# 126.com
#
# Updated and domains verified 4/25/02
# Last reported spam: 4/24/02
# Other Relevant Info:
#  Chinese network with no reverse DNS, little valid info in APNIC,
#  no valid complaint email addresses, and a pattern of spamming.
#  Probably a spamhaus, but being blocked as a precaution.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](202\.108\.36\.|\
          126.com([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: 126.com"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# 163.com/163.net
#
# Updated and domains verified 4/24/02
# Other Relevant Info:
#  Chinese network with no reverse DNS, little valid info in APNIC,
#  no valid complaint email addresses, and a pattern of spamming.
#  Probably a spamhaus, but being blocked for now as a precaution.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](202\.106\.185\.|\
          202\.108\.255\.|\
          163\.(com|net)([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: 163.(com|net)"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# 263.net
#
# Updated and domains verified 4/24/02
# Last reported spam: 10/25/01
# Other Relevant Info:
#  Another Chinese network with no reverse DNS, little valid info in APNIC,
#  no valid complaint email addresses, and a pattern of spamming.
#  Probably a spamhaus, but being blocked for now as a precaution.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](202\.96\.44\.|\
          263\.net([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: 263.net"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Alchemy Communications
#
# Updated and domains verified 11/01/02
# Other Relevant Info:
#   Bogus netblock information, hosts spammers.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](209\.132\.19[2-9]\.[0-9][0-9]?[0-9]?|\
          209\.132\.2[0-4][0-9]\.[0-9][0-9]?[0-9]?|\
          209\.132\.25[0-5]\.[0-9][0-9]?[0-9]?)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Alchemy Communications netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# American Network, Inc.
#
# Updated and domains verified 4/24/02
# Last reported spam: 03/01/01
# Other Relevant Info:
#  Admin contact email listed as NOMAILBOX@nowhere, typical of spam houses.
#  Spam received from this network, nowhere to complain but upstream, which
#  is Sprint and just about useless. :/
#
:0
* ^Received:.*206\.231\.[0-7]\.
{
:0 f
| ${FORMAIL} -A"X-SBRule: American Network Inc."

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# AT&T SpamHaus Netblocks
#
# Updated and domains verified 12/04/02
# Other Relevant Info:
#
#   Netblocks that are owned/used by spammers, but that I haven't
#   been able to assign to one specific spammer.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]12\.170\.66\.223([^a-z0-9\.]|$)
{ ATTSPAMNETBLOCK=yes }

:0
* LEANTAG ?? no
* ! ATTSPAMNETBLOCK ?? yes
* !^Subject:.*\(fwd\)
* !^Subject: FW:
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  1100^0    (^|[^-_0-9a-z])12\.170\.66\.223([^a-z0-9\.]|$)
 { ATTSPAMNETBLOCK=yes }
}

:0
* ATTSPAMNETBLOCK ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: AT&T Spammer Netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# auspachosting.net.au
#
# Updated and domains verified 4/24/02
# Last reported spam: 04/22/01
# Other Relevant Info:
#    Hosts of nasty Indian-based spam nest including lustingforu.com and
#    teasemenow.com.  Several spam complaints about these guys in April
#    and May 2000, but not listed as a spam site because insufficient
#    evidence as yet.
#
# Status: Irresponsible Site
#
:0
* ^Received:.*202\.56\.36\.[1-9][0-9]?[0-9]?([^a-z0-9\.]|$)
{
:0 f
| ${FORMAIL} -A"X-SBRule: auspachosting.net.au"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# BloodstockWWW -- hosters of fine Christian Spammers. :/
#
# Updated and domains verified 11/10/01
# Other Relevant Info:
#   Owner hosts the Christianministry/Christianword spam sites, and also
#   provides DNS for a dedicated spammer, Tony Howard of The Wizards.
# Status: Irresponsible Site
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]206\.24\.34\.
{
:0 f
| ${FORMAIL} -A"X-SBRule: BloodstockWWW"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Caribbean Trading & Sales
#
# Updated and domains verified 11/19/02
# Other Relevant Info:
#
# Status: Irresponsible Site
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](216\.7\.129\.[0-9][0-9]?[0-9]?|\
          216\.7\.130\.[0-9][0-9]?[0-9]?|\
          216\.7\.132\.[0-9][0-9]?[0-9]?|\
          algreen\.biz([^a-z0-9\.]|$)|\
          bur-find\.org([^a-z0-9\.]|$)|\
          chrystalsoftware\.net([^a-z0-9\.]|$)|\
          digitial-isp\.net([^a-z0-9\.]|$)|\
          ezwebmail\.biz([^a-z0-9\.]|$)|\
          ezwebmailuse\.com([^a-z0-9\.]|$)|\
          flag-networks\.net([^a-z0-9\.]|$)|\
          freedomkingdom\.org([^a-z0-9\.]|$)|\
          landrygroup\.com([^a-z0-9\.]|$)|\
          larrymills\.net([^a-z0-9\.]|$)|\
          optedxmail\.(com|net)([^a-z0-9\.]|$)|\
          outpostdigital\.net([^a-z0-9\.]|$)|\
          penn-connections\.biz([^a-z0-9\.]|$)|\
          smith-valley2000\.org([^a-z0-9\.]|$)|\
          ultradigitial\.biz([^a-z0-9\.]|$)|\
          ultratackcomm\.com([^a-z0-9\.]|$))
{ CARIBBEANTRADING=yes }

