You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2011/04/28 07:57:36 UTC
svn commit: r1097328 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Thu Apr 28 05:57:36 2011
New Revision: 1097328
URL: http://svn.apache.org/viewvc?rev=1097328&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1097328&r1=1097327&r2=1097328&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Thu Apr 28 05:57:36 2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201104271
+## khop-sc-neighbors.cf v 201104281
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -93,7 +93,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:(?:1\.152\.5|7\.118\.8)1|3\.2(?:26\.63|33\.64))|0(?:3\.217\.145|9\.205\.220))|9(?:(?:1\.195\.8|9\.192\.4)7|3\.1(?:90\.104|25\.2)|8\.139\.91)|1(?:14\.39\.143|78\.49\.255|82\.255\.61|98\.106\.26)|59\.120\.25|79\.124\.92)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:(?:1\.152\.5|7\.118\.8)1|3\.233\.64|8\.213\.77)|0(?:3\.217\.145|9\.205\.220))|1(?:78\.49\.255|82\.255\.61|98\.106\.26|21\.54\.32)|7(?:7\.221\.143|9\.124\.92)|9(?:8\.139\.91|9\.192\.47)|81\.9\.23)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 0.1 0 0.1 0
@@ -112,7 +112,7 @@ score KHOP_SC_CIDR24 0.1 0 0.1 0
# 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:0\.234\.196|2\.152\.243|9\.205\.220|8\.43\.232|3\.82\.95)|1(?:7\.(?:118\.(?:83|90)|66\.146)|2\.199\.29|3\.87\.74))|8(?:5\.(?:2(?:6\.(?:2(?:3[134]|41)|1(?:6[45]|86))|5\.135)|115\.248)|3\.149\.(?:21|3)|2\.178\.69)|1(?:(?:80\.232\.10|95\.191\.5)8|19\.82\.65|74\.36\.60)|6(?:1\.19\.6[67]|0\.199\.201)|77\.(?:221\.143|111\.34))\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:7\.(?:118\.(?:83|90)|66\.146|8\.225)|2\.199\.29|3\.87\.74)|0(?:0\.234\.196|2\.152\.243|9\.205\.220|8\.43\.232))|8(?:5\.2(?:6\.(?:2(?:3[134]|41)|1(?:6[45]|86))|5\.135)|3\.149\.(?:38?|21)|2\.178\.69)|1(?:(?:80\.232\.10|95\.191\.5)8|19\.82\.65|74\.36\.60)|6(?:1\.19\.6[67]|0\.199\.201)|9(?:1\.195\.87|3\.125\.2)|77\.111\.34)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5
@@ -130,7 +130,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:4\.(?:4(?:0\.(?:2(?:04\.217|16\.246)|183\.100)|2\.2(?:08\.(?:188|24)|14\.13)|7\.3\.5)|3(?:9\.1(?:43\.183|\.17)|8\.242\.247))|9\.(?:2(?:0(?:3\.156\.164|0\.84\.197)|35\.30\.51)|199\.200\.147|82\.65\.199)|5\.(?:2(?:49\.120\.138|2\.125\.210)|126\.227\.18)|8\.(?:39\.(?:123\.3|80\.57)|40\.59\.216)|2\.1(?:04\.146\.46|62\.237\.82)|3\.160\.131\.250|0\.76\.103\.221|7\.20\.207\.236)|8(?:8\.(?:2(?:3(?:0\.91\.212|3\.151\.56)|(?:17\.227\.23|27\.48\.)5|4(?:1\.66\.68|9\.49\.43))|12(?:3\.129\.144|7\.132\.11))|7\.(?:45\.241\.(?:27|30)|11\.27\.165|5\.198\.158)|(?:2\.(?:50\.24\.13|71\.28\.24)|0\.176\.84\.16)3|9\.(?:32\.58\.241|60\.14\.132|75\.14\.186)|3\.(?:104\.162\.167|83\.167\.109)|6\.(?:215\.210\.169|112\.250\.14))|9(?:5\.(?:1(?:8(?:9\.2(?:15\.21|34\.25)0|2\.194\.223)|91\.58\.[45]|61\.9\.2)|5\.41\.190)|0\.1(?:66\.146\.171|58\.100\.65)|3\.(?:77\.221\.219|23\.58\.182)|4\.150\.165\.243|7\.200\.56\.38|8\.106\.26\.54)|2(?:3\.(?:2(?:3(?:6\
