# This series of recipes checks various IPs and/or domains associated with
# a particular email message against assorted blacklists.

# Dorkslayers Check
:0
* DORKSLCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.orbs.dorkslayers.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in Dorkslayers"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}



# DSBL Check
:0
* DSBLCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.list.dsbl.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in the DSBL (main)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# DSBL Multi-Stage Relay Check
:0
* DSBLMULTICHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.multihop.dsbl.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in the DSBL (multi-stage)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# Five-Ten-SG Blacklist Checks
#
# five-ten-sg.com has a bunch of different blacklists, and
# the SpamBouncer can be configured to check any arbitrary
# list of them.  This recipe is written to minimize the number
# of hits on the five-ten-sg site itself.

:0
{ RUNCHECK=no }

:0
* FTSGDIALCHECK ?? yes
{ RUNCHECK=yes }

:0
* FTSGIGNORECHECK ?? yes
{ RUNCHECK=yes }

:0
* FTSGMULTICHECK ?? yes
{ RUNCHECK=yes }

:0
* FTSGOPTOUTCHECK ?? yes
{ RUNCHECK=yes }

:0
* FTSGOTHERCHECK ?? yes
{ RUNCHECK=yes }

:0
* FTSGRSSCHECK ?? yes
{ RUNCHECK=yes }

:0
* FTSGSRCCHECK ?? yes
{ RUNCHECK=yes }

:0
* FTSGWEBFORMCHECK ?? yes
{ RUNCHECK=yes }

:0
* RUNCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.blackholes.five-ten-sg.com` }

  :0
  * FTSGSRCCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.2
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in five-ten-sg (spam sources)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGDIALCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.3
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in five-ten-sg (dial-ups)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGOPTOUTCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.4
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in five-ten-sg (opt-out lists)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGMULTICHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.5
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in five-ten-sg (multi-stage open relay)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGRSSCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.6
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in five-ten-sg (open relay)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGIGNORECHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.7
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in five-ten-sg (ignores spam complaints)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGWEBFORMCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.8
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in five-ten-sg (insecure web form)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGOTHERCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.9
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in five-ten-sg (other issues)"

    :0
   { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }
 }

 :0
 * $!SECONDEXIP ?? 000.000.000.000
 * $!SECONDEXIP ?? ${FIRSTEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXREVIP}.blackholes.five-ten-sg.com` }

  :0
  * FTSGSRCCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.2
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in five-ten-sg (spam sources)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGOPTOUTCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.4
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in five-ten-sg (opt-out lists)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGIGNORECHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.7
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in five-ten-sg (ignores spam complaints)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGWEBFORMCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.8
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in five-ten-sg (insecure web form)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGOTHERCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.9
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in five-ten-sg (other issues)"

    :0
   { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }
 }

 :0
 * $!THIRDEXIP ?? 000.000.000.000
 * $!THIRDEXIP ?? ${FIRSTEXIP}
 * $!THIRDEXIP ?? ${SECONDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXREVIP}.blackholes.five-ten-sg.com` }

  :0
  * FTSGSRCCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.2
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in five-ten-sg (spam sources)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGOPTOUTCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.4
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in five-ten-sg (opt-out lists)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGIGNORECHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.7
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in five-ten-sg (ignores spam complaints)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGWEBFORMCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.8
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in five-ten-sg (insecure web form)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGOTHERCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.9
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in five-ten-sg (other issues)"

    :0
   { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }
 }

 :0
 * $!FOURTHEXIP ?? 000.000.000.000
 * $!FOURTHEXIP ?? ${FIRSTEXIP}
 * $!FOURTHEXIP ?? ${SECONDEXIP}
 * $!FOURTHEXIP ?? ${THIRDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXREVIP}.blackholes.five-ten-sg.com` }

