# 3dpageturningebook.com
#
# Updated and domains verified 12/06/02
# Last reported spam:  12/06/02
# Other Relevant Info:
#
#   12/06/02:
#     Not high volume, but hugely persistent and has hit several
#     spamtraps of various types.
#
# Status: Active Spammer
#
:0
* LEANTAG ?? no
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -500^0   ^Subject: Re:
 *  -200^1   ^[:;#>]
 *  1100^1   (^|[^-_0-9a-z])3dpageturningebook\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])digitalauthoringtools\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])image777\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])v-broker\.com(\.au)?([^a-z0-9\.]|$)
 {
  :0 f
  | ${FORMAIL} -A"X-SBRule: 3dpageturningebook.com"

  :0
  { SPAMTAG=yes }

  :0
  * SRC ?? yes
  * !ADMINTAG ?? yes
  * !BULKTAG ?? yes
  {
   :0
   { SPAMPID=`echo $$` }

   :0 c:
   spamtemp.${SPAMPID}

   :0 c: spamtemp.${SPAMPID}.lock
   | (${FORMAIL} -rt \
      -I"From: ${ALTFROM}" \
      -I"To: mail@3dpageturningebook.com,postmaster@3dpageturningebook.com,postmaster@edatahome.com" \
      -I"Cc: abuse@shaidc.com,abuse@online.sh.cn,cyy@online.sh.cn,jping@online.sh.cn,webmaster@online.sh.cn" \
      -A"X-Loop: ${NOLOOP}";\
      cat ${SBDIR}/spam;\
      cat spamtemp.${SPAMPID};\
      ${RM} -f spamtemp.${SPAMPID}) \
      | ${SENDMAIL} -oi -t
  }

  :0
  * SRB ?? yes
  { BOUNCETHIS=yes }
 }
}


# Alloy Online
#
# Updated and domains verified 11/20/02
# Last reported spam: 11/20/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(209\.225\.55\.[0-9][0-9]?[0-9]?|\
          alloy\.com([^a-z0-9\.]|$)|\
          mylistmailing\.com([^a-z0-9\.]|$))
{ ALLOYONLINE=yes }

:0
* LEANTAG ?? no
* ! ALLOYONLINE ?? yes
* !^Subject: .*\(fwd\)
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])209\.225\.55\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])alloy\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])mylistmailing\.com([^a-z0-9\.]|$)
 { ALLOYONLINE=yes }
}

:0
* ALLOYONLINE ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Alloy Online"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@mylistmailing.com,hostmaster@alloy.com,urlcontact@alloy.com" \
     -I"Cc: abuse@exodus.net,abuse@cw.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# artprice.com
#
# Updated and domains verified 9/10/02
# Last reported spam:  11/07/02
# Other Relevant Info:
#     For what should be a small-time company, these guys are
#     really persistent spammers, spamming even the autoresponder
#     at a non-profit domain I run.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(artmarket\.com([^a-z0-9\.]|$)|\
          artprice\.com([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: artprice.com"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@artmarket.com,postmaster@artprice.com" \
     -I"Cc: abuse@fr.colt.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Atomicdot1.com
#
# Updated and domains verified 11/23/02
# Last reported spam: 11/23/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(66\.79\.10\.[0-9][0-9]?[0-9]?|\
          209\.164\.30\.[0-9][0-9]?[0-9]?|\
          atomicdot1\.(com|net)([^a-z0-9\.]|$))
{ ATOMICDOT1=yes }

:0
* LEANTAG ?? no
* ! ATOMICDOT1 ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])66\.79\.10\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])209\.164\.30\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])atomicdot1\.(com|net)([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])sexyadultpages\.com([^a-z0-9\.]|$)
 { ATOMICDOT1=yes }
}

:0
* ATOMICDOT1 ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Atomicdot1"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@atomicdot1.com,postmaster@atomicdot1.net" \
     -I"Cc: abuse@madisonriver.net,postmaster@deltanet.com,abuse@xo.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# bay9.com
#
# Updated and domains verified 6/25/02
# Last reported spam:  5/29/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(63\.87\.242\.12[8-9]|\
          63\.87\.242\.1[3-8][0-9]|\
          63\.87\.242\.19[0-1]|\
          63\.87\.243\.|\
          209\.73\.205\.9[6-9]|\
          209\.73\.205\.1[0-1][0-9]|\
          209\.73\.205\.12[0-7]|\
          bay9\.com([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: Bay9.com"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: postmaster@bay9.com" \
    -I"Cc: abuse@globix.com,abuse@nyc-ip.net" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
 }

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# bigwhat.com
#
# Updated and domains verified 7/31/02
# Last reported spam:  1/08/02
# Other Relevant Info:
#    11/11/01 -- pesters registered domain contacts of web sites it locates
#     to "update their information", despite their never having requested
#     listing in this list. :/  Uncool.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*bigwhat\.com([^a-z0-9\.]|$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Bigwhat.com"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@bigwhat.com" \
     -I"Cc: abuse@dialtone.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# bigwho.com
#
# Updated and domains verified 7/31/02
# Last reported spam:  1/08/02
# Other Relevant Info:
#    11/11/01 -- pesters registered domain contacts of web sites it locates
#     to "update their information", despite their never having requested
#     listing in this list. :/  Uncool.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*bigwho\.com([^a-z0-9\.]|$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Bigwho.com"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@bigwho.com" \
     -I"Cc: abuse@verio.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Chya Dann Enterprises
#
# Updated and domains verified 7/30/02
# Last reported spam:  7/30/02
# Other Relevant Info:
#    Prolific Hong-Kong based spammers, manufacturers of computer
#    peripherals.
# Status: Active Spammer
#
:0 BH
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*   800^1   CHYA DANN
*   800^1   texas?comtech\.com([^a-z0-9\.]|$)
*   800^1   O755[-\. ()]*8759053([^a-z0-9\.]|$)
*   800^1   886[-\. ()]*2[-\. )]*29170979([^a-z0-9\.]|$)
*   800^1   886[-\. ()]*2[-\. )]*29137636([^a-z0-9\.]|$)
*   800^1   hongkong@.*hinet\.net([^a-z0-9\.]|$)
*   800^1   texascom[1-9][0-9]*@163\.com([^a-z0-9\.]|$)
*   800^1   5F(.*$)+No(.*$)+135(.*$)+Pao-Chung Road(.*$)+Hsin-Tien City(.*$)+Taipei
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Chya Dann"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: spam@ms1.hinet.net,texascom711@163.com,mit_domainadm@hichina.com" \
     -I"Cc: postmaster@hichina.com,support@chinanetcenter.com,support@hichina.com,spamcomplaints@cw.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Clickman LLC (Or possibly just customers of theirs)
#
# Updated and domains verified 11/21/02
# Last reported spam: 11/21/02
# Other Relevant Info:
#
#  11/15/02:
#    Aggressive new spammer using lots of new domains.
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](64\.89\.1[6-9]\.[0-9][0-9]?[0-9]?|\
          64\.89\.2[0-9]\.[0-9][0-9]?[0-9]?|\
          64\.89\.3[0-1]\.[0-9][0-9]?[0-9]?|\
          66\.239\.3\.[0-9][0-9]?[0-9]?|\
          216\.218\.220\.[0-9][0-9]?[0-9]?|\
          216\.218\.242\.[0-9][0-9]?[0-9]?|\
          dailycomnet\.com([^a-z0-9\.]|$)|\
          diginetcom\.com([^a-z0-9\.]|$)|\
          infotechcom\.com([^a-z0-9\.]|$)|\
          intranetcom\.net([^a-z0-9\.]|$)|\
          nettechno\.net([^a-z0-9\.]|$)|\
          network3000\.net([^a-z0-9\.]|$)|\
          technocomnet\.net([^a-z0-9\.]|$))
{ CLICKMANLLC=yes }

