spamassassin-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From khop...@apache.org
Subject svn commit: r1125866 - /spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Date Sun, 22 May 2011 05:57:19 GMT
Author: khopesh
Date: Sun May 22 05:57:19 2011
New Revision: 1125866

URL: http://svn.apache.org/viewvc?rev=1125866&view=rev
Log:
auto-generated rules

Modified:
    spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf

Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1125866&r1=1125865&r2=1125866&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Sun May 22 05:57:19
2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf	v 201105211
+## khop-sc-neighbors.cf	v 201105221
 ## Khopesh's syndication of SpamCop's top offenders and top offending networks.
 ## 
 ## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
 
 # http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
 # Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8  X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:8[79]|22)|95)(?:\.[012]?\d{1,2}){3}\b)
/
+header __KHOP_SC_CIDR8  X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:18[79]|59|95)(?:\.[012]?\d{1,2}){3}\b)
/
 # and gets cleaned up a bit
 meta	 KHOP_SC_CIDR8	__KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
 describe KHOP_SC_CIDR8  Relay CIDR /8 is among worst in SpamCop
@@ -93,7 +93,7 @@ score	 KHOP_SC_TOP_CIDR16  2.0 0.3 2.0 0
 
 
 # http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header	 KHOP_SC_CIDR24  Received =~ /(?-xism:\b(?:1(?:2(?:4\.(?:6\.181|7\.20)|1\.183\.117)|74\.142\.241|19\.82\.65)|2(?:1(?:3\.2(?:29\.110|33\.64)|7\.118\.81)|00\.108\.108)|7(?:7\.2(?:32\.142|46\.145)|8\.129\.128|9\.124\.92)|98\.139\.91|46\.175\.8|83\.149\.3)\.[012]?\d{1,2}\b)/
+header	 KHOP_SC_CIDR24  Received =~ /(?-xism:\b(?:2(?:1(?:3\.2(?:29\.110|33\.64)|7\.118\.81|8\.159\.75)|00\.108\.108)|1(?:(?:74\.142\.24|24\.6\.18)1|80\.232\.104|19\.82\.65)|7(?:(?:7\.232\.14|9\.124\.9)2|8\.129\.128)|9(?:5\.154\.217|8\.139\.91)|64\.187\.122|46\.175\.8)\.[012]?\d{1,2}\b)/
 describe KHOP_SC_CIDR24  Relay CIDR /24 is among worst in SpamCop
 tflags	 KHOP_SC_CIDR24  nopublish
 score	 KHOP_SC_CIDR24  0.1 0 0.1 0
@@ -112,7 +112,7 @@ score	 KHOP_SC_CIDR24  0.1 0 0.1 0
 # 0.4157/0.5009 0.454 20110227  something is wrong here! -> .1 0 .1 0
 
 
-header	 KHOP_SC_TOP_CIDR24  Received =~ /(?-xism:\b(?:1(?:1(?:8\.4(?:1\.208|5\.115)|9\.202\.150)|80\.232\.10[34]|21\.151\.140|09\.75\.162|4\.45\.205)|2(?:1(?:7\.(?:118\.(?:83|90)|66\.146)|(?:3\.87\.7|6\.81\.6)4|8\.159\.75)|03\.82\.95)|8(?:5\.(?:26\.(?:1(?:6[45]|8[46])|2(?:3[14]|41))|115\.248)|3\.149\.(?:38?|21))|6(?:4\.187\.122|1\.19\.66))\.[012]?\d{1,2}\b)/
+header	 KHOP_SC_TOP_CIDR24  Received =~ /(?-xism:\b(?:1(?:1(?:8\.4(?:1\.208|5\.115)|9\.202\.150)|7(?:3\.245\.204|8\.162\.160)|21\.151\.140|80\.232\.104|09\.75\.162|4\.45\.205)|8(?:5\.26\.(?:16[45]|2[34]1)|3\.149\.(?:38?|21))|21(?:7\.118\.(?:83|90)|3\.229\.109|6\.81\.64)|92\.48\.74)\.[012]?\d{1,2}\b)/
 describe KHOP_SC_TOP_CIDR24  Relay CIDR /24 leads SpamCop in worst /24s
 tflags	 KHOP_SC_TOP_CIDR24  nopublish
 score	 KHOP_SC_TOP_CIDR24  2.7 0.5 2.7 0.5
@@ -130,7 +130,7 @@ score	 KHOP_SC_TOP_CIDR24  2.7 0.5 2.7 0
 
