# Adult8 Porn Nest
#
# Updated and domains verified 12/12/02
# Last reported spam: 12/12/02
# Other Relevant Info:
#
#  12/10/02
#    Spamming via GNUZ World Enterprises.
#
# Status: Active Spammer
#
:0
* LEANTAG ?? no
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])adult8\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])jizzyboner\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])suckafat\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])supaclix\.com([^a-z0-9\.]|$)
 {
  :0 f
  | ${FORMAIL} -A"X-SBRule: Adult8"

  :0
  { SPAMTAG=yes }

  :0
  * SRC ?? yes
  * !ADMINTAG ?? yes
  * !BULKTAG ?? yes
  {
   :0
   { SPAMPID=`echo $$` }

   :0 c:
   spamtemp.${SPAMPID}

   :0 c: spamtemp.${SPAMPID}.lock
   | (${FORMAIL} -rt \
      -I"From: ${ALTFROM}" \
      -I"To: postmaster@adult8.com" \
      -I"Cc: abuse@cavecreek.com,spamtool@level3.net" \
      -A"X-Loop: ${NOLOOP}";\
      cat ${SBDIR}/spam;\
      cat spamtemp.${SPAMPID};\
      ${RM} -f spamtemp.${SPAMPID}) \
      | ${SENDMAIL} -oi -t
  }

  :0
  * SRB ?? yes
  { BOUNCETHIS=yes }
 }
}



# Cosmex Media
#
# Updated and domains verified 10/05/02
# Last reported spam:  10/05/02
# Other Relevant Info:
#    10/05/02:
#      Apparently a pornographic spamhaus.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](216\.89\.24[1-3]\.[0-9][0-9]?[0-9]?|\
          coochiemail\.com([^a-z0-9\.]|$)|\
          cosmexhosting\.com([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Cosmex Media"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: abuse@cosmexhosting.com" \
     -I"Cc: abuse@savvis.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# CP Cyberwurx (conepuppy.com)
#
# Updated and domains verified 11/06/02
# Last reported spam: 12/04/02
# Other Relevant Info:
#
#  4/25/02:
#   Chinese network with no reverse DNS, little valid info in APNIC,
#   no valid complaint email addresses, and a pattern of spamming.
#   Probably a spamhaus, but being blocked as a precaution.
#
#  11/06/02:
#   Definitely a spamhaus.  Plonk!
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](12\.25\.237\.[0-9][0-9]?[0-9]?|\
          66\.154\.[0-9]\.[0-9][0-9]?[0-9]?|\
          66\.154\.[1-8][0-9]\.[0-9][0-9]?[0-9]?|\
          66\.154\.9[0-5]\.[0-9][0-9]?[0-9]?|\
          conepuppy\.com([^a-z0-9\.]|$)|\
          cyberwurx\.com([^a-z0-9\.]|$)|\
          globalcompass\.com([^a-z0-9\.]|$)|\
          tiburondeltigre\.com([^a-z0-9\.]|$))
{ CPCYBER=yes }

:0
* LEANTAG ?? no
* !CPCYBER ?? yes
{
 :0 BH
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -500^0   ^Subject: Re:
 *  -200^1   ^[:;#>]
 *  1100^1    (^|[^-_0-9a-z])12\.25\.237\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])66\.154\.[0-9]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])66\.154\.[1-8][0-9]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])66\.154\.9[0-5]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])conepuppy\.com([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])cyberwurx\.com([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])globalcompass\.com([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])tiburondeltigre\.com([^a-z0-9\.]|$)
 { CPCYBER=yes }
}