:0
* LEANTAG ?? no
* ! CLICKMANLLC ?? yes
{
 :0 BH
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -500^0   ^Subject: Re:
 *  -200^1   ^[:;#>]
 *  1100^1    (^|[^-_0-9a-z])64\.89\.1[6-9]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])64\.89\.2[0-9]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])64\.89\.3[0-1]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])66\.239\.3\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])216\.218\.220\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])216\.218\.242\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])dailycomnet\.com([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])diginetcom\.com([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])infotechcom\.com([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])intranetcom\.net([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])nettechno\.net([^a-z0-9\.]|$)
 *  1100^1    (^|[^-_0-9a-z])network3000\.net([^a-z0-9\.]|$)
 { CLICKMANLLC=yes }
}

:0
* CLICKMANLLC ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Clickman LLC"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0
  * ^Received:.*(^|[^0-9])(64\.89\.1[6-9]\.[0-9][0-9]?[0-9]?|\
                           64\.89\.2[0-9]\.[0-9][0-9]?[0-9]?|\
                           64\.89\.3[0-1]\.[0-9][0-9]?[0-9]?|\
                           216\.218\.220\.[0-9][0-9]?[0-9]?|\
                           216\.218\.242\.[0-9][0-9]?[0-9]?)([^0-9\.]|$)
  { CLICKGRIPE=yes }

  :0 BH
  * ((^|[^0-9a-z])diginetcom\.com([^a-z0-9\.]|$)|\
     (^|[^0-9a-z])intranetcom\.com([^a-z0-9\.]|$)|\
     (^|[^0-9a-z])nettechno\.net([^a-z0-9\.]|$)|\
     (^|[^0-9a-z])network3000\.net([^a-z0-9\.]|$))
  { CLICKGRIPE=yes }

  :0
  * ^Received:.*(^|[^0-9])211\.152\.5[1-2]\.[0-9][0-9]?[0-9]?([^0-9\.]|$)
  { VIANETGRIPE=yes }

  :0 BH
  * (^|[^0-9a-z])infotechcom\.com([^a-z0-9\.]|$)
  { VIANETGRIPE=yes }

  :0
  * ^Received:.*(^|[^0-9])66\.239\.3\.[0-9][0-9]?[0-9]?([^0-9\.]|$)
  { XOGRIPE=yes }

  :0 BH
  * (^|[^0-9a-z])dailycomnet\.com([^a-z0-9\.]|$)
  { XOGRIPE=yes }

  :0
  * CLICKGRIPE ?? yes
  { GRIPETO=postmaster@clickman.com,abuse@he.net }

  :0
  * VIANETGRIPE ?? yes
  { GRIPETO=${GRIPETO},dns_mgr@21vianet.com,dns_admin@21vianet.com,shanghai@21vianet.com,abuse@online.sh.cn }

  :0
  * XOGRIPE ?? yes
  { GRIPETO=${GRIPETO},abuse@xo.com }

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: ${GRIPETO}" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Commission Junction
#
# Updated and domains verified 12/06/02
# Last reported spam:  12/06/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(63\.236\.5\.12[8-9]|\
          63\.236\.5\.1[3-5][0-9]|\
          207\.71\.241\.8[0-9]|\
          207\.71\.241\.9[0-5]|\
          216\.34\.209\.[0-9]|\
          216\.34\.209\.[1-2][0-9]|\
          216\.34\.209\.3[0-1]|\
          cj\.com|\
          qksrv\.net)([^a-z0-9\.]|$)
{ COMMISSIONJUNCTION=yes }

:0
* LEANTAG ?? no
* ! COMMISSIONJUNCTION ?? yes
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^1   (^|[^-_0-9a-z])63\.236\.5\.12[8-9]([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])63\.236\.5\.1[3-5][0-9]([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])207\.71\.241\.8[0-9]([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])207\.71\.241\.9[0-5]([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])216\.34\.209\.[0-9]([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])216\.34\.209\.[1-2][0-9]([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])216\.34\.209\.3[0-1]([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])cj\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])qksrv\.net([^a-z0-9\.]|$)
 { COMMISSIONJUNCTION=yes }
}

:0
* COMMISSIONJUNCTION ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Commission Junction"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: cjspamcomplaint@custhelp.com" \
     -I"Cc: abuse@exodus.net,abuse@cw.net,abuse@silcom.com,admin@silcom.com,abuse@qwest.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# DealDelivery
#
# Updated and domains verified 11/19/02
# Last reported spam: 11/04/02
# Other Relevant Info:
#   11/04/02:
#     Another fine RackSpace spammer. :/
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(66\.216\.107\.[0-9][0-9]?[0-9]?|\
          championoffers\.com([^a-z0-9\.]|$)|\
          dealdelivery\.com([^a-z0-9\.]|$))
{ DEALDELIVERY=yes }

:0
* LEANTAG ?? no
* ! DEALDELIVERY ?? yes
{
 :0 B
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])66\.216\.107\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])championoffers\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])dealdelivery\.com([^a-z0-9\.]|$)
 { DEALDELIVERY=yes }
}

:0
* DEALDELIVERY ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: DealDelivery"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@dealdelivery.com,abuse@dealdelivery.com" \
     -I"Cc: abuse@rackspace.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# dlbdirect.com
#
# Updated and domains verified 11/08/02
# Last reported spam:  10/26/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(63\.251\.57\.[0-9][0-9]?[0-9]?|\
          dlbdirect\.com([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: dlbdirect.com"

:0
{ SPAMTAG=yes }

:0
* SRC ?? yes
* !ADMINTAG ?? yes
* !BULKTAG ?? yes
{
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: postmaster@dlbdirect.com,clientrelations@dlbdirect.com" \
    -I"Cc: abuse@internap.com" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
 }

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# eBiz Media Group
#
# Updated and domains verified 10/11/02
# Last reported spam: 10/30/02
# Other Relevant Info:
#
# Status: Active Spammers
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](64\.32\.48\.[0-9][0-9]?[0-9]?|\
          beawnez\.com([^a-z0-9\.]|$)|\
          speedi-list\.com([^a-z0-9\.]|$)|\
          speedi-services\.com([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: eBiz Media Group"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: abuse@beawnez.com" \
     -A"Cc: abuse@speedi-services.com,abuse@relaypoint.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# E-Business News
#
# Updated and domains verified 12/09/02
# Last reported spam: 12/09/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*E-Business News([^a-z0-9\.]|$)
{ EBUSINESSNEWS=yes }

:0
* LEANTAG ?? no
* ! EBUSINESSNEWS ?? yes
* !^Subject: .*\(fwd\)
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])gov-invest\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])virtual-biz\.net([^a-z0-9\.]|$)
 { EBUSINESSNEWS=yes }
}

:0
* EBUSINESSNEWS ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: E-Business News"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: info@gov-invest.com,remove@gov-invest.com,sales@virtual-biz.net" \
     -I"Cc: uce@ftc.gov" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Email4Luck
#
# Updated and domains verified 11/20/02
# Last reported spam: 11/20/02
# Other Relevant Info:
#    11/20/02:
#      Cybercon-based spammer.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(66\.201\.91\.[0-9][0-9]?[0-9]?|\
          66\.201\.112\.[0-9][0-9]?[0-9]?|\
          email4luck\.com([^a-z0-9\.]|$)|\
          mailogen\.com([^a-z0-9\.]|$)|\
          opt4email\.com([^a-z0-9\.]|$))
{ EMAIL4LUCK=yes }

:0
* LEANTAG ?? no
* ! EMAIL4LUCK ?? yes
* !^Subject: .*\(fwd\)
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])66\.201\.91\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])66\.201\.112\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])email4luck\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])mailogen\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])opt4email\.com([^a-z0-9\.]|$)
 { EMAIL4LUCK=yes }
}

:0
* EMAIL4LUCK ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Email4Luck"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: brian@email4luck.com,postmaster@email4luck.com,postmaster@opt4email.com" \
     -I"Cc: abuse@cybercon.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Direct Synergy
#
# Updated and domains verified 12/12/02
# Last reported spam: 12/11/02
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(63\.251\.200\.34|\
          161\.58\.172\.53|\
          202\.157\.161\.221|\
          216\.52\.222\.[0-9][0-9]?[0-9]?|\
          directsynergy\.com([^a-z0-9\.]|$)|\
          emailbargain\.com([^a-z0-9\.]|$)|\
          virtualoffers\.net([^a-z0-9\.]|$))
{ DIRECTSYNERGY=yes }

