spamassassin-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From khop...@apache.org
Subject svn commit: r1085652 - /spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Date Sat, 26 Mar 2011 05:57:53 GMT
Author: khopesh
Date: Sat Mar 26 05:57:53 2011
New Revision: 1085652

URL: http://svn.apache.org/viewvc?rev=1085652&view=rev
Log:
auto-generated rules

Modified:
    spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf

Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1085652&r1=1085651&r2=1085652&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sat Mar 26 05:57:53
2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf	v 201103251
+## khop-sc-neighbors.cf	v 201103261
 ## Khopesh's syndication of SpamCop's top offenders and top offending networks.
 ## 
 ## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
 
 # http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
 # Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8  X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:13|87)|41|95)(?:\.[012]?\d{1,2}){3}\b)
/
+header __KHOP_SC_CIDR8  X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:22|87)|41|95)(?:\.[012]?\d{1,2}){3}\b)
/
 # and gets cleaned up a bit
 meta	 KHOP_SC_CIDR8	__KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
 describe KHOP_SC_CIDR8  Relay CIDR /8 is among worst in SpamCop
@@ -75,7 +75,7 @@ score	 KHOP_SC_CIDR16  1.0 0.2 1.0 0.2
 # crap, still empty   20100410  bad scrape, script failed to populate rule
 # crap, still empty   20110227  this is due to safety net exclusions -> 1 .2 1 .2
 
-header	 KHOP_SC_TOP_CIDR16  Received =~ /(?-xism:\b(?:1(?:80\.241|18\.96)|41\.141)(?:\.[012]?\d{1,2}){2}\b)/
+header	 KHOP_SC_TOP_CIDR16  Received =~ /(?-xism:\b(?:1(?:1(?:0\.137|8\.96)|80\.241)|41\.141)(?:\.[012]?\d{1,2}){2}\b)/
 describe KHOP_SC_TOP_CIDR16  Relay CIDR /16 leads SpamCop in worst /16s
 tflags	 KHOP_SC_TOP_CIDR16  nopublish
 score	 KHOP_SC_TOP_CIDR16  2.0 0.3 2.0 0.4
@@ -93,7 +93,7 @@ score	 KHOP_SC_TOP_CIDR16  2.0 0.3 2.0 0
 
 
 # http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header	 KHOP_SC_CIDR24  Received =~ /(?-xism:\b(?:2(?:1(?:7\.1(?:99\.218|18\.81)|3\.233\.64)|0(?:7\.57\.124|0\.80\.13))|1(?:78\.(?:49\.255|63\.70)|80\.214\.232|98\.106\.26)|9(?:1\.149\.157|3\.186\.119)|8(?:9\.208\.41|0\.95\.70)|77\.232\.142|62\.75\.193)\.[012]?\d{1,2}\b)/
+header	 KHOP_SC_CIDR24  Received =~ /(?-xism:\b(?:2(?:1(?:7\.1(?:99\.218|18\.81)|3\.233\.64)|0(?:7\.57\.124|0\.80\.13))|1(?:7(?:4\.137\.172|8\.49\.255)|28\.121\.191|98\.106\.26)|9(?:1\.149\.157|3\.186\.119)|77\.232\.142|62\.75\.193|82\.140\.81)\.[012]?\d{1,2}\b)/
 describe KHOP_SC_CIDR24  Relay CIDR /24 is among worst in SpamCop
 tflags	 KHOP_SC_CIDR24  nopublish
 score	 KHOP_SC_CIDR24  0.1 0 0.1 0
@@ -112,7 +112,7 @@ score	 KHOP_SC_CIDR24  0.1 0 0.1 0
 # 0.4157/0.5009 0.454 20110227  something is wrong here! -> .1 0 .1 0
 
