spamassassin-commits mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From khop...@apache.org
Subject svn commit: r1203508 - /spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Date Fri, 18 Nov 2011 06:57:12 GMT
Author: khopesh
Date: Fri Nov 18 06:57:12 2011
New Revision: 1203508

URL: http://svn.apache.org/viewvc?rev=1203508&view=rev
Log:
auto-generated rules

Modified:
    spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf

Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=1203508&r1=1203507&r2=1203508&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Fri Nov 18 06:57:12
2011
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf	v 201111171
+## khop-sc-neighbors.cf	v 201111181
 ## Khopesh's syndication of SpamCop's top offenders and top offending networks.
 ## 
 ## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
 
 # http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
 # Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8  X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:13|22|90)|41)(?:\.[012]?\d{1,2}){3}\b)
/
+header __KHOP_SC_CIDR8  X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:13|22|80)|41)(?:\.[012]?\d{1,2}){3}\b)
/
 # and gets cleaned up a bit
 meta	 KHOP_SC_CIDR8	__KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
 describe KHOP_SC_CIDR8  Relay CIDR /8 is among worst in SpamCop
@@ -40,7 +40,7 @@ score	 KHOP_SC_CIDR8	0.3 0.1 0.3 0.1
 # 12.1449/0.0139 0.999 20100410  net, solo=12.1966/0.0197@0.998, ->.2 .1 .3 .2
 # 10.3554/0.0112 0.999 20110227@510k  solo=10.3717/0.0119@0.999, ->.3 .1 .3 .1
 
-header __KHOP_SC_TOP_CIDR8  X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b1(?:8[02]|17|78)(?:\.[012]?\d{1,2}){3}\b)
/
+header __KHOP_SC_TOP_CIDR8  X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b1(?:17|78|82|90)(?:\.[012]?\d{1,2}){3}\b)
/
 meta	 KHOP_SC_TOP_CIDR8  __KHOP_SC_TOP_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
 describe KHOP_SC_TOP_CIDR8  Relay CIDR /8 leads SpamCop in worst /8s
 tflags	 KHOP_SC_TOP_CIDR8  nopublish
@@ -93,7 +93,7 @@ score	 KHOP_SC_TOP_CIDR16  2.0 0.3 2.0 0
 
 
 # http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header	 KHOP_SC_CIDR24  Received =~ /(?-xism:\b(?:1(?:25\.110\.1(?:1[17]|[02]7)|92\.217\.122|12\.149\.78)|2(?:1(?:3\.233\.64|7\.118\.81)|23\.255\.226)|83\.149\.[23]|60\.190\.223|75\.75\.239|98\.139\.91)\.[012]?\d{1,2}\b)/
+header	 KHOP_SC_CIDR24  Received =~ /(?-xism:\b(?:1(?:25\.110\.1(?:0[27]|1[79])|80\.232\.193|92\.217\.122|12\.149\.78)|2(?:1(?:3\.233\.64|7\.118\.81)|23\.255\.226)|60\.190\.223|75\.75\.239|98\.139\.91|83\.149\.2)\.[012]?\d{1,2}\b)/
