You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2012/03/02 08:57:12 UTC
svn commit: r1296076 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Fri Mar 2 07:57:12 2012
New Revision: 1296076
URL: http://svn.apache.org/viewvc?rev=1296076&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1296076&r1=1296075&r2=1296076&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Fri Mar 2 07:57:12 2012
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20120312
+## khop-sc-neighbors.cf v 20120322
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:[89]0|19)|59)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:19|80)|41|59)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -40,7 +40,7 @@ score KHOP_SC_CIDR8 0.3 0.1 0.3 0.1
# 12.1449/0.0139 0.999 20100410 net, solo=12.1966/0.0197@0.998, ->.2 .1 .3 .2
# 10.3554/0.0112 0.999 20110227@510k solo=10.3717/0.0119@0.999, ->.3 .1 .3 .1
-header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:17|78|82)|41)(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b1(?:17|78|82|90)(?:\.[012]?\d{1,2}){3}\b) /
meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s
tflags KHOP_SC_TOP_CIDR8 nopublish
@@ -93,7 +93,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:7\.104\.162|2\.149\.78|9\.46\.91)|86\.120\.236|23\.194\.4)|2(?:0(?:9\.237\.142|0\.208\.81)|13\.233\.64)|6(?:0\.190\.218|7\.159\.5)|84\.121\.241)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:8(?:0\.232\.103|6\.120\.236)|1(?:7\.104\.162|2\.149\.78)|(?:09\.100\.13|23\.194\.)4)|2(?:0(?:9\.237\.142|0\.208\.81)|13\.233\.64)|60\.190\.218|84\.121\.241)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -112,7 +112,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:2\.215\.6[345]|8\.233\.129)|9(?:0\.200\.177|4\.126\.183)|80\.232\.10[35]|09\.100\.134|73\.38\.153)|2(?:1(?:3\.87\.13[03]|7\.118\.81|9\.70\.43)|7\.100\.31)|8(?:3\.149\.(?:21|3)|5\.26\.1[68]4)|46\.249\.(?:62|0)|60\.190\.223|91\.194\.57)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:2\.215\.6[345]|8\.233\.129|9\.46\.91)|9(?:0\.200\.177|4\.126\.183)|80\.232\.10[35]|73\.38\.153)|2(?:1(?:3\.87\.13[03]|7\.118\.81|9\.70\.43)|7\.100\.31)|8(?:3\.149\.(?:21|3)|5\.26\.1[68]4)|6(?:0\.190\.223|7\.159\.5)|46\.249\.(?:62|0)|91\.194\.57)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -130,7 +130,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:7\.(?:1(?:63\.16\.229|\.119\.40)|45\.198\.88|5\.215\.24)|4\.1(?:7(?:3\.112\.226|\.89\.199)|07\.164\.42)|9\.(?:126\.107\.69|204\.66\.226|62\.83\.148)|6\.1(?:20\.23(?:0\.181|6\.6)|77\.5\.145)|8\.165\.2(?:48\.7|53\.9)9|0\.71\.205\.94)|7(?:4\.(?:1(?:33\.74\.170|42\.97\.49)|6\.8\.130|57\.6\.1)|3\.(?:2(?:03\.56\.243|13\.115\.6)|38\.153\.3[56])|8\.(?:158\.155\.46|235\.203\.92)|6\.53\.30\.142|7\.10\.192\.86)|1(?:8\.(?:233\.129\.57|40\.50\.156)|4\.20(?:0\.199\.187|2\.2\.151)|7\.104\.162\.229|1\.68\.111\.194|2\.78\.124\.115|9\.46\.91\.196)|9(?:4\.(?:1(?:26\.183\.117|87\.105\.194)|44\.103\.216)|0\.(?:2(?:00\.177\.34|6\.118\.123)|96\.85\.36)|3\.180\.178\.78)|2(?:1\.(?:145\.43\.146|6\.188\.204)|3\.(?:237\.231\.28|194\.4\.159)|4\.1(?:37\.20\.253|58\.107\.55)|2\.201\.74\.57)|09\.(?:1(?:00\.(?:134\.246|54\.185)|95\.66\.2)|9(?:3\.210\.35|2\.67\.47|8\.7\.228)|230\.225\.194|73\.165\.209)|6(?:1\.58\.135\.190|8\.143\.21\.28))|2(?:1(?:6\.(