 
 # http://www.spamcop.net/w3m?action=hoshame
-header	 KHOP_SC_TOP200  Received =~ /(?-xism:\b(?:1(?:1(?:9\.(?:2(?:0(?:2\.(?:150\.9[02]|70\.45)|6\.166\.22)|35\.30\.51)|19(?:9\.(?:169\.235|200\.147)|5\.46\.119)|82\.65\.199)|8\.(?:4(?:5\.(?:115\.1(?:7[78]|[36]3|42)|228\.60)|1\.208\.174)|23(?:3\.172\.244|2\.201\.35))|5\.(?:2(?:3\.(?:73\.156|87\.195)|2\.125\.210)|145\.25\.201|93\.199\.242)|3\.(?:162\.217\.84|59\.153\.29)|4\.(?:40\.196\.219|36\.19\.41))|2(?:1\.(?:1(?:8(?:3\.117\.2[04]|0\.50\.96)|7(?:5\.126\.60|9\.85\.66)|47\.197\.153|51\.140\.194)|243\.204\.229|50\.16\.11)|2\.(?:1(?:78\.242\.197|21\.7\.95)|55\.106\.4)|4\.(?:1(?:07\.251\.17|24\.16\.74)|7\.20\.77)|5\.(?:136\.39\.115|230\.77\.49)|3\.237\.80\.76)|9(?:5\.(?:2(?:18\.149\.230|50\.70\.156|30\.96\.4)|49\.205\.28|161\.9\.2)|3\.(?:(?:252\.221\.24|17\.253\.)7|58\.246\.2)|0\.(?:246\.(?:186\.23|231\.21)3|80\.239\.92)|4\.65\.228\.124)|7(?:8\.(?:1(?:40\.(?:160\.100|60\.151)|62\.160\.92)|76\.222\.70)|5\.1(?:81\.253\.126|99\.32\.198)|3\.208\.102\.131|4\.142\.241\.134)|8(?:8\.(
 ?:95\.185\.186|241\.66\.68)|6\.207\.149\.137|2\.71\.45\.230)|09\.(?:7(?:5\.162\.18[26]|0\.184\.22)|87\.115\.124|203\.97\.48)|4\.(?:4(?:5\.(?:205\.132|168\.89)|8\.94\.108)|201\.69\.96)|65\.98\.135\.166|\.230\.123\.125)|8(?:7\.(?:2(?:2(?:4\.(?:180\.241|218\.62)|8\.(?:122\.108|28\.227)|9\.179\.179)|07\.18(?:0\.10|9\.62))|1(?:06\.81\.103|17\.255\.75|26\.201\.86))|9\.(?:1(?:0(?:0\.168\.125|5\.158\.103)|8(?:9\.169\.77|4\.1\.232)|69\.85\.238|12\.8\.40)|216\.180\.252)|5\.(?:1(?:98\.186\.234|30\.18\.223)|222\.22\.208)|4\.(?:2(?:04\.148\.123|2\.8\.137)|53\.196\.245)|1\.24(?:1\.238\.209|\.208\.184)|3\.(?:239\.39\.166|16\.167\.14)|8\.(?:135\.86\.210|204\.14\.3)|0\.90\.171\.122|2\.207\.32\.239|6\.110\.94\.3)|9(?:1\.(?:1(?:9(?:1\.235\.46|5\.230\.14|7\.184\.18|4\.10\.30)|4(?:4\.186\.138|0\.255\.82)|86\.25\.83)|2(?:0(?:1\.244\.103|3\.67\.46)|14\.83\.2))|2\.(?:48\.(?:1(?:05\.206|24\.34)|74\.(?:30|56))|246\.195\.49|39\.215\.145|60\.188\.66)|4\.(?:1(?:5(?:3\.232\.178|9\.138\.175)|78\.178\.213)
 |76\.213\.224|232\.13\.20)|3\.(?:1(?:90\.1(?:07\.236|76\.103)|57\.148\.102)|95\.43\.240|73\.16\.63)|5\.(?:1(?:54\.217\.244|91\.153\.7)|64\.81\.158|83\.172\.73)|0\.189\.168\.214)|2(?:1(?:3\.(?:229\.(?:1(?:0(?:9\.225|4\.79)|10\.74)|93\.211)|1(?:77\.100\.235|42\.200\.58))|8\.(?:2(?:12\.58\.137|48\.44\.196)|159\.75\.20)|1\.(?:1(?:52\.51\.62|95\.16\.86)|76\.89\.125)|9\.(?:8(?:4\.124\.7|5\.232\.5)|147\.19\.50)|6\.81\.64\.1[09]|0\.219\.245\.97|2\.66\.32\.94)|2(?:0\.(?:(?:80\.173\.5|71\.140\.)2|131\.(?:24\.170|1\.223))|2\.164\.67\.31)|02\.(?:1(?:64\.49\.210|73\.45\.146)|55\.191\.22))|7(?:7\.(?:1(?:0(?:6\.232\.178|8\.98\.177)|21\.83\.180)|2(?:23\.132\.158|46\.145\.89)|66\.192\.37)|9\.1(?:7(?:2\.15\.237|4\.67\.113|6\.108\.59)|24\.92\.164|39\.21\.248)|8\.129\.1(?:28\.215|68\.234))|6(?:1\.(?:(?:19\.251\.6|8\.203\.5)8|217\.232\.201)|4\.187\.12(?:2\.(?:5[09]|49|61)|6\.195)|6\.197\.244\.25|9\.46\.65\.29)|4(?:6\.(?:181\.199\.135|252\.33\.222)|1\.137\.(?:24|30|56)\.4)|59\.3\.242\.136)\b)/
