You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/03/21 06:57:42 UTC
svn commit: r1083680 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Mon Mar 21 05:57:41 2011
New Revision: 1083680
URL: http://svn.apache.org/viewvc?rev=1083680&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1083680&r1=1083679&r2=1083680&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Mon Mar 21 05:57:41 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201103201
+## khop-sc-neighbors.cf v 201103211
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:187|41|59|95)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:113|41|59|95)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -75,7 +75,7 @@ score KHOP_SC_CIDR16 1.0 0.2 1.0 0.2
# crap, still empty 20100410 bad scrape, script failed to populate rule
# crap, still empty 20110227 this is due to safety net exclusions -> 1 .2 1 .2
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:8(?:0\.241|2\.177)|1(?:0\.13|8\.9)6|25\.16[06])|41\.141)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:8(?:0\.241|2\.177)|1(?:0\.13|8\.9)6|25\.160)|41\.141)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0.4
@@ -93,7 +93,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:7(?:8\.(?:49\.255|63\.70)|5\.100\.127)|80\.214\.23[23]|13\.162\.141|25\.163\.55|98\.106\.26)|21(?:3\.(?:186\.38|233\.64)|7\.118\.81)|8(?:1\.192\.211|5\.26\.225|0\.95\.70)|7(?:7\.232\.14[23]|4\.53\.39)|9(?:1\.203\.67|8\.139\.91)|6(?:2\.75\.193|1\.19\.66)|41\.137\.24)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:0\.214\.23[23]|7\.61\.61)|7(?:5\.100\.127|8\.49\.255)|19\.200\.35|95\.161\.9)|2(?:1(?:3\.(?:186\.38|233\.64)|7\.118\.81)|00\.80\.13)|8(?:1\.192\.211|5\.26\.225)|98\.1(?:02\.168|39\.91)|77\.232\.142|41\.137\.24|62\.75\.193)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -112,7 +112,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.(?:87\.(?:1(?:28|36)|74)|233\.64|5\.178)|7\.(?:118\.(?:83|90)|66\.146)|8\.248\.64)|0(?:2\.1(?:52\.243|64\.161)|7\.57\.124|0\.80\.13|3\.82\.95))|8(?:5\.(?:26\.(?:1(?:6[45]|8[46])|2(?:3[2345]|41))|115\.248)|1\.192\.(?:2(?:11|38)|199)|3\.149\.(?:38?|21)|2\.178\.69|8\.190\.12)|1(?:13\.(?:162\.56|56\.28)|87\.45\.193|95\.91\.70)|6(?:1\.19\.66|9\.67\.29)|98\.1(?:02\.168|39\.44)|41\.95\.4)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.(?:87\.(?:1(?:28|36)|74)|233\.64|5\.178)|7\.(?:118\.(?:83|90)|66\.146)|8\.248\.64)|0(?:2\.1(?:52\.243|64\.161)|7\.57\.124))|8(?:5\.(?:26\.(?:2(?:3[2345]|41)|1(?:6[45]|84))|115\.248)|1\.192\.2(?:11|38)|3\.149\.(?:38?|21)|2\.178\.69)|1(?:28\.121\.191|98\.106\.26|13\.56\.28|78\.63\.70)|9(?:2\.243\.17|8\.139\.44)|6(?:1\.19\.66|9\.67\.29))\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -130,7 +130,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:8\.1|9\.2)|0\.253\.4)|30\.154\.215)|2(?:10\.47\.94|8\.0\.238)|5\.163\.212)|3\.(?:2(?:3\.143\.155|54\.241\.29)|68\.35\.110)|(?:4\.63\.140\.4|8\.247\.40\.2)2|0\.(?:145\.73\.164|205\.182\.81))|8(?:7\.(?:45\.193\.1(?:67|74)|141\.84\.87|61\.61\.169)|8\.(?:1(?:38\.32\.142|65\.223\.87)|2\.88\.236)|9\.(?:38\.(?:50\.233|86\.19)|62\.60\.211)|(?:0\.230\.249\.6|2\.18\.31\.7)2|4\.154\.138\.118)|1(?:8\.(?:97\.(?:15\.(?:19|20)|252\.234)|32\.200\.134|127\.4\.50)|0\.172\.153\.105|9\.112\.122\.169|2\.164\.148\.2|5\.78\.0\.207)|7(?:8\.(?:18\.129\.49|208\.83\.18|63\.70\.214)|3\.212\.254\.180|4\.137\.172\.84)|2(?:5\.163\.(?:249\.195|55\.230)|1\.52\.147\.12|4\.243\.13\.16)|09\.(?:8(?:6\.139\.114|7\.82\.26)|100\.94\.217|72\.95\.101)|61\.132\.253\.26)|8(?:9\.(?:1(?:0(?:8\.(?:111\.110|76\.243)|1\.165\.150|4\.72\.14)|21\.202\.195|8\.180\.22|7\.196\.7)|2(?:1(?:6\.181\.209|8\.52\.234)|28\.195\.196|08\.41\.167|49\.48\.31))|7\.