?:(?:245\.208\.7|109\.71\.1)5|51\.141\.2|70\.81\.36)|9\.(?:94\.1(?:94\.(?:138|242)|78\.180)|70\.43\.245)|3\.(?:(?:251\.187\.12|135\.103\.6)6|91\.216\.223)|2\.(?:31\.(?:45\.189|54\.193)|146\.26\.62)|0\.(?:56\.23\.100|168\.50\.6)|7\.(?:197\.68\.66|76\.2\.129)|1\.47\.88\.228|8\.149\.84\.49)|0(?:3\.(?:1(?:46\.127\.140|63\.255\.126|50\.225\.61)|211\.134\.181)|(?:9\.237\.142\.15|8\.0\.222\.)9|2\.1(?:31\.234\.15|42\.203\.19)|7\.(?:106\.42\.45|57\.28\.224)|5\.251\.156\.(?:67|70)|0\.208\.81\.245|1\.116\.199\.34)|2(?:2\.(?:255\.128\.147|102\.236\.32)|0\.135\.222\.97)|4\.6\.176\.93|\.88\.13\.177)|8(?:9\.(?:1(?:2(?:2\.161\.212|3\.66\.85)|90\.64\.251|60\.4\.177)|2(?:00\.168\.153|21\.250\.5)|3(?:1\.144\.222|7\.109\.3)|76\.225\.137)|5\.(?:2(?:3(?:5\.205\.6|6\.96\.5)|5\.124\.28)|10\.138\.107|31\.211\.176)|4\.(?:1(?:21\.241\.200|08\.31\.54)|95\.244\.114)|7\.(?:1(?:18\.140\.10|06\.253\.6)1|238\.162\.47)|1\.(?:169\.135\.114|202\.116\.105|0\.200\.66)|2\.(?:223\.114\.79|165\.148\.3)|8\.(?:198\.1
4\.23|255\.133\.6)1|6\.1(?:09\.203\.7|22\.61\.20)4|0\.188\.(?:94\.130|124\.2)|3\.222\.232\.17)|9(?:1\.(?:1(?:21\.(?:1(?:7(?:9\.191|3\.38)|95\.114|04\.28|83\.49)|81\.35)|9(?:0\.232\.8|4\.57\.62))|211\.52\.208)|4\.(?:23\.(?:2(?:2(?:5\.109|1\.96)|42\.44|7\.226)|1(?:68\.19|\.20)8|45\.55)|(?:100\.89\.15|73\.245\.4)8)|(?:3\.75\.246\.11|5\.188\.70\.20)8|2\.(?:103\.107\.195|63\.183\.167))|6(?:4\.(?:34\.(?:1(?:11\.10|61\.6)0|234\.107)|235\.242\.130|62\.128\.247)|6\.(?:1(?:99\.184\.114|1\.226\.160|35\.33\.39)|228\.125\.106)|0\.190\.2(?:18\.(?:110|67)|23\.144)|7\.(?:205\.89\.119|159\.5\.206)|9\.(?:28\.213\.72|73\.165\.68)|2\.33\.191\.66|5\.75\.73\.118)|7(?:7\.(?:2(?:48\.62\.213|54\.81\.197)|95\.91\.140|65\.7\.122)|2\.(?:5(?:3\.91\.177|5\.174\.39)|47\.2(?:37\.79|49\.97))|9\.(?:175\.229\.158|99\.203\.1)|8\.(?:107\.82\.98|41\.233\.74)|4\.208\.126\.127|0\.33\.254\.79)|4(?:6\.(?:1(?:05\.1(?:0(?:0\.154|1\.171)|84\.246)|86\.15\.134)|249\.62\.(?:9[01]|89)|45\.169\.41|8\.116\.75)|1\.1(?:37\.2[0
4]\.4|93\.5\.62)|9\.158\.(?:199\.163|26\.200))|50\.47\.49\.34)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:7\.(?:1(?:27\.147\.151|63\.16\.229|\.119\.40)|45\.198\.88|5\.215\.24)|4\.1(?:7(?:3\.112\.226|\.89\.199)|07\.164\.42)|9\.(?:126\.107\.69|204\.66\.226|62\.83\.148)|6\.1(?:20\.23(?:0\.181|6\.6)|77\.5\.145)|8\.165\.2(?:48\.7|53\.9)9|0\.71\.205\.94)|7(?:3\.(?:2(?:03\.56\.243|13\.115\.6)|83\.27\.19[5678]|38\.153\.3[56])|4\.(?:1(?:33\.74\.170|42\.97\.49)|6\.8\.130|57\.6\.1)|8\.(?:158\.155\.46|235\.203\.92)|6\.53\.30\.142)|1(?:8\.(?:233\.129\.57|40\.50\.156)|4\.20(?:0\.199\.187|2\.2\.151)|7\.104\.162\.229|2\.78\.124\.115|9\.46\.91\.196)|9(?:4\.1(?:26\.183\.117|87\.105\.194)|0\.2(?:00\.177\.34|6\.118\.123)|3\.180\.178\.78|5\.117\.219\.10)|09\.(?:1(?:00\.(?:134\.246|54\.185)|95\.66\.2)|9(?:2\.67\.47|8\.7\.228)|230\.225\.194|73\.165\.209)|2(?:3\.(?:237\.231\.28|194\.4\.159)|4\.1(?:37\.20\.253|58\.107\.55)|1\.6\.188\.204|2\.201\.74\.57)|68\.143\.21\.28)|2(?:1(?:6\.(?:1(?:18\.117\.51|09\.71\.15)|245\.208\.75|51\.141\.2|70\.81\.36)
