You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/08/06 07:57:22 UTC
svn commit: r1154444 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Sat Aug 6 05:57:22 2011
New Revision: 1154444
URL: http://svn.apache.org/viewvc?rev=1154444&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1154444&r1=1154443&r2=1154444&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sat Aug 6 05:57:22 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20110851
+## khop-sc-neighbors.cf v 20110861
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -93,7 +93,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:25\.110\.(?:1(?:2[02346]|05)|9[79])|11\.249\.169|80\.232\.105|75\.96\.56)|213\.233\.64)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:25\.110\.(?:1(?:2[0236]|0[35])|97)|75\.96\.5[67]|11\.249\.169|80\.232\.104)|213\.233\.64)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -112,7 +112,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:5\.96\.(?:11[23]|57)|3\.245\.20[45])|25\.110\.(?:1(?:2[157]|1[89])|96)|80\.232\.10[34]|11\.249\.177|09\.127\.86)|8(?:5\.26\.2(?:3[12345]|41)|3\.149\.3)|217\.118\.(?:83|90)|46\.249\.0)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:25\.110\.(?:1(?:2[157]|1[89]|04)|96)|7(?:3\.245\.20[45]|5\.96\.11[23])|11\.249\.177|80\.232\.103|09\.127\.86)|8(?:5\.26\.(?:2(?:3[12345]|41)|186)|3\.149\.3)|217\.118\.(?:83|90)|46\.249\.0)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -130,7 +130,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:2(?:5\.(?:110\.(?:1(?:2(?:7\.(?:1(?:6[59]|06|8)|2(?:07|32)|5[03]|38)|5\.(?:1(?:1[45]|34|8)|217|51|63|96)|(?:3\.(?:10|2)|6\.2?)0|1\.(?:1(?:45|76)|65)|0\.(?:148|53)|2\.(?:246|32)|4\.(?:253|62))|0(?:4\.(?:1(?:02|48|86)|241|48)|5\.(?:[26]7|176)|3\.230)|1(?:8\.(?:178|246)|9\.(?:113|90)|7\.152))|9(?:6\.(?:1(?:[15]7|65)|[35]0|208|99)|7\.(?:132|214)|8\.178|9\.157))|224\.201\.197|7\.241\.200)|1\.(?:180\.50\.96|50\.16\.11)|4\.30\.164\.138|3\.194\.16\.16)|1(?:8\.(?:4(?:5\.115\.1(?:33|42)|0\.236\.134)|232\.(?:201\.35|98\.98))|1\.(?:249\.1(?:77\.1(?:25|61)|69\.16)|90\.134\.210)|4\.4(?:4\.149\.87|7\.72\.152)|5\.248\.141\.81|9\.201\.63\.110)|8(?:8\.(?:1(?:65\.(?:195\.144|254\.91)|20\.245\.104|32\.213\.123)|40\.1(?:20\.17|4\.93)|95\.185\.186)|3\.(?:105\.182\.238|83\.162\.10)|7\.(?:179\.125\.12|28\.229\.128))|9(?:5\.(?:(?:222\.40\.19|54\.2\.1)8|1(?:86\.81\.8|61\.9\.)2|70\.57\.103|95\.214\.4)|4\.1(?:26\.183\.120|35\.103\.178)|8\.173\.15\.2