:0
* LEANTAG ?? no
* ! CARIBBEANTRADING ?? yes
* !^Subject:.*\(fwd\)
* !^Subject: FW:
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  1100^0    (^|[^-_0-9a-z])216\.7\.129\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])216\.7\.130\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])216\.7\.132\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])algreen\.biz([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])bur-find\.org([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])chrystalsoftware\.net([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])digitial-isp\.net([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])ezwebmail\.biz([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])ezwebmailuse\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])flag-networks\.net([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])freedomkingdom\.org([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])landrygroup\.com([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])larrymills\.net([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])optedxmail\.(com|net)([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])outpostdigital\.net([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])penn-connections\.biz([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])smith-valley2000\.org([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])ultradigitial\.biz([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])ultratackcomm\.com([^a-z0-9\.]|$)
 { CARIBBEANTRADING=yes }
}

:0
* CARIBBEANTRADING ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Caribbean Trading & Sales"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# ChinaMobile
#
# Updated and domains verified 12/09/02
# Other Relevant Info:
#   (none)
# Status: Irresponsible Sites
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](211\.13[6-9]\.[0-9]?[0-9]?[0-9]\.[0-9]?[0-9]?[0-9]|\
          211\.14[0-1]\.[0-9]?[0-9]?[0-9]\.[0-9]?[0-9]?[0-9]|\
          218\.20[0-5]].[0-9]?[0-9]?[0-9]\.[0-9]?[0-9]?[0-9])
{
:0 f
| ${FORMAIL} -A"X-SBRule: ChinaMobile Netblock"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# ChinaNet
#
# Updated and domains verified 11/19/02
# Other Relevant Info:
#   (none)
# Status: Irresponsible Sites
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](61\.145\.[0-9]?[0-9]?[0-9]\.[0-9]?[0-9]?[0-9]|\
          218\.[0-9]\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\
          218\.[1-2][0-9]\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\
          218\.3[0-1]\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\
          218\.64\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\
          218\.65\.[0-9]\.[0-9][0-9]?[0-9]?|\
          218\.65\.[1-9][0-9]\.[0-9][0-9]?[0-9]?|\
          218\.65\.1[0-1][0-9]\.[0-9][0-9]?[0-9]?|\
          218\.65\.12[0-7]\.[0-9][0-9]?[0-9]?)
{ CHINANET=yes }

:0
* LEANTAG ?? no
* ! CHINANET ?? yes
* !^Subject:.*\(fwd\)
* !^Subject: FW:
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  1100^0    (^|[^-_0-9a-z])61\.145\.[0-9]?[0-9]?[0-9]\.[0-9]?[0-9]?[0-9]([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])218\.[0-9]\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])218\.[1-2][0-9]\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])218\.3[0-1]\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])218\.64\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])218\.65\.[0-9]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])218\.65\.[1-9][0-9]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])218\.65\.1[0-1][0-9]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])218\.65\.12[0-7]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 { CHINANET=yes }
}


:0
* CHINANET ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: ChinaNet Netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# ChinaNetCenter
#
# Updated and domains verified 10/05/02
# Other Relevant Info:
#   (none)
# Status: Irresponsible Sites
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](210\.192\.9[6-9]\.[0-9]?[0-9]?[0-9]|\
          210\.192\.1[0-1][0-9]\.[0-9]?[0-9]?[0-9]|\
          210\.192\.12[0-7]\.[0-9][0-9]?[0-9]?)
{
:0 f
| ${FORMAIL} -A"X-SBRule: ChinaNetCenter Netblock"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# China Netcom
#
# Updated and domains verified 12/09/02
# Other Relevant Info:
#
#   12/09/02:
#    Bunch of spam suddenly appearing from these netblocks.
#    It's Christmas, so I'm taking precautions.
#
# Status: Irresponsible Site
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](210\.82\.[0-9]\.[0-9][0-9]?[0-9]?|\
          210\.82\.[1-9][0-9]\.[0-9][0-9]?[0-9]?|\
          210\.82\.1[0-1][0-9]\.[0-9][0-9]?[0-9]?|\
          210\.82\.12[0-7]\.[0-9][0-9]?[0-9]?)
{ CHINANETCOM=yes }

