# # #
# 
# NOTE: If you're viewing this file with a web browser, some of the 
#       recipes will not display properly because of the "<" and 
#       ">" characters.  In that case, view the source of this file.
#
# spam/tag-radical "procmailrc" file
#
# TO USE THESE RECIPES, put
#    INCLUDERC=$tag_dir/tag-radical
# into your "main" procmail file (after the tag file).
#
# This file will tag any message that seems to be
# from a site or provider that has been a consistent
# repeat offender in the past.  THIS FILE CASTS A WIDE
# NET, AND MAY CATCH LEGITIMATE MAIL -- USE AT YOUR
# OWN RISK!
#
# 1996/09/20 Anne Bennett
#   - Initial coding
# 1996/12/19 Anne Bennett
#   - Added code to use Panix's spam recipes too
# 1997/01/07 Anne Bennett
#   - Added code to use AOL's spam recipes too
# 1998/05/19 Anne Bennett
#   - Removed sallynet entries
# 1998/05/20 Anne Bennett
#   - Removed JDFalk entries for cyberpromo, llv, and nancynet (dead)
#   - Removed tag-aol (no longer maintained)
#   - Removed miscellaneous entries which were no longer performing.
#   - Added JDFalk entry for linkus
# 1998/12/08 Anne Bennett
#   - Added Xmas tag file
# 1999/08/12 Anne Bennett
#   - Added MindSpring spam recipes
# 1999/11/11 Anne Bennett
#   - Added variable for location of includes directory (tag_dir).
# 2002/01/22 Anne Bennett
#   - Removed MindSpring spam recipes; they are sending empty data
#     as of 2001/11/28.  Lists no longer available; their despamming
#     is now provided by Brightmail.
# 2002/03/11 Anne Bennett
#   - Panix caught 241 of the 4128 caught messages between 20021/08/21
#     and 2002/03/10 (7 months); of the 241 tagged by Panix, 188 were
#     tagged by other rules as well.  In other words, Panix was solely
#     responsible for 53 of 4128 hits (1.2%).  Since Panix no longer
#     seems to be keeping their list updated, we won't use it any more.
# 2002/03/11 Anne Bennett
#   - "tag-jdfalk-linkus" was last changed in late 1998, and has had
#     no hits since at least August 2001, so we won't use it any more.
# 2002/12/12 Anne Bennett
#   - (Last update)
#
# ----------- "spam" series configuration done in "spam/tag"

# Include our
# modified versions
# of MindSpring's recipes too.  
# REMOVED 2002/01/22
#INCLUDERC=$tag_dir/tag-mindspring

# -----------

# Include our 
# modified versions
# of Panix's recipes too.  
# REMOVED 2002/03/11
#INCLUDERC=$tag_dir/tag-panix

# -----------

# Include our procmailified versions of J.D.Falk's domain lists.
# J.D.Falk is the maintainer of the
# Net-Abuse FAQ.
# Our corresponding procmail files are in:
# /topics/email/auto/procmail/spam/tag-jdfalk-linkus.html
# 
# REMOVED 2002/03/11
#INCLUDERC=$tag_dir/tag-jdfalk-linkus

# -----------

# Include our 
# Christmas greetings
# file which catches large binary Christmas greetings, a real plague.  See
# Ho-ho-holiday headache
# for more information.
INCLUDERC=$tag_dir/tag-xmas

# -----------

# interramp+aol 1996/09/20
:0 Hf
* ^Received: .*interramp\.com
* ^(To|From): .*aol\.com
| formail -b -f -A "$trash_header siteban interramp+aol"

# Material obtained from spam-l.
#
# 1stfamily.com is a well-known spam-generating MLM site.
:0 Hf
* ^(To|From|Received|Reply-To|Sender):.*\<1stfamily\.com\>
| formail -b -f -A "$trash_header siteban spam-l 1"
#
# Anything with this bogus To: header has to be spam.
:0 Hf
* ^(To|From|Received|Reply-To|Sender):.*\
| formail -b -f -A "$trash_header siteban spam-l 2"
#
# iemmc.org is the "Internet EMail Marketing Council" relay host.
:0 Hf
* ^(To|From|Received|Reply-To|Sender):.*\
| formail -b -f -A "$trash_header siteban spam-l 3"
#
# Another iemmc.org marker
:0 Hf
* ^X-.*: .*\
| formail -b -f -A "$trash_header siteban spam-l 4"
#
# Spamford's messages often mention his web site in X- headers.
:0 Hf
* ^X-.*: .*\
| formail -b -f -A "$trash_header siteban spam-l 5"
#
# Bogus (exists, but autoresponds as having no users)
:0 Hf
* ^(To|From|Received|Reply-To|Sender):.*\
| formail -b -f -A "$trash_header siteban spam-l 6"
#
# as reported on SPAM-L, AOL addresses cannot be solely numbers.
:0 Hf
* ^(To|From|Received|Reply-To|Sender):.*\<[0-9]+@aol\.(com|net)\>
| formail -b -f -A "$trash_header siteban spam-l 7"
#
# DISABLED per Neil 1999/08/12
# Earthlink's relay that is used primarily for spam
##:0 Hf
#* ^Received: .*\.it\.earthlink\.net
#| formail -b -f -A "$trash_header siteban it.earthlink.net"


# linkus.com
# Per Neil, 1998/05/17
:0 Hf
* ^(To|From|Received|Reply-To|Sender):.*\<207\.93\.198\.[0-9][0-9]*\>
| formail -b -f -A "$trash_header siteban linkus"
:0 Hf
* ^(To|From|Received|Reply-To|Sender):.*\
| formail -b -f -A "$trash_header siteban linkus"


# Translations for our site of some Panix-derived recipes
# 1998/04/16 Anne
:0 Hf
* ^To: internet.*@(|alcor\.)concordia\.ca\>
| formail -b -f -A "$trash_header siteban panix-like 1"
:0 Hf
* ^To:.*entrepreneurs?@(|alcor\.)concordia\.ca\>
| formail -b -f -A "$trash_header siteban panix-like 2"
:0 Hf
* ^To: (.*member|.*friend|you)@(|alcor\.)concordia\.ca\>
| formail -b -f -A "$trash_header siteban panix-like 3"
# new sendmail no longer marks bounces with "internal id"
###:0 Hf
###* ^From:.*MAILER-DAEMON@(alcor\.|)concordia\.ca
###* !^Received:.*internal id
###| formail -b -f -A "$trash_header siteban panix-like 4"


# Blank from or to line (exists but is empty)
# 1998/04/16 Anne
:0 Hf
* ^From: $
| formail -b -f -A "$trash_header siteban empty from"
:0 Hf
* ^To: $
| formail -b -f -A "$trash_header siteban empty to"

# mailgod bulk mailer
# Per Neil, 1998/06/15
:0 Hf
* ^Received:.*MAILGOD\.by\.IMI
| formail -b -f -A "$trash_header ordinary mailgod"

# Per Neil, 1998/06/16
:0 Hf
* ^Received:.*\<((aubbs|accessnet)\.com|verycool\.net)\>
| formail -b -f -A "$trash_header siteban verycool,aubbs,accessnet"
:0 Hf
* ^From:.*\
| formail -b -f -A "$trash_header ordinary goodnews"

# Per Neil, 1998/06/30
:0 Hf
* ^Received: from Server .*
| formail -b -f -A "$trash_header ordinary server"

# Invalid hotmail addresses, per Neil, 1998/07/27
#
# Hotmail addresses never start with a number:
:0 Hf
* ^From:.*\<[0-9][^ ]*@hotmail\.com\>
| formail -b -f -A "$trash_header ordinary hotmail invalid start-number"
#
# Hotmail addresses never have a host part:
:0 Hf
* ^From:.*@[^ ]*\.hotmail\.com\>
| formail -b -f -A "$trash_header ordinary hotmail invalid host-part"
#
# Hotmail messages have Originating-IP, except mail from abuse/policy.
:0 Hf
* ^From:.*@hotmail\.com\>
* ! ^From:.*\<(postmaster|abuse|policy)@hotmail\.com\>
* ! ^X-Originating-IP: \[[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\]
| formail -b -f -A "$trash_header ordinary hotmail invalid no-orig-ip"