|9\.(?:94\.1(?:94\.(?:138|242)|78\.180)|70\.43\.245)|3\.(?:(?:251\.187\.12|135\.103\.6)6|91\.216\.223)|7\.(?:197\.68\.66|76\.2\.129)|2\.31\.(?:45\.189|54\.193)|1\.47\.88\.228|0\.168\.50\.6)|0(?:3\.(?:1(?:46\.127\.140|63\.255\.126|50\.225\.61)|211\.134\.181)|0\.(?:208\.81\.245|116\.10\.11)|2\.1(?:31\.234\.15|42\.203\.19)|7\.(?:106\.42\.45|57\.28\.224)|5\.251\.156\.(?:67|70)|1\.116\.199\.34|8\.0\.222\.9)|(?:20\.135\.222\.9|\.88\.13\.17)7|4\.(?:246\.42\.115|6\.176\.93))|8(?:9\.(?:1(?:2(?:2\.161\.212|3\.66\.85)|90\.64\.251|60\.4\.177)|2(?:00\.168\.153|21\.250\.5)|3(?:1\.144\.222|7\.109\.3)|76\.225\.137)|5\.(?:2(?:3(?:5\.205\.6|6\.96\.5)|5\.124\.28)|10\.138\.107|31\.211\.176)|4\.(?:1(?:21\.241\.200|08\.31\.54)|95\.244\.114)|7\.(?:1(?:18\.140\.10|06\.253\.6)1|238\.162\.47)|1\.(?:169\.135\.114|202\.116\.105|0\.200\.66)|2\.(?:223\.114\.79|165\.148\.3)|8\.(?:198\.14\.23|255\.133\.6)1|6\.1(?:09\.203\.7|22\.61\.20)4|0\.188\.(?:94\.130|124\.2)|3\.222\.232\.17)|9(?:4\.(?:23\.(?:2(?:2(?:5
\.109|1\.96)|42\.44|7\.226)|1(?:68\.19|\.20)8|36\.211)|(?:100\.89\.15|73\.245\.4)8)|1\.(?:1(?:21\.(?:1(?:7(?:9\.191|3\.38)|04\.28|83\.49)|81\.35)|9(?:0\.232\.8|4\.57\.62))|211\.52\.208)|2\.(?:103\.107\.195|63\.183\.167)|3\.7(?:5\.246\.118|8\.118\.186)|5\.188\.70\.208|6\.31\.75\.42)|6(?:4\.(?:34\.(?:1(?:11\.10|61\.6)0|234\.107)|235\.242\.130|62\.128\.247)|6\.(?:1(?:99\.184\.114|1\.226\.160|35\.33\.39)|228\.125\.106)|0\.190\.2(?:18\.(?:[67]7|110)|23\.144)|7\.(?:205\.89\.119|159\.5\.206)|9\.(?:28\.213\.72|73\.165\.68)|2\.33\.191\.66|5\.75\.73\.118|1\.12\.19\.84)|7(?:7\.(?:2(?:48\.62\.213|54\.81\.197)|121\.43\.83|95\.91\.140|65\.7\.122)|2\.(?:5(?:3\.91\.177|5\.174\.39)|47\.2(?:37\.79|49\.97)|172\.134\.3)|9\.(?:175\.229\.158|99\.203\.1)|4\.208\.126\.127|0\.33\.254\.79|8\.107\.82\.98)|4(?:6\.(?:1(?:05\.1(?:0(?:0\.154|1\.171)|84\.246)|86\.15\.134)|249\.62\.(?:9[01]|89)|45\.169\.41|8\.116\.75)|1\.1(?:37\.2[04]\.4|93\.5\.62)|9\.158\.(?:199\.163|26\.200))|50\.47\.49\.34)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -147,14 +147,14 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# Spamhaus DROP, http://www.spamhaus.org/drop/
-header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.25)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[012