 
-header	 KHOP_SC_TOP_CIDR24  Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:2(?:3[234]|41)|16[45])|115\.248)|1\.192\.2(?:11|38)|3\.149\.(?:38?|21)|2\.140\.81|7\.106\.10)|2(?:1(?:3\.(?:18(?:8\.130|6\.38)|5\.178|87\.74)|7\.(?:118\.(?:83|90)|66\.146))|02\.1(?:52\.243|64\.161))|1(?:87\.(?:45\.193|61\.61)|74\.137\.172|13\.56\.28)|6(?:2\.193\.234|1\.19\.66)|98\.139\.(?:44|91)|74\.50\.95)\.[012]?\d{1,2}\b)/
+header	 KHOP_SC_TOP_CIDR24  Received =~ /(?-xism:\b(?:2(?:1(?:3\.(?:18(?:8\.130|6\.38)|5\.178)|7\.(?:118\.(?:83|90)|66\.146))|0(?:2\.1(?:52\.243|64\.161)|9\.205\.22[45]|3\.82\.95))|8(?:5\.(?:26\.(?:23[234]|164)|115\.248)|(?:7\.106\.1|0\.95\.7)0|1\.192\.2(?:11|38)|3\.149\.(?:38?|21))|1(?:8(?:7\.(?:45\.193|61\.61)|0\.232\.105)|78\.63\.70)|6(?:2\.193\.234|1\.19\.66)|98\.139\.(?:44|91)|74\.50\.95)\.[012]?\d{1,2}\b)/
 describe KHOP_SC_TOP_CIDR24  Relay CIDR /24 leads SpamCop in worst /24s
 tflags	 KHOP_SC_TOP_CIDR24  nopublish
 score	 KHOP_SC_TOP_CIDR24  2.7 0.5 2.7 0.5
@@ -130,7 +130,7 @@ score	 KHOP_SC_TOP_CIDR24  2.7 0.5 2.7 0
 
