# Barnes & Noble
#
# Updated and domains verified 6/25/02
# Last reported spam:  5/08/02
# Other Relevant Info:
#    Amazon seems to have learned its lesson.  Pity about B&N.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(208\.158\.245\.140|\
          208\.237\.178\.|\
          (^|[^-_0-9a-z])barnesandnoble\.com([^a-z0-9\.]|$)|\
          (^|[^-_0-9a-z])bn\.com([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: Barnes & Noble"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: postmaster@bn.com,postmaster@barnesandnoble.com" \
    -A"Cc: abuse@uu.net,abuse@cw.net,abuse@rapidsite.net" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
 }

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# Britannica
#
# Updated and domains verified 12/06/02
# Last reported spam:  12/18/02
# Other Relevant Info:
#
#  12/06/02:
#   Several years after I first saw Britannica's spam hit scraped email
#   addresses from almost every web site I maintain, and various addresses
#   of mine that had been closed for years, I =still= get spam from them.
#   Britannica has a real product, but their email marketing practices
#   resemble those of Alan Ralsky more than an honest business. :(
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(66\.54\.33\.138|\
          192\.215\.6\.[0-9][0-9]?[0-9]?|\
          208\.154\.71\.[0-9][0-9]?[0-9]?|\
          216\.146\.93\.[0-9][0-9]?[0-9]?|\
          (^|[^-_0-9a-z])britannica\.com([^a-z0-9\.]|$)|\
          (^|[^-_0-9a-z])eb\.com([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: Britannica"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: customersupport@us.britannica.com" \
    -A"Cc: abuse@cw.net,postmaster@loudcloud.com,abuse@global-com.com,abuse@att.net" \
    -A"Bcc: syndication@us.britannica.com,international@us.britannica.com,copyright@us.britannica.com" \
    -A"Bcc: distribution@us.britannica.com,media@us.britannica.com,staffing@eb.com" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
 }

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# C2it
#
# Updated and domains verified 6/21/02
# Last reported spam:  8/05/02
# Other Relevant Info:
#
#    I joined C2it, and specifically opted out of all marketing email.  I then
#    found, when I was looking through my SPAMFOLDER, that they were sending
#    legitimate system emails via a sleazoid spamhaus.  Tried to warn them
#    about it, but there was no email address at c2it.com that didn't bounce.
#    (No postmaster, etc.)  Then, a few days later, I got the first of several
#    clearly marketing emails, sent in violation of my LOUDLY expressed wishes.
#    I therefore called c2it and closed my account.
#
#    A week later, I got another marketing email.  I called c2it customer service
#    again. The account had not been closed.  I demanded that it be closed, and
#    asked that a paper mail be sent to me confirming that it had been closed.
#    The customer service rep commented that it was "only a little email" they
#    had sent, confirming to me that they had no intention of adhering to the
#    limits I'd set or respecting my wishes.
#
#    I got the letter confirming the closure two weeks later.  The SAME DAY,
#    I got more spam from C2it.  This was about a month ago.  Two weeks later,
#    I got another spam, this one from inside of c2it instead of from the
#    spamhaus, stating that I had ten dollars waiting for me at the account.
#    I responded to support@c2it.com, the email address that sent this offer,
#    refusing the $10.00 and asking for them to confirm that they had in fact
#    closed my account.  The email bounced.
#
#    Today, I got email indicating that the $10.00 had been returned to c2it's
#    coffers, email that then told me how to sign up if I wasn't a c2it member!
#
#    Spamming slimeballs.  Every email they send my way or any of yours in the
#    future gets rammed back up Citicorp's virtual throat.
#
#   8/05/02 -- they're =still= spamming me months after I closed the account. :/
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(192\.193\.195\.|\
          (^|[^-_0-9a-z])c2it\.com([^a-z0-9\.]|$)|\
          (^|[^-_0-9a-z])citicorp\.com([^a-z0-9\.]|$))
* ^From:.*c2it\.com([^a-z0-9\.]|$)
{
:0 f
| ${FORMAIL} -A"X-SBRule: C2it"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: postmaster@citi.com,postmaster@citicorp.com" \
    -A"Cc: hostmaster@cto.citicorp.com,domain.admin@citicorp.com,dns@citicorp.com" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
 }

