You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/02/25 07:58:05 UTC
svn commit: r1074409 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Fri Feb 25 06:58:05 2011
New Revision: 1074409
URL: http://svn.apache.org/viewvc?rev=1074409&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1074409&r1=1074408&r2=1074409&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Fri Feb 25 06:58:05 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201102241
+## khop-sc-neighbors.cf v 201102251
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.2(?:26\.63|33\.64)|7\.118\.81|8\.248\.64)|09\.250\.231)|1(?:78\.(?:162\.13|49\.25)5|13\.162\.(?:118|237)|98\.106\.26)|8(?:1\.192\.2(?:11|38)|5\.26\.225|0\.65\.16)|9(?:5\.129\.166|1\.203\.67)|(?:58\.150\.5|62\.183\.8)5|77\.232\.142|41\.137\.24)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.2(?:26\.63|33\.64)|7\.118\.81|8\.248\.64)|09\.250\.231)|1(?:13\.162\.(?:118|237)|28\.121\.191|78\.49\.255|98\.106\.26)|8(?:1\.192\.2(?:11|38)|5\.26\.225|8\.191\.78|0\.65\.16)|9(?:5\.129\.166|1\.203\.67)|(?:58\.150\.5|62\.183\.8)5|77\.232\.142|41\.137\.24)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|1\.192\.(?:2(?:1[15]|38)|199)|8\.19(?:0\.12|1\.78)|3\.149\.(?:38?|21)|2\.178\.69)|2(?:1(?:7\.(?:118\.(?:83|90)|66\.146|8\.225)|3\.87\.(?:1(?:28|36)|74))|0(?:(?:(?:4\.11|0\.8)0\.1|2\.152\.24)3|3\.82\.95))|9(?:(?:1\.121\.22|6\.44\.17|8\.139\.9)1|5\.154\.240)|1(?:13\.162\.244|84\.82\.128|95\.91\.70)|6(?:1\.19\.6[56]|0\.199\.201)|41\.(?:254\.1|95\.4))\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.(?:87\.(?:1(?:28|36)|74)|233\.64)|7\.(?:118\.(?:83|90)|66\.146|8\.225))|0(?:(?:(?:4\.11|0\.8)0\.1|2\.152\.24)3|3\.82\.95))|8(?:5\.(?:26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|115\.248)|1\.192\.(?:2(?:1[15]|38)|199)|3\.149\.(?:38?|21)|2\.178\.69|8\.190\.12)|9(?:(?:1\.121\.22|6\.44\.17|8\.139\.9)1|5\.154\.240)|1(?:13\.162\.244|84\.82\.128|95\.91\.70)|6(?:1\.19\.6[56]|0\.199\.201)|41\.(?:254\.1|95\.4))\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:0\.(?:2(?:5(?:4\.23\.190|\.242\.179)|05\.182\.81)|79\.205\.152|4\.48\.130)|8\.1(?:0(?:6\.26\.(?:45|54)|9\.51\.252)|70\.241\.5)|5\.16(?:1\.(?:40\.10|9\.2)|0\.253\.4)|9\.239\.254\.(?:46|52)|3\.226\.161\.154)|7(?:8\.(?:1(?:62\.135\.23[345]|98\.28\.199)|209\.102\.38|49\.255\.104)|3\.2(?:10\.25\.146|9\.247\.70)|4\.123\.(?:246\.66|92\.59)|5\.115\.92\.120)|8(?:7\.(?:141\.(?:102\.198|84\.87)|66\.16\.83)|8\.(?:154\.157\.104|207\.130\.206)|4\.(?:82\.128\.[34]|1\.151\.12)|0\.230\.249\.62|6\.22\.161\.43)|2(?:2\.(?:252\.234\.75|166\.11\.64)|8\.121\.191\.(?:18[14]|229|75)|\.155\.164\.162|4\.243\.13\.16|3\.27\.79\.11)|1(?:3\.16(?:0\.196\.110|5\.156\.3)|1\.224\.250\.134|6\.50\.210\.90)|09\.(?:121\.130\.78|73\.85\.184)|51\.100\.65\.168|61\.58\.148\.115)|2(?:0(?:1\.(?:1(?:16\.224\.244|44\.148\.82|61\.60\.159)|2(?:18\.195\.10|2\.56\.36)|55\.165\.134)|9\.(?:1(?:21\.198\.94|56\.45\.190)|250\.231\.2(?:5[14]|27))|(?:4\.252\.148\.4|2\.28\.24
