# 2np.net
#
# Updated and domains verified 11/25/02
# Last reported spam:  7/01/02
# Other Relevant Info:
#
#   7/02/02 -- Got email from someone at JDR Media indicating that
#    they are no longer affiliated with 2np.net/em5000.com, etc.
#
#   11/25/02:
#     Nuked by XO along with tilw.net. :)
#
# Status: Nuked Spammer
#
:0
* LEANTAG ?? no
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -500^0   ^Subject: Re:
 *  -200^1   ^[:;#>]
 *  1100^1   2np\.net([^a-z0-9\.]|$)
 *  1100^1   em5000\.com([^a-z0-9\.]|$)
 {
  :0 f
  | ${FORMAIL} -A"X-SBRule: 2np.net"

  :0
  { BLOCKTAG=yes }

  :0
  * BLOCKREPLY ?? NOTIFY
  { BLOCKTHIS=yes }
 }
}


# aeopublishing.com
#
# Updated and domains verified 10/06/01
# Last reported spam:  10/03/01
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(64\.23\.55\.108|\
          aeo\.com([^a-z0-9\.]|$)|\
          aeopublishing\.com([^a-z0-9\.]|$))
{ AEOPUB=yes }

:0 BH
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*   500^1   activemarketplace\.com([^a-z0-9\.]|$)
*   500^1   aeopublishing\.com([^a-z0-9\.]|$)
*   500^1   BannerCo-op\.com([^a-z0-9\.]|$)
*   500^1   BannersGoMLM\.com([^a-z0-9\.]|$)
*   500^1   Be-Your-Own-ISP\.com([^a-z0-9\.]|$)
*   500^1   CashPromotions\.com([^a-z0-9\.]|$)
*   500^1   ClickDough\.com([^a-z0-9\.]|$)
*   500^1   designercard\.com([^a-z0-9\.]|$)
*   500^1   Find-Local-ISP\.com([^a-z0-9\.]|$)
*   500^1   FreeLinksNetwork\.com([^a-z0-9\.]|$)
*   500^1   Monster-Traffic\.com([^a-z0-9\.]|$)
*   500^1   MyShoppingPlace\.com([^a-z0-9\.]|$)
*   500^1   MySiteInc\.com([^a-z0-9\.]|$)
*   500^1   PayMeNet\.net([^a-z0-9\.]|$)
*   500^1   ProfitBanners\.com([^a-z0-9\.]|$)
*   500^1   PromoteLinks\.com([^a-z0-9\.]|$)
*   500^1   PutPEEL\.(com|net)([^a-z0-9\.]|$)
*   500^1   ralphsnostalgicjewelry\.com([^a-z0-9\.]|$)
*   500^1   SELLinternetACCESS\.com([^a-z0-9\.]|$)
*   500^1   SeventhPower\.com([^a-z0-9\.]|$)
*   500^1   TheLeadEngine\.com([^a-z0-9\.]|$)
*   500^1   TimsHomeTownStories\.com([^a-z0-9\.]|$)
*   500^1   webwealth4u\.ws([^a-z0-9\.]|$)
{ AEOPUB=yes }