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# CDNOW
#
# Updated and domains verified 11/08/01
# Last reported spam:  5/15/02
# Other Relevant Info:
#    10/20/00 -- Stuck me on a spam list when I was foolish enough to order from
#     them and provide a working email address.  Did not ask for permission, did
#     not mention that they would do this.  I got no response from these sleazeballs
#     at all.  The bulk mail house apologized, but is still doing business with
#     CDNOW, whose policies on this have not changed.
#
#    11/08/01 -- Now spamming from their own domain instead of via a spam-for-hire
#     house. :(
#
#    5/21/02 -- Apparently realized that spamming from their own domain was causing
#     them grief, and started spamming via kooloffers.com.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(12\.33\.5[6-9]\.|\
          (^|[^-_0-9a-z])cdnow\.com([^a-z0-9\.]|$)|\
          (^|[^-_0-9a-z])CDs<bounce@kooloffers\.com>)
{ CDNOW=yes }

:0 BH
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*   500^0   ^From: CDNOW_Welcome
*   500^0   ^Subject: How to Customize Your Account
*   800^1    cdnow\.com([^a-z0-9\.]|$)
*   800^1    http://www\.kooloffers\.com/adimages/cdnow/
{ CDNOW=yes }

:0
* CDNOW ?? yes
{
:0 f
| ${FORMAIL} -A"X-SBRule: CDNOW"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: postmaster@cdnow.com" \
    -I"Cc: abuse@att.net" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID})\
    | ${SENDMAIL} -oi -t

 :0 c: spamtemp.${SPAMPID}.lock
 * ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*kooloffers\.com([^a-z0-9\.]|$)
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: postmaster@kooloffers.com" \
    -I"Cc: abuse@verio.net" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
 }

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}

# Looksmart
#
# Updated and domains verified 6/25/02
# Last reported spam:  11/13/02
# Other Relevant Info:
#    10/20/00:
#     Web site/site index that is spamming users advertising its "site
#     submission" service. :/  Looksmart is a legitimate directory, but
#     spamming its users is =NOT= legitimate behavior in any way,
#     shape, or form.  Offering a "remove" option does not make it
#     legitimate.
#    11/08/01:
#     Spamming via Messagereach, a spam-for-hire service.
#
:0 BH
* LEANTAG ?? no
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* !^Subject: .*\(fwd\)
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*  1000^0   ^From:.*submit@.*looksmart\.net([^a-z0-9\.]|$)
*   800^0   ^From:.*LookSmart([^a-z0-9\.]|$)
*   600^0   ^Subject.*Express Submit
*    50^1.5  LookSmart
*   800^1    LookSmart\'?s? Directory
*  1100^1    (^|[^-_0-9a-z])looksmart\.(com|net)([^a-z0-9\.]|$)
*  1100^1    (^|[^-_0-9a-z])lksm\.(com|net)([^a-z0-9\.]|$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: LookSmart"

 :0
 { SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
{
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: postmaster@looksmart.com,mreaves@looksmart.net,abuse@looksmart.com" \
    -I"Cc: abuse@savvis.net" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
}

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# Microsoft bCentral
#
# Updated and domains verified 6/25/02
# Last reported spam: 6/23/02
# Other Relevant Info:
#    10/26/00 -- Microsoft appears to be spamming a list of former LinkExchange users. :(
#     One report indicated that the recipient of their spam has never used Windows and
#     his company is Unix-only.  Stupid marketer somewhere in Microsoft's organization,
#     probably, since other parts of MS are death on spam.  Filter written to catch
#     only this stuff.
#
#    6/25/02 -- Unfortunately, bcentral.com has turned into a spam support services
#     outfit supporting small businesses, many with no clue what is acceptable on
#     the Internet. :/  There are occasional legitimate users, but not enough to
#     justify treating this as a legitimate service.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(206\.132\.79\.|\
          bcentral\.com([^a-z0-9\.]|$)|\
          listbuilder\.com([^a-z0-9\.]|$))
{ BCENTRAL=yes }