\.9)9|3\.(?:153\.44\.130|248\.186\.72)|8\.131\.186\.2|0\.80\.13\.66)|1(?:2\.(?:1(?:74\.243\.146|18\.142\.77|99\.29\.145)|85\.(?:101\.94|97\.169))|(?:8\.248\.44\.19|0\.122\.170\.|9\.255\.18\.3)6|7\.(?:15(?:0\.47\.129|1\.78\.134)|26\.6\.97)|3\.(?:186\.38\.38|8\.119\.140)|6\.17(?:0\.88\.196|6\.16\.202)|1\.202\.2\.178)|4\.(?:1(?:1\.192\.241|32\.97\.18)|68\.9\.152)|22\.252\.223\.2|\.89\.212\.208)|6(?:7\.(?:1(?:(?:74\.247\.10|97\.83\.21)1|87\.215\.197|5\.97\.82)|2(?:3(?:0\.181\.234|1\.175\.67|7\.220\.98)|05\.199\.18)|58\.92\.55)|8\.(?:5(?:7\.251\.23|8\.19\.18|1\.70\.2)0|2(?:35\.232\.200|02\.42\.141)|190\.19\.57|63\.31\.151)|5\.(?:4(?:7\.145\.226|0\.95\.123)|183\.197\.46|34\.204\.27|206\.8\.1)|9\.(?:1(?:99\.164\.222|81\.9\.71)|6(?:4\.155\.181|6\.241\.44))|4\.(?:1(?:48\.129\.140|87\.106\.29|6\.128\.42)|90\.72\.43)|0\.(?:199\.201\.120|32\.127\.131)|2\.140\.253\.15|1\.221\.67\.96|6\.158\.48\.2)|7(?:6\.(?:1(?:2(?:0\.13\.239|6\.40\.233)|6\.(?:124\.15|51\.19)7|09\.252\.20)|(?:0\.150\.14|
20\.16\.1)0)|1\.(?:(?:23(?:9\.144\.23|4\.26\.10)|80\.23\.12)3|(?:125\.12\.1|3\.251\.4)5)|7\.(?:2(?:32\.(?:142\.233|83\.2)|52\.116\.42)|198\.16\.108|78\.183\.219)|8\.(?:225\.129\.13|36\.17\.164|96\.131\.51)|5\.1(?:30\.182\.18|48\.7\.17)|9\.96\.(?:48\.103|14\.31)|0\.166\.229\.75)|8(?:8\.(?:19(?:0\.12\.240|1\.78\.136)|255\.153\.106|84\.137\.159)|4\.(?:1(?:09\.202\.211|5\.191\.254)|94\.100\.20|51\.44\.66)|9\.(?:2(?:18\.52\.234|37\.26\.2)|161\.1(?:44\.109|89\.62))|7\.(?:238\.209\.101|126\.253\.24)|1\.(?:143\.119\.33|255\.83\.190)|2\.1(?:93\.140\.168|69\.93\.145)|3\.1(?:42\.111\.228|73\.164\.10)|5\.25\.135\.200|0\.65\.16\.71)|9(?:6\.(?:4(?:4\.171\.15[5678]|9\.179\.100)|33\.135\.112|226\.4\.60)|8\.2(?:2(?:2\.177\.17|3\.13\.4)4|10\.90\.116)|3\.(?:1(?:90\.104\.7|57\.47\.1)|91\.196\.99)|7\.(?:89\.116\.202|93\.177\.5)|1\.121\.221\.192|2\.126\.214\.177|5\.154\.240\.98)|4(?:1\.137\.(?:(?:24|30|56)\.4|63\.20[123])|6\.17\.121\.1)|5(?:0\.75\.145\.46|8\.150\.55\.59)|38\.112\.61\.60)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:0\.(?:2(?:(?:45\.157\.21|05\.182\.8)1|5\.242\.179|16\.41\.94)|79\.205\.152|101\.53\.33|4\.48\.130)|5\.16(?:1\.(?:40\.10|9\.2)|0\.253\.4)|8\.10(?:6\.26\.(?:45|54)|9\.51\.252)|9\.239\.254\.(?:46|52)|3\.226\.161\.154)|8(?:7\.(?:141\.(?:102\.198|84\.87)|66\.16\.83)|8\.(?:154\.157\.104|207\.130\.206)|4\.(?:82\.128\.[34]|1\.151\.12)|0\.230\.249\.62|3\.99\.46\.115|6\.22\.161\.43)|2(?:2\.(?:16(?:9\.249\.87|6\.11\.64)|252\.234\.75)|(?:1\.7\.203\.8|3\.27\.79\.1)1|8\.121\.191\.(?:181|229|75)|\.155\.164\.162|4\.243\.13\.16)|7(?:3\.2(?:10\.25\.146|9\.247\.70)|4\.123\.246\.66|5\.115\.92\.120|8\.49\.255\.104)|1(?:3\.16(?:0\.(?:196\.110|225\.215)|2\.237\.235|5\.156\.3)|6\.50\.210\.90)|09\.(?:121\.130\.78|66\.119\.189|73\.85\.184)|51\.100\.65\.168)|2(?:1(?:2\.(?:1(?:(?:74\.243\.14|20\.246\.8)6|99\.29\.145)|85\.(?:101\.94|97\.169))|(?:8\.248\.44\.19|0\.122\.170\.|9\.255\.18\.3)6|6\.(?:17(?:0\.88\.196|6\.16\.202)|87\.190\.50)|7\.(?:15(?