# Fakes sprynet messages, per Neil, 1998/07/27-28
#
# Sprynet addresses never have host part in authenticated sender:
:0 Hf
* ^Comments: Authenticated sender is <.*@sprynet\.com>
| formail -b -f -A "$trash_header ordinary sprynet invalid comments"
#
# Sprynet has no all-numeric usernames:
:0 Hf
* ^From:.*\<[0-9]+@sprynet\.com\>
| formail -b -f -A "$trash_header ordinary sprynet invalid username"

# Invalid MSN addresses, per Neil, 1998/09/09
#
# MSN email addresses cannot contain exclamation points, pound,
# percentage or dollar signs.
:0 Hf
* ^From:.*\<.*[!#%$@][^ ]*@msn\.(com|net)\>
| formail -b -f -A "$trash_header ordinary msn invalid address"

# Invalid ApexMail addresses, per Neil, 1998/09/09
#
# Numerics at beginning of ApexMail e-mail address not permitted.
:0 Hf
* ^From:.*\<[0-9][^ ]*@apexmail\.com\>
| formail -b -f -A "$trash_header ordinary apexmail invalid username"
#
# All ApexMail messages have X-MAILFROM-IP header.
:0 Hf
* ^From:.*@apexmail\.com\>
* ! ^X-MAILFROM-IP:
| formail -b -f -A "$trash_header ordinary apexmail missing X-MAILFROM-IP"
#
:0 Hf
* ^From:.*@apexmail\.com\>
* ^X-MAILFROM-IP:
* ! $^X-MAILFROM-IP:.*\[${VALIDIP}\]
| formail -b -f -A "$trash_header ordinary apexmail invalid X-MAILFROM-IP"

# Pre-emptive site ban because of netnews spamming, per Neil 1998/09/28
:0 Hf
* ^(To|From|Received|Reply-To|Sender):.*\<(dheahealth|thescent|emreg|ademail|sex-aphrodisiacs|transsexualweb|sex-attraction|lust-online|quitsmokingforever|live-transsexuals|yes-pheromones|lustdesires|femaleseduction|meetmorewomen|sexboxoffice|sexpheromones|houseofseduction|ictcom|internology|pure-instinct|web-promoters|agsjewelry|floridafleamarket|web-adulthosting)\.com\>
| formail -b -f -A "$trash_header siteban repsis 1"
#
:0 Hf
* ^(To|From|Received|Reply-To|Sender):.*\
| formail -b -f -A "$trash_header siteban repsis 2"
#
:0 Hf
* ^(To|From|Reply-To|Sender):.*\<(repsis@(web2010\.com|gdi\.net)|thescent@ict-web\.com)\>
| formail -b -f -A "$trash_header siteban repsis 3"

# *.hk.super.net, Per Neil, 1998/12/08
:0 Hf
* ^(To|From|Received|Reply-To|Sender):.*\
| formail -b -f -A "$trash_header siteban hk.super.net"

# webtv, per Neil 1998/12/17:
# - Logon will never be more than 15 or less than 3 characters.
# - Logon will never be from the domain 'webtv.com', but will always
#   originate from 'webtv.net'.

:0 Hf
* ^(To|From|Received|Reply-To|Sender):.*\
| formail -b -f -A "$trash_header ordinary webtv .com forgery"

:0 Hf
* ^(To|From|Sender):.*\<[a-zA-Z0-9_][a-zA-Z0-9_]?@webtv\.net\>
| formail -b -f -A "$trash_header ordinary webtv username too short"

:0 Hf
* ^(To|From|Sender):.*\<[a-zA-Z0-9_][a-zA-Z0-9_][a-zA-Z0-9_][a-zA-Z0-9_][a-zA-Z0-9_][a-zA-Z0-9_][a-zA-Z0-9_][a-zA-Z0-9_][a-zA-Z0-9_][a-zA-Z0-9_][a-zA-Z0-9_][a-zA-Z0-9_][a-zA-Z0-9_][a-zA-Z0-9_][a-zA-Z0-9_][a-zA-Z0-9_]+@webtv\.net\>
| formail -b -f -A "$trash_header ordinary webtv username too long"

## # per Neil, 1998/12/22
## # removed by Anne 2000/10/13 (25 false-positives vs 5 legitimate catches)
## :0 Hf
## * ^Message-ID:.*<.*@default>
## | formail -b -f -A "$trash_header ordinary message-id default"

# per Neil, 1999/03/03
:0 Hf
* ^(To|From|Sender|Received):.*\<(TargitMail\.com|gtminet\.net|gtmiadworx\.net)\>
| formail -b -f -A "$trash_header siteban walt rines"

# per Neil, 1999/03/15
:0 Hf
* ^Subject: adv:
| formail -b -f -A "$trash_header ordinary subject adv"

# per Neil, 1999/08/18
:0 Hf
* ^(To|From|Sender|Received):.*\<(newamerica\.org|npcollege-edu\.net)\>
| formail -b -f -A "$trash_header siteban newamerica"

# per Neil, 1998/11/02, added 2000/01/04
:0 Hf
* ^(From|Received):.*\.promovis\.ch
| formail -b -f -A "$trash_header ordinary promovis.ch"

# Translation for our site of a Panix-derived recipe
# 1998/04/16 Anne
# 2000/01/04 Anne: removed check that From line is *not* local
# 2000/01/04 Anne: improved regexp for detecting "by host.concordia.ca"
:0 Hf
* ^Received: from.*(dialup\.earthlink|us\.ibm|dialsprint|da\.uu|gt\.uu|ms\.uu|dial-access\.att|dialup.*\.mci|pub-ip\.psi|port[0-9]+\.jps|ppp-.*\.pacbell|ts[0-9]+.*\.concentric|pool.*\.grid|sc[0-9]+.*\.thegrid|usr-.*\.win)\.net *by [^ ]+\.concordia\.ca
| formail -b -f -A "$trash_header siteban dial-up 1"

# Per Neil 2001/03/22
# Four consecutive spaces in the subject lines; apparently a spammer
# personalization trick "Subject: Here's what you wanted      12b3d6".
# Oops, that catches too much.  Try six spaces after at least one non-space.
# Rich Lafferty reports: start getting false positives at 5 spaces,
# and start losing correct hits at 10.
:0 Hf
* ^Subject: .*[^ ].*      .*
| formail -b -f -A "$trash_header ordinary four-spaces"

# Per Neil 2001/03/26
:0 BHf
* .*\<(herbal v|herbal viagra)\>
| formail -b -f -A "$trash_header ordinary herbal-v"

# Per Neil 2001/04/04
# "The real one is spamcop.net, this is a spammer who is mocking Julian"
:0 BHf
* .*\
| formail -b -f -A "$trash_header ordinary spamcop-faker"

# Per Neil 2001/04/09
:0 BHf
* .*\<(Johnathon Rourke|international executive guild)\>
| formail -b -f -A "$trash_header ordinary misc-2001/04/09"

# Per Neil 2001/03/26
# spamhaus.org additions, (A-D listings)
# Check in header and body
# 2001/05/11 added "codebynite.com" per Neil
:0 BHf
* .*\<(101super|123cyberave|1stfinancing|360hosting|4liferecords|4outdoorsman|4smartec|aaamericafind|aamercafinder|aamericafind|aamericafinder|aamericafnder|aamericfinder|aliasbrokers|america-find|americafind|andnewsletters|andsweepstakes|aptitudetesting|aromapatch|bakesoft|bedbunny|bhmailbox|bitca|bulk-isp|bulkemailgroup|bulkispcorp|chipperclownman|codebynight|codebynite|cumseemenow|cyber-results|cybercreek|cyborgy|datacommarketing|desktopserver|desktopserver2001|dm1-cc|dm1ftp|drthwilliams|earnmoremarketing|earnmorepublishing|emailtools|emu-efnet|esocal|extreme-marketing|eyeblast|ezmerlin|femalesluts|fetishy|findtracesearch|formorinternational|freesitesrus|globalhostinginstitute|gothardcore|gotloan|gulf-island-digital|homebusiness-network|hostsuccess)\.com\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.a-d.part-1"