 describe KHOP_SC_CIDR24  Relay CIDR /24 is among worst in SpamCop
 tflags	 KHOP_SC_CIDR24  nopublish
 score	 KHOP_SC_CIDR24  0.1 0 0.1 0
@@ -112,7 +112,7 @@ score	 KHOP_SC_CIDR24  0.1 0 0.1 0
 # 0.4157/0.5009 0.454 20110227  something is wrong here! -> .1 0 .1 0
 
 
-header	 KHOP_SC_TOP_CIDR24  Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[46])|2(?:3[1235]|41))|115\.248)|3\.149\.(?:4[67]|38?|21))|1(?:25\.110\.(?:1(?:2[013]|0[46]|1[29])|9[678])|14\.112\.224|09\.127\.86)|2(?:0(?:2\.152\.243|5\.185\.214)|17\.118\.(?:8[13]|90)|7\.100\.31)|41\.254\.1|92\.42\.55)\.[012]?\d{1,2}\b)/
+header	 KHOP_SC_TOP_CIDR24  Received =~ /(?-xism:\b(?:8(?:5\.(?:26\.(?:1(?:6[45]|8[46])|2(?:3[12345]|41))|115\.248)|3\.149\.(?:4[67]|38?|21))|1(?:25\.110\.(?:1(?:2[0137]|0[46]|12)|9[678])|09\.127\.86)|2(?:17\.118\.(?:8[13]|90)|02\.152\.243|7\.100\.31)|41\.254\.1|92\.42\.55)\.[012]?\d{1,2}\b)/
 describe KHOP_SC_TOP_CIDR24  Relay CIDR /24 leads SpamCop in worst /24s
 tflags	 KHOP_SC_TOP_CIDR24  nopublish
 score	 KHOP_SC_TOP_CIDR24  2.7 0.5 2.7 0.5
@@ -130,7 +130,7 @@ score	 KHOP_SC_TOP_CIDR24  2.7 0.5 2.7 0
 
 
 # http://www.spamcop.net/w3m?action=hoshame
-header	 KHOP_SC_TOP200  Received =~ /(?-xism:\b(?:1(?:2(?:5\.(?:110\.(?:1(?:1(?:2\.(?:1(?:03|52)|6[18]|0)|9\.(?:2(?:10|47)|31?|53)|1\.(?:1(?:63|78)|223)|7\.1(?:05|82)|6\.177|8\.111)|2(?:0\.(?:1(?:04|91)|2?27|91)|1\.(?:53|61|82)|7\.(?:162|41)|5\.178|3\.99)|0(?:6\.1(?:2[24]|62)|7\.(?:127|63|70)|2\.10|3\.15|4\.61))|9(?:8\.(?:1(?:62|76)|2(?:44|55)|9[49])|6\.(?:5[09]|118)|7\.(?:147|55)|9\.19))|233\.155\.(?:154|72))|4\.(?:8\.(?:3\.(?:10|26)|7\.(?:60|92))|158\.107\.55)|1\.(?:1(?:56\.118\.172|80\.50\.96)|78\.244\.172)|3\.193\.112\.177)|9(?:4\.(?:1(?:26\.183\.11|35\.21\.7)0|213\.122\.34|85\.25\.15)|3\.(?:1(?:24\.133\.216|69\.87\.144)|255\.124\.162)|(?:0\.(?:200\.182\.5|94\.97\.9)|2\.217\.122\.18)1|5\.(?:1(?:35\.237\.251|61\.9\.2)|56\.126\.150))|1(?:2\.(?:1(?:49\.78\.(?:10[27]|98)|85\.200\.227|68\.206\.11)|216\.12\.162)|4\.(?:200\.199\.(?:187|204)|41\.228\.240)|1\.224\.250\.(?:11|24)7|8\.232\.193\.179|9\.200\.84\.134)|7(?:(?:5\.215\.125\.8|3\.12\.82\.21)8|8\.151\.241\.155|4\.133\.121\
