You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2012/03/07 08:57:13 UTC
svn commit: r1297871 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Wed Mar 7 07:57:12 2012
New Revision: 1297871
URL: http://svn.apache.org/viewvc?rev=1297871&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1297871&r1=1297870&r2=1297871&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Wed Mar 7 07:57:12 2012
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20120362
+## khop-sc-neighbors.cf v 20120372
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -75,7 +75,7 @@ score KHOP_SC_CIDR16 1.0 0.2 1.0 0.2
# crap, still empty 20100410 bad scrape, script failed to populate rule
# crap, still empty 20110227 this is due to safety net exclusions -> 1 .2 1 .2
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b1(?:22\.168|82\.177|90\.233)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b182\.177(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0.4
@@ -93,7 +93,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.(?:233\.64|55\.105)|7\.118\.81)|0(?:0\.108\.108|5\.251\.156))|1(?:09\.(?:100\.134|98\.7)|18\.233\.129|23\.194\.4|73\.83\.27)|84\.(?:121\.241|235\.73)|60\.190\.218|50\.47\.49|96\.31\.75)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:3\.(?:233\.64|55\.105)|7\.118\.81)|0(?:0\.108\.108|5\.251\.156))|1(?:(?:09\.100\.13|23\.194\.)4|1(?:8\.233\.129|9\.46\.91))|84\.(?:121\.241|235\.73)|60\.190\.218|50\.47\.49|72\.53\.91|96\.31\.75)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -112,7 +112,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:2\.215\.6[345]|9\.46\.91)|9(?:0\.200\.177|4\.126\.183)|80\.232\.10[35]|73\.38\.153)|8(?:5\.(?:26\.(?:1(?:6[45]|84)|2[34]1)|115\.248)|3\.149\.(?:21?|3))|2(?:1(?:(?:7\.118\.8|9\.70\.4)3|3\.87\.13[023])|7\.100\.31)|6(?:0\.190\.223|7\.159\.5)|9(?:1\.194\.57|8\.139\.91)|46\.249\.62)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:9(?:0\.200\.177|4\.126\.183)|73\.(?:38\.153|83\.27)|12\.215\.6[345]|80\.232\.10[35])|8(?:5\.(?:26\.(?:1(?:6[45]|84)|2[34]1)|115\.248)|3\.(?:149\.(?:21?|3)|221\.160))|2(?:1(?:(?:7\.118\.8|9\.70\.4)3|3\.87\.13[02])|7\.100\.31)|6(?:0\.190\.223|7\.159\.5)|9(?:1\.194\.57|8\.139\.91)|46\.249\.62)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -130,7 +130,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:9\.(?:126\.107\.69|204\.66\.226|62\.83\.148)|7\.1(?:27\.147\.151|63\.16\.229|\.119\.40)|6\.1(?:20\.23(?:0\.181|6\.6)|16\.38\.185)|8\.1(?:65\.2(?:48\.7|53\.9)9|73\.122\.43)|0\.(?:177\.7\.227|71\.205\.94)|4\.17(?:3\.112\.226|\.89\.199))|7(?:8\.(?:1(?:2(?:0\.245\.114|1\.158\.123)|58\.155\.46)|2(?:35\.203\.92|0\.153\.9)|33\.188\.203)|4\.(?:1(?:33\.74\.170|42\.97\.49)|57\.6\.1)|3\.(?:83\.27\.19[5678]|38\.153\.3[56]))|1(?:8\.(?:40\.(?:236\.153|50\.156)|233\.129\.57|68\.184\.179)|(?:3\.10\.50\.16|9\.46\.91\.19)6|4\.20(?:0\.199\.187|2\.2\.151)|7\.242\.248\.117|0\.74\.223\.229)|0(?:9\.(?:1(?:00\.(?:134\.246|54\.185)|95\.66\.2)|9(?:2\.67\.47|8\.7\.228)|60\.147\.73)|8\.163\.215\.122|1\.99\.134\.240)|9(?:0\.(?:2(?:00\.177\.34|4\.150\.251|6\.118\.123)|140\.44\.101)|5\.1(?:17\.219\.10|61\.9\.2)|4\.126\.183\.117)|2(?:3\.(?:237\.231\.28|194\.4\.159)|4\.1(?:37\.20\.253|58\.107\.55)|2\.227\.159\.201)|68\.187\.134\.85)|2(?:0(?:0\.(?:2(?