(?:106\.(?:1(?:0(?:1\.154|\.20)|76\.124)|9(?:0\.108|4\.73)|206\.106|75\.39)|2(?:4(?:2\.72\.180|5\.3\.98)|33\.12\.82))|2\.(?:1(?:93\.140\.168|65\.27\.42|40\.81\.3)|200\.25\.150)|3\.(?:1(?:69\.4(?:2\.27|\.84)|42\.111\.228)|98\.163\.87)|8\.(?:19(?:0\.12\.240|8\.7\.58)|255\.153\.106)|0\.(?:249\.248\.158|95\.70\.173|65\.16\.71)|1\.1(?:3\.(?:72\.14|66\.5)8|77\.22\.81)|4\.(?:15\.191\.254|20\.36\.42)|6\.1(?:07\.184\.148|10\.94\.3)|5\.92\.129\.132)|2(?:0(?:8\.(?:117\.40\.168|78\.147\.242|87\.242\.130|43\.232\.34)|7\.(?:5(?:7\.124\.67|8\.143\.21)|253\.227\.202)|0\.(?:(?:98\.246\.22|80\.13\.6)6|219\.245\.41)|2\.(?:125\.33\.114|71\.102\.178)|5\.(?:186\.165\.32|209\.97\.171)|1\.(?:55\.165\.134|81\.37\.253)|4\.202\.23\.119)|1(?:3\.(?:1(?:8(?:8\.130\.113|6\.38\.38)|32\.197\.138)|5(?:\.178\.5[56789]|9\.176\.86)|2(?:51\.135\.152|01\.40\.23))|2\.(?:1(?:19\.184\.94|59\.53\.26)|68\.54\.253)|7\.19(?:5\.180\.130|9\.218\.172)|1\.154\.141\.169|0\.212\.245\.44|8\.248\.44\.196)|2(?:1\.(?:120\.224\.14
7|2\.231\.58)|2\.252\.223\.2)|4\.1\.35\.73)|9(?:1\.(?:1(?:21\.99\.104|49\.157\.37|95\.80\.41)|2(?:04\.116\.115|25\.119\.242))|3\.(?:1(?:86\.119\.109|57\.0\.2)|75\.194\.231|91\.196\.99)|2\.(?:24(?:3\.17\.(?:147|221)|5\.188\.135)|38\.229\.70)|4\.23\.(?:(?:200\.5|60\.12)4|14\.32)|5\.1(?:42\.161\.107|66\.102\.145)|8\.102\.168\.6[12]|0\.156\.149\.184|6\.226\.4\.60)|6(?:2\.(?:1(?:40\.2(?:47\.94|53\.15)|93\.2(?:47\.34|34\.9)|29\.200\.133)|75\.1(?:(?:48\.25|62\.11)0|93\.1(?:57|68)))|9\.(?:6(?:4\.155\.181|7\.29\.34)|137\.252\.155)|7\.2(?:28\.(?:134\.50|88\.28)|07\.77\.35)|0\.(?:190\.218\.103|251\.150\.202)|6\.(?:109\.109\.161|58\.243\.150)|4\.187\.104\.95|1\.19\.251\.68)|7(?:4\.(?:8(?:6\.(?:158\.2|92\.44)|2\.196\.209)|5(?:3\.39\.25|0\.95\.1)0)|6\.1(?:6(?:4\.226\.166|8\.107\.253|\.37\.140)|2\.19\.4)|7\.2(?:3(?:9\.64\.5|2\.83\.)2|46\.144\.140)|8\.(?:96\.144\.162|155\.22\.36)|9\.(?:174\.78\.194|96\.48\.103)|2\.55\.165\.169|0\.32\.73\.76)|4(?:1\.137\.(?:24|30|56)\.4|6\.180\.39\.166)|58\.