  :0
  * FTSGSRCCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.2
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in five-ten-sg (spam sources)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGOPTOUTCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.4
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in five-ten-sg (opt-out lists)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGIGNORECHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.7
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in five-ten-sg (ignores spam complaints)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGWEBFORMCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.8
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in five-ten-sg (insecure web form)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * FTSGOTHERCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.9
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in five-ten-sg (other issues)"

    :0
   { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }
 }
}


# The Habeas Infringer's List (HIL)
#
# If the Habeas SWE is present, check to see if the user's IP is on the
# Habeas Infringer's list (HIL).  If the user's IP is on this list,
# block the email.
#
:0
* HABEASINFRINGERS ?? yes
* HBSWE ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.hil.habeas.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in the HIL"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# MAPS Realtime Blackhole List Check
:0
* RBLCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.hil.habeas.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in the HIL"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!SECONDEXIP ?? 000.000.000.000
 * $!SECONDEXIP ?? ${FIRSTEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXREVIP}.hil.habeas.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in the HIL"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!THIRDEXIP ?? 000.000.000.000
 * $!THIRDEXIP ?? ${FIRSTEXIP}
 * $!THIRDEXIP ?? ${SECONDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXREVIP}.hil.habeas.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in the HIL"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!FOURTHEXIP ?? 000.000.000.000
 * $!FOURTHEXIP ?? ${FIRSTEXIP}
 * $!FOURTHEXIP ?? ${SECONDEXIP}
 * $!FOURTHEXIP ?? ${THIRDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXREVIP}.hil.habeas.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in the HIL"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}



# MAPS Dial-Up List Check
:0
* DULCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.dialups.mail-abuse.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in the MAPS DUL"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# MAPS Realtime Blackhole List Check
:0
* RBLCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.blackholes.mail-abuse.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in the MAPS RBL"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!SECONDEXIP ?? 000.000.000.000
 * $!SECONDEXIP ?? ${FIRSTEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXREVIP}.blackholes.mail-abuse.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in the MAPS RBL"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!THIRDEXIP ?? 000.000.000.000
 * $!THIRDEXIP ?? ${FIRSTEXIP}
 * $!THIRDEXIP ?? ${SECONDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXREVIP}.blackholes.mail-abuse.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in the MAPS RBL"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!FOURTHEXIP ?? 000.000.000.000
 * $!FOURTHEXIP ?? ${FIRSTEXIP}
 * $!FOURTHEXIP ?? ${SECONDEXIP}
 * $!FOURTHEXIP ?? ${THIRDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXREVIP}.blackholes.mail-abuse.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in the MAPS RBL"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# MAPS Relay Spam Stopper List Check
:0
* RSSCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.relays.mail-abuse.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in the MAPS RSS"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# Monkeys.com formmail.pl blacklist Check
:0
* MONKEYFORMMAILCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.formmail.relays.monkeys.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in monkeys.com (insecure web form)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!SECONDEXIP ?? 000.000.000.000
 * $!SECONDEXIP ?? ${FIRSTEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXREVIP}.formmail.relays.monkeys.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in monkeys.com (insecure web form)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!THIRDEXIP ?? 000.000.000.000
 * $!THIRDEXIP ?? ${FIRSTEXIP}
 * $!THIRDEXIP ?? ${SECONDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXREVIP}.formmail.relays.monkeys.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in monkeys.com (insecure web form)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!FOURTHEXIP ?? 000.000.000.000
 * $!FOURTHEXIP ?? ${FIRSTEXIP}
 * $!FOURTHEXIP ?? ${SECONDEXIP}
 * $!FOURTHEXIP ?? ${THIRDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXREVIP}.formmail.relays.monkeys.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in monkeys.com (insecure web form)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# Monkeys.com Open Proxy blacklist Check
:0
* MONKEYPROXYCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.proxies.relays.monkeys.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in monkeys.com (open proxy)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!SECONDEXIP ?? 000.000.000.000
 * $!SECONDEXIP ?? ${FIRSTEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXREVIP}.proxies.relays.monkeys.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in monkeys.com (open proxy)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!THIRDEXIP ?? 000.000.000.000
 * $!THIRDEXIP ?? ${FIRSTEXIP}
 * $!THIRDEXIP ?? ${SECONDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXREVIP}.proxies.relays.monkeys.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in monkeys.com (open proxy)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!FOURTHEXIP ?? 000.000.000.000
 * $!FOURTHEXIP ?? ${FIRSTEXIP}
 * $!FOURTHEXIP ?? ${SECONDEXIP}
 * $!FOURTHEXIP ?? ${THIRDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXREVIP}.proxies.relays.monkeys.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in monkeys.com (open proxy)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# ORDB (Open Relay DataBase) check
:0
* ORDBCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.relays.ordb.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in the ORDB"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# Osirusoft Blacklists Check
#
# Osirusoft has a bunch of different blacklists, and
# the SpamBouncer can be configured to check any arbitrary
# number of them.  This recipe is written to minimize the number
# of hits on the Osirusoft site itself.