:0
* LEANTAG ?? no
* ! DIRECTSYNERGY ?? yes
* !^Subject: .*\(fwd\)
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])63\.251\.200\.34([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])161\.58\.172\.53([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])202\.157\.161\.221([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])216\.52\.222\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])emailbargain\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])virtualoffers\.net([^a-z0-9\.]|$)
 { DIRECTSYNERGY=yes }
}

:0
* DIRECTSYNERGY ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Direct Synergy"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@emailbargain.com,postmaster@virtualoffers.net" \
     -I"Cc: abuse@internap.com,abuse@verio.net,abuse@webvisions.com" \
     -A"Bcc: greg@directsynergy.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Etracks
#
# Updated and domains verified 2/18/03
# Last reported spam:  10/31/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(209\.19\.106\.[0-9][0-9]?[0-9]?|\
          209\.19\.106\.[0-9][0-9]?[0-9]?|\
          216\.216\.0\.131|\
          etracks\.com([^a-z0-9\.]|$)|\
          ivbs\.net([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Etracks"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@etracks.com" \
     -I"Cc: abuse@level3.net,spamtool@level3.net,abuse@newedgenetworks.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Euniverse/flowgo.com
#
# Updated and domains verified 11/09/02
# Last reported spam:  11/13/02
# Other Relevant Info:
#
#   7/19/02:
#    Spamming root addresses at nameservers.
#
#   11/09/02:
#     Appear to have hooked up with Frank Bernal/Optin Inc. and Sweepsclub,
#     among other spammers, who spam on their behalf.  They appear to be hosting
#     haven domains instead of spamming from their own netblocks.
#
#   11/13/02:
#     Now also appear to have hooked up with IDSBI. :/
#
#   11/19/02:
#     AT&T, which hosts most of the Euniverse/Flowgo sites, is whining about
#     complaints because of one that they don't host.  Update made, although
#     AT&T really should do something about their spamming customers.
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(ecommercetransactionsllc\.com([^a-z0-9\.]|$)|\
          euniverse\.com([^a-z0-9\.]|$)|\
          fitnessheaven\.com([^a-z0-9\.]|$)|\
          flowgo\.com([^a-z0-9\.]|$)|\
          gossipflash\.com([^a-z0-9\.]|$)|\
          increaseyourhealth\.com([^a-z0-9\.]|$)|\
          partner2profit\.com([^a-z0-9\.]|$)|\
          smilepop\.com([^a-z0-9\.]|$)|\
          smokingsolution\.com([^a-z0-9\.]|$)|\
          yourbigvote\.com([^a-z0-9\.]|$))
{ EUNIVERSE=yes }

:0
* LEANTAG ?? no
* ! EUNIVERSE ?? yes
* !^Subject:.*\(fwd\)
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -500^0   ^Subject: Re:
 *  -200^1   ^[:;#>]
 *  1100^1   (^|[^-_0-9a-z])ecommercetransactionsllc\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])euniverse\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])flowgo\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])fitnessheaven\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])gossipflash\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])increaseyourhealth\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])partner2profit\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])smilepop\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])smokingsolution\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])yourbigvote\.com([^a-z0-9\.]|$)
 { EUNIVERSE=yes }
}

:0
* EUNIVERSE ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Euniverse/Flowgo"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 BH c: spamtemp.${SPAMPID}.lock
  * (^|[^-_0-9a-z])gossipflash\.com([^a-z0-9\.]|$)
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@gossipflash.com,postmaster@flowgo.com,postmaster@euniverse.com,mnoakes@la.euniverse.com" \
     -I"Cc: abuse@level3.net,spamtool@level3.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t

  :0 BH c: spamtemp.${SPAMPID}.lock
  * (^|[^-_0-9a-z])yourbigvote\.com([^a-z0-9\.]|$)
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: customer_service@yourbigvote.com,postmaster@flowgo.com,postmaster@euniverse.com,mnoakes@la.euniverse.com" \
     -I"Cc: abuse@valuenet.net,abuse@cw.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t

  :0 BH c: spamtemp.${SPAMPID}.lock
  * ((^|[^-_0-9a-z])ecommercetransactionsllc\.com([^a-z0-9\.]|$)|\
     (^|[^-_0-9a-z])euniverse\.com([^a-z0-9\.]|$)|\
     (^|[^-_0-9a-z])flowgo\.com([^a-z0-9\.]|$)|\
     (^|[^-_0-9a-z])fitnessheaven\.com([^a-z0-9\.]|$)|\
     (^|[^-_0-9a-z])increaseyourhealth\.com([^a-z0-9\.]|$)|\
     (^|[^-_0-9a-z])partner2profit\.com([^a-z0-9\.]|$)|\
     (^|[^-_0-9a-z])smilepop\.com([^a-z0-9\.]|$)|\
     (^|[^-_0-9a-z])smokingsolution\.com([^a-z0-9\.]|$))
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@flowgo.com,postmaster@euniverse.com,mnoakes@la.euniverse.com" \
     -I"Cc: postmaster@attens.com,abuse@att.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t

  :0
  | ${RM} -f spamtemp.${SPAMPID} >>/dev/null
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# EValueExpress
#
# Updated and domains verified 11/09/02
# Last reported spam: 10/11/02
# Other Relevant Info:
#    11/09/02:
#      One of a bunch of Rackspace spammers whose whois information
#      and spams look suspiciously similar.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(64\.49\.241\.[0-9][0-9]?[0-9]?|\
          evalueexpress\.com([^a-z0-9\.]|$))
{ EVALUEEXPRESS=yes }

:0
* LEANTAG ?? no
* !EVALUEEXPRESS ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])64\.49\.241\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])evalueexpress\.com([^a-z0-9\.]|$)
 { EVALUEEXPRESS=yes }
}

:0
* EVALUEEXPRESS ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: EValueExpress"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: abuse@evalueexpress.com,postmaster@evalueexpress.com" \
     -I"Cc: abuse@rackspace.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Excuria.com
#
# Updated and domains verified 12/09/02
# Last reported spam: 12/09/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*excuria\.com([^a-z0-9\.]|$)
{ EXCURIA=yes }

:0
* LEANTAG ?? no
* ! EXCURIA ?? yes
* !^Subject: .*\(fwd\)
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])excuria\.com([^a-z0-9\.]|$)
 { EXCURIA=yes }
}

:0
* EXCURIA ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: excuria.com"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@excuria.com" \
     -I"Cc: abuse@interliant.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# "Friendfinder" spammers
#
# Updated and domains verified 2/20/03
# Last reported spam: 2/20/03
# Other Relevant Info:
#
#  2/20/03:
#   New burst of spam to mailing lists and Usenet. :/
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*(^|[^-_0-9a-z])(adultfriendfinder\.com([^a-z0-9\.]|$)|\
          amigos\.com([^a-z0-9\.]|$)|\
          asiafriendfinder\.com([^a-z0-9\.]|$)|\
          filipinofriendfinder\.com([^a-z0-9\.]|$)|\
          frenchfriendfinder\.com([^a-z0-9\.]|$)|\
          friendfinder\.com([^a-z0-9\.]|$)|\
          friendfinderinc\.com([^a-z0-9\.]|$)|\
          germanfriendfinder\.com([^a-z0-9\.]|$)|\
          gradfinder\.com([^a-z0-9\.]|$)|\
          koreanfriendfinder\.com([^a-z0-9\.]|$)|\
          outpersonals\.com([^a-z0-9\.]|$)|\
          seniorfriendfinder\.com([^a-z0-9\.]|$))
{ FRIENDFINDER=yes }

:0
* LEANTAG ?? no
* !FRIENDFINDER ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^1   (^|[^-_0-9a-z])adultfriendfinder\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])amigos\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])asiafriendfinder\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])filipinofriendfinder\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])frenchfriendfinder\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])friendfinder\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])friendfinderinc\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])germanfriendfinder\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])gradfinder\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])koreanfriendfinder\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])outpersonals\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])seniorfriendfinder\.com([^a-z0-9\.]|$)
 { FRIENDFINDER=yes }
}