150\.55\.59)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:8\.1|9\.2)|0\.253\.4)|30\.154\.215)|2(?:10\.47\.94|8\.0\.238)|5\.163\.212)|3\.(?:2(?:5(?:4\.241\.29|1\.61\.2)|3\.143\.155)|68\.35\.110)|8\.(?:106\.26\.(?:54|76)|247\.40\.22)|0\.(?:145\.73\.164|205\.182\.81)|4\.63\.140\.42)|8(?:8\.(?:1(?:38\.32\.142|65\.223\.87)|72\.232\.55|2\.88\.236)|7\.(?:45\.193\.1(?:67|74)|141\.84\.87|61\.61\.169)|9\.(?:38\.(?:50\.233|86\.19)|62\.60\.211)|0\.230\.249\.62)|1(?:8\.(?:(?:32\.200\.1|97\.252\.2)34|127\.4\.50)|0\.172\.153\.105|9\.112\.122\.169|2\.164\.148\.2|5\.78\.0\.207)|7(?:4\.1(?:23\.110\.26|37\.172\.84)|8\.(?:18\.129\.49|63\.70\.214)|3\.212\.254\.180)|09\.(?:8(?:6\.139\.114|7\.82\.26)|100\.94\.217|72\.95\.101)|2(?:8\.121\.191\.18[12]|4\.107\.38\.189|1\.52\.147\.12)|61\.132\.253\.26)|8(?:9\.(?:1(?:0(?:8\.(?:111\.110|76\.243)|1\.165\.150|4\.72\.14)|22\.203\.136|8\.180\.22|7\.196\.7)|2(?:16\.181\.209|08\.41\.167|49\.48\.31)|77\.122\.39)|7\.(?:106\.(?:1(?:0(?:1\.154
|\.20)|76\.124)|9(?:0\.108|4\.73)|206\.106|75\.39)|2(?:4(?:2\.72\.180|5\.3\.98)|33\.12\.82))|2\.(?:1(?:93\.140\.168|65\.27\.42|40\.81\.3)|200\.25\.150)|3\.(?:1(?:42\.111\.228|69\.42\.27)|98\.163\.87)|1\.(?:1(?:3\.72\.148|77\.22\.81)|202\.116\.25)|6\.(?:1(?:07\.184\.148|10\.94\.3)|73\.27\.114)|8\.(?:19(?:0\.12\.240|8\.7\.58)|255\.153\.106)|0\.(?:249\.248\.158|95\.70\.173|65\.16\.71)|4\.(?:1(?:5\.191\.254|0\.8\.25)|20\.36\.42)|5\.92\.129\.132)|2(?:1(?:3\.(?:1(?:8(?:8\.130\.113|6\.38\.38)|32\.197\.138|71\.218\.196)|5(?:\.178\.5[456789]|9\.176\.86)|2(?:51\.135\.152|01\.40\.23))|2\.(?:1(?:19\.184\.94|59\.53\.26)|6(?:7\.198\.23|8\.54\.25)3|232\.70\.228)|7\.19(?:5\.180\.130|9\.218\.172)|1\.154\.141\.169|0\.212\.245\.44|8\.248\.44\.196)|0(?:7\.(?:5(?:7\.124\.67|8\.143\.21)|253\.227\.202)|0\.(?:(?:98\.246\.22|80\.13\.6)6|219\.245\.41)|8\.(?:78\.147\.242|87\.242\.130|43\.232\.34)|2\.(?:125\.33\.114|71\.102\.178)|5\.(?:186\.165\.32|209\.97\.171)|1\.(?:55\.165\.134|81\.37\.253))|2(?:2\.