:0
{ RUNCHECK=no }

:0
* OSDIALCHECK ?? yes
{ RUNCHECK=yes }

:0
* OSHAVENCHECK ?? yes
{ RUNCHECK=yes }

:0
* OSOOLCHECK ?? yes
{ RUNCHECK=yes }

:0
* OSOPSCHECK ?? yes
{ RUNCHECK=yes }

:0
* OSORCHECK ?? yes
{ RUNCHECK=yes }

:0
* OSSHRCHECK ?? yes
{ RUNCHECK=yes }

:0
* OSSPAMCHECK ?? yes
{ RUNCHECK=yes }

:0
* RUNCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.relays.osirusoft.com` }

  :0
  * OSORCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.2
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in Osirusoft (open relay)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * OSDIALCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.3
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in Osirusoft (dial-ups)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * OSSPAMCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.4
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in Osirusoft (spam source)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * OSSHRCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.5
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in Osirusoft (multi-stage open relay)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * OSHAVENCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.6
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in Osirusoft (haven domain)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * OSOOLCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.7
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in Osirusoft (opt-out list)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * OSOPSCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.9
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in Osirusoft (open proxy)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }
 }

 :0
 * $!SECONDEXIP ?? 000.000.000.000
 * $!SECONDEXIP ?? ${FIRSTEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXREVIP}.relays.osirusoft.com` }

  :0
  * OSSPAMCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.4
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in Osirusoft (spam source)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * OSHAVENCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.6
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in Osirusoft (haven domain)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * OSOOLCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.7
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in Osirusoft (opt-out list)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * OSOPSCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.9
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in Osirusoft (open proxy)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }
 }

 :0
 * $!THIRDEXIP ?? 000.000.000.000
 * $!THIRDEXIP ?? ${FIRSTEXIP}
 * $!THIRDEXIP ?? ${SECONDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXREVIP}.relays.osirusoft.com` }

  :0
  * OSSPAMCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.4
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in Osirusoft (spam source)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * OSHAVENCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.6
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in Osirusoft (haven domain)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * OSOOLCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.7
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in Osirusoft (opt-out list)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * OSOPSCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.9
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in Osirusoft (open proxy)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }
 }

 :0
 * $!FOURTHEXIP ?? 000.000.000.000
 * $!FOURTHEXIP ?? ${FIRSTEXIP}
 * $!FOURTHEXIP ?? ${SECONDEXIP}
 * $!FOURTHEXIP ?? ${THIRDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXREVIP}.relays.osirusoft.com` }

  :0
  * OSSPAMCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.4
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in Osirusoft (spam source)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * OSHAVENCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.6
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in Osirusoft (haven domain)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * OSOOLCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.7
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in Osirusoft (opt-out list)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }

  :0
  * OSOPSCHECK ?? yes
  {
   :0
   * $ REVCHECKIP ?? 127\.0\.0\.9
   {
    :0 f
    | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in Osirusoft (open proxy)"