:0
* LEANTAG ?? no
* ! CHINANETCOM ?? yes
* !^Subject:.*\(fwd\)
* !^Subject: FW:
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  1100^0    (^|[^-_0-9a-z])210\.82\.[0-9]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])210\.82\.[1-9][0-9]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])210\.82\.1[0-1][0-9]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])210\.82\.12[0-7]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 { CHINANETCOM=yes }
}


:0
* CHINANETCOM ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: China Netcom netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# CIHost.com/Propagation.net
#
# Updated and domains verified 7/09/02
# Other Relevant Info:
#   (none)
# Status: Irresponsible Sites
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]216\.221\.160\.
{
:0 f
| ${FORMAIL} -A"X-SBRule: CIHost/Propagation.net Netblock"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Clarksville.com
#
# Updated and domains verified 11/10/01
# Other Relevant Info:
#    (none)
# Status: Irresponsible Site
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](205\.152\.95\.|\
          agspray\.com([^a-z0-9\.]|$)|\
          alternative-energy\.com([^a-z0-9\.]|$)|\
          ashkins\.com([^a-z0-9\.]|$)|\
          authenticode\.com([^a-z0-9\.]|$)|\
          cahilltech\.com([^a-z0-9\.]|$)|\
          cahilltech\.com([^a-z0-9\.]|$)|\
          chefdavid\.com([^a-z0-9\.]|$)|\
          cityinternet\.com([^a-z0-9\.]|$)|\
          cityinternet\.com([^a-z0-9\.]|$)|\
          clarksville\.com([^a-z0-9\.]|$)|\
          clarksvillehomes\.com([^a-z0-9\.]|$)|\
          clarksville-tn\.org([^a-z0-9\.]|$)|\
          daystarshop\.com([^a-z0-9\.]|$)|\
          evosys\.com([^a-z0-9\.]|$)|\
          fort-campbell\.com([^a-z0-9\.]|$)|\
          fortcampbellhomes\.com([^a-z0-9\.]|$)|\
          guthrieisp\.com([^a-z0-9\.]|$)|\
          harris-unlimited\.com([^a-z0-9\.]|$)|\
          hayes-group\.com([^a-z0-9\.]|$)|\
          heartlandtpe\.com([^a-z0-9\.]|$)|\
          hopkinsville\.com([^a-z0-9\.]|$)|\
          inntek\.com([^a-z0-9\.]|$)|\
          jeffstewart\.com([^a-z0-9\.]|$)|\
          kentuckynewera\.com([^a-z0-9\.]|$)|\
          kids-n-critters\.com([^a-z0-9\.]|$)|\
          lchappell\.com([^a-z0-9\.]|$)|\
          marketplacelink\.com([^a-z0-9\.]|$)|\
          miminet\.com([^a-z0-9\.]|$)|\
          pagges\.com([^a-z0-9\.]|$)|\
          prudentialclarksville\.com([^a-z0-9\.]|$)|\
          queencitywebauthoring\.com([^a-z0-9\.]|$)|\
          replinets\.com([^a-z0-9\.]|$)|\
          replinets-max\.com([^a-z0-9\.]|$)|\
          runyon\.net([^a-z0-9\.]|$)|\
          seaypages\.com([^a-z0-9\.]|$)|\
          snj\.net([^a-z0-9\.]|$)|\
          specialtyfoodamerica\.com([^a-z0-9\.]|$)|\
          specialtyfoodamerica\.com([^a-z0-9\.]|$)|\
          surf-master\.net([^a-z0-9\.]|$)|\
          tcscomp\.net([^a-z0-9\.]|$)|\
          the-wizards\.com([^a-z0-9\.]|$)|\
          tribgroup\.com([^a-z0-9\.]|$)|\
          vhkc21\.com([^a-z0-9\.]|$)|\
          vhkc21\.com([^a-z0-9\.]|$)|\
          wendy-whoppers\.com([^a-z0-9\.]|$)|\
          winnvision\.com([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: Clarksville.com"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Cogentco
#
# Updated and domains verified 11/02/02
# Other Relevant Info:
#   =TONS= of spamming customers, does nothing about them
#   as far as I can tell.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]66\.28\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Cogentco netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# ComCor Hosting
#
# Updated and domains verified 2/21/03
# Other Relevant Info:
#
#   Hosts Viagra spammers, apparently others.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]213\.71\.60\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
{ ATTSPAMNETBLOCK=yes }