:0
* FRIENDFINDER ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: FriendFinder"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: spam2@friendfinderinc.com,hostmaster@friendfinderinc.com,conru@conru.com,dns@CONRU.COM,conru@W3.COM" \
     -I"Cc: abuse@level3.net,spamtool@level3.net,abuse@exodus.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Friend Greetings Trojan spammers ("Permissioned Media")
#
# Updated and domains verified 11/06/02
# Last reported spam: 11/06/02
# Other Relevant Info:
#
#    11/06/02:
#      These guys install an ActiveX trojan on people's systems,
#      and send spam to everyone in their address book. :(  The
#      individual in question is presented with a LOOONNNNGG EULA,
#      so users technically did give consent to the ActiveX code
#      being installed, and also sending these emails to everyone
#      in their Outlook address book.  HOWEVER, the recipients of
#      this cr*p did NOT give consent to receive it.  So I consider
#      these people spammers, if not something worse.
#
#   11/06/02 (later):
#      DNS for permissionedmedia.com and all related domains is
#      provided via new netblocks in AT&T and Broadwing space
#      assigned to the Free Yankee/QVES spammer.  Interesting....
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*(^|[^-_0-9a-z])(cool-downloads\.(com|net)([^a-z0-9\.]|$)|\
          friend-cards\.net([^a-z0-9\.]|$)|\
          friendgreetings\.com([^a-z0-9\.]|$)|\
          friend-greetings\.(com|net)([^a-z0-9\.]|$)|\
          permissionedmedia\.com([^a-z0-9\.]|$))
{ FRIENDGREETINGS=yes }

:0
* LEANTAG ?? no
* !FRIENDGREETINGS ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *   800^1   ^Subject:.*[^-_0-9a-z]you have an E-Card from[^a-z0-9\.]
 *   500^1   ^Greetings!$(.*$)+
 *   600^1   (^|[^-_0-9a-z])has sent you an E.?Card.*a virtual postcard from
 *   500^1   (^|[^-_0-9a-z])You can pick up your E.?Card at the
 *   300^1   (^|[^-_0-9a-z])by clicking on the link below\.
 *   500^1   (^|[^-_0-9a-z])cool-downloads\.(com|net)([^a-z0-9\.]|$)
 *   500^1   (^|[^-_0-9a-z])friend-cards\.net([^a-z0-9\.]|$)
 *   500^1   (^|[^-_0-9a-z])friendgreetings\.com([^a-z0-9\.]|$)
 *   500^1   (^|[^-_0-9a-z])friend-greetings\.(com|net)([^a-z0-9\.]|$)
 *   500^1   (^|[^-_0-9a-z])permissionedmedia\.com([^a-z0-9\.]|$)
 { FRIENDGREETINGS=yes }
}

:0
* FRIENDGREETINGS ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: FriendGreetings Trojan"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: admin@permissionedmedia.com,postmaster@permissionedmedia.com" \
     -I"Cc: abuse@teleglobe.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# FunSleuth
#
# Updated and domains verified 11/04/02
# Last reported spam: 11/04/02
# Other Relevant Info:
#    11/04/02:
#      One of a bunch of Rackspace spammers whose whois information
#      and spams look suspiciously similar.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(66\.216\.116\.[0-9][0-9]?[0-9]?|\
          myfunsleuth\.com([^a-z0-9\.]|$))
{ FUNSLEUTH=yes }

:0
* LEANTAG ?? no
* !FUNSLEUTH ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])66\.216\.116\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])myfunsleuth\.com([^a-z0-9\.]|$)
 { FUNSLEUTH=yes }
}

:0
* FUNSLEUTH ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: FunSleuth"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: abuse@myfunsleuth.com" \
     -I"Cc: abuse@rackspace.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# GerOnline.com
#
# Updated and domains verified 10/15/02
# Last reported spam:  10/15/02
# Other Relevant Info:
#     10/15/02:
#       Hosting a bunch of domains that appear to be registered to different
#       people in different locations, but that are sending out spams that
#       are identical except for the From: address and contact information.
#       I think we've got an unusually sneaky, and probably unusually
#       sleazy, spammer here. :(
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(209\.5\.11[2-9]\.[0-9][0-9]?[0-9]?|\
          geroline\.com([^a-z0-9\.]|$)|\
          hsionline\.com([^a-z0-9\.]|$)|\
          jsweave\.com([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: geronline.com"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@geronline.com,postmaster@iaw.on.ca" \
     -I"Cc: abuse@sprint.ca" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Giantrewards
#
# Updated and domains verified 11/15/02
# Last reported spam:  11/15/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^((From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(63\.211\.228\.[0-9][0-9]?[0-9]?|\
          216\.150\.217\.[0-9][0-9]?[0-9]?|\
          giantrewards?\.com([^a-z0-9\.]|$)|\
          intervolved\.com([^a-z0-9\.]|$))|\
     X-Mailer: GRMessageQueue([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Giantrewards"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: service@intervolved.net" \
     -I"Cc: abuse@viawest.net,abuse@internap.com,spamtool@level3.net,abuse@level3.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Global Cyber Strategies
#
# Updated and domains verified 12/05/02
# Last reported spam: 12/05/02
# Other Relevant Info:
#
#   12/05/02:
#    Notified by Airband that this customer was terminated some
#    time ago for spamming.  So updated the recipe.
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(64\.119\.212\.9[6-9]|\
          64\.119\.212\.1[0-1][0-9]|\
          64\.119\.212\.12[0-7]|\
          216\.110\.48\.[0-9][0-9]?[0-9]?|\
          216\.203\.153\.[0-9][0-9]?[0-9]?|\
          gcs-corp\.com([^a-z0-9\.]|$)|\
          givemegiveme\.com([^a-z0-9\.]|$)|\
          rdncorp\.com([^a-z0-9\.]|$)|\
          spammingbureau\.com([^a-z0-9\.]|$))
{ RDNCORP=yes }

:0
* LEANTAG ?? no
* !RDNCORP ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *   800^0   ^Subject:.*your auto insurance quote
 *  1100^0   (^|[^-_0-9a-z])64\.119\.212\.9[6-9]([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])64\.119\.212\.1[0-1][0-9]([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])64\.119\.212\.12[0-7]([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])216\.110\.48\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])216\.203\.153\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])gcs-corp\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])givemegiveme\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])rdncorp\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])spammingbureau\.com([^a-z0-9\.]|$)
 { RDNCORP=yes }
}

:0
* RDNCORP ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Global Cyber Strategies"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@gcs-corp.com,postmaster@rdncorp.com" \
     -I"Cc: abuse@twtelecom.net,abuse@algx.net,ip@iwayhosting.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# GotMarketing
#
# Updated and domains verified 12/06/02
# Last reported spam: 12/06/02
# Other Relevant Info:
#
#   12/06/02:
#    Another spammer that showed up in association with
#    Optin Inc., but turns out to be independent.
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(164\.109\.168\.40|\
          205\.150\.169\.123|\
          gm[0-9]+\.com([^a-z0-9\.]|$)|\
          gotmarketing\.com([^a-z0-9\.]|$))
{ GOTMARKETING=yes }

:0
* LEANTAG ?? no
* ! GOTMARKETING ?? yes
{
 :0 B
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])164\.109\.168\.40([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])205\.150\.169\.123([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])gm[0-9]+\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])gotmarketing\.com([^a-z0-9\.]|$)
 { GOTMARKETING=yes }
}

:0
* GOTMARKETING ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: GotMarketing"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: akudesia@gotmarketing.com,mlang@gotmarketing.com" \
     -I"Cc: abuse@godaddy.com,abuse@digex.com,abuse@uu.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# GreatFamilyOffers
#
# Updated and domains verified 11/04/02
# Last reported spam: 11/06/02
# Other Relevant Info:
#
#   11/04/02:
#     More RackSpace spammers. <sigh>
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(64\.49\.250\.[0-9][0-9]?[0-9]?|\
          greatfamilyoffers\.com([^a-z0-9\.]|$))
{ GFOCOM=yes }