:0 BHf
* .*\<(i-ops|img-online|increasenet|information-411|intravest|intravestment|intravestor|iopsradio|isc2000|masterdisc2000|maximauction|megahostgrp|michellebattles|microsyssolutions|middleeastisp|missingsincemonday|moesha|myxwives|netwisepublishing|networkwww|ourmailhouse|pennygasclub|port5|premium-websolutions|psychololli|qorban|rateu|rego-enterprises|rego-world|selectivemarketing|sexagon|sexstreams|shapesonline|silvatek|starstuf|swffr|teenatic|thefinancialbridge|theleadsystem|therackroom|toad-ally|tokoroinc|traceramerica|uclickedsodontcomplain|uniporn|usastarbusiness|usastarmall|usastarsearch|vegas-vegas|virtualmagazines|virtualpaymentsystem|webofmoney|wickedvideos|world-services|www-llc|xmoviedirector|xxxpornobabes|xxxyoungstuds)\.com\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.a-d.part-2"

:0 BHf
* .*\<(1stfinancing|247365|4marketing|aaamericafind|aamericafind|aliasbrokers|america-find|americafind|andsweepstakes|bulk-isp|bulkisp|cyborgy|data-miners|datingsingles|earnmoremarketing|einventory|email-prom|emailtools|esocal|eyeblast|fabrikant|family-care|geekbox|gojohnny|gozone|img-online|internet-promotions|internetpromos|intravestment|intravestor|intravest|media21|nastyteens|netsurfers|netwisepublishing|nicproductions|nictechnologies|onlinedirect|pcmagic|plutonet|purefantasy|resultsmarketing|rint|secksi|thetrendsetters|toadally|tofu|turnkeycasino|uniporn|vegas-vegas|virtualpaymentsystem|zentek)\.net\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.a-d.part-3"

:0 BHf
* .*\<((bulkisp|targetdirect)\.nu|(aliasbrokers|baumbach|billsmail|calstatelongbeach|combat|debthelper|dwelling|eyeblast|formor|his-place|indecisive|listwasher|loan-search|mailcom|missingsincemonday|samal|turnkeycasino|unstable|utopialinux|vegas-vegas)\.org)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.a-d.part-4"

# Per Neil 2001/04/03
# spamhaus.org additions, (E-G listings)
# Check in header and body
:0 BHf
* .*\<((100autobuying|100mobilebuying|100pricewar|100usedcarprice|10offbuy|1800pricewar|4adoge|800bidacar|abestvalue|airplaneprices|alllists|apraisers|atorneys|auto--guide|auto-carprices|autocrawler|autofusion|automobilereview|autorave|autos-carprices|avamed|bestof-america|bestof-nevada|billsoverdue|blackswancobs|bookbuyer|bounties|bountys|browse-carprices|bulkemailsoftwaremarketing|bulkemailsoftwarestore|buy-carprices|buyat-carprices|buyingacaronline|cadillaccom|car--buying|car--prices|carcache|cardealerpricewar|carprices|carpricessucks|carreerpath|centreexchange|classfied|classfieds|codywy|colormymouse2|concious|consumervault|coolcontacts|credit2005|creditpluscard|crenshawlady2|cybercreek|datastreamhosting|debt-control|desktoptuner|doggieview|downloadoutlet|downloadshop|ebuy-carprices|emailexpeditor|empiretowers|escortdigest|eshop-carprices|find-carprices|findingacaronline|freedish|g-forcehosting|gamblegalore|globalspeedway|globaltekgrp|golfadz|golfcitymall|golfniagrafalls|golfuniverse|goto-carprices|greentulip5|groovyeggplant|hiddenvalleyhigh|hitache|hotpixxx|huesandbubbles|huyandia|ideast|imescon|info-carprices|insideportfolios|ishoppingoutlet|ivnstats)\.com)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.e-g.part-1"

:0 BHf
* .*\<((jetsonville|kbr1|knowledgepod|lesbianthrills|letsdate|look4service|lookforservice|lookforservices|lorial|lose-inches-fast|masteragents|mayballine|merykay|michigangiftmart|misspelled|monstorboard|motorsportdesign|moveing|myauctionoutlet|myautoreport|myemailoffer|myofficeoutlet|mypricewars|mytraveloutlet|nabl|network4web|network4web|neutragena|new--car|newcarpricewar|newstartmanual|nightauto|outboundusa|outletrx|pedsdrugs|pedsmeds|picturesoftware|pioneer-net|poplaunch|pornostore|price-cars|prlies|rbbinvestments|royalrugsystems|sabadjian|sdcarprice|sdcarprices|search4-carprices|selectacar|shop-carprices|shopat-carprices|shoppingtrip|showitall|smtm1|spiderpromotions|sugarbrook|sunnysideofthestreet|targetmails|theautoreport|thecomicsite|themortgageden|towerrecordscom|traffic-maker|travelandfinance|truckprices|ubidon|umarketit|upcar|usedcarpricewar|uslongdistance|visit-carprices|web-site-commerce|webqwest|welshponies|wnog|wtloss|wwwcadillac|wwwferarri|wwwjeepunpaved|wwwlandrover|wwwlincolnvehicles|wwwmercuryvehicles|wwwmitsucars|wwwporche|wwwsaabusa|wwwsixt|wwwtowerrecords|wwwusaautonews|wwwusautonews|yournewcredit|yourpricewar)\.com)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.e-g.part-2"

:0 BHf
* .*\<((conceptual|credit123|credit2000|emailoffer|funstuff2000|golfnaples|golfpromo|homeownerscredit|innovest|invest-now|investmentmail|isavecash|justgotmail|justgotweb|pedsdrugs|pedsmeds|select-a-car|shoplet|startyourownpricewar|swsna|theproshop|usedautosales|visualsecretssoftware)\.net)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.e-g.part-3"

:0 BHf
* .*\<(golfpromo\.cc|financialnews\.nu|bizemail\.to|serverpro\.to|sportsandtravel\.org.uk|travelandfinance\.co.uk|(allamerican|bestinfo|compuman|emmex|hostoffice|muchodinero|novanet)\.com\.mx|(cfuce|combat|mypricewar|pedsdrugs|pedsmeds|select-a-car)\.org)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.e-g.part-4"

# Per Neil 2001/04/09
# spamhaus.org additions, (I-L listings)
# Check in header and body
:0 BHf
* .*\<((1-800-1stplace|1inallonline|affiliatefreepages|amygdalin|answertocancer|apricotsfromgod|armwrestling|bulk-board|canceranswer|cancernomore|carbcutter|catelogs|christianbrothers|cyberfreepages|dentalhealthnet|dietomaha|discountdomainregistry|domain-quick|domaindns|eactive|eatseeds|eatseeds|eclubint|enameserv|eroticmidnight|esweeps|esweeps|extremepenis|famvid|findouteverything|free-p0rno|freehostcommunity|freehostearth|freehostglobe|freehostinet|freehostlake|freehosttown|freehostvillage|gastonsplanetproducts|getitright|giveawayvacations|golfgreat|gotwebpage|greatfreesite|greetking|greetkingcards)\.com)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.i-l.part-1"

:0 BHf
* .*\<((heavenlyhealing|herbalo|ibecorporation|imoneg|imwebhosting|inameserv|inches-away-now|instructingu|interacitvemidnight|jasonvale|jiefreehost|jietelecom|mailrewards|monemakr|nameservers9|nationalsolutions|naturalhealings|nis4u|odiets|omahamg|onlinefreehost|open2win|opt-track|opthost|optininc|optmerchant|opttrack|postmasternetwork|prhost|proteinlifestyle|pureproteindiet|retail-display|searchengine-ranking|service-won|theatreartsguild|theclotherie|vacation-giveaways|vitaminb17|websiteoptimizationplus|websiteoptimizationplus|webyellowpages|wildvelvet|xcitemail|xxxp0rn|xxxpure|youngteensexonline)\.com)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.i-l.part-2"

:0 BHf
* .*\<((advancedisp|agingsolutions|amygdalin|answertocancer|apricotsfromgod|bestoffreesites|bulkemailsoftware|cyberfreepages|dialtoneinternet|dns-routing|e-ps|edirectnetwork|everyonesfreesite|findouteverything|freehostnet|freehostusa|general-delivery|greetking|hyperfax|ibizsuccess|iboc|inameservers|laetrile|mailrewards|marketing-2000|netaffiliatepages|oi2|oin3|oin4|oin5|oin7|oin8|opt-in-net|opt-inbroadcasts|penisgrowth|planetwebb|pmn00|pmn1|postmasternetwork|profitcenter|secureroutes|vacation-giveaways)\.net)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.i-l.part-3"

