You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/03/30 07:57:17 UTC
svn commit: r1086847 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Mar 30 05:57:17 2011
New Revision: 1086847
URL: http://svn.apache.org/viewvc?rev=1086847&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1086847&r1=1086846&r2=1086847&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Mar 30 05:57:17 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201103291
+## khop-sc-neighbors.cf v 201103301
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -93,7 +93,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.233\.64|7\.118\.81|9\.94\.155|1\.147\.3)|0(?:0\.(?:234\.196|80\.13)|8\.43\.232))|1(?:7(?:4\.1(?:37\.172|42\.10)|5\.100\.127|8\.49\.255)|80\.214\.232)|7(?:7\.232\.142|4\.50\.95)|87\.106\.94|98\.139\.91)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.233\.64|7\.118\.81|9\.94\.155|1\.147\.3)|0(?:0\.234\.196|8\.43\.232))|1(?:7(?:5\.100\.127|4\.142\.10|8\.49\.255)|8(?:0\.214\.232|7\.61\.61))|(?:61\.19\.25|98\.139\.9)1|7(?:7\.232\.142|4\.50\.95)|80\.65\.16)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -112,7 +112,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:7\.(?:118\.(?:83|90)|66\.146)|3\.(?:186\.3|5\.17)8)|0(?:9\.205\.22[45]|2\.152\.243|7\.57\.124|3\.82\.95))|8(?:5\.(?:26\.(?:23[234]|164)|115\.248)|(?:7\.106\.1|0\.95\.7)0|1\.192\.2(?:11|38)|3\.149\.(?:38?|21)|2\.178\.69)|1(?:8(?:7\.(?:45\.193|61\.61)|0\.232\.105)|78\.63\.70)|9(?:8\.139\.(?:44|91)|1\.149\.157)|6(?:2\.193\.234|1\.19\.66))\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:(?:2\.152\.24|0\.80\.1)3|9\.205\.22[45]|7\.57\.124|3\.82\.95)|1(?:7\.(?:118\.(?:83|90)|66\.146)|3\.(?:186\.3|5\.17)8))|8(?:5\.(?:26\.(?:23[234]|164)|115\.248)|(?:7\.106\.1|0\.95\.7)0|1\.192\.2(?:11|38)|3\.149\.(?:38?|21)|2\.178\.69)|1(?:8(?:0\.232\.105|7\.45\.193)|78\.63\.70)|9(?:8\.139\.(?:44|91)|1\.149\.157)|6(?:2\.193\.234|1\.19\.66))\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -130,7 +130,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:2(?:1(?:7\.(?:1(?:9(?:5\.180\.130|9\.218\.172)|(?:28\.11\.22|56\.58\.9)6)|(?:3(?:6\.121\.15|9\.43\.19)|41\.13\.7)4)|3\.(?:5(?:\.178\.(?:5[0348]|4[68])|9\.176\.86)|2(?:51\.135\.152|01\.40\.23)|18(?:8\.130\.113|6\.38\.38))|2\.(?:199\.29\.145|232\.70\.228|91\.188\.26)|6\.(?:108\.235\.219|55\.139\.104)|1\.(?:202\.2\.178|147\.3\.74)|0\.185\.183\.67|8\.248\.44\.196|9\.94\.155\.142)|0(?:0\.(?:2(?:34\.196\.(?:188|233)|19\.245\.41)|(?:98\.246\.22|4\.167\.5|80\.13\.6)6)|(?:9\.212\.153\.18|1\.55\.165\.13)4|2\.(?:125\.33\.114|71\.102\.178)|7\.(?:253\.227\.202|57\.124\.67)|8\.(?:87\.242\.130|43\.232\.34)|4\.202\.23\.119|5\.209\.97\.171)|2(?:2\.(?:252\.223\.|99\.39\.19)2|1\.120\.224\.147))|8(?:7\.(?:1(?:06\.(?:1(?:76\.124|0\.20)|9(?:0\.108|4\.73)|75\.39)|98\.176\.162)|2(?:4(?:(?:9\.113\.21|5\.3\.9)8|2\.72\.180)|19\.204\.105|33\.12\.82)|69\.160\.88)|9\.(?:1(?:61\.(?:1(?:(?:76\.16|54\.1)7|89\.62)|227\.171)|0(?:1\.165\.15|8\.111\.11)0)|2(?:0(
?:8\.41\.167|5\.58\.69)|49\.48\.32)|77\.122\.39)|1\.(?:1(?:99\.173\.194|78\.18\.166|3\.72\.148)|2(?:03\.188\.38|9\.225\.129))|0\.(?:2(?:49\.248\.158|38\.225\.66)|(?:85\.98\.13|95\.70\.17)3|65\.16\.71)|2\.(?:1(?:78\.192\.244|65\.27\.42|40\.81\.3)|200\.25\.150)|3\.(?:1(?:42\.111\.228|69\.42\.27)|98\.163\.87)|8\.2(?:55\.153\.106|22\.84\.110)|5\.(?:11\.196\.106|222\.67\.35)|4\.(?:109\.238\.83|50\.91\.98)|6\.110\.94\.3)|1(?:9(?:5\.(?:1(?:6(?:0\.253\.4|1\.9\.2)|30\.154\.215)|5\.163\.212|24\.89\.3)|0\.(?:246\.188\.94|41\.146\.80)|3\.(?:120\.102\.123|251\.61\.2)|8\.(?:106\.26\.54|247\.40\.22)|4\.63\.140\.42)|8(?:8\.(?:1(?:65\.223\.87|20\.32\.35)|214\.36\.189|72\.232\.55)|7\.(?:45\.(?:193\.1(?:67|74)|241\.30)|61\.61\.169)|3\.96\.90\.129|9\.62\.60\.211)|7(?:4\.(?:1(?:3(?:2\.242\.10|7\.172\.84)|23\.110\.26|42\.10\.193)|36\.60\.27)|8\.(?:63\.70\.214|8\.123\.88)|3\.212\.254\.180)|1(?:9\.2(?:00\.35\.19[24]|35\.30\.51)|8\.(?:32\.200\.134|127\.4\.50)|6\.50\.210\.90)|3(?:1\.114\.25\.127|0\.9
