You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/05/04 07:57:27 UTC
svn commit: r1099328 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed May 4 05:57:26 2011
New Revision: 1099328
URL: http://svn.apache.org/viewvc?rev=1099328&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1099328&r1=1099327&r2=1099328&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed May 4 05:57:26 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20110531
+## khop-sc-neighbors.cf v 20110541
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:13|87)|41|95)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:8[79]|13)|95)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -40,7 +40,7 @@ score KHOP_SC_CIDR8 0.3 0.1 0.3 0.1
# 12.1449/0.0139 0.999 20100410 net, solo=12.1966/0.0197@0.998, ->.2 .1 .3 .2
# 10.3554/0.0112 0.999 20110227@510k solo=10.3717/0.0119@0.999, ->.3 .1 .3 .1
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b1(?:17|78|89|90)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|78|90)|41)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -75,7 +75,7 @@ score KHOP_SC_CIDR16 1.0 0.2 1.0 0.2
# crap, still empty 20100410 bad scrape, script failed to populate rule
# crap, still empty 20110227 this is due to safety net exclusions -> 1 .2 1 .2
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b11(?:0\.137|3\.169)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:11(?:0\.137|3\.169)|41\.141)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0.4
@@ -93,7 +93,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:9\.205\.2(?:03|20)|0\.234\.196|3\.217\.145)|1(?:3\.2(?:26\.63|33\.64)|7\.118\.81))|1(?:19\.199\.200|78\.49\.255|95\.191\.58)|9(?:0\.156\.210|1\.203\.67|8\.139\.91)|7(?:9\.124\.92|4\.63\.57)|8(?:8\.198\.67|3\.149\.3)|62\.33\.156)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.(?:2(?:26\.63|33\.64)|108\.172)|8\.213\.77)|0(?:9\.205\.2(?:03|20)|3\.217\.145))|1(?:1(?:2\.196\.253|9\.199\.200)|78\.49\.255|01\.79\.50|24\.6\.181)|9(?:1\.(?:194\.10|203\.67)|0\.156\.210|8\.139\.91)|7(?:(?:7\.232\.14|9\.124\.9)2|4\.63\.57)|8(?:8\.198\.67|3\.149\.3))\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -112,7 +112,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:7\.(?:118\.(?:83|90)|66\.146|8\.225)|2\.199\.29|8\.213\.77)|0(?:8\.(?:67\.5[78]|43\.232)|9\.205\.22[45]|2\.152\.243))|8(?:5\.26\.(?:1(?:6[45]|84)|2(?:3[14]|41))|3\.149\.(?:38?|21)|2\.178\.69)|1(?:1(?:2\.196\.253|9\.82\.65)|95\.222\.16|01\.79\.50)|7(?:8\.46\.4[34]|7\.111\.34)|61\.19\.6[67]|91\.195\.87)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:9\.205\.2(?:03|25)|8\.67\.5[78]|2\.152\.243|3\.82\.95)|1(?:7\.(?:118\.(?:83|90)|66\.146)|2\.199\.29))|8(?:5\.26\.(?:1(?:6[45]|84)|2(?:3[14]|41))|3\.149\.(?:38?|21))|1(?:1(?:2\.196\.253|9\.82\.65)|95\.222\.16)|7(?:8\.46\.4[34]|7\.111\.34)|9(?:1\.195\.87|8\.138\.91)|6(?:2\.33\.15|1\.19\.6)6)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -130,7 +130,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:9\.