+header	 KHOP_SC_TOP200  Received =~ /(?-xism:\b(?:1(?:1(?:9\.(?:2(?:0(?:2\.(?:150\.9[02]|70\.45)|6\.166\.22)|35\.30\.51)|19(?:9\.(?:169\.235|200\.147)|5\.46\.119)|82\.65\.199)|8\.(?:4(?:5\.(?:115\.1(?:7[78]|[36]3|42)|228\.60)|1\.208\.174)|23(?:3\.172\.244|2\.201\.35))|5\.(?:2(?:3\.(?:73\.156|87\.195)|2\.125\.210)|1(?:24\.110\.232|45\.25\.201))|2\.16(?:3\.126\.127|2\.103\.38)|4\.(?:40\.196\.219|36\.19\.41)|3\.162\.217\.84|1\.243\.5\.35)|2(?:1\.(?:1(?:8(?:3\.117\.2[04]|0\.50\.96)|47\.197\.153|51\.140\.194|79\.85\.66)|243\.204\.229|50\.16\.11)|5\.13(?:5\.197\.228|6\.39\.115)|2\.(?:248\.11\.5|55\.106\.)4|4\.(?:107\.251\.1|7\.20\.7)7|3\.237\.80\.76)|9(?:0\.(?:(?:246\.(?:186\.23|231\.21)|18\.127\.3)3|65\.180\.29|80\.239\.92)|5\.(?:2(?:18\.149\.230|50\.70\.156)|49\.205\.28|161\.9\.2)|3\.(?:34\.173\.250|17\.253\.7|58\.246\.2)|4\.65\.228\.124)|7(?:8\.(?:1(?:40\.(?:160\.100|60\.151)|62\.160\.92|78\.44\.246)|76\.222\.70)|5\.1(?:81\.253\.126|99\.32\.198)|3\.208\.102\.131|4\.142\.241\.13
 4)|8(?:(?:6\.82\.120\.4|8\.241\.66\.6)8|7\.92\.208\.114|2\.71\.45\.230|9\.75\.14\.186)|09\.(?:7(?:5\.162\.18[26]|0\.184\.22)|87\.115\.124|203\.97\.48)|4\.4(?:5\.(?:205\.132|168\.89)|8\.94\.108)|65\.98\.135\.166|\.230\.123\.125)|2(?:1(?:3\.(?:229\.(?:1(?:0(?:9\.225|4\.79)|10\.74)|83\.157|93\.211)|1(?:77\.100\.235|42\.200\.58|68\.47\.100))|1\.(?:2(?:26\.179\.152|32\.209\.34)|1(?:52\.51\.62|95\.16\.86)|76\.89\.125)|9\.(?:8(?:4\.124\.7|5\.232\.5)|147\.19\.50)|8\.(?:212\.58\.137|159\.75\.20)|2\.(?:34\.61\.5|66\.32\.9)4|6\.81\.64\.1[09]|0\.219\.245\.97)|2(?:0\.(?:13(?:1\.24\.170|6\.21\.112)|(?:80\.173\.5|71\.140\.)2)|2\.1(?:02\.14(?:4\.18|5\.45)|64\.67\.31))|0(?:2\.(?:173\.45\.146|55\.191\.22)|4\.202\.23\.119|0\.46\.186\.82))|8(?:7\.(?:2(?:2(?:8\.(?:122\.108|28\.227)|4\.180\.241)|07\.18(?:0\.10|9\.62)|50\.116\.4)|1(?:06\.81\.103|17\.255\.75))|9\.(?:1(?:0(?:0\.168\.125|5\.158\.103)|8(?:9\.169\.77|4\.1\.232)|69\.85\.238|12\.8\.40)|216\.180\.252)|5\.1(?:0\.19(?:3\.107|6\.11)|98\.186\
 .234|30\.18\.223)|4\.(?:2(?:04\.148\.123|2\.8\.137)|53\.196\.245)|3\.(?:239\.39\.166|16\.167\.14)|8\.(?:135\.86\.210|204\.14\.3)|0\.90\.171\.122|1\.24\.208\.184|2\.207\.32\.239|6\.110\.94\.3)|9(?:1\.(?:1(?:9(?:1\.235\.46|5\.230\.14|7\.184\.18|4\.10\.30)|8(?:6\.25\.83|7\.92\.52)|44\.186\.138)|2(?:0(?:1\.244\.103|3\.67\.46)|14\.83\.2))|4\.(?:1(?:5(?:3\.232\.178|9\.138\.175)|78\.178\.213)|76\.213\.224|232\.13\.20)|3\.(?:1(?:57\.148\.102|90\.107\.236)|95\.43\.240|73\.16\.63)|5\.(?:1(?:54\.217\.244|91\.153\.7)|64\.81\.158|83\.172\.73)|2\.(?:48\.(?:105\.20|74\.5)6|246\.195\.49)|0\.189\.168\.214)|7(?:7\.(?:1(?:06\.232\.178|21\.83\.180)|2(?:23\.132\.158|46\.145\.89)|66\.192\.37)|9\.1(?:2(?:6\.227\.177|4\.92\.164)|7(?:2\.15\.237|4\.67\.113))|8\.1(?:29\.1(?:28\.215|68\.234)|11\.176\.6))|6(?:1\.(?:2(?:17\.232\.20|30\.2\.25)1|(?:19\.251\.6|8\.203\.5)8)|4\.187\.122\.(?:5[09]|49|61)|9\.46\.65\.29)|4(?:6\.(?:181\.199\.135|252\.33\.222)|1\.137\.(?:24|30|56)\.4)|59\.(?:105\.25\.95|3\.242\.13
 6))\b)/
 describe KHOP_SC_TOP200  Relay listed in SpamCop top 200 spammer IPs
 tflags	 KHOP_SC_TOP200  nopublish
 score	 KHOP_SC_TOP200  4 0 4 0	# unnecessary if DNSBLs work
@@ -147,14 +147,14 @@ score	 KHOP_SC_TOP200  4 0 4 0	# unneces
 