    :0
    { BLOCKTAG=yes }

    :0
    * BLOCKREPLY ?? NOTIFY
    { BLOCKTHIS=yes }
   }
  }
 }
}


# rfc-ignorant.org -- no abuse@ address
:0
* RFCABUSECHECK ?? yes
{
 :0
 * $!FIRSTEXDOMAIN ?? example.com
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXDOMAIN}.abuse.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: ${FIRSTEXDOMAIN} is in rfc-ignorant.org (No abuse@ email address)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!SECONDEXDOMAIN ?? example.com
 * $!SECONDEXDOMAIN ?? ${FIRSTEXDOMAIN}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXDOMAIN}.abuse.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: ${SECONDEXDOMAIN} is in rfc-ignorant.org (no abuse@ email address)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!THIRDEXDOMAIN ?? example.com
 * $!THIRDEXDOMAIN ?? ${FIRSTEXDOMAIN}
 * $!THIRDEXDOMAIN ?? ${SECONDEXDOMAIN}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXDOMAIN}.abuse.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: ${THIRDEXDOMAIN} is in rfc-ignorant.org (no abuse@ email address)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!FOURTHEXDOMAIN ?? example.com
 * $!FOURTHEXDOMAIN ?? ${FIRSTEXDOMAIN}
 * $!FOURTHEXDOMAIN ?? ${SECONDEXDOMAIN}
 * $!FOURTHEXDOMAIN ?? ${THIRDEXDOMAIN}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXDOMAIN}.abuse.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: ${FOURTHEXDOMAIN} is in rfc-ignorant.org (no abuse@ email address)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# rfc-ignorant.org -- rejects From <> (bounced email messages)
:0
* RFCDSNCHECK ?? yes
{
 :0
 * $!FIRSTEXDOMAIN ?? example.com
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXDOMAIN}.dsn.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: ${FIRSTEXDOMAIN} is in rfc-ignorant.org (rejects bounces)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!SECONDEXDOMAIN ?? example.com
 * $!SECONDEXDOMAIN ?? ${FIRSTEXDOMAIN}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXDOMAIN}.dsn.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: ${SECONDEXDOMAIN} is in rfc-ignorant.org (rejects bounces)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!THIRDEXDOMAIN ?? example.com
 * $!THIRDEXDOMAIN ?? ${FIRSTEXDOMAIN}
 * $!THIRDEXDOMAIN ?? ${SECONDEXDOMAIN}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXDOMAIN}.dsn.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: ${THIRDEXDOMAIN} is in rfc-ignorant.org (rejects bounces)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!FOURTHEXDOMAIN ?? example.com
 * $!FOURTHEXDOMAIN ?? ${FIRSTEXDOMAIN}
 * $!FOURTHEXDOMAIN ?? ${SECONDEXDOMAIN}
 * $!FOURTHEXDOMAIN ?? ${THIRDEXDOMAIN}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXDOMAIN}.dsn.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: ${FOURTHEXDOMAIN} is in rfc-ignorant.org (rejects bounces)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# rfc-ignorant.org -- invalid whois information for IP block
:0
* RFCIPWHOISCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.ipwhois.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.6
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in rfc-ignorant.org (invalid IP whois)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!SECONDEXIP ?? 000.000.000.000
 * $!SECONDEXIP ?? ${FIRSTEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXREVIP}.ipwhois.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.6
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in rfc-ignorant.org (invalid IP whois)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!THIRDEXIP ?? 000.000.000.000
 * $!THIRDEXIP ?? ${FIRSTEXIP}
 * $!THIRDEXIP ?? ${SECONDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXREVIP}.ipwhois.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.6
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in rfc-ignorant.org (invalid IP whois)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!FOURTHEXIP ?? 000.000.000.000
 * $!FOURTHEXIP ?? ${FIRSTEXIP}
 * $!FOURTHEXIP ?? ${SECONDEXIP}
 * $!FOURTHEXIP ?? ${THIRDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXREVIP}.ipwhois.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.6
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in rfc-ignorant.org (invalid IP whois)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# rfc-ignorant.org -- no postmaster@ address
:0
* RFCPOSTMASTERCHECK ?? yes
{
 :0
 * $!FIRSTEXDOMAIN ?? example.com
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXDOMAIN}.postmaster.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.3
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: ${FIRSTEXDOMAIN} is in rfc-ignorant.org (No postmaster@ email address)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!SECONDEXDOMAIN ?? example.com
 * $!SECONDEXDOMAIN ?? ${FIRSTEXDOMAIN}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXDOMAIN}.postmaster.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.3
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: ${SECONDEXDOMAIN} is in rfc-ignorant.org (no postmaster@ email address)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!THIRDEXDOMAIN ?? example.com
 * $!THIRDEXDOMAIN ?? ${FIRSTEXDOMAIN}
 * $!THIRDEXDOMAIN ?? ${SECONDEXDOMAIN}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXDOMAIN}.postmaster.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.3
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: ${THIRDEXDOMAIN} is in rfc-ignorant.org (no postmaster@ email address)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!FOURTHEXDOMAIN ?? example.com
 * $!FOURTHEXDOMAIN ?? ${FIRSTEXDOMAIN}