3]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|01\.2(?:0[01234567]|4\d)|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:5\.(?:1(?:[24]1|[58]4|32)|2(?:07|45))|4\.(?:1(?:10|53|76|2)|[39]4|41)|6\.(?:17|3)[2345]|7\.1[6789])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23]|28\.145|43\.166)|4(?:3\.134|6\.211|1\.38)|39\.78)|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|8(?:4\.8[67]|2\.57)|14\.[89]|62\.[67])|2(?:2(?:6\.(?:197|220)|5\.17[6789])|8\.1[01]|\.21[23]|38\.242)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|8(?:8\.(?:19[01]|22[67])|5\.204)|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:1(?:0\.16[0123]|6\.14[67])|4(?:6\.20[4567]|0\.229)|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.205)|0\.2(?:21|45)
|54\.15[6789]|8\.7[45])|6\.32\.2(?:1[6789]|2[0123]))?|2(?:[034567]|1(?:\.46\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d))?|9\.76\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2(?:\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789]))?|8\.1(?:68|99))?|1(?:[125789]|0(?:\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d)))?|4(?:\.112\.2(?:2[456789]|5[012345]|[34]\d))?|6(?:\.199\.1(?:[345]\d|2[89]))?|3(?:\.20\.1(?:[678]\d|9[01]))?)?|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:145|232)|0\.2(?:01|22)|6\.228|9\.167|8\.43)?|4(?:\.192\.(?:[0456789]|[12]\d?|3[01]?)|6\.185\.2(?:4[59]|12)|8\.(?:1(?:05|78)|248)|1\.136\.[12]7|3\.(?:135|49)|0\.170)?|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.141|2\.147|5\.190)?|8(?:8\.(?:2(?:12\.(?:[023456789]|1[012345]?)|47\.(?:135|232))|170\.19[23456789])|6\.190\.2(?:2[456789]|3[01]))?|7(?:8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))?
|0(?:[01245678]|9(?:\.(?:94\.21[2345]|196\.140))?|3(?:\.10\.1(?:8[89]|9[01]))?)?|6(?:7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125)?)?|2(?:[23456789]|0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|25\.(?:159|210))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|44\.(?:19[23456789]|20[01234567])|89\.224)|9\.(?:1(?:4(?:8\.(?:6[456789]|9[012345]|[78]\d)|5\.(?:[0456789]|[12]\d?|3[01]?))|82\.(?:6[456789]|9[012345]|[78]\d)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|89\.7[123]|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[45678
9]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.7(?:1\.(?:[023456789]|1[012345]?)|\.2(?:2[0123]|0[89]|1\d))|3\.3(?:1\.8[89]|4\.7[01])|2\.61\.108)?|1(?:6\.(?:212\.(?:2(?:2[0123]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?)))?|\.5[6789])?|9(?:[026789]|1(?:\.(?:2(?:0(?:0\.(?:1(?:6[4567]|7[6789]|8[89]|9[01])|2(?:4[0
12389]|5[01]))|1\.(?:[4567]|2(?:1[2345]|3[6789])|12[4567])|9\.(?:1(?:8[346]|4)|(?:[45]|23)8|63)|4\.(?:5[01]|4\d)|8\.(?:162|228)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:[26]3|07|35|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21|57)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22|90)|7?3)|7\.(?:1(?:53|62|78)|249)|0\.17[2345])|2(?:6\.(?:21[23]|78|97)|9\.(?:4[67]|9[01])|0\.(?:9?0|62)|8\.132)|3(?:0\.143|2\.235))|19(?:6\.2(?:1[6789]|3[2345])|9\.(?:1(?:12|23)|230)|4\.(?:[01]|21[45])|3\.(?:19|7)[2345]|8\.1(?:2[57]|09)|5\.1[01])))?|4(?:\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|6(?:3\.(?:1(?:4[679]|5[01])|24[0134567])|0\.12[123]|1\.247)|232\.2(?:5[012345]|4[89])))?|3(?:\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])))?|5(?:\.(?:64\.(?:3[789]|1[13]|9[89])|21(?:[67]|5\.14[0123])))?)?|6(?:[01358]|4(?:\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0