:08\.81\.24|16\.198\.8)5|116\.10\.11|75\.215\.10)|5\.(?:251\.156\.(?:67|70)|178\.144\.101)|(?:3\.163\.255\.12|6\.188\.77\.)6|1\.(?:116\.199\.34|37\.197\.123)|9\.(?:237\.142\.114|183\.5\.210)|2\.(?:173\.214\.18|4\.178\.39)|8\.0\.222\.9)|1(?:2\.(?:31\.(?:45\.189|54\.193)|113\.44\.238|40\.65\.17)|3\.(?:251\.187\.126|91\.216\.223)|7\.(?:197\.68\.66|76\.2\.129)|9\.7(?:0\.43\.245|4\.187\.52)|6\.245\.208\.75|8\.212\.136\.22|0\.168\.50\.6|1\.47\.88\.97)|4\.246\.42\.115|\.88\.13\.177)|8(?:9\.(?:1(?:2(?:2\.(?:161\.212|34\.15)|3\.85\.24)|36\.114\.62|90\.64\.251)|7(?:6\.225\.137|3\.38\.241)|3(?:1\.144\.222|7\.109\.3))|4\.(?:1(?:(?:5\.191\.2|08\.31\.)54|21\.241\.200)|20\.241\.123)|5\.(?:(?:31\.211\.17|235\.205\.)6|105\.189\.224|40\.123\.83)|3\.(?:2(?:22\.232\.17|38\.39\.15)|103\.27\.190)|2\.(?:1(?:02\.24\.1|65\.148\.)|32\.116\.13)3|(?:7\.118\.140\.10|8\.198\.14\.23)1|1\.(?:202\.116\.105|0\.200\.66)|6\.122\.61\.204|0\.188\.124\.2)|9(?:4\.(?:23\.2(?:2(?:5\.109|1\.96)|42\.44|7\.226)|1(?:00\
.89\.158|53\.86\.152)|9(?:6\.13\.182|7\.62\.209)|52\.198\.249|42\.36\.211|73\.245\.48)|1\.(?:1(?:21\.(?:1(?:7(?:9\.191|3\.38)|83\.49)|91\.111)|9(?:8\.197\.90|0\.232\.8|4\.57\.62)|44\.244\.137)|211\.52\.208)|3\.(?:15(?:7\.148\.102|2\.149\.88)|7(?:5\.246\.118|8\.118\.186))|5\.(?:188\.70\.208|72\.166\.126)|2\.63\.183\.167|6\.31\.75\.42)|6(?:4\.(?:(?:34\.234\.10|62\.128\.24)7|79\.81\.13[0123]|235\.242\.130)|(?:8\.151\.236\.10|6\.11\.226\.16)0|0\.190\.2(?:18\.(?:110|67)|23\.144)|7\.(?:205\.89\.119|159\.5\.206)|1\.1(?:09\.250\.202|2\.19\.84)|9\.(?:28\.213\.72|73\.165\.68)|2\.219\.(?:192\.161|239\.5)|5\.75\.73\.118)|7(?:7\.(?:2(?:54\.180\.23|48\.62\.21)3|12(?:1\.43\.83|7\.50\.61))|2\.(?:5(?:3\.91\.177|5\.174\.39)|172\.134\.3|47\.237\.79)|9\.(?:9(?:7\.10\.56|9\.203\.1)|175\.229\.158)|8\.(?:2(?:33\.173\.34|9\.4\.78)|107\.82\.98)|1\.10\.28\.157)|4(?:6\.(?:1(?:05\.101\.171|86\.15\.134)|45\.16(?:4\.227|9\.41)|249\.62\.(?:9[01]|89)|8\.116\.75)|1\.137\.2[04]\.4)|5(?:8\.(?:182\.173\.35|97\
.25\.34)|0\.47\.49\.34))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:8(?:7\.1(?:\.119\.(?:40|77)|27\.147\.151|63\.16\.229)|8\.1(?:15\.183\.121|65\.253\.99)|9\.(?:204\.66\.226|62\.83\.148)|0\.(?:177\.7\.227|71\.205\.94)|6\.120\.23(?:0\.181|6\.6)|4\.17\.89\.199)|1(?:8\.(?:40\.(?:236\.153|50\.156)|233\.129\.57|68\.184\.179)|(?:3\.10\.50\.16|9\.46\.91\.19)6|0\.(?:74\.223\.22|9\.126\.19)9|7\.242\.24(?:8\.117|9\.90)|4\.200\.199\.187)|7(?:8\.(?:1(?:2(?:0\.245\.114|1\.158\.123)|58\.155\.46)|235\.203\.92|33\.188\.203)|4\.(?:1(?:33\.74\.170|42\.97\.49)|57\.6\.1)|3\.(?:83\.27\.19[5678]|38\.153\.3[56]))|9(?:0\.(?:2(?:00\.177\.34|4\.150\.251|6\.118\.123)|140\.44\.101|98\.48\.83)|6\.(?:217\.241\.62|1\.248\.46)|5\.1(?:17\.219\.10|61\.9\.2)|4\.126\.183\.117)|0(?:9\.(?:1(?:00\.(?:134\.246|54\.185)|95\.66\.2)|9(?:2\.67\.47|8\.7\.228)|60\.147\.73)|1\.99\.134\.240)|2(?:(?:2\.227\.159\.2|5\.224\.187\.1)01|3\.(?:237\.231\.28|194\.4\.159)|4\.1(?:37\.20\.253|58\.107\.55))|68\.187\.134\.85)|2(?:1(?:2\.(?:31\.(?:45