:0\.47\.129|1\.78\.134)|26\.6\.97)|3\.(?:57\.148\.124|186\.38\.38|8\.119\.140)|1\.202\.2\.178)|0(?:1\.(?:1(?:16\.224\.244|93\.167\.210|44\.148\.82|61\.60\.159)|55\.165\.134|22\.56\.36)|9\.(?:1(?:21\.198\.94|56\.45\.190)|250\.231\.2(?:5[14]|27))|3\.(?:153\.44\.130|248\.186\.72)|0\.(?:32\.219\.12|80\.13\.66)|8\.131\.186\.2|2\.28\.24\.99)|4\.(?:1(?:1\.192\.241|32\.97\.18)|218\.163\.223|68\.9\.152)|22\.252\.223\.2)|6(?:7\.(?:1(?:(?:74\.247\.10|97\.83\.21)1|87\.215\.197|5\.97\.82)|2(?:3(?:0\.181\.234|7\.220\.98)|05\.199\.18)|58\.92\.55)|8\.(?:(?:5(?:7\.251\.23|8\.19\.18|1\.70\.2)|82\.113\.22)0|2(?:35\.232\.200|02\.42\.141)|63\.31\.151)|9\.(?:1(?:99\.164\.222|81\.9\.71)|6(?:4\.155\.181|6\.241\.44)|250\.113\.122)|4\.1(?:6\.1(?:30\.16|28\.4)2|48\.129\.140|87\.106\.29)|5\.(?:183\.197\.46|34\.204\.27|40\.95\.123|206\.8\.1)|0\.(?:199\.201\.120|32\.127\.131)|2\.140\.253\.15|6\.158\.48\.2)|7(?:6\.(?:1(?:2(?:0\.13\.239|6\.40\.233)|6\.(?:124\.15|51\.19)7|09\.252\.20)|(?:0\.150\.14|20\.16\.
1)0|30\.91\.104)|1\.(?:(?:23(?:9\.144\.23|4\.26\.10)|80\.23\.12)3|(?:125\.12\.1|3\.251\.4)5)|8\.(?:225\.129\.13|36\.17\.164|96\.131\.51)|9\.(?:96\.(?:48\.103|14\.31)|180\.65\.188)|(?:0\.166\.229\.7|2\.243\.69\.4)5|7\.(?:198\.16\.108|232\.83\.2)|5\.1(?:30\.182\.18|48\.7\.17))|8(?:9\.(?:2(?:18\.52\.234|37\.26\.2)|161\.1(?:44\.109|89\.62)|96\.156\.54)|8\.(?:19(?:0\.12\.240|1\.78\.136)|255\.153\.106)|7\.(?:12(?:6\.253\.24|1\.96\.50)|238\.209\.101)|4\.(?:15\.191\.254|94\.100\.20|51\.44\.66)|1\.(?:143\.119\.33|255\.83\.190)|2\.1(?:93\.140\.168|69\.93\.145)|3\.1(?:42\.111\.228|73\.164\.10)|0\.65\.16\.71)|9(?:6\.(?:4(?:4\.171\.15[2345678]|9\.179\.100)|33\.135\.112|226\.4\.60)|8\.2(?:2(?:2\.177\.17|3\.13\.4)4|10\.90\.116)|2\.(?:126\.214\.177|86\.26\.208)|7\.(?:89\.116\.202|93\.177\.5)|1\.121\.221\.192|5\.154\.240\.98|3\.91\.196\.99|4\.69\.33\.125)|41\.(?:13(?:7\.(?:(?:24|30|56)\.4|63\.20[23])|2\.241\.65)|251\.253\.50)|5(?:0\.75\.145\.46|8\.150\.55\.59)|38\.112\.61\.60)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -139,13 +139,13 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# Spamhaus DROP, http://www.spamhaus.org/drop/
-header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567])|04\.[01234567])|57\.(?:6[456789]|7\d))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|9\.(?:1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|2(?:30\.(?:6[456789]|10[0123]|[789]\d)|4(?:5\.138|6\.215))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|3\.(?:1(?:
0(?:4\.(?:1(?:[47]6|10|2)|[39]4|253|41)|5\.(?:1(?:[78]4|32|41)|2(?:07|45))|6\.3[2345])|6(?:9\.25[01]|\.100)|4(?:2\.244|8\.47)|10\.136|78\.172|86\.9)|2(?:3(?:\.126(?:\.30)?|8\.[0123])|2(?:7\.24[01]|8\.145)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|2\.(?:2(?:23\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.4[4567]|47\.58)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789]|63\.14[4567])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\
d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:28|97)|2\.125|8\.151)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|4\.138\.1(?:4[456789]|5\d)|0\.(?:[27]5|120|67))|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|94\.1(?:8[456789]|9[01])|26\.24[45]|07\.208)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|