 .34|7\.10\.192\.86)|8(?:8\.231\.1(?:42\.229|51\.237)|2\.55\.126\.151)|41\.136\.68\.52|09\.98\.7\.206|\.251\.18\.69)|2(?:1(?:3\.(?:1(?:(?:35\.103\.6|87\.115\.1)6|71\.61\.178)|2(?:48\.153\.212|22\.53\.236))|7\.(?:2(?:3\.154\.115|5\.215\.228)|197\.155\.14|76\.2\.129)|9\.(?:94\.194\.138|70\.43\.245)|0\.219\.173\.90|1\.49\.171\.141|2\.70\.155\.88)|2(?:2\.12(?:4\.1(?:5(?:(?:4\.17|6\.23)0|8\.86)|98\.167)|2\.163\.118)|0\.(?:7(?:7\.183\.16|1\.140\.)2|136\.131\.180))|0(?:1\.(?:207\.179\.118|116\.199\.34)|2\.(?:126\.91\.246|71\.136\.200)|0\.61\.42\.145|7\.157\.30\.66)|7\.110\.203\.29|\.37\.13\.245)|8(?:9\.(?:2(?:3(?:0\.220\.215|9\.132\.173)|12\.115\.157|00\.152\.10)|1(?:21\.137\.41|32\.61\.145)|31\.145\.16)|0\.(?:23(?:4\.104\.151|5\.82\.62)|188\.(?:94\.130|124\.2)|91\.185\.90|70\.39\.12)|(?:4\.121\.247\.5|6\.101\.181\.1|7\.204\.245\.3)9|2\.(?:208\.116\.222|151\.210\.15)|3\.(?:102\.154\.134|220\.34\.50)|1\.(?:202\.111\.74|9\.70\.100)|5\.235\.205\.6|8\.80\.32\.122)|9(?:1\.1(?:21\.(?:119\
 .157|31\.104|0\.178|74\.33)|43\.39\.205|88\.112\.1|90\.232\.8)|4\.(?:2(?:3\.2(?:25\.109|\.185)|45\.156\.34)|(?:100\.89\.15|73\.245\.4)8)|5\.(?:(?:226\.174\.1|76\.237\.4)3|188\.(?:118\.213|70\.208)|84\.222\.195)|3\.(?:157\.148\.102|72\.239\.221)|2\.(?:63\.183\.167|80\.59\.158))|6(?:(?:7\.205\.111\.20|1\.12\.19\.8)4|0\.1(?:81\.163\.136|90\.223\.144)|4\.(?:34\.234\.10|62\.128\.24)7|2\.1(?:19\.28\.120|22\.96\.6)|5\.98\.224\.52)|7(?:7\.(?:2(?:27\.10\.206|40\.240\.58)|65\.7\.122)|5\.75\.239\.(?:6[012]|5[89])|8\.12(?:9\.170\.41|8\.75\.7)|9\.1(?:90\.243|73\.80)\.195)|4(?:1\.(?:2(?:08\.106\.244|23\.184\.23)|137\.24\.4)|6\.61\.205\.226)|31\.42\.162\.106|59\.120\.52\.73)\b)/
+header	 KHOP_SC_TOP200  Received =~ /(?-xism:\b(?:1(?:2(?:5\.(?:110\.(?:1(?:1(?:2\.(?:1(?:03|52)|6[18]|0)|9\.(?:210|31?|53)|1\.(?:178|223)|7\.1(?:05|82)|6\.177|8\.111)|2(?:0\.(?:1(?:04|91)|2?27|91)|1\.(?:53|61|82)|7\.(?:162|41)|5\.178|3\.99)|0(?:6\.1(?:2[24]|62)|7\.(?:127|63|70)|2\.10|3\.15|4\.61))|9(?:8\.(?:1(?:62|76)|2(?:44|55)|9[49])|6\.(?:5[09]|118)|7\.(?:147|55)|9\.19))|233\.155\.72)|1\.(?:1(?:56\.118\.172|80\.50\.96)|78\.244\.172)|4\.(?:8\.(?:7\.(?:60|92)|3\.26)|158\.107\.55)|2\.160\.162\.242|3\.193\.112\.177)|9(?:4\.(?:1(?:26\.183\.11|35\.21\.7)0|213\.122\.34|85\.25\.15)|3\.(?:1(?:24\.133\.216|69\.87\.144)|255\.124\.162)|5\.(?:1(?:35\.237\.251|61\.9\.2)|56\.126\.150)|(?:2\.217\.122\.18|0\.200\.182\.5)1)|1(?:2\.(?:1(?:49\.78\.(?:10[027]|98)|85\.200\.227|68\.206\.11)|216\.12\.162)|9\.(?:200\.84\.134|70\.227\.137)|4\.200\.199\.(?:187|204)|1\.224\.250\.117|8\.232\.193\.179)|7(?:4\.133\.121\.34|5\.215\.125\.88|7\.10\.192\.86)|88\.2(?:31\.151\.237|6\.22\.131)|41\.136\.68\.5
