You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/06/10 07:57:42 UTC
svn commit: r1134196 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Fri Jun 10 05:57:42 2011
New Revision: 1134196
URL: http://svn.apache.org/viewvc?rev=1134196&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1134196&r1=1134195&r2=1134196&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Fri Jun 10 05:57:42 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 20110691
+## khop-sc-neighbors.cf v 201106101
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -75,7 +75,7 @@ score KHOP_SC_CIDR16 1.0 0.2 1.0 0.2
# crap, still empty 20100410 bad scrape, script failed to populate rule
# crap, still empty 20110227 this is due to safety net exclusions -> 1 .2 1 .2
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:18\.96|90\.41)|41\.141|89\.122)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:118\.96|41\.141|89\.122)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0.4
@@ -93,7 +93,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:0\.111\.134|3\.217\.145|2\.54\.119)|13\.(?:110\.49|233\.64)|22\.102\.144)|1(?:2(?:1\.180\.50|4\.6\.181)|19\.202\.(?:15|7)0)|41\.137\.24|91\.187\.92)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:0\.111\.134|3\.217\.145)|13\.(?:110\.49|233\.64)|22\.102\.144)|1(?:19\.202\.(?:15|7)0|74\.143\.204|88\.165\.219)|(?:91\.121\.20|31\.7\.16)8|79\.124\.92|65\.49\.36)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -112,7 +112,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:8(?:5\.26\.(?:1(?:6[45]|8[46])|231)|3\.149\.(?:38?|21)|2\.178\.69|6\.110\.94)|1(?:8(?:0\.232\.107|8\.140\.128)|18\.4(?:1\.208|5\.115)|21\.147\.135)|2(?:1(?:7\.(?:118\.(?:8[13]|90)|66\.146)|3\.175\.201)|03\.82\.9[25])|61\.1(?:55\.5|9\.66)|79\.124\.92|31\.7\.168|94\.23\.26)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:8\.4(?:1\.208|5\.115)|1\.224\.250)|8(?:0\.232\.107|8\.140\.128)|2(?:1\.147\.135|4\.6\.181))|2(?:17\.(?:118\.(?:8[13]|90)|66\.146)|0(?:2\.54\.119|3\.82\.92))|8(?:5\.26\.(?:16[45]|231)|3\.149\.(?:38?|21)|2\.178\.69)|61\.1(?:55\.5|9\.66)|94\.23\.26)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -130,7 +130,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:2(?:1\.(?:1(?:4(?:7\.(?:1(?:3(?:5\.20|9\.5)6|97\.153)|201\.27)|8\.212\.146)|8(?:0\.(?:170\.203|50\.96)|1\.171\.48)|75\.13(?:8\.118|\.42)|51\.140\.194)|243\.204\.229|6\.165\.116)|5\.13(?:6\.(?:104\.13|39\.115)|5\.148\.246|7\.24\.238)|2\.(?:1(?:60\.137\.202|99\.119\.57)|248\.11\.54)|4\.(?:56\.149\.35|7\.20\.77)|3\.195\.18\.42)|1(?:9\.(?:20(?:0\.(?:1(?:39\.233|46\.2)|225\.156|84\.197)|2\.(?:150\.92|70\.45))|69\.172\.103|82\.65\.199)|8\.(?:4(?:1\.(?:208\.174|17\.231)|5\.115\.1(?:33|42))|233\.164\.84)|2\.16(?:3\.(?:126\.127|236\.200)|2\.103\.38)|5\.2(?:3\.(?:14\.112|88\.199)|2\.125\.210)|6\.36\.250\.143|1\.93\.47\.162)|8(?:8\.(?:165\.2(?:04\.181|19\.114)|241\.66\.68)|0\.(?:227\.213\.103|94\.176\.87)|2\.71\.45\.230|6\.82\.120\.48|3\.83\.3\.254)|7(?:8\.(?:21(?:9\.244\.13|1\.38\.)2|18\.90\.109|76\.222\.70)|5\.215\.79\.181|4\.123\.43\.69|3\.0\.129\.78)|9(?:0\.(?:246\.186\.2|18\.127\.)33|3\.(?:34\.173\.250|58\.246\.2)|5\.(?:22\.229