252\.223\.2|1\.2\.231\.58)|4\.1\.35\.73)|9(?:1\.(?:1(?:21\.99\.104|49\.157\.37|95\.80\.41)|2(?:04\.116\.115|25\.119\.242))|5\.1(?:6(?:8\.1(?:83\.240|75\.39)|6\.102\.145)|42\.161\.107)|3\.(?:1(?:86\.119\.109|57\.0\.2)|75\.194\.231|91\.196\.99)|2\.(?:24(?:3\.17\.(?:147|221)|5\.188\.135)|38\.229\.70)|4\.23\.(?:(?:200\.5|60\.12)4|14\.32)|0\.156\.149\.184|8\.102\.168\.61)|6(?:2\.(?:1(?:40\.2(?:47\.94|53\.15)|93\.2(?:47\.34|34\.9)|29\.200\.133)|75\.1(?:(?:48\.25|62\.11)0|93\.1(?:57|68)))|7\.2(?:28\.(?:134\.50|88\.28)|07\.77\.35)|0\.(?:190\.218\.103|251\.150\.202)|4\.(?:187\.104\.9|34\.131\.23)5|9\.6(?:4\.155\.181|7\.29\.34)|6\.109\.109\.161|1\.19\.251\.68)|7(?:4\.(?:8(?:6\.(?:158\.2|92\.44)|2\.196\.209)|5(?:3\.39\.25|0\.95\.1)0)|7\.2(?:23\.132\.158|46\.144\.140|39\.64\.52)|6\.1(?:6(?:8\.107\.253|\.37\.140)|2\.19\.4)|2\.(?:47\.203\.228|55\.165\.169)|8\.(?:96\.144\.162|155\.22\.36)|9\.(?:174\.78\.194|96\.48\.103)|0\.32\.73\.76)|4(?:1\.137\.(?:24|30|56)\.4|6\.180\.39\.166)|58\.150\.5
5\.59)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -147,14 +147,14 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# Spamhaus DROP, http://www.spamhaus.org/drop/
-header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567])|04\.[01234567])|57\.(?:6[456789]|7\d))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|9\.(?:1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|2(?:30\.(?:6[456789]|10[0123]|[789]\d)|4(?:5\.138|6\.215))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|3\.(?:1(?:
0(?:4\.(?:1(?:[47]6|10|2)|[39]4|253|41)|5\.(?:1(?:[78]4|32|41)|2(?:07|45))|6\.3[2345])|6(?:9\.25[01]|\.100)|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|2\.(?:2(?:23\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789]|63\.14[4567])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6
[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:28|97)|2\.125|8\.151)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|4\.138\.1(?:4[456789]|5\d)|0\.(?:[27]5|120|67))|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|94\.1(?:8[456789]|9[01])|26\.24[45]|07\.208)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|
5[01])|52\.255|89\.224)|5\.(?:2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89]))|1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|72\.24[4567]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|6\.(?:2(?:2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01]))|01\.(?:6[0123]|4[89]|5\d))|197\.(?:17[567]|2[89]))|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|36\.(?:1(?:1[01]|0\d)|9[6789])|13\.(?:6[0123]|4[89]|5\d))|7\.18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:81\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789]|4[01234567]))|151\.(?:19[23456789]|
20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|0\.17[2345]|7\.249)|2(?:0\.(?:(?:11|9)0|62)|2\.6[4567]|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.24[0134567])|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:1[03]|9[89]|59|61)))
|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.98\.1(?:1[23456789]|2[01234567])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.97?)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|3\.0\.(?:[023456789]|1[012345]?)|58\.83\.(?:[89]|1[012345]))\b)/
+header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567])|04\.[01234567])|57\.(?:6[456789]|7\d))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|9\.(?:1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|2(?:30\.(?:6[456789]|10[0123]|[789]\d)|4(?:5\.138|6\.215))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|3\.(?:1(?:
0(?:4\.(?:1(?:[47]6|10|2)|[39]4|253|41)|5\.(?:1(?:[78]4|32|41)|2(?:07|45))|6\.3[2345])|6(?:9\.25[01]|\.100)|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|2\.(?:2(?:23\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789]|63\.14[4567])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6
[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:28|97)|2\.125|8\.151)|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|94\.1(?:8[456789]|9[01])|26\.24[45]|07\.208)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[4