 2|09\.98\.7\.206|51\.8\.71\.25|\.251\.18\.69)|2(?:1(?:3\.(?:2(?:48\.153\.212|22\.53\.236)|1(?:35\.103\.66|71\.61\.178))|7\.(?:2(?:3\.154\.115|5\.215\.228)|197\.155\.14|76\.2\.129)|0\.(?:109\.102\.86|219\.173\.90)|9\.(?:94\.194\.138|70\.43\.245)|1\.49\.171\.141|2\.70\.155\.88)|2(?:2\.12(?:4\.1(?:5(?:(?:4\.17|6\.23)0|8\.86)|98\.167)|2\.163\.118)|0\.(?:7(?:7\.183\.16|1\.140\.)2|136\.131\.180)|1\.143\.48\.187)|0(?:2\.(?:1(?:26\.91\.246|31\.234\.15)|71\.136\.200)|1\.116\.199\.34|7\.218\.237\.18|0\.61\.42\.145)|\.37\.13\.245)|9(?:1\.1(?:21\.(?:119\.157|31\.104|0\.178|74\.33)|43\.3(?:9\.205|6\.50)|88\.112\.1|90\.232\.8)|5\.(?:1(?:88\.(?:118\.213|70\.208)|56\.192\.8)|(?:226\.174\.1|76\.237\.4)3|84\.222\.195)|4\.(?:2(?:3\.2(?:25\.109|\.185)|45\.156\.34)|(?:100\.89\.15|73\.245\.4)8)|3\.(?:157\.148\.102|72\.239\.221)|2\.(?:63\.183\.167|80\.59\.158)|0\.152\.30\.106|7\.66\.58\.85)|8(?:9\.(?:2(?:3(?:0\.220\.215|9\.132\.173)|12\.115\.157|00\.152\.10|52\.40\.6)|1(?:21\.137\.41|32\.61\.145)|
 31\.145\.16)|0\.(?:188\.(?:94\.130|124\.2)|234\.104\.151|91\.185\.90|70\.39\.12)|3\.(?:1(?:02\.154\.134|7\.242\.202)|220\.34\.50|3\.103\.227)|(?:6\.101\.181\.1|7\.204\.245\.3)9|(?:2\.208\.116\.2|8\.80\.32\.1)22|1\.202\.111\.74|5\.235\.205\.6)|6(?:4\.(?:(?:34\.234\.10|62\.128\.24)7|120\.253\.1(?:79|80))|0\.1(?:81\.163\.136|90\.223\.144)|7\.(?:205\.111\.204|55\.0\.150)|2\.1(?:19\.28\.120|22\.96\.6)|6\.240\.223\.160|5\.98\.224\.52|1\.12\.19\.84)|7(?:7\.(?:2(?:27\.10\.206|40\.240\.58)|79\.161\.84|65\.7\.122)|8\.1(?:29\.170\.41|07\.82\.98)|5\.75\.239\.(?:6[012]|5[89])|9\.1(?:90\.243|73\.80)\.195)|41\.(?:223\.184\.23|137\.24\.4)|31\.42\.162\.106|59\.120\.52\.73)\b)/
 describe KHOP_SC_TOP200  Relay listed in SpamCop top 200 spammer IPs
 tflags	 KHOP_SC_TOP200  nopublish
 score	 KHOP_SC_TOP200  4 0 4 0	# unnecessary if DNSBLs work
@@ -147,14 +147,14 @@ score	 KHOP_SC_TOP200  4 0 4 0	# unneces
 
 
 # Spamhaus DROP, http://www.spamhaus.org/drop/
-header	 KHOP_SPAMHAUS_DROP	X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456
 789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:5\.(?:1(?:[578]4|[24]1|32)|2(?:07|45))|4\.(?:1(?:10|76|2)|[39]4|41)|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|8\.1[01]|\.21[23]|38\.242)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|8(?:8\.(?:19[01]|22[67])|5\.204)|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.