89\.224)|0\.(?:1(?:2(?:5\.1(?:7[012345]|6[89])|3\.2(?:2[456789]|3\d)|4\.16[01234567])|15\.(?:1(?:2[01234567]|[01]\d)|9[6789])|06\.1(?:4[0123]|2[89]|3\d))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|6\.(?:2(?:2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01]))|01\.(?:6[0123]|4[89]|5\d))|197\.(?:17[567]|2[89]))|5\.(?:1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|72\.24[4567])|23(?:5\.(?:6[456789]|7\d)|6\.189))|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|36\.(?:1(?:1[01]|0\d)|9[6789])|13\.(?:6[0123]|4[89]|5\d))|8\.(?:8[12]\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|7\.189\.(?:[0456789]|[12]\d?|3[01]?)|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789]|4[01234567]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:1(?:7[6789]|9[01]|8\d)|2(?:2[0123]|0[89]|
1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89]))|\.0\.0)|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|(?:2\.5|3\.9)[2345]|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|0\.17[2345]|7\.249)|2(?:0\.(?:62|90)|2\.6[4567]))|19(?:(?:3\.19|6\.23)[2345]|8\.(?:1(?:09|27)|217)|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.24[0134567])|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]|109?|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[2
3456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|6\.(?:98\.1(?:1[23456789]|2[01234567])|119\.2(?:2[456789]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|1\.22\.15[23]|6\.55\.243|9\.114\.9)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345]))\b)/
+header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567])|04\.[01234567])|57\.(?:6[456789]|7\d))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|9\.(?:1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|2(?:30\.(?:6[456789]|10[0123]|[789]\d)|4(?:5\.138|6\.215))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|3\.(?:1(?:
0(?:4\.(?:1(?:[47]6|10|2)|[39]4|253|41)|5\.(?:1(?:[78]4|32|41)|2(?:07|45))|6\.3[2345])|6(?:9\.25[01]|\.100)|4(?:2\.244|8\.47)|10\.136|78\.172|86\.9)|2(?:3(?:\.126(?:\.30)?|8\.[0123])|2(?:7\.24[01]|8\.145)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|2\.(?:2(?:23\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.4[4567]|47\.58)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789]|63\.14[4567])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\
d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:28|97)|2\.125|8\.151)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|4\.138\.1(?:4[456789]|5\d)|0\.(?:[27]5|120|67))|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|94\.1(?:8[456789]|9[01])|26\.24[45]|07\.208)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|
89\.224)|0\.(?:1(?:2(?:5\.1(?:7[012345]|6[89])|3\.2(?:2[456789]|3\d)|4\.16[01234567])|15\.(?:1(?:2[01234567]|[01]\d)|9[6789])|06\.1(?:4[0123]|2[89]|3\d))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|6\.(?:2(?:2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01]))|01\.(?:6[0123]|4[89]|5\d))|197\.(?:17[567]|2[89]))|5\.(?:1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|72\.24[4567])|23(?:5\.(?:6[456789]|7\d)|6\.189))|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|36\.(?:1(?:1[01]|0\d)|9[6789])|13\.(?:6[0123]|4[89]|5\d))|8\.(?:8[12]\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|7\.189\.(?:[0456789]|[12]\d?|3[01]?)|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789]|4[01234567]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:1(?:7[6789]|9[01]|8\d)|2(?:2[0123]|0[89]|
1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89]))|\.0\.0\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|(?:2\.5|3\.9)[2345]|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|0\.17[2345]|7\.249)|2(?:0\.(?:62|90)|2\.6[4567]))|19(?:(?:3\.19|6\.23)[2345]|8\.(?:1(?:09|27)|217)|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.24[0134567])|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]|109?