 
 # http://www.spamcop.net/w3m?action=hoshame
-header	 KHOP_SC_TOP200  Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:8\.1|9\.2)|0\.253\.4)|30\.154\.215)|2(?:8\.0\.238|4\.89\.3)|5\.163\.212)|3\.(?:25(?:4\.241\.29|1\.61\.2)|68\.35\.110)|8\.(?:106\.26\.(?:45|54)|247\.40\.22)|0\.145\.73\.164|4\.63\.140\.42)|1(?:9\.2(?:00\.3(?:5\.(?:1(?:9[24]|29)|33)|6\.97)|35\.30\.51)|8\.(?:(?:32\.200\.1|97\.252\.2)34|127\.4\.50)|0\.136\.190\.227|1\.90\.134\.210|4\.32\.226\.164|5\.78\.134\.19)|8(?:8\.(?:1(?:38\.32\.142|65\.223\.87)|2(?:14\.36\.189|\.88\.236)|72\.232\.55)|9\.(?:38\.(?:50\.233|86\.19)|62\.60\.211)|7\.(?:45\.193\.1(?:67|74)|61\.61\.169))|7(?:4\.1(?:23\.110\.26|37\.172\.84|42\.10\.193)|8\.(?:18\.129\.49|63\.70\.214)|3\.212\.254\.180)|2(?:8\.121\.191\.(?:2(?:29|44)|18[12]|53)|4\.107\.38\.189|1\.52\.147\.12)|09\.72\.95\.101|30\.94\.222\.48)|2(?:1(?:3\.(?:1(?:8(?:8\.130\.113|6\.38\.38)|71\.218\.196)|5(?:\.178\.5[0345678]|9\.176\.86)|251\.135\.152)|2\.(?:1(?:19\.184\.94|99\.29\.145)|232\.70\.228|67\.198\.233)|7\.19(?:5\.180\
 .130|9\.218\.172)|1\.(?:202\.2\.178|147\.3\.74)|6\.55\.139\.104|8\.248\.44\.196|9\.94\.155\.142)|0(?:0\.(?:(?:98\.246\.22|80\.13\.6)6|219\.245\.41)|2\.(?:125\.33\.114|55\.183\.171|71\.102\.178)|5\.(?:186\.165\.32|209\.97\.171)|7\.(?:253\.227\.202|57\.124\.67)|8\.(?:87\.242\.130|43\.232\.34)|1\.55\.165\.134)|2(?:2\.252\.223\.2|1\.2\.231\.58))|8(?:9\.(?:1(?:0(?:8\.(?:111\.110|76\.243)|4\.72\.14)|61\.(?:227\.171|154\.17)|22\.203\.136)|2(?:49\.48\.3[12]|28\.195\.196|08\.41\.167)|77\.122\.39)|7\.(?:106\.(?:1(?:0(?:1\.154|\.20)|76\.124)|9(?:0\.108|4\.73)|206\.106|75\.39)|2(?:19\.204\.105|42\.72\.180|33\.12\.82))|2\.(?:1(?:9(?:3\.140\.168|4\.68\.100)|78\.192\.244|65\.27\.42|40\.81\.3)|200\.25\.150)|3\.(?:1(?:42\.111\.228|69\.42\.27)|98\.163\.87)|8\.(?:255\.153\.106|198\.7\.58)|6\.1(?:07\.184\.148|10\.94\.3)|0\.(?:95\.70\.173|65\.16\.71)|1\.1(?:3\.72\.148|77\.22\.81))|9(?:2\.(?:24(?:3\.17\.(?:147|221)|5\.188\.135)|8(?:5\.231\.89|7\.192\.98)|38\.229\.70|48\.68\.24)|3\.(?:1(?:86\.119\
 .109|57\.0\.2)|91\.(?:196\.99|49\.15)|75\.194\.231)|1\.(?:1(?:21\.9(?:2\.175|9\.104)|49\.157\.37)|204\.116\.115)|5\.1(?:6(?:6\.102\.145|8\.175\.39)|42\.161\.107|9\.0\.25)|4\.(?:23\.(?:200\.54|14\.32)|73\.36\.237)|0\.(?:156\.149\.184|80\.128\.139))|7(?:4\.(?:8(?:6\.(?:158\.2|92\.44)|2\.196\.209)|5(?:4\.138\.74|0\.95\.10)|201\.15\.[24])|9\.(?:1(?:37\.226\.72|74\.78\.194)|9(?:6\.48\.103|9\.24\.110))|7\.2(?:3(?:(?:9\.64\.5|2\.83\.)2|6\.164\.31)|23\.132\.158)|2\.(?:47\.203\.228|55\.165\.169)|8\.(?:96\.144\.162|47\.172\.3)|0\.32\.73\.76|6\.12\.19\.4)|6(?:2\.(?:1(?:40\.2(?:47\.94|53\.15)|93\.2(?:47\.34|34\.9)|29\.200\.133)|75\.1(?:93\.1(?:57|68)|62\.110))|9\.(?:6(?:4\.155\.181|7\.29\.34)|36\.13\.22)|7\.(?:228\.(?:134\.50|88\.28)|15\.97\.82)|4\.(?:187\.104\.9|34\.131\.23)5|6\.109\.109\.161|1\.19\.251\.68|8\.114\.212\.4)|4(?:1\.137\.(?:24|30|56)\.4|6\.182\.176\.60)|58\.150\.55\.59)\b)/
+header	 KHOP_SC_TOP200  Received =~ /(?-xism:\b(?:1(?:9(?:5\.(?:1(?:6(?:1\.(?:8\.1|9\.2)|0\.253\.4)|30\.154\.215)|2(?:8\.0\.238|4\.89\.3)|5\.163\.212)|3\.(?:25(?:4\.241\.29|1\.61\.2)|68\.35\.110)|8\.(?:106\.26\.(?:45|54)|247\.40\.22)|0\.145\.73\.164|4\.63\.140\.42)|1(?:9\.2(?:00\.35\.(?:1(?:9[24]|29)|33)|35\.30\.51)|8\.(?:(?:32\.200\.1|97\.252\.2)34|127\.4\.50)|1\.90\.134\.210|4\.32\.226\.164|0\.136\.158\.5|5\.78\.134\.19)|8(?:8\.(?:1(?:38\.32\.142|65\.223\.87)|2(?:14\.36\.189|\.88\.236)|72\.232\.55)|9\.(?:38\.(?:50\.233|86\.19)|62\.60\.211)|7\.(?:45\.193\.1(?:67|74)|61\.61\.169))|7(?:4\.1(?:23\.110\.26|37\.172\.84|42\.10\.193)|8\.(?:18\.129\.49|63\.70\.214)|3\.212\.254\.180)|28\.121\.191\.(?:2(?:29|44)|18[12]|53)|09\.72\.95\.101|30\.94\.222\.48)|8(?:9\.(?:1(?:0(?:8\.(?:111\.110|76\.243)|4\.72\.14)|61\.(?:1(?:54\.17|89\.62)|227\.171)|22\.203\.136|57\.171\.73)|2(?:0(?:8\.41\.167|5\.58\.69)|49\.48\.3[12]|28\.195\.196)|77\.122\.39)|7\.(?:106\.(?:1(?:0(?:1\.154|\.20)|76\.124)|9(
 ?:0\.108|4\.73)|206\.106|75\.39)|2(?:19\.204\.105|42\.72\.180|33\.12\.82))|2\.(?:1(?:9(?:3\.140\.168|4\.68\.100)|78\.192\.244|65\.27\.42|40\.81\.3)|200\.25\.150)|3\.(?:1(?:42\.111\.228|69\.42\.27)|98\.163\.87)|1\.(?:1(?:3\.72\.148|77\.22\.81)|203\.188\.38)|8\.(?:255\.153\.106|198\.7\.58)|6\.1(?:07\.184\.148|10\.94\.3)|0\.(?:95\.70\.173|65\.16\.71)|5\.222\.67\.35)|2(?:1(?:3\.(?:5(?:\.178\.(?:5[034568]|48)|9\.176\.86)|18(?:8\.130\.113|6\.38\.38)|251\.135\.152)|2\.(?:1(?:19\.184\.94|99\.29\.145)|232\.70\.228|67\.198\.233)|7\.1(?:9(?:5\.180\.130|9\.218\.172)|56\.58\.96)|1\.(?:202\.2\.178|147\.3\.74)|6\.55\.139\.104|8\.248\.44\.196|9\.94\.155\.142|0\.92\.62\.229)|0(?:2\.(?:125\.33\.114|215\.67\.115|55\.183\.171|71\.102\.178)|0\.(?:(?:98\.246\.22|80\.13\.6)6|219\.245\.41)|5\.(?:186\.165\.32|209\.97\.171)|7\.(?:253\.227\.202|57\.124\.67)|8\.(?:87\.242\.130|43\.232\.34)|1\.55\.165\.134)|22\.(?:252\.223\.|99\.39\.19)2)|9(?:2\.(?:24(?:3\.17\.(?:147|221)|5\.188\.135)|8(?:5\.231\.89|7\.
 192\.98)|38\.229\.70|48\.68\.24)|1\.(?:1(?:21\.9(?:2\.175|9\.104)|49\.157\.37)|204\.116\.115)|5\.1(?:6(?:6\.102\.145|8\.175\.39)|42\.161\.107|9\.0\.25)|3\.(?:1(?:86\.119\.109|57\.0\.2)|91\.(?:196\.99|49\.15))|4\.(?:23\.(?:200\.54|14\.32)|73\.36\.237)|0\.156\.149\.184)|7(?:4\.(?:8(?:6\.(?:158\.2|92\.44)|2\.196\.209)|5(?:4\.138\.74|0\.95\.10)|201\.15\.2)|9\.(?:1(?:37\.226\.72|74\.78\.194)|9(?:6\.48\.103|9\.24\.110))|7\.2(?:3(?:6\.164\.31|2\.83\.2)|23\.132\.158)|2\.(?:47\.203\.228|55\.165\.169)|8\.(?:96\.144\.162|47\.172\.3)|0\.32\.73\.76|6\.12\.19\.4)|6(?:2\.(?:1(?:40\.2(?:47\.94|53\.15)|93\.2(?:47\.34|34\.9)|29\.200\.133)|75\.1(?:93\.1(?:57|68)|62\.110))|7\.(?:228\.(?:134\.50|88\.28)|15\.97\.82)|4\.(?:187\.104\.9|34\.131\.23)5|9\.(?:64\.155\.181|36\.13\.22)|6\.109\.109\.161|1\.19\.251\.68|8\.114\.212\.4)|4(?:1\.137\.(?:24|30|56)\.4|6\.182\.176\.60)|5(?:9\.13\.159\.181|8\.150\.55\.59))\b)/
 describe KHOP_SC_TOP200  Relay listed in SpamCop top 200 spammer IPs
 tflags	 KHOP_SC_TOP200  nopublish
 score	 KHOP_SC_TOP200  4 0 4 0	# unnecessary if DNSBLs work
@@ -147,14 +147,14 @@ score	 KHOP_SC_TOP200  4 0 4 0	# unneces
 