:0
* AEOPUB ?? yes
{
:0 f
| ${FORMAIL} -A"X-SBRule: AEO Publishing"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# agoramail.com
#
# Updated and domains verified 10/07/01
# Last reported spam: 10/02/01
# Other Relevant Info:
#     Spammers-for-hire that also provoked threats on the life of
#     an anti-spam activist's family.  Slimeballs. :(
# Status: Active Spammers
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](216\.167\.107\.199|\
          64\.23\.60\.154|\
          247profits\.com([^a-z0-9\.]|$)|\
          agoramail\.com([^a-z0-9\.]|$)|\
          pop\.hebergement-discount\.com([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: agoramail.com"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# bulkmailhosting.com (Michael Atkin)
#
# Updated and domains verified 11/07/01
# Last reported spam: 10/24/01
# Other Relevant Info:
#
# Status: Active Spammers
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](24\.244\.140\.|\
          206\.47\.217\.4[8-9]|\
          206\.47\.217\.5[0-5]|\
          216\.221\.218\.|\
          atkin\.com([^a-z0-9\.]|$)|\
          bulkmailhosting\.com([^a-z0-9\.]|$)|\
          bulkmailservers\.com([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Atkin/bulkmailhosting.com"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Bulk ISP/Listwasher
#
# Updated and domains verified 11/08/01
# Last reported spam: 11/08/01
# Other Relevant Info:
#   11/09/01:
#     These spammers bombarded random addresses at spambouncer.net,
#     all non-existent (the domain is unused at present) and all
#     beginning with "v" so far.  The spam was sent via a relay
#     rape of a machine in Poland, but came from an IP belonging
#     to "SMA" in Beverly Hills, California.  I phoned them,
#     thinking a spammer was abusing a small company's netblock,
#     but the voice mail tree at the top started off with, "Welcome
#     to Bulk ISP, the world's largest bulk-friendly internet
#     provider." :>  I wonder who seeded their mailing list with
#     stuff at spambouncer.net? :)
#  11/11/01:
#     I've gotten over sixty spams from these idiots, on four different
#     subjects/on behalf of four different customers, all to different
#     non-existent addresses in the spambouncer.net domain.  I've got
#     a nice collection.... :)
# Status: Active Spammers
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](64\.86\.192\.6[4-9]|\
          64\.86\.192\.7[0-9]|\
          ewasher\.org([^a-z0-9\.]|$)|\
          listwasher\.org([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Bulk ISP"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Cyberentertainment group
#
# Updated and domains verified 6/10/00
# Last reported spam:  5/08/00
# Other Relevant Info:
#    Porno spammers who put people on porno mailing lists and send
#    "confirmation" notices to find out if addresses are live.
#    1/25/00 -- *ssh*les forged a spam in the name of an Internet
#     greeting card company, with a URL link that displayed the
#     greeting card company's name, but linked to a hard core
#     porn web page run by the spammers. :(
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(204\.178\.98\.[0-9]([^a-z0-9\.]|$)|\
          204\.178\.98\.[1-5][0-9]([^a-z0-9\.]|$)|\
          204\.178\.98\.6[0-3]([^a-z0-9\.]|$)|\
          204\.178\.107\.17[6-9]([^a-z0-9\.]|$)|\
          204\.178\.107\.18[0-9]([^a-z0-9\.]|$)|\
          204\.178\.107\.19[0-1]([^a-z0-9\.]|$)|\
          204\.178\.124\.([^a-z0-9\.]|$)|\
          208\.2\.8[0-3]\.|\
          208\.50\.1[6-7]\.|\
          badgirlsclub\.com([^a-z0-9\.]|$)|\
          britishbombshells\.com([^a-z0-9\.]|$)|\
          cyberentertainment\.(com|net)([^a-z0-9\.]|$)|\
          eroticeye\.com([^a-z0-9\.]|$)|\
          innovativecreations\.com([^a-z0-9\.]|$)|\
          pornzine\.com([^a-z0-9\.]|$)|\
          prettyinpink\.com([^a-z0-9\.]|$)|\
          privategold\.com([^a-z0-9\.]|$)|\
          puritansex\.com([^a-z0-9\.]|$)|\
          schoolgirls\.com([^a-z0-9\.]|$)|\
          sexcenterfolds\.com([^a-z0-9\.]|$)|\
          sexillustrated\.com([^a-z0-9\.]|$)|\
          threesomes\.com([^a-z0-9\.]|$)|\
          truly18\.com([^a-z0-9\.]|$)|\
          vixxens\.com([^a-z0-9\.]|$)|\
          xxasians\.com([^a-z0-9\.]|$))
{ CYBERENTERTAINMENT=yes }

:0 BH
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*  1100^1   badgirlsclub\.com([^a-z0-9\.]|$)
*  1100^1   britishbombshells\.com([^a-z0-9\.]|$)
*  1100^1   cyberentertainment\.(com|net)([^a-z0-9\.]|$)
*  1100^1   eroticeye\.com([^a-z0-9\.]|$)
*  1100^1   innovativecreations\.com([^a-z0-9\.]|$)
*  1100^1   pornzine\.com([^a-z0-9\.]|$)
*  1100^1   prettyinpink\.com([^a-z0-9\.]|$)
*  1100^1   privategold\.com([^a-z0-9\.]|$)
*  1100^1   puritansex\.com([^a-z0-9\.]|$)
*  1100^1   schoolgirls\.com([^a-z0-9\.]|$)
*  1100^1   sexcenterfolds\.com([^a-z0-9\.]|$)
*  1100^1   sexillustrated\.com([^a-z0-9\.]|$)
*  1100^1   threesomes\.com([^a-z0-9\.]|$)
*  1100^1   truly18\.com([^a-z0-9\.]|$)
*  1100^1   vixxens\.com([^a-z0-9\.]|$)
*  1100^1   xxasians\.com([^a-z0-9\.]|$)
{ CYBERENTERTAINMENT=yes }

