below you do have a good example for ```rejected by local_scan(): Rejected```.  Above two examples should not lead to banning of some IP which did nothing wrong but rather when sysadmin misconfigured the server or alike.

That is why I think ```.{0,256}``` would be too flexible and we should ban only those which have "local_scan(): Rejected" with optional suffix of scores (i.e. ```: hits=7.5 required=5.0 trigger=5.0 ```)