:0 BHf
* .*\<((abfchurch|apricotsfromgod|fathersheartministries|general-delivery|mindtechuniversity|nitech)\.org|nicolas\.cx|aboutwebsitepromotion\.tv|searchengineranking\.tv|websitespromotion\.tv)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.i-l.part-4"

# Per Neil 2001/04/18
# spamhaus.org additions, (M-R listings)
# Check in header and body
:0 BHf
* .*\<((00-bulk-email-software|1-800-timeshares|1secureserver|1st-affordable-computers|1st-bulk-email-software|1st-bulk-email-software-superstore|1st-cable-box-descramblers|1st-cable-tv-boxes-descramblers|1st-cigar-humidors-spanish-cedar-travel-discount-desltop|1st-clean-credit-repair|1st-rate-cheap-computers|1st-smart-access-card-programmers|1st-smart-card-programmers|1stclass-cigar-humidors|aaanews|aaatechnologies|accountantlinks|ace-embroidery-sewing-machines|acesewvac|acutec-ltd|americaint|americanbulldog|auto-insurance-net|automaticdebit|avtechint|awwww|bayoucom|beautycontestants|bestleads|bicycledata|bigold|bizdrive|boopywas|broadwing|buddybeam|bulk-email-center|bulk-email-software-addresses|bulk-email-software-center|bulk-email-software-programs-lists-services|bulk-email-software-superstore|bulkemailcenter|bulkemailsoftwarecenter|bulkemailsuperstore|bulkerzsolutions|cable-boxes-unlimited|camania|caribbeanshoppers|cashorcamera|casinocity|catz-inc|cgiexpert|classic-cars-n-cycles|classic-data|clubsoftware|cmcholdings|cmcholdingsltd|coffee-tea-pots-cups|commissionsaver|consultants-4-u|crittercash|cybercashguys|cyberfreehosting|cycledata|cyclefax|cyclemail|direct-tv-dss-satellite-test-tv-hu-cards|directmail-marketing|discountmarketplace|doctortraffic|doithere|drtraffic|earthonline-downloads|elijahlist|emailsoftwaresolutions|embroidery-sewing-machines-cards-vacuums-cleaners|everythingandmoreonline|financinglinks|fireflyingfall|fishinginaustralia|floristlinks|foryourpeaceofmind|franchisinglinks|free--webservices|free-webservices|freebweb2|freecyberhosting|freednsbox|freeworldpages|freshleadsdirect|fyipdq|fypom|globaldatadotcom|globe-net|guaranteedtowork)\.com)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.m-r.part-1"

:0 BHf
* .*\<((hatstop|hawgmail|hdmail|health-insurance-net|healthclublinks|homebusinessopp|hostable|hot-young-teen-college-pussy|hotreply|insurancelinks|internet-nameserver|internetdealsdirect|intlstockinfo|jamgroovesociety|kawasakimail|kellysquest|labelv|leaddatabase|leadleader|leads2go|leadstoday|legalhelplinks|life-insurance-net|lyleandaudrey|marketing-on-internet|marketingmazters|markinet|marsspacestation|mbmarketing|mississippihomefinder|moneymatterswireless|mortgagelinks|motellinks|nationalbusinessnet|navfree|netmarketingpros|newcarlinks|newportmarketing|ng214|optinmailingdomain|optinspecialoffers|pcspy2000|pharmacom-group|pneumasoft|programmersavailableimmediately|programming-29-hour|pussyvalley|quest2success|realestateagentlinks|regbox|relihosting|rewardvisit|rivage|roadtowealth|satellite-dish-network-direct-tv-dss|searchengineregister|setupyourwebsite|sewing-machines-singer-brother-viking-janome-embroidery|sexy-young-teen-pussy|sixthsense2|sixthsenseii|softwarebydownload|softwaretown|supersavingscenter|suzukimail|the-cable-guy|theinsnet|theinsurancemall|thesixthsense2|thesixthsenseii|thindrops|top20ranking|travelagentlinks|travelincentives99|unination|usedcarlinks|vetech1|virtualchurch2000|w2w4u|webenrollersystem|webspace4free|weintl|workingwebpeople|worldbusinessnetworks|www-spanish|www-spy|y2kisp|yamahamail|young-hot-naked-teen-pussy|young-teen-hot-pussy-naked-pictures|yourgooddeal)\.com)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.m-r.part-2"

:0 BHf
* .*\<((1-800-computers|1-888-computers|1freesite|1st-clean-credit-reports-bad-loans-debt-repair-program-bank|a1eservice|bayoucom|bestproducts|bicycledata|bizdrive|broadwing|businessvalues|buzzlinks|cajunnet|cheap-cable-box-descramblers|cigars-humidors-online|clean-credit|coffee-tea-pots-cups|cyber-consultants|cyber-pages|ddt|endzeit|free-web-page|free-webservices|gateware|globesys|guaranteedtowork|hollywoodsecrets|homebusinessmoney|informationagent|interwebcorp|jamin|justthebest|leaddatabase|leadstoday|mailshack|marketingexpress|marsspacestation|mycash2|netprofessionals|novosoft|onlineexpressions|seantucker|sites4free|smartnews|softwaretown|softwarevalues|the-cable-guy|toplessbars|unination|viewprogram|virtualchurch2000|wa-state-resident|wanlessonline|webconnection|webgineering|webtise|westerncoast|worlddollar|worldmarketer|yourownhomebusiness|youthchurch)\.net)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.m-r.part-3"

:0 BHf
* .*\<((bicycledata|coffee-tea-pots-cups|gsent|informationagent|marsspacestation|the-mark|unination|virtualchurch2000)\.org|micromentor\.au|novosoft\.co\.nz|novosoft\.ru|\(541\)772-3965|\(541\)772-3995|\(707\)588-8868|\(888\)340-9733|\(888\)6-neuport|\(888\)663-8767|888-352-5443)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.m-r.part-4"

# Per Neil 2001/04/23
# spamhaus.org additions, (S-Z listings)
# Check in header and body
:0 BHf
* .*\<((1st-homeloans|1st-mortgage-directory|1z7|3bf|57pickup|5es|7ts|92z|accessonesoftware|advantage-life|advertisingmasters|anabolic-bodybuilding|barrelsandthings.combobmiguel|best-stock|best-stocks|bss0axxzpxwf|bulkemailpeople|bulkemailstore|bwcdrom|california-home-loans|calvinenterprises|canadawebhouse|cheapest-travel|compare-interest-rates|compare-loan-rates|compare-mortgage-rates|competing-lenders|cyber-hostmaster|cyber-webb|cyber-webbb|cyber-website|cyberhost2001|cyberjetstream|desktop-server2000|desktop-server2001|desktopserver98|diamondshow|directform|dnsquito|doctor-stock|domain-parking-free|dotcommortgagebanker|duncandns|e-mailblaster|e-mailmagnet|e-trafficdirect|etmp|eworldhost|eworldhost|execguild|execunet2000|executiveguild|executiveguild|expressmailserver|expressmailservice|extractor-pro|extractor-pro98|extractorpro2000|ez-mortgage-loans|faisalnasim|fasioncam|financialbull|find-mortgage-rates|first-internet-national-bank|florida-mortgage-lender|footcorrectors|freehost1|freevacations4you|freewebcity|freewebware|gobluesales|grooveycam|growthstocks2000|growthstocks2000)\.com)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.s-z.part-1"