 
 # Spamhaus DROP, http://www.spamhaus.org/drop/
-header	 KHOP_SPAMHAUS_DROP	X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[01
 23])|98\.1(?:[678]\d|9[01])|20\.163)|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|3\.(?:1(?:0(?:5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|4\.(?:1(?:[47]6|10|2)|[39]4|253|41)|6\.3[2345])|6(?:9\.25[01]|\.100)|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789]|63\.14[4567])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123]
 )))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|09\.94\.21[2345])|2(?:
 0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|5\.(?:2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89]))|1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|36\.(?:1(?:1[01]|0\d)|9[6789])|13\.(?:6[0123]|4[89]|5\d))|7\.18(?:3\.(?:2(?:2[0123]
 |[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:81\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789]|4[01234567]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:153|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|2\.6[4567]|3\.201))|19(?:8\.(?:1(?
 :2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.(?:24[0134567]|146))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]|13|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.98\.1(?:1[23456789]|2[01234567])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8
 \.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.9)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|51\.10[0123]|161\.1[01])|1\.221\.1(?:1[23456789]|2[01234567]))|3\.0\.0\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|58\.83\.(?:[89]|1[012345]))\b)/
+header	 KHOP_SPAMHAUS_DROP	X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[01
 23])|98\.1(?:[678]\d|9[01])|20\.163)|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|3\.(?:1(?:0(?:5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|4\.(?:1(?:[47]6|10|2)|[39]4|253|41)|6\.3[2345])|6(?:9\.25[01]|\.100)|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789]|63\.14[4567])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123]
 )))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|09\.94\.21[2345])|2(?:
 0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|5\.(?:2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89]))|1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|36\.(?:1(?:1[01]|0\d)|9[6789])|13\.(?:6[0123]|4[89]|5\d))|7\.18(?:3\.(?:2(?:2[0123]
 |[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:81\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789]|4[01234567]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:153|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|2\.6[4567]|3\.201))|19(?:8\.(?:1(?
 :2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.(?:24[0134567]|146))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]|13|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.98\.1(?:1[23456789]|2[01234567])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8
 \.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.9)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|51\.10[0123]|161\.1[01])|1\.221\.1(?:1[23456789]|2[01234567]))|3\.0\.0\.(?:[0789]|[12345]\d?|6[0123]?)|58\.83\.(?:[89]|1[012345]))\b)/
 describe KHOP_SPAMHAUS_DROP	Relay listed in Spamhaus Don't Route Or Peer List
 tflags	 KHOP_SPAMHAUS_DROP	nopublish
 score	 KHOP_SPAMHAUS_DROP	1 0.2 1 0.2
 #   spam/ham     s/o   corpus
 # 0.0349/0.0029 0.924  20110227@510k
 