 (?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.32\.2(?:1[6789]|2[0123]))|1(?:\.0\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|4\.112\.2(?:2[456789]|5[012345]|[34]\d)|3\.20\.1(?:[678]\d|9[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|1\.136\.2[27]|6\.185\.245|0\.170)|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|5(?:7\.2(?:32\.(?:1(?:[3456789]
 |2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|88\.(?:2(?:12\.(?:[023456789]|1[012345]?)|47\.135)|1(?:70\.19[23456789]|30\.25[01]))|6(?:7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|0(?:9\.(?:94\.21[2345]|196\.140)|3\.10\.1(?:8[89]|9[01])))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01])|25\.(?:159|210))|4(?:8\.(?:6[456789]|9[012345]|[78]\d)|4\.(?:19[23456789]|20[01234567]))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|63\.1(?:4[456789]|5[01])|89\.224)|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|89\.7[123]|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d
 )|6\.189)|14\.1(?:[345]\d|2[89])))|9\.(?:1(?:82\.(?:6[456789]|9[012345]|[78]\d)|45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|2\.(?:61\.1(?:08|27)|59\.236)|3\.3(?:1\.8[89]|4\.7[01]))|1(?:6\.(?:212\.(?:2(?:2[0123]|[01]
 \d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:2(?:0(?:0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|1\.(?:[4567]|2(?:1[2345]|3[6789])|12[4567])|9\.(?:1(?:8[346]|4)|(?:[45]|23)8|63)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:3[25]|[26]3|07|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21|57)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22|90)|7?3)|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:9?0|62)|1\.9[89]|9\.9[01]|3\.201))|19(?:6\.2(?:1[6789]|3[2345])|3\.(?:19|7)[2345]|8\.1(?:2[57]|09)|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|99\.51|3[01])|6(?:3\.(?:1(?:4[69]|5[01])|24[0134567])|0\.12[123]|1\.247)|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89]))|5\.(
 ?:64\.(?:3[789]|1[13]|9[89])|21(?:[67]|5\.14[0123])))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|44)|7\.21(?:[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|8\.67\.(?:19[23456789]|20[01234567])|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|4\.22\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|9\.(?:114\.97?|45\.14)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.29)|1\.221\.1(?:1[23456789]|2[01234567]))|31\.(?:222\.20[01234567]|11\.43)|58\.83\.(?:[89]|1[012345]))\b)/
+header	 KHOP_SPAMHAUS_DROP	X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?:3[23456
 789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:5\.(?:1(?:[578]4|[24]1|32)|2(?:07|45))|4\.(?:1(?:10|76|2)|[39]4|41)|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|8\.1[01]|\.21[23]|38\.242)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|8(?:8\.(?:19[01]|22[67])|5\.204)|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[67])|26\.
 (?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.32\.2(?:1[6789]|2[0123]))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|4\.112\.2(?:2[456789]|5[012345]|[34]\d)|\.0\.(?:[0789]|[12345]\d?|6[0123]?)|3\.20\.1(?:[678]\d|9[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|1\.136\.2[27]|6\.185\.245|0\.170)|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|7(?:8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|
 4\.138\.1(?:4[456789]|5\d))|88\.(?:2(?:12\.(?:[023456789]|1[012345]?)|47\.135)|1(?:70\.19[23456789]|30\.25[01]))|6(?:7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|0(?:9\.(?:94\.21[2345]|196\.140)|3\.10\.1(?:8[89]|9[01])))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01])|25\.(?:159|210))|4(?:8\.(?:6[456789]|9[012345]|[78]\d)|4\.(?:19[23456789]|20[01234567]))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|63\.1(?:4[456789]|5[01])|89\.224)|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|89\.7[123]|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|9\.(?:1(?:82\.(?:6[456789]|9
 [012345]|[78]\d)|45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|2\.(?:61\.1(?:08|27)|59\.236)|3\.3(?:1\.8[89]|4\.7[01]))|1(?:6\.(?:212\.(?:2(?:2[0123]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109
 \.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:2(?:0(?:0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|1\.(?:[4567]|2(?:1[2345]|3[6789])|12[4567])|9\.(?:1(?:8[346]|4)|(?:[45]|23)8|63)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:3[25]|[26]3|07|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21|57)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22|90)|7?3)|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:9?0|62)|1\.9[89]|9\.9[01]|3\.201))|19(?:6\.2(?:1[6789]|3[2345])|3\.(?:19|7)[2345]|8\.1(?:2[57]|09)|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|99\.51|3[01])|6(?:3\.(?:1(?:4[69]|5[01])|24[0134567])|0\.12[123]|1\.247)|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89]))|5\.(?:64\.(?:3[789]|1[13]|9[89])|21(?:[67]|5\.14[0123])))|6(?:4\.(?