(?:2(?:0(?:3\.156\.164|0\.84\.197|6\.166\.22)|35\.30\.51)|1(?:58\.1(?:36\.19|74\.71)|99\.200\.147)|82\.65\.199)|5\.(?:1(?:26\.227\.1|44\.62\.19)8|2(?:2\.125\.21|52\.2\.14)0)|8\.(?:(?:233\.172\.24|171\.33\.3)4|45\.228\.60|39\.80\.57)|4\.(?:47\.217\.109|25\.161\.23|38\.247\.48)|3\.16(?:0\.196\.110|2\.217\.101)|0\.76\.103\.221|7\.239\.69\.34)|8(?:8\.(?:12(?:(?:0\.40\.5|8\.0\.7)8|3\.129\.144|7\.132\.11)|24(?:1\.66\.68|9\.49\.43)|95\.185\.186)|3\.(?:10(?:4\.162\.167|6\.110\.131)|82\.249\.65)|9\.(?:32\.58\.241|60\.14\.132|75\.14\.186)|6\.(?:215\.210\.169|112\.250\.14)|7\.(?:45\.241\.27|35\.71\.51)|2\.71\.28\.243)|2(?:2\.1(?:6(?:0\.(?:175\.16|25\.12)1|9\.67\.58)|76\.44\.238)|1\.(?:1(?:44\.27\.84|51\.87\.82|80\.50\.96)|50\.16\.11)|5\.(?:137\.(?:24\.23|68\.14)8|230\.(?:3\.122|0\.74))|4\.123\.167\.140|3\.205\.171\.98)|9(?:5\.(?:1(?:8(?:2\.1(?:55\.214|94\.200)|9\.2(?:15\.21|34\.25)0)|91\.58\.[45]|61\.9\.2)|2(?:50\.70\.156|22\
.16\.9)|5\.41\.190)|3\.(?:(?:200\.255\.1|39\.118\.3)0|77\.221\.219)|4\.79\.23\.182)|7(?:8\.(?:1(?:40\.234\.195|62\.144\.149)|2(?:12\.79\.185|00\.95\.22)|76\.222\.70)|5\.115\.146\.167)|4\.(?:48\.108\.173|201\.69\.96)|09\.194\.198\.24|58\.250\.33\.227)|2(?:1(?:3\.(?:1(?:10\.96\.156|71\.35\.131)|27\.18\.150|56\.32\.164)|7\.(?:1(?:2\.71\.200|47\.17\.67)|23\.156\.118)|8\.2(?:1(?:2\.58\.137|3\.77\.68)|48\.65\.140)|0\.(?:219\.245\.97|89\.78\.226|126\.14\.1)|1\.(?:152\.51\.62|237\.23\.81|76\.90\.57)|2\.(?:199\.29\.145|5\.19\.71)|6\.138\.200\.18)|0(?:8\.(?:67\.58\.1[02]|43\.232\.34)|2\.(?:62\.106\.166|55\.191\.22)|0\.234\.196\.2(?:33|46)|1\.51\.232\.248|3\.250\.88\.125|4\.202\.23\.119)|2(?:0\.(?:13(?:0\.181\.45|5\.222\.97)|80\.173\.52)|2\.1(?:24\.198\.167|64\.67\.31)|1\.201\.96\.126)|\.144\.112\.181)|8(?:9\.(?:1(?:0(?:0\.168\.125|5\.158\.103|1\.232\.58)|8(?:9\.169\.77|4\.1\.232)|20\.128\.52)|250\.152\.159)|8\.(?:(?:8(?:4\.218\.25|0\.59\.6)|204\.14\.)3|198\.(?:57\.150|67\.24))|2\.(?:2
07\.119\.171|114\.79\.163|79\.192\.188|80\.232\.242)|0\.(?:195\.239\.169|235\.63\.152|77\.154\.135)|5\.(?:113\.137\.195|37\.118\.166)|1\.(?:192\.114\.13|9\.23\.22)3|6\.(?:35\.201\.200|110\.94\.3)|3\.239\.39\.166|7\.250\.208\.44|4\.22\.8\.137)|9(?:1\.(?:1(?:4(?:4\.186\.138|0\.255\.82)|(?:23\.191\.1|94\.10\.3)0)|21(?:3\.240\.240|5\.232\.34))|5\.(?:1(?:91\.(?:1(?:40\.201|53\.7)|238\.243)|80\.215\.102|7\.47\.108)|32\.119\.197)|3\.(?:1(?:90\.10(?:7\.236|4\.7)|57\.148\.102|25\.2\.169)|7(?:8\.140\.87|3\.16\.63))|4\.(?:23(?:3\.133\.1|2\.13\.)15|73\.220\.48)|0\.156\.210\.106|2\.53\.112\.21|9\.192\.47\.69)|7(?:7\.(?:2(?:2(?:1\.143\.162|3\.132\.158)|46\.(?:145\.89|55\.34))|1(?:11\.34\.143|21\.83\.180)|66\.192\.37)|8\.(?:46\.4(?:4\.185|3\.51)|154\.243\.154|26\.128\.55)|9\.1(?:24\.92\.164|74\.67\.113)|4\.(?:50\.95\.105|63\.57\.24))|6(?:2\.(?:33\.(?:1(?:56\.247|91\.144)|49\.41)|1(?:41\.122\.146|82\.91\.22)|213\.79\.233)|0\.199\.201\.120|6\.197\.244\.25|1\.19\.251\.68)|4(?:1\.1(?:37\.(?:(?