:0
* LEANTAG ?? no
* !GFOCOM ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])64\.49\.250\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])greatfamilyoffers\.com([^a-z0-9\.]|$)
 { GFOCOM=yes }
}

:0
* GFOCOM ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: GreatFamilyOffers"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@greatfamilyoffers.com" \
     -I"Cc: abuse@rackspace.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# IFX Corporation
#
# Updated and domains verified 10/05/02
# Last reported spam: 8/28/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](198\.172\.137\.|\
          206\.105\.10[4-5]\.|\
          1888meds\.com([^a-z0-9\.]|$)|\
          atlanticmeds\.com([^a-z0-9\.]|$)|\
          best-pill\.com([^a-z0-9\.]|$)|\
          corptopia\.com([^a-z0-9\.]|$)|\
          didlyco\.com([^a-z0-9\.]|$)|\
          docdrugs\.com([^a-z0-9\.]|$)|\
          get-meds\.com([^a-z0-9\.]|$)|\
          get-pills\.net([^a-z0-9\.]|$)|\
          globalrxco\.com([^a-z0-9\.]|$)|\
          marital-aid\.com([^a-z0-9\.]|$)|\
          netprescribe\.net([^a-z0-9\.]|$)|\
          overnightrx\.com([^a-z0-9\.]|$)|\
          penisshopstore\.com([^a-z0-9\.]|$)|\
          pillsgroup\.com([^a-z0-9\.]|$)|\
          pill-shop\.com([^a-z0-9\.]|$)|\
          platinumpills\.com([^a-z0-9\.]|$)|\
          postageshop\.com([^a-z0-9\.]|$)|\
          quickrxmeds\.com([^a-z0-9\.]|$)|\
          realsmalltalk\.com([^a-z0-9\.]|$)|\
          sexpills\.biz([^a-z0-9\.]|$)|\
          sterlingpills\.com([^a-z0-9\.]|$)|\
          telcom\.net([^a-z0-9\.]|$)|\
          thebestpills\.com([^a-z0-9\.]|$)|\
          universalmeds\.com([^a-z0-9\.]|$)|\
          vmarketingonline\.com([^a-z0-9\.]|$))
{ IFXCORP=yes }

:0 BH
* LEANTAG ?? no
* !IFXCORP ?? yes
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -500^0   ^Subject: Re:
 *  -200^1   ^[:;#>]
 *  1100^0    (^|[^-_0-9a-z])1888meds\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])atlanticmeds\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])best-pill\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])corptopia\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])didlyco\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])docdrugs\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])get-meds\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])get-pills\.net([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])globalrxco\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])marital-aid\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])netprescribe\.net([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])overnightrx\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])penisshopstore\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])pillsgroup\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])pill-shop\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])platinumpills\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])postageshop\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])quickrxmeds\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])realsmalltalk\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])sexpills\.biz([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])sterlingpills\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])telcom\.net([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])thebestpills\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])universalmeds\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])vmarketingonline\.com([^a-z0-9\.]|$)
 { IFXCORP=yes }
}

:0
* IFXCORP ?? yes
{
:0 f
| ${FORMAIL} -A"X-SBRule: IFX Corporation"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
{
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: postmaster@postageshop.com" \
    -I"Cc: akachler@telecom.net,dsalama@ifxcorp.com,abuse@verio.net" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
}

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# The International Executive Guild
#
# Updated and domains verified 7/31/02
# Last reported spam: 5/29/02
# Other Relevant Info:
#   9/22/99: These guys have been around too long.  Time for a recipe for them
#    specifically.
#   6/10/00: Still spamming away, via throwaway accounts and with usual spammer
#    forged headers.
# Status: Active Spammer
#
:0 BH
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -200^1   ^[:;#>]
*   800^0   ^Received:.*orgas[0-9]*\.org([^a-z0-9\.]|$)
*   800^0   ^From:.*theheadoffice\.com([^a-z0-9\.]|$)
*   800^0   ^Subject:.*Business Recognition
*   500^1   ^Dear Candidate,[ ]*$
*   500^1   Office.*$?^?.*Managing.*$?^?.*Director
*   800^1   International(.*$)+Executive(.*$)+Guild
*   500^1   Who\'s.*$?^?.*Who.*$?^?.*CD-ROM
*   800^1   Lorraine.*Michaels
*   500^1   Office Of Managing Director
{
:0 f
| ${FORMAIL} -A"X-SBRule: International Executive Guild"

:0
{ SPAMTAG=yes }

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# InternetSeer
#
# Updated and domains verified 12/11/02
# Last reported spam:  12/11/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(66\.150\.40\.[0-9][0-9]?[0-9]?|\
          internetseer\.com([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: InternetSeer"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@internetseer.com" \
     -I"Cc: abuse@internap.com" \
     -A"X-Loop: ${NOLOOP}";\
      cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# JDR Media
#
# Updated and domains verified 7/02/02
# Last reported spam:  7/29/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0 BH
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*  1100^1   jdrdirect\.com([^a-z0-9\.]|$)
*  1100^1   jdrmedia\.com([^a-z0-9\.]|$)
*  1100^1   jdrmedia1\.com([^a-z0-9\.]|$)
*  1100^1   optinoffers\.com([^a-z0-9\.]|$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: JDR Media"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: abuse@jdrmedia.com, sales@jdrmedia.com, support@jdrmedia.com" \
     -I"Cc: abuse@internap.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Jobseekernews.com
#
# Updated and domains verified 4/24/02
# Last reported spam:  4/24/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(208\.147\.47\.|\
          career-news-room\.org([^a-z0-9\.]|$)|\
          jobseekernews\.com([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: Jobseekernews"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: postmaster@jobseekernews.com" \
    -I"Cc: postmaster@vawebprop.com,admin@vawebprop.com,spamcomplaints@cw.net" \
    -A"Bcc: rwithers@vawebprop.com" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
 }

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# Joke-Of-The-Day
#
# Updated and domains verified 11/10/02
# Last reported spam:  11/10/02
# Other Relevant Info:
#
#   7/31/02:
#    Long-time spammer.
#
#   11/10/02:
#    After a few months off, definitely back in business. :(
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(64\.83\.123\.[0-9][0-9]?[0-9]?|\
          twistedhumor[0-9]?\.com([^a-z0-9\.]|$)|\
          vitafactory\.com([^a-z0-9\.]|$))
{ JOKEOFTHEDAY=yes }

:0
* LEANTAG ?? no
* ! JOKEOFTHEDAY ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -500^0   ^Subject: Re:
 *  -200^1   ^[:;#>]
 *  1100^1   (^|[^\.])64\.83\.123\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1   (^|[^\.])twistedhumor[0-9]?\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^\.])vitafactory\.com([^a-z0-9\.]|$)
 *   800^0   ^From:.*(Daily Joke|Joke-of-the-Day)
 *   800^1   ^To:.*Daily Joke Sub[as]criber
 { JOKEOFTHEDAY=yes }
}

:0
* JOKEOFTHEDAY ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Joke-of-the-Day"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@vitafactory.com,abuse@uta.at,abuse@prioritytelecom.com" \
     -I"Cc: abuse@telekomaustria.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Jsuati.com
#
# Updated and domains verified 2/21/03
# Last reported spam:  2/21/03
# Other Relevant Info:
#
#   2/21/03:
#    Disclaimer claims, "You opted in via HiSpeed", which tells
#    me that this is likely an AdProSolutions/HiSpeedMedia morph. :/
#    It is also using IP space assigned to the GlobeAndMail, a
#    respected national newspaper in Canada.  Wierd.
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(216\.95\.201\.[0-9][0-9]?[0-9]?|\
          jsuati\.com([^a-z0-9\.]|$))
{ JSUATI=yes }

:0
* LEANTAG ?? no
* ! JSUATI ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -500^0   ^Subject: Re:
 *  -200^1   ^[:;#>]
 *  1100^1   (^|[^\.])216\.95\.201\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1   (^|[^\.])jsuati\.com([^a-z0-9\.]|$)
 *  1100^0    [^0-9][0-1]?877[-\. )]*553[-\. ]*1183[^0-9]
 { JSUATI=yes }
}