 * $!FOURTHEXDOMAIN ?? ${SECONDEXDOMAIN}
 * $!FOURTHEXDOMAIN ?? ${THIRDEXDOMAIN}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXDOMAIN}.postmaster.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.3
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: ${FOURTHEXDOMAIN} is in rfc-ignorant.org (no postmaster@ email address)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# rfc-ignorant.org -- invalid whois information for domain
:0
* RFCWHOISCHECK ?? yes
{
 :0
 * $!FIRSTEXDOMAIN ?? example.com
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXDOMAIN}.whois.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: ${FIRSTEXDOMAIN} is in rfc-ignorant.org (invalid domain whois)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!SECONDEXDOMAIN ?? example.com
 * $!SECONDEXDOMAIN ?? ${FIRSTEXDOMAIN}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXDOMAIN}.whois.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: ${SECONDEXDOMAIN} is in rfc-ignorant.org (invalid domain whois)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!THIRDEXDOMAIN ?? example.com
 * $!THIRDEXDOMAIN ?? ${FIRSTEXDOMAIN}
 * $!THIRDEXDOMAIN ?? ${SECONDEXDOMAIN}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXDOMAIN}.whois.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: ${THIRDEXDOMAIN} is in rfc-ignorant.org (invalid domain whois)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!FOURTHEXDOMAIN ?? example.com
 * $!FOURTHEXDOMAIN ?? ${FIRSTEXDOMAIN}
 * $!FOURTHEXDOMAIN ?? ${SECONDEXDOMAIN}
 * $!FOURTHEXDOMAIN ?? ${THIRDEXDOMAIN}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXDOMAIN}.whois.rfc-ignorant.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: ${FOURTHEXDOMAIN} is in rfc-ignorant.org (invalid domain whois)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# RSL (Relay StopList) Check
:0
* RSLCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.relays.visi.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in the RSL"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# Spamcop.net Check
:0
* SPAMCOPCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.bl.spamcop.net` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in SpamCop"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!SECONDEXIP ?? 000.000.000.000
 * $!SECONDEXIP ?? ${FIRSTEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXREVIP}.bl.spamcop.net` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in SpamCop"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!THIRDEXIP ?? 000.000.000.000
 * $!THIRDEXIP ?? ${FIRSTEXIP}
 * $!THIRDEXIP ?? ${SECONDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXREVIP}.bl.spamcop.net` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in SpamCop"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!FOURTHEXIP ?? 000.000.000.000
 * $!FOURTHEXIP ?? ${FIRSTEXIP}
 * $!FOURTHEXIP ?? ${SECONDEXIP}
 * $!FOURTHEXIP ?? ${THIRDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXREVIP}.bl.spamcop.net` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in SpamCop"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# SpamHaus.org Check
:0
* SPAMHAUSORGCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.sbl.spamhaus.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in SpamHaus.org"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!SECONDEXIP ?? 000.000.000.000
 * $!SECONDEXIP ?? ${FIRSTEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXREVIP}.sbl.spamhaus.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in SpamHaus.org"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!THIRDEXIP ?? 000.000.000.000
 * $!THIRDEXIP ?? ${FIRSTEXIP}
 * $!THIRDEXIP ?? ${SECONDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXREVIP}.sbl.spamhaus.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in SpamHaus.org"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!FOURTHEXIP ?? 000.000.000.000
 * $!FOURTHEXIP ?? ${FIRSTEXIP}
 * $!FOURTHEXIP ?? ${SECONDEXIP}
 * $!FOURTHEXIP ?? ${THIRDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXREVIP}.sbl.spamhaus.org` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in SpamHaus.org"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# SPEWS (Spam Prevention Early Warning List) Check
:0
* SPEWSCHECK ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.spews.relays.osirusoft.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in SPEWS"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!SECONDEXIP ?? 000.000.000.000
 * $!SECONDEXIP ?? ${FIRSTEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXREVIP}.spews.relays.osirusoft.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in SPEWS"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!THIRDEXIP ?? 000.000.000.000
 * $!THIRDEXIP ?? ${FIRSTEXIP}
 * $!THIRDEXIP ?? ${SECONDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXREVIP}.spews.relays.osirusoft.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in SPEWS"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!FOURTHEXIP ?? 000.000.000.000
 * $!FOURTHEXIP ?? ${FIRSTEXIP}
 * $!FOURTHEXIP ?? ${SECONDEXIP}
 * $!FOURTHEXIP ?? ${THIRDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXREVIP}.spews.relays.osirusoft.com` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in SPEWS"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# WireHub Dialups
:0
* WIREHUBDIALUP ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.dynablock.wirehub.net` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in WireHub (Dial-ups)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}