|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|6\.(?:98\.1(?:1[23456789]|2[01234567])|119\.2(?:2[456789]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|1\.22\.15[23]|6\.55\.243|9\.114\.9)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345]))\b)/
describe KHOP_SPAMHAUS_DROP Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP nopublish
#score KHOP_SPAMHAUS_DROP 3 0 3 0
score KHOP_SPAMHAUS_DROP 0.5 0 0.5 0 # testing, see also final stanza
-header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567])|04\.[01234567])|57\.(?:6[456789]|7\d))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|9\.(?:1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|2(?:30\.(?:6[456789]|10[0123]|[789]\d)|4(?:5\.138|6\.215))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|3\
.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|[39]4|253|41)|5\.(?:1(?:[78]4|32|41)|2(?:07|45))|6\.3[2345])|6(?:9\.25[01]|\.100)|4(?:2\.244|8\.47)|10\.136|78\.172|86\.9)|2(?:3(?:\.126(?:\.30)?|8\.[0123])|2(?:7\.24[01]|8\.145)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|2\.(?:2(?:23\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.4[4567]|47\.58)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789]|63\.14[4567])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789
]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:28|97)|2\.125|8\.151)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|4\.138\.1(?:4[456789]|5\d)|0\.(?:[27]5|120|67))|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|94\.1(?:8[456789]|9[01])|26\.24[45]|07\.208)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|
52\.255|89\.224)|0\.(?:1(?:2(?:5\.1(?:7[012345]|6[89])|3\.2(?:2[456789]|3\d)|4\.16[01234567])|15\.(?:1(?:2[01234567]|[01]\d)|9[6789])|06\.1(?:4[0123]|2[89]|3\d))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|6\.(?:2(?:2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01]))|01\.(?:6[0123]|4[89]|5\d))|197\.(?:17[567]|2[89]))|5\.(?:1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|72\.24[4567])|23(?:5\.(?:6[456789]|7\d)|6\.189))|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|36\.(?:1(?:1[01]|0\d)|9[6789])|13\.(?:6[0123]|4[89]|5\d))|8\.(?:8[12]\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|7\.189\.(?:[0456789]|[12]\d?|3[01]?)|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789]|4[01234567]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:1(?:7[6789]|9[01]|8\d)|2(?:2[0123
]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89]))|\.0\.0)|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|(?:2\.5|3\.9)[2345]|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|0\.17[2345]|7\.249)|2(?:0\.(?:62|90)|2\.6[4567]))|19(?:(?:3\.19|6\.23)[2345]|8\.(?:1(?:09|27)|217)|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.24[0134567])|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]|109?|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[0
1]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|6\.(?:98\.1(?:1[23456789]|2[01234567])|119\.2(?:2[456789]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|1\.22\.15[23]|6\.55\.243|9\.114\.9)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345]))\b)/
+header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567])|04\.[01234567])|57\.(?:6[456789]|7\d))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|9\.(?:1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|2(?:30\.(?:6[456789]|10[0123]|[789]\d)|4(?:5\.138|6\.215))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|3\
.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|[39]4|253|41)|5\.(?:1(?:[78]4|32|41)|2(?:07|45))|6\.3[2345])|6(?:9\.25[01]|\.100)|4(?:2\.244|8\.47)|10\.136|78\.172|86\.9)|2(?:3(?:\.126(?:\.30)?|8\.[0123])|2(?:7\.24[01]|8\.145)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|2\.(?:2(?:23\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.4[4567]|47\.58)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789]|63\.14[4567])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789
