## khop-sc-neighbors.cf v 20130262 ## Khopesh's syndication of SpamCop's top offenders and top offending networks. ## ## Spamassassin rules written by Adam Katz ## http://khopesh.com/Anti-spam ## khopesh on irc://irc.freenode.net/#spamassassin ## ## sa-update --gpgkey E8B493D6 --channel khop-bl.sa.khopesh.com ## ## These rules are Copyright 2001-2009 by Adam Katz ## Licensed under the Apache License 2.0. ## The code that generated this output is GNU Affero General Public License v3. ## Source data (copyright Cisco) was taken from links below. ## ## Frequent updates are needed for these rules, so they are marked 'nopublish' ## This keeps them from being automatically promoted to SpamAssassin proper ## from the testing system, which affirms their usefulness. You can check ## their efficiency at http://ruleqa.spamassassin.org/?rule=%2FKHOP_SC # http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56 # Due to the massive block size, this rule only examines the last untrusted header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:9[35]|117|2)(?:\.[012]?\d{1,2}){3}\b) / # and gets cleaned up a bit meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL) describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop tflags KHOP_SC_CIDR8 nopublish score KHOP_SC_CIDR8 0.3 0.1 0.3 0.1 # spam/ham s/o corpus # 12.3692/1.0099 0.925 20100211 .2 .1 .3 .2 -> .1 .01 .1 .01 # 8.9412/1.1532 0.886 20100325 # 9.4362/0.4074 0.959 20100329 # 11.8281/0.4788 0.961 20100401 without meta # 11.8578/0.4495 0.961 20100402 half meta (oops). decreased worst 4/8->4/7 # 7.8856/0.1388 0.983 20100403 meta, net, solo=7.9236/0.4189 # changed from rank by spam count to rank by hosts reported, back to 4/8 # 12.1963/0.0356 0.997 20100406 (wow) solo=12.2454/0.0408@0.997 # 12.0753/0.0359 0.997 20100409 solo=12.1265/0.0412@0.997 # 12.1449/0.0139 0.999 20100410 net, solo=12.1966/0.0197@0.998, ->.2 .1 .3 .2 # 10.3554/0.0112 0.999 20110227@510k solo=10.3717/0.0119@0.999, ->.3 .1 .3 .1 header __KHOP_SC_TOP_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:13|78|90)|37)(?:\.[012]?\d{1,2}){3}\b) / meta KHOP_SC_TOP_CIDR8 __KHOP_SC_TOP_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL) describe KHOP_SC_TOP_CIDR8 Relay CIDR /8 leads SpamCop in worst /8s tflags KHOP_SC_TOP_CIDR8 nopublish score KHOP_SC_TOP_CIDR8 0.2 0 0.2 0 # spam/ham s/o corpus # 15.6795/0.1173 0.993 20100211 .5 .4 .8 .6 -> .6 .5 .8 .5 # 11.0578/0.3614 0.968 20100325 # 13.7809/0.4860 0.966 20100329 .9 .1 .9 .1 masscheck promoted # 14.1773/0.4799 0.967 20100401 # 14.1807/0.4960 0.966 20100402 without meta # 14.0841/0.0926 0.993 20100402 added meta (wow!) # 14.2553/0.0424 0.997 20100403 net, solo=14.3609/0.4888@0.967 # 11.6252/0.1263 0.989 20100406 solo=11.7104/0.5366@0.956 # 11.5987/0.1295 0.989 20100409 solo=11.6856/0.5731@0.953 # 11.6286/0.0475 0.996 20100410 net, solo=11.7224/0.6900@0.944, ->LE as above # 10.6798/0.1269 0.993 20110227@510k solo=10.6996/0.5918@0.948 -> .2 0 .2 0 # http://www.spamcop.net/w3m?action=map;net=bmaxcnt;mask=16777215;sort=spamcnt header KHOP_SC_CIDR16 Received =~ /___ FAILED TO POPULATE ___/ describe KHOP_SC_CIDR16 Relay CIDR /16 is among worst in SpamCop tflags KHOP_SC_CIDR16 nopublish score KHOP_SC_CIDR16 1.0 0.2 1.0 0.2 # spam/ham s/o corpus # 0.7444/0.0129 0.983 20100211 # 0.5943/0.0139 0.977 20100325 .6 .5 .9 .75 # 0.8767/0.0167 0.981 20100329 1.6 .5 1.6 .5 masscheck promoted # 0.6952/0.0011 0.998 20100401 increased worst offenders 6/12->9/15 @ 20100401 # 0.6814/0.0149 0.979 20100402 # 0.4399/0.0008 0.998 20100403 net run # 0.2102/0.0011 0.995 20100406 # 0 /0 0 20100409 (wha!?) # crap, still empty 20100410 bad scrape, script failed to populate rule # crap, still empty 20110227 this is due to safety net exclusions -> 1 .2 1 .2 header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b222\.174(?:\.[012]?