-header	 KHOP_SPAMHAUS_DROP_LE	X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|
 6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|3\.(?:1(?:0(?:5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|4\.(?:1(?:[47]6|10|2)|[39]4|253|41)|6\.3[2345])|6(?:9\.25[01]|\.100)|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789]|63\.14[4567])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]
 |2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|09\.94\.21[234
 5])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|5\.(?:2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89]))|1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|36\.(?:1(?:1[01]|0\d)|9[6789])|13\.(?:6[0123]|4[89]|5\d))|7\.18(?:3\.(?:2(?
 :2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:81\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789]|4[01234567]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:153|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|2\.6[4567]|3\.201))|19(?:8
 \.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.(?:24[0134567]|146))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]|13|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.98\.1(?:1[23456789]|2[01234567])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]
 |8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.9)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|51\.10[0123]|161\.1[01])|1\.221\.1(?:1[23456789]|2[01234567]))|3\.0\.0\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|58\.83\.(?:[89]|1[012345]))\b)/
+header	 KHOP_SPAMHAUS_DROP_LE	X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|
 6\.20[0123])|98\.1(?:[678]\d|9[01])|20\.163)|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|84\.(?:6[456789]|9[012345]|[78]\d)|5\.15[23]|60\.102)|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|\.21[23])|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|3\.(?:1(?:0(?:5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|4\.(?:1(?:[47]6|10|2)|[39]4|253|41)|6\.3[2345])|6(?:9\.25[01]|\.100)|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789]|63\.14[4567])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]
 |2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.(?:2(?:01|22)|51)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|09\.94\.21[234
 5])|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|5\.(?:2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89]))|1(?:4(?:4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22)|9\.2(?:05\.(?:19[23456789]|2[0123]\d)|36\.(?:1(?:1[01]|0\d)|9[6789])|13\.(?:6[0123]|4[89]|5\d))|7\.18(?:3\.(?:2(?
 :2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|8\.(?:81\.1(?:3[6789]|4[0123])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|4(?:9\.(?:[0789]|[12345]\d?|6[0123]?)|7\.(?:3[23456789]|4[01234567]))|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:153|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|2\.6[4567]|3\.201))|19(?:8
 \.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|232\.2(?:5[012345]|4[89])|63\.(?:24[0134567]|146))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:9[89]|13|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|28\.1(?:7[6789]|9[01]|8\d)|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.98\.1(?:1[23456789]|2[01234567])|9\.8\.1(?:7[6789]|9[01]|8\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?)|35\.1(?:[345]\d|2[89]))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]
 |8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|6\.55\.(?:140|243)|1\.22\.15[23]|9\.114\.9)|4(?:6\.(?:252\.1(?:3[0123]|2[89])|51\.10[0123]|161\.1[01])|1\.221\.1(?:1[23456789]|2[01234567]))|3\.0\.0\.(?:[0789]|[12345]\d?|6[0123]?)|58\.83\.(?:[89]|1[012345]))\b)/
 describe KHOP_SPAMHAUS_DROP_LE	Relay listed in Spamhaus Don't Route Or Peer List
 tflags	 KHOP_SPAMHAUS_DROP_LE	nopublish
 score	 KHOP_SPAMHAUS_DROP_LE	2 0 2 0 	# adds to KHOP_SPAMHAUS_DROP
@@ -164,7 +164,7 @@ score	 KHOP_SPAMHAUS_DROP_LE	2 0 2 0 	# 
 