:0
* LEANTAG ?? no
* ! ATTSPAMNETBLOCK ?? yes
* !^Subject:.*\(fwd\)
* !^Subject: FW:
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  1100^0    (^|[^-_0-9a-z])213\.71\.60\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 { ATTSPAMNETBLOCK=yes }
}

:0
* ATTSPAMNETBLOCK ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: ComCor Hosting Netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Conversent.net
#
# Updated and domains verified 11/08/02
# Other Relevant Info:
#   Hosts eBay phisher pages, has invalid ARIN info.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](216\.41\.[0-9]\.[0-9][0-9]?[0-9]?|\
          216\.41\.[1-9][0-9]\.[0-9][0-9]?[0-9]?|\
          216\.41\.1[0-1][0-9]\.[0-9][0-9]?[0-9]?|\
          216\.41\.12[0-7]\.[0-9][0-9]?[0-9]?)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Conversent.net Netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# CSINET.net
#
# Updated and domains verified 11/10/01
# Other Relevant Info:
#   CSINET system administrator stated that CSINET would not take action
#   against spamming customers of theirs, and stated that any further complaints
#   about spam from their customers would themselves be treated as spam.
#
#   This is not acceptable, of course.  For this reason, all CSINET netblocks
#   and CSINET-hosted domains are in the "Irresponsible Providers" section of
#   the SpamBouncer until that policy changes.
#
# Status: Irresponsible Site
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]206\.31\.16\.
{
:0 f
| ${FORMAIL} -A"X-SBRule: CSINET"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Emi1.net
#
# Updated and domains verified 2/20/03
# Last reported spam: 2/20/03
# Other Relevant Info:
#
#  2/20/03:
#   Appear to be opt-out spammers masquereding as an opt-in marketing
#   house.  Blocked for now -- will move to definite spammer status
#   if current spam flow continues unabated.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]216\.93\.165\.[0-9][0-9]?[0-9]?
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: emi1.net netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# ETWebs Taiwan
#
# Updated and domains verified 12/09/02
# Last reported spam: 12/09/02
# Other Relevant Info:
#
#  12/09/02:
#    Taiwanese broadband provider/source of a lot of spam.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]21.184\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: ETWebs Taiwan netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Exodus SpamHaus Netblocks
#
# Updated and domains verified 12/09/02
# Other Relevant Info:
#
#   Exodus has a huge number of spamming customers, and appears
#   to be actively helping them avoid filtering by moving them
#   around.  I am therefore blocking many Exodus netblocks for
#   hosting spammers.  I'll whitelist any non-spammers caught
#   in such netblocks.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](64\.70\.[0-9]\.[0-9][0-9]?[0-9]?|\
          64\.70\.[1-9][0-9]\.[0-9][0-9]?[0-9]?|\
          64\.70\.1[0-1][0-9]\.[0-9][0-9]?[0-9]?|\
          64\.70\.12[0-7]\.[0-9][0-9]?[0-9]?|\
          216\.136\.134\.[0-9]|\
          216\.136\.134\.[1-9][0-9]|\
          216\.136\.134\.1[0-1][0-9]|\
          216\.136\.134\.12[0-7])
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Exodus spamhaus netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# fasthosts.co.uk
#
# Updated and domains verified 6/22/02
# Other Relevant Info:
#   These idiots refuse email to abuse@fasthosts.co.uk, even in reply
#   to email =from= that address, and demand that all users use a web
#   form. They also refuse postal mail or faxes except from a "qualified
#   solicitors firm."  Clueless fools, or spam-friendly jackasses?  You
#   decide -- I don't care.
#
# Status: Irresponsible Site
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](213\.171\.19[2-7]\.|\
          fasthosts\.co\.uk)([^a-z0-9\.]|$)
{
:0 f
| ${FORMAIL} -A"X-SBRule: fasthosts.co.uk"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Fiber Plus netblocks
#
# Updated and domains verified 5/02/02
# Other Relevant Info:
#   Hosts Robert Hicks and other notorious spammers, is unresponsive
#    to complaints.
# Status: Irresponsible Sites
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](209\.114\.19[2-9]\.|\
