You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/02/28 07:57:59 UTC
svn commit: r1075223 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Mon Feb 28 06:57:59 2011
New Revision: 1075223
URL: http://svn.apache.org/viewvc?rev=1075223&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1075223&r1=1075222&r2=1075223&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Mon Feb 28 06:57:59 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201102271
+## khop-sc-neighbors.cf v 201102281
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.(?:186\.38|233\.64)|7\.118\.(?:81|90)|8\.248\.64)|04\.110\.13)|1(?:9(?:8\.106\.26|5\.161\.9)|13\.162\.(?:118|77)|78\.49\.255)|8(?:1\.192\.211|5\.26\.225)|(?:58\.150\.5|62\.183\.8)5|9(?:1\.203\.67|8\.139\.91)|77\.232\.142|41\.137\.24)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:3\.162\.(?:118|240|77)|8\.96\.203)|9(?:8\.106\.26|5\.161\.9)|78\.49\.255)|21(?:3\.(?:2(?:26\.63|33\.64)|186\.38)|7\.118\.(?:81|90)|8\.248\.64)|8(?:5\.2(?:5\.13|6\.22)5|3\.149\.21|0\.65\.16)|9(?:5\.129\.166|1\.203\.67|8\.139\.91)|41\.(?:137\.24|254\.1)|62\.183\.85)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.(?:87\.(?:1(?:28|36)|74)|233\.64)|7\.(?:118\.(?:83|90)|66\.146|8\.225))|0(?:(?:(?:4\.11|0\.8)0\.1|2\.152\.24)3|3\.82\.95))|8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|1\.192\.(?:2(?:1[15]|38)|199)|3\.149\.(?:38?|21)|2\.178\.69|8\.190\.12)|1(?:1(?:3\.162\.244|6\.121\.230)|84\.82\.128|95\.91\.70)|9(?:(?:1\.121\.22|6\.44\.17)1|5\.154\.240)|6(?:1\.19\.6[56]|0\.199\.201)|41\.95\.4)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.(?:87\.(?:1(?:28|36)|74)|233\.64)|7\.(?:118\.(?:83|90)|66\.146|8\.225))|0(?:(?:(?:4\.11|0\.8)0\.1|2\.152\.24)3|3\.82\.95))|8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|1\.192\.(?:2(?:1[15]|38)|199)|3\.149\.(?:38?|21)|2\.178\.69|8\.190\.12)|9(?:(?:1\.121\.22|6\.44\.17)1|5\.154\.240)|1(?:22\.55\.106|95\.91\.70)|6(?:0\.199\.201|1\.19\.66)|41\.95\.4)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:0\.(?:2(?:(?:45\.157\.21|05\.182\.8)1|5\.242\.179|16\.41\.94)|79\.205\.152|101\.53\.33|4\.48\.130)|8\.10(?:6\.26\.(?:37|45|72)|9\.51\.252)|5\.16(?:1\.(?:40\.10|9\.2)|0\.253\.4)|3\.226\.161\.154|4\.225\.28\.202)|8(?:8\.(?:2(?:07\.130\.206|42\.66\.21)|154\.157\.104|62\.69\.142)|7\.(?:141\.(?:102\.198|84\.87)|66\.16\.83)|4\.82\.128\.[34]|0\.230\.249\.62|3\.99\.46\.115)|2(?:2\.(?:16(?:9\.249\.87|6\.11\.64)|252\.234\.75)|\.(?:155\.164\.162|52\.153\.246)|4\.243\.13\.16|3\.27\.79\.11)|1(?:3\.1(?:6(?:0\.(?:196\.110|225\.215)|2\.237\.235)|72\.35\.2)|5\.113\.53\.35|6\.50\.210\.90)|7(?:3\.2(?:10\.25\.146|9\.247\.70)|5\.115\.92\.120|8\.49\.255\.104)|09\.(?:121\.130\.78|66\.119\.189|73\.85\.184)|51\.100\.65\.168)|2(?:1(?:2\.(?:1(?:(?:74\.243\.14|20\.246\.8)6|99\.29\.145)|85\.(?:101\.94|97\.169)|248\.42\.19)|6\.(?:17(?:0\.88\.196|6\.16\.202)|87\.190\.50)|7\.(?:2(?:1\.247\.82|6\.6\.97)|151\.78\.134)|(?:9\.149\.164\.14|3\.186\.38\.3)
8|(?:8\.248\.44\.19|0\.122\.170\.)6)|0(?:1\.(?:(?:116\.224\.24|55\.165\.13)4|22\.56\.36)|9\.(?:1(?:21\.198\.94|56\.45\.190)|26\.153\.3)|3\.(?:144\.221\.146|248\.186\.72)|8\.(?:131\.186\.|89\.28\.5)2|4\.188\.168\.11|5\.158\.54\.195|0\.80\.13\.66|2\.28\.24\.99)|4\.(?:218\.163\.223|11\.192\.241)|22\.252\.223\.2)|6(?:7\.(?:1(?:8(?:7\.215\.197|2\.46\.232)|74\.247\.101|5\.97\.82)|2(?:3(?:0\.181\.234|7\.220\.98)|05\.199\.18)|58\.92\.55)|9\.(?:1(?:0(?:4\.131\.230|8\.142\.225)|99\.1(?:64\.222|8\.28)|81\.9\.71)|6(?:4\.155\.181|6\.241\.44)|250\.113\.122)|5\.(?:40\.(?:14\.134|95\.123)|183\.197\.46|34\.204\.27|206\.8\.1)|8\.(?:(?:5(?:7\.251\.23|8\.19\.18)|82\.113\.22)0|114\.57\.129)|4\.1(?:6\.1(?:30\.16|28\.4)2|48\.129\.140|27\.37\.68)|6\.(?:239\.77\.194|83\.215\.138|158\.48\.2)|0\.(?:199\.201\.120|32\.127\.131)|2\.140\.253\.15)|7(?:1\.(?:2(?:3(?:9\.144\.23|4\.26\.10)3|49\.187\.225)|125\.12\.15|80\.23\.123)|6\.(?:1(?:2(?:0\.13\.239|6\.40\.233)|6\.124\.157)|77\.225\.192|0\.150\.140)|7\.(?