\.189|54\.193)|113\.44\.238|40\.65\.17)|1\.(?:4(?:5\.126\.81|7\.88\.97)|172\.56\.38)|3\.(?:251\.187\.126|55\.76\.224)|6\.(?:157\.17\.142|245\.208\.75)|7\.(?:197\.68\.66|76\.2\.129)|9\.7(?:0\.43\.245|4\.187\.52)|8\.212\.136\.22|0\.168\.50\.6)|0(?:0\.(?:2(?:08\.81\.24|16\.198\.8)5|1(?:16\.10\.11|29\.187\.2)|75\.215\.10)|1\.(?:116\.199\.34|37\.197\.123)|3\.1(?:63\.255\.126|89\.141\.25)|(?:2\.4\.178\.3|8\.0\.222\.)9|9\.237\.142\.114|6\.188\.77\.6)|20\.255\.145\.8|4\.246\.42\.115|\.88\.13\.177)|9(?:4\.(?:23\.2(?:2(?:5\.109|1\.96)|7\.226)|1(?:00\.89\.158|53\.86\.152)|(?:52\.198\.24|97\.62\.20)9|42\.36\.211|73\.245\.48)|1\.(?:1(?:9(?:8\.197\.90|0\.232\.8|4\.57\.62)|21\.1(?:79\.191|83\.49))|2(?:35\.176\.100|11\.52\.208))|3\.(?:1(?:5(?:7\.148\.102|2\.149\.88)|09\.245\.154)|7(?:5\.246\.118|8\.118\.186))|5\.(?:188\.70\.208|240\.183\.54|72\.166\.126|59\.39\.82)|2\.(?:46\.201\.134|63\.183\.167|84\.150\.150)|6\.31\.75\.42)|8(?:9\.(?:1(?:2(?:2\.161\.212|3\.85\.24)|36\.114\.62|90\.64\.251)|
7(?:6\.225\.137|3\.38\.241)|37\.109\.3)|4\.(?:1(?:(?:5\.191\.2|08\.31\.)54|21\.241\.200)|20\.241\.123)|5\.(?:(?:31\.211\.17|235\.205\.)6|105\.189\.224|40\.123\.83)|3\.(?:2(?:22\.232\.17|38\.39\.15)|103\.27\.190)|0\.(?:179\.163\.218|69\.151\.86)|1\.(?:202\.116\.105|0\.200\.66)|2\.(?:32\.116\.13|102\.24\.1)3|7\.118\.140\.101|6\.122\.61\.204|8\.198\.35\.229)|6(?:4\.(?:(?:34\.234\.10|62\.128\.24)7|79\.81\.13[0123]|235\.242\.130)|0\.190\.2(?:23\.(?:1(?:44|52)|68)|18\.(?:[67]7|110))|2\.(?:219\.(?:192\.161|239\.5)|42\.24\.98)|9\.(?:28\.213\.72|63\.81\.186|73\.165\.68)|(?:8\.151\.236\.10|6\.11\.226\.16)0|7\.(?:205\.89\.119|159\.5\.206)|5\.75\.73\.118|1\.12\.19\.84)|7(?:7\.(?:1(?:2(?:1\.43\.83|7\.50\.61)|06\.232\.178)|2(?:54\.180\.23|48\.62\.21)3)|9\.(?:1(?:75\.229\.158|87\.34\.207)|9(?:7\.10\.56|9\.203\.1))|2\.(?:5(?:3\.91\.177|5\.174\.39)|47\.237\.79)|8\.(?:2(?:33\.173\.34|9\.4\.78)|189\.47\.83))|4(?:6\.(?:1(?:05\.101\.171|86\.15\.134)|8\.116\.75)|1\.(?:137\.2[04]\.4|251\.255\.72))
|5(?:8\.(?:182\.173\.35|97\.25\.34)|0\.47\.49\.34))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -147,14 +147,14 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# Spamhaus DROP, http://www.spamhaus.org/drop/
-header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.25)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[012
3]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|01\.2(?:0[01234567]|4\d)|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:5\.(?:1(?:[24]1|[58]4)|2(?:07|45))|4\.(?:1(?:10|53|76|2)|[39]4|41)|6\.(?:17|3)[2345]|7\.1[6789])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23]|28\.145|43\.166)|4(?:3\.134|6\.211|1\.38)|39\.78)|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|8(?:4\.8[67]|2\.57)|14\.[89]|62\.[67])|2(?:2(?:6\.(?:197|220)|5\.17[6789])|8\.1[01]|\.21[23]|38\.242)|8(?:8\.(?:19[01]|22[67])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.155)|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:1(?:0\.16[0123]|6\.14[67])|4(?:6\.20[4567]|0\.229)|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.205)|0\.2(?:21|45)|54\.1