50|3\.106\.92\.23)|7(?:5\.96\.(?:11(?:3\.(?:197|25)|2\.195)|5(?:7\.1(?:09|80)|6\.242))|8\.(?:123\.89\.245|21\.17\.179)|3\.244\.221\.228)|09\.(?:172\.59\.153|70\.184\.22)|63\.15\.203\.2)|2(?:1(?:3\.(?:22(?:9\.109\.225|7\.207\.89)|151\.124\.193|73\.96\.16)|2\.(?:172\.221\.15|47\.211\.174|67\.210\.32)|1\.(?:238\.171\.203|45\.126\.81)|7\.(?:114\.13\.127|26\.6\.74)|6\.227\.220\.84|8\.248\.44\.196|0\.93\.56\.29)|0(?:3\.(?:14(?:6\.140\.130|2\.24\.175)|252\.153\.61)|2\.(?:1(?:23\.82\.14|70\.119\.1)|54\.119\.149)|9\.(?:239\.40\.14|18\.83\.80|85\.63\.7)|0\.204\.32\.177|1\.33\.17\.140)|2(?:0\.(?:132\.1\.188|231\.69\.30)|2\.(?:231\.57\.191|99\.35\.49)|1\.143\.46\.33)|4\.12\.107\.121)|8(?:0\.(?:235\.(?:82\.62|1\.68)|72\.45\.226|55\.219\.2)|6\.(?:109\.167\.147|35\.211\.203)|5\.1(?:98\.186\.234|0\.136\.151)|7\.2(?:28\.107\.124|30\.20\.192)|1\.(?:93\.155\.140|176\.76\.66)|9\.18(?:9\.169\.77|4\.1\.232)|2\.197\.(?:155\.18|219\.70)|3\.96\.143\.156|4\.53\.196\.245)|9(?:5\.(?:1(?:40\.205\.183|67
\.157\.154|36\.59\.98|91\.153\.7)|226\.174\.13|76\.211\.216)|1\.(?:2(?:0(?:5\.147\.194|8\.144\.133|3\.67\.208)|12\.26\.41)|121\.80\.46)|4\.(?:1(?:59\.131\.233|02\.212\.20)|20\.86\.79)|2\.(?:48\.105\.248|83\.114\.123)|3\.(?:74\.232\.137|94\.217\.36))|6(?:2\.(?:(?:217\.232\.|33\.191\.6)6|16(?:1\.248\.197|8\.96\.9)|75\.186\.61)|1\.19\.(?:25(?:0\.69|1\.68)|121\.50)|(?:6\.36\.177\.20|7\.192\.62\.3)2|4\.49\.221\.236)|7(?:8\.(?:9(?:7\.173\.156|6\.86\.133)|109\.165\.39|46\.63\.82)|7\.1(?:06\.232\.17|20\.241\.2)8|9\.124\.92\.164|2\.55\.174\.13|4\.50\.83\.62)|41\.1(?:37\.(?:2[04]|56)\.4|41\.249\.236)|5(?:8\.227\.41\.247|9\.0\.249\.140))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:2(?:5\.(?:110\.(?:1(?:2(?:7\.(?:1(?:6[59]|06|11|8)|2(?:07|32)|5[03]|38)|5\.(?:1(?:1[45]|34|8)|217|51|63|96)|(?:3\.(?:10|2)|6\.2?)0|1\.(?:1(?:45|76)|65)|0\.(?:148|53)|2\.(?:246|32)|4\.(?:253|62))|0(?:4\.(?:1(?:02|48|86)|241|48)|5\.(?:[26]7|176)|3\.230)|1(?:8\.(?:178|246)|9\.(?:113|90)|7\.152))|9(?:6\.(?:1(?:[158]7|65)|[35]0|208|99)|7\.(?:132|214)|8\.178|9\.157))|224\.201\.197|7\.241\.200)|1\.(?:180\.50\.96|50\.16\.11)|4\.30\.164\.138|3\.194\.16\.16)|1(?:8\.(?:23(?:2\.(?:201\.35|98\.98)|3\.18\.182)|45\.(?:115\.1(?:33|42)|243\.3))|1\.(?:249\.1(?:7(?:7\.1(?:25|61)|1\.68)|69\.16)|90\.134\.210)|2\.10(?:5\.196\.171|4\.20\.178)|4\.(?:47\.72\.15|26\.21\.4)2|3\.193\.186\.90|6\.15\.55\.9)|8(?:8\.(?:1(?:65\.(?:195\.144|254\.91)|20\.245\.104|32\.213\.123)|40\.1(?:20\.17|4\.93)|95\.185\.186)|3\.(?:8(?:3\.162\.1|2\.188\.)0|105\.182\.238)|7\.179\.125\.12|2\.71\.15\.170)|7(?:5\.96\.(?:11(?:3\.(?:197|25)|2\.195|7\.29)|5(?:6\.(?:242|40)|7\.
