You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2012/03/20 07:57:13 UTC
svn commit: r1302787 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Tue Mar 20 06:57:13 2012
New Revision: 1302787
URL: http://svn.apache.org/viewvc?rev=1302787&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1302787&r1=1302786&r2=1302787&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Tue Mar 20 06:57:13 2012
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201203109
+## khop-sc-neighbors.cf v 201203195
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:13|80)|41|59)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:[89]0|13)|59)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -40,7 +40,7 @@ score KHOP_SC_CIDR8 0.3 0.1 0.3 0.1
# 12.1449/0.0139 0.999 20100410 net, solo=12.1966/0.0197@0.998, ->.2 .1 .3 .2
# 10.3554/0.0112 0.999 20110227@510k solo=10.3717/0.0119@0.999, ->.3 .1 .3 .1
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b1(?:17|78|82|90)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|78|82)|41)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -75,7 +75,7 @@ score KHOP_SC_CIDR16 1.0 0.2 1.0 0.2
# crap, still empty 20100410 bad scrape, script failed to populate rule
# crap, still empty 20110227 this is due to safety net exclusions -> 1 .2 1 .2
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b182\.178(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /___ FAILED TO POPULATE ___/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0.4
@@ -93,7 +93,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:7\.242\.248|2\.109\.4)|09\.(?:100\.134|98\.7)|24\.106\.113|86\.120\.236)|2(?:1(?:3\.233\.64|7\.118\.81|1\.47\.88)|00\.(?:108\.108|208\.81)|7\.100\.31)|84\.(?:121\.241|235\.73)|50\.47\.49)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:0\.232\.10[34]|9\.62\.83)|1(?:3\.162\.24|2\.109\.)4|09\.(?:100\.134|98\.7)|25\.233\.15[45])|2(?:1(?:3\.233\.64|7\.118\.81)|09\.15\.236)|84\.(?:121\.254|235\.73)|72\.53\.91)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -112,7 +112,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:2\.215\.6[345]|8\.233\.129)|(?:94\.126\.18|73\.38\.15)3|80\.232\.10[35]|23\.194\.4)|8(?:5\.(?:26\.(?:1(?:8[34]|65)|2[34]1)|115\.248)|3\.(?:149\.[23]|221\.160))|21(?:(?:7\.118\.8|9\.70\.4)3|3\.87\.1(?:28|32))|6(?:0\.190\.223|1\.19\.66|4\.79\.81|7\.159\.5)|9(?:1\.194\.57|8\.139\.91)|41\.254\.5)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:2\.215\.6[345]|8\.233\.129)|7(?:3\.38\.153|8\.79\.12)|80\.232\.10[35]|94\.126\.183|23\.194\.4)|2(?:1(?:7\.118\.8|9\.70\.4)3|09\.205\.19[56])|8(?:5\.(?:115\.248|26\.184)|3\.149\.[23])|9(?:1\.194\.57|8\.139\.91|6\.31\.75)|6(?:0\.190\.223|2\.33\.191)|4(?:1\.254\.5|6\.249\.0))\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -130,7 +130,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:9\.(?:2(?:13\.109\.141|04\.66\.226)|(?:10\.117\.|62\.83\.1)48)|6\.(?:1(?:20\.23(?:0\.181|6\.6)|15\.241\.242)|204\.6\.230)|7\.(?:1(?:63\.16\.229|\.119\.77)|5\.215\.24)|0\.17(?:6\.160\.221|7\.7\.227)|4\.17\.89\.199|8\.54\.128\.28)|1(?:8\.(?:40\.(?:236\.153|50\.156)|68\.(?:184\.179|76\.163)|233\.129\.57)|(?:3\.10(?:5\.222\.4|\.50\.16)|2\.217\.195\.2)6|4\.(?:4(?:6\.161\.247|2\.13\.144)|24\.107\.153)|7\.242\.248\.1(?:[49]9|17)|0\.9\.126\.199)|2(?:4\.1(?:06\.113\.21[67]|16\.176\.74|37\.20\.253|58\.107\.55)|2\.(?:(?:123\.166\.13|227\.159\.20)1|57\.194\.100)|5\.2(?:(?:33\.156\.1|08\.20\.)34|24\.187\.101)|0\.151\.186\.78|3\.194\.4\.159)|9(?:0\.(?:2(?:00\.177\.34|4\.150\.251|6\.118\.123)|140\.44\.145|98\.48\.83)|5\.1(?:61\.(?:113\.161|9\.2)|17\.219\.10)|4\.(?:126\.183\.117|44\.103\.216)|6\.(?:217\.241\.62|1\.248\.46))|7(?:8\.(?:1(?:21\.158\.123|58\.155\.46)|235\.203\.92)|3\.(?:38\.153\.3[56]|46\.233\.183)|6\.8\.216\.253|4\.57\.