:0 BHf
* .*\<((hellonheels|hoek-industries|home-loan-info|home-mortgage-lending|home-mortgage-quotes|hot-stock|hot-stocks|iamnaked|iamnude|iexec|illinois-mortgage|illinois-mortgage-rates|imnaked|imnude|inexpensiveair|inforel|instant-mortgage-loans|instant-mortgage-quotes|inteliwebb|internet-411|internetstocks2001|j00da5hj|jt-restaurants|jtsr-stock|lead-tracker|lenderscompete|lexingtonwhoswho|lexingtonwhoswho|list-sorcerer|listsorcerer|listsorcererpro|littlewhorehouse|londoncreekonline|losangeles-mortgage|magimpact|makeyour|marketingmasters|marketprofile2000|massmailer|mastdns|mavericks-bar|maxi103fm|megadirect2000|megafreesites|megauniverse|microcapmarkets|mightymoe|mjicorp|mortgage-loan-info|mortgage-loan-quotes|mortgage-rate-quotes|mynakedbody|mynudebody|naughtyhostess|net-vest|nethost1|netpub-3|new-york-mortgage-lender|newyorkmortgagelender|nudeduderanch|nudesgalore|nudesweb|ohio-mortgage-lender|onlinesportscasino|ontarget98|optin-direct|orange-county-mortgage-lender|orangecountymortgagelender|p1dtiu1s|pakistans|pakpowerpage|park-it-free|pc-xxx|pemma|porno-man|product-barn|qi5iepjtrjmh41483y|qp6kswxum4y|quickfastgain)\.com)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.s-z.part-2"

:0 BHf
* .*\<((r81gs1|ratesavings|real-stock|real-stocks|realestateagentsites|salesform|samson-1|san-diego-mortgage|sdi-labs|sdi-marketing|sdi-marketing|see-the-message-for-remove-instructions|shopngift|smart-stocks|stealthmassmailer|stock-1999|stock-2000|stock-2001|stock-investigator|stock-market1999|stock-market2000|stock-market2001|stock-pick|stock-researcher|stock-sightings|stock-vest|stock-vest|stock99|stockalert2000|stockmarket1999|stockmarket2001|stockmarket2001|stockmarket2002|stockmarket2002|stockmarket2020|stockmarket5000|stockmarketletter|stockprofile2000|stockpromo|stockresearch2000|stocks-1999|stocksfor99|stockspike|stocktrader1999|stocktrader2001|stockwatch2001|stockwatcher2000|stockweb-1999|stockweb-2001|stockweb1001|stockweb1999|stockweb2000|stockweb2001|stockwebcorp|stockwebinc|stockwebsite|stripforyou|stripforyou|super-stocks|supplytel|teleproductsonline|telysis|templeoftorture|thegqclub|thehomeloansource|themixnightclub|therockdns|therockdns|timberdns|tockweb1000|tornadoblaster|trashymonica|visitorsbuy|webgate2000|webhost2001|webpages2001|webstocks1999|webstocks2000|webstocks2001|winner-stocks|winnerstockpicks|wisestocks2000|wisestocks2000|ypeyzblvt3r2km5|yusoki|z-land)\.com)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.s-z.part-3"

:0 BHf
* .*\<((1st-homeloans|1st-loans|1st-mortgages|1stmtg|22ez|22w|22ww|advertisingmasters|california-mortgage|cyber-market|cyber-media|cyber-pages|cyber-spot|cyber-stock|expressmailserver|florida-home-loans|growth-stocks|handycrafts|hegqclub|hereisdsl|hereisdsl|home-loan-rates|host-pros|hostingcentre|infomercial|invisihost|invisimail|leurette|lexingtonwhoswho|live-xxx|mortgage-interest-rate|mortgage-loan-rates|mortgage-quotes|mortgage-refinance|mortgageleads|my-dns|my-dns|naughtyhostess|pemma|real-stocks|reconveyance|starter-kit|stock-pick|stockprofile2000|super-stock|t3t|tcshost|telodigm|telysis|templeoftorture|thebestsales|thecybersite|thecybersite|thehomeloansource|usnameservers|uss|virtualdot|web-housing|weblizard|wq2|x14)\.net|(billsmail|debt-reduction|evasmail|interest-rates|lexingtonwhoswho|missingsincemonday|mortgage-rates|nasim|pakdev|pemma|refinancing|removemenow|thehomeloansource)\.org|pakicomp\.com\.pk|paks\.com\.pk)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org.s-z.part-4"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/06/03
# Check in header and body for all RFC 822
:0 BHf
* .*\<(aticana\.com\.ar|millicom\.net\.ar|att\.net\.br|xjzb\.edu\.cn|cyt\.cu|tur\.cu|iddeo\.es|teleline\.es|45\.fr|dial\.net\.mx|dial-up\.cnt\.ru|ethome\.net\.tw|mtparan\.org|(cma|dpe|microtec|nameservices|wisol)\.net|(birdieon18winsit|cheliobon|coxatwork|etwebs|mergen|ontracinc|orgsites|pinoymail|replicate99|yourname)\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/06/03"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/06/26
# Check in header and body for all RFC 822
:0 BHf
* .*\<(hosting\.ru|ibershop\.com|worldonline\.nl)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/06/26a"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/06/26
# Check in header and body for all RFC 822
:0 BHf
* .*\<(email\.com\.br|yyyee\.com\.br|gayfo\.co\.il|sina\.com\.hk|tripod\.lycos\.co\.kr|url\.com\.tw|st\.net|postaweb\.com|sinaman\.com|toservers\.com|will-secure\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/06/26b"

# Per Neil 2001/06/26
# SPAM-L additions
# Check in header and body
:0 BHf
* .*\<((12floweringbusinesses|ClickMeds|allservicesite|consumersavingnetwork|crazycradle|everythingheresite|free-electric|maleperformamcemethod|mineralscience|spc87085|updatesavings|zooeyes)\.com|(avirtualaccess|bugjuise|gryeengoddess|internetco)\.net|nationalBios\.org)\>
| formail -b -f -A "$trash_header ordinary spam-l 2001/06/26"

# Per Neil 2001/06/26
# spamsites.org additions (providers of spam software or mailing lists)
# Check in header and body
:0 BHf
* .*\<(magnum\.com\.au|tv-pc\.com\.au|fisica\.ufsc\.br|bulkemail\.ca|ink\.ca|softds\.ch|beyondsales\.co|homepage\.com\.hk|superbmarket\.it|bulkemail\.com\.pk|zabrze\.pl|massmail\.ru|bullnet\.co\.uk|phil\.skinheads\.co\.uk|primetek\.co\.uk|soft\.net\.uk|webhits\.ws|emaillists\.org|imatcher\.org|marketenterprise\.org|premier2000\.org|wegroup\.org)\>
| formail -b -f -A "$trash_header ordinary spamsites.org 2001/06/26a"

:0 BHf
* .*\<((1marketing|1tips|all-new|arclightdesign|bluecaribbean|brobus|bulk|bulk-email-software|bulk-isp|bulkemailsoftware|bulkers|bulkhost|bulkisp|bulkmarketing|bulletproofwebhosting|businesswebhosting|cashexplosion|catskill|chinashareware|data-miners|ddp|desktopserver2001|direct-email|dkg|dm1|domainnameservers|e-tools|elmed|email-advertising|email-marketers|email-marketing|emailmarketingsoftware|exploit|flashsendmail|freebulkemail|from-behind|healthyway|homebusiness.ukf|intellitec|isd|ispconnection|mailthem|mall-shopping|marketing-2000|marketing-depot|marketing-tools|marketingdreams|mass-marketers|natlpark|netergy|nikola|optin-lists|pavilion|reg|targetedemail|ttmi|undergroundusa|web-host|webmasterszone|website-promotion|worldpromote|wowa)\.net)\>
| formail -b -f -A "$trash_header ordinary spamsites.org 2001/06/26b"

:0 BHf
* .*\<((123emailing|1affiliateprograms|1billionsites|1desktopserver|1einform|1second|2001mall|4uservers|9tofive|a-aabyss|a1emailsoftware|a1superstore|abestvalue|abulkemailsource|acdrom|acesewvac|ackermarketing|ad-submit|advertising-tools.l00|all-about-mall|allmarketingnetwork|allreach|allservicesite|allysubmit|ameribase|amoneymaker|amt-net|amtech2010|amtechnologies|apex-pi|apexpacific|asofttouch|atspider|attainwealth|aztecdist|bestmailinglists|billminder|bizbox|biztargetmail|bizzbang|bocamax|bookiesoftware|brockford|bulk-board|bulk-email-store|bulkemaildirect|bulkemailgroup|bulkemailnetwork|bulkemailprograms|bulkemailsoftwaremarketing|bulkisp|bulkispcorp|bulkmail\.marketing00|bulkmailstore|bull-electrical|bulletron|business-moneymaking|business-start-ups|butimel|buybelowcost|cccow|cdduplicationplus|cequal2000|cherrypicker|chinaw3|coastnet|cyber-webcom|cyberlink1|cybertechinternet|cybervalue|datalogical|davecentral|ddtsoft|dengem|desktop-server|desktopserver|desktopserver-2001|desktopserver2000|desktopserver2k|desktopserver4u|desktopserver98|despro|direct-marketers|directflyer|dollareach)\.com)\>
| formail -b -f -A "$trash_header ordinary spamsites.org 2001/06/26c"