1(?:09|80)))|8\.(?:123\.89\.245|21\.17\.179)|3\.244\.221\.228)|9(?:5\.(?:1(?:86\.81\.8|61\.9\.)2|70\.57\.103|95\.214\.4|54\.2\.18)|4\.1(?:26\.183\.120|35\.103\.178)|3\.106\.92\.23)|09\.(?:172\.59\.153|70\.184\.22)|50\.101\.137\.35|63\.15\.203\.2)|2(?:1(?:3\.(?:22(?:9\.109\.225|7\.207\.89)|151\.124\.193)|1\.(?:238\.171\.203|152\.51\.126|45\.126\.81)|2\.(?:172\.221\.15|47\.211\.174|67\.210\.32)|(?:6\.227\.220\.8|7\.26\.6\.7)4|8\.248\.44\.196|0\.93\.56\.29)|0(?:3\.(?:14(?:6\.140\.130|2\.24\.175)|252\.153\.61)|2\.(?:1(?:23\.82\.14|70\.119\.1)|54\.119\.149)|9\.(?:239\.40\.14|18\.83\.80|85\.63\.7)|0\.204\.32\.177|1\.33\.17\.140)|2(?:0\.(?:190\.58\.186|245\.93\.253)|2\.(?:231\.57\.191|99\.35\.49)|1\.143\.46\.33)|4\.12\.107\.121|7\.96\.84\.8|\.88\.61\.9)|8(?:9\.1(?:8(?:9\.169\.77|4\.1\.232)|48\.20\.179)|2\.1(?:97\.(?:155\.18|219\.70)|51\.210\.15)|0\.(?:235\.(?:82\.62|1\.68)|72\.45\.226)|6\.(?:109\.167\.147|35\.211\.203)|5\.1(?:98\.186\.234|0\.136\.151)|7\.2(?:28\.107\.124|30\.20\.19
2)|1\.(?:93\.155\.140|176\.76\.66)|8\.168\.237\.240|3\.96\.143\.156)|6(?:2\.(?:16(?:1\.248\.197|8\.96\.9)|33\.191\.66|75\.186\.61)|1\.(?:19\.(?:25(?:0\.69|1\.68)|121\.50)|47\.197\.124)|(?:6\.36\.177\.20|7\.192\.62\.3)2|4\.49\.221\.236)|9(?:5\.(?:1(?:40\.205\.183|91\.153\.7)|226\.174\.13)|1\.(?:2(?:08\.144\.133|12\.26\.41)|121\.80\.46)|4\.(?:102\.212\.20|20\.86\.79)|2\.48\.105\.248|3\.74\.232\.137)|7(?:8\.(?:1(?:09\.165\.39|28\.75\.7)|97\.173\.156|46\.63\.82)|7\.1(?:06\.232\.17|20\.241\.2)8|9\.124\.92\.164|2\.55\.174\.13|4\.50\.83\.62)|41\.137\.(?:2[04]|56)\.4|59\.0\.249\.140)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -147,14 +147,14 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# Spamhaus DROP, http://www.spamhaus.org/drop/
-header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456
789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\
.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:2\.[23]|7\.58))|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))?|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)?|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))?|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d
|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)?|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)?|88\.(?:2(?:12\.(?:[023456789]|1[012345]?)|29\.(?:9[012347]|8[89]|13|35))|1(?:70\.19[23456789]|30\.25[01]|64))|0(?:9\.(?:94\.21[2345]|196\.140))?)|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01])|25\.(?:159|210))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|9\.(?:1(?:82\.(?:6[456789]|9[012345]|[78]\d)|45\.(?:[0456789]|[12]\d?|
3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567]))|3\.(
?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|6\.(?:1(?:4?1|22|90)|232|7?3)|1\.(?:6[4567]|8[89]|9[01])|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|2(?:50\.1(?:[345678]\d|2[89]|9[01])|32\.2(?:5[012345]|4[89]))|6(?:3\.(?:1(?:4[69]|5[01])|24[0134567])|0\.12[123]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:64\.(?:3[789]|9[89]?|1[13]|4
[45]|5[59]|61)|21(?:[67]|5\.14[0123])))?|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|2\.1(?:9\.(?:[0789]|2(?:[01236789]|5[012345]?|4[89]?)?|6[01234567]?|[1345]\d?)|8(?:2\.15[23456789]|\.252)|22\.(?:3[23456789]|7[23]))|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|3\.223\.2(?:2[456789]|5[012345]|[34]\d)|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:2(?:1[01]|43)|140)|9\.(?:114\.97?|45\.14)|1\.22\.15[23])?|4(?:6\.(?:252\.