:0
* CPCYBER ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: CP Cyberwurx"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: abuse@globalcompass.com,abuse@cyberwurx.com" \
     -I"Cc: abuse@att.net,abuse@webusenet.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
      cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# EmailPink
#
# Updated and domains verified 10/08/02
# Last reported spam:  10/08/02
# Other Relevant Info:
#     Persistent Japanese porn spam newsletter.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(asian3p\.com([^a-z0-9\.]|$)|\
          dirty-japanese-xxx\.com([^a-z0-9\.]|$)|\
          emailpink\.com([^a-z0-9\.]|$)|\
          japanesecockjockeys\.com([^a-z0-9\.]|$)|\
          japanesedirtysluts\.com([^a-z0-9\.]|$)|\
          pink-tv\.com([^a-z0-9\.]|$)|\
          sexyasiangirlsonline\.com([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: EmailPink"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@emailpink.com" \
     -I"Cc: dns@nttsupport.com,abuse@he.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# FlyntVision
#
# Updated and domains verified 2/18/03
# Last reported spam: 12/13/02
# Other Relevant Info:
#
#  12/13/02:
#    Getting a lot of spam from these nitwits in the last two
#    days, at spamtraps and at one of my personal email addresses.
#    Porn != spam, but porno spammers who don't care who they
#    send email to are especially offensive nonetheless.
#
# Status: Active Spammer
#
:0
* LEANTAG ?? no
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])flyntvision\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])pornadultdvds\.com([^a-z0-9\.]|$)
 {
  :0 f
  | ${FORMAIL} -A"X-SBRule: FlyntVision"

  :0
  { SPAMTAG=yes }

  :0
  * SRC ?? yes
  * !ADMINTAG ?? yes
  * !BULKTAG ?? yes
  {
   :0
   { SPAMPID=`echo $$` }

   :0 c:
   spamtemp.${SPAMPID}

   :0 c: spamtemp.${SPAMPID}.lock
   | (${FORMAIL} -rt \
      -I"From: ${ALTFROM}" \
      -I"To: postmaster@flyntvision.com,postmaster@pornadultdvds.com,jdonner@flyntvision.com" \
      -I"Cc: abuse@exodus.net,abuse@cw.net" \
      -A"X-Loop: ${NOLOOP}";\
      cat ${SBDIR}/spam;\
      cat spamtemp.${SPAMPID};\
      ${RM} -f spamtemp.${SPAMPID}) \
      | ${SENDMAIL} -oi -t
  }

  :0
  * SRB ?? yes
  { BOUNCETHIS=yes }
 }
}


# GiantWeb porn nest
#
# Updated and domains verified 11/05/02
# Last reported spam: 12/11/02
# Other Relevant Info:
#
#  8/17/02:
#   Porn spammers, use throwaway dial-ups, email handled through
#   separate place.  Spamming assholes. :(
#
#  11/05/02:
#    Still at it.
#
#  12/11/02:
#   New netblocks. <sigh>
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(209\.203\.16[0-9]\.[0-9][0-9]?[0-9]?|\
          209\.203\.17[0-5]\.[0-9][0-9]?[0-9]?|\
          celeb-xxx\.net([^a-z0-9\.]|$)|\
          thepornlottery\.com([^a-z0-9\.]|$))
{ GIANTWEB=yes }

:0
* LEANTAG ?? no
* ! GIANTWEB ?? no
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])209\.203\.16[0-9]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])209\.203\.17[0-5]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])celeb-xxx\.net([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])thepornlottery\.com([^a-z0-9\.]|$)
 *   800^0   ^Congratulations You\'ve Won A Free Password!!!!$
 *   800^0   ^And You Are A Lucky Winner!!!!$
 *   500^0   (^|[^-_0-9a-z])Free (Membership|Password)([^a-z0-9\.]|$)
 *   800^0   (^|[^-_0-9a-z])fools who pay for memberships([^a-z0-9\.]|$)
 *   500^0   (^|[^-_0-9a-z])I hate free porn([^a-z0-9\.]|$)
 { GIANTWEB=yes }
}

:0
* GIANTWEB ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Giantweb"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: abuse@giantweb.com" \
     -I"Cc: abuse@verio.net,abuse@internap.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}



# Kellu.com
#
# Updated and domains verified 12/13/02
# Last reported spam:  12/13/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(64\.57\.64\.18(2|4)|\
          kellu\.com([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: kellu.com"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@kellu.com" \
     -I"Cc: abuse@bluegravity.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Kirrill Mussonov
#
# Updated and domains verified 12/06/02
# Last reported spam: 12/06/02
# Other Relevant Info:
#
#   12/06/02:
#     Probably a morph of some other Russian Porn nest, but listed
#     separately for now, under the name of the domain registrar.
#     Uses lots of misspellings, filter evasion techniques.
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(12\.237\.151\.95|\
          hardpornsites\.com([^a-z0-9\.]|$))
{ KIRRILLM=yes }

