# Luke Fictitiouis
#
# Updated and domains verified 12/11/02
# Last reported spam: 12/11/02
# Other Relevant Info:
#
#    12/11/02:
#      Annoying "fanboy" spammers.  I don't know if this is intended
#      just to annoy anti-spammers or is a real TV/Cable show.
#      (The disadvantages of not owning a TV -- I don't know what
#      is real TV and what isn't.) :)  They're in the nuisance
#      file because they appear to have no specific web presence,
#      or at least none they mention in their spam.
#
# Status: Active Spammer
#
:0
* LEANTAG ?? no
{
 :0 BH
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *   800^0   ^From:.*(wethinkurbeautiful@.*)([^a-z0-9\.]|$)
 *   800^0   ^Subject: (FW: |Re: )?(Who Loves YOU(\?)+ we do that's who!+)$
 *   600^1   (^|[^-_0-9a-z])Luke( )?fictitious([^a-z0-9\.]|$)
 *   600^1   (^|[^-_0-9a-z])Luke\'s secret following([^a-z0-9\.]|$)
 { LUKEFICTITIOUS=yes }
}

:0
* LUKEFICTITIOUS ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Luke Fictitious"

 :0
 { SPAMTAG=yes }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}



# Miniature Radio-Controlled Car spam
#
# Updated and domains verified 12/11/02
# Last reported spam: 12/11/02
# Other Relevant Info:
#
#    11/21/02:
#      Extraordinarily pushy spammers who use every trick in the books to avoid
#      filtering and complaints. :(
#
#    12/11/02:
#      These spammers have hired many of the high-volume spamhauses to push
#      their stuff.  They are apparently making a huge push for Christmas,
#      and aren't the only ones.  They have no single web presence, so
#      they're here in the Nuisance file so that they'll be caught, if
#      not autoreplied to.
#
# Status: Active Spammer
#
:0
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
{
 :0 BH
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *   800^0   ^From:.*(Mini|Micro) (RC|Race Cars?)
 *   800^0   ^Subject: (FW: |Re: )?(Mini.(Matchbox|RC|R/C|Race Cars?|Racer)|\
                                    MINI R(ADIO)?.?C(ONTROLLED)? CARS|\
                                    Remote Controlled Mini.*Cars|\
                                    Remote Control Car.*Hot Wheel)$
 *  1100^1   (^|[^-_0-9a-z])(CustBlast@cs\.com|\
                             praclicars\.com)([^a-z0-9\.]|$)
 *   400^1   (^|[^-_0-9a-z])Matchbox sized car with a mini remote control([^a-z0-9\.]|$)
 *   400^1   (^|[^-_0-9a-z])Micro Racers?([^a-z0-9\.]|$)
 *   800^1   (^|[^-_0-9a-z])Mini[ ]?(.*$)?Radio[ ]?(.*$)?Controlled[ ]?(.*$)?Racers([^a-z0-9\.]|$)
 *   400^1   (^|[^-_0-9a-z])Mini.(Matchbox|RC|R/C|Race Cars?|Racer)([^a-z0-9\.]|$)
 *   400^1   (^|[^-_0-9a-z])R/C([^a-z0-9\.]|$)
 *   400^1   (^|[^-_0-9a-z])Remote_Controlled([^a-z0-9\.]|$)
 *   400^1   (^|[^-_0-9a-z])six direction radio controlled \(r/c\)([^a-z0-9\.]|$)
 *   400^1   (^|[^-_0-9a-z])smallest radio controlled cars.*world([^a-z0-9\.]|$)
 *   400^1   (^|[^-_0-9a-z])The hot new toy for Christmas([^a-z0-9\.]|$)
 *   400^1   (^|[^-_0-9a-z])The World's Smallest Radio-Controlled Car([^a-z0-9\.]|$)
 *   400^1   (^|[^-_0-9a-z])this year.?s hottest Christmas gift([^a-z0-9\.]|$)
 *   400^1   (^|[^-_0-9a-z])wireless Remote Controlled Mini Car([^a-z0-9\.]|$)
 { MINIREMOTECARS=yes }
}

:0
* MINIREMOTECARS ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Miniature Remote-Controlled Cars"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0
  { GRIPECC=uce@ftc.gov }

  :0
  * ^Received:.*(^|[^0-9])(24\.16[0-9]\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\
                           24\.170\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?)([^0-9\.]|$)
  { GRIPECC=$GRIPETO,abuse@rr.com }

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@praclicars.com,abuse@burst.net,abuse@hostnoc.net" \
     -I"Cc: ${GRIPECC}" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Norton/Symantec Spammers
#
# Updated and domains verified 2/20/03
# Last reported spam: 2/20/03
# Other Relevant Info:
#
#    2/20/03:
#     Aggressive bunch of spammers pushing Norton/Symantec products.
#     These spammers are not Symantec -- Symantec's opinion of spam
#     approximates mine.
#
# Status: Active Spammer
#
:0
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
{
 :0 BH
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *   400^0   ^From: \"\" <[0-9a-z][-_0-9a-z]*@[0-9a-z][-_0-9a-z\.]*>
 *   800^0   ^Subject: slght jeal([^a-z0-9\.]|$)
 *   800^0   ^\*NEW-Special Package Deal!\*$
 *   800^1   ^Norton SystemWorks 200[0-9] Software Suite -Professional Edition-$
 *   800^1   (^|[^-_0-9a-z])3fia\.com([^a-z0-9\.]|$)
 *   800^1   (^|[^-_0-9a-z])ebargain-masters-web\.com([^a-z0-9\.]|$)
 { NSYMSPAM=yes }
}

:0
* NSYMSPAM ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Bogus Norton/Symantec spam"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0
  { GRIPETO=uce@ftc.gov }

  :0
  * ^Received:.*(^|[^0-9])(12\.37\.112\.[0-9]|12\.37\.112\.1[0-5])([^0-9\.]|$)
  { GRIPETO=$GRIPETO,postmaster@sydneymicrosystems.com,abuse@att.net }

  :0 BH
  * (^|[^0-9a-z])3fia\.com([^a-z0-9\.]|$)
  { GRIPETO=$GRIPETO,postmaster@3fia.com,abuse@capitalnet.com.cn,dandan.zhao@capitalnet.com.cn,csd@capitalnet.com.cn }

  :0 BH
  * (^|[^0-9a-z])ebargain-masters-web\.com([^a-z0-9\.]|$)
  { GRIPETO=$GRIPETO,postmaster@ebargain-masters-web.com,bjit@21cncorp.com }

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: ${GRIPETO}" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}