 # PSBL-neighbors:  any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
 # as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header	 KHOP_PSBL_CIDR24	X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.15(?:9\.(?:2(?:1[012356789]|0[01234679]|2[0123])|19[345679])|3\.(?:[0236]|1[1245689]|8[245679]?|9[01357]?)|6\.(?:1[789]|2[37]|34)|5\.2)|3\.(?:1(?:62\.(?:2(?:4[3456]|2[57])|1(?:32|41)|7[47]|[59]6)|0\.16[45])|56\.28)|6\.(?:71\.(?:2(?:1[23469]|2[12]|09)|1(?:4[67]|51)|5)|16\.99)|4\.112\.2(?:4[579]|51))|8(?:3\.93\.[01235]|0\.149\.8)|9(?:6\.202\.214|5\.91\.70)|25\.23(?:4\.144|5\.192))|2(?:1(?:3\.(?:87\.(?:1(?:14|28|36)|8[789]|9[012]|74)|(?:108\.17|226\.6)3)|7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|8\.(?:104\.156|248\.64))|0(?:(?:1\.191\.1|3\.82\.)95|2\.1(?:52\.243|64\.161)|0\.85\.24))|8(?:5\.(?:26\.(?:1(?:6[45]|8[46]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:[89]|4[4567]|3[68]?|2[18])|1\.192\.(?:2(?:1[15]|38)|199)|2\.1(?:28\.62|78\.69)|0\.83\.23[89]|9\.204\.153)|41\.(?:95\.(?:[48]|1[02])|202\.19[2567]|199\.113|59\.0)|61\.19\.6[56])\.[012]?\d{1,2}\b)/
+header	 KHOP_PSBL_CIDR24	X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:9\.(?:15(?:9\.(?:2(?:0[01234679]|1[01235789]|2[0123])|19[345679])|3\.(?:[02367]|1[12345689]|8[1245679]?|9[01357]?)|6\.(?:1[789]|27)|5\.(?:[27]|36))|30\.96)|6\.(?:71\.(?:2(?:[79]|1[23456789]|0[89]|2[12])|1(?:5[01]?|4[67]|0)|52)|16\.99)|3\.(?:1(?:62\.(?:2(?:4[3456]|2[57]|3[48])|[59]6|141|74)|0\.16[45])|56\.28)|4\.112\.2(?:4[79]|51))|8(?:3\.93\.[01235]|0\.149\.8)|9(?:6\.202\.214|5\.91\.70)|25\.23(?:4\.144|5\.192)|78\.49\.255)|8(?:5\.(?:26\.(?:1(?:6[45]|8[46]|55)|2(?:3[2345]|41))|115\.248)|3\.149\.(?:[89]|4[4567]|3[68]?|21)|2\.1(?:28\.(?:5[45]|62)|78\.69)|1\.192\.(?:2(?:1[15]|38)|199)|0\.83\.23[89]|9\.204\.153)|2(?:1(?:7\.(?:118\.(?:83|90)|8\.2(?:25|36)|66\.146)|3\.87\.(?:1(?:14|28|36)|8[789]|9[012]|74)|8\.(?:104\.156|248\.64))|0(?:(?:1\.191\.1|3\.82\.)95|2\.1(?:52\.243|64\.161)|0\.85\.24))|41\.(?:202\.(?:19[256]|202)|95\.(?:[48]|12)|199\.113|59\.0)|61\.19\.6[567])\.[012]?\d{1,2}\b)/
 describe KHOP_PSBL_CIDR24	Relay's IP/24 CIDR contains many PSBL hits
 tflags	 KHOP_PSBL_CIDR24	nopublish
 score	 KHOP_PSBL_CIDR24	2 0.6 2 0.6



Mime
View raw message