:0 BH
* LEANTAG ?? no
* !^Subject:.*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*  1100^1   ^From:.*Microsoft[ ]?bCentral
*   600^1    bCentral
*  1100^1    (^|[^-_0-9a-z])bcentral\.com([^a-z0-9\.]|$)
*   500^0    (^|[^-_0-9a-z])cq0\.net([^a-z0-9\.]|$)
{ BCENTRAL=yes }

:0
* BCENTRAL ?? yes
{
:0 f
| ${FORMAIL} -A"X-SBRule: bCentral"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
{
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: abuse@microsoft.com,postmaster@bcentral.com,policy_us@bcentral.com" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
}

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# Microsoft Network (MSN)
#
# Updated and domains verified 11/08/02
# Last reported spam: 4/23/02
# Other Relevant Info:
#    Spamming for MSN. :(
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*(^|[^-_0-9a-z])(communications[0-9]?\.msn\.com([^a-z0-9\.]|$)|\
          communications@.*msn.com([^a-z0-9\.]|$)|\
          msnnewsletters\.customer-email\.com([^a-z0-9\.]|$))
{ MSN=yes }

:0
* LEANTAG ?? no
* ! MSN ?? yes
{
 :0 BH
 * !^Subject:.*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -500^0   ^Subject: Re:
 *  -200^1   ^[:;#>]
 *  1100^0    (^|[^-_0-9a-z])communications[0-9]?\.msn\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])newsletters\.msn\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])privacy\.msn\.com([^a-z0-9\.]|$)
 { MSN=yes }
}

:0
* MSN ?? yes
{
:0 f
| ${FORMAIL} -A"X-SBRule: MSN"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
{
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: abuse@microsoft.com,abuse@msn.com" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
}

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# McAfee (Network Associates)
#
# Updated and domains verified 10/15/02
# Last reported spam: 8/06/02
# Other Relevant Info:
#    After a hiatus, NAI/McAfee is spamming again. :/  This time, they
#    are spamming using Unitymail, a known spam software package.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*(^|[^-_0-9a-z])(216\.49\.8[0-9]\.|\
          216\.49\.9[0-5]\.|\
          unity[0-9]\.mcafee\.com([^a-z0-9\.]|$)|\
          subscriptions@mcafee\.com([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: McAfee/Network Associates"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@mcafee.com,postmaster@nai.com" \
     -I"Cc: abuse@internap.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Network Solutions
#
# Updated and domains verified 9/06/02
# Last reported spam: 9/05/02
# Other Relevant Info:
#   7/13/99:
#    Network Solutions has started a new "mailing list" to which it has
#    apparently subscribed the listed technical contacts in its huge
#    database without asking them, requiring them to unsubscribe
#    themselves.  This is opt-out bulk email, which is spam, plain
#    and simple.  I am therefore including the Network Solutions
#    spamming machine here.  I am not blacklisting the whole domain
#    because that could pose a problem for people with domains
#    registered through this monopoly. :(  The *ssholes are
#    taking advantage of their monopoly to force a situation on
#    their customers which most of the customers would reject totally
#    if asked.
#
#   9/24/99: A few days ago NSI spammed every email address they had,
#    administrative and billing contacts as well as technical
#    contacts, through a third-party company as well, apparently to
#    avoid spam blocks.  :(  These are slimeballs.  I've blocked them
#    entirely -- I'd suggest you inform them that they are to
#    communicate with you about your domain via postal mail only.
#
#   6/10/00: Contacted me via phone a few weeks ago to "follow up on my
#    recent request to opt-out of the .COM directory with a domain".  That
#    request/demand was sent last fall.  A few weeks later, got spammed by
#    them asking me to update my "incomplete" registration information for
#    that specific domain. These jerks simply DO NOT GET IT.
#
#   6/20/00: Yet another spam from these unbelievable slimeballs....
#
#   11/01/01: Now they're spamming on behalf of Verisign, a company
#     they own, via yet another spamhaus....
#
#   4/30/02: They hired a small spamhaus to spam on their behalf, apparently
#     got tired of fielding their own complaints. :/
#
#   9/06/02: New domain, nsi-direct.com, being used to spam now. They are
#     spamming people about domains that are not due to expire til next
#     year, urging them to sign on for a three-year contract.  Desperate,
#     perhaps, because ICANN is threatening to deregister them?
#
# Status:  Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*(^|[^-_0-9a-z])(netsol\.com([^a-z0-9\.]|$)|\
          networksolutions\.com([^a-z0-9\.]|$)|\
          nsi-direct\.com([^a-z0-9\.]|$)|\
          verisign\.com([^a-z0-9\.]|$)|\
          verisign-em\.com([^a-z0-9\.]|$))
{ NSI=yes }