 :1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|44)|7\.21(?:[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|8\.67\.(?:19[23456789]|20[01234567])|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|4\.22\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|9\.(?:114\.97?|45\.14)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.29)|1\.221\.1(?:1[23456789]|2[01234567]))|31\.(?:222\.20[01234567]|11\.43)|58\.83\.(?:[89]|1[012345]))\b)/
 describe KHOP_SPAMHAUS_DROP	Relay listed in Spamhaus Don't Route Or Peer List
 tflags	 KHOP_SPAMHAUS_DROP	nopublish
 score	 KHOP_SPAMHAUS_DROP	1 0.2 1 0.2
 #   spam/ham     s/o   corpus
 # 0.0349/0.0029 0.924  20110227@510k
 
-header	 KHOP_SPAMHAUS_DROP_LE	X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?
 :3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:5\.(?:1(?:[578]4|[24]1|32)|2(?:07|45))|4\.(?:1(?:10|76|2)|[39]4|41)|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|8\.1[01]|\.21[23]|38\.242)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|8(?:8\.(?:19[01]|22[67])|5\.204)|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[6
 7])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.32\.2(?:1[6789]|2[0123]))|1(?:\.0\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|4\.112\.2(?:2[456789]|5[012345]|[34]\d)|3\.20\.1(?:[678]\d|9[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|1\.136\.2[27]|6\.185\.245|0\.170)|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|7(?:3\.225\.1(?:1[23456789]|2[01234567])|8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)|67|75)|4\.138\.1(?:4[456789]|5\d))|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|5(?:7\.2(?:32\.(?:1(?:[
 3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|88\.(?:2(?:12\.(?:[023456789]|1[012345]?)|47\.135)|1(?:70\.19[23456789]|30\.25[01]))|6(?:7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|0(?:9\.(?:94\.21[2345]|196\.140)|3\.10\.1(?:8[89]|9[01])))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01])|25\.(?:159|210))|4(?:8\.(?:6[456789]|9[012345]|[78]\d)|4\.(?:19[23456789]|20[01234567]))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|63\.1(?:4[456789]|5[01])|89\.224)|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|89\.7[123]|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456
 789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|9\.(?:1(?:82\.(?:6[456789]|9[012345]|[78]\d)|45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|2\.(?:61\.1(?:08|27)|59\.236)|3\.3(?:1\.8[89]|4\.7[01]))|1(?:6\.(?:212\.(?:2(?:2[01
 23]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3\.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:2(?:0(?:0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|1\.(?:[4567]|2(?:1[2345]|3[6789])|12[4567])|9\.(?:1(?:8[346]|4)|(?:[45]|23)8|63)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:3[25]|[26]3|07|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21|57)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22|90)|7?3)|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:9?0|62)|1\.9[89]|9\.9[01]|3\.201))|19(?:6\.2(?:1[6789]|3[2345])|3\.(?:19|7)[2345]|8\.1(?:2[57]|09)|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|99\.51|3[01])|6(?:3\.(?:1(?:4[69]|5[01])|24[0134567])|0\.12[123]|1\.247)|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89
 ]))|5\.(?:64\.(?:3[789]|1[13]|9[89])|21(?:[67]|5\.14[0123])))|6(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|44)|7\.21(?:[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|8\.67\.(?:19[23456789]|20[01234567])|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|4\.22\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|9\.(?:114\.97?|45\.14)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.29)|1\.221\.1(?:1[23456789]|2[01234567]))|31\.(?:222\.20[01234567]|11\.43)|58\.83\.(?:[89]|1[012345]))\b)/
+header	 KHOP_SPAMHAUS_DROP_LE	X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:1(?:9(?:8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.(?:1[6789]|3[01]|2\d))|2\.(?:3[23456789]|6[0123]|[45]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d)|43\.1(?:[345]\d|2[89])|51\.15[2345])|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|52\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|3\.(?:3[23456789]|4[01234567]))|45\.(?:3[23456789]|4[01234567])|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|20\.163)|8(?:4\.(?:6[456789]|9[012345]|[78]\d)|8\.(?:3[23456789]|5[01]|4\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|46\.(?