:2(?:52\.116\.4|32\.83\.)2|198\.16\.108|78\.183\.219)|2\.(?:2(?:9\.215\.244|43\.69\.45)|46\.215\.108)|5\.(?:1(?:30\.182\.18|48\.7\.17)|61\.200\.125)|8\.(?:111\.205\.158|36\.17\.164)|9\.(?:135\.234\.184|96\.14\.31)|0\.166\.229\.75|4\.231\.181\.2)|8(?:4\.(?:1(?:09\.202\.211|5\.191\.254)|255\.203\.15|94\.100\.20|51\.44\.66)|9\.(?:1(?:61\.1(?:44\.109|89\.62)|22\.216\.26)|96\.156\.54|237\.26\.2)|3\.1(?:7(?:3\.164\.10|\.222\.25)|42\.111\.228)|7\.(?:238\.209\.101|126\.253\.24)|8\.(?:255\.153\.106|190\.12\.240)|1\.(?:143\.119\.33|255\.83\.190)|5\.(?:154\.152\.72|25\.135\.200)|2\.193\.140\.168|0\.65\.16\.71)|9(?:6\.(?:4(?:4\.171\.1(?:5[012345678]|4[789])|9\.179\.100)|33\.135\.112|226\.4\.60)|5\.1(?:70\.183\.255|54\.240\.98)|(?:4\.69\.33\.12|7\.93\.177\.)5|8\.22(?:2\.177\.17|3\.13\.4)4|1\.121\.221\.192|2\.126\.214\.177|9\.186\.105\.88|3\.91\.196\.99)|41\.(?:13(?:7\.(?:(?:24|30|56)\.4|63\.20[23])|2\.241\.65)|251\.253\.50)|5(?:0\.75\.145\.46|8\.150\.55\.59)|38\.112\.61\.60)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:0\.(?:2(?:0(?:2\.100\.188|5\.182\.81)|45\.157\.211|5\.242\.179|16\.41\.94)|79\.205\.152|30\.236\.34|4\.48\.130)|5\.(?:16(?:1\.(?:40\.10|9\.2)|0\.253\.4)|62\.62\.243)|8\.10(?:6\.26\.(?:37|45)|9\.51\.252)|4\.(?:225\.28\.20|79\.151\.)2|9\.239\.254\.46)|8(?:7\.(?:1(?:41\.(?:102\.198|84\.87)|74\.152\.150)|66\.16\.83)|4\.(?:78\.117\.100|1\.151\.12|82\.128\.4)|8\.154\.157\.104|0\.230\.249\.62|9\.100\.177\.19|3\.99\.46\.115)|2(?:2\.(?:252\.2(?:46\.234|34\.75)|169\.249\.87)|\.(?:155\.164\.162|52\.153\.246)|3\.2(?:5\.216\.100|7\.79\.11)|4\.243\.13\.16)|1(?:(?:3\.160\.196\.11|6\.50\.210\.9)0|1\.(?:224\.250\.134|118\.23\.250)|0\.139\.57\.173|5\.113\.53\.35)|7(?:3\.(?:165\.165\.117|210\.25\.146)|5\.115\.92\.120|8\.49\.255\.104)|09\.(?:121\.130\.78|66\.119\.189|73\.85\.184)|51\.100\.65\.168)|2(?:0(?:1\.(?:1(?:16\.224\.244|44\.148\.82)|55\.165\.134)|3\.(?:1(?:44\.221\.146|75\.76\.214)|248\.186\.72)|9\.(?:1(?:21\.198\.94|56\.45\.190)
|26\.153\.3)|(?:7\.118\.195\.21|2\.28\.24\.9)9|0\.(?:4\.164\.205|80\.13\.66)|4\.188\.168\.11|8\.131\.186\.2)|1(?:2\.(?:1(?:99\.29\.14|75\.170\.)5|85\.(?:101\.94|97\.169)|248\.42\.19)|6\.(?:17(?:0\.88\.196|6\.16\.202)|87\.190\.50)|(?:8\.248\.44\.19|0\.122\.170\.)6|3\.(?:57\.148\.124|186\.38\.38)|9\.149\.164\.148|7\.26\.6\.97)|4\.(?:1(?:1\.192\.241|4\.194\.214|32\.97\.18)|218\.163\.223|68\.9\.152)|22\.252\.223\.2)|6(?:7\.(?:1(?:87\.(?:151\.225|215\.197)|(?:67\.53\.21|5\.97\.8)2|74\.247\.101)|2(?:30\.181\.234|05\.199\.18)|58\.92\.55)|9\.(?:1(?:99\.1(?:64\.222|8\.28)|04\.131\.230|81\.9\.71)|6(?:4\.155\.181|6\.241\.44)|250\.113\.122)|8\.(?:(?:5(?:7\.251\.23|8\.19\.18)|82\.113\.22)0|2(?:35\.232\.200|02\.42\.141)|114\.57\.129)|5\.(?:(?:40\.95\.12|75\.94\.24)3|183\.197\.46|34\.204\.27|206\.8\.1)|0\.(?:199\.201\.120|32\.127\.131)|4\.(?:148\.129\.140|90\.72\.43)|6\.(?:58\.243\.150|158\.48\.2)|2\.140\.253\.15)|7(?:6\.(?:1(?:6\.(?:124\.15|51\.19)7|09\.252\.20|26\.40\.233)|77\.225\.192|0