\.246|161\.9\.2))|09\.20(?:3\.114\.108|5\.115\.72)|4\.48\.(?:108\.17|94\.16)3|64\.124\.106\.100)|2(?:1(?:3\.(?:1(?:75\.2(?:1(?:7\.246|9\.150)|01\.(?:186|90))|10\.49\.174)|2(?:39\.215\.174|29\.104\.79)|79\.124\.130|5\.245\.122)|7\.(?:1(?:59\.145\.115|14\.13\.127|6\.4\.18)|8\.249\.230)|1\.(?:107\.185\.163|226\.179\.152)|0\.(?:216\.151\.98|0\.202\.215)|2\.(?:200\.117\.230|1\.103\.94)|9\.85\.(?:30\.103|232\.5)|6\.138\.200\.18|8\.159\.75\.20)|2(?:0\.(?:2(?:25\.69\.235|55\.82\.62)|8(?:0\.173\.52|4\.29\.159)|7(?:1\.140\.2|7\.45\.69)|131\.0\.149)|2\.1(?:0(?:2\.144\.1(?:16|8)|4\.49\.236)|64\.67\.31)|1\.144\.55\.55)|0(?:0\.(?:111\.134\.114|46\.186\.82)|2\.(?:54\.119\.149|66\.107\.203)|3\.2(?:17\.145\.136|50\.93\.55)|1\.238\.249\.242))|9(?:4\.(?:1(?:5(?:3\.232\.178|9\.140\.16)|37\.237\.184|02\.212\.20|26\.46\.196|90\.125\.63)|23\.2(?:42\.67|6\.58)|41\.99\.85)|1\.(?:1(?:21\.(?:1(?:(?:57\.10|65\.6)0|06\.24)|208\.138|96\.125)|95\.230\.14|87\.92\.52)|2(?:02\.3\.8|14\.83\.)2)|2\.(?:24(?:(?:
1\.107\.20|5\.188\.13)5|7\.231\.242|3\.90\.184)|4(?:3\.143\.232|8\.110\.204))|5\.(?:83\.1(?:32\.91|72\.73)|226\.174\.13|64\.81\.158)|3\.(?:7(?:9\.249\.78|3\.16\.63)|125\.2\.169)|0\.190\.237\.215)|8(?:9\.(?:1(?:05\.(?:158\.103|236\.194)|84\.1\.232|12\.8\.40)|2(?:(?:52\.126\.16|05\.94\.8)6|16\.180\.252))|1\.(?:9(?:3\.155\.140|5\.181\.39)|2(?:4\.80\.130|1\.5\.166))|7\.(?:2(?:28\.122\.108|37\.210\.174)|118\.114\.4)|3\.(?:1(?:42\.111\.228|6\.167\.14)|239\.39\.166)|5\.(?:198\.1(?:64\.225|86\.234)|92\.140\.11)|0\.(?:80\.116\.129|68\.237\.1)|4\.5(?:3\.196\.245|2\.124\.36)|2\.194\.90\.131|8\.156\.33\.227|6\.110\.94\.3)|7(?:9\.1(?:8(?:3\.230\.116|1\.193\.7)|24\.92\.164|39\.21\.248)|7\.(?:10(?:6\.232\.178|8\.98\.177)|37\.207\.248)|(?:5\.127\.110\.1|4\.52\.87\.16)2|8\.(?:97\.136\.113|46\.84\.88)|2\.55\.174\.13)|6(?:1\.(?:1(?:9\.25(?:0\.69|1\.68)|47\.75\.74|55\.5\.247)|8\.203\.58|35\.56\.2)|2\.149\.(?:200\.170|163\.43)|4\.31\.32\.210|9\.16\.253\.19)|4(?:1\.137\.(?:(?:24|56)\.4|63\.203)|6
\.50\.151\.108)|59\.(?:151\.228\.36|0\.183\.130|21\.61\.238))\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:2(?:1\.(?:1(?:4(?:7\.1(?:3(?:5\.(?:206|74)|9\.56)|97\.153)|8\.212\.146)|80\.(?:170\.203|50\.96)|51\.140\.194|75\.138\.118)|243\.204\.229|6\.165\.116)|5\.13(?:5\.148\.246|6\.104\.13|7\.24\.238)|2\.(?:160\.137\.202|248\.11\.54)|4\.(?:56\.149\.35|7\.20\.77)|3\.195\.18\.42)|1(?:9\.(?:20(?:0\.(?:1(?:39\.233|46\.2)|225\.156|84\.197)|2\.(?:150\.92|70\.45))|82\.65\.199)|8\.(?:4(?:1\.(?:208\.174|17\.231)|5\.115\.1(?:33|42))|233\.164\.84)|2\.16(?:3\.126\.127|2\.103\.38)|5\.23\.(?:14\.112|88\.199)|1\.224\.250\.1(?:29|30)|6\.36\.250\.143)|8(?:8\.(?:165\.2(?:04\.181|19\.114)|241\.66\.68)|3\.83\.(?:224\.218|3\.254)|7\.92\.208\.114|0\.94\.176\.87|2\.71\.45\.230|6\.82\.120\.48)|7(?:8\.(?:21(?:9\.244\.13|1\.38\.)2|18\.90\.109|76\.222\.70)|4\.1(?:43\.204\.71|23\.43\.69)|5\.215\.79\.181|3\.0\.129\.78)|9(?:5\.(?:1(?:3\.179\.28|91\.58\.4|61\.9\.2)|22\.229\.246)|0\.(?:(?:246\.186\.2|18\.127\.)33|80\.239\.92)|3\.34\.173\.250)|09\.(?:20(?:3\.114