5[6789]|8\.7[45])|6\.32\.2(?:1[6789]|2[0123]))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.19(?:9\.1(?:[345]\d|2[89])|7\.15[23456789])|4\.112\.2(?:2[456789]|5[012345]|[34]\d)|3\.20\.1(?:[678]\d|9[01]))|4(?:\.192\.(?:[06789]|[125]\d?|3[01]?|4[89]?)|6\.185\.2(?:4[59]|12)|8\.(?:1(?:05|78)|248)|1\.136\.[12]7|3\.(?:135|49)|0\.170)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:145|232)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.141|2\.147|5\.190)|8(?:8\.(?:2(?:12\.(?:[023456789]|1[012345]?)|47\.(?:135|232))|170\.19[23456789])|6\.190\.2(?:2[456789]|3[01]))|7(?:8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))|0(?:3\.10\.(?:1(?:8[89]|9[01])|6[89]|7[01])|9\.(?:94\.21[2345]|196\.140))|6(?:7
\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125))?|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|25\.(?:159|210))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|44\.(?:19[23456789]|20[01234567])|89\.224)|9\.(?:1(?:4(?:8\.(?:6[456789]|9[012345]|[78]\d)|5\.(?:[0456789]|[12]\d?|3[01]?))|82\.(?:6[456789]|9[012345]|[78]\d)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|89\.7[123]|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[78
9]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.7(?:1\.(?:[023456789]|1[012345]?)|\.2(?:2[0123]|0[89]|1\d))|3\.3(?:1\.8[89]|4\.7[01])|2\.61\.108)|1(?:6\.(?:212\.(?:2(?:2[0123]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?)))|\.5[6789])?|9(?:1\.(?:2(?:0(?:0\.(?:1(?:6[4567]|7[6789]|8[89]|9[01])|2(?:4[012389]|5[01]))|1\.(?:[4567]|2(?:1[2345]|3[6789])|12[4567])|9\.(?:1(?:8[346]|4)|(?:[45]|23)8|63)|4\.(?:5[01]|4\d)
|8\.(?:162|228)|3\.9[2345]|5\.4[0123])|1(?:2\.(?:1(?:[26]3|07|35|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21|57)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22|90)|7?3)|7\.(?:1(?:53|62|78)|249)|0\.17[2345])|2(?:6\.(?:21[23]|78|97)|9\.(?:4[67]|9[01])|0\.(?:9?0|62)|8\.132|3\.77)|3(?:0\.143|2\.235))|19(?:6\.2(?:1[6789]|3[2345])|9\.(?:1(?:12|23)|230)|4\.(?:[01]|21[45])|3\.(?:19|7)[2345]|8\.1(?:2[57]|09)|5\.1[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|6(?:3\.(?:1(?:4[679]|5[01])|24[0134567])|0\.12[123]|1\.247)|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89]))|5\.(?:64\.(?:3[789]|1[13]|9[89])|21(?:[67]|5\.14[0123])))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|21\.(?:2(?:0[01234567]|1[23456789]|2[0123])|19[23456789])|44)|7\.21(?:[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123