56789]|5[01])|52\.255|89\.224)|5\.(?:2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89]))|1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|72\.24[4567]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|6\.(?:2(?:2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01]))|01\.(?:6[0123]|4[89]|5\d))|197\.(?:17[567]|2[89]))|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|36\.(?:1(?:1[01]|0\d)|9[6789])|13\.(?:6[0123]|4[89]|5\d))|7\.18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:81\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789]|4[01234567]))|151\.(?:19[234
56789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|0\.17[2345]|7\.249)|2(?:0\.(?:(?:11|9)0|62)|2\.6[4567]|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.24[0134567])|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:1[03]|9[89]|5
9|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.98\.1(?:1[23456789]|2[01234567])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.97?)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345])|3\.0\.[01234567])\b)/
describe KHOP_SPAMHAUS_DROP Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP nopublish
score KHOP_SPAMHAUS_DROP 1 0.2 1 0.2
# spam/ham s/o corpus
# 0.0349/0.0029 0.924 20110227@510k
-header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567])|04\.[01234567])|57\.(?:6[456789]|7\d))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|9\.(?:1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|2(?:30\.(?:6[456789]|10[0123]|[789]\d)|4(?:5\.138|6\.215))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|3\
.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|[39]4|253|41)|5\.(?:1(?:[78]4|32|41)|2(?:07|45))|6\.3[2345])|6(?:9\.25[01]|\.100)|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|2\.(?:2(?:23\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789]|63\.14[4567])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[
01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:28|97)|2\.125|8\.151)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|4\.138\.1(?:4[456789]|5\d)|0\.(?:[27]5|120|67))|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|94\.1(?:8[456789]|9[01])|26\.24[45]|07\.208)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[
456789]|5[01])|52\.255|89\.224)|5\.(?:2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89]))|1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|72\.24[4567]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|6\.(?:2(?:2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01]))|01\.(?:6[0123]|4[89]|5\d))|197\.(?:17[567]|2[89]))|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|36\.(?:1(?:1[01]|0\d)|9[6789])|13\.(?:6[0123]|4[89]|5\d))|7\.18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:81\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789]|4[01234567]))|151\.(?:19[23
456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|0\.17[2345]|7\.249)|2(?:0\.(?:(?:11|9)0|62)|2\.6[4567]|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.24[0134567])|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:1[03]|9[89]|
59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.98\.1(?:1[23456789]|2[01234567])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.97?)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|3\.0\.(?:[023456789]|1[012345]?)|58\.83\.(?:[89]|1[012345]))\b)/
+header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567])|04\.[01234567])|57\.(?:6[456789]|7\d))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|9\.(?:1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|2(?:30\.(?:6[456789]|10[0123]|[789]\d)|4(?:5\.138|6\.215))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|3\
.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|[39]4|253|41)|5\.(?:1(?:[78]4|32|41)|2(?:07|45))|6\.3[2345])|6(?:9\.25[01]|\.100)|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|2\.(?:2(?:23\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789]|63\.14[4567])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[