\.150\.140)|1\.(?:(?:239\.144\.23|80\.23\.12)3|1(?:86\.195\.80|25\.12\.15))|8\.(?:3(?:0\.234\.240|6\.17\.164)|111\.205\.158|225\.129\.13)|9\.(?:1(?:35\.234\.184|80\.65\.188)|38\.134\.137|96\.14\.31)|7\.(?:(?:78\.183\.21|127\.22\.8)9|232\.83\.2)|0\.1(?:35\.175\.249|66\.229\.75)|2\.(?:46\.215\.108|243\.69\.45)|5\.130\.182\.18)|8(?:2\.(?:1(?:6(?:8\.84\.116|9\.93\.145)|93\.140\.168)|245\.245\.10)|9\.(?:1(?:61\.1(?:44\.109|89\.62)|49\.194\.64)|237\.26\.2)|4\.(?:15\.191\.254|94\.100\.20|51\.44\.66)|(?:7\.238\.209\.10|0\.65\.16\.7)1|3\.(?:142\.111\.228|66\.112\.150)|8\.(?:255\.153\.106|190\.12\.240)|5\.25\.135\.200|1\.93\.6\.24)|9(?:6\.(?:4(?:4\.171\.1(?:5[012345678]|4[789])|9\.179\.100)|33\.135\.112|226\.4\.60)|8\.2(?:2(?:2\.177\.17|3\.13\.4)4|10\.90\.116)|5\.1(?:70\.183\.255|54\.240\.98)|7\.(?:89\.116\.202|93\.177\.5)|(?:0\.218\.10|3\.91\.196)\.99|1\.121\.221\.192|2\.126\.214\.177|9\.186\.105\.88)|41\.13(?:7\.(?:(?:24|30|56)\.4|63\.20[23])|2\.241\.65)|5(?:0\.75\.145\.46|8\.150\.5
5\.59)|38\.112\.61\.60)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -139,13 +139,13 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# Spamhaus DROP, http://www.spamhaus.org/drop/
-header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567])|04\.[01234567])|57\.(?:6[456789]|7\d))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|9\.(?:1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|2(?:30\.(?:6[456789]|10[0123]|[789]\d)|4(?:5\.138|6\.215))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|3\.(?:1(?:
0(?:4\.(?:1(?:[47]6|10|2)|[39]4|253|41)|5\.(?:1(?:[78]4|32|41)|2(?:07|45))|6\.3[2345])|6(?:9\.25[01]|\.100)|4(?:2\.244|8\.47)|10\.136|78\.172|86\.9)|2(?:3(?:\.126(?:\.30)?|8\.[0123])|2(?:7\.24[01]|8\.145)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|2\.(?:2(?:23\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.4[4567]|47\.58)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789]|63\.14[4567])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\
d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:28|97)|2\.125|8\.151)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|4\.138\.1(?:4[456789]|5\d)|0\.(?:[27]5|120|67))|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|94\.1(?:8[456789]|9[01])|26\.24[45]|07\.208)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|
89\.224)|0\.(?:1(?:2(?:5\.1(?:7[012345]|6[89])|3\.2(?:2[456789]|3\d)|4\.16[01234567])|15\.(?:1(?:2[01234567]|[01]\d)|9[6789])|06\.1(?:4[0123]|2[89]|3\d))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|5\.(?:2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89]))|1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|72\.24[4567]))|6\.(?:2(?:2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01]))|01\.(?:6[0123]|4[89]|5\d))|197\.(?:17[567]|2[89]))|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|36\.(?:1(?:1[01]|0\d)|9[6789])|13\.(?:6[0123]|4[89]|5\d))|7\.18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:8[12]\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789
]|4[01234567]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:1(?:7[6789]|9[01]|8\d)|2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89]))|\.0\.0\.(?:[0456789]|[12]\d?|3[01]?))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|(?:2\.5|3\.9)[2345]|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|0\.17[2345]|7\.249)|2(?:0\.(?:62|90)|2\.6[4567]))|19(?:(?:3\.19|6\.23)[2345]|8\.(?:1(?:09|27)|217)|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.24[0134567])|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89