\d{1,2}){2}\b)/ describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s tflags KHOP_SC_TOP_CIDR16 nopublish score KHOP_SC_TOP_CIDR16 2.0 0.3 2.0 0.4 # spam/ham s/o corpus # 0.8862/0.0008 0.999 20100211 # 0.5738/0.0008 0.999 20100325 .9 .8 1.3 1.2 # 0.6658/0 1.000 20100329 2 .5 2 .5 masscheck promoted # 0.8374/0 1.000 20100401 # 1.1534/0 1.000 20100402 # 1.2077/0.0145 0.988 20100403 net run # 1.2155/0.0142 0.988 20100406 # 1.2779/0.0142 0.989 20100409 # 1.0611/0.0009 0.999 20100410 net # 0.5034/0 1.000 20110227@510k 2 .3 2 .4 # http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:1(?:0(?:9\.236\.8[78]|3\.9\.156)|12\.90\.197)|2(?:22\.174\.255|08\.184\.72|17\.23\.11)|5(?:8\.253\.216|9\.37\.168)|91\.121\.222)\.[012]?\d{1,2}\b)/ describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop tflags KHOP_SC_CIDR24 nopublish score KHOP_SC_CIDR24 0.1 0 0.1 0 # spam/ham s/o corpus # 0.1350/0 1.000 20100211 # 0.0798/0 1.000 20100325 .9 .8 1.3 1.2 # 0.0159/0 1.000 20100329 2.5 .6 2.5 .6 masscheck promoted # 0.1577/0 1.000 20100401 # added top host-count /24s, increased worst offenders 6/12->8/15 @ 20100401 # 0.1223/0 1.000 20100402 (oops, too small a pool) # host-count 84/64->84/50, offenders 8/15->10/20 @ 20100402 # 0.2547/0 1.000 20100403 net # 0.2126/0 1.000 20100406 # 0.2960/0 1.000 20100409 # 0.2905/0 1.000 20100410 net # 0.4157/0.5009 0.454 20110227 something is wrong here! -> .1 0 .1 0 header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:1(?:1(?:0\.165\.15|2\.97\.24)|20\.(?:128\.2|84\.13)|4\.137\.224|83\.221\.13|03\.9\.157)|2(?:1(?:(?:7\.200\.18|0\.21\.24)4|3\.230\.128)|03\.143\.115)|6(?:6\.214\.211|7\.205\.85)|8(?:4\.235\.91|5\.26\.184)|78\.138\.106)\.[012]?\d{1,2}\b)/ describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s tflags KHOP_SC_TOP_CIDR24 nopublish score KHOP_SC_TOP_CIDR24 2.7 0.5 2.7 0.5 # spam/ham s/o corpus # 0.2528/0.0092 0.965 20100211 # 0.2231/0.0112 0.952 20100325 1.7 1.5 1.9 1.8 # 0.0249/0 1.000 20100329 2.7 .6 2.7 .6 masscheck promoted # 0.1594/0 1.000 20100401 # 0.6448/0 1.000 20100402 (wow!) # 0.6896/0 1.000 20100403 net # 0.6255/0.0045 0.993 20100406 # 0.7261/0.0045 0.994 20100409 # 0.7447/0.0054 0.993 20100410 net # 0.5722/0 1.000 20110227@510k 2.7 .5 2.7 .5 # http://www.spamcop.net/w3m?action=hoshame header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:1(?:2(?:1\.(?:14(?:\.1(?:55\.106|7\.220)|4\.174\.12)|2(?:02\.132\.141|2\.127\.17)|78\.152\.51|8\.152\.242)|0\.(?:88\.2(?:0(?:1\.186|5\.127|8\.58)|17\.100)|197\.155\.179)|4\.(?:1(?:25\.156\.52|65\.228\.18)|243\.124\.206)|3\.(?:254\.1(?:09\.235|10\.119)|110\.82\.141)|2\.225\.62\.211)|1(?:2\.(?:9(?:0\.197\.(?:3[246]|44|50)|2\.32\.101)|158\.114\.9)|5\.(?:160\.146\.221|249\.168\.189)|9\.(?:36\.138\.131|40\.53\.90)|0\.93\.128\.(?:40|6)|4\.113\.221\.66|6\.255\.242\.43|7\.34\.72\.51)|9(?:0\.(?:10(?:7\.140\.74|9\.164\.81)|223\.53\.198|85\.209\.11)|8\.(?:23\.167\.10[14]|55\.96\.175)|(?:2\.174\.84\.3|5\.161\.9\.)2|4\.158\.204\.250)|0(?:3\.(?:9\.15(?:7\.(?:2(?:4[16]|17|33)|193|64)|6\.195)|244\.1\.101)|9\.2(?:36\.8(?:8\.(?:197|206)|7\.59)|02\.14\.161)|8\.163\.167\.202)|4(?:(?:4\.76\.12\.1|\.63\.74\.20)4|2\.11\.245\.(?:42|58)|9\.255\.3\.158|0\.127\.3\.99)|8(?:9\.7(?:6\.239\.130|5\.63\.114)|1\.53\.76\.120|6\.34\.45\.239|2\.237\.3\.55)|7(?:(?:5\.117\.14|8\.140\.9)4\.15|6\.115\.123\.33|7\.36\.243\.6)|\.2(?:14\.208\.114|26\.83\.199)|30\.193\.121\.162|63\.177\.112\.110)|2(?:1(?:0\.(?:2(?:1\.244\.(?:1(?:1[01345789]|0[1235679]|2[123456])|99)|45\.226\.87)|1(?:18\.26\.183|68\.50\.16)|3\.4\.160)|8\.(?:2(?:32\.109\.194|04\.174\.28)|(?:4\.203\.21|61\.18\.17)8|75\.146\.125|38\.12\.150)|7\.(?:2(?:3\.1(?:1\.(?:1(?:8[07]|72|6)|214)|4\.178)|00\.184\.87)|97\.211\.20)|3\.(?:(?:230\.128\.22|192\.3\.6)6|55\.(?:105\.115|72\.14))|1\.(?:115\.127\.32|58\.255\.121|202\.3\.156)|6\.205\.110\.27|9\.147\.172\.2)|0(?:2\.10(?:9\.228\.206|5\.134\.41|4\.22\.42)|3\.(?:145\.89\.