:0
* JSUATI ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Jsuati.com"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@jsuati.com,admin@jsuati.com" \
     -I"Cc: cybgen2@uunet.ca,abuse@uunet.ca" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Labelsdaily.com
#
# Updated and domains verified 11/24/02
# Last reported spam: 11/24/02
# Other Relevant Info:
#    Internap/ENOM-registered domain. <sigh>
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(63\.251\.51\.12[8-9]|\
          63\.251\.51\.1[3-5][0-9]|\
          63\.251\.51\.160|\
          labelsdaily\.com([^a-z0-9\.]|$))
{ LABELSDAILY=yes }

:0
* LEANTAG ?? no
* ! LABELSDAILY ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])63\.251\.51\.12[8-9]([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])63\.251\.51\.1[3-5][0-9]([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])63\.251\.51\.160([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])labelsdaily\.com([^a-z0-9\.]|$)
 { LABELSDAILY=yes }
}

:0
* LABELSDAILY ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: labelsdaily.com"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@labelsdaily.com,abuse@labelsdaily.com" \
     -I"Cc: abuse@internap.com,abuse@enom.com,bruce.bronczyk@enom.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# link-builder.com
#
# Updated and domains verified 12/11/02
# Last reported spam:  12/11/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(200\.76\.230\.149|\
          209\.242\.170\.62|\
          link-builder\.com([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: link-builder.com"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@link-builder.com,barbaraopperman@link-builder.com" \
     -I"Cc: postmaster@cablemas.com,juan_leyva@hotmail.com,postmaster@telnor.com,rone@telnor.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# MailComesAndGoes.com
#
# Updated and domains verified 8/11/02
# Last reported spam:  8/11/02
# Other Relevant Info:
#    ChinaMobile spamhaus.
# Status: Active Spammer
#
:0
* LEANTAG ?? no
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -500^0   ^Subject: Re:
 *  -200^1   ^[:;#>]
 {
  :0 f
  | ${FORMAIL} -A"X-SBRule: MailComesAndGoes.com"

  :0
  { SPAMTAG=yes }

  :0
  * SRC ?? yes
  * !ADMINTAG ?? yes
  * !BULKTAG ?? yes
  {
   :0
   { SPAMPID=`echo $$` }

   :0 c:
   spamtemp.${SPAMPID}

   :0 c: spamtemp.${SPAMPID}.lock
   | (${FORMAIL} -rt \
      -I"From: ${ALTFROM}" \
      -I"To: postmaster@mailcomesandgoes.com" \
      -I"Cc: hostmaster@chinamobile.com,admin@chinamobile.com,abuse@Teleglobe.net" \
      -A"X-Loop: ${NOLOOP}";\
      cat ${SBDIR}/spam;\
      cat spamtemp.${SPAMPID};\
      ${RM} -f spamtemp.${SPAMPID}) \
      | ${SENDMAIL} -oi -t
  }

  :0
  * SRB ?? yes
  { BOUNCETHIS=yes }
 }
}


# Migada (Cosmic Offers)
#
# Updated and domains verified 12/06/02
# Last reported spam:  12/11/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(63\.87\.242\.160|\
          63\.87\.252\.[0-9][0-9]?[0-9]?|\
          63\.123\.249\.[0-9][0-9]?[0-9]?|\
          66\.28\.60\.22[4-9]|\
          66\.28\.60\.2[3-4][0-9]|\
          66\.28\.60\.25[0-5]|\
          migada\.com([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Migada"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: abuse@nyc-ip.net" \
     -I"Cc: abuse@uu.net,abuse@cogentco.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# optin-offers.net/sweepsclub.com
#
# Updated and domains verified 11/09/02
# Last reported spam:  11/04/02
# Other Relevant Info:
#
#    11/09/02:
#      Partnered with Euniverse/Flowgo recently, spamming on their
#      behalf while they host the haven domains.
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(66\.115\.49\.[0-9][0-9]?[0-9]?|\
          205\.244\.71\.[0-9][0-9]?[0-9]?|\
          discountdeals\.net([^a-z0-9\.]|$)|\
          optin-offers\.net([^a-z0-9\.]|$)|\
          sweepsclub\.com([^a-z0-9\.]|$)|\
          winning-deals\.(com|net)([^a-z0-9\.]|$))
{ SWEEPSCLUB=yes }

:0
* LEANTAG ?? no
* ! SWEEPSCLUB ?? yes
{
 :0 BH
 * !^Subject:.*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -500^0   ^Subject: Re:
 *  -200^1   ^[:;#>]
 *  1100^1   (^|[^-_0-9a-z])66\.115\.49\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])205\.244\.71\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])discountdeals\.net([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])optin-offers\.net([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])sweepsclub\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])winning-deals\.(com|net)([^a-z0-9\.]|$)
 { SWEEPSCLUB=yes }
}

:0
* SWEEPSCLUB ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: optin-offers.net/sweepclub.com"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: customerservice@sweepsclub.com" \
     -I"Cc: abuse@webunited.net,abuse@sprint.net,postmaster@cyberlinx.net,abuse@cw.net" \
     -A"Bcc: suggestions@sweepsclub.com,employment@sweepsclub.com,advertising@sweepsclub.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Panoramic.net (Direct Offers)
#
# Updated and domains verified 11/23/02
# Last reported spam: 11/23/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(66\.170\.99\.[0-9][0-9]?[0-9]?|\
          panoramic\.net([^a-z0-9\.]|$)|\
          panoramicnet\.com([^a-z0-9\.]|$))
{ PANORAMIC=yes }

:0
* LEANTAG ?? no
* ! PANORAMIC ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])66\.170\.99\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])panoramic\.net([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])panoramicnet\.com([^a-z0-9\.]|$)
 { PANORAMIC=yes }
}

:0
* PANORAMIC ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Panoramic.net"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: abuse@panoramicnet.com" \
     -I"Cc: abuse@spectrumaccess.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Pressetext
#
# Updated and domains verified 2/20/03
# Last reported spam: 2/20/03
# Other Relevant Info:
#
#  2/20/03:
#   One of my email addresses was subscribed to this "service" without
#   my consent.  Worse, when I tried to unsubscribe, I couldn't -- the
#   web site gave a script error. :/
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(newsfox\.com([^a-z0-9\.]|$)|\
          pressetext\.com([^a-z0-9\.]|$))
{ PRESSETEXT=yes }

:0
* LEANTAG ?? no
* ! PRESSETEXT ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])newsfox\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])pressetext\.com([^a-z0-9\.]|$)
 { PRESSETEXT=yes }
}

:0
* PRESSETEXT ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: newsfox.com/pressetext.com"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@newsfox.com,postmaster@pressetext.com" \
     -I"Cc: editor@newsfox.com,temmel@seywald.co.at" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# RB Express
#
# Updated and domains verified 11/19/02
# Last reported spam:  11/19/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(63\.215\.87\.[0-9][0-9]?[0-9]?|\
          dlbnetwork\.net([^a-z0-9\.]|$)|\
          internetproductsgroup\.com([^a-z0-9\.]|$))
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: RB Express"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@dlbnetwork.net,postmaster@internetproductsgroup.com" \
     -I"Cc: abuse@level3.net,spamtool@level3.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# RecruiterExec/"The Job Scene"
#
# Updated and domains verified 11/25/02
# Last reported spam: 11/25/02
# Other Relevant Info:
#   Aggressive resume/recruiter spammers.  Not affiliated with recruitexec.com, as far
#   as I can tell.
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(grenada[0-9]+\.com([^a-z0-9\.]|$)|\
          joblink[0-9]\.com([^a-z0-9\.]|$)|\
          recruitexec[0-9]\.com([^a-z0-9\.]|$)|\
          recruit-professionals[0-9]+\.com([^a-z0-9\.]|$)|\
          resumetiger\.com([^a-z0-9\.]|$)|\
          thejoblinker\.com([^a-z0-9\.]|$)|\
          CARL ROBERTS|\
          Sarah Anderson|\
          SUSAN HANSON)
{ RECRUITEREXEC=yes }