:24|30|56)\.4|63\.201)|95\.87\.8)|6\.(?:39\.1\.56|62\.6\.54))|59\.1(?:04\.141\.42|3\.159\.181))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:9\.(?:1(?:9(?:5\.125\.172|9\.200\.147)|58\.1(?:36\.19|74\.71))|2(?:06\.166\.22|35\.30\.51)|82\.65\.199)|4\.(?:4(?:6\.161\.253|7\.217\.109)|2(?:4\.144\.77|5\.161\.23)|38\.247\.48)|5\.(?:1(?:26\.227\.1|44\.62\.19)8|2(?:2\.125\.21|52\.2\.14)0)|8\.(?:(?:233\.172\.24|171\.33\.3)4|45\.228\.60|39\.80\.57)|3\.16(?:0\.196\.110|2\.217\.101)|0\.76\.103\.221|7\.239\.69\.34)|8(?:8\.(?:24(?:1\.66\.68|9\.49\.43)|12(?:0\.40\.5|8\.0\.7)8|95\.185\.186)|9\.(?:239\.89\.50|32\.58\.241|60\.14\.132|75\.14\.186)|3\.(?:10(?:4\.162\.167|6\.110\.131)|82\.249\.65)|6\.(?:215\.210\.169|112\.250\.14)|2\.71\.28\.243|7\.35\.71\.51)|2(?:2\.(?:1(?:60\.(?:1(?:75\.16|56\.2)|25\.12)1|76\.44\.238)|55\.106\.4)|5\.(?:1(?:37\.(?:24\.23|68\.14)8|43\.87\.106)|230\.(?:3\.122|0\.74))|1\.(?:1(?:(?:75\.251\.17|51\.87\.8)2|80\.50\.96)|50\.16\.11)|3\.205\.171\.98|0\.50\.70\.220)|9(?:5\.(?:1(?:8(?:2\.1(?:55\.214|94\.200)|9\.2(?:15\.21|34\.25)0)|91\.58\.[45]|61\.9\.2)|
2(?:50\.70\.156|22\.16\.9)|5\.41\.190)|3\.(?:200\.255\.1|39\.118\.3)0|0\.93\.72\.119|4\.79\.23\.182|6\.1\.111\.165)|7(?:8\.(?:1(?:40\.234\.195|62\.144\.149)|212\.79\.185|76\.222\.70)|5\.115\.146\.167)|4\.(?:48\.108\.173|201\.69\.96)|09\.194\.198\.24|58\.250\.33\.227)|2(?:1(?:3\.(?:1(?:10\.96\.156|30\.116\.18|41\.141\.72|71\.35\.131)|27\.18\.150|56\.32\.164)|7\.(?:1(?:2\.71\.200|47\.17\.67)|23\.156\.118|97\.184\.2)|8\.2(?:1(?:2\.58\.137|3\.77\.68)|48\.44\.196)|1\.(?:152\.51\.62|237\.23\.81|76\.90\.57)|0\.(?:219\.245\.97|126\.14\.1)|2\.(?:199\.29\.145|5\.19\.71)|6\.54\.194\.1[89])|0(?:2\.(?:1(?:64\.49\.210|\.199\.174)|62\.106\.166|55\.191\.22)|(?:0\.234\.196\.23|3\.235\.2\.24)3|8\.(?:67\.58\.1[02]|43\.232\.34)|4\.202\.23\.119)|2(?:2\.1(?:24\.198\.167|56\.204\.224|64\.67\.31)|0\.(?:80\.(?:173\.52|5\.205)|135\.222\.97)|1\.201\.218\.9)|\.(?:144\.112\.181|55\.147\.127))|8(?:9\.(?:1(?:0(?:0\.168\.125|5\.158\.103|1\.232\.58)|8(?:9\.169\.77|4\.1\.232)|20\.128\.52)|250\.152\.159)|8\.(
?:(?:8(?:4\.218\.25|0\.59\.6)|204\.14\.)3|198\.(?:57\.150|67\.24))|0\.(?:195\.239\.169|235\.63\.152|77\.154\.135)|1\.(?:19(?:2\.114\.133|0\.80\.205)|9\.23\.223)|2\.(?:207\.119\.171|79\.192\.188)|(?:3\.239\.39|5\.37\.118)\.166|7\.250\.208\.44|4\.22\.8\.137|6\.110\.94\.3)|9(?:1\.(?:1(?:4(?:4\.186\.138|0\.255\.82)|(?:23\.191\.1|94\.10\.3)0|03\.78\.226)|21(?:3\.240\.240|5\.232\.34))|5\.(?:1(?:91\.(?:1(?:40\.201|53\.7)|238\.243)|80\.215\.102|7\.47\.108)|32\.119\.197)|3\.(?:1(?:57\.148\.102|90\.107\.236|25\.2\.169)|86\.254\.171|73\.16\.63)|2\.5(?:4\.109\.133|3\.112\.21)|0\.156\.210\.106|4\.233\.133\.115|9\.192\.47\.69)|7(?:7\.(?:2(?:23\.(?:132\.158|5\.72)|46\.(?:145\.89|55\.34))|1(?:11\.34\.143|21\.83\.180)|66\.192\.37)|8\.(?:46\.4(?:4\.185|3\.51)|154\.225\.108|26\.128\.55)|9\.1(?:24\.92\.164|74\.67\.113)|4\.(?:50\.95\.105|63\.57\.24))|4(?:1\.(?:1(?:37\.(?:24|30|56)\.4|95\.87\.8)|84\.142\.150)|6\.(?:39\.1\.56|62\.6\.54)|3\.244\.233\.173)|6(?:2\.(?:1(?:41\.122\.146|82\.91\.22)|213\
.79\.233|33\.156\.247)|6\.197\.244\.25|1\.19\.251\.68)|59\.1(?:04\.141\.42|3\.159\.181))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -147,14 +147,14 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# Spamhaus DROP, http://www.spamhaus.org/drop/
-header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:
2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.