:0
* LEANTAG ?? no
* !NSI ?? yes
{
 :0 B
 * !^Subject:.*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -500^0   ^Subject: Re:
 *  -200^1   ^[:;#>]
 *   400^0   ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]inte-net\.com([^a-z0-9\.]|$)
 *   800^0   ^From: .*[^0-9a-z]netsoll@integram\.org([^a-z0-9\.]|$)
 *   600^0   ^From: .*[^0-9a-z]net(work)?.?sol(utions)?[-_0-9a-z]*@
 *   800^0   ^From: .*[^0-9a-z]VeriSign([^a-z0-9\.]|$)
 *   500^1   ^Subject: .*domain name account
 *   500^1   Network Solutions
 *   800^1   netsol\.com([^a-z0-9\.]|$)
 *   800^1   networksolutions\.com([^a-z0-9\.]|$)
 *   800^1   nsi-direct\.com([^a-z0-9\.]|$)
 *   800^1   verisign\.com([^a-z0-9\.]|$)
 *   800^1   verisign-em\.com([^a-z0-9\.]|$)
 *   800^1   the dot com people
 { NSI=yes }
}

:0
* NSI ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Network Solutions/VeriSign"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: abuse@networksolutions.com,postmaster@netsol.com,privacy@networksolutions.com,postmaster@networksolutions.com" \
     -I"Cc: postmaster@nsi-direct.com,postmaster@verisign.com,postmaster@verisign-em.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}

# oracle.com
#
# Updated and domains verified 6/25/02
# Last reported spam: 4/05/02
# Other Relevant Info:
#    3/08/00: Sending out opt-out newsletter to people who did not ask to get it.
#      I'm not sure whether this is going just to customers or to other people as
#      well, but if it's opt-out, it is spam.  :(
#
#    4/13/02: Now someone at Oracle is sending an "eNewsletter" to addresses
#      scraped from the Internet! :(
# Status: Active Spammer
#
:0
* ^(((From.|Reply-To:|Message-ID:|Received:).*(^|[^-_0-9a-z])(magazine@.*oracle\.com([^a-z0-9\.]|$)|\
     scott\.nichols@oracle\.com([^a-z0-9\.]|$)))|\
     Subject: eNewsletter from Oracle Corporation)
{
:0 f
| ${FORMAIL} -A"X-SBRule: Oracle"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
{
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: postmaster@oracle.com,abuse@level3.net" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
}

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# paypal.com
#
# Updated and domains verified 6/25/02
# Last reported spam: 5/14/02
# Other Relevant Info:
#       Subscribed all users to newsletter without their consent, reportedly
#       is ignoring remove requests as well. :(
#
#       11/08/01 -- Not reportedly any more.  They've kept spamming me despite
#        repeated, vociferous complaints directed to various addresses in the
#        company, to which they have not given the courtesy of a response yet.
#
#       6/25/02 -- PayPal has gone from putting users on mailing lists they
#        can't get off of, to outright spamming, or so it appears to me. :(
#        I'm no longer trying to avoid "legitimate" email from these clowns;
#        people who dislike spam should simply avoid using PayPal.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*(^|[^-_0-9a-z])(announcements.*@.*paypal\.com([^a-z0-9\.]|$)|\
          service@.*paypal\.com([^a-z0-9\.]|$)|\
          paypalupdate\.com([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: PayPal"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
{
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: postmaster@paypal.com,accessviolation@paypal.com" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
}