6\.1)|0(?:9\.(?:1(?:00\.(?:134\.246|54\.185)|95\.66\.2)|98\.(?:147\.26|7\.228)|230\.58\.112|60\.147\.73)|1\.99\.134\.240)|5(?:3\.19\.108\.41|9\.0\.80\.114)|68\.187\.134\.85|44\.132\.0\.112)|2(?:1(?:9\.(?:7(?:0\.43\.245|4\.187\.52)|223\.252\.137)|1\.(?:4(?:5\.126\.81|7\.88\.97)|172\.56\.38)|2\.1(?:12\.96\.161|60\.133\.34)|0\.(?:203\.103\.50|168\.50\.6)|3\.55\.76\.(?:224|18)|7\.76\.2\.129)|0(?:0\.(?:2(?:08\.81\.24|16\.198\.8)5|35\.188\.169|129\.187\.2)|3\.(?:1(?:63\.255\.126|89\.141\.25)|67\.108\.172)|2\.(?:1(?:44\.180\.61|73\.214\.18)|4\.178\.39)|6\.188\.77\.6)|2(?:2\.(?:102\.236\.32|75\.166\.245)|1\.(?:143\.46\.33|6\.162\.204))|4\.(?:1(?:21\.182\.93|53\.157\.90)|246\.42\.115|92\.72\.100)|7\.251\.160\.75)|8(?:9\.(?:1(?:2(?:2\.(?:161\.212|34\.15)|3\.85\.24)|44\.143\.210|36\.114\.62)|2(?:18\.52\.234|4\.217\.220)|7(?:6\.225\.137|3\.38\.241)|37\.109\.3)|4\.(?:1(?:21\.241\.200|5\.191\.254)|2(?:0\.241\.123|41\.32\.109))|5\.(?:1(?:05\.189\.224|14\.175\.6)|56\.116\.255)|8\.198\.(?:1(
?:30\.245|4\.231)|35\.229)|0\.(?:176\.185\.2|69\.151\.86)|1\.202\.116\.105|2\.32\.116\.133|6\.122\.61\.204)|9(?:4\.(?:(?:(?:23\.225\.1|97\.62\.2)0|52\.198\.24)9|1(?:53\.86\.152|9\.37\.139)|73\.245\.48)|3\.(?:15(?:7\.148\.102|2\.149\.88)|84\.(?:151\.9|62\.48)|75\.246\.118)|1\.(?:1(?:83\.48\.238|94\.57\.62)|211\.52\.208)|5\.(?:(?:48\.24\.24|59\.39\.8)2|240\.183\.54)|(?:7\.87\.172\.23|6\.31\.75\.4)2|2\.63\.183\.167|8\.244\.224\.66)|6(?:0\.190\.2(?:23\.(?:1(?:5[02]|44)|6[18]|26)|18\.110)|(?:1\.(?:216\.121\.19|129\.251\.6)|5\.75\.73\.11)8|2\.(?:106\.118\.26|219\.239\.5|42\.24\.98)|9\.(?:146\.233\.117|63\.81\.186)|4\.79\.81\.13[0123]|8\.151\.236\.100|7\.159\.5\.206)|7(?:7\.(?:1(?:2(?:1\.43\.83|7\.165\.2)|06\.232\.178)|(?:46\.196\.15|65\.111\.19)6|2(?:54\.180\.23|48\.62\.21)3)|9\.(?:1(?:75\.229\.158|01\.236\.62)|97\.10\.56)|(?:1\.10\.28\.15|2\.53\.91\.17)7|8\.(?:189\.47\.83|29\.4\.78))|4(?:1\.(?:2(?:04\.94\.226|51\.255\.72)|137\.(?:2[04]|56)\.4)|6\.(?:186\.15\.134|8\.116\.75)|9\.15
8\.199\.163)|5(?:0\.(?:37\.114\.202|47\.49\.34)|8\.182\.173\.35))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:6\.(?:1(?:4(?:6\.1(?:86\.238|91\.154)|7\.63\.112)|20\.(?:23(?:0\.181|6\.6)|169\.178)|59\.16\.172|\.193\.254)|204\.6\.230)|9\.(?:2(?:1(?:4\.(?:43\.162|95\.197)|3\.109\.141)|04\.66\.226)|10(?:6\.152\.54|\.117\.48)|62\.83\.148)|7\.(?:1(?:26\.(?:141\.188|230\.104)|85\.197\.228|\.119\.62)|(?:6\.253\.23|5\.215\.2)4|21\.48\.148)|0\.(?:17(?:6\.160\.221|7\.7\.227)|226\.176\.228)|8\.(?:16\.121\.145|92\.214\.210|78\.212\.44)|4\.17(?:2\.252\.152|\.89\.199)|3\.106\.110\.131)|1(?:8\.(?:40\.(?:236\.153|50\.156)|233\.129\.57|97\.103\.231)|5\.(?:66\.(?:129\.44|3\.169)|84\.94\.2[56]|127\.20\.153)|2\.(?:170\.167\.101|217\.195\.26)|4\.4(?:2\.23\.123|7\.28\.244)|1\.68\.111\.194|7\.242\.248\.63|3\.10\.50\.166)|2(?:5\.2(?:33\.15(?:4\.216|5\.252)|24\.121\.169)|3\.(?:194\.(?:128\.60|4\.159)|205\.139\.29)|4\.(?:247\.246\.178|137\.20\.253)|1\.180\.108\.216|0\.151\.186\.78|2\.57\.192\.87)|9(?:0\.(?:2(?:(?:00\.191\.6|4\.150\.25)1|6\.118\.123)|1(?