:0
* LEANTAG ?? no
* ! KIRRILLM ?? yes
* !^Subject: .*\(fwd\)
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])12\.237\.151\.95([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])hardpornsites\.com([^a-z0-9\.]|$)
 { KIRRILLM=yes }
}

:0
* KIRRILLM ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Kirrill Mussonov"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@hardpornsites.com" \
     -I"Cc: abuse@telesp.net.br,kirrill-mussonov@nm.ru" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Now Online
#
# Updated and domains verified 2/18/03
# Last reported spam: 1/12/03
# Other Relevant Info:
#
#  1/12/03:
#    Pornadultdvds.com moved to here from FlyntVision.
#
# Status: Active Spammer
#
:0
* LEANTAG ?? no
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])pornadultdvds\.com([^a-z0-9\.]|$)
 {
  :0 f
  | ${FORMAIL} -A"X-SBRule: NOW Online"

  :0
  { SPAMTAG=yes }

  :0
  * SRC ?? yes
  * !ADMINTAG ?? yes
  * !BULKTAG ?? yes
  {
   :0
   { SPAMPID=`echo $$` }

   :0 c:
   spamtemp.${SPAMPID}

   :0 c: spamtemp.${SPAMPID}.lock
   | (${FORMAIL} -rt \
      -I"From: ${ALTFROM}" \
      -I"To: postmaster@pornadultdvds.com" \
      -I"Cc: abuse@e-command.net,abuse@gblx.net" \
      -A"X-Loop: ${NOLOOP}";\
      cat ${SBDIR}/spam;\
      cat spamtemp.${SPAMPID};\
      ${RM} -f spamtemp.${SPAMPID}) \
      | ${SENDMAIL} -oi -t
  }

  :0
  * SRB ?? yes
  { BOUNCETHIS=yes }
 }
}


# "Rape" spammers :/
#
# Updated and domains verified 12/09/02
# Last reported spam:  12/09/02
# Other Relevant Info:
#
#  10/21/2002:
#    Incredibly disgusting, graphic, rape and murder spam.  Probably is fake,
#    but the stuff is turning my stomach, so I'm giving it its own recipe.
#    The sites are hosted in places as far apart as Russia and Nigeria, but
#    always in countries where this stuff is either legal or is not
#    in practice prosecuted.
#
#  12/09/02:
#    They're still at it. :(
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(cockrape\.com([^a-z0-9\.]|$)|\
          fullrape\.com([^a-z0-9\.]|$)|\
          rapesocket\.com([^a-z0-9\.]|$)|\
          russianrape\.com([^a-z0-9\.]|$))
{ RAPEPORN=yes }

:0
* LEANTAG ?? no
* ! RAPEPORN ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *   600^0   ^From:.*illegal@
 *   600^0   ^From:.*@porno\.com([^a-z0-9\.]|$)
 *   600^0   ^Subject:.*@Illegal
 *  1100^0   (^|[^-_0-9a-z])animerape.com\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])birape.com\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])fullrape.com\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])pornocruto\.nu([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])rape-3in1\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])rapebrutal\.com\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])rapedasians.com\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])rapehere\.com\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])rapelist\.com\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])rapesocket\.com\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])russianrape\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])screamandcream\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])teen-stop\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])uniformrape\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])violentcomix\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])yui1104\.com([^a-z0-9\.]|$)
 { RAPEPORN=yes }
}