 :3[23456789]|6[0123]|[45]\d)|5\.15[23]|60\.102)|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:0(?:1\.(?:2(?:0[01234567]|4\d)|177)|0\.5)|71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|31\.21[23]|67\.16|86\.85)|3\.(?:1(?:0(?:5\.(?:1(?:[578]4|[24]1|32)|2(?:07|45))|4\.(?:1(?:10|76|2)|[39]4|41)|6\.3[2345])|6(?:\.(?:100|213)|9\.25[01])|1(?:0\.136|1\.235)|4(?:2\.244|8\.47)|78\.172|86\.9)|2(?:2(?:7\.24[01]|8\.145)|3(?:8\.[0123]|\.126)|7\.2(?:3[23]|4[67])|01\.19[23])|4(?:3\.134|6\.211|1\.38))|5\.(?:1(?:9(?:1\.10[23]|0\.157)|4(?:\.11[23]|9\.88)|14\.[89]|62\.[67]|82\.57)|2(?:2(?:6\.(?:197|220)|5\.17[6789])|8\.1[01]|\.21[23]|38\.242)|9(?:3\.(?:18[45]|20[89])|5\.15[15])|8(?:8\.(?:19[01]|22[67])|5\.204)|5(?:4\.17[01]|\.161)|7(?:8\.10|4\.8)[89])|4\.(?:1(?:4(?:6\.20[4567]|3\.13[01]|0\.229)|1(?:0\.16[0123]|6\.14[6
 7])|26\.(?:193|251)|65\.[45]|\.22[01])|2(?:8\.(?:11[2345]|4[4567])|4(?:7\.[45]8|2\.[23]))|6(?:3\.14[4567]|0\.205)|8\.(?:25[01]|7[45])|0\.2(?:21|45)|54\.15[6789])|6\.32\.2(?:1[6789]|2[0123]))|1(?:0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.(?:68\.1(?:3[6789]|4[0123])|199\.1(?:[345]\d|2[89]))|4\.112\.2(?:2[456789]|5[012345]|[34]\d)|\.0\.(?:[0789]|[12345]\d?|6[0123]?)|3\.20\.1(?:[678]\d|9[01]))|4(?:\.1(?:\.(?:1(?:2[01234567]|[01]\d)|9[6789])|02\.1(?:[678]\d|9[01]))|8\.(?:1(?:05|78)|248)|3\.(?:(?:13|9)5|49)|1\.136\.2[27]|6\.185\.245|0\.170)|3(?:4\.(?:1(?:7(?:5\.(?:[0456789]|[12]\d?|3[01]?)|2)|27)|2(?:09|3)|33)|2\.(?:2(?:32|40)|145)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|2(?:(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.1(?:68|99))|5(?:7\.2(?:32\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|[23456789]\d?|0)|26)|(?:1\.1|9\.2)23|0\.(?:141|230)|2\.147|5\.190)|7(?:8\.218\.1(?:4[0123]|2[89]|3\d)|0\.(?:1(?:06|20|97)
 |67|75)|4\.138\.1(?:4[456789]|5\d))|88\.(?:2(?:12\.(?:[023456789]|1[012345]?)|47\.135)|1(?:70\.19[23456789]|30\.25[01]))|6(?:7\.(?:2(?:24\.(?:[0456789]|[12]\d?|3[01]?)|8)|97)|2\.125|8\.151)|0(?:9\.(?:94\.21[2345]|196\.140)|3\.10\.1(?:8[89]|9[01])))|2(?:0(?:4\.(?:1(?:87\.(?:2(?:2[456789]|5[01234]|[34]\d)|1(?:5[56789]|[678]\d|9[01]))|0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|94\.1(?:8[456789]|9[01])|26\.24[45]|30\.167)|2(?:36\.(?:[0456789]|[12]\d?|3[01]?)|8\.1(?:0[456789]|1[01])|25\.(?:159|210))|4(?:8\.(?:6[456789]|9[012345]|[78]\d)|4\.(?:19[23456789]|20[01234567]))|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|63\.1(?:4[456789]|5[01])|89\.224)|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|5\.(?:2(?:2[0123]|[01]\d)|19[23456789])|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|89\.7[123]|59\.180)|2(?:03\.2(?:2[456789]|5[012345]|[34]\d)|3(?:5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|9\.(?:1(?:82\.(?:6[4