:07\.139\.10|36\.36\.178)|68\.54\.223)|5\.1(?:(?:28\.90|61\.9)\.2|17\.219\.10)|4\.126\.183\.117)|7(?:8\.(?:1(?:24\.133\.69|37\.158\.97|58\.155\.46)|79\.12\.94)|4\.(?:6\.8\.130|57\.6\.1)|3\.38\.153\.3[56]|6\.8\.216\.253)|09\.(?:100\.134\.246|230\.58\.112|98\.7\.228)|44\.132\.0\.112|59\.90\.16\.201)|2(?:1(?:9\.7(?:0\.(?:10\.203|43\.245)|4\.(?:187\.52|35\.61))|2\.(?:1(?:56\.127\.19|74\.243\.17)4|231\.254\.197)|1\.(?:4(?:5\.126\.81|7\.106\.65)|172\.56\.38)|8\.21(?:1\.152\.30|2\.226\.3)|0\.168\.50\.6|6\.36\.28\.94|7\.76\.2\.129)|0(?:1\.(?:2(?:01\.66\.140|44\.51\.172)|37\.197\.123)|0\.(?:208\.81\.245|79\.245\.253)|7\.(?:157\.30\.66|45\.186\.34)|9\.1(?:5\.236\.94|83\.5\.212)|3\.163\.255\.126|2\.173\.214\.18)|2(?:0\.(?:134\.216\.153|68\.72\.102)|1\.1(?:61\.22\.116|43\.46\.33)|2\.102\.236\.32)|4\.(?:246\.42\.115|92\.72\.100|6\.176\.93)|7\.0\.125\.166)|8(?:9\.(?:1(?:2(?:2\.(?:161\.212|34\.15)|3\.93\.118)|36\.114\.62)|2(?:18\.52\.234|28\.65\.132|4\.217\.220)|7(?:6\.225\.137|3\.38\.241)
|37\.109\.3)|4\.(?:1(?:21\.254\.67|5\.191\.254|0\.96\.89)|205\.227\.20|54\.184\.144)|(?:8\.2(?:22\.168\.9|04\.232\.)|0\.69\.151\.8)6|5\.1(?:05\.189\.224|93\.227\.96|4\.109\.70)|1\.(?:202\.116\.105|65\.123\.20)|2\.(?:35\.197\.101|27\.172\.97)|6\.122\.61\.204|3\.66\.170\.97|7\.121\.66\.70)|9(?:3\.(?:15(?:7\.148\.102|2\.149\.88)|7(?:5\.246\.118|8\.118\.196)|84\.158\.69)|4\.(?:2(?:3\.216\.21|53\.91\.3)|127\.223\.112|52\.198\.249|73\.245\.48)|5\.(?:(?:154\.118\.7|83\.172\.2)3|58\.244\.76)|(?:0\.154\.137\.13|8\.230\.114\.25)5|1\.(?:211\.52\.208|194\.57\.62)|6\.31\.75\.4[1234])|7(?:7\.(?:1(?:2(?:1\.43\.83|7\.165\.2)|06\.232\.178)|(?:46\.196\.15|97\.139\.6)6|254\.180\.233)|1\.(?:21\.129\.112|55\.155\.200|10\.28\.157)|2\.(?:42\.186\.13|53\.91\.17)7|9\.101\.236\.62)|6(?:0\.190\.223\.(?:1(?:5[02]|44)|26)|7\.(?:228\.177\.123|133\.133\.1)|2\.33\.191\.66|6\.35\.93\.202)|4(?:6\.(?:234\.1(?:03\.242|16\.218)|186\.15\.134)|1\.137\.2[04]\.4|9\.158\.199\.163)|5(?:8\.18(?:2\.173\.35|6\.92\.11)|0
\.37\.114\.202|9\.22\.128\.25)|3(?:7\.(?:104\.118\.159|45\.250\.146)|1\.6\.131\.113))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -147,14 +147,14 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# Spamhaus DROP, http://www.spamhaus.org/drop/
-header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.25)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[012