(?:103|57)|237\.226\.116)|7\.57\.83\.17)|2(?:1\.214\.2(?:08\.226|14\.187)|2\.174\.255\.238)|\.134\.20\.90)|9(?:3\.(?:1(?:57\.148\.102|84\.71\.66)|58\.136\.118|95\.184\.236|79\.44\.189)|(?:5\.(?:167\.66\.15|83\.170\.)|6\.41\.209\.1)7|1\.(?:121\.222\.56|222\.15\.250)|2\.39\.61\.148)|5(?:8\.(?:2(?:53\.216\.1(?:3[01245689]|4[023]|28)|30\.118\.125)|64\.228\.224)|9\.(?:(?:37\.168\.1|41\.70\.2|60\.7\.14)6|188\.196\.185)|0\.7\.251\.155)|6(?:1\.(?:102\.226\.123|40\.132\.114)|0\.(?:199\.178\.121|208\.56\.19)|7\.(?:205\.85\.101|32\.6\.66)|6\.214\.211\.218|8\.114\.69\.171)|7(?:8\.138\.106\.(?:3[3467]|5[09]|43|60)|7\.1(?:06\.232\.178|23\.74\.140)|5\.134\.104\.36|9\.98\.128\.142)|8(?:4\.(?:233\.249\.236|15\.191\.254)|7\.1(?:19\.220\.229|06\.1\.246)|0\.36\.130\.135|\.33\.183\.1)|3(?:6\.231\.(?:8(?:0\.160|4\.43)|78\.29)|7\.59\.43\.203)|41\.(?:20(?:8\.106\.24|3\.92\.11)|137\.24\.)4)\b)/ describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs tflags KHOP_SC_TOP200 nopublish score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work # spam/ham s/o corpus # 1.2552/0 1.000 20100211 # 0.8558/0 1.000 20100325 3.4 3.2 3.7 3.5 # 0.1265/0 1.000 20100329 4 0 4 0 masscheck promoted # 0.7066/0 1.000 20100401 # 0.6558/0 1.000 20100403 net # 0.6211/0 1.000 20100406 # 0.5307/0 1.000 20100409 # 0.5617/0 1.000 20100410 net # 0.3655/0 1.000 20110227@510k # Spamhaus DROP, http://www.spamhaus.org/drop/ header KHOP_SPAMHAUS_DROP X-Spam-Relays-Untrusted =~ /(?-xism: (?:by|ip)=(?:(?:1(?:9(?:9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|6\.(?:1(?:2[01234567]|[01]\d)|9[6789])|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d)|54\.(?:3[23456789]|4[01234567])|12\.(?:1(?:1[01]|0\d)|9[6789]))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|85\.(?:19[23456789]|20[01234567])|20\.163)|8(?:4\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|8\.(?:3[23456789]|5[01]|4\d)|9\.(?:1[6789]|3[01]|2\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|5(?:8\.2(?:5[012345]|4[89])|\.15[23])|46\.(?:3[23456789]|6[0123]|[45]\d)|71\.(?:19[23456789]|20[01234567])|9\.(?:2[456789]|3[01])|60\.102)|8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.25)|51\.(?:1(?:2[01234567]|5[2345]|[01]\d)|6[456789]|[789]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d))|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|3\.(?:3[23456789]|4[01234567]))|4(?:5\.(?:3[23456789]|4[01234567])|8\.(?:1[6789]|3[01]|2\d))|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|01\.2(?:0[01234567]|4\d)|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|67\.16[0123]?|31\.21[23]|86\.85)|3\.(?:1(?:0(?:5\.(?:1(?:[58]4|41)|2(?:07|45))|4\.(?:1(?:10|76|2)|[39]4|41)|6\.3[2345]|7\.1[6789]|8\.178)|6(?:\.(?:100|213)|9\.25[01])|78\.1(?:2[0123]|72)|1(?:0\.136|1\.235)|48\.47)|2(?:0(?:1\.19[23]|0\.167)|2(?:7\.24[01]|8\.145)|7\.2(?:3[23]|4[67])|(?:43\.16|3\.12)6)|4(?:3\.134|6\.211|1\.38)|0\.212)|5\.(?:1(?:4(?:9\.(?:88|90)|\.11[23])|9(?:1\.10[23]|0\.157)|8(?:4\.8[67]|2\.57)|14\.[89]|62\.[67])|2(?:2(?:6\.(?:197|220)|5\.17[6789])|8\.1[01]|\.21[23]|46\.200)|8(?:8\.(?:19[01]|22[67])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.155)|5(?:4\.16[23]|\.161)|78\.10[89]|43\.128)|4\.(?:1(?:1(?:0\.16[0123]|6\.14[67])|\.(?:22[01]|184)|26\.(?:193|251)|65\.[45]|40\.229)|5(?:4\.15[6789]|0\.116)|6(?:3\.14[4567]|0\.242)|2(?:42\.[23]|9\.185)|44\.4)|\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|5(?:7\.2(?:3(?:2\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|(?:[01]?\d?\d|2[0-4]\d|25[0-5])|[23456789]\d?|0)|1\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|26\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|(?:\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|9\.(?:141|223)|0\.1(?:26|41)|1\.123|2\.147|5\.190)\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|4(?:\.(?:(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|192\.(?:4[89]|5\d))|(?:8\.