\.108|5\.115\.72)|104\.92\.176|70\.1\.254)|4\.48\.(?:108\.17|94\.16)3|64\.124\.106\.100)|2(?:1(?:3\.(?:1(?:75\.2(?:1(?:7\.246|9\.150)|01\.(?:186|90))|10\.49\.174)|2(?:39\.215\.174|29\.104\.79)|79\.124\.130)|7\.(?:1(?:59\.145\.115|14\.13\.127|6\.4\.18)|8\.249\.230)|0\.(?:216\.151\.98|0\.202\.215|59\.187\.44)|1\.(?:107\.185\.163|226\.179\.152)|2\.(?:200\.117\.230|1\.103\.94)|9\.85\.(?:30\.103|232\.5)|8\.159\.75\.20)|2(?:0\.(?:2(?:25\.69\.235|55\.82\.62)|8(?:0\.173\.52|4\.29\.159)|7(?:1\.140\.2|7\.45\.69)|131\.0\.149)|2\.1(?:0(?:2\.144\.1(?:16|8)|4\.49\.236)|64\.67\.31)|1\.144\.55\.55)|0(?:0\.(?:111\.134\.114|46\.186\.82)|2\.(?:54\.119\.149|66\.107\.203)|3\.217\.145\.136))|9(?:4\.(?:1(?:5(?:3\.232\.178|9\.140\.16)|02\.212\.20|26\.46\.196|90\.125\.63)|2(?:3\.2(?:42\.67|6\.58)|5\.90\.84)|(?:31\.162\.4|41\.99\.8)5)|1\.(?:1(?:21\.(?:1(?:(?:57\.10|65\.6)0|06\.24|35\.66)|208\.138|83\.101|96\.125)|95\.230\.14|87\.92\.52)|2(?:02\.3\.8|14\.83\.)2)|2\.(?:24(?:(?:1\.107\.20|5\.188\.13)5|7
\.231\.242)|4(?:3\.143\.232|8\.110\.204))|5\.(?:83\.1(?:32\.91|72\.73)|226\.174\.13|77\.129\.219|167\.74\.42|64\.81\.158)|3\.(?:1(?:57\.148\.102|25\.2\.169)|7(?:9\.249\.78|3\.16\.63))|0\.190\.237\.215)|8(?:9\.(?:1(?:05\.(?:158\.103|236\.194)|8(?:9\.169\.77|4\.1\.232)|12\.8\.40)|2(?:(?:52\.126\.16|05\.94\.8)6|16\.180\.252))|1\.(?:9(?:3\.155\.140|5\.181\.39)|2(?:4\.80\.130|1\.5\.166))|7\.(?:2(?:28\.122\.108|37\.210\.174)|118\.114\.4)|5\.(?:198\.1(?:64\.225|86\.234)|92\.140\.11)|3\.(?:142\.111\.228|239\.39\.166)|2\.1(?:65\.149\.152|94\.90\.131)|0\.(?:80\.116\.129|68\.237\.1)|8\.156\.33\.227|4\.52\.124\.36|6\.110\.94\.3)|7(?:9\.1(?:8(?:3\.230\.116|1\.193\.7)|24\.92\.164|39\.21\.248)|(?:5\.127\.110\.1|4\.52\.87\.16)2|7\.10(?:6\.232\.178|8\.98\.177)|8\.(?:97\.136\.113|46\.84\.88)|2\.55\.174\.13)|6(?:1\.(?:1(?:9\.25(?:0\.69|1\.68)|47\.75\.74|55\.5\.247)|8\.203\.58|35\.56\.2)|2\.149\.(?:200\.170|163\.43)|4\.31\.32\.210|5\.49\.36\.166|9\.16\.253\.19)|4(?:1\.137\.(?:24|56)\.4|6\.50\.1
51\.108)|59\.(?:151\.228\.36|21\.61\.238))\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -147,14 +147,14 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# Spamhaus DROP, http://www.spamhaus.org/drop/
-header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123
]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3
\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|
0\.(?:141|230)|2\.147|5\.190)|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|13|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|3(?:4\.(?:1(?:7[25]|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|09\.(?:94\.21[2345]|196\.140))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01]))
)|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:1(?:45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:2(?:0
(?:1\.(?:[457]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789])|6[4567]?)|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|6\.(?:1(?:4?1|22|90)|232|7?3)|1\.(?:6[4567]|8[89]|9[01])|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:4[4569]|5[01])|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:64\.(?:1[013]|3[789]|9[89]?|5[69]|45|61)|21(?:[67]|5\.14[0123])))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|