:0
* RAPEPORN ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Rape PornHouse"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@holeporn.com" \
     -I"Cc: abuse@hostcentric.com,abuse@eltel.net,abuse@isprime.com,abuse@rackspace.com" \
     -A"Cc: abuse@sxpress.com,abuse@uu.net,abuse@ev1.net,abuse@yipes.com" \
     -A"X-Loop: ${NOLOOP}";\
     echo " ";\
     echo "Nauseating pornographic spam that is probably illegal in most";\
     echo "jurisdictions is attached to the bottom of this email.  Because of";\
     echo "the extremely similar spam text and approach of a number of porn";\
     echo "spammers that exploit rape and violence, they got stuck in one ";\
     echo "complaint recipe.  That is, they are probably, although not ";\
     echo "certainly, related to one another.";\
     echo " ";\
     echo "EV1 -- you host rapelist.com.  Ditto.";\
     echo " ";\
     echo "IsPrime -- you host fullrape.com.  Ditto.";\
     echo " ";\
     echo "Maxim/HostCentric -- you host violentcomix.com.  Ditto.";\
     echo " ";\
     echo "Rackspace -- you host animerape.com, birape.com, pornocruto.nu, ";\
     echo "rapedasians.com, russianrape.com, screamandcream.com, teen-stop.com,";\
     echo "and uniformrape.com.  Please disconnect your porn spam nest.";\
     echo " ";\
     echo "SXpress -- you host rape-3in1.com and rapehere.com.  Ditto.";\
     echo " ";\
     echo "UUNet -- you host rapebrutal.com and rapesocket.com.  Ditto.";\
     echo " ";\
     echo "Yipes -- you host yui1104.com.  Ditto.";\
     echo " ";\
     echo "=-=-=-=-=-=-=-=-=-=";\
     echo " ";\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# S. M. Marketing, Inc.
#
# Updated and domains verified 2/18/03
# Last reported spam: 2/15/03
# Other Relevant Info:
#
#  2/15/03:
#   Long-time spammers that change domain names rapidly and
#   move around to fly under the radar.
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(203\.26\.22[6-7]\.[0-9][0-9]?[0-9]?|\
          ceniche\.com([^a-z0-9\.]|$)|\
          global-carrier\.net([^a-z0-9\.]|$)|\
          instantmove\.com([^a-z0-9\.]|$)|\
          maxpenalty\.com([^a-z0-9\.]|$)|\
          sci-tec\.net([^a-z0-9\.]|$)|\
          techescape\.com([^a-z0-9\.]|$))
{ SMMARKET=yes }

:0
* LEANTAG ?? no
* ! SMMARKET ?? yes
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])203\.26\.22[6-7]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])ceniche\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])global-carrier\.net([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])instantmove\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])maxpenalty\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])sci-tec\.net([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])techescape\.com([^a-z0-9\.]|$)
 { SMMARKET=yes }
}

:0
* SMMARKET ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: S. M. Marketing"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: techhelpdesk@sci-tec.net" \
     -I"Cc: abuse@theplanet.com,abuse@uu.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# StudioCEV
#
# Updated and domains verified 12/09/02
# Last reported spam: 12/09/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(209\.17\.84\.[0-9]|\
          209\.17\.84\.1[0-5]|\
          216\.136\.134\.[0-9]|\
          216\.136\.134\.[1-9][0-9]|\
          216\.136\.134\.1[0-1][0-9]|\
          216\.136\.134\.12[0-7]|\
          amateurwhore\.net([^a-z0-9\.]|$)|\
          chubbyams\.com([^a-z0-9\.]|$)|\
          contdiskman\.net([^a-z0-9\.]|$)|\
          hot-americanteens\.com([^a-z0-9\.]|$)|\
          lesbianfunhouse\.com([^a-z0-9\.]|$)|\
          nympho-sluts\.com([^a-z0-9\.]|$)|\
          smalltitties\.net([^a-z0-9\.]|$)|\
          studiocev\.com([^a-z0-9\.]|$)|\
          usvirgins\.com([^a-z0-9\.]|$)|\
          virginpussies\.net([^a-z0-9\.]|$))
{ STUDIOCEV=yes }

:0
* LEANTAG ?? no
* ! STUDIOCEV ?? yes
* !^Subject: .*\(fwd\)
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])209\.17\.84\.[0-9]([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])209\.17\.84\.1[0-5]([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])216\.136\.134\.[0-9]([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])216\.136\.134\.[1-9][0-9]([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])216\.136\.134\.1[0-1][0-9]([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])216\.136\.134\.12[0-7]([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])amateurwhore\.net([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])chubbyams\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])contdiskman\.net([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])hot-americanteens\.net([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])lesbianfunhouse\.net([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])nympho-sluts\.net([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])smalltitties\.net([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])studiocev\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])usvirgins\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])virginpussies\.net([^a-z0-9\.]|$)
 { STUDIOCEV=yes }
}