:0 BHf
* .*\<((e-announce|e-buys|e-maildata|e-mailpeople|e-mailplatinum|e-mailsoftware|e-zonerz|easybiz|ebprofits|ebz|eflashtech|egres|einfochips|elitecardservice|emagnet|email-marketing.l00|email-platinum|emailbroadcaster|emailcollage|emaildigger|emailemailemail|emailhoster|emailingservices|emailking|emailmania|emailmarketingcentral|emailmarketingsystems|emailrider|emailsgalore|emailspidereasy|emailspyder|emailtoday|emailtools|emarc|emarketing-depot|esalesbiz|esberner|eventhorizon.l00|everythingheresite|expressmail-server|extremeachievers|fantasymall|filehouse|firstclassweb|firstlinesoft|flashsendmail|floodgate|floridabuilders|francomm|freesecret|gdscott|getyoursoftware|globalhighway|globere|go2salestools|godspeed-tech|gorillamarketing|greatshop|hcontact|healthhomedevice|hhfservices|homebuys|homeuniverse|hot-new|i-netmall|iloft|ilovemyclub|image-impression|ims2000|infomercialsasseenontv|informationmart|innovative-emails|interking|internet-soft|internetmarketingpromotion|internetpromotioncenter|ipgroup|itprodownloads|jbpublications|jemwebs|jumbo|killersoftware|kimfo|kingcard|kingsolomon|ksware|lazerbluepromo|leechsoftware|libertyzone|lightspeedmarketing|listguy|listmate|listsorcerer|lk-soft|lootster|luxline)\.com)\>
| formail -b -f -A "$trash_header ordinary spamsites.org 2001/06/26d"

# 2002/12/12 removed mooreware.com
:0 BHf
* .*\<((madwebextractor|magnavity|mailharvester|mailing-service|mailresults|mailsoftware|mailutilities|mandpconcepts|mapsys|market-2-sales|marketing00|marketingtips|marketsources|marksadclub|mass-fax|massmaillists|maxpol|mcmail|mcpcom|mega-money|megamalls|megauniverse|midsolutions|midsouthclassifieds|mitchellintl|mlft|mlmhelp|mlmlaunchpad|money4-u|moneyfun|moneyinyourhands|multiplexsystems|myce|ncmarketing|net-psychic|netachievers|netbillions|netmegs|netnack|netprosweb|netres|network-marketing-unlimited|networldwide|newsgrouper|nitro-net|no-crap|no1emailsoftware|norman-law|nuvisionnet|objlink|offshoreprogrammer|onlinehere|onlinenow|oppty|order-bulk-email-software|oregonia|oxygensoftware|pageworld|pemaso|perfectextractor|phelpsenterprises|portup|position1marketing|premiermediaconcepts|pro-email|profitbooks|profitzone|prolinkexpress|promailing|promotionalsoftware|proserpine|prospectmailer2000|pslweb|publicitydoctor|qualitybooks|quicksitemaker|qwerks|rainbowpcm|reachthemall|readysetcatalog|realcybersex|redrival|rlyeh|rocktontownsite|rothsystems|route72|rshollander)\.com)\>
| formail -b -f -A "$trash_header ordinary spamsites.org 2001/06/26e"

:0 BHf
* .*\<((salesautomationgroup|search-engine-submission-bulk-email-mp3|sendbulkmail|sharewareviking|siteprotect|skybusiness|snackbar|softadvertiser|softwareking|sohusoft|spree|stardust|starrcomm|stevekaras|subfinders|submissionsplus|submitmart|successmasters|sunriseadvertising|taarna|tapwrite|target-market|targeted-addresses|targeted-advertising|targeted-lists|targetmarketingusa|tbonesoftware|tecnomarketing|telebotics|thedigitaldetective|theemailshop|theinstantbusiness|theinternetbiz|theinternetcd|tiklsoft|tlicworldwide|top-10|totalbiz-solutions|treblasoft|triconweb|truemarkproducts|tthsystems|tv-broadcaster|united-marketinggroup|usa-asap|usa-marketers|usawebsite|v-zone|veryfree|visitourmall|w3-lightspeed|web-charge|web-hosting-ecommerce|web-promotions|webbetter|webbizbrokers|webdebit|webersmall|webinterchange|webmasters-only|webmole|webmole2000|webnetlocations|webpromotion-software|webspecific|websubmissionsoftware|webyellowpages|welcomail|welshware|whyask|win-shareware|worldemailer|worldwide-telenet|wwtelenet|zeeaccess)\.com)\>
| formail -b -f -A "$trash_header ordinary spamsites.org 2001/06/26f"

# Per Neil 2001/07/03
# SPAM-L additions
# Check in header and body
:0 BHf
* .*\<(energis\.ch|infohack\.org|jacksorbetter\.org|(2sendit|blastsurf|careerdepot|desertsurf|directmeasurement|dslage|dslwise|emailisfun|europhoneclub|freewebforall|newportmarketing|peopleweb|piranhatalk|themicrocapanalyst|ultranet-telecom|vortexwebzone|webclickconcepts|weedwaacker|whodaonline)\.com|(atf|cloudyweather|edirectnetwork|energis-ip|infomart|phoneclub|stickyspoon)\.net)\>
| formail -b -f -A "$trash_header ordinary spam-l 2001/07/03"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/07/03
# Check in header and body for all RFC 822
:0 BHf
* .*\<(telintar\.net\.ar|vsnl\.net\.in|p9\.col\.ru|ciberlynx\.net|sify\.net|(amenworld|cc-pages|firstworld|sinaman|stercap|tatanova)\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/07/03"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/07/09
# Check in header and body for all RFC 822
:0 BHf
* .*\<(scanning\.com\.ar|freemail\.com\.au|tpt\.tj\.cn|iasiaworks\.net|uic-in\.net|donet\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/07/09"

# Per Neil 2001/07/09
# SPAM-L additions
# Check in header and body
:0 BHf
* .*\<(classicmail\.com\.br|lookmail\.com\.br|mdbrazil\.com\.br|northeast-christian\.org|(amateurvirgins|getmorehits|hostingplus|lookatthis|panicweb)\.net|(alldatingsearch|asianfinest|bestinternetgirls|cableisfaster|cashfromhome|heybytheway|homeofficedigest|hostingplus|kindjake|mysprintfast|optin-direct|peetbros|sendco|sprintfast|tgifcam|thintoday|tlc-futures|workathomenews)\.com)\>
| formail -b -f -A "$trash_header ordinary spam-l 2001/07/09"

# Per Neil 2001/07/15 (implemented 2001/07/23)
# SPAM-L additions
# Check in header and body
:0 BHf
* .*\<((free-dailyhoroscope|lovejungle|rhinodata)\.net|(houselist|newonlinecredit|prostepinc|virtumundo|wine-alley|winealley|wuzzlenorple)\.com)\>
| formail -b -f -A "$trash_header ordinary spam-l 2001/07/15"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/07/15 (implemented 2001/07/23)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(kornet\.net|sexlist\.com|usxchange\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/07/15"

# Per Neil 2001/07/23 (implemented 2001/07/23)
# SPAM-L additions
# Check in header and body
:0 BHf
* .*\<(bestbrightest\.net|fasthostnow\.net|(advanced-diets-weight-loss|beebeatwo|freesmartpages|internetseer|optinrealbig|otterjam|direct-mail-services|sustema)\.com)\>
| formail -b -f -A "$trash_header ordinary spam-l 2001/07/23"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/07/23 (implemented 2001/07/23)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(buap\.mx|cetin\.net\.cn|worldonline\.net\.uk|(cninfo|ponchan)\.net)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/07/23"