])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]|109?|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|6\.(?:98\.1(?:1[23456789]|2[01234567])|119\.2(?:2[456789]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|1\.22\.15[23]|6\.55\.243|9\.114\.9)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[0123456
7]))|58\.83\.(?:[89]|1[012345]))\b)/
+header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567])|04\.[01234567])|57\.(?:6[456789]|7\d))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|9\.(?:1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|2(?:30\.(?:6[456789]|10[0123]|[789]\d)|4(?:5\.138|6\.215))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|3\.(?:1(?:
0(?:4\.(?:1(?:[47]6|10|2)|[39]4|253|41)|5\.(?:1(?:[78]4|32|41)|2(?:07|45))|6\.3[2345])|6(?:9\.25[01]|\.100)|4(?:2\.244|8\.47)|10\.136|78\.172|86\.9)|2(?:3(?:\.126(?:\.30)?|8\.[0123])|2(?:7\.24[01]|8\.145)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|2\.(?:2(?:23\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.4[4567]|47\.58)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789]|63\.14[4567])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\
d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:28|97)|2\.125|8\.151)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|4\.138\.1(?:4[456789]|5\d)|0\.(?:[27]5|120|67))|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|94\.1(?:8[456789]|9[01])|26\.24[45]|07\.208)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|
89\.224)|0\.(?:1(?:2(?:5\.1(?:7[012345]|6[89])|3\.2(?:2[456789]|3\d)|4\.16[01234567])|15\.(?:1(?:2[01234567]|[01]\d)|9[6789])|06\.1(?:4[0123]|2[89]|3\d))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|5\.(?:2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89]))|1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|72\.24[4567]))|6\.(?:2(?:2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01]))|01\.(?:6[0123]|4[89]|5\d))|197\.(?:17[567]|2[89]))|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|36\.(?:1(?:1[01]|0\d)|9[6789])|13\.(?:6[0123]|4[89]|5\d))|7\.18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:8[12]\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789
]|4[01234567]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:1(?:7[6789]|9[01]|8\d)|2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89]))|\.0\.0\.(?:[023456789]|1[012345]?))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|(?:2\.5|3\.9)[2345]|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|0\.17[2345]|7\.249)|2(?:0\.(?:62|90)|2\.6[4567]))|19(?:(?:3\.19|6\.23)[2345]|8\.(?:1(?:09|27)|217)|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.24[0134567])|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])
|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]|109?|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|6\.(?:98\.1(?:1[23456789]|2[01234567])|119\.2(?:2[456789]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|1\.22\.15[23]|6\.55\.243|9\.114\.9)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]
))|58\.83\.(?:[89]|1[012345]))\b)/
describe KHOP_SPAMHAUS_DROP Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP nopublish
#score KHOP_SPAMHAUS_DROP 3 0 3 0
score KHOP_SPAMHAUS_DROP 0.5 0 0.5 0 # testing, see also final stanza
-header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567])|04\.[01234567])|57\.(?:6[456789]|7\d))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|9\.(?:1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|2(?:30\.(?:6[456789]|10[0123]|[789]\d)|4(?:5\.138|6\.215))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|3\