:0
* STUDIOCEV ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: StudioCEV"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0
  { GRIPETO=uce@ftc.gov }

  :0
  * ^Received:.*(^|[^0-9])(209\.17\.84\.[0-9]|\
                           209\.17\.84\.1[0-5])([^0-9\.]|$)
  { GRIPETO=$GRIPETO,abuse@optigate.net }

  :0
  * ^Received:.*(^|[^0-9])(216\.136\.134\.[0-9]|\
                           216\.136\.134\.[1-9][0-9]|\
                           216\.136\.134\.1[0-1][0-9]|\
                           216\.136\.134\.12[0-7]|\
                           amateurwhore\.net|\
                           chubbyams\.com|\
                           contdiskman\.net|\
                           hot-americanteens\.com|\
                           lesbianfunhouse\.com|\
                           nympho-sluts\.com|\
                           smalltitties\.net|\
                           studiocev\.com|\
                           usvirgins\.com|\
                           virginpussies\.net)([^0-9\.]|$)
  { GRIPETO=$GRIPETO,abuse@exodus.net,abuse@cw.net,webmaster@whitcon.net,abuse@whitcon.net }

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@studiocev.com,postmaster@usvirgins.com" \
     -I"Cc: ${GRIPETO}" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# VeriFast Network Porn Nest
#
# Updated and domains verified 12/11/02
# Last reported spam: 12/11/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* LEANTAG ?? no
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *   600^0   ^Subject:.*Babe Of The Week
 *  1100^0   (^|[^-_0-9a-z])66\.28\.252\.[0-9]([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])66\.28\.252\.1[0-5]([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])verisexy\.net([^a-z0-9\.]|$)
 *   600^0   (^|[^-_0-9a-z])Webunlimited Newsletter([^a-z0-9\.]|$)
 {
  :0 f
  | ${FORMAIL} -A"X-SBRule: VeriFast Network"

  :0
  { SPAMTAG=yes }

  :0
  * SRC ?? yes
  * !ADMINTAG ?? yes
  * !BULKTAG ?? yes
  {
   :0
   { SPAMPID=`echo $$` }

   :0 c:
   spamtemp.${SPAMPID}

   :0 c: spamtemp.${SPAMPID}.lock
   | (${FORMAIL} -rt \
      -I"From: ${ALTFROM}" \
      -I"To: postmaster@adult8.com" \
      -I"Cc: abuse@cavecreek.com,spamtool@level3.net" \
      -A"X-Loop: ${NOLOOP}";\
      cat ${SBDIR}/spam;\
      cat spamtemp.${SPAMPID};\
      ${RM} -f spamtemp.${SPAMPID}) \
      | ${SENDMAIL} -oi -t
  }

  :0
  * SRB ?? yes
  { BOUNCETHIS=yes }
 }
}



# "World Trade Center" Porn Spammers
#
# Updated and domains verified 2/21/03
# Last reported spam:  2/21/03
# Other Relevant Info:
#
#  12/10/02:
#    Porn spammer that uses lots of filter evasion, etc. :/  Goes by "World Trade Center"
#    (not nice) and is under Eltel.net in Russia.
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](81\.9\.10\.3[2-9]|\
          81\.9\.10\.[4-5][0-9]|\
          81\.9\.10\.6[0-3]|\
          Last Raper([^a-z0-9\.]|$))
{ ELTELPORNHAUS=yes }

:0
* LEANTAG ?? no
* ! ELTELPORNHAUS ?? yes
* !^Subject: .*\(fwd\)
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])81\.9\.10\.3[2-9]([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])81\.9\.10\.[4-5][0-9]([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])81\.9\.10\.6[0-3]([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])cockrape\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])horsejaculation\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])pizdolet\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])rapecunt\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])rapnstuff\.com([^a-z0-9\.]|$)
 *   600^1   (^|[^-_0-9a-z])make sekks([^a-z0-9\.]|$)
 *   600^1   (^|[^-_0-9a-z])p&nbsp;0&nbsp;r n([^a-z0-9\.]|$)
 { ELTELPORNHAUS=yes }
}

:0
* ELTELPORNHAUS ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Eltel Porn Spammer"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: abuse@eltel.net" \
     -I"Cc: postmaster@rm-rf.info,abuse@teklan.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