.147\.206|7\.84\.72)|55\.250\.2)|195\.47\.115)|1\.(?:1(?:47\.105\.198|80\.50\.96)|50\.16\.11)|2\.16(?:0\.175\.161|9\.67\.58)|4\.123\.167\.140|5\.230\.6\.37)|7(?:8\.(?:21(?:2\.7(?:2\.251|3\.177)|4\.183\.76)|1(?:62\.160\.92|8\.129\.40)|76\.222\.70|95\.70\.46)|4\.36\.60\.2[48])|09\.(?:1(?:88\.(?:13\.193|32\.86)|00\.41\.133)|70\.184\.22)|63\.152\.102\.208|58\.250\.33\.227|4\.48\.108\.173)|2(?:1(?:3\.(?:1(?:71\.(?:218\.150|35\.131)|41\.141\.72)|22(?:7\.227\.115|6\.63\.144))|8\.(?:2(?:1(?:2\.(?:58\.137|9\.231)|3\.77\.68)|48\.65\.140)|163\.90\.199)|2\.(?:1(?:99\.29\.145|\.105\.136)|5\.19\.216)|0\.(?:219\.245\.97|89\.78\.226|126\.14\.1)|7\.(?:147\.17\.67|97\.184\.2)|1\.1(?:52\.51\.62|47\.3\.74)|6\.138\.200\.18)|0(?:3\.(?:1(?:(?:28\.178\.2|58\.176\.4)8|07\.154\.2|97\.77\.37)|70\.110\.82)|0\.234\.196\.(?:1(?:22|88)|2(?:33|46))|1\.(?:238\.108\.70|51\.232\.248)|2\.(?:137\.150\.5|55\.191\.22)|8\.43\.232\.34)|2(?:0\.(?:1(?:3(?:0\.181\.45|5\.222\.97)|1(?:7\.196\.12|9\.56\.14))|80\.173\.(?:
18|5)2)|2\.102\.169\.209)|7\.251\.86\.163)|9(?:3\.(?:1(?:57\.148\.102|25\.2\.169|90\.104\.7)|7(?:5\.191\.238|8\.140\.87|3\.16\.63)|95\.43\.240)|1\.(?:1(?:(?:44\.186\.13|97\.184\.1)8|24\.0\.145)|2(?:02\.11\.9[01]|13\.240\.240))|2\.(?:24(?:2\.97\.102|5\.38\.44)|61\.25\.222)|4\.(?:190\.64\.12|232\.13\.15|41\.59\.238)|5\.1(?:80\.215\.102|7\.47\.108|91\.153\.7)|9\.192\.47\.69)|8(?:5\.(?:185\.155\.69|25\.135\.200|37\.118\.166)|0\.(?:195\.239\.169|77\.154\.135|90\.120\.7)|2\.(?:114\.7(?:2\.110|9\.163)|80\.232\.242)|9\.(?:101\.232\.58|207\.72\.109)|8\.119\.250\.114|3\.157\.56\.187|7\.103\.211\.65|1\.9\.23\.223)|7(?:7\.(?:2(?:2(?:1\.143\.162|3\.132\.158)|46\.55\.34|32\.83\.2)|1(?:11\.34\.143|21\.83\.180)|34\.183\.45)|8\.144\.231\.107|9\.124\.92\.164|2\.35\.95\.18)|6(?:1\.(?:19\.251\.68|78\.29\.47)|0\.199\.201\.120|5\.98\.107\.178|9\.50\.238\.106|6\.7\.148\.135|2\.33\.49\.41)|5(?:9\.(?:1(?:45\.209\.135|04\.141\.42|20\.25\.101)|90\.140\.216|4\.78\.112)|8\.149\.10\.243)|4(?:1\.137\.(?:(
?:24|30|56)\.4|63\.20[12])|6\.183\.83\.169)|38\.105\.20\.163)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:1(?:4\.(?:4(?:0\.(?:2(?:04\.217|16\.246)|183\.100)|2\.208\.(?:188|24)|7\.3\.5)|3(?:9\.1(?:43\.183|\.17)|8\.242\.247))|9\.(?:20(?:3\.156\.164|0\.84\.197)|199\.200\.147|82\.65\.199)|8\.(?:39\.(?:123\.3|80\.57)|233\.172\.244|40\.59\.216)|5\.(?:2(?:49\.120\.138|2\.125\.210)|126\.227\.18)|2\.1(?:04\.146\.46|62\.237\.82)|7\.2(?:0\.207\.236|40\.248\.34)|0\.76\.103\.221)|8(?:8\.(?:2(?:3(?:0\.91\.212|3\.151\.56)|4(?:1\.66\.68|9\.49\.43)|27\.48\.5)|12(?:3\.129\.144|7\.132\.11|8\.0\.78))|7\.(?:45\.241\.(?:27|30)|11\.27\.165|5\.198\.158|35\.71\.51)|3\.(?:10(?:4\.162\.167|6\.110\.131)|83\.167\.109)|6\.(?:215\.210\.169|112\.250\.14)|9\.(?:32\.58\.241|75\.14\.186)|2\.(?:50\.24\.13|71\.28\.24)3)|2(?:1\.(?:1(?:44\.27\.84|51\.87\.82|80\.50\.96)|50\.16\.11)|3\.(?:2(?:36\.147\.206|55\.250\.2)|195\.47\.115)|5\.(?:230\.(?:3\.122|6\.37)|137\.24\.238)|2\.16(?:0\.175\.161|9\.67\.58)|4\.123\.167\.140)|9(?:5\.(?:1(?:8(?:9\.2(?:15\.21|34\.25)0|2\.19