          209\.114\.2[0-1][0-9]\.|\
          209\.114\.22[0-3]\.)
{
:0 f
| ${FORMAIL} -A"X-SBRule: Fiber Plus"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Focus USA (epending dipshits)
#
# Updated and domains verified 9/10/02
# Other Relevant Info:
#  9/10/02:
#   Are advertising an epending spam service that is, by definition,
#   opt-out/spam.  Am therefore blocking pre-emptively; these idiots
#   get NO first chance.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](66\.152\.223\.24[8-9]\.|\
          66\.152\.223\.25[0-5]\.)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Focus USA"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Idyia.net netblocks
#
# Updated and domains verified 8/04/02
# Other Relevant Info:
#   Suspected reincarnation of Monsterhut/Beaverhome, run by spammer
#   Todd Pelow.  Am unsure, though, and just blocking the netblock at
#   this point. (
# Status: Irresponsible Sites
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](209\.177\.9[6-9]\.|\
          209\.177\.10[0-9]\.|\
          209\.177\.11[0-1]\.)
{
:0 f
| ${FORMAIL} -A"X-SBRule: Idyia netblock"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Inflow.com netblocks
#
# Updated and domains verified 8/17/02
# Other Relevant Info:
#   Apparent ISP of choice for a number of "respectable"
#   spam-for-hire outfits that has a professional CRM
#   package in use with its abuse@ addresses. :/  Does
#   nothing about spam but listwash, though.  I think
#   this one deserves to be in the spammer ISP category,
#   but am blocking for now.
# Status: Irresponsible Sites
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](66\.45\.[0-9]\.|\
          66\.45\.[1-9][0-9]\.|\
          66\.45\.1[1-1][0-9]\.|\
          66\.45\.12[0-7]\.)
{
:0 f
| ${FORMAIL} -A"X-SBRule: Inflow netblock"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Inprof.net netblocks
#
# Updated and domains verified 6/17/02
# Other Relevant Info:
#   Hosts a number of porn spam sites, unresponsive to complaints.
# Status: Irresponsible Sites
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]81\.9\.6\.
{
:0 f
| ${FORMAIL} -A"X-SBRule: Inprof.net netblock"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Internet Connect netblocks
#
# Updated and domains verified 8/05/02
# Other Relevant Info:
#   Hosts a number of porn spam sites, unresponsive to complaints.
# Status: Irresponsible Sites
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]208\.244\.15[2-9]\.
{
:0 f
| ${FORMAIL} -A"X-SBRule: Internet Connect netblock"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Intelligence Network Online
#
# Updated and domains verified 11/05/02
# Other Relevant Info:
#   Hosts WinXPNews and a bunch of other spam sites. :(
# Status: Irresponsible Site
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](207\.90\.[0-9]\.[0-9][0-9]?[0-9]?|\
          207\.90\.[1-5][0-9]\.[0-9][0-9]?[0-9]?|\
          207\.90\.6[0-3]\.[0-9][0-9]?[0-9]?)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Intnet.net netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# kundenserver.de
#
# Updated and domains verified 11/10/01
# Other Relevant Info:
#    No responses whatsoever to spam complaints -- dead air.  I am told
#    this is part of a large provider in Germany, so I am not listing them
#    as spammers, but I have seen =nothing= from this site but spam for
#    the last several months at least.
#
# Status: Irresponsible Site
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](195\.20\.22[4-5]\.|\
          kundenserver\.de([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: kundenserver.de"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Lauderdale.net (PG&C Leasing)
#
# Updated and domains verified 12/06/02
# Other Relevant Info:
#
#   11/01/01:
#    ISP and former ISP for numerous extremely abusive spam sites.
#    This one almost deserves to be treated as a spam site itself,
#    but it has too many legitimate customers as well as spammers.
#
#   12/06/02:
#     Among other things, hosting OneStopData, Optin Inc., and
#     other spammers. :(
#
# Status: Irresponsible Site
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](209\.236\.[0-9]\.|\
          209\.236\.[1-5][0-9]\.|\
          209\.236\.6[0-3]\.)
{ LAUDERDALE=yes }