3]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|01\.2(?:0[01234567]|4\d)|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:5\.(?:1(?:[24]1|[58]4)|2(?:07|45))|4\.(?:1(?:10|53|76|2)|[39]4|41)|6\.(?:17|3)[2345]|7\.1[6789])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23]|43\.166)|4(?:3\.134|6\.211|1\.38)|39\.78)|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|8(?:4\.8[67]|2\.57)|14\.[89]|62\.[67])|2(?:2(?:6\.(?:197|220)|5\.17[6789])|8\.1[01]|\.21[23]|38\.242)|8(?:8\.(?:19[01]|22[67])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.155)|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:1(?:0\.16[0123]|6\.14[67])|4(?:6\.20[4567]|0\.229)|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.205)|0\.2(
?:21|45)|54\.15[6789]|8\.7[45])|6\.32\.2(?:1[6789]|2[0123]))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.19(?:9\.1(?:[345]\d|2[89])|7\.15[23456789])|3\.20\.1(?:[678]\d|9[01]))|4(?:\.192\.(?:[06789]|[125]\d?|3[01]?|4[89]?)|6\.185\.2(?:4[59]|12)|8\.(?:1(?:05|78)|248)|1\.136\.[12]7|3\.(?:135|49)|0\.170)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:145|232)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.141|2\.147|5\.190)|7(?:8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))|8(?:8\.2(?:12\.(?:[023456789]|1[012345]?)|47\.(?:135|232))|6\.190\.2(?:2[456789]|3[01]))|0(?:3\.10\.(?:1(?:8[89]|9[01])|6[89]|7[01])|9\.(?:94\.21[2345]|196\.140))|6(?:7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)
|2\.125))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|25\.(?:159|210))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|44\.(?:19[23456789]|20[01234567])|89\.224)|9\.(?:1(?:4(?:8\.(?:6[456789]|9[012345]|[78]\d)|5\.(?:[0456789]|[12]\d?|3[01]?))|82\.(?:6[456789]|9[012345]|[78]\d)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|89\.7[123]|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[0
1234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.7(?:1\.(?:[023456789]|1[012345]?)|\.2(?:2[0123]|0[89]|1\d))|3\.3(?:1\.8[89]|4\.7[01])|2\.61\.108)|1(?:6\.(?:212\.(?:2(?:2[0123]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?)))|\.5[6789])|9(?:1\.(?:2(?:0(?:0\.(?:1(?:6[4567]|7[6789]|8[89]|9[01])|2(?:4[012389]|5[01]))|1\.(?:[4567]|2(?:1[2345]|3[6789])|12[4567])|9\.(?:1(?:8[346]|4)|(?:[45]|23)8|63)|4\.(?:5[01]|4\d)|8\.(?:162|228)|3\.9[2345]|5\.4[0123])|1(?:2\.(?:1
(?:[26]3|07|35|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21|57)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22|90)|7?3)|7\.(?:1(?:53|62|78)|249)|0\.17[2345])|2(?:6\.(?:21[23]|78|97)|9\.(?:4[67]|9[01])|0\.(?:9?0|62)|8\.132|3\.77)|3(?:0\.143|2\.235))|19(?:6\.2(?:1[6789]|3[2345])|9\.(?:1(?:12|23)|230)|4\.(?:[01]|21[45])|3\.(?:19|7)[2345]|8\.1(?:2[57]|09)|7\.9[6789]|5\.1[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|6(?:3\.(?:1(?:4[679]|5[01])|24[0134567])|0\.12[123]|1\.247)|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89]))|5\.(?:64\.(?:3[789]|1[13]|9[89])|21(?:[67]|5\.14[0123])))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|21\.(?:2(?:0[01234567]|1[23456789]|2[0123])|19[23456789])|44)|7\.21(?:[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]