]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d)|9\.6\.80)|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|12(?:0\.9[45]|1\.39))|4\.22\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|1\.(?:22\.15[23]|94\.43)|6\.55\.(?:21[01]|9[67])|9\.(?:114\.97?|45\.14))|7(?:2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|9\.1(?:10\.(?:1(?:[678]\d?|9[01]?)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|3(?:1\.(?:1(?:84\.2(?:[23][67]|42)|1\.43)|222\.20[01234567]|44\.18[45]))?|4(?:1\.221\.1(?:1[23456789]|2[01234567])|6\.161\.29)|58\.83\.(?:[89]|1[01])|0)\b)/
+header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.25)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[012
3]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|01\.2(?:0[01234567]|4\d)|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:5\.(?:1(?:[24]1|[58]4)|2(?:07|45))|4\.(?:1(?:10|53|76|2)|[39]4|41)|6\.(?:17|3)[2345]|7\.1[6789])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23]|43\.166)|4(?:3\.134|6\.211|1\.38)|39\.78)|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|8(?:4\.8[67]|2\.57)|14\.[89]|62\.[67])|2(?:2(?:6\.(?:197|220)|5\.17[6789])|8\.1[01]|\.21[23]|38\.242)|8(?:8\.(?:19[01]|22[67])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.155)|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:1(?:0\.16[0123]|6\.14[67])|4(?:6\.20[4567]|0\.229)|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.205)|0\.2(
?:21|45)|54\.15[6789]|8\.7[45])|6\.32\.2(?:1[6789]|2[0123]))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.19(?:9\.1(?:[345]\d|2[89])|7\.15[23456789])|4\.112\.2(?:2[456789]|5[012345]|[34]\d)|3\.20\.1(?:[678]\d|9[01]))|4(?:\.192\.(?:[06789]|[125]\d?|3[01]?|4[89]?)|6\.185\.2(?:4[59]|12)|8\.(?:1(?:05|78)|248)|1\.136\.[12]7|3\.(?:135|49)|0\.170)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:145|232)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.141|2\.147|5\.190)|8(?:8\.(?:2(?:12\.(?:[023456789]|1[012345]?)|47\.(?:135|232))|170\.19[23456789])|6\.190\.2(?:2[456789]|3[01]))|7(?:8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))|0(?:3\.10\.(?:1(?:8[89]|9[01])|6[89]|7[01])|9\.(?:94\.21[2345]|19
6\.140))|6(?:7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|25\.(?:159|210))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|44\.(?:19[23456789]|20[01234567])|89\.224)|9\.(?:1(?:4(?:8\.(?:6[456789]|9[012345]|[78]\d)|5\.(?:[0456789]|[12]\d?|3[01]?))|82\.(?:6[456789]|9[012345]|[78]\d)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|89\.7[123]|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|
6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.7(?:1\.(?:[023456789]|1[012345]?)|\.2(?:2[0123]|0[89]|1\d))|3\.3(?:1\.8[89]|4\.7[01])|2\.61\.108)|1(?:6\.(?:212\.(?:2(?:2[0123]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?)))|\.5[6789])?|9(?:1\.(?:2(?:0(?:0\.(?:1(?:6[4567]|7[6789]|8[89]|9[01])|2(?:4[012389]|5[01]))|1\.(?:[4567]|2(?:1[2345]|3[6789])|12[4567])|9\.(?:1(?:8[346]|4)|(?:[45]|23)8|63)|4\.