 
 # Spamhaus DROP, http://www.spamhaus.org/drop/
-header	 KHOP_SPAMHAUS_DROP	X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|62\.(?:1(?:4[0123]|2[89]|3\d)|2(?:2[0123]|0[89]|1\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145
 )|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|
 4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9
 [01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:7[25]|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|09\.(?:94\.21[2345]|196\.140))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[4
 56789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:1(?:45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|2
 47\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:5[01]|46)|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:1[013]|9[89]?|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\
 d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|9\.(?:114\.97?|45\.14)|6\.55\.(?:140|243)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|29)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|5(?:8\.83\.(?:[89]|1[012345])|\.0\.[01234567]))\b)/
+header	 KHOP_SPAMHAUS_DROP	X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|62\.(?:1(?:4[0123]|2[89]|3\d)|2(?:2[0123]|0[89]|1\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145
 )|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|
 4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9
 [01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:7[25]|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|09\.(?:94\.21[2345]|196\.140))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[4
 56789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:1(?:45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|2
 47\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:5[01]|46)|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:1[013]|9[89]?|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\
 d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|9\.(?:114\.97?|45\.14)|6\.55\.(?:140|243)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|29)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|5(?:8\.83\.(?:[89]|1[012345])|\.0\.[0123]))\b)/
 describe KHOP_SPAMHAUS_DROP	Relay listed in Spamhaus Don't Route Or Peer List
 tflags	 KHOP_SPAMHAUS_DROP	nopublish
 score	 KHOP_SPAMHAUS_DROP	1 0.2 1 0.2
 #   spam/ham     s/o   corpus
 # 0.0349/0.0029 0.924  20110227@510k
 