)|5\.(?:[023456789]|1[012345]?))|21\.(?:2(?:0[01234567]|1[23456789]|2[0123])|19[23456789])|44))?|7(?:\.21(?:[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d)))?|2(?:\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789]))?|6(?:\.231\.(?:6[456789]|7\d))?|9(?:\.6\.80)?)?|8(?:[0237]|5(?:\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|12(?:0\.9[45]|1\.39)))?|4(?:\.22\.(?:1(?:2[01234567]|[01]\d)|9[6789]))?|8(?:\.(?:135\.(?:6[456789]|7\d)|214\.211))?|6(?:\.55\.(?:21[01]|9[67]))?|9(?:\.(?:114\.97?|45\.14))?|1(?:\.22\.15[23])?)?|7(?:[0134567]|2(?:\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d)))?|9(?:\.1(?:10\.(?:1(?:[678]\d?|9[01]?)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)))?|8(?:\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))?)?|3(?:[023456789]|1(?:\.(?:1(?:84\.2(?:[23][67]|42)|1\.43)|222\.20[01234567]))?)?|4(?:[02345789]|1(?:\.221\.1(?:1[23456789]|2[01234567]))?|6(?:\.1
61\.29)?)?|5(?:[012345679]|8(?:\.83\.(?:[89]|1[01]))?)?|0)\b)/
+header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.25)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[012
3]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|01\.2(?:0[01234567]|4\d)|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:5\.(?:1(?:[24]1|[58]4|32)|2(?:07|45))|4\.(?:1(?:10|53|76|2)|[39]4|41)|6\.(?:17|3)[2345]|7\.1[6789])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23]|28\.145|43\.166)|4(?:3\.134|6\.211|1\.38)|39\.78)|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|8(?:4\.8[67]|2\.57)|14\.[89]|62\.[67])|2(?:2(?:6\.(?:197|220)|5\.17[6789])|8\.1[01]|\.21[23]|38\.242)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|8(?:8\.(?:19[01]|22[67])|5\.204)|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:1(?:0\.16[0123]|6\.14[67])|4(?:6\.20[4567]|0\.229)|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.205)|0\.2(?:21|45)
|54\.15[6789]|8\.7[45])|6\.32\.2(?:1[6789]|2[0123]))?|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|4\.112\.2(?:2[456789]|5[012345]|[34]\d)|6\.199\.1(?:[345]\d|2[89])|3\.20\.1(?:[678]\d|9[01]))?|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))?|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:145|232)|0\.2(?:01|22)|6\.228|9\.167|8\.43)?|4(?:\.192\.(?:[0456789]|[12]\d?|3[01]?)|6\.185\.2(?:4[59]|12)|8\.(?:1(?:05|78)|248)|1\.136\.[12]7|3\.(?:135|49)|0\.170)?|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.141|2\.147|5\.190)?|8(?:8\.(?:2(?:12\.(?:[023456789]|1[012345]?)|47\.(?:135|232))|170\.19[23456789])|6\.190\.2(?:2[456789]|3[01]))?|7(?:8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))?|6(?:7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125)?|0(?:9\.(?:94\.21[2345]|196\.