|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d)|9\.6\.80)|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|12(?:0\.9[45]|1\.39))|4\.22\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|1\.(?:22\.15[23]|94\.43)|6\.55\.(?:21[01]|9[67])|9\.(?:114\.97?|45\.14))|7(?:2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|9\.1(?:10\.(?:1(?:[678]\d?|9[01]?)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|3(?:1\.(?:1(?:84\.2(?:[23][67]|42)|1\.43)|222\.20[01234567]|44\.18[45])|\.(?:[0789]|[12345]\d?|6[0123]?))|4(?:1\.221\.1(?:1[23456789]|2[01234567])|6\.161\.29)|58\.83\.(?:[89]|1[01]))\b)/
+header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /___ FAILED TO POPULATE ___/
describe KHOP_SPAMHAUS_DROP Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP nopublish
score KHOP_SPAMHAUS_DROP 1 0.2 1 0.2
# spam/ham s/o corpus
# 0.0349/0.0029 0.924 20110227@510k
-header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.25)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[2345678
9]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|01\.2(?:0[01234567]|4\d)|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:5\.(?:1(?:[24]1|[58]4)|2(?:07|45))|4\.(?:1(?:10|53|76|2)|[39]4|41)|6\.(?:17|3)[2345]|7\.1[6789])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23]|43\.166)|4(?:3\.134|6\.211|1\.38)|39\.78)|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|8(?:4\.8[67]|2\.57)|14\.[89]|62\.[67])|2(?:2(?:6\.(?:197|220)|5\.17[6789])|8\.1[01]|\.21[23]|38\.242)|8(?:8\.(?:19[01]|22[67])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.155)|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:1(?:0\.16[0123]|6\.14[67])|4(?:6\.20[4567]|0\.229)|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.20
5)|0\.2(?:21|45)|54\.15[6789]|8\.7[45])|6\.32\.2(?:1[6789]|2[0123]))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.19(?:9\.1(?:[345]\d|2[89])|7\.15[23456789])|3\.20\.1(?:[678]\d|9[01]))|4(?:\.192\.(?:[06789]|[125]\d?|3[01]?|4[89]?)|6\.185\.2(?:4[59]|12)|8\.(?:1(?:05|78)|248)|1\.136\.[12]7|3\.(?:135|49)|0\.170)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:145|232)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.141|2\.147|5\.190)|7(?:8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))|8(?:8\.2(?:12\.(?:[023456789]|1[012345]?)|47\.(?:135|232))|6\.190\.2(?:2[456789]|3[01]))|0(?:3\.10\.(?:1(?:8[89]|9[01])|6[89]|7[01])|9\.(?:94\.21[2345]|196\.140))|6(?:7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?