-header	 KHOP_SPAMHAUS_DROP_LE	X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|62\.(?:1(?:4[0123]|2[89]|3\d)|2(?:2[0123]|0[89]|1\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01]
 )|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.
 8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[
 678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:7[25]|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|09\.(?:94\.21[2345]|196\.140))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01
 ]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:1(?:45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[
 6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:5[01]|46)|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:1[013]|9[89]?|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012
 345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|9\.(?:114\.97?|45\.14)|6\.55\.(?:140|243)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|29)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|5(?:8\.83\.(?:[89]|1[012345])|\.0\.[01234567]))\b)/
+header	 KHOP_SPAMHAUS_DROP_LE	X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|62\.(?:1(?:4[0123]|2[89]|3\d)|2(?:2[0123]|0[89]|1\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|5\.138|6\.215)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01]
 )|3\.145)|46\.(?:3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:4\.(?:1(?:[47]6|10|2)|2(?:2[4567]|53)|[39]4|41)|5\.(?:1(?:[24]1|[78]4|32)|2(?:07|45))|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:2(?:2(?:6\.(?:197|220)|5\.17[6789])|3(?:4\.159|8\.242)|8\.1[01]|\.21[23])|1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|8(?:8\.(?:1(?:4[45]|9[01])|22[67])|0\.1(?:4[89]|5[01])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.
 8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|47\.58)|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.(?:1\.1(?:7[6789]|9[01]|8\d)|32\.2(?:1[6789]|2[0123])))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|3\.20\.1(?:[678]\d|9[01]))|6(?:9\.131\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89]))|7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20)|[27]5|67)|4\.138\.1(?:4[456789]|5\d))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|88\.(?:2(?:29\.(?:9[012345]|[45678]\d|1[36789]|2[0123]|35)|12\.(?:[023456789]|1[012345]?))|1(?:70\.19[23456789]|30\.25[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[
 678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|0\.170)|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|3(?:4\.(?:1(?:7[25]|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|09\.(?:94\.21[2345]|196\.140))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45])|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01]))|48\.(?:6[456789]|9[012345]|[78]\d)|63\.1(?:4[456789]|5[01])|52\.255|89\.224)|5\.(?:1(?:4(?:5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|4\.(?:[023456789]|1[012345]?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567]))|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01
 ]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|9\.(?:1(?:45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567]|64\.20[0123])|1\.71\.(?:[023456789]|1[012345]?)|3\.3(?:1\.8[89]|4\.7[01])|2\.(?:59\.236|61\.127))|1(?:6\.(?:2(?:45\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|12\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|151\.(?:19[23456789]|20[01234567])|49\.(?:[0789]|[12345]\d?|6[0123]?))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[
 6789])|247\.(?:[0456789]|[12]\d?|3[01]?))|8\.75\.1(?:[345]\d|2[89])))|9(?:1\.(?:2(?:0(?:1\.(?:[4567]|1(?:2[4567]|9[6789])|2(?:1[2345]|3[6789]))|0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:2[37]|3[25]|07|63|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:21|57|74)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22)|232|7?3)|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:(?:11|9)0|62)|3\.201))|19(?:8\.(?:1(?:2[57]|09)|217)|(?:3\.19|6\.23)[2345]|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|3[01])|63\.(?:1(?:5[01]|46)|24[0134567])|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89])|88\.16[01234567])|5\.(?:21(?:[67]|5\.1(?:4[0123]|9[2345]))|64\.(?:1[013]|9[89]?|59|61)))|6(?:4\.(?:1(?:12\.(?:1(?:[012
 345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|2(?:50\.(?:1(?:1[01]|0\d)|9[6789])|8\.1(?:7[6789]|9[01]|8\d))|44)|7\.21(?:0\.(?:[023456789]|1[012345]?)|[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01])|5\.98\.(?:[89]|1[012345]))|8(?:5\.2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|9\.(?:114\.97?|45\.14)|6\.55\.(?:140|243)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.(?:1[01]|29)|51\.10[0123])|1\.221\.1(?:1[23456789]|2[01234567]))|5(?:8\.83\.(?:[89]|1[012345])|\.0\.[0123]))\b)/
 describe KHOP_SPAMHAUS_DROP_LE	Relay listed in Spamhaus Don't Route Or Peer List
 tflags	 KHOP_SPAMHAUS_DROP_LE	nopublish
 score	 KHOP_SPAMHAUS_DROP_LE	2 0 2 0 	# adds to KHOP_SPAMHAUS_DROP
@@ -164,7 +164,7 @@ score	 KHOP_SPAMHAUS_DROP_LE	2 0 2 0 	# 
 