# Per spam-l, recommended by Neil, implemented 2001/08/03
# "effective for certain types of ratware which Ralsky, Pacheco, and
# others are using".  Make sure to use D (case-sensitive) flag.
:0 HfD
* ^Message-ID: <0000[0-9].......\$0000[0-9]...\$0000[0-9]...@
| formail -b -f -A "$trash_header ordinary spam-l ratware-1"
#
:0 HfD
* ^From: [a-z0-9.-]+@
* ^To: [a-z0-9.-]+@
* ^Content-Type: .*charset="iso-8859-1"
* ^Content-Transfer-Encoding: 8BIT
* ^Message-Id: <[a-z]*[0-9][a-z0-9]*\.[a-z]*[0-9][a-z0-9]*@
* ^Message-Id: <[0-9]*[a-z][a-z0-9]*\.[0-9]*[a-z][a-z0-9]*@
* !^Mime-Version:
* !^X-MimeOLE: Produced By Microsoft MimeOLE V[4-9]
* !^User-Agent:
| formail -b -f -A "$trash_header ordinary spam-l ratware-2"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/07/28 (implemented 2001/08/03)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(gov\.ir|kravchenko\.ru|st\.net|telefonica-data\.net|technogeeks\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/08/03"

# Per Neil 2001/07/28 (implemented 2001/08/03)
# SPAM-L additions
:0 BHf
* .*\<(onlinechance\.de|eagles\.org|(cabledescramblerplans|coloringup|customoffers|dhs-club|directoryserviceinc|directsend|haramlik|haretoday|joker|mpinet|napster|navalweb|networld|postageshop|talking-e-mail|treeloot|virtumundo|xxxwindows)\.com)\>
| formail -b -f -A "$trash_header ordinary spam-l 2001/08/03"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/08/05 (implemented 2001/08/06)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(aol\.com\.ar|apanet\.com\.au|bta\.net\.cn|onpt\.net\.ma|cyberspacereality\.net|k12tn\.net)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/08/06"

# Per Neil 2001/08/05 (implemented 2001/08/06)
# SPAM-L additions
:0 BHf
* .*\<((domainregistryinternational|essentialnic|fullecom|interndesigns|webdesignl)\.com)\>
| formail -b -f -A "$trash_header ordinary spam-l 2001/08/06"

# Per Neil 2001/08/12 (implemented 2001/08/13)
# SPAM-L additions
:0 BHf
* .*\<(atlantys\.org|(agents-network|cdsonline.cjb|hostpro|mailpromopack|wemail4you)\.net|(1virgin|cuttingedgetoolz|dynu|emsiweb|ezgreen|hostronixaffiliates|internicsecure|justaddpromotion|kk5000|myownemail|onlinepsychic|promoteacasino|qorban|smileyface|snipermail|soupstone|thebetterhealthnewsletter|themailblaster|thesuperpromoter|uswives|voicenetinfo|yeshost)\.com)\>
| formail -b -f -A "$trash_header ordinary spam-l 2001/08/13"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/08/12 (implemented 2001/08/13)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(blueyonder\.co\.uk|chinanet\.cn\.net|multa\.net|arquettefinance\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/08/13"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/08/19 (implemented 2001/08/20)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(redir\.as|city\.com\.ru|kgex\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/08/20"

# Per Neil 2001/08/19 (implemented 2001/08/20)
# SPAM-L additions
:0 BHf
* .*\<(ueops2000\.com\.br|dotgod\.co\.uk|howareyoutoday\.org|(newdomainregistry|registernewextensions|newinternetdomain|registernewextensions|worldwideregistry)\.net|(ec-ourcity|berrytrim|employeenomore|bestonlinelotto|newdomainfactory|newtoplevelextensions|domainregistryglobal|globalinternic|internicworldwide|internicworldwide|newdomaincentral|newdomainextensions|domainsregistry|globalinternic|newextensioncentral|newicannextensions|newinternetextension|newinternetextensions|newtldextensions|worldwideinternic|newextensionsnow|newextensioncentral|theadstop|prq0|processrequest|dotsexregistrar|winewayoflife.redirige)\.com)\>
| formail -b -f -A "$trash_header ordinary spam-l 2001/08/20"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/08/20 (implemented 2001/08/27)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(gddc\.com\.cn|iasnet\.ru|p3\.col\.ru|vv\.ru|ecorporation\.com|iasiaworks\.com|servnet2\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/08/27"

# Per Neil 2001/08/20 (implemented 2001/08/27)
# SPAM-L additions
:0 BHf
* .*\<(dio\.pp\.ru|alternativepersonals\.org|(host-servers|newicannextensions|newinternetdomain|paid4survey|registryglobal|worldwideinternic)\.net|(ameritrends|aploso|bigprizes|bikinisweeps|bizsweeps|bluelight|britannica|cartoonsweeps|casinosweeps|cinemasweeps|cookingsweeps|debtconsolidationservicesonline|diamondsweeps|download100|eblasters|electronicsweeps|emailemall|emailprize|executivesweeps|fantasysweeps|freebiestuff|frontrowsweeps|gassweeps|grabitpro|hissweeps|hitechsweeps|hollywoodsweeps|infograb|intunetelecom|leohost|megahardcoresex|monstersweeps|mortgagesweeps|mountainsweeps|neopets|newregistryextensions|newsuccess|officesweeps|optin2win|pacificassoc|paydaysweeps|petsweeps|qwiki|scholarshipsweeps|sebd|sportingsweeps|stockmarketsweeps|sweepsclub|sweepstakescasino|theanimalnewsletter|thesweepsnewsletter|thirstyforcum|toolsweeps|towerrecords|toysweeps|travelsweeps|windaily|worldnetadvertising|worldsweeps)\.com)\>
| formail -b -f -A "$trash_header ordinary spam-l 2001/08/27a"
:0 BHf
* .*\<(received: from plastic1|from: iagentnetwork eblast)\>
| formail -b -f -A "$trash_header ordinary spam-l 2001/08/27b"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/09/02 (implemented 2001/09/04)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(bta\.net\.cn|fzu\.edu\.cn|huazheng\.com\.cn|hz\.zj\.cn|online\.sh\.cn|gov\.co|cyt\.cu|marueiss\.co\.jp|ttnet\.net\.tr|www\.tv|kimo\.com\.tw|tripodasia\.com\.tw|skytel\.com\.uy|swissmail\.org|371\.net|pcis\.net|(9netway|alldirect|compuconn|easylink|fastdnsservers|freewebhostingcentral|friendlyemail|kimo|mailsweeps|mypad|seimitsu|technogeeks|utelfla|valuepaynetwork)\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/09/04"

# Per Neil 2001/09/02 (implemented 2001/09/04)
# From external sources, headers and body
:0 BHf
* .*\<((\(54\) \(011\) 15-5-328-9119|\(54\) \(011\) 4-627-9737|425-928-0413|559 222-5679|775-898-8933)|brandpublishing\.org|peta-online\.org|(bulkemailzone|directtraffic|domaincow|lenders-network|othoserver|postmasterpro|powermailbox|sbcomp|smutmail|webstream|wemail4you)\.net|(avirtualhosting|brandcentralstation|businessinfo-center|clubjenna|customoffers|dealbiz|directtraffic|dmsocure|domaincow|domainsystems|eblasters|ecommercepalace|escrache|etracks|expokey|freegroups|freesoftpromotions|globalinternic|go2websex|guarddvr|happyadults|hypemonster|i2bs|incometicket|infograb|innerwise|inti2bs|itinternet|itsyourdomain|maill|merchantleaders|oemmail|onecybermarket|paybycheck|preregisteryourdomains|professilist|qandatoday|realsexsurfing|servnet1|sofweb|solutionhome|speednames|sysr|telibid|theslotsaretalkingtome|transparentaffiliate|vmadmin|vortech-interactive|vortechhosting|webstorealley)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2001/09/04"

# Per Neil 2001/09/02 (implemented 2001/09/04)
# Open relays which sent spam, and were tested via http://www.ordb.org/
:0 BHf
* ^Received:.*\[(64\.3\.106\.144|163\.26\.115\.1|195\.210\.132\.46|195\.248\.38\.43|200\.38\.77\.46|202\.103\.27\.90|202\.77\.146\.2|202\.98\.127\.162|208\.183\.75\.3|209\.217\.14\.138|210\.12\.88\.49|210\.15\.78\.1|210\.34\.62\.194|210\.40\.32\.33|210\.99\.37\.2|211\.20\.140\.18|211\.21\.178\.109|211\.21\.2\.126|211\.41\.53\.34|212\.162\.48\.122|212\.96\.209\.202)\]
| formail -b -f -A "$trash_header ordinary open-relays 2001/09/04"

