?:[023456789]|1[012345]?)|29\.(?:9[012347]|8[89]|13|35))|1(?:70\.19[23456789]|30\.25[01]))|09\.(?:94\.21[2345]|196\.140))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01])|25\.(?:159|210))|4(?:8\.(?:6[456789]|9[012345]|[78]\d)|4\.(?:19[23456789]|20[01234567]))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|63\.1(?:4[456789]|5[01])|89\.224)|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]
\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|9\.(?:1(?:82\.(?:6[456789]|9[012345]|[78]\d)|45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|2\.(?:61\.1(?:08|27)|59\.236)|3\.3(?:1\.8[89]|4\.7[01]))|1(?:6\.
(?:212\.(?:2(?:2[0123]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|6\.(?:1(?:4?1|22|90)|232|7?3)|1\.(?:6[4567]|8[89]|9[01])|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:(?:3\.(?:19|7)|6\.23)[2345]|8\.(?:1(?:2[57]|09)|217)|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:8\.(?:2(?:5[012345]|4\d)|6[456789]|7\d)|4\.1(?:[345678]\d|2[89]|9[01]))|26\.1(?:7[6789]|8[0123])|3[01])|6(?:3\.(?:1(?:4[69]|5[01])|24[0134567])|0\.12[123])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\
.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:64\.(?:4[3456]|3[789]|5[569]|9[89]?|1[13]|61)|21(?:[67]|5\.14[0123]))|\.0\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:2(?:1[01]|43)|140)|9\.(?:114\.97?|45\.14)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|1(
?:08\.225|61\.29)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|31\.(?:222\.20[01234567]|11\.43)|58\.83\.(?:[89]|1[012345]))\b)/
+header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456
789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89]|3\.14[4567])|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|4\.(
?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|1\.136\.(?:16|22)|0\.170)|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[0123456
7]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|88\.(?:2(?:12\.(?:[023456789]|1[012345]?)|29\.(?:9[012347]|8[89]|13|35))|1(?:70\.19[23456789]|30\.25[01]))|09\.(?:94\.21[2345]|196\.140))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01])|25\.(?:159|210))|4(?:8\.(?:6[456789]|9[012345]|[78]\d)|4\.(?:19[23456789]|20[01234567]))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|63\.1(?:4[456789]|5[01])|89\.224)|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|59\.180)|2(?:03\.2(?:2[456789]|5[01234
5]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|9\.(?:1(?:82\.(?:6[456789]|9[012345]|[78]\d)|45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|2\.(?:61\.1(?:08|27)|59\.236)|3\.3(?:1\.8[89]|4\.7[01]))|
1(?:6\.(?:212\.(?:2(?:2[0123]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|6\.(?:1(?:4?1|22|90)|232|7?3)|1\.(?:6[4567]|8[89]|9[01])|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:(?:3\.(?:19|7)|6\.23)[2345]|8\.(?:1(?:2[57]|09)|217)|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:8\.(?:2(?:5[012345]|4\d)|6[456789]|7\d)|4\.1(?:[345678]\d|2[89]|9[01]))|26\.1(?:7[6789]|8[0123])|3[01])|6(?:3\.(?:1(?:4[69]|5[01])|24[0134567])|0\.12[123])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.1
64)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:64\.(?:4[3456]|3[789]|5[569]|9[89]?|1[13]|61)|21(?:[67]|5\.14[0123]))|\.0\.(?:[0789]|[12345]\d?|6[0123]?))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:2(?:1[01]|43)|140)|9\.(?:114\.97?|45\.14)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|1(?:08\.225|61\.29)|5
1\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|31\.(?:222\.20[01234567]|11\.43)|58\.83\.(?:[89]|1[012345]))\b)/
describe KHOP_SPAMHAUS_DROP Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP nopublish
score KHOP_SPAMHAUS_DROP 1 0.2 1 0.2
# spam/ham s/o corpus
# 0.0349/0.0029 0.924 20110227@510k
-header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?
:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89]|3\.14[4567])|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.3
8))|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|1\.136\.22|0\.170)|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[012345
67]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|88\.(?:2(?:12\.(?:[023456789]|1[012345]?)|29\.(?:9[012347]|8[89]|13|35))|1(?:70\.19[23456789]|30\.25[01]))|09\.(?:94\.21[2345]|196\.140))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01])|25\.(?:159|210))|4(?:8\.(?:6[456789]|9[012345]|[78]\d)|4\.(?:19[23456789]|20[01234567]))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|63\.1(?:4[456789]|5[01])|89\.224)|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|59\.180)|2(?:03\.2(?:2[456789]|5[0123
45]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|9\.(?:1(?:82\.(?:6[456789]|9[012345]|[78]\d)|45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|2\.(?:61\.1(?:08|27)|59\.236)|3\.3(?:1\.8[89]|4\.7[01]))
|1(?:6\.(?:212\.(?:2(?:2[0123]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|6\.(?:1(?:4?1|22|90)|232|7?3)|1\.(?:6[4567]|8[89]|9[01])|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:(?:3\.(?:19|7)|6\.23)[2345]|8\.(?:1(?:2[57]|09)|217)|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:8\.(?:2(?:5[012345]|4\d)|6[456789]|7\d)|4\.1(?:[345678]\d|2[89]|9[01]))|26\.1(?:7[6789]|8[0123])|3[01])|6(?:3\.(?:1(?:4[69]|5[01])|24[0134567])|0\.12[123])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.
164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:64\.(?:4[3456]|3[789]|5[569]|9[89]?|1[13]|61)|21(?:[67]|5\.14[0123]))|\.0\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:2(?:1[01]|43)|140)|9\.(?:114\.97?|45\.14)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2
[89])|1(?:08\.225|61\.29)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|31\.(?:222\.20[01234567]|11\.43)|58\.83\.(?:[89]|1[012345]))\b)/
+header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?
:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89]|3\.14[4567])|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.3
8))|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|1\.136\.(?:16|22)|0\.170)|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2
[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|88\.(?:2(?:12\.(?:[023456789]|1[012345]?)|29\.(?:9[012347]|8[89]|13|35))|1(?:70\.19[23456789]|30\.25[01]))|09\.(?:94\.21[2345]|196\.140))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01])|25\.(?:159|210))|4(?:8\.(?:6[456789]|9[012345]|[78]\d)|4\.(?:19[23456789]|20[01234567]))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|63\.1(?:4[456789]|5[01])|89\.224)|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|59\.180)|2(?:03\.2(?:2[456789]
|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|9\.(?:1(?:82\.(?:6[456789]|9[012345]|[78]\d)|45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|2\.(?:61\.1(?:08|27)|59\.236)|3\.3(?:1\.8[89]|4\.
7[01]))|1(?:6\.(?:212\.(?:2(?:2[0123]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|6\.(?:1(?:4?1|22|90)|232|7?3)|1\.(?:6[4567]|8[89]|9[01])|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:(?:3\.(?:19|7)|6\.23)[2345]|8\.(?:1(?:2[57]|09)|217)|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:8\.(?:2(?:5[012345]|4\d)|6[456789]|7\d)|4\.1(?:[345678]\d|2[89]|9[01]))|26\.1(?:7[6789]|8[0123])|3[01])|6(?:3\.(?:1(?:4[69]|5[01])|24[0134567])|0\.12[123])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4
\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:64\.(?:4[3456]|3[789]|5[569]|9[89]?|1[13]|61)|21(?:[67]|5\.14[0123]))|\.0\.(?:[0789]|[12345]\d?|6[0123]?))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:2(?:1[01]|43)|140)|9\.(?:114\.97?|45\.14)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|1(?:08\.225|6
1\.29)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|31\.(?:222\.20[01234567]|11\.43)|58\.83\.(?:[89]|1[012345]))\b)/
describe KHOP_SPAMHAUS_DROP_LE Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP_LE nopublish
score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 # adds to KHOP_SPAMHAUS_DROP