 # PSBL-neighbors:  any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
 # as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header	 KHOP_PSBL_CIDR24	X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:2(?:1(?:3\.87\.(?:1(?:2[89]|3[67]|14|41)|74)|7\.(?:118\.(?:83|90)|66\.146|8\.225))|0(?:2\.152\.243|3\.82\.95)|23\.252\.16[013])|8(?:5\.(?:26\.(?:1(?:6[45]|8[46])|2(?:3[1345]|41))|115\.248)|3\.149\.(?:4[4567]|3[68]?|21)|0\.83\.238)|1(?:1(?:3\.10\.16[2345679]|4\.112\.22[456789])|25\.23(?:4\.144|5\.192)|80\.232\.10[34]|01\.79\.50)|58\.64\.194|61\.19\.66)\.[012]?\d{1,2}\b)/
+header	 KHOP_PSBL_CIDR24	X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:2(?:1(?:7\.(?:118\.(?:83|90)|66\.146|8\.225)|3\.87\.(?:1(?:2[89]|3[67])|74))|0(?:2\.152\.243|3\.82\.95)|23\.252\.16[013])|1(?:1(?:3\.10\.16[2345679]|4\.112\.22[456789])|25\.23(?:4\.144|5\.192)|80\.232\.10[34]|01\.79\.50)|8(?:5\.(?:26\.(?:1(?:6[45]|8[46])|2(?:3[1345]|41))|115\.248)|3\.149\.(?:4[4567]|3[68]?|21))|58\.64\.194|61\.19\.66)\.[012]?\d{1,2}\b)/
 describe KHOP_PSBL_CIDR24	Relay's IP/24 CIDR contains many PSBL hits
 tflags	 KHOP_PSBL_CIDR24	nopublish
 score	 KHOP_PSBL_CIDR24	2 0.6 2 0.6



Mime
View raw message