4\.222\.48)|09\.(?:86\.139\.114|156\.80\.81)|28\.121\.191\.229)|6(?:2\.(?:7(?:5\.193\.1(?:57|68)|7\.185\.17)|1(?:29\.200\.133|93\.234\.9)|43\.38\.97)|7\.(?:22(?:5\.166\.182|7\.131\.186|8\.88\.28)|15\.97\.82)|0\.(?:2(?:51\.150\.202|34\.63\.6)|54\.177\.22)|6\.(?:110\.120\.29|96\.80\.182)|9\.(?:64\.155\.181|36\.13\.22)|4\.(?:62\.132\.44|77\.63\.20)|1\.19\.251\.68|8\.114\.212\.4)|7(?:9\.(?:9(?:6\.48\.103|9\.24\.110)|182\.110\.165|0\.173\.172|87\.209\.93|29\.35\.14)|7\.(?:2(?:3(?:6\.164\.31|2\.83\.2)|23\.132\.158)|7(?:3\.208\.100|8\.158\.136))|4\.(?:8(?:2\.198\.189|6\.158\.2)|5(?:4\.138\.74|0\.95\.10)|201\.15\.[24])|2\.4(?:6\.128\.247|7\.203\.228)|8\.(?:154\.213\.218|7\.71\.243))|9(?:2\.(?:8(?:5\.231\.89|7\.192\.98)|237\.201\.39|38\.229\.70|48\.68\.24)|1\.(?:1(?:21\.9(?:2\.175|9\.104)|49\.157\.37)|204\.116\.115)|5\.(?:1(?:43\.188\.203|9\.0\.25)|211\.20\.19|86\.7\.37)|3\.(?:186\.119\.109|27\.200\.244|91\.49\.15)|0\.156\.149\.184)|4(?:(?:1\.137\.(?:24|30|56)\.|6\.24\.254\.21)4|3\.2
44\.233\.173)|5(?:9\.13\.159\.181|8\.150\.55\.59))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:8(?:9\.(?:1(?:61\.(?:1(?:(?:76\.16|54\.1)7|89\.62)|227\.171)|01\.165\.150|57\.171\.73)|2(?:0(?:8\.41\.167|5\.58\.69)|49\.48\.32|\.249\.220)|77\.122\.39)|7\.(?:2(?:4(?:(?:9\.113\.21|5\.3\.9)8|2\.72\.180)|19\.204\.105|33\.12\.82)|1(?:06\.(?:9(?:0\.108|4\.73)|10\.20|75\.39)|98\.176\.162)|69\.160\.88)|1\.(?:2(?:41\.242\.152|03\.188\.38|9\.225\.129)|1(?:99\.173\.194|78\.18\.166|3\.72\.148)|60\.136\.45)|0\.(?:2(?:49\.248\.158|38\.225\.66)|(?:85\.98\.13|95\.70\.17)3|65\.16\.71)|5\.(?:1(?:1\.196\.106|35\.19\.14)|2(?:6\.113\.210|22\.67\.35)|71\.155\.59)|2\.(?:1(?:78\.192\.244|65\.27\.42|40\.81\.3)|200\.25\.150|99\.42\.28)|4\.(?:1(?:09\.238\.83|21\.165\.75)|252\.57\.199|50\.91\.98)|3\.(?:1(?:42\.111\.228|69\.42\.27)|71\.162\.149)|6\.(?:1(?:52\.164\.24|10\.94\.3)|40\.146\.22)|8\.2(?:55\.153\.106|22\.84\.110))|2(?:1(?:3\.(?:5(?:\.178\.(?:4[468]|5[03])|9\.176\.86)|2(?:51\.135\.152|01\.40\.23)|18(?:8\.130\.113|6\.38\.38)|92\.191\.162)|7\.(
?:1(?:9(?:5\.180\.130|9\.218\.172)|(?:28\.11\.22|56\.58\.9)6)|(?:3(?:6\.121\.15|9\.43\.19)|41\.13\.7)4)|6\.(?:108\.235\.219|55\.139\.104)|2\.(?:199\.29\.145|91\.188\.26)|1\.(?:202\.2\.178|147\.3\.74)|0\.185\.183\.(?:67|71)|8\.248\.44\.196|9\.94\.155\.142)|0(?:0\.(?:(?:98\.246\.22|4\.167\.5|80\.13\.6)6|2(?:34\.196\.233|19\.245\.41))|(?:1\.(?:116\.224\.24|55\.165\.13)|9\.212\.153\.18|2\.125\.33\.11)4|8\.(?:87\.242\.130|43\.232\.34)|4\.202\.23\.119|5\.209\.97\.171|7\.57\.124\.67)|2(?:1\.(?:120\.224\.147|201\.220\.119)|2\.99\.39\.192))|1(?:9(?:5\.(?:1(?:6(?:0\.253\.4|1\.9\.2)|30\.154\.215)|5\.163\.212|24\.89\.3)|0\.(?:(?:145\.73\.16|246\.188\.9)4|41\.146\.80)|4\.(?:(?:63\.140\.4|7\.45\.16)2|208\.254\.11)|8\.(?:106\.26\.54|247\.40\.22)|3\.120\.102\.123|6\.211\.214\.139)|7(?:4\.(?:1(?:3(?:2\.242\.10|7\.172\.84)|23\.110\.26|42\.10\.193)|36\.60\.27)|3\.(?:161\.145\.121|212\.254\.180)|8\.(?:63\.70\.214|8\.123\.88))|8(?:7\.(?:45\.(?:193\.1(?:67|74)|241\.30)|61\.61\.169)|8\.(?:1(?:65\.
223\.87|20\.32\.35)|72\.232\.55)|9\.62\.60\.211)|1(?:8\.(?:32\.200\.134|127\.4\.50)|9\.2(?:00\.35\.192|35\.30\.51)|6\.50\.210\.90)|2(?:1\.138\.155\.166|8\.121\.191\.229)|09\.156\.80\.81|30\.94\.222\.48)|7(?:7\.(?:2(?:3(?:1\.215\.91|2\.83\.2)|23\.132\.158|9\.130\.53)|7(?:3\.208\.100|8\.158\.136))|4\.(?:8(?:2\.198\.189|6\.158\.2)|5(?:4\.138\.74|0\.95\.10))|8\.(?:15(?:4\.213\.218|9\.143\.30)|96\.144\.162|7\.71\.243)|9\.(?:9(?:6\.48\.103|9\.24\.110)|87\.209\.93|29\.35\.14)|2\.46\.128\.247)|6(?:2\.(?:7(?:5\.193\.1(?:57|68)|7\.185\.17)|1(?:29\.200\.133|93\.234\.9)|43\.38\.97)|(?:7\.(?:225\.166\.1|15\.97\.)|6\.96\.80\.1)82|0\.(?:2(?:51\.150\.202|34\.63\.6)|54\.177\.22)|9\.(?:64\.155\.181|36\.13\.22)|4\.(?:62\.132\.44|77\.63\.20)|1\.19\.251\.68|8\.114\.212\.4)|9(?:1\.(?:1(?:21\.92\.175|49\.157\.37)|204\.116\.115)|4\.1(?:(?:74\.158\.4|85\.199\.6)5|59\.132\.90)|3\.(?:186\.119\.109|27\.200\.244|91\.49\.15)|5\.(?:143\.188\.203|211\.20\.19|86\.7\.37)|2\.(?:237\.201\.39|87\.192\.98)|0\.15