:0
* LEANTAG ?? no
* ! LAUDERDALE ?? yes
* !^Subject: .*\(fwd\)
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP MESSAGE-----
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  -200^1    UCE
 *  1100^0    209\.236\.[0-9]\.
 *  1100^0    209\.236\.[1-5][0-9]\.
 *  1100^0    209\.236\.6[0-3]\.
 { LAUDERDALE=yes }
}

:0
* LAUDERDALE ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: PG&C Leasing"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Long Great-Wall Network Service Company
#
# Updated and domains verified 11/05/02
# Other Relevant Info:
#   11/05/02: Can't tell if these are spammers or just a clueless
#     Chinese ISP that I can't communicate with.
# Status: Irresponsible Site
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](218\.7\.3\.3[2-9]|\
          218\.7\.3\.4[0-7])
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Long Great-Wall netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Nevada Hosting
#
# Updated and domains verified 11/10/01
# Other Relevant Info:
#   Has lots of spamming customers, no known non-spamming customers.
#   Probably spammers, but just blocked until this is confirmed.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]12\.36\.242\.
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Nevada Hosting netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# New Century InfoComm
#
# Updated and domains verified 12/09/02
# Other Relevant Info:
#
#   12/09/02:
#     Taiwanese ISP, lots of spamming customers. :/
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](61\.56\.19[2-9]\.[0-9][0-9]?[0-9]?|\
          61\.56\.2[0-1][0-9]\.[0-9][0-9]?[0-9]?|\
          61\.56\.22[0-3]\.[0-9][0-9]?[0-9]?)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: New Century InfoComm netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# NetTelcos Inc.
#
# Updated and domains verified 12/09/02
# Other Relevant Info:
#
#  12/09/02:
#   Stubberfield, probably, and if so, this is a spammer.  But I
#   haven't verified he actually owns this whole huge block. :/
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](65\.201\.17[6-9]\.[0-9][0-9]?[0-9]?|\
          65\.201\.18[0-9].[0-9][0-9]?[0-9]?|\
          65\.201\.19[0-1]\.[0-9][0-9]?[0-9]?)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: NetTelcos netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# New Century InfoComm
#
# Updated and domains verified 12/09/02
# Other Relevant Info:
#
#   12/09/02:
#     Taiwanese ISP, lots of spamming customers. :/
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](61\.56\.19[2-9]\.[0-9][0-9]?[0-9]?|\
          61\.56\.2[0-1][0-9]\.[0-9][0-9]?[0-9]?|\
          61\.56\.22[0-3]\.[0-9][0-9]?[0-9]?)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: New Century InfoComm netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# NuCul -- NiUang Culture
#
# Updated and domains verified 12/09/02
# Other Relevant Info:
#   Despite the name, appears to be a Chinese based host of spamvertized.
#   web sites.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]211\.101\.236\.
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: NuCul netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Optus.net.au/BayNetworks Inc.
#
# Updated and domains verified 11/10/01
# Other Relevant Info:
#    Hosts of nasty Indian-based spam nest including lustingforu.com.
#    Not listed in aunic.net.au whois database, nearly untraceable.
#
# Status: Irresponsible Site
#
:0
* ^Received:.*(192\.65\.8[2-9]\.|\
               192\.65\.9[0-1]\.|\
               202\.139\.[0-1]\.|\
               202\.139\.[6-7]\.|\
               202\.139\.1[8-9]\.|\
               202\.139\.3[2-3]\.|\
               202\.139\.39\.|\
               202\.139\.46\.|\
               202\.139\.49\.|\
               202\.139\.50\.|\
               202\.139\.63\.|\
               202\.139\.8[2-3]\.|\
               202\.139\.8[7-8]\.|\
               202\.139\.94\.|\
               202\.139\.110\.|\
               202\.139\.113\.|\
               202\.139\.120\.|\
               202\.139\.12[3-4]\.|\
               202\.139\.12[7-9]\.|\
               202\.139\.13[0-9]\.|\
               202\.139\.14[0-3]\.|\
               202\.139\.166\.|\
               202\.139\.169\.|\
               202\.139\.181\.|\
               202\.139\.18[8-9]\.|\
               202\.139\.19[0-1]\.|\
               203\.202\.2\.12[8-9]|\
               203\.202\.2\.1[3-5][0-9]|\
               203\.202\.5\.[0-7]|\
               203\.202\.5\.1[6-9]|\
               203\.202\.5\.2[0-9]|\
               203\.202\.5\.3[0-1]|\
               203\.202\.3[0-2]\.|\
               203\.202\.48\.|\
               203\.202\.70\.6[4-9]|\
               203\.202\.70\.7[0-9]|\
               203\.202\.70\.24[8-9]|\
               203\.202\.70\.25[0-5]|\
               203\.202\.88\.|\
               203\.202\.109\.|\
               203\.202\.130\.|\
               203\.202\.13[7-8]\.|\
               203\.202\.14[8-9]\.|\
               203\.202\.15[0-3]\.)
{ OPTUS=yes }