 56789]|9[012345]|[78]\d)|45\.(?:[0456789]|[12]\d?|3[01]?)|98\.1(?:7[6789]|9[01]|8\d))|2(?:05\.(?:19[23456789]|2[0123]\d)|13\.(?:6[0123]|4[89]|5\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|81\.(?:[0456789]|[12]\d?|3[01]?)|197\.(?:17[567]|2[89]))|0\.(?:1(?:15\.1(?:1[23456789]|2[01234567])|06\.1(?:4[0123]|2[89]|3\d)|25\.1(?:7[012345]|6[89]))|50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|3\.1(?:4[0123]|2[89]|3\d)|22)|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789]))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|90\.[01234567])|1\.71\.(?:[023456789]|1[012345]?)|2\.(?:61\.1(?:08|27)|59\.236)|3\.3(?:1\.8[89]|4\.7[01]))|1(?:6\.(?:212\.(?:2(?:2[0123]|[01]\d)|19[23456789])|151\.(?:19[23456789]|20[01234567]))|3
 \.(?:109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789])|247\.(?:[0456789]|[12]\d?|3[01]?))))|9(?:1\.(?:2(?:0(?:0\.(?:1(?:6[4567]|8[89]|9[01])|2(?:4[012389]|5[01]))|1\.(?:[4567]|2(?:1[2345]|3[6789])|12[4567])|9\.(?:1(?:8[346]|4)|(?:[45]|23)8|63)|4\.(?:5[01]|4\d)|8\.(?:162|228|0)|3\.9[2345]|5\.4[0123]|7\.11[67])|1(?:2\.(?:1(?:3[25]|[26]3|07|98)|2(?:01|20)|4[15]|65)|3\.(?:1(?:7[45]|21|57)|2(?:17|9)|7[25]|9[34])|1\.(?:6[4567]|8[89]|9[01])|6\.(?:1(?:4?1|22|90)|7?3)|7\.(?:1(?:53|62)|249)|0\.17[2345])|2(?:0\.(?:9?0|62)|1\.9[89]|9\.9[01]|3\.201))|19(?:6\.2(?:1[6789]|3[2345])|3\.(?:19|7)[2345]|8\.1(?:2[57]|09)|9\.1(?:12|23|57)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|26\.1(?:7[6789]|8[0123])|99\.51|3[01])|6(?:3\.(?:1(?:4[69]|5[01])|24[0134567])|0\.12[123]|1\.247)|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89]))|5\.(?:64\.(?:3[789]|1[13]|9[89])|21(?:[67]|5\.14[0123])))|6
 (?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?))|44)|7\.21(?:[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|2\.1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789])|8\.67\.(?:19[23456789]|20[01234567])|6\.231\.(?:6[456789]|7\d))|7(?:9\.1(?:10\.(?:1(?:4[456789]|[678]\d?|9[01]?|5\d)|6[0123]|[25]\d|3[01]|4[89])|74\.(?:[0456789]|[12]\d?|3[01]?))|2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d)|2\.1(?:7[6789]|9[01]|8\d))|8\.(?:31\.1(?:8[456789]|9[01])|155\.22[01]))|8(?:5\.(?:2(?:02\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|55\.1(?:1[23456789]|2[01234567]))|121\.39)|4\.22\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.(?:135\.(?:6[456789]|7\d)|214\.211)|9\.(?:114\.97?|45\.14)|1\.22\.15[23])|4(?:6\.(?:252\.1(?:3[0123]|2[89])|161\.29)|1\.221\.1(?:1[23456789]|2[01234567]))|31\.(?:222\.20[01234567]|11\.43)|58\.83\.(?:[89]|1[012345]))\b)/
 describe KHOP_SPAMHAUS_DROP_LE	Relay listed in Spamhaus Don't Route Or Peer List
 tflags	 KHOP_SPAMHAUS_DROP_LE	nopublish
 score	 KHOP_SPAMHAUS_DROP_LE	2 0 2 0 	# adds to KHOP_SPAMHAUS_DROP



Mime
View raw message