205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))?|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))?|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)?|8(?:8\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01])))?|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))?|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)?|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)?|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))?|3
(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)?|0(?:9\.94\.21[2345])?)?|2(?:[23456789]|0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[
0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567])|198\.1(?:7[6789]|9[01]|8\d))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))?|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89]))?)?|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:
[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:5[01]|46)|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]?|13|59|61)))?|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3
\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d))?|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))?|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.97?)?|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|29)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))?|5(?:8\.83\.(?:[89]|1[012345]))?|3[01]?|0)\b)/
+header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:[03]|1(?:9(?:9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6
[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[
01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))?|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))?|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)?|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)?|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(
?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)?|0(?:9\.94\.21[2345])?)?|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:2(?:05\.(?:19[23456789]|2[0123]\d)
|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567])|198\.1(?:7[6789]|9[01]|8\d))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))?|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[
012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:5[01]|46)|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]?|13|59|61)))?|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[
0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d))?|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))?|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.97?)?|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|29)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))?|5(?:8\.83\.(?:[89]|1[012345]))?)\b)/
describe KHOP_SPAMHAUS_DROP Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP nopublish
score KHOP_SPAMHAUS_DROP 1 0.2 1 0.2
# spam/ham s/o corpus
# 0.0349/0.0029 0.924 20110227@510k
-header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))
|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4
567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))?|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))?|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)?|8(?:8\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01])))?|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))?|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)?|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)?|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|
5\d))?|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)?|0(?:9\.94\.21[2345])?)?|2(?:[23456789]|0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(
?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567])|198\.1(?:7[6789]|9[01]|8\d))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))?|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89]))?)?|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346
]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:5[01]|46)|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]?|13|59|61)))?|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]
|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d))?|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))?|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.97?)?|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|29)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))?|5(?:8\.83\.(?:[89]|1[012345]))?|3[01]?|0)\b)/
+header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:[03]|1(?:9(?:9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[
01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[4
5]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))?|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))?|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)?|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)?|7(?:3\.225\.1(?:1[23456789]|2[0123456
7])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)?|0(?:9\.94\.21[2345])?)?|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:2(?:05\.(?:19[23456789]|2[
0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567])|198\.1(?:7[6789]|9[01]|8\d))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))?|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01]
)|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:5[01]|46)|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]?|13|59|61)))?|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]
\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d))?|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))?|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.97?)?|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|29)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))?|5(?:8\.83\.(?:[89]|1[012345]))?)\b)/
describe KHOP_SPAMHAUS_DROP_LE Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP_LE nopublish
score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 # adds to KHOP_SPAMHAUS_DROP
@@ -164,7 +164,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.(?:162\.(?:246|67|74)|56\.28)|4\.112\.23[169]|2\.196\.253)|8(?:3\.93\.(?:[0135]|2[01]?)|0\.149\.8)|25\.23(?:4\.144|5\.192)|01\.79\.50)|8(?:5\.(?:26\.(?:1(?:6[45]|8[46])|2(?:3[1345]|41))|115\.248)|3\.149\.(?:4[4567]|3[68]?|21)|2\.1(?:28\.62|78\.69)|0\.83\.239)|2(?:1(?:7\.(?:118\.(?:83|90)|66\.146|8\.225)|3\.87\.(?:1(?:3[37]|14|29|41)|74))|0(?:1\.191\.198|2\.152\.243|3\.82\.95))|41\.(?:189\.193|95\.4)|61\.19\.6[56])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:3\.(?:162\.(?:246|74)|56\.28)|(?:2\.196\.25|9\.159\.19)3|4\.112\.23[169])|8(?:3\.93\.(?:[0135]|2[01]?)|0\.149\.8)|25\.23(?:4\.144|5\.192)|01\.79\.50)|8(?:5\.(?:26\.(?:1(?:6[45]|8[46])|2(?:3[1345]|41))|115\.248)|3\.149\.(?:4[4567]|3[68]?|21)|2\.1(?:28\.62|78\.69)|0\.83\.239)|2(?:1(?:7\.(?:118\.(?:83|90)|66\.146|8\.225)|3\.87\.(?:1(?:3[37]|14|29|41)|74))|0(?:1\.191\.198|2\.152\.243|3\.82\.95))|41\.(?:189\.193|95\.[48])|61\.19\.6[56])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6