6\.149\.184)|4(?:(?:1\.137\.(?:24|56)\.|6\.24\.254\.21)4|3\.244\.233\.173)|5(?:9\.13\.159\.181|8\.150\.55\.59))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -147,14 +147,14 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# Spamhaus DROP, http://www.spamhaus.org/drop/
-header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[01
23])|98\.1(?:[678]\d|9[01])|20\.163)|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:9\.25[01]|\.100)|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|
32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))
|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|5\.(?:2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89]))|1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|7\.18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|9\.2(?:
05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|8\.(?:81\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789]|4[01234567]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:153|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|2\.6[4567]|3\.201))|19(?:8\.(?:1
(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.(?:24[0134567]|146))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]|13|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.98\.1(?:1[23456789]|2[01234567])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))
|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.9)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|24)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345])|3\.0\.0\.[01234567])\b)/
+header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[01
23])|98\.1(?:[678]\d|9[01])|20\.163)|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:9\.25[01]|\.100)|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|
32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))
|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|5\.(?:2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89]))|1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|7\.18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|9\.2(?:
05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|8\.(?:81\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789]|4[01234567]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:153|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|2\.6[4567]|3\.201))|19(?:8\.(?:1
(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.(?:24[0134567]|146))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]|13|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.98\.1(?:1[23456789]|2[01234567])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))
|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.9)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|24)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345])|3\.0\.0\.[0123])\b)/
describe KHOP_SPAMHAUS_DROP Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP nopublish
score KHOP_SPAMHAUS_DROP 1 0.2 1 0.2
# spam/ham s/o corpus
# 0.0349/0.0029 0.924 20110227@510k
-header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|
6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:9\.25[01]|\.100)|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[0
1]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[45678