(?:1(?:05|78)|248)|(?:0\.17|7\.5)0|3\.(?:135|49))\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|6\.185\.2(?:3[59]|18|54)|1\.136\.(?:1[67]|2[27]))|1(?:\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.19(?:9\.1(?:[345]\d|2[89])|7\.15[23456789])|3\.20\.1(?:[678]\d|9[01])|9\.42\.4[0123])|7(?:(?:\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|0\.(?:1(?:06|13|20)|67)|6\.47)\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|3\.2(?:05\.(?:[06789]|5[012345]?|[1234]\d?)|49\.1(?:[678]\d|9[01]))|8\.159\.1(?:7[6789]|9[01]|8\d)|1\.25\.190)|6(?:7\.(?:2(?:8\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|24\.(?:[0456789]|[12]\d?|3[01]?))|97\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|(?:\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|1\.232|2\.125)\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|2(?:(?:\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|8\.1(?:68|99))\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789]))|(?:3(?:\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:145|232)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|0(?:3\.(?:1(?:4\.2(?:0[89]|1[01])|0\.(?:6[89]|7[01]))|246\.7[2345]|7\.20[4567])|\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|9\.94\.2(?:2[0123]|0[89]|1\d))|8(?:\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|8\.2(?:47\.(?:135|230)|11\.2[45])|6\.190\.2(?:2[456789]|3[01])))|2(?:0(?:4\.(?:1(?:0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|5(?:5\.1(?:4[0123]|2[89]|3\d)|2\.2(?:2[456789]|3[01]))|87\.(?:2(?:[01234]\d|5[01234])|1(?:5[56789]|[6789]\d))|94\.1(?:8[456789]|9[01])|47\.2(?:5[012345]|4\d)|26\.24[45]|30\.167)|2(?:3(?:7\.(?:1(?:7[012345]|3[6789]|4[0123]|6[89])|2(?:3[23456789]|4[01234567]))|6\.(?:[0456789]|[12]\d?|3[01]?))|25\.(?:159|210))|44\.(?:2(?:0[01234567]|2[456789]|3\d)|19[23456789])|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|89\.224)|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|89\.7[123]|59\.180)|2(?:03\.(?:[0456789]|2(?:[016789]|2[456789]?|5[012345]?|[34]\d?)?|3[01]?|1\d?)|3(?:3\.2(?:2[456789]|3\d)|5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d)|9\.(?:9[012345]|8\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|1(?:23\.1(?:[345]\d|2[89])|97\.(?:2[89]|175))|81\.(?:[0456789]|[12]\d?|3[01]?))|9\.(?:1(?:4(?:8\.(?:6[456789]|9[012345]|[78]\d)|5\.(?:[0456789]|[12]\d?|3[01]?))|82\.(?:6[456789]|9[012345]|[78]\d)|98\.1(?:7[6789]|9[01]|8\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789])|32\.1(?:[345]\d|2[89]))|0\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|105\.(?:3[23456789]|4[01234567])|3\.1(?:4[0123]|2[89]|3\d))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|9(?:3\.(?:10[0123]|9[6789])|0\.[01234567])|70\.1(?:7[012345]|6[89])|117\.(?:9[012345]|8\d))|\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|1\.7(?:1\.(?:[023456789]|1[012345]?)|\.2(?:2[0123]|0[89]|1\d))|3\.3(?:1\.8[89]|4\.7[01])|2\.61\.108)|1(?:6\.(?:1(?:51\.(?:19[23456789]|20[01234567])|62\.1(?:1[23456789]|2[01234567]))|212\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|3\.109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789]))|[23456789]?\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|9(?:1\.(?:2(?:0(?:0\.(?:1(?:6[4567]|7[6789])|2(?:4[89]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8|63)|1\.(?:(?:12)?[4567]|23[6789])|4\.4[01234567]|8\.(?:162|228)|3\.9[2345]|6\.20[01])|1(?:2\.(?:1(?:23|35|98)|2(?:01|20)|4[15]|65)|3\.(?:2(?:17|9)|17[45]|9[34]|72)|7\.(?:1(?:62|78)|2(?:00|49))|6\.(?:1(?:90|1)|7?3)|0\.17[2345]|1\.6[4567])|3(?:0\.1(?:1[01]|4[37])|8\.(?:18[01]|82)|9\.(?:15|24)|6\.12[01]|1\.156|5\.2)|2(?:0\.(?:35|62|90)|8\.(?:132|39)|6\.1[01]|9\.248|3\.77)|4(?:(?:0\.16|3\.11)5|2\.217))|19(?:3\.1(?:9[2345]|1[01])|5\.(?:25[45]|1[01])|8\.1(?:09|27)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|3[01]\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|6(?:3\.