(?:5[01]|4\d)|8\.(?:162|228)|3\.9[2345]|5\.4[0123])|1(?:2\.(?:1(?:[26]3|07|35|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21|57)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22|90)|7?3)|7\.(?:1(?:53|62|78)|249)|0\.17[2345])|2(?:6\.(?:21[23]|78|97)|9\.(?:4[67]|9[01])|0\.(?:9?0|62)|8\.132|3\.77)|3(?:0\.143|2\.235))|19(?:6\.2(?:1[6789]|3[2345])|9\.(?:1(?:12|23)|230)|4\.(?:[01]|21[45])|3\.(?:19|7)[2345]|8\.1(?:2[57]|09)|7\.9[6789]|5\.1[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|6(?:3\.(?:1(?:4[679]|5[01])|24[0134567])|0\.12[123]|1\.247)|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89]))|5\.(?:64\.(?:3[789]|1[13]|9[89])|21(?:[67]|5\.14[0123])))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|21\.(?:2(?:0[01234567]|1[23456789]|2[0123])|19[23456789])|44)|7\.21(?:[18]\.2(?:2[0123]|
0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d)|9\.6\.80)|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|12(?:0\.9[45]|1\.39))|4\.22\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|1\.(?:22\.15[23]|94\.43)|6\.55\.(?:21[01]|9[67])|9\.(?:114\.97?|45\.14))|7(?:2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|9\.1(?:10\.(?:1(?:[678]\d?|9[01]?)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|3(?:1\.(?:1(?:84\.2(?:[23][67]|42)|1\.43)|222\.20[01234567]|44\.18[45]))?|4(?:1\.221\.1(?:1[23456789]|2[01234567])|6\.161\.29)|58\.83\.(?:[89]|1[01]))\b)/
describe KHOP_SPAMHAUS_DROP Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP nopublish
score KHOP_SPAMHAUS_DROP 1 0.2 1 0.2
# spam/ham s/o corpus
# 0.0349/0.0029 0.924 20110227@510k
-header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.25)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[2345678
9]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|01\.2(?:0[01234567]|4\d)|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:5\.(?:1(?:[24]1|[58]4)|2(?:07|45))|4\.(?:1(?:10|53|76|2)|[39]4|41)|6\.(?:17|3)[2345]|7\.1[6789])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23]|28\.145|43\.166)|4(?:3\.134|6\.211|1\.38)|39\.78)|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|8(?:4\.8[67]|2\.57)|14\.[89]|62\.[67])|2(?:2(?:6\.(?:197|220)|5\.17[6789])|8\.1[01]|\.21[23]|38\.242)|8(?:8\.(?:19[01]|22[67])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.155)|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:1(?:0\.16[0123]|6\.14[67])|4(?:6\.20[4567]|0\.229)|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.205)|0\.2(?:21|4
5)|54\.15[6789]|8\.7[45])|6\.32\.2(?:1[6789]|2[0123]))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.19(?:9\.1(?:[345]\d|2[89])|7\.15[23456789])|4\.112\.2(?:2[456789]|5[012345]|[34]\d)|3\.20\.1(?:[678]\d|9[01]))|4(?:\.192\.(?:[06789]|[125]\d?|3[01]?|4[89]?)|6\.185\.2(?:4[59]|12)|8\.(?:1(?:05|78)|248)|1\.136\.[12]7|3\.(?:135|49)|0\.170)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:145|232)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.141|2\.147|5\.190)|8(?:8\.(?:2(?:12\.(?:[023456789]|1[012345]?)|47\.(?:135|232))|170\.19[23456789])|6\.190\.2(?:2[456789]|3[01]))|7(?:8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))|0(?:3\.10\.(?:1(?:8[89]|9[01])|6[89]|7[01])|9\.(?:94\.21[2345]|196\.140
))|6(?:7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125))?|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|25\.(?:159|210))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|44\.(?:19[23456789]|20[01234567])|89\.224)|9\.(?:1(?:4(?:8\.(?:6[456789]|9[012345]|[78]\d)|5\.(?:[0456789]|[12]\d?|3[01]?))|82\.(?:6[456789]|9[012345]|[78]\d)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|89\.7[123]|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456