:0 BH
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP MESSAGE-----
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -200^1   ^[:;#>]
*  1100^0    192\.65\.8[2-9]\.
*  1100^0    192\.65\.9[0-1]\.
*  1100^0    202\.139\.[0-1]\.
*  1100^0    202\.139\.[6-7]\.
*  1100^0    202\.139\.1[8-9]\.
*  1100^0    202\.139\.3[2-3]\.
*  1100^0    202\.139\.39\.
*  1100^0    202\.139\.46\.
*  1100^0    202\.139\.49\.
*  1100^0    202\.139\.50\.
*  1100^0    202\.139\.63\.
*  1100^0    202\.139\.8[2-3]\.
*  1100^0    202\.139\.8[7-8]\.
*  1100^0    202\.139\.94\.
*  1100^0    202\.139\.110\.
*  1100^0    202\.139\.113\.
*  1100^0    202\.139\.120\.
*  1100^0    202\.139\.12[3-4]\.
*  1100^0    202\.139\.12[7-9]\.
*  1100^0    202\.139\.13[0-9]\.
*  1100^0    202\.139\.14[0-3]\.
*  1100^0    202\.139\.166\.
*  1100^0    202\.139\.169\.
*  1100^0    202\.139\.181\.
*  1100^0    202\.139\.18[8-9]\.
*  1100^0    202\.139\.19[0-1]\.
*  1100^0    203\.202\.2\.12[8-9]
*  1100^0    203\.202\.2\.1[3-5][0-9]
*  1100^0    203\.202\.5\.[0-7]
*  1100^0    203\.202\.5\.1[6-9]
*  1100^0    203\.202\.5\.2[0-9]
*  1100^0    203\.202\.5\.3[0-1]
*  1100^0    203\.202\.3[0-2]\.
*  1100^0    203\.202\.48\.
*  1100^0    203\.202\.70\.6[4-9]
*  1100^0    203\.202\.70\.7[0-9]
*  1100^0    203\.202\.70\.24[8-9]
*  1100^0    203\.202\.70\.25[0-5]
*  1100^0    203\.202\.88\.
*  1100^0    203\.202\.109\.
*  1100^0    203\.202\.130\.
*  1100^0    203\.202\.13[7-8]\.
*  1100^0    203\.202\.14[8-9]\.
*  1100^0    203\.202\.15[0-3]\.
{ OPTUS=yes }

:0
* OPTUS ?? yes
{
:0 f
| ${FORMAIL} -A"X-SBRule: optus.net.au netblock"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# planet.nl
#
# Updated and domains verified 11/07/01
# Last reported spam: 10/27/01
# Other Relevant Info:
#   Email by system administrator states that planet.nl acts on spam
#   complaints only for spam sent from their servers, but will not
#   shut down a web site advertised in spam sent from somewhere else.
#   That makes them a spam haven.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](62\.131\.[0-9][0-9]?[0-9]?\.|\
          80\.60\.[0-9][0-9]?[0-9]?\.|\
          195\.121\.0.|\
          195\.121\.1\.[0-9]|\
          195\.121\.1\.[0-8][0-9]|\
          195\.121\.1\.9[0-5]|\
          213\.10\.[0-9][0-9]?[0-9]?\.|\
          213\.75\.[0-9][0-9]?[0-9]?\.)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: planet.nl netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# RackSpace
#
# Updated and domains verified 11/02/02
# Other Relevant Info:
#   Huge amounts of colocated/hosted spammers, isn't doing anything
#   about them.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](64\.49\.19[2-9]\.[0-9][0-9]?[0-9]?|\
          64\.49\.2[0-4][0-9]\.[0-9][0-9]?[0-9]?|\
          64\.49\.25[0-5]\.[0-9][0-9]?[0-9]?|\
          66\.216\.6[4-9]\.[0-9][0-9]?[0-9]?|\
          66\.216\.[7-9][0-9]\.[0-9][0-9]?[0-9]?|\
          66\.216\.1[0-1][0-9]\.[0-9][0-9]?[0-9]?|\
          66\.216\.12[0-7]\.[0-9][0-9]?[0-9]?)
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: RackSpace netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Safepages.com
#
# Updated and domains verified 10/31/01
# Relevant Info:
#   Reverse DNS for lots of spam sites.  For this reason, only email with
#   safepages.com in the Received: headers is blocked, not email from the
#   site itself.
#
# Status: Irresponsible Site
#
:0
* ^Received:.*[^0-9a-z]safepages\.com([^a-z0-9\.]|$)
{
:0 f
| ${FORMAIL} -A"X-SBRule: Safepages.com rDNS"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# seed.net.tw
#
# Updated and domains verified 8/11/02
# Last reported spam: 8/11/02
# Other Relevant Info:
#  Chinese network that appears in huge amounts of spam.  Probably rogue,
#  but just blocked as a precaution now.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](139\.175\.[0-9]\.[0-9]?[0-9]?[0-9]|\
          139\.175\.[1-9][0-9]\.[0-9]?[0-9]?[0-9]|\
          139\.175\.1[0-9][0-9]\.[0-9]?[0-9]?[0-9]|\
          139\.175\.2[0-4][0-9]\.[0-9]?[0-9]?[0-9]|\
          139\.175\.25[0-5]\.[0-9]?[0-9]?[0-9]|\
          203\.73\.[0-9]\.[0-9]?[0-9]?[0-9]|\
          203\.73\.[1-9][0-9]\.[0-9]?[0-9]?[0-9]|\
          203\.73\.1[0-9][0-9]\.[0-9]?[0-9]?[0-9]|\
          203\.73\.2[0-4][0-9]\.[0-9]?[0-9]?[0-9]|\
          203\.73\.25[0-5]\.[0-9]?[0-9]?[0-9]|\
          210\.64\.[0-9]?[0-9]?[0-9]\.[0-9]?[0-9]?[0-9]|\
          211\.74\.[0-9]\.[0-9]?[0-9]?[0-9]|\
          211\.74\.[1-9][0-9]\.[0-9]?[0-9]?[0-9]|\
          211\.74\.1[0-1][0-9]\.[0-9]?[0-9]?[0-9]|\
          211\.74\.12[0-7]\.[0-9]?[0-9]?[0-9]|\
          (^|[^-_0-9a-z])seed\.net\.tw([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: seed.net.tw"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# seeder.net.tw/seeder.net
#
# Updated and domains verified 8/11/02
# Last reported spam: 8/11/02
# Other Relevant Info:
#  Chinese network that appears in huge amounts of spam.  Probably rogue,
#  but just blocked as a precaution now.
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](202\.43\.6[4-9]\.\[0-9]?[0-9]?[0-9]|\
          202\.43\.[7-8][0-9]\.\[0-9]?[0-9]?[0-9]|\
          202\.43\.9[0-5]\.\[0-9]?[0-9]?[0-9]|\
          (^|[^-_0-9a-z])seeder\.net(\.tw)?([^a-z0-9\.]|$))
{
:0 f
| ${FORMAIL} -A"X-SBRule: seeder.net.tw"