(?:1(?:4[679]|5[01])|24[034567])|0\.12[123]|1\.247)|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89]))|5\.(?:21(?:[67]\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|5\.14[0123])|64\.(?:1[13]|9[89]))|\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|3(?:7\.(?:(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|2(?:46\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|30\.212)|1(?:48\.2(?:1[6789]|2[0123])|39\.49)|9\.58)|1\.(?:(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|1(?:(?:4\.10|1\.4)3|84\.242)|42\.1(?:[345]\d|2[89])|222\.20[01234567])|[02345689]?\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|8(?:1\.(?:4\.(?:[0789]|[12345]\d?|6[0123]?)|162\.1(?:[345678]\d|2[89]|9[01])|22\.15[23])|5\.(?:202\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|12(?:0\.9[45]|1\.39))|\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|4\.22\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.135\.(?:1[6789]|3[01]|2\d)|9\.(?:114\.97?|45\.14)|6\.55\.(?:21[01]|140))|5(?:\.(?:(?:(?:[01]?\d?\d|2[0-4]\d|25[0-5])|7[2345])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|62\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89])))|8\.(?:(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|83\.(?:[89]|1[01]))|[012345679]\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|7(?:2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d))|\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|9\.110\.(?:1(?:[678]\d?|9[01]?)|6[0123]|[25]\d|3[01]|4[89])|4\.123\.(?:10[0123]|9[6789])|8\.31\.1(?:8[456789]|9[01]))|4\d?\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|6(?:(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?)|85\.2(?:2[456789]|3\d))|44\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|234\.2(?:2[456789]|3\d))|2\.(?:(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789]))|3\.(?:(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|141\.(?:3[23456789]|6[0123]|[45]\d))|[01]\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|7\.21(?:[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|6\.231\.(?:6[456789]|7\d))\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|\.(?:(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|0\.0\.0))|0(?:\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|7\.0\.0\.0))\b)/ describe KHOP_SPAMHAUS_DROP Relay listed in Spamhaus Don't Route Or Peer List tflags KHOP_SPAMHAUS_DROP nopublish score KHOP_SPAMHAUS_DROP 1 0.2 1 0.2 # spam/ham s/o corpus # 0.0349/0.0029 0.924 20110227@510k header KHOP_SPAMHAUS_DROP_LE X-Spam-Relays-External =~ /^[^]]*(?-xism: (?:by|ip)=(?:(?:1(?:9(?:9\.(?:2(?:4(?:8\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|6\.(?:21[35]|137)|5\.138)|6\.(?:1(?:2[01234567]|[01]\d)|9[6789])|00\.(?:6[456789]|9[012345]|[78]\d)|30\.(?:6[456789]|10[0123]|[789]\d)|54\.(?:3[23456789]|4[01234567])|12\.(?:1(?:1[01]|0\d)|9[6789]))|1(?:9(?:6\.(?:2(?:2[0123]|[01]\d)|19[23456789])|8\.1(?:8[01234589]|[67]\d|9[01]))|6(?:5\.(?:3[23456789]|6[0123]|[45]\d)|6\.20[0123])|85\.(?:19[23456789]|20[01234567])|20\.163)|8(?:4\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|8\.(?:3[23456789]|5[01]|4\d)|9\.(?:1[6789]|3[01]|2\d))|3(?:4\.1(?:[345678]\d|2[89]|9[01])|3\.145)|5(?:8\.2(?:5[012345]|4[89])|\.15[23])|46\.(?:3[23456789]|6[0123]|[45]\d)|71\.(?:19[23456789]|20[01234567])|9\.(?:2[456789]|3[01])|60\.102)|8\.(?:1(?:8(?:1\.(?:6[456789]|9[012345]|[78]\d)|3\.(?:3[23456789]|6[0123]|[45]\d)|6\.25)|51\.(?:1(?:2[01234567]|5[2345]|[01]\d)|6[456789]|[789]\d)|3\.(?:[023456789]|1[012345]?)|62\.2(?:2[0123]|0[89]|1\d))|2(?:0(?:5\.(?:6[456789]|9[012345]|[78]\d)|\.(?:1[6789]|3[01]|2\d)|4\.[01234567])|3\.(?:3[23456789]|4[01234567]))|4(?:5\.(?:3[23456789]|4[01234567])|8\.(?:1[6789]|3[01]|2\d))|96\.2(?:2[456789]|3\d)|57\.(?:6[456789]|7\d))|2\.(?:2(?:2(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|9\.