.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|[39]4|253|41)|5\.(?:1(?:[78]4|32|41)|2(?:07|45))|6\.3[2345])|6(?:9\.25[01]|\.100)|4(?:2\.244|8\.47)|10\.136|78\.172|86\.9)|2(?:3(?:\.126(?:\.30)?|8\.[0123])|2(?:7\.24[01]|8\.145)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|2\.(?:2(?:23\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.4[4567]|47\.58)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789]|63\.14[4567])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789
]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:28|97)|2\.125|8\.151)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|4\.138\.1(?:4[456789]|5\d)|0\.(?:[27]5|120|67))|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|94\.1(?:8[456789]|9[01])|26\.24[45]|07\.208)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|
52\.255|89\.224)|0\.(?:1(?:2(?:5\.1(?:7[012345]|6[89])|3\.2(?:2[456789]|3\d)|4\.16[01234567])|15\.(?:1(?:2[01234567]|[01]\d)|9[6789])|06\.1(?:4[0123]|2[89]|3\d))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|5\.(?:2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89]))|1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|72\.24[4567]))|6\.(?:2(?:2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01]))|01\.(?:6[0123]|4[89]|5\d))|197\.(?:17[567]|2[89]))|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|36\.(?:1(?:1[01]|0\d)|9[6789])|13\.(?:6[0123]|4[89]|5\d))|7\.18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:8[12]\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[
23456789]|4[01234567]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:1(?:7[6789]|9[01]|8\d)|2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89]))|\.0\.0\.(?:[0456789]|[12]\d?|3[01]?))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|(?:2\.5|3\.9)[2345]|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|0\.17[2345]|7\.249)|2(?:0\.(?:62|90)|2\.6[4567]))|19(?:(?:3\.19|6\.23)[2345]|8\.(?:1(?:09|27)|217)|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.24[0134567])|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[0123
45]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]|109?|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|6\.(?:98\.1(?:1[23456789]|2[01234567])|119\.2(?:2[456789]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|1\.22\.15[23]|6\.55\.243|9\.114\.9)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2
[01234567]))|58\.83\.(?:[89]|1[012345]))\b)/
+header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567])|04\.[01234567])|57\.(?:6[456789]|7\d))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|9\.(?:1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|2(?:30\.(?:6[456789]|10[0123]|[789]\d)|4(?:5\.138|6\.215))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|3\
.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|[39]4|253|41)|5\.(?:1(?:[78]4|32|41)|2(?:07|45))|6\.3[2345])|6(?:9\.25[01]|\.100)|4(?:2\.244|8\.47)|10\.136|78\.172|86\.9)|2(?:3(?:\.126(?:\.30)?|8\.[0123])|2(?:7\.24[01]|8\.145)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|2\.(?:2(?:23\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.4[4567]|47\.58)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789]|63\.14[4567])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789
]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:28|97)|2\.125|8\.151)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|4\.138\.1(?:4[456789]|5\d)|0\.(?:[27]5|120|67))|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|94\.1(?:8[456789]|9[01])|26\.24[45]|07\.208)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|