9]|5\d))|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|5\.(?:2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89]))|1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|7\.18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))
|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|8\.(?:81\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789]|4[01234567]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:153|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|2\.6[4567]|3\.201))|19(?
:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.(?:24[0134567]|146))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]|13|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.98\.1(?:1[23456789]|2[01234567])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[0
1]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.9)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|24)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345])|3\.0\.0\.[01234567])\b)/
+header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|
6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:9\.25[01]|\.100)|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[0
1]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[45678
9]|5\d))|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|5\.(?:2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89]))|1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|7\.18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))
|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|8\.(?:81\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789]|4[01234567]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:153|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|2\.6[4567]|3\.201))|19(?
:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.(?:24[0134567]|146))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]|13|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.98\.1(?:1[23456789]|2[01234567])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[0
1]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.9)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|24)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345])|3\.0\.0\.[0123])\b)/
describe KHOP_SPAMHAUS_DROP_LE Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP_LE nopublish
score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 # adds to KHOP_SPAMHAUS_DROP
@@ -164,7 +164,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:9\.(?:2(?:0[12]|12|21)|19[45])|3\.(?:[023]|9[07]|19|87)|5\.36)|3\.(?:1(?:62\.(?:2(?:4[456]|2[57])|[59]6)|0\.16[45])|56\.28)|6\.(?:71\.(?:2(?:1[234]|08|22)|1(?:47|51))|16\.99)|4\.112\.2(?:4[79]|51))|8(?:3\.93\.[01235]|0\.149\.8)|9(?:6\.202\.214|5\.91\.70)|25\.23(?:4\.144|5\.192))|8(?:5\.(?:26\.(?:1(?:6[45]|8[46])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:[89]|4[4567]|3[68]?|21)|1\.192\.(?:2(?:1[15]|38)|199)|2\.1(?:28\.(?:54|62)|78\.69)|0\.83\.23[89])|2(?:1(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|3\.87\.(?:1(?:14|28|36)|8[789]|9[012]|74)|8\.(?:104\.156|248\.64))|0(?:(?:1\.191\.1|3\.82\.)95|2\.152\.243))|41\.(?:1(?:89\.19|99\.11)3|95\.(?:[48]|12)|202\.192)|61\.19\.6[56])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.(?:1(?:62\.(?:2(?:4[46]|27)|56)|0\.16[45])|251\.195|56\.28)|9\.1(?:5(?:9\.(?:2(?:0[12]|12)|194)|3\.(?:87|0))|00\.164)|6\.(?:71\.(?:2(?:1[23]|22)|151)|16\.99)|4\.112\.24[79])|8(?:3\.93\.[01235]|0\.149\.8)|9(?:6\.202\.214|5\.91\.70)|25\.23(?:4\.144|5\.192))|8(?:5\.(?:26\.(?:1(?:6[45]|8[46])|2(?:3[2345]|41))|115\.248)|3\.149\.(?:[89]|4[4567]|3[68]?|21)|1\.192\.(?:2(?:1[15]|38)|199)|2\.1(?:28\.62|78\.69)|0\.83\.238)|2(?:1(?:3\.87\.(?:1(?:28|36)|8[789]|9[012]|74)|7\.(?:118\.(?:83|90)|66\.146|8\.225)|8\.104\.156)|0(?:(?:1\.191\.1|3\.82\.)95|2\.152\.243)|22\.84\.177)|41\.(?:1(?:89\.19|99\.11)3|95\.(?:[48]|12))|61\.19\.6[56])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6