(?:3[23456789]|6[0123]|[45]\d))|19\.(?:2(?:1[012345]|0\d)|1[23456789]\d)|6\.25)|1(?:71\.(?:6[456789]|9[012345]|[78]\d)|12\.1(?:1[23456789]|2[01234567])|01\.2(?:0[01234567]|4\d)|60\.44|97\.87)|43\.1(?:5[3456789]|7[56789]|8[01234]|60)|67\.16[0123]?|31\.21[23]|86\.85)|3\.(?:1(?:0(?:5\.(?:1(?:[58]4|41)|2(?:07|45))|4\.(?:1(?:10|76|2)|[39]4|41)|6\.3[2345]|7\.1[6789]|8\.178)|6(?:\.(?:100|213)|9\.25[01])|78\.1(?:2[0123]|72)|1(?:0\.136|1\.235)|48\.47)|2(?:0(?:1\.19[23]|0\.167)|2(?:7\.24[01]|8\.145)|7\.2(?:3[23]|4[67])|(?:43\.16|3\.12)6)|4(?:3\.134|6\.211|1\.38)|0\.212)|5\.(?:1(?:4(?:9\.(?:88|90)|\.11[23])|9(?:1\.10[23]|0\.157)|8(?:4\.8[67]|2\.57)|14\.[89]|62\.[67])|2(?:2(?:6\.(?:197|220)|5\.17[6789])|8\.1[01]|\.21[23]|46\.200)|8(?:8\.(?:19[01]|22[67])|5\.204)|9(?:3\.(?:18[45]|20[89])|5\.155)|5(?:4\.16[23]|\.161)|78\.10[89]|43\.128)|4\.(?:1(?:1(?:0\.16[0123]|6\.14[67])|\.(?:22[01]|184)|26\.(?:193|251)|65\.[45]|40\.229)|5(?:4\.15[6789]|0\.116)|6(?:3\.14[4567]|0\.242)|2(?:42\.[23]|9\.185)|44\.4)|\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|5(?:7\.2(?:3(?:2\.(?:1(?:[3456789]|2[01234567]?|[01]\d?)?|(?:[01]?\d?\d|2[0-4]\d|25[0-5])|[23456789]\d?|0)|1\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|26\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|(?:\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|9\.(?:141|223)|0\.1(?:26|41)|1\.123|2\.147|5\.190)\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|4(?:\.(?:(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|192\.(?:4[89]|5\d))|(?:8\.(?:1(?:05|78)|248)|(?:0\.17|7\.5)0|3\.(?:135|49))\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|6\.185\.2(?:3[59]|18|54)|1\.136\.(?:1[67]|2[27]))|1(?:\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|0\.(?:44\.1(?:4[0123]|2[89]|3\d)|232\.1(?:7[012345]|6\d))|6\.19(?:9\.1(?:[345]\d|2[89])|7\.15[23456789])|3\.20\.1(?:[678]\d|9[01])|9\.42\.4[0123])|7(?:(?:\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|0\.(?:1(?:06|13|20)|67)|6\.47)\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|3\.2(?:05\.(?:[06789]|5[012345]?|[1234]\d?)|49\.1(?:[678]\d|9[01]))|8\.159\.1(?:7[6789]|9[01]|8\d)|1\.25\.190)|6(?:7\.(?:2(?:8\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|24\.(?:[0456789]|[12]\d?|3[01]?))|97\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|(?:\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|1\.232|2\.125)\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|2(?:(?:\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|8\.1(?:68|99))\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|(?:1\.4|9\.7)6\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|2\.202\.(?:1(?:2[01234567]|[01]\d)|9[6789]))|(?:3(?:\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|4\.(?:1(?:27|72)|2(?:09|3)|33)|2\.(?:145|232)|0\.2(?:01|22)|6\.228|9\.167|8\.43)|\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|0(?:3\.(?:1(?:4\.2(?:0[89]|1[01])|0\.(?:6[89]|7[01]))|246\.7[2345]|7\.20[4567])|\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|9\.94\.2(?:2[0123]|0[89]|1\d))|8(?:\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|8\.2(?:47\.(?:135|230)|11\.2[45])|6\.190\.2(?:2[456789]|3[01])))|2(?:0(?:4\.(?:1(?:0(?:6\.(?:1(?:[3456789]\d|2[89])|2(?:2[0123]|[01]\d))|7\.208)|5(?:5\.1(?:4[0123]|2[89]|3\d)|2\.2(?:2[456789]|3[01]))|87\.(?:2(?:[01234]\d|5[01234])|1(?:5[56789]|[6789]\d))|94\.1(?:8[456789]|9[01])|47\.2(?:5[012345]|4\d)|26\.24[45]|30\.167)|2(?:3(?:7\.(?:1(?:7[012345]|3[6789]|4[0123]|6[89])|2(?:3[23456789]|4[01234567]))|6\.(?:[0456789]|[12]\d?|3[01]?))|25\.(?:159|210))|44\.(?:2(?:0[01234567]|2[456789]|3\d)|19[23456789])|5(?:7\.(?:1[6789]|3[01]|2\d)|2\.255)|89\.224)|5\.(?:1(?:4(?:4\.(?:[023456789]|1(?:[012345]|7[6789]|9[01]|8\d)?)|2\.10[4567])|7(?:5\.1(?:[678]\d|9[01])|2\.24[4567])|37\.(?:[023456789]|1[012345]?)|89\.7[123]|59\.180)|2(?:03\.(?:[0456789]|2(?:[016789]|2[456789]?|5[012345]?|[34]\d?)?