:0
* CYBERENTERTAINMENT ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Cyberentertainment Group"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# devondirect.com
#
# Updated and domains verified 6/25/02
# Last reported spam: 4/18/02
# Other Relevant Info:
#   4/18/02:
#     Spamming for Network Solutions/Verisign.
# Status: Active Spammers
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](205\.147\.216\.|\
           devondirect\.com([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: devondirect.com"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# discounts-direct.com/takecover.com
#
# Updated and domains verified 3/24/01
# Last reported spam: 2/05/01
# Other Relevant Info:
#     Spammers-for-hire for Hasbro.
# Status: Active Spammers
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](208\.226\.20[4-7]\.|\
          discounts-direct\.com([^a-z0-9\.]|$)|\
          takecover\.com([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: discounts-direct.com"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Guangzhou Liangxing Enterprise Company Ltd.
#
# Updated and domains verified 3/24/01
# Last reported spam:  2/06/01
# Other Relevant Info:
#
# Status: Retired Spammer
#
:0 BH
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*   800^1    Guangzhou Liangxing
*   800^1    Lee Fungliang
*   500^0    333 Tian He Long Kou
*   500^0    \+86\-20\-3848901(3|5)
{
:0 f
| ${FORMAIL} -A"X-SBRule: Guangzhou Liangxing"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Sam Khuri
#
# Updated and domains verified 5/02/02
# Last reported spam:  3/01/02
# Other Relevant Info:
#    7/11/99:
#     Long-time spammer in the Atlanta area, uses throwaways and doesn't
#     have a known email address or domain.  Identified here for
#     tracking purposes.
# Status: Active Spammer
#
:0 BH
* LEANTAG ?? no
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* !^Subject: .*\(fwd\)
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*   500^1    Benchmark Supply
*   500^1    D \& J Printing Corporation
*   500^1    Static Systems
*   500^1    Vertex Technologies
*   500^1    7540 Bridgegate
*   500^1    2564 Cochise Drive
*   300^1    Atlanta.*30350
*   300^1    Acworth.*30102
*  1000^1    770[-\. )]*399[-\. ]*0953
*  1000^1    770[-\. )]*974[-\. ]*8228
*  1000^1    800[-\. )]*586[-\. ]*0540
*  1000^1    800[-\. )]*650[-\. ]*5062
*  1000^1    888[-\. )]*288[-\. ]*9043
*  1000^1    888[-\. )]*977[-\. ]*1577
*  1000^1    888[-\. )]*248[-\. ]*4930
*  1000^1    dprint2000@aol\.com([^a-z0-9\.]|$)
*  1000^1    quickinspirations\.com([^a-z0-9\.]|$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Khuri"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# lc-mail.com
#
# Updated and domains verified 8/03/01
# Last reported spam: 6/10/01
# Other Relevant Info:
#
# Status: Active Spammers
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](209\.190\.47\.62|\
          lc-mail\.com([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: lc-mail.com"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}

# MessageMedia (Emailpub)
#
# Updated and domains verified 11/12/01
# Last reported spam: 11/06/01
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](195\.35\.10[0-3]\.|\
          195\.35\.104]\.[0-9]|\
          195\.35\.104]\.1[0-9]|\
          195\.35\.104]\.2[0-3]|\
          208\.169\.2[2-3]\.|\
          212\.23\.230\.|\
          messagemedia\.com([^a-z0-9\.]|$)|\
          0mme\.com([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: MessageMedia"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Opt-inbroadcasts.net/postmasternetworks.(com|net)
#
# Updated and domains verified 6/12/00
# Last reported spam: 5/18/00
# Other Relevant Info:
#    3/17/00 -- another "direct marketing" bulk email opt-out spamhaus, despite
#     the misleading domain name.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](opt-inbroadcasts\.net([^a-z0-9\.]|$)|\
          postmasternetworks?\.(com|net)([^a-z0-9\.]|$)|\
          traveltoday@beer\.com([^a-z0-9\.]|$))
{ OIB=yes }

:0 BH
* LEANTAG ?? no
* !^Subject:.*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*   600^0   ^From: .*[^0-9a-z].*@beer\.com([^a-z0-9\.]|$)
*   800^1   ^Subject: Thank you for joining
*   800^1   Opt-in Broadcast network
*  1100^1   opt-inbroadcasts\.net([^a-z0-9\.]|$)
*  1100^1   postmasternetworks\.(com|net)([^a-z0-9\.]|$)
*   800^1   copy.*subscriber.*opt-in email
{ OIB=yes }

:0
* OIB ?? yes
{
:0 f
| ${FORMAIL} -A"X-SBRule: opt-inbroadcasts/postmasternetworks"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Optinglobal.com
#
# Updated and domains verified 11/06/01
# Last reported spam: 10/25/01
# Other Relevant Info:
#    *DEFINITELY* opt-out spammers.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](209\.114\.218\.|\
          optinglobal\.com([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: Optinglobal.com"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# paid4survey.net
#
# Updated and domains verified 10/15/02
# Last reported spam: 8/14/02
# Other Relevant Info:
#    10/15/02:
#      NANAE reports that they've imploded -- the domain is up for grabs.
# Status: Dead Spammer
#
:0
* ^(Content-Location:|From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]paid4survey\.net([^a-z0-9\.]|$)
{ PAID4SURVEY=yes }