140)|3\.10\.1(?:8[89]|9[01]))?)?|2(?:[23456789]|0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|25\.(?:159|210))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|44\.(?:19[23456789]|20[01234567])|89\.224)|9\.(?:1(?:4(?:8\.(?:6[456789]|9[012345]|[78]\d)|5\.(?:[0456789]|[12]\d?|3[01]?))|82\.(?:6[456789]|9[012345]|[78]\d)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|89\.7[123]|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0
123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.7(?:1\.(?:[023456789]|1[012345]?)|\.2(?:2[0123]|0[89]|1\d))|3\.3(?:1\.8[89]|4\.7[01])|2\.61\.108)?|1(?:6\.(?:212\.(?:2(?:2[0123]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?)))?|\.5[6789])?|9(?:1\.(?:2(?:0(?:0\.(?:1(?:6[4567]|7[6789]|8[89]|9[01])|2(?:4[012389]|5[01]))|1\.(?:[4567]|2(?:1[2345]|3[6789])|12[4567])|9\.(?:1(?:8[346]|4)|(?:[45]|23)8|63)|4\.(?:5[01]|4\d)|8\.(?:162|22
8)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:[26]3|07|35|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21|57)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22|90)|7?3)|7\.(?:1(?:53|62|78)|249)|0\.17[2345])|2(?:6\.(?:21[23]|78|97)|9\.(?:4[67]|9[01])|0\.(?:9?0|62)|8\.132)|3(?:0\.143|2\.235))|19(?:6\.2(?:1[6789]|3[2345])|9\.(?:1(?:12|23)|230)|4\.(?:[01]|21[45])|3\.(?:19|7)[2345]|8\.1(?:2[57]|09)|5\.1[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|6(?:3\.(?:1(?:4[679]|5[01])|24[0134567])|0\.12[123]|1\.247)|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89]))|5\.(?:64\.(?:3[789]|1[13]|9[89])|21(?:[67]|5\.14[0123])))?|6(?:[13]|4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|21\.(?:2(?:0[01234567]|1[23456789]|2[0123])|19[23456789])|44)|7\.21(?:[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2
[89]|3\d))|2(?:\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789]))?|6\.231\.(?:6[456789]|7\d)|(?:9\.6\.8)?0)?|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|12(?:0\.9[45]|1\.39))|4\.22\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:21[01]|9[67])|9\.(?:114\.97?|45\.14)|1\.22\.15[23])?|7(?:2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|9\.1(?:10\.(?:1(?:[678]\d?|9[01]?)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))?|3(?:[023456789]|1(?:\.(?:1(?:84\.2(?:[23][67]|42)|1\.43)|222\.20[01234567]))?)?|4(?:[02345789]|1(?:\.221\.1(?:1[23456789]|2[01234567]))?|6(?:\.161\.29)?)?|5(?:[012345679]|8(?:\.83\.(?:[89]|1[01]))?)?|0)\b)/
describe KHOP_SPAMHAUS_DROP Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP nopublish
score KHOP_SPAMHAUS_DROP 1 0.2 1 0.2
# spam/ham s/o corpus
# 0.0349/0.0029 0.924 20110227@510k
-header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.25)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[2345678
9]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|01\.2(?:0[01234567]|4\d)|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:5\.(?:1(?:[24]1|[58]4|32)|2(?:07|45))|4\.(?:1(?:10|53|76|2)|[39]4|41)|6\.(?:17|3)[2345]|7\.1[6789])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23]|28\.145|43\.166)|4(?:3\.134|6\.211|1\.38)|39\.78)|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|8(?:4\.8[67]|2\.57)|14\.[89]|62\.[67])|2(?:2(?:6\.(?:197|220)|5\.17[6789])|8\.1[01]|\.21[23]|38\.242)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|8(?:8\.(?:19[01]|22[67])|5\.204)|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:1(?:0\.16[0123]|6\.14[67])|4(?:6\.20[4567]|0\.229)|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.205)|0\.2(
?:21|45)|54\.15[6789]|8\.7[45])|6\.32\.2(?:1[6789]|2[0123]))?|2(?:[034567]|1(?:\.46\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d))?|9\.76\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2(?:\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789]))?|8\.1(?:68|99))?|1(?:[125789]|0(?:\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d)))?|4(?:\.112\.2(?:2[456789]|5[012345]|[34]\d))?|6(?:\.199\.1(?:[345]\d|2[89]))?|3(?:\.20\.1(?:[678]\d|9[01]))?)?|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:145|232)|0\.2(?:01|22)|6\.228|9\.167|8\.43)?|4(?:\.192\.(?:[0456789]|[12]\d?|3[01]?)|6\.185\.2(?:4[59]|12)|8\.(?:1(?:05|78)|248)|1\.136\.[12]7|3\.(?:135|49)|0\.170)?|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.141|2\.147|5\.190)?|8(?:8\.(?:2(?:12\.(?:[023456789]|1[012345]?)|47\.(?:135|232))|170\.19[23456789])|6\.190\.2(?:2[456789]|3[01]))?|7(?:8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789
]|5\d))?|0(?:[01245678]|9(?:\.(?:94\.21[2345]|196\.140))?|3(?:\.10\.1(?:8[89]|9[01]))?)?|6(?:7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125)?)?|2(?:[23456789]|0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|25\.(?:159|210))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|44\.(?:19[23456789]|20[01234567])|89\.224)|9\.(?:1(?:4(?:8\.(?:6[456789]|9[012345]|[78]\d)|5\.(?:[0456789]|[12]\d?|3[01]?))|82\.(?:6[456789]|9[012345]|[78]\d)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|89\.7[123]|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?
:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.7(?:1\.(?:[023456789]|1[012345]?)|\.2(?:2[0123]|0[89]|1\d))|3\.3(?:1\.8[89]|4\.7[01])|2\.61\.108)?|1(?:6\.(?:212\.(?:2(?:2[0123]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?)))?|\.5[6789])?|9(?:[026789]|1(?:\.(?:2(?:0(?:0\.(?:1(?:6[4567]|7[6789]|8[89]|9[01])
|2(?:4[012389]|5[01]))|1\.(?:[4567]|2(?:1[2345]|3[6789])|12[4567])|9\.(?:1(?:8[346]|4)|(?:[45]|23)8|63)|4\.(?:5[01]|4\d)|8\.(?:162|228)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:[26]3|07|35|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21|57)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22|90)|7?3)|7\.(?:1(?:53|62|78)|249)|0\.17[2345])|2(?:6\.(?:21[23]|78|97)|9\.(?:4[67]|9[01])|0\.(?:9?0|62)|8\.132)|3(?:0\.143|2\.235))|19(?:6\.2(?:1[6789]|3[2345])|9\.(?:1(?:12|23)|230)|4\.(?:[01]|21[45])|3\.(?:19|7)[2345]|8\.1(?:2[57]|09)|5\.1[01])))?|4(?:\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|6(?:3\.(?:1(?:4[679]|5[01])|24[0134567])|0\.12[123]|1\.247)|232\.2(?:5[012345]|4[89])))?|3(?:\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])))?|5(?:\.(?:64\.(?:3[789]|1[13]|9[89])|21(?:[67]|5\.14[0123])))?)?|6(?:[01358]|4(?:\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[234567
89]\d?|0)|5\.(?:[023456789]|1[012345]?))|21\.(?:2(?:0[01234567]|1[23456789]|2[0123])|19[23456789])|44))?|7(?:\.21(?:[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d)))?|2(?:\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789]))?|6(?:\.231\.(?:6[456789]|7\d))?|9(?:\.6\.80)?)?|8(?:[0237]|5(?:\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|12(?:0\.9[45]|1\.39)))?|4(?:\.22\.(?:1(?:2[01234567]|[01]\d)|9[6789]))?|8(?:\.(?:135\.(?:6[456789]|7\d)|214\.211))?|6(?:\.55\.(?:21[01]|9[67]))?|9(?:\.(?:114\.97?|45\.14))?|1(?:\.22\.15[23])?)?|7(?:[0134567]|2(?:\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d)))?|9(?:\.1(?:10\.(?:1(?:[678]\d?|9[01]?)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)))?|8(?:\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))?)?|3(?:[023456789]|1(?:\.(?:1(?:84\.2(?:[23][67]|42)|1\.43)|222\.20[01234567]))?)?|4(?:[02345789]|1(?:\.221\.1(?:1[23456789]|2[01234567]))?