52\.255|89\.224)|0\.(?:1(?:2(?:5\.1(?:7[012345]|6[89])|3\.2(?:2[456789]|3\d)|4\.16[01234567])|15\.(?:1(?:2[01234567]|[01]\d)|9[6789])|06\.1(?:4[0123]|2[89]|3\d))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|5\.(?:2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89]))|1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|72\.24[4567]))|6\.(?:2(?:2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01]))|01\.(?:6[0123]|4[89]|5\d))|197\.(?:17[567]|2[89]))|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|36\.(?:1(?:1[01]|0\d)|9[6789])|13\.(?:6[0123]|4[89]|5\d))|7\.18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:8[12]\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[
23456789]|4[01234567]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:1(?:7[6789]|9[01]|8\d)|2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89]))|\.0\.0\.(?:[023456789]|1[012345]?))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|(?:2\.5|3\.9)[2345]|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|0\.17[2345]|7\.249)|2(?:0\.(?:62|90)|2\.6[4567]))|19(?:(?:3\.19|6\.23)[2345]|8\.(?:1(?:09|27)|217)|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.24[0134567])|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345
]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]|109?|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|6\.(?:98\.1(?:1[23456789]|2[01234567])|119\.2(?:2[456789]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|1\.22\.15[23]|6\.55\.243|9\.114\.9)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[0
1234567]))|58\.83\.(?:[89]|1[012345]))\b)/
describe KHOP_SPAMHAUS_DROP_LE Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP_LE nopublish
score KHOP_SPAMHAUS_DROP_LE 0.1 0 0.1 0 # this adds to KHOP_SPAMHAUS_DROP
@@ -153,7 +153,7 @@ score KHOP_SPAMHAUS_DROP_LE 0.1 0 0.1 0
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.1(?:62\.(?:2(?:2[458]|38|44)|1(?:3[23]|18))|0\.16[45])|0\.(?:49\.(?:193|205)|53\.2[4567])|4\.112\.2(?:4[256789]|3[78]|5[01])|7\.24(?:1\.(?:144|40)|2\.148)|6\.121\.230)|2(?:5\.23(?:4\.144|5\.192)|1\.101\.203|2\.55\.106)|9(?:6\.202\.214|5\.91\.70)|75\.100\.64|80\.149\.8)|2(?:1(?:3\.(?:87\.(?:1(?:14|28|36)|8[789]|9[012]|74)|(?:108\.17|226\.6)3)|7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|2\.95\.7)|0(?:1\.191\.19[58]|2\.152\.243|0\.85\.24|3\.82\.95))|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:[89]|4[13456]|3[468]?|21)|1\.192\.(?:2(?:1[15]|38)|199)|9\.204\.1(?:37|53)|0\.83\.23[89]|2\.178\.69)|41\.(?:95\.(?:[48]|12)|254\.[12]|59\.[05])|6(?:1\.19\.6[567]|2\.183\.85|6\.87\.0)|59\.9(?:8\.152|9\.153)|91\.203\.67)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.1(?:62\.(?:2(?:2[45]|4[46]|38)|1(?:3[23]|18))|0\.16[3458])|0\.(?:49\.(?:193|205)|53\.2[4567])|4\.112\.2(?:4[256789]|3[78]|51)|7\.24(?:1\.144|2\.148)|6\.121\.230)|2(?:5\.23(?:4\.144|5\.192)|1\.101\.203|2\.55\.106)|9(?:6\.202\.214|5\.91\.70)|78\.49\.255|80\.149\.8)|2(?:1(?:3\.(?:87\.(?:1(?:14|28|36)|8[789]|9[012]|74)|(?:108\.17|226\.6)3)|7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|2\.95\.7)|0(?:1\.191\.19[58]|2\.152\.243|0\.85\.24|3\.82\.95))|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:[89]|4[13456]|3[468]?|21)|1\.192\.(?:2(?:1[15]|38)|199)|9\.204\.1(?:37|53)|0\.83\.23[89]|2\.178\.69)|41\.(?:95\.(?:[48]|12)|254\.[12]|59\.[05])|6(?:1\.19\.6[567]|2\.183\.85|6\.87\.0)|5(?:9\.9(?:8\.152|9\.153)|8\.64\.187)|91\.203\.67)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8