:0 BH
* LEANTAG ?? no
* !^Subject:.*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*  1100^1   paid4survey\.net([^a-z0-9\.]|$)
{ PAID4SURVEY=yes }

:0
* PAID4SURVEY ?? yes
{
:0 f
| ${FORMAIL} -A"X-SBRule: paid4survey.net"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Preferredmail.com
#
# Updated and domains verified 6/12/00
# Last reported spam: 3/08/00
# Other Relevant Info:
#    Apparently another "legitimate" postal direct mail house trying out
#     spamming. :(
#    3/08/00: Spamming on behalf of Apple Computer.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](206\.156\.198\.|\
          preferredmail\.com([^a-z0-9\.]|$)|\
          preferred-mail\.com([^a-z0-9\.]|$)|\
          preferred-mail\.net([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: PreferredMail"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# prognostics.com
#
# Updated and domains verified 8/14/01
# Last reported spam: 8/05/01
# Other Relevant Info:
#    Marketing research/surveys firm that spams on behalf of Dell Computer.
#    Sends unsolicited email to each Dell customer who orders online asking
#    them to complete a marketing survey.  Uncool. :(
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](165\.193\.8\.|\
          prognostics\.com([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: prognostics.com"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Software Services
#
# Updated and domains verified 3/24/01
# Last reported spam: 2/06/01
# Other Relevant Info:
#
# Status: Active Spammer
#
:0 BH
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*   600^0   Software Services([^a-z0-9\.]|$)
*   600^0   9824 South Western Avenue([^a-z0-9\.]|$)
*   600^0   Evergreen Park, IL 60805([^a-z0-9\.]|$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Software Services"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Sprint (via Harte Hanks)
#
# Updated and domains verified 10/19/01
# Last reported spam: 10/17/01
# Other Relevant Info:
#    Spam for Sprint via Harte Hanks, big bulk postal mail house that
#    also spams for hire.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*(208\.49\.146\.130|\
          (^|[^-_0-9a-z])ssprd2\.net([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: Sprint"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Universal Ad Systems
#
# Updated and domains verified 8/14/01
# Last reported spam: 8/07/01
# Other Relevant Info:
#    Intentional obscuring of phone number and other typical filter strings.
#    Slimeballs are trying to evade filtering, hence they got a filter of
#    their own. :)
# Status: Active Spammer
#
:0 BH
* LEANTAG ?? no
* !^Subject:.*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*   600^0   ^From: .*@doar\.net([^a-z0-9\.]|$)
*   600^0   ^Received:.*polcola\.com\.co([^a-z0-9\.]|$)
*  1100^1   tammismith@freeze\.com([^a-z0-9\.]|$)
*  1100^1   [2-9][ ][0-9][ ][0-9]\*[ ][0-9][ ][0-9][ ][0-9]\*[ ][0-9][ ][0-9][ ][0-9][ ][0-9]
*  1100^1   [2-9][ ][0-9][ ][0-9]\*[ ][0-9][ ][0-9][ ][0-9]\*[ ][0-9][ ][0-9][ ][0-9][ ][0-9]
*  1100^1   8[ ]?8[ ]?8[-\. )\*]6[ ]?0[ ]?5[-\. \*]2[ ]?4[ ]?8[ ]?5
*   800^1   U[ ]?n[ ]?i[ ]?v[ ]?e[ ]?r[ ]?s[ ]?a[ ]?l[ ][ ]?[ ]?A[ ]?d[ ][ ]?S[ ]?y[ ]?s[ ]?t[ ]?e[ ]?m[ ]?s
{
:0 f
| ${FORMAIL} -A"X-SBRule: Universal Ad Systems"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# WebSideStory
#
# Updated and domains verified 3/24/01
# Last reported spam: 2/07/01
# Other Relevant Info:
#
# Status: Inactive Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](hitbox\.com([^a-z0-9\.]|$)|\
          hitboxmailer\.com([^a-z0-9\.]|$)|\
          websidestory\.com([^a-z0-9\.]|$))
{ WSS=yes }

:0 BH
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*   600^0   Sean.*Shubert([^a-z0-9\.]|$)
*   800^0   Product Marketing Manager.*HitBox Pro([^a-z0-9\.]|$)
*   800^0   WebSideStory([^a-z0-9\.]|$)
*   800^0   858[-\. )]*546[-\. ]*0040([^a-z0-9\.]|$)
{ WSS=yes }

:0
* WSS ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: WebSideStory"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