2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|2\.1(?:9\.(?:[0789]|2(?:[01236789]|5[012345]?|4[89]?)?|6[01234567]?|[1345]\d?)|8(?:2\.15[23456789]|\.252)|22\.(?:3[23456789]|7[23]))|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|9\.(?:114\.97?|45\.14)|6\.55\.(?:140|243)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345])|31\.222\.20
[01234567])\b)/
+header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /___ FAILED TO POPULATE ___/
describe KHOP_SPAMHAUS_DROP Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP nopublish
score KHOP_SPAMHAUS_DROP 1 0.2 1 0.2
# spam/ham s/o corpus
# 0.0349/0.0029 0.924 20110227@510k
-header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789
]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20
[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|
9\.2)23|0\.(?:141|230)|2\.147|5\.190)|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|13|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|3(?:4\.(?:1(?:7[25]|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|09\.(?:94\.21[2345]|196\.140))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d
|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:1(?:45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.
(?:2(?:0(?:1\.(?:[457]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789])|6[4567]?)|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|6\.(?:1(?:4?1|22|90)|232|7?3)|1\.(?:6[4567]|8[89]|9[01])|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:4[4569]|5[01])|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:64\.(?:1[013]|3[789]|9[89]?|5[69]|45|61)|21(?:[67]|5\.14[0123])))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012
345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|2\.1(?:9\.(?:[0789]|2(?:[01236789]|5[012345]?|4[89]?)?|6[01234567]?|[1345]\d?)|8(?:2\.15[23456789]|\.252)|22\.(?:3[23456789]|7[23]))|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|9\.(?:114\.97?|45\.14)|6\.55\.(?:140|243)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|2[89])|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|58\.83\.(?:[89]|1[012345])|31\
.222\.20[01234567])\b)/
+header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*___ FAILED TO POPULATE ___/
describe KHOP_SPAMHAUS_DROP_LE Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP_LE nopublish
score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 # adds to KHOP_SPAMHAUS_DROP
@@ -164,7 +164,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:2(?:1(?:3\.87\.(?:1(?:2[01389]|3[67]|42)|74)|7\.(?:118\.(?:83|90)|66\.146))|0(?:3\.82\.9[25]|2\.152\.243)|23\.252\.1(?:6[123]|7[45]))|1(?:1(?:4\.112\.22[456789]|1\.224\.250|3\.10\.166)|25\.23(?:4\.144|5\.192)|80\.232\.107)|8(?:5\.(?:26\.(?:1(?:6[45]|8[46])|2[34]1)|115\.248)|3\.149\.(?:[89]|4[4567]|3[68]?|21))|58\.64\.187|61\.19\.66)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:2(?:1(?:3\.87\.(?:1(?:2[01389]|3[67]|42)|74)|7\.(?:118\.(?:83|90)|66\.146))|0(?:3\.82\.9[25]|2\.152\.243)|23\.252\.1(?:6[13]|7[45]))|8(?:5\.(?:26\.(?:1(?:6[45]|8[46]|55)|2[34]1)|115\.248)|3\.149\.(?:[89]|4[4567]|3[68]?|21))|1(?:1(?:4\.112\.2(?:2[456789]|3[16789])|3\.10\.166)|25\.23(?:4\.144|5\.192)|80\.232\.107)|(?:36\.37\.23|61\.19\.6)6|58\.64\.187)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6