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# Progressive Networks (real.com/realaudio.com)
#
# Updated and domains verified 6/25/02
# Last reported spam: 4/23/02
# Other Relevant Info:
#    Yet another "legitimate" company which sends lots of unsolicited
#     and unwanted email, usually to people who download their
#     "RealAudio" player.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*(209\.210\.138\.|\
          (^|[^-_0-9a-z])prognet\.com([^a-z0-9\.]|$)|\
          (^|[^-_0-9a-z])real\.(com|net)([^a-z0-9\.]|$)|\
          (^|[^-_0-9a-z])real-net\.net([^a-z0-9\.]|$)|\
          (^|[^-_0-9a-z])realaudio\.com([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: Progressive Networks"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
{
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: abuse@real.com" \
    -I"Cc: black@prognet.com,abuse@eli.net" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
}

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# Staples
#
# Updated and domains verified 8/06/02
# Last reported spam: 8/06/02
# Other Relevant Info:
#    Bulk mailing list, opt out. :(
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*(^|[^-_0-9a-z])(12\.40\.61\.|\
            staples-deals\.com([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: Staples"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
{
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: postmaster@staples-deals.com,postmaster@staples.com" \
    -I"Cc: abuse@att.net,abuse@cw.net,ang@doubleclick.net,hostmaster@doubleclick.net,postmaster@doubleclick.net" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
}

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# Utne Reader
#
# Updated and domains verified 8/07/02
# Last reported spam: 8/07/02
# Other Relevant Info:
#    Well respected alternative/leftist magazine, but spams via
#    email-publisher.com, Topica's spam-for-hire outfit.
# Status: Active Spammer
#
:0
* LEANTAG ?? no
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -500^0   ^Subject: Re:
 *  -200^1   ^[:;#>]
 *   600^0   cafe\.utne\.com([^a-z0-9\.]|$)
 {
  :0 f
  | ${FORMAIL} -A"X-SBRule: Utne Reader"

  :0
  { SPAMTAG=yes }

  :0
  * SRC ?? yes
  * !ADMINTAG ?? yes
  * !BULKTAG ?? yes
  {
   :0
   { SPAMPID=`echo $$` }

   :0 c:
   spamtemp.${SPAMPID}

   :0 c: spamtemp.${SPAMPID}.lock
   | (${FORMAIL} -rt \
      -I"From: ${ALTFROM}" \
      -I"To: postmaster@utne.com" \
      -I"Subject: cafe.utne.com Spam" \
      -I"Cc: postmaster@eventis.com,postmaster@uslink.net,lance@uslink.net" \
      -A"Cc: abuse@Interliant.com,postmaster@sagenetworks.com" \
      -A"X-Loop: ${NOLOOP}";\
      cat ${SBDIR}/spam;\
      echo " ";\
      echo "Eventis -- you host the web site cafe.utne.com, which is referenced";\
      echo "in the body of this spam.  Please ensure that your customer does not";\
      echo "continue to send unsolicited bulk email.";\
      echo " ";\
      echo "USLink -- You are the upstream provider of Eventis.  Please follow";\
      echo "up and see that Eventis stops its spamming customer.";\
      echo " ";\
      echo "Interliant/sagenetworks -- you host the main utne.com web site.  Please";\
      echo "make it clear to your spamming customers that hosting the cafe.utne.com";\
      echo "site somewhere else does not mean that it is okay to spam.";\
      echo " ";\
      echo "=-=-=-=-=-=-=-=-=-=";\
      echo " ";\
      cat spamtemp.${SPAMPID};\
      ${RM} -f spamtemp.${SPAMPID}) \
      | ${SENDMAIL} -oi -t
  }

  :0
  * SRB ?? yes
  { BOUNCETHIS=yes }
 }
}