# WireHub Spam Sources
:0
* WIREHUBSPAMSOURCE ?? yes
{
 :0
 * $!FIRSTEXIP ?? 000.000.000.000
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FIRSTEXREVIP}.blackholes.wirehub.net` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FIRSTEXIP} is in WireHub (Spam Source)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!SECONDEXIP ?? 000.000.000.000
 * $!SECONDEXIP ?? ${FIRSTEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${SECONDEXREVIP}.blackholes.wirehub.net` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${SECONDEXIP} is in WireHub (Spam Source)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!THIRDEXIP ?? 000.000.000.000
 * $!THIRDEXIP ?? ${FIRSTEXIP}
 * $!THIRDEXIP ?? ${SECONDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${THIRDEXREVIP}.blackholes.wirehub.net` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${THIRDEXIP} is in WireHub (Spam Source)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }

 :0
 * $!FOURTHEXIP ?? 000.000.000.000
 * $!FOURTHEXIP ?? ${FIRSTEXIP}
 * $!FOURTHEXIP ?? ${SECONDEXIP}
 * $!FOURTHEXIP ?? ${THIRDEXIP}
 {
  :0
  { REVCHECKIP=`${NSLOOKUP} ${FOURTHEXREVIP}.blackholes.wirehub.net` }

  :0
  * $ REVCHECKIP ?? 127\.0\.0\.2
  {
   :0 f
   | ${FORMAIL} -A"X-SBRule: IP ${FOURTHEXIP} is in WireHub (Spam Source)"

   :0
   { BLOCKTAG=yes }

   :0
   * BLOCKREPLY ?? NOTIFY
   { BLOCKTHIS=yes }
  }
 }
}