|6(?:\.161\.29)?)?|5(?:[012345679]|8(?:\.83\.(?:[89]|1[01]))?)?|0)\b)/
+header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.25)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[2345678
9]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|01\.2(?:0[01234567]|4\d)|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:5\.(?:1(?:[24]1|[58]4|32)|2(?:07|45))|4\.(?:1(?:10|53|76|2)|[39]4|41)|6\.(?:17|3)[2345]|7\.1[6789])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23]|28\.145|43\.166)|4(?:3\.134|6\.211|1\.38)|39\.78)|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|8(?:4\.8[67]|2\.57)|14\.[89]|62\.[67])|2(?:2(?:6\.(?:197|220)|5\.17[6789])|8\.1[01]|\.21[23]|38\.242)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|8(?:8\.(?:19[01]|22[67])|5\.204)|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:1(?:0\.16[0123]|6\.14[67])|4(?:6\.20[4567]|0\.229)|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.205)|0\.2(
?:21|45)|54\.15[6789]|8\.7[45])|6\.32\.2(?:1[6789]|2[0123]))?|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|4\.112\.2(?:2[456789]|5[012345]|[34]\d)|6\.199\.1(?:[345]\d|2[89])|3\.20\.1(?:[678]\d|9[01]))?|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))?|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:145|232)|0\.2(?:01|22)|6\.228|9\.167|8\.43)?|4(?:\.192\.(?:[0456789]|[12]\d?|3[01]?)|6\.185\.2(?:4[59]|12)|8\.(?:1(?:05|78)|248)|1\.136\.[12]7|3\.(?:135|49)|0\.170)?|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.141|2\.147|5\.190)?|8(?:8\.(?:2(?:12\.(?:[023456789]|1[012345]?)|47\.(?:135|232))|170\.19[23456789])|6\.190\.2(?:2[456789]|3[01]))?|7(?:8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))?|6(?:7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125)?|0(?:9\.(?:94\.21[234
5]|196\.140)|3\.10\.1(?:8[89]|9[01]))?)?|2(?:[23456789]|0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|25\.(?:159|210))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|44\.(?:19[23456789]|20[01234567])|89\.224)|9\.(?:1(?:4(?:8\.(?:6[456789]|9[012345]|[78]\d)|5\.(?:[0456789]|[12]\d?|3[01]?))|82\.(?:6[456789]|9[012345]|[78]\d)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|89\.7[123]|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1
\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.7(?:1\.(?:[023456789]|1[012345]?)|\.2(?:2[0123]|0[89]|1\d))|3\.3(?:1\.8[89]|4\.7[01])|2\.61\.108)?|1(?:6\.(?:212\.(?:2(?:2[0123]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?)))?|\.5[6789])?|9(?:1\.(?:2(?:0(?:0\.(?:1(?:6[4567]|7[6789]|8[89]|9[01])|2(?:4[012389]|5[01]))|1\.(?:[4567]|2(?:1[2345]|3[6789])|12[4567])|9\.(?:1(?:8[346]|4)|(?:[45]|23)8|63)|4\.(?:5[01]|4\d)|8\.(
?:162|228)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:[26]3|07|35|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21|57)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22|90)|7?3)|7\.(?:1(?:53|62|78)|249)|0\.17[2345])|2(?:6\.(?:21[23]|78|97)|9\.(?:4[67]|9[01])|0\.(?:9?0|62)|8\.132)|3(?:0\.143|2\.235))|19(?:6\.2(?:1[6789]|3[2345])|9\.(?:1(?:12|23)|230)|4\.(?:[01]|21[45])|3\.(?:19|7)[2345]|8\.1(?:2[57]|09)|5\.1[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|6(?:3\.(?:1(?:4[679]|5[01])|24[0134567])|0\.12[123]|1\.247)|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89]))|5\.(?:64\.(?:3[789]|1[13]|9[89])|21(?:[67]|5\.14[0123])))?|6(?:[13]|4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|21\.(?:2(?:0[01234567]|1[23456789]|2[0123])|19[23456789])|44)|7\.21(?:[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4
[0123]|2[89]|3\d))|2(?:\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789]))?|6\.231\.(?:6[456789]|7\d)|(?:9\.6\.8)?0)?|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|12(?:0\.9[45]|1\.39))|4\.22\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:21[01]|9[67])|9\.(?:114\.97?|45\.14)|1\.22\.15[23])?|7(?:2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|9\.1(?:10\.(?:1(?:[678]\d?|9[01]?)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))?|3(?:[023456789]|1(?:\.(?:1(?:84\.2(?:[23][67]|42)|1\.43)|222\.20[01234567]))?)?|4(?:[02345789]|1(?:\.221\.1(?:1[23456789]|2[01234567]))?|6(?:\.161\.29)?)?|5(?:[012345679]|8(?:\.83\.(?:[89]|1[01]))?)?|0)\b)/
describe KHOP_SPAMHAUS_DROP_LE Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP_LE nopublish
score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 # adds to KHOP_SPAMHAUS_DROP