:0
* LEANTAG ?? no
* !RECRUITEREXEC ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^1   (^|[^-_0-9a-z])grenada[0-9]+\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])joblink[0-9]\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])recruitexec[0-9]\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])resumetiger\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])thejoblinker\.com([^a-z0-9\.]|$)
 *   800^0   (^|[^-_0-9a-z])Resume Lion([^a-z0-9\.]|$)
 *   800^0   (^|[^-_0-9a-z])Resume Tiger([^a-z0-9\.]|$)
 *   800^0   (^|[^-_0-9a-z])The[ ]*Job[ ]*Scene([^a-z0-9\.]|$)
 *   800^0   (^|[^-_0-9a-z])Sarah Anderson([^a-z0-9\.]|$)
 *   800^0   (^|[^-_0-9a-z])SUSAN HANSON([^a-z0-9\.]|$)
 { RECRUITEREXEC=yes }
}

:0
* RECRUITEREXEC ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: RecruitExec"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
      -A"To: postmaster@cnnic.net.cn,cnnic-staff@cnnic.net.cn,abuse@vantasinc.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}



# resumerabbit.com
#
# Updated and domains verified 8/17/02
# Last reported spam: 9/06/02
# Other Relevant Info:
#   Aggressive resume/recruiter spammers.
#   8/17/02 -- moved from Virginia Web Properties to China. :/
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(211\.167\.175\.|\
          216\.73\.139\.178|\
          execs-direct\.com([^a-z0-9\.]|$)([^a-z0-9\.]|$)|\
          resumerabbit\.com([^a-z0-9\.]|$)([^a-z0-9\.]|$))
{ RESUMERABBIT=yes }

:0
* LEANTAG ?? no
* !RESUMERABBIT ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^1   (^|[^-_0-9a-z])execs-direct\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])resumerabbit\.com([^a-z0-9\.]|$)
 { RESUMERABBIT=yes }
}

:0
* RESUMERABBIT ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: ResumeRabbit"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
      -A"To: postmaster@cnnic.net.cn,cnnic-staff@cnnic.net.cn,abuse@vantasinc.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}



# Royal Marine A.M.S. Inc.
#
# Updated and domains verified 12/09/02
# Last reported spam: 12/09/02
# Other Relevant Info:
#
#  12/09/02:
#    Not prolific, but extraordinarily persistent spammers.
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*shipjob\.com([^a-z0-9\.]|$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Royal Marine A.M.S. Inc."

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@shipjob.com" \
     -I"Cc: abuse@zenon.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# SeekerCenter.net
#
# Updated and domains verified 11/13/02
# Last reported spam:  11/13/02
# Other Relevant Info:
#
#   11/13/02:
#    Apparently left bta.net.cn and moved over to cnnic.net.cn.
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*seekercenter\.net([^a-z0-9\.]|$)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: seekercenter.net"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@seekercenter.net" \
     -I"Cc: cnnic-staff@cnnic.net.cn" \
     -A"Bcc: support@seekercenter.net,inquiry@seekercenter.net,seekercenter@netstorage.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# SiteProNews
#
# Updated and domains verified 10/08/02
# Last reported spam:  11/04/02
# Other Relevant Info:
#   9/18/02:
#     SiteProNews spammers, and probably other stuff.
#   10/08/02:
#     A complaint to the bypass address put me onto a bunch of
#     spammers that apparently aren't associated with these
#     guys, but are definitely spamming.  So there are a couple
#     of new recipes, and the domains below definitely all belong
#     to the same folks.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(ezinehub\.com|\
          goarticles\.com|\
          novicenews\.com|\
          sitepronews\.com|\
          submitexpress\.com)([^a-z0-9\.]|$)
{ SITEPRONEWS=yes }

:0
* LEANTAG ?? no
* !SITEPRONEWS ?? yes
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^1   (^|[^-_0-9a-z])ezinehub\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])goarticles\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])novicenews\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])sitepronews\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])submitexpress\.com([^a-z0-9\.]|$)
 { SITEPRONEWS=yes }
}

:0
* SITEPRONEWS ?? yes
{
:0 f
| ${FORMAIL} -A"X-SBRule: SiteProNews"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: postmaster@ezinehub.com,postmaster@sitepronews.com" \
    -I"Cc: abuse@skynetweb.com,support@skynetweb.com" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
 }

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# Septic Tank spammer
#
# Updated and domains verified 2/20/03
# Last reported spam: 2/20/03
# Other Relevant Info:
#
#   2/20/03:
#     Persistent, long-term nuisance of a spammer.
#
# Status: Active Spammer
#
:0
* LEANTAG ?? no
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *   800^1   ^From:.*septic.?tank
 *   800^1   ^Subject:.*septic.?tank
 *   300^1   (^|[^-_0-9a-z])septic tank([^a-z0-9\.]|$)
 *   500^1   (^|[^-_0-9a-z])septic tank doctors?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])aaa9875548\.com([^a-z0-9\.]|$)
 { SEPTICTANK=yes }
}

:0
* SEPTICTANK ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Septic Tank Spammer"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@aaa9875548.com" \
     -I"Cc: abuse@ifxnetworks.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Sky08
#
# Updated and domains verified 11/08/02
# Last reported spam: 11/08/02
# Other Relevant Info:
#   11/08/02:
#     Another fine RackSpace spammer, this one also multihomed with Sprint. :/
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(66\.216\.91\.[0-9][0-9]?[0-9]?|\
          208\.17\.213\.[0-9][0-9]?[0-9]?|\
          fpsamplesmail\.com([^a-z0-9\.]|$)|\
          sky08\.com([^a-z0-9\.]|$)|\
          skylist\.net([^a-z0-9\.]|$)|\
          wyzermail\.com([^a-z0-9\.]|$))
{ SKY08=yes }

:0
* LEANTAG ?? no
* !SKY08 ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])66\.216\.91\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])208\.17\.213\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])fpsamplesmail\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])sky08\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])skylist\.net([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])wyzermail\.com([^a-z0-9\.]|$)
 { SKY08=yes }
}

:0
* SKY08 ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Sky08"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: abuse@fpsamplemail.com,abuse@sky08.com,abuse@skylist.net" \
     -I"Cc: abuse@rackspace.com,abuse@sprint.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# SmartDM
#
# Updated and domains verified 11/09/02
# Last reported spam: 9/30/02
# Other Relevant Info:
#   7/02/02: resume blasting site, recently expanded IP space. :(
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](216\.153\.8[0-1]\.|\
          sdm0\.com([^a-z0-9\.]|$)|\
          sdm2\.com([^a-z0-9\.]|$)|\
          smartreminders\.com([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: SmartDM"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
{
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: abuse@isdn.net,postmaster@isdn.net,web@rex.isdn.net" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
}

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# Sunshine Ready, Inc.
#
# Updated and domains verified 11/21/02
# Last reported spam: 11/21/02
# Other Relevant Info:
#
#   11/21/02:
#     Newly prolific inkjet supplies spammer.
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(209\.139\.200\.[0-9][0-9]?[0-9]?|\
          epson-canon-inkjet-cartridges\.com([^a-z0-9\.]|$)|\
          free-printer-cartridges\.com([^a-z0-9\.]|$))
{ SUNSHINEREADY=yes }

:0
* LEANTAG ?? no
* ! SUNSHINEREADY ?? yes
{
 :0 B
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])209\.139\.200\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])epson-canon-inkjet-cartridges\.com([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])free-printer-cartridges\.com([^a-z0-9\.]|$)
 { SUNSHINEREADY=yes }
}