)|8)|97)|2\.125))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|25\.(?:159|210))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|44\.(?:19[23456789]|20[01234567])|89\.224)|9\.(?:1(?:4(?:8\.(?:6[456789]|9[012345]|[78]\d)|5\.(?:[0456789]|[12]\d?|3[01]?))|82\.(?:6[456789]|9[012345]|[78]\d)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|89\.7[123]|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?
:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.7(?:1\.(?:[023456789]|1[012345]?)|\.2(?:2[0123]|0[89]|1\d))|3\.3(?:1\.8[89]|4\.7[01])|2\.61\.108)|1(?:6\.(?:212\.(?:2(?:2[0123]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?)))|\.5[6789])|9(?:1\.(?:2(?:0(?:0\.(?:1(?:6[4567]|7[6789]|8[89]|9[01])|2(?:4[012389]|5[01]))|1\.(?:[4567]|2(?:1[2345]|3[6789])|12[4567])|9\.(?:1(?:8[346]|4)|(?:[45]|23)8|63)|4\.(?:5[01]|4\d)|8\.(?:162|228)|3\.9[2345]|5\.4[0123])|1(?
:2\.(?:1(?:[26]3|07|35|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21|57)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22|90)|7?3)|7\.(?:1(?:53|62|78)|249)|0\.17[2345])|2(?:6\.(?:21[23]|78|97)|9\.(?:4[67]|9[01])|0\.(?:9?0|62)|8\.132|3\.77)|3(?:0\.143|2\.235))|19(?:6\.2(?:1[6789]|3[2345])|9\.(?:1(?:12|23)|230)|4\.(?:[01]|21[45])|3\.(?:19|7)[2345]|8\.1(?:2[57]|09)|7\.9[6789]|5\.1[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|6(?:3\.(?:1(?:4[679]|5[01])|24[0134567])|0\.12[123]|1\.247)|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89]))|5\.(?:64\.(?:3[789]|1[13]|9[89])|21(?:[67]|5\.14[0123])))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|21\.(?:2(?:0[01234567]|1[23456789]|2[0123])|19[23456789])|44)|7\.21(?:[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[2
3456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d)|9\.6\.80)|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|12(?:0\.9[45]|1\.39))|4\.22\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|1\.(?:22\.15[23]|94\.43)|6\.55\.(?:21[01]|9[67])|9\.(?:114\.97?|45\.14))|7(?:2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|9\.1(?:10\.(?:1(?:[678]\d?|9[01]?)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|3(?:1\.(?:1(?:84\.2(?:[23][67]|42)|1\.43)|222\.20[01234567]|44\.18[45])|\.(?:[0789]|[12345]\d?|6[0123]?))|4(?:1\.221\.1(?:1[23456789]|2[01234567])|6\.161\.29)|58\.83\.(?:[89]|1[01]))\b)/
+header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*___ FAILED TO POPULATE ___/
describe KHOP_SPAMHAUS_DROP_LE Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP_LE nopublish
score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 # adds to KHOP_SPAMHAUS_DROP
@@ -164,7 +164,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:4\.112\.2(?:2[456789]|3[016789])|2\.215\.6[345])|80\.232\.105)|8(?:3\.(?:221\.160|149\.3)|5\.26\.(?:184|241))|223\.252\.1(?:6[1578]|7[03])|41\.190\.3)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:12\.215\.6[345]|80\.232\.105)|223\.252\.1(?:6[1578]|7[03]))\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6