(another one of these!) the test around line 2340 or so looks at whether there's any number or closing square bracket at the end of a helo and then fires HELO_NUMERIC? Say a server incorrectly identifies itself as "EHLO server3", it already gets penalised in the right places, and it might not be the intention to fire off HELO_NUMERIC as well then?
I stumbled onto a decent perl-regexp for identifying IP addresses on some PHP site a while ago, if you think it useful here instead of the current test: /^\[(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])(\.(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])){3}\]$/ (square brackets added to fit this case) regards, Riaan