4\.223)|91\.58\.[45]|61\.9\.2)|5\.41\.190)|0\.1(?:66\.146\.171|58\.100\.65)|4\.150\.165\.243|3\.77\.221\.219|7\.200\.56\.38|8\.106\.26\.54)|7(?:8\.(?:2(?:1(?:2\.7(?:2\.251|3\.177)|4\.183\.76)|00\.95\.22)|(?:18\.129\.4|76\.222\.7)0|95\.70\.46)|4\.36\.60\.28)|09\.(?:1(?:88\.(?:13\.193|32\.86)|94\.198\.24)|70\.184\.22)|63\.152\.102\.208|58\.250\.33\.227|4\.48\.108\.173)|2(?:1(?:3\.(?:1(?:71\.(?:218\.150|35\.131)|41\.141\.72)|22(?:7\.227\.115|6\.63\.144))|8\.(?:2(?:1(?:2\.(?:58\.137|9\.231)|3\.77\.68)|48\.65\.140)|163\.90\.199)|0\.(?:219\.245\.97|66\.139\.115|89\.78\.226|126\.14\.1)|2\.(?:1(?:99\.29\.145|\.105\.136)|5\.19\.(?:216|71))|1\.1(?:78\.61\.203|52\.51\.62|47\.3\.74)|7\.(?:147\.17\.67|97\.184\.2)|6\.138\.200\.18)|0(?:3\.(?:1(?:28\.167\.100|58\.176\.48|07\.154\.2|97\.77\.37)|250\.88\.125|70\.110\.82)|2\.(?:62\.106\.166|137\.150\.5|55\.191\.22)|1\.(?:238\.108\.70|51\.232\.248)|0\.234\.196\.(?:2(?:33|46)|188)|8\.43\.232\.34)|2(?:0\.(?:1(?:3(?:0\.181\.45|5\.222\.97)|1(?:7\.1
96\.12|9\.56\.14))|80\.173\.(?:18|5)2)|2\.102\.169\.209)|7\.251\.86\.163)|9(?:3\.(?:1(?:2(?:5\.2\.169|7\.12\.10)|57\.148\.102|90\.104\.7)|7(?:5\.191\.238|8\.140\.87|3\.16\.63)|95\.43\.240)|1\.(?:1(?:(?:44\.186\.13|97\.184\.1)8|24\.0\.145)|2(?:13\.240\.240|02\.11\.91))|5\.1(?:91\.1(?:40\.201|53\.7)|80\.215\.102|7\.47\.108)|4\.(?:232\.13\.15|41\.59\.238)|2\.24(?:2\.97\.102|5\.38\.44)|9\.192\.47\.69)|8(?:2\.(?:1(?:14\.7(?:2\.110|9\.163)|93\.139\.246)|80\.232\.242)|5\.(?:185\.155\.69|25\.135\.200|37\.118\.166)|0\.(?:195\.239\.169|77\.154\.135|90\.120\.7)|9\.(?:101\.232\.58|207\.72\.109)|8\.119\.250\.114|3\.239\.39\.166|7\.103\.211\.65|1\.9\.23\.223|4\.22\.8\.137)|7(?:7\.(?:2(?:2(?:1\.143\.162|3\.132\.158)|46\.55\.34|32\.83\.2)|1(?:11\.34\.143|21\.83\.180)|34\.183\.45|66\.192\.37)|8\.144\.231\.107|9\.124\.92\.164)|6(?:0\.19(?:6\.128\.122|9\.201\.120)|1\.(?:19\.251\.68|78\.29\.47)|6\.7\.148\.135|2\.33\.49\.41)|5(?:9\.(?:1(?:04\.141\.42|20\.25\.101)|90\.140\.216|4\.78\.112)|8\.149\
.10\.243)|4(?:1\.137\.(?:24|30|56)\.4|6\.183\.83\.169)|38\.105\.20\.163)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -147,14 +147,14 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# Spamhaus DROP, http://www.spamhaus.org/drop/
-header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /___ FAILED TO POPULATE ___/
+header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)
|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:2
1|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:3
2|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567])|198
\.1(?:7[6789]|9[01]|8\d))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]