:0
{ BLOCKTAG=yes }

:0
* BLOCKREPLY ?? NOTIFY
{ BLOCKTHIS=yes }
}


# Shanghai Telecom Data Communication Division IDC
#
# Updated and domains verified 12/11/02
# Other Relevant Info:
#
#   12/09/02:
#    Sudden influx of spammers hosted here, bounces on email
#    sent to abuse@ addresses registered at abuse.net.  Not
#    sure what the problem is, but blocking as a precaution
#    because of Christmas spam rush.
#
# Status: Irresponsible Site
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](61\.129\.6[4-9]\.[0-9][0-9]?[0-9]?|\
          61\.129\.[7-8][0-9]\.[0-9][0-9]?[0-9]?|\
          61\.129\.9[0-3]\.[0-9][0-9]?[0-9]?)
{ SHANGHAITELECOM=yes }

:0
* LEANTAG ?? no
* ! SHANGHAITELECOM ?? yes
* !^Subject: .*\(fwd\)
{
 :0 B
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP MESSAGE-----
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -200^1   ^[:;#>]
 *  -200^1    UCE
 *  1100^0    (^|[^-_0-9a-z])61\.129\.6[4-9]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])61\.129\.[7-8][0-9]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 *  1100^0    (^|[^-_0-9a-z])61\.129\.9[0-3]\.[0-9][0-9]?[0-9]?([^a-z0-9\.]|$)
 { SHANGHAITELECOM=yes }
}

:0
* SHANGHAITELECOM ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Shanghai Telecom netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# SpeakEasy.net
#
# Updated and domains verified 12/11/02
# Other Relevant Info:
#
#   12/11/02:
#     Tons of spew, registration records almost empty, no way to contact
#     the admins. :/
#
# Status: Irresponsible Site
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]202\.108\.68\.[0-9][0-9]?[0-9]?
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Yun Tong netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Telefonica de Argentina
#
# Updated and domains verified 2/20/03
# Other Relevant Info:
#
#   2/20/03:
#     Frequent source of dial-up throwaway accounts used by
#     Argentinian spammers.
#
# Status: Irresponsible Site
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]168\.226\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Telefonica de Argentina netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


# Yun Tong Ke Ji Co. Ltd.
#
# Updated and domains verified 11/05/02
# Other Relevant Info:
#   11/05/02: Another Chinese company that might be spammers, or might
#     just be clueless.  Source of too much spam, though. :/
# Status: Irresponsible Site
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z]202\.108\.68\.[0-9][0-9]?[0-9]?
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: Yun Tong netblock"

 :0
 { BLOCKTAG=yes }

 :0
 * BLOCKREPLY ?? NOTIFY
 { BLOCKTHIS=yes }
}