1(?:3[0123]|2[89])|51\.10[0123]|161\.29|96)|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345])|31\.222\.20[01234567])\b)/
+header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456
789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\
.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:2\.[23]|7\.58))|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))?|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9
[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|88\.(?:2(?:12\.(?:[023456789]|1[012345]?)|29\.(?:9[012347]|8[89]|13|35))|1(?:70\.19[23456789]|30\.25[01]|64))|0(?:9\.(?:94\.21[2345]|196\.140))?)|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01])|25\.(?:159|210))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|9\.(?:1(?:82\.(?:6[456789]|9[012345]|[78]\d)|45\.(?:[0456789]|[12]\d?|3[01
]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:10
9\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|6\.(?:1(?:4?1|22|90)|232|7?3)|1\.(?:6[4567]|8[89]|9[01])|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|2(?:50\.1(?:[345678]\d|2[89]|9[01])|32\.2(?:5[012345]|4[89]))|6(?:3\.(?:1(?:4[69]|5[01])|24[0134567])|0\.12[123]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:64\.(?:3[789]|9[89]?|1[13]|4[45]
|5[59]|61)|21(?:[67]|5\.14[0123])))?|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|2\.1(?:9\.(?:[0789]|2(?:[01236789]|5[012345]?|4[89]?)?|6[01234567]?|[1345]\d?)|8(?:2\.15[23456789]|\.252)|22\.(?:3[23456789]|7[23]))|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|3\.223\.2(?:2[456789]|5[012345]|[34]\d)|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:2(?:1[01]|43)|140)|9\.(?:114\.97?|45\.14)|1\.22\.15[23])?|4(?:6\.(?:252\.1(?:
3[0123]|2[89])|51\.10[0123]|161\.29|96)|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345])|31\.222\.20[01234567])\b)/
describe KHOP_SPAMHAUS_DROP Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP nopublish
score KHOP_SPAMHAUS_DROP 1 0.2 1 0.2
# spam/ham s/o corpus
# 0.0349/0.0029 0.924 20110227@510k
-header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?
:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(
?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:2\.[23]|7\.58))|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))?|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)?|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))?|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?
:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)?|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)?|88\.(?:2(?:12\.(?:[023456789]|1[012345]?)|29\.(?:9[012347]|8[89]|13|35))|1(?:70\.19[23456789]|30\.25[01]|64))|0(?:9\.(?:94\.21[2345]|196\.140))?)|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01])|25\.(?:159|210))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|9\.(?:1(?:82\.(?:6[456789]|9[012345]|[78]\d)|45\.(?:[0456789]|
[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567
]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|6\.(?:1(?:4?1|22|90)|232|7?3)|1\.(?:6[4567]|8[89]|9[01])|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|2(?:50\.1(?:[345678]\d|2[89]|9[01])|32\.2(?:5[012345]|4[89]))|6(?:3\.(?:1(?:4[69]|5[01])|24[0134567])|0\.12[123]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:64\.(?:3[789]|9[89]?