789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.7(?:1\.(?:[023456789]|1[012345]?)|\.2(?:2[0123]|0[89]|1\d))|3\.3(?:1\.8[89]|4\.7[01])|2\.61\.108)|1(?:6\.(?:212\.(?:2(?:2[0123]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?)))|\.5[6789])?|9(?:1\.(?:2(?:0(?:0\.(?:1(?:6[4567]|7[6789]|8[89]|9[01])|2(?:4[012389]|5[01]))|1\.(?:[4567]|2(?:1[2345]|3[6789])|12[4567])|9\.(?:1(?:8[346]|4)|(?:[45]|23)8|63)|4\.(?:5[
01]|4\d)|8\.(?:162|228)|3\.9[2345]|5\.4[0123])|1(?:2\.(?:1(?:[26]3|07|35|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21|57)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22|90)|7?3)|7\.(?:1(?:53|62|78)|249)|0\.17[2345])|2(?:6\.(?:21[23]|78|97)|9\.(?:4[67]|9[01])|0\.(?:9?0|62)|8\.132|3\.77)|3(?:0\.143|2\.235))|19(?:6\.2(?:1[6789]|3[2345])|9\.(?:1(?:12|23)|230)|4\.(?:[01]|21[45])|3\.(?:19|7)[2345]|8\.1(?:2[57]|09)|5\.1[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|6(?:3\.(?:1(?:4[679]|5[01])|24[0134567])|0\.12[123]|1\.247)|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89]))|5\.(?:64\.(?:3[789]|1[13]|9[89])|21(?:[67]|5\.14[0123])))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|21\.(?:2(?:0[01234567]|1[23456789]|2[0123])|19[23456789])|44)|7\.21(?:[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(
?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d)|9\.6\.80)|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|12(?:0\.9[45]|1\.39))|4\.22\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|1\.(?:22\.15[23]|94\.43)|6\.55\.(?:21[01]|9[67])|9\.(?:114\.97?|45\.14))|7(?:2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|9\.1(?:10\.(?:1(?:[678]\d?|9[01]?)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|3(?:1\.(?:1(?:84\.2(?:[23][67]|42)|1\.43)|222\.20[01234567]|44\.18[45]))?|4(?:1\.221\.1(?:1[23456789]|2[01234567])|6\.161\.29)|58\.83\.(?:[89]|1[01])|0)\b)/
+header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.25)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[2345678
9]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|01\.2(?:0[01234567]|4\d)|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:5\.(?:1(?:[24]1|[58]4)|2(?:07|45))|4\.(?:1(?:10|53|76|2)|[39]4|41)|6\.(?:17|3)[2345]|7\.1[6789])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23]|43\.166)|4(?:3\.134|6\.211|1\.38)|39\.78)|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|8(?:4\.8[67]|2\.57)|14\.[89]|62\.[67])|2(?:2(?:6\.(?:197|220)|5\.17[6789])|8\.1[01]|\.21[23]|38\.242)|8(?:8\.(?:19[01]|22[67])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.155)|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:1(?:0\.16[0123]|6\.14[67])|4(?:6\.20[4567]|0\.229)|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.20
5)|0\.2(?:21|45)|54\.15[6789]|8\.7[45])|6\.32\.2(?:1[6789]|2[0123]))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.19(?:9\.1(?:[345]\d|2[89])|7\.15[23456789])|4\.112\.2(?:2[456789]|5[012345]|[34]\d)|3\.20\.1(?:[678]\d|9[01]))|4(?:\.192\.(?:[06789]|[125]\d?|3[01]?|4[89]?)|6\.185\.2(?:4[59]|12)|8\.(?:1(?:05|78)|248)|1\.136\.[12]7|3\.(?:135|49)|0\.170)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:145|232)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.141|2\.147|5\.190)|8(?:8\.(?:2(?:12\.(?:[023456789]|1[012345]?)|47\.(?:135|232))|170\.19[23456789])|6\.190\.2(?:2[456789]|3[01]))|7(?:8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))|0(?:3\.10\.(?:1(?:8[89]|9[01])|6[89]|7[01])|9\.(?:94\.21[