]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:28|97)|2\.125|8\.151)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|4\.138\.1(?:4[456789]|5\d)|0\.(?:[27]5|120|67))|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|94\.1(?:8[456789]|9[01])|26\.24[45]|07\.208)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|
52\.255|89\.224)|0\.(?:1(?:2(?:5\.1(?:7[012345]|6[89])|3\.2(?:2[456789]|3\d)|4\.16[01234567])|15\.(?:1(?:2[01234567]|[01]\d)|9[6789])|06\.1(?:4[0123]|2[89]|3\d))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|6\.(?:2(?:2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01]))|01\.(?:6[0123]|4[89]|5\d))|197\.(?:17[567]|2[89]))|5\.(?:1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|72\.24[4567])|23(?:5\.(?:6[456789]|7\d)|6\.189))|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|36\.(?:1(?:1[01]|0\d)|9[6789])|13\.(?:6[0123]|4[89]|5\d))|8\.(?:8[12]\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|7\.189\.(?:[0456789]|[12]\d?|3[01]?)|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789]|4[01234567]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:1(?:7[6789]|9[01]|8\d)|2(?:2[0123
]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89]))|\.0\.0\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|(?:2\.5|3\.9)[2345]|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|0\.17[2345]|7\.249)|2(?:0\.(?:62|90)|2\.6[4567]))|19(?:(?:3\.19|6\.23)[2345]|8\.(?:1(?:09|27)|217)|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.24[0134567])|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[
89]|109?|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|6\.(?:98\.1(?:1[23456789]|2[01234567])|119\.2(?:2[456789]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|1\.22\.15[23]|6\.55\.243|9\.114\.9)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345]))\b)/
describe KHOP_SPAMHAUS_DROP_LE Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP_LE nopublish
score KHOP_SPAMHAUS_DROP_LE 0.1 0 0.1 0 # this adds to KHOP_SPAMHAUS_DROP
@@ -153,7 +153,7 @@ score KHOP_SPAMHAUS_DROP_LE 0.1 0 0.1 0
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.162\.(?:1(?:3[23]|18)|2(?:2[45]|44))|0\.(?:49\.(?:193|205)|53\.2[4567])|4\.112\.2(?:4[2569]|3[78]|5[01])|7\.24(?:1\.144|2\.148)|6\.121\.230)|2(?:5\.23(?:4\.144|5\.192)|1\.101\.203|2\.55\.106)|9(?:6\.202\.214|5\.91\.70)|75\.100\.64|80\.149\.8)|2(?:1(?:3\.(?:87\.(?:1(?:14|28|36)|8[789]|9[012]|7[46])|108\.17[23]|226\.63)|7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|2\.95\.7)|0(?:1\.191\.19[58]|2\.152\.243|0\.85\.24|3\.82\.95))|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:[89]|4[1456]|3[68]?|21)|1\.192\.(?:2(?:1[15]|38)|199)|9\.204\.1(?:37|53)|0\.83\.23[89]|2\.178\.69)|41\.(?:95\.(?:[48]|12)|254\.[012]|59\.[05])|6(?:1\.19\.6[567]|2\.183\.85|6\.87\.0)|59\.9(?:9\.(?:1(?:28|53)|40)|8\.152)|91\.203\.67)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.162\.(?:2(?:2[458]|44)|1(?:3[23]|18))|0\.(?:49\.(?:193|205)|53\.2[4567])|4\.112\.2(?:4[25679]|3[78]|5[01])|7\.24(?:1\.144|2\.148)|6\.121\.230)|2(?:5\.23(?:4\.144|5\.192)|1\.101\.203|2\.55\.106)|9(?:6\.202\.214|5\.91\.70)|75\.100\.64|80\.149\.8)|2(?:1(?:3\.(?:87\.(?:1(?:14|28|36)|8[789]|9[012]|7[46])|108\.17[23]|226\.63)|7\.(?:8\.2(?:3[68]|25)|118\.(?:83|90)|66\.146)|2\.95\.7)|0(?:1\.191\.19[58]|2\.152\.243|0\.85\.24|3\.82\.95))|8(?:5\.(?:26\.(?:1(?:6[45]|8[36]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:[89]|3[468]?|4[1456]|21)|1\.192\.(?:2(?:1[15]|38)|199)|9\.204\.1(?:37|53)|0\.83\.23[89]|2\.178\.69)|41\.(?:95\.(?:[48]|12)|254\.[12]|59\.[05])|6(?:1\.19\.6[567]|2\.183\.85|6\.87\.0)|59\.9(?:9\.(?:153|40)|8\.152)|91\.203\.67)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8