|3[01]?|1\d?)|3(?:3\.2(?:2[456789]|3\d)|5\.(?:6[456789]|7\d)|6\.189)|14\.1(?:[345]\d|2[89])))|6\.(?:2(?:0(?:3\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|1\.(?:6[0123]|4[89]|5\d)|9\.(?:9[012345]|8\d))|2(?:7\.(?:1(?:2[01234567]|[01]\d)|6[456789]|[789]\d)|4\.1(?:[678]\d|9[01])))|1(?:23\.1(?:[345]\d|2[89])|97\.(?:2[89]|175))|81\.(?:[0456789]|[12]\d?|3[01]?))|9\.(?:1(?:4(?:8\.(?:6[456789]|9[012345]|[78]\d)|5\.(?:[0456789]|[12]\d?|3[01]?))|82\.(?:6[456789]|9[012345]|[78]\d)|98\.1(?:7[6789]|9[01]|8\d))|95\.(?:2(?:2[0123]|[01]\d)|19[23456789])|51\.(?:3[23456789]|4[01234567]))|7\.(?:18(?:3\.(?:2(?:2[0123]|[01]\d)|19[23456789])|9\.(?:[0456789]|[12]\d?|3[01]?))|22\.(?:2(?:5[012345]|[01234]\d)|19[23456789])|32\.1(?:[345]\d|2[89]))|0\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|22\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|105\.(?:3[23456789]|4[01234567])|3\.1(?:4[0123]|2[89]|3\d))|8\.(?:8(?:1\.1(?:3[6789]|4[0123])|5\.3[23456789])|9(?:3\.(?:10[0123]|9[6789])|0\.[01234567])|70\.1(?:7[012345]|6[89])|117\.(?:9[012345]|8\d))|\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|1\.7(?:1\.(?:[023456789]|1[012345]?)|\.2(?:2[0123]|0[89]|1\d))|3\.3(?:1\.8[89]|4\.7[01])|2\.61\.108)|1(?:6\.(?:1(?:51\.(?:19[23456789]|20[01234567])|62\.1(?:1[23456789]|2[01234567]))|212\.(?:2(?:2[0123]|[01]\d)|19[23456789]))|\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|3\.109\.(?:2(?:2[0123]|0[89]|1\d)|9[6789]))|[23456789]?\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|9(?:1\.(?:2(?:0(?:0\.(?:1(?:6[4567]|7[6789])|2(?:4[89]|5[01]))|9\.(?:1(?:8[346]|4)|(?:[45]|23)8|63)|1\.(?:(?:12)?[4567]|23[6789])|4\.4[01234567]|8\.(?:162|228)|3\.9[2345]|6\.20[01])|1(?:2\.(?:1(?:23|35|98)|2(?:01|20)|4[15]|65)|3\.(?:2(?:17|9)|17[45]|9[34]|72)|7\.(?:1(?:62|78)|2(?:00|49))|6\.(?:1(?:90|1)|7?3)|0\.17[2345]|1\.6[4567])|3(?:0\.1(?:1[01]|4[37])|8\.(?:18[01]|82)|9\.(?:15|24)|6\.12[01]|1\.156|5\.2)|2(?:0\.(?:35|62|90)|8\.(?:132|39)|6\.1[01]|9\.248|3\.77)|4(?:(?:0\.16|3\.11)5|2\.217))|19(?:3\.1(?:9[2345]|1[01])|5\.(?:25[45]|1[01])|8\.1(?:09|27)|7\.9[6789]|4\.[01]))|4\.(?:1(?:5(?:4\.1(?:[345678]\d|2[89]|9[01])|8\.2(?:5[012345]|4\d))|3[01]\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|6(?:3\.(?:1(?:4[679]|5[01])|24[034567])|0\.12[123]|1\.247)|232\.2(?:5[012345]|4[89]))|3\.1(?:20\.(?:3[23456789]|6[0123]|[45]\d)|7(?:5\.2(?:5[012345]|4\d)|4\.164)|68\.(?:2[012345]|1[89]))|5\.(?:21(?:[67]\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|5\.14[0123])|64\.(?:1[13]|9[89]))|\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|3(?:7\.(?:(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|2(?:46\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|30\.212)|1(?:48\.2(?:1[6789]|2[0123])|39\.49)|9\.58)|1\.(?:(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|1(?:(?:4\.10|1\.4)3|84\.242)|42\.1(?:[345]\d|2[89])|222\.20[01234567])|[02345689]?\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|8(?:1\.(?:4\.(?:[0789]|[12345]\d?|6[0123]?)|162\.1(?:[345678]\d|2[89]|9[01])|22\.15[23])|5\.(?:202\.(?:1(?:9[23456789]|7[012345]|6\d)|20[01234567])|12(?:0\.9[45]|1\.39))|\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|4\.22\.(?:1(?:2[01234567]|[01]\d)|9[6789])|8\.135\.(?:1[6789]|3[01]|2\d)|9\.(?:114\.97?|45\.14)|6\.55\.(?:21[01]|140))|5(?:\.(?:(?:(?:[01]?\d?\d|2[0-4]\d|25[0-5])|7[2345])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|62\.(?:2(?:5[012345]|[01234]\d)|1(?:[3456789]\d|2[89])))|8\.(?:(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|83\.(?:[89]|1[01]))|[012345679]\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))|7(?:2\.(?:50\.(?:2(?:2[0123]|[01]\d)|19[23456789])|13\.(?:1[6789]|3[01]|2\d))|\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|9\.110\.(?:1(?:[678]\d?|9[01]?)|6[0123]|[25]\d|3[01]|4[89])|4\.123\.(?:10[0123]|9[6789])|8\.31\.1(?:8[456789]|9[01]))|4\d?