01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:28|97)|2\.125|8\.151)|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|94\.1(?:8[456789]|9[01])|26\.24[45]|07\.208)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\
.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89]))|1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|72\.24[4567]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|6\.(?:2(?:2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01]))|01\.(?:6[0123]|4[89]|5\d))|197\.(?:17[567]|2[89]))|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|36\.(?:1(?:1[01]|0\d)|9[6789])|13\.(?:6[0123]|4[89]|5\d))|7\.18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:81\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789]|4[01234567]))|151\.(
?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|0\.17[2345]|7\.249)|2(?:0\.(?:(?:11|9)0|62)|2\.6[4567]|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.24[0134567])|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:1[03]
|9[89]|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.98\.1(?:1[23456789]|2[01234567])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.97?)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345])|3\.0\.[01234567])\b)/
describe KHOP_SPAMHAUS_DROP_LE Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP_LE nopublish
score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 # adds to KHOP_SPAMHAUS_DROP
@@ -164,7 +164,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:5\.(?:[2568]|1(?:0[013]|14?|21)|9[6789]?|3[5679]|4[3467])|3\.(?:[0234567]|8[12456789]?|9[01345679]?|1\d?)|9\.(?:2(?:2[0123]|[01]\d)|19[23456789])|6\.(?:2[023456789]|1[6789]|3[459]|63))|3\.(?:1(?:62\.(?:2(?:2[4578]|4[3456]|3[48])|1(?:3[23]|24|41)|7[047]|6[57]|[59]6)|0\.16[3457])|56\.28)|6\.71\.(?:1(?:[01367]|4[456789]?|5[01]?)?|2(?:[34789]|2[0123]|0[89]|1\d)|5[256]?|4[16]|3?3)|7\.(?:24(?:1\.(?:24[48]|80)|2\.(?:44|1))|198\.32)|4\.112\.2(?:4[3579]|51)|5\.92\.136)|2(?:5\.(?:23(?:4\.144|5\.192)|162\.243)|2\.55\.106)|9(?:6\.20(?:2\.2(?:07|14)|1\.75)|5\.91\.70)|8(?:3\.93\.(?:[0135]|21?)|0\.149\.8)|7(?:5\.100\.64|8\.49\.255))|2(?:1(?:3\.(?:87\.(?:1(?:14|28|36)|8[789]|9[012]|7[46])|(?:108\.17|226\.6)3)|7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|8\.(?:104\.156|248\.64)|2\.60\.73)|0(?:2\.1(?:52\.243|24\.75)|3\.(?:171\.197|82\.95)|1\.191\.19[58]|0\.85\.24))|8(?:5\.(?:26\.(?:1(?:8[346]|6[45]|55)|2(?:3[2345
]|41))|115\.248)|3\.149\.(?:[89]|4[4567]|3[68]?|2[18])|1\.192\.(?:2(?:1[15]|38)|199)|2\.1(?:28\.(?:54|62)|78\.69)|9\.204\.1(?:37|53)|0\.83\.23[89])|41\.(?:2(?:02\.(?:19[23456789]|20[0123])|18\.238)|1(?:89\.19|99\.11)3|95\.(?:[48]|1[02])|59\.[05]|71\.136)|5(?:9\.9(?:8\.(?:1[59]2|240)|7\.217|9\.40)|8\.64\.187)|61\.19\.6[567])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:3\.(?:[0234567]|1[012345689]?|8[12456789]?|9[01345679]?)|9\.(?:2(?:1[012356789]|2[0123]|0\d)|19[23456789])|5\.(?:[258]|1(?:0[013]|21)|3[579]|4[467]|9[789])|6\.(?:2[02345789]|1[6789]|3[458]|63))|3\.(?:1(?:62\.(?:2(?:2[4578]|4[3456]|3[48])|1(?:3[23]|24|41)|7[047]|[59]6|67)|0\.16[3457])|56\.28)|6\.71\.(?:2(?:[349]|1[23456789]|2[0123]|0[89])|1(?:[0137]|4[45678]|5[01])?|5[25]?|35?|45)|7\.(?:24(?:1\.(?:248|80)|2\.44)|198\.32)|4\.112\.2(?:4[3579]|51)|5\.92\.136)|2(?:5\.(?:23(?:4\.144|5\.192)|162\.243)|2\.55\.106)|9(?:6\.20(?:2\.2(?:07|14)|1\.75)|5\.91\.70)|8(?:3\.93\.[01235]|0\.149\.8)|7(?:5\.100\.64|8\.49\.255))|2(?:1(?:3\.(?:87\.(?:1(?:14|28|36)|8[789]|9[012]|7[46])|(?:108\.17|226\.6)3)|7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|8\.(?:104\.156|248\.64))|0(?:2\.1(?:52\.243|24\.75)|1\.191\.19[58]|0\.85\.24|3\.82\.95))|8(?:5\.(?:26\.(?:1(?:8[346]|6[45]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:[89]|4[
4567]|3[68]?|2[18])|1\.192\.(?:2(?:1[15]|38)|199)|2\.1(?:28\.(?:54|62)|78\.69)|0\.83\.23[89]|9\.204\.153)|41\.(?:202\.(?:19[23456789]|20[12])|1(?:89\.19|99\.11)3|95\.(?:[48]|1[02])|59\.[05])|5(?:9\.9(?:7\.217|8\.192|9\.40)|8\.64\.187)|61\.19\.6[567])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6