|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:5[01]|46)|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]?|13|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|6\.(?:98\.1(?:1[23456789]|2[01234567])|231\.(?:6[456789]|7\d))
|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789]))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.97?)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|29)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567])|\.0\.0\.(?:[023456789]|1[012345]?))|58\.83\.(?:[89]|1[012345]))\b)/
describe KHOP_SPAMHAUS_DROP Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP nopublish
score KHOP_SPAMHAUS_DROP 1 0.2 1 0.2
# spam/ham s/o corpus
# 0.0349/0.0029 0.924 20110227@510k
-header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*___ FAILED TO POPULATE ___/
+header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[2345
6789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|
0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.
(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|09\.94\.21[2345])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[012345
67])|198\.1(?:7[6789]|9[01]|8\d))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\
.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:5[01]|46)|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]?|13|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|6\.(?:98\.1(?:1[23456789]|2[01234567])|231\.(?:6[45678
9]|7\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789]))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.97?)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|29)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567])|\.0\.0\.(?:[023456789]|1[012345]?))|58\.83\.(?:[89]|1[012345]))\b)/
describe KHOP_SPAMHAUS_DROP_LE Relay listed in Spamhaus Don't Route Or Peer List
tflags KHOP_SPAMHAUS_DROP_LE nopublish
score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 # adds to KHOP_SPAMHAUS_DROP
@@ -164,7 +164,7 @@ score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 #
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:2(?:1(?:7\.(?:118\.(?:83|90)|66\.146|8\.225)|3\.87\.(?:1(?:3[37]|14|29|41)|74))|0(?:2\.152\.243|3\.82\.95)|22\.84\.17[678])|8(?:5\.(?:26\.(?:1(?:6[45]|8[46])|2(?:3[12345]|41))|115\.248)|3\.149\.(?:4[4567]|38?|21)|2\.178\.69)|1(?:8(?:3\.93\.(?:[0135]|2[01]?)|0\.(?:232\.10|149\.)8)|25\.23(?:4\.144|5\.192)|13\.56\.28)|41\.189\.193|61\.19\.66)\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:2(?:1(?:7\.(?:118\.(?:83|90)|66\.146|8\.225)|3\.87\.(?:1(?:3[37]|14|29|41)|74))|0(?:2\.152\.243|3\.82\.95)|22\.84\.17[67])|8(?:5\.(?:26\.(?:1(?:6[45]|8[46])|2(?:3[12345]|41))|115\.248)|3\.149\.(?:4[4567]|38?|21)|(?:0\.83\.23|2\.178\.6)9)|1(?:8(?:3\.93\.(?:[0135]|2[01]?)|0\.(?:232\.10|149\.)8)|13\.(?:162\.246|56\.28)|25\.23(?:4\.144|5\.192))|61\.19\.6[56]|41\.189\.193)\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 2 0.6 2 0.6