\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5]))\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|6(?:(?:4\.(?:1(?:12\.(?:1(?:[012345678]\d?|9[01]?)?|[23456789]\d?|0)|5\.(?:[023456789]|1[012345]?)|85\.2(?:2[456789]|3\d))|44\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|234\.2(?:2[456789]|3\d))|2\.(?:(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|1(?:22\.(?:3[23456789]|7[23])|82\.15[23456789]))|3\.(?:(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|141\.(?:3[23456789]|6[0123]|[45]\d))|[01]\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|7\.21(?:[18]\.2(?:2[0123]|0[89]|1\d)|3\.1(?:4[0123]|2[89]|3\d))|6\.231\.(?:6[456789]|7\d))\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|\.(?:(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|0\.0\.0))|0(?:\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])\.(?:[01]?\d?\d|2[0-4]\d|25[0-5])|7\.0\.0\.0))\b)/ describe KHOP_SPAMHAUS_DROP_LE Relay listed in Spamhaus Don't Route Or Peer List tflags KHOP_SPAMHAUS_DROP_LE nopublish score KHOP_SPAMHAUS_DROP_LE 2 0 2 0 # adds to KHOP_SPAMHAUS_DROP # spam/ham s/o corpus # 0.0241/0 1.000 20110227@510k # PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop), # as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?-xism:\b(?:1(?:83\.221\.1[23]|09\.127\.81|10\.165\.15|97\.252\.0)|8(?:2\.115\.20[89]|5\.26\.184|3\.149\.3)|4(?:1\.254\.[58]|6\.53\.195)|6(?:1\.97\.169|3\.223\.67))\.[012]?\d{1,2}\b)/ describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits tflags KHOP_PSBL_CIDR24 nopublish score KHOP_PSBL_CIDR24 2 0.6 2 0.6 # spam/ham s/o corpus # 0.5363/0 1.000 20100401 # 0.7486/0 1.000 20100402 # 0.7317/0 1.000 20100403 net run. min hosts 73->65 # 0.9316/0 1.000 20100406 # 0.9473/0 1.000 20100409 # 0.9545/0 1.000 20100410 net # 0.6985/0.0014 0.998 20110227@510k 2 .6 2 .6 # test for ruleqa, 20100409, http://ruleqa.spamassassin.org/?rule=/KHOP_SPAMMY meta __KHOP_SPAMMY_CIDR24 KHOP_PSBL_CIDR24||KHOP_SC_CIDR24||KHOP_SC_TOP_CIDR24 # est. 1.2/0.0050@.996, floor: 1.0/0.0112@.989, ceiling: 1.4/0@1 # spam/ham s/o corpus # 1.2645/0.0054 0.996 20100410 net # 1.1562/0.0058 0.995 20100417 net # 1.1332/0.5023 0.693 20110227@510k meta __KHOP_SPAMMY_CIDR16 KHOP_SC_CIDR16||KHOP_SC_TOP_CIDR16 # est. 1.4/0.02@.986, floor: 1.3/0.0312@.977, ceiling: 2.0/0.0150@.993 # spam/ham s/o corpus # 1.0611/0.0009 0.999 20100410 net # 1.9539/0.0152 0.992 20100417 net # 0.5034/0 1.000 20110227@510k meta __KHOP_SPAMMY_CIDR8 KHOP_SC_CIDR8||KHOP_SC_TOP_CIDR8 # est. 23.7/0.15@.994, floor: 23/0.2685@.988, ceiling: 26.5/0.0789@.997 # spam/ham s/o corpus # 23.7686/0.0614 0.997 20100410 net # 22.2300/0.0616 0.997 20100417 net # 21.0352/0.1381 0.993 20110227@510k meta __KHOP_SPAMMY_SUBNET __KHOP_SPAMMY_CIDR24||__KHOP_SPAMMY_CIDR16 # est. 26.2/0.175@.993, floor: 24.5/0.5@.980, ceiling: 30.1/0.1@.997 # spam/ham s/o corpus # 25.6744/0.0677 0.997 20100410 net, beat estimated ceiling (for ham)! # 23.7846/0.0826 0.997 20100417 net, beat ceiling ham, but beat floor spam # 23.7505/0.1041 0.996 20100418 too much ham, nixing /8, new est. 3.0/.02@.993 # 1.6366/0.5023 0.765 20110227@510k # Bump these up to compensate for expected but absent overlap (94+% noted below) if (! plugin(Mail::SpamAssassin::Plugin::DNSEval) ) score KHOP_SC_CIDR8 (0) (0.2) (0) (0.2) # BRBL(98%) score KHOP_SC_TOP_CIDR8 (0) (0.9) (0) (0.9) # BRBL(98%) score KHOP_SC_CIDR16 (0) (1.5) (0) (1.5) # BRBL(99%), PBL(98%) score KHOP_SC_TOP_CIDR16 (0) (1.7) (0) (1.7) # BRBL(99%), PBL(94%) score KHOP_SC_CIDR24 (0) (0.9) (0) (0.9) # SC(99) BRBL(96) MSPIKE(96) score KHOP_SC_TOP_CIDR24 (0) (2.5) (0) (2.5) # MSPIKE(99) SC(98) BRBL(97) ... # PSBL(97) HOSTKARMA(97) score KHOP_SC_TOP200 (0) (4.4) (0) (4.4) # SC(99) PSBL(99) ... # HOSTKARMA(99) SEMBLACK(99) BRBL(98) MSPIKE(94) score KHOP_SPAMHAUS_DROP (0) (3) (0) (3) # SBL(78) score KHOP_PSBL_CIDR24 (0) (1.5) (0) (1.5) # BRBL(98) XBL(95) endif