2345]|196\.140))|6(?:7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|25\.(?:159|210))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|44\.(?:19[23456789]|20[01234567])|89\.224)|9\.(?:1(?:4(?:8\.(?:6[456789]|9[012345]|[78]\d)|5\.(?:[0456789]|[12]\d?|3[01]?))|82\.(?:6[456789]|9[012345]|[78]\d)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|89\.7[123]|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|
[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.7(?:1\.(?:[023456789]|1[012345]?)|\.2(?:2[0123]|0[89]|1\d))|3\.3(?:1\.8[89]|4\.7[01])|2\.61\.108)|1(?:6\.(?:212\.(?:2(?:2[0123]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?)))|\.5[6789])?|9(?:1\.(?:2(?:0(?:0\.(?:1(?:6[4567]|7[6789]|8[89]|9[01])|2(?:4[012389]|5[01]))|1\.(?:[4567]|2(?:1[2345]|3[6789])|12[4567])|9\.(?:1(?:8[346]|4)|(?:[45]|23)8
|63)|4\.(?:5[01]|4\d)|8\.(?:162|228)|3\.9[2345]|5\.4[0123])|1(?:2\.(?:1(?:[26]3|07|35|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21|57)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22|90)|7?3)|7\.(?:1(?:53|62|78)|249)|0\.17[2345])|2(?:6\.(?:21[23]|78|97)|9\.(?:4[67]|9[01])|0\.(?:9?0|62)|8\.132|3\.77)|3(?:0\.143|2\.235))|19(?:6\.2(?:1[6789]|3[2345])|9\.(?:1(?:12|23)|230)|4\.(?:[01]|21[45])|3\.(?:19|7)[2345]|8\.1(?:2[57]|09)|7\.9[6789]|5\.1[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|6(?:3\.(?:1(?:4[679]|5[01])|24[0134567])|0\.12[123]|1\.247)|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89]))|5\.(?:64\.(?:3[789]|1[13]|9[89])|21(?:[67]|5\.14[0123])))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|21\.(?:2(?:0[01234567]|1[23456789]|2[0123])|19[23456789])|44)|7\.21(?:[18]\.2(?:
2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d)|9\.6\.80)|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|12(?:0\.9[45]|1\.39))|4\.22\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|1\.(?:22\.15[23]|94\.43)|6\.55\.(?:21[01]|9[67])|9\.(?:114\.97?|45\.14))|7(?:2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|9\.1(?:10\.(?:1(?:[678]\d?|9[01]?)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|3(?:1\.(?:1(?:84\.2(?:[23][67]|42)|1\.43)|222\.20[01234567]|44\.18[45]))?|4(?:1\.221\.1(?:1[23456789]|2[01234567])|6\.161\.29)|58\.83\.(?:[89]|1[01]))\b)/
describe KHOP_SPAMHAUS_DROP_LE Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP_LE nopublish
score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 # adds to KHOP_SPAMHAUS_DROP
@@ -164,7 +164,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:3\.(?:[034567]|9[01235678]?|1[012345]?|8[1469]?|20?)|5\.(?:[58]|11|20)|6\.1[78])|6\.71\.(?:2(?:[579]|2[12]|0?8|1\d)|3[589]?|5[0258]|16?)|3\.(?:1(?:62\.(?:244|56)|0\.20[01])|23\.46)|4\.112\.2(?:2[456789]|3[016789])|2\.215\.44|0\.165\.3)|82\.177\.(?:1(?:[01]2|56?|21|3)|7[3458]|8[178]|5[05]|210|47?)|7(?:5\.106\.(?:5[0123679]|6[013]|4[89])|8\.172\.183)|2(?:(?:0\.86\.19|1\.63\.1)[6789]|2\.155\.36)|09\.127\.86)|2(?:1(?:7\.(?:118\.(?:8[13]|90)|66\.146)|3\.87\.(?:12[12]|7[46]))|0(?:2\.1(?:01\.201|52\.243)|0\.108\.108)|23\.25(?:2\.1(?:7[012345]|6\d)|5\.226))|8(?:5\.(?:26\.(?:1(?:6[45]|8[46]|55)|2(?:3[12345]|41))|115\.248)|3\.149\.(?:[89]|3[458]?|4[4567]|21?)|2\.128\.55)|41\.(?:2(?:54\.[012]|09\.65)|95\.(?:[248]|1[0246]))|36\.37\.23[89]|59\.55\.89|61\.19\.66|92\.42\.55)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:4\.112\.2(?:2[456789]|3[016789])|2\.215\.6[345])|(?:22\.155\.3|97\.252\.1)6|80\.232\.105|76\.53\.121|03\.1\.29)|8(?:5\.(?:26\.(?:1(?:6[45]|8[34])|2[34]1)|115\.248)|3\.(?:149\.(?:21|3)|221\.160))|223\.252\.1(?:6[1578]|7[03])|41\.190\.3)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6