|1[13]|4[45]|5[59]|61)|21(?:[67]|5\.14[0123])))?|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|2\.1(?:9\.(?:[0789]|2(?:[01236789]|5[012345]?|4[89]?)?|6[01234567]?|[1345]\d?)|8(?:2\.15[23456789]|\.252)|22\.(?:3[23456789]|7[23]))|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|3\.223\.2(?:2[456789]|5[012345]|[34]\d)|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:2(?:1[01]|43)|140)|9\.(?:114\.97?|45\.14)|1\.22\.15[23])?|4(?:6\.
(?:252\.1(?:3[0123]|2[89])|51\.10[0123]|161\.29|96)|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345])|31\.222\.20[01234567])\b)/
+header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?
:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(
?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:2\.[23]|7\.58))|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))?|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[
678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|88\.(?:2(?:12\.(?:[023456789]|1[012345]?)|29\.(?:9[012347]|8[89]|13|35))|1(?:70\.19[23456789]|30\.25[01]|64))|0(?:9\.(?:94\.21[2345]|196\.140))?)|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01])|25\.(?:159|210))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|9\.(?:1(?:82\.(?:6[456789]|9[012345]|[78]\d)|45\.(?:[0456789]|[12]
\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567]))|
3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|6\.(?:1(?:4?1|22|90)|232|7?3)|1\.(?:6[4567]|8[89]|9[01])|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|2(?:50\.1(?:[345678]\d|2[89]|9[01])|32\.2(?:5[012345]|4[89]))|6(?:3\.(?:1(?:4[69]|5[01])|24[0134567])|0\.12[123]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:64\.(?:3[789]|9[89]?|1[1
3]|4[45]|5[59]|61)|21(?:[67]|5\.14[0123])))?|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|2\.1(?:9\.(?:[0789]|2(?:[01236789]|5[012345]?|4[89]?)?|6[01234567]?|[1345]\d?)|8(?:2\.15[23456789]|\.252)|22\.(?:3[23456789]|7[23]))|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|3\.223\.2(?:2[456789]|5[012345]|[34]\d)|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:2(?:1[01]|43)|140)|9\.(?:114\.97?|45\.14)|1\.22\.15[23])?|4(?:6\.(?:2
52\.1(?:3[0123]|2[89])|51\.10[0123]|161\.29|96)|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345])|31\.222\.20[01234567])\b)/
describe KHOP_SPAMHAUS_DROP_LE Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP_LE nopublish
score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 # adds to KHOP_SPAMHAUS_DROP
@@ -164,7 +164,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:4\.112\.2(?:2[456789]|3[016789])|1\.224\.250|2\.196\.254)|2(?:1\.63\.1[67]|3\.146\.117|5\.234\.144|2\.155\.36)|(?:78\.172\.1|09\.127\.)86)|2(?:1(?:3\.87\.(?:1(?:2[012389]|3[47]|42)|74)|7\.(?:118\.(?:83|90)|66\.146))|23\.252\.1(?:6[0469]|7[15])|02\.152\.243)|8(?:5\.(?:26\.(?:2(?:3[12345]|41)|18[46])|115\.248)|3\.149\.(?:4[457]|38?)))\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:4\.112\.2(?:2[456789]|3[016789])|1\.224\.250|2\.196\.254)|2(?:1\.63\.1[67]|5\.234\.144|2\.155\.36)|(?:78\.172\.1|09\.127\.)86)|2(?:1(?:3\.87\.(?:1(?:2[012389]|34)|74)|7\.(?:118\.(?:83|90)|66\.146))|23\.252\.1(?:6[0469]|7[15])|02\.152\.243)|8(?:5\.(?:26\.(?:2(?:3[12345]|41)|18[46])|115\.248)|3\.149\.(?:4[45]|38?))|61\.19\.66)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6