:0
* SUNSHINEREADY ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Sunshine Ready"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@epson-canon-inkjet-cartridges.com,jlimardo@despegar.com" \
     -I"Cc: postmaster@doteasy.com,noc@doteasy.com,abuse@gt.ca" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# TES/WWWI
#
# Updated and domains verified 12/13/02
# Last reported spam: 12/13/02
# Other Relevant Info:
#
#   10/11/02:
#    "Papa Hymen" porn spammers, probably among other things.
#
#   11/06/02:
#    Mostly porn spammers, but some other stuff too.
#
#   12/13/02:
#    Reappeared as onlinedirectmail.com/promoteonlinenow.com at a new
#    netblock, not spamming porn this time.  But same guys.
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(63\.94\.14[4-9]\.[0-9][0-9]?[0-9]?|\
          63\.94\.15[0-1]\.[0-9][0-9]?[0-9]?|\
          192\.216\.11\.[0-9][0-9]?[0-9]?|\
          (^|[^-_0-9a-z])dailymarketingservices\.com([^a-z0-9\.]|$)|\
          (^|[^-_0-9a-z])onlinedirectmail\.com([^a-z0-9\.]|$)|\
          (^|[^-_0-9a-z])promoteonlinenow\.com([^a-z0-9\.]|$)|\
          (^|[^-_0-9a-z])tesdns\.com([^a-z0-9\.]|$)|\
          (^|[^-_0-9a-z])tesimages\.com([^a-z0-9\.]|$)|\
          (^|[^-_0-9a-z])tesmailers\.com([^a-z0-9\.]|$)|\
          (^|[^-_0-9a-z])testargeted\.com([^a-z0-9\.]|$)|\
          (^|[^-_0-9a-z])testracking\.com([^a-z0-9\.]|$))
{ TESSPAM=yes }

:0
* LEANTAG ?? no
* !TESSPAM ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^1   (^|[^-_0-9a-z])192\.216\.11\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])dailymarketingservices\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])onlinedirectmail\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])promoteonlinenow\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])tesdns\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])tesimages\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])tesmailers\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])testargeted\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])testracking\.com([^a-z0-9\.]|$)
 { TESSPAM=yes }
}

:0
* TESSPAM ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: TES"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@onlinedirectemail.com,postmaster@dailymarketingservices.com" \
     -A"Cc: postmaster@wwwi.net,abuse@grapevine.net,abuse@webunited.net" \
     -A"Cc: abuse@sprint.net,abuse@uu.net,abuse@avhcomm.net,abuse@verizon.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# TheKHA
#
# Updated and domains verified 11/20/02
# Last reported spam:  11/20/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(63\.123\.250\.[0-9][0-9]?[0-9]?|\
          65\.215\.21\.[0-9][0-9]?[0-9]?|\
          216\.128\.76\.[0-9][0-9]?[0-9]?|\
          bnb[0-9]+\.com|\
          thekha\.com)([^a-z0-9\.]|$)
{ THEKHA=yes }

:0
* LEANTAG ?? no
* ! THEKHA ?? yes
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^1   (^|[^-_0-9a-z])63\.123\.250\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])65\.215\.21\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])216\.128\.76\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])bnb[0-9]+\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])thekha\.com([^a-z0-9\.]|$)
 { THEKHA=yes }
}

:0
* THEKHA ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: TheKHA"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@thekha.com,admin@thekha.com" \
     -I"Cc: abuse-mail@wcom.com,abuse@uu.net,postmaster@band-x.com" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# TorpedoMail
#
# Updated and domains verified 11/20/02
# Last reported spam:  11/20/02
# Other Relevant Info:
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(64\.213\.55\.[0-9][0-9]?[0-9]?|\
          opt-?in-servers\.com|\
          torpedomail\.com)([^a-z0-9\.]|$)
{ TORPEDOMAIL=yes }

:0
* LEANTAG ?? no
* ! TORPEDOMAIL ?? yes
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^1   (^|[^-_0-9a-z])64\.213\.55\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])opt-?in-servers\.com([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])torpedomail\.com([^a-z0-9\.]|$)
 { TORPEDOMAIL=yes }
}

:0
* TORPEDOMAIL ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: TorpedoMail"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@optin-servers.com,postmaster@torpedomail.com" \
     -I"Cc: abuse@anawave.com,abuse@xo.com,abuse@gblx.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Trafficmagnet
#
# Updated and domains verified 8/07/02
# Last reported spam:  10/15/02
# Other Relevant Info:
#    Long-time web site promotion spammers.
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*trafficmagnet\.(com|net)([^a-z0-9\.]|$)
{
:0 f
| ${FORMAIL} -A"X-SBRule: Trafficmagnet"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: postmaster@trafficmagnet.net" \
    -I"Cc: hostmast@publicf.bta.net.cn, postmaster@capitalnet.com.cn, suny@publicf.bta.net.cn, ipmaster@capitalnet.com.cn, dandan.zhao@capitalnet.com.cn" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
 }

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# Virtual0.net
#
# Updated and domains verified 12/06/02
# Last reported spam: 12/06/02
# Other Relevant Info:
#
#   12/06/02:
#    Another spammer that showed up in association with
#    Optin Inc., but turns out to be independent.
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(63\.94\.149\.[0-9][0-9]?[0-9]?|\
          virtual0\.net([^a-z0-9\.]|$))
{ VIRTUAL0=yes }

:0
* LEANTAG ?? no
* ! VIRTUAL0 ?? yes
{
 :0 B
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^0   (^|[^-_0-9a-z])63\.94\.149\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0   (^|[^-_0-9a-z])virtual0\.net([^a-z0-9\.]|$)
 { VIRTUAL0=yes }
}

:0
* VIRTUAL0 ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: virtual0.net"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@virtual0.net" \
     -I"Cc: abuse@uu.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Virtual-biz.net
#
# Updated and domains verified 11/15/02
# Last reported spam:  11/15/02
# Other Relevant Info:
#
#   11/15/02:
#    Credit and debt repair service spammers.
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(64\.208\.8[8-9]\.[0-9][0-9]?[0-9]?|\
          virtual-biz\.net([^a-z0-9\.]|$))
{ VIRTUALBIZNET=yes }

:0
* LEANTAG ?? no
* ! VIRTUALBIZNET ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  1100^1   (^|[^-_0-9a-z])64\.208\.8[8-9]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^1   (^|[^-_0-9a-z])virtual-biz\.net([^a-z0-9\.]|$)
 { VIRTUALBIZNET=yes }
}

:0
* VIRTUALBIZNET ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: virtual-biz.net"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0 c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: postmaster@virtual-biz.net,sales@virtual-biz.net" \
     -I"Cc: abuse@gblx.net" \
     -A"X-Loop: ${NOLOOP}";\
     cat ${SBDIR}/spam;\
     cat spamtemp.${SPAMPID};\
     ${RM} -f spamtemp.${SPAMPID}) \
     | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# WinXPNews
#
# Updated and domains verified 12/11/02
# Last reported spam:  12/11/02
# Other Relevant Info:
#
#  12/11/02:
#   Persistent as )(#@*$!
#
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*winxpnews\.com([^a-z0-9\.]|$)
{
:0 f
| ${FORMAIL} -A"X-SBRule: WinXPNews"

:0
{ SPAMTAG=yes }

:0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: postmaster@winxpnews.com" \
    -I"Cc: abuse@intnet.net" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
 }

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# World Currency Cartel
#
# Updated and domains verified 11/06/02
# Last reported spam:  7/03/02
# Other Relevant Info:
#
#    3/16/00: Long-time spammer, needs own recipe because this spammer
#      tries to bypass filters with unusual obstinancy.  This filter does
#      not autoreply because the WCC spammers don't have a stable
#      domain or presence on the 'Net.
#
#    11/05/02:
#      Still at it, not much has changed except that these spammers are
#      now flying low, probably using "flamer lists" to avoid spamming
#      spamtraps, and in general avoiding notice.
#
# Status: Active Spammer
#
:0 BH
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*   800^1   ^From:.*profitsnow\.net([^a-z0-9\.]|$)
*   800^1   ^Subject: Make Big Money Exchanging Foreign Currency
*   500^1    S\.?J\.? Enterprises
*   500^1    100 Riverdale Ave.*Suite LJ
*   500^1    Yonkers.*10701-4638
*  1100^1    [^0-9][0-1]?914[-\. )]*476[-\. ]*9167[^0-9]
*   800^1    WORLD CURRENCY (ASSOCIATION|Cartel)
*   500^1    ATTENTION: ALAN GREENSPAN
*   500^1    P.?O.? BOX 351839(.*$)+LOS ANGELES.*90035
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: World Currency Cartel"

 :0
 { SPAMTAG=yes }
}