# Per Neil 2001/09/09 (implemented 2001/09/10)
:0 BHf
* .*\<(direct-email-marketing\.net|see-money\.net|(alstoa|best-email-software|bulkemailerplus|eblasters|ebprofits|emailgremlin|likee|number1emailsoftware|share2|shrinkingtheglobe|sohoany|stg\.20megsfree)\.com)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org 2001/09/10"

# Per Neil 2001/09/09 (implemented 2001/09/10)
# Open relays which sent spam, and were tested via http://www.ordb.org/
:0 Hf
* ^Received:.*\[(163\.24\.55\.140|209\.189\.97\.150|210\.34\.62\.194|210\.62\.171\.8|211\.47\.193\.16)\]
| formail -b -f -A "$trash_header ordinary open-relays 2001/09/10"


# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/09/09 (implemented 2001/09/10)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(klik\.co\.il)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/09/10"

# Per Neil 2001/09/09 (implemented 2001/09/10)
# SPAM-L additions
:0 BHf
* .*\<(cell\.sa\.net\.co\.fr|likom\.com\.tr|atlantys\.org|usafis\.org|(af2|credit---cards|debtfreelife|greatnewlife|sexlive-tv|velocitycom)\.net|(alluneedhosting|banffhiddenridge|bccoastexperts|bytehosting|cumasur|cyberstream|dotbizcentral|eroticsworld|freedomstarr|g-low|iphonebill|largestpackage|logorush|netmon|overclockerz|pryzmweb|smokingcigarettescheaper|talkfreeamericainc|trafficboost|vmadmin|welshfantasyfootball)\.com)\>
| formail -b -f -A "$trash_header ordinary spam-l 2001/09/10"

# Invalid Message-Id looks like Outlook
# 2001/09/10 per Neil, from Andrew Porter via spam-l
:0 Hf
* ^Message-Id:.*\<0000[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]\$0000[0-9a-f][0-9a-f][0-9a-f][0-9a-f]\$0000[0-9a-f][0-9a-f][0-9a-f][0-9a-f]@
* ! ^X-Mailer: Microsoft
| formail -b -f -A "$trash_header ordinary invalid outlook-like message-id"

# Per Neil 2001/09/16 (implemented 2001/09/18)
# Open relays which sent spam, and were tested via http://www.ordb.org/
:0 Hf
* ^Received:.*\[(61\.13\.56\.195|163\.24\.137\.11|202\.229\.220\.2|209\.189\.97\.150|210\.62\.171\.8|211\.47\.193\.16)\]
| formail -b -f -A "$trash_header ordinary open-relays 2001/09/18"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/09/16 (implemented 2001/09/18)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(fzu\.edu\.cn|mamabear\.sgi\.int|pchome\.com\.tw|tripodasia\.com\.tw|my-ila\.co\.uk|yhman\.net\.uk|(i-interactive|seeder)\.net|(alcybiz|china|mexmail)\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/09/18"

# Per Neil 2001/09/16 (implemented 2001/09/18)
# SPAM-L additions
:0 BHf
*.*\<((animalsex|clisteri|culifamosi|cybererotica|digisex|extraconiugale|fiche|fottute|hardsexy|inculata|lagazzettadelcazzo|medianetgroup|planetsex|puntosex|radiosex|sexmail|sexnews|sexservice)\.it|cashteam\.tv|(4server|debtfreelife|emailpack|hiddenonline|highspeedweb|home-shop|medianetgroup|medianetit|othoserver|the-peoples)\.net|(24hour-affiliates|37500hits|bbpmarketing|cardmktplace|chargecards2go|chargeitdirect|cheapispservice|classadmoney|e-shoptotal|ecommercechargecards|eloan|faxbiz4u|flashsales|genesis2net|goodmoney4u|jokemeister|mailermailer|massexposure4u|massivehits4u|moneyviafax|n-instinct|ncimarketing|netwkr2000.mybravenet|ombramarketing|ready4hits|realsexsurfing|search4auctions|server-colo-farm|spaceisp|thawte|time4hits|tonerbuys|ubider32|ugot2see|unitearth|web4porno|web4porno|webmktplace|westburyconsulting|winfreestuff)\.com)\>
| formail -b -f -A "$trash_header ordinary spam-l 2001/09/18"

# Per Neil 2001/09/24
# Security hole in formmail.pl script < 2001/06/16 allows spam relay
# This rule may catch legitimate uses; formmail users take note.
:0 BHf
* Below is the result of your feedback form.  It was submitted by
| formail -b -f -A "$trash_header ordinary formmail.pl"

# Per Neil 2001/09/24 (implemented 2001/09/24)
# From external sources, headers and body
:0 BHf
* .*\<(NUTTER Mass e-Mailer 2000|mercadolibre\.com\.ar|wintrip\.coc\.cc|(networkpride|mypchosting|semicustomwebsites)\.net|(attackonournation|bryantours|diamonddollarcasino|directoffers|domainbank|dotbiztoday|expage|fetish-factory|garyharvey|get-it-today-usa|getdomainow|inshop|luckycherrycasino|luckystudcasino|magnetqueen|mailwire|maximumresult|mortgage1.4asd|my163|ombramarketing|paladiantech|pornstarsexsecrets|prepaidlegal|protectfamily|prq0|retirequickly|rjmoments|saverealbig|servicenetbest|shockmails|shrikhatushyamji|sprayv|successhaven|ur-online-rx|wisemensgifts|withlibertandjustice)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2001/09/24"

# Per Neil 2001/09/24 (implemented 2001/09/24)
# Open relays which sent spam, and were tested via http://www.ordb.org/
:0 Hf
* ^Received:.*\[(194\.184\.39\.4)\]
| formail -b -f -A "$trash_header ordinary open-relays 2001/09/24"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/09/24 (implemented 2001/09/24)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(go\.id|infoguru\.co\.kr|turnet\.net\.tr|(ecorporation|gscyclone)\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/09/24"

# Per Neil 2001/10/01 (implemented 2001/10/02)
# From external sources, headers and body
:0 BHf
* .*\<(rendaextra\.tw\.st|sourceconnect\.tv|explosia\.org|quasistupid\.org|superdns\.org|w0rldservicesonline\.org|(biogenesis|bmccomp|bmcomp|freehostcentral|printdoctor|webunited)\.net|(aconectarse|amateurs-usa|amateursexphoto|asian-girl-erotica|associationnews|atlasinkjet|bi-curiousgirl|bi-girl|biggerpackage|bjgirl|black-girl|cebbank|dfime|dickteaser|digital-promotions|e-gold|e-shopwalker|ebchina|emailaddressesunlimited|entertainmentearth|flyfrontier|girlswholovepussy|goodgirlbadgirl|hardpp|heftypp|hipgirl|hushidentity|hushmail|ihsoutlet|inkjet-tec|isis-solutions|killerwebsites|lindenwold|lpt|multipaycasino|mysprintfast|penisdevelopment|pocketpclife|prettysexygirls|rebuildornot|schneiderpublishing|secec|securesci|sexfreakgirl|sizecancount|sportstravelnet|suarez|substancetv|teamsconference|twingirlsex|usacartridge|uscommgallery)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2001/10/01"

# Per Neil 2001/10/01 (implemented 2001/10/02)
# Open relays which sent spam, and were tested via http://www.ordb.org/
:0 Hf
* ^Received:.*\[(194\.184\.39\.4|194\.7\.47\.242|195\.6\.211\.14|211\.74\.201\.4|212\.37\.209\.121)\]
| formail -b -f -A "$trash_header ordinary open-relays 2001/10/01"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/10/01 (implemented 2001/10/02)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(cafetaria-dnbol\.nl|siscom\.net|starlightlimited\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/10/01"

# Per Neil 2001/10/09 (implemented 2001/10/09)
# From external sources, headers and body
:0 BHf
* .*\<(kawananet\.com\.au|hothosting\.org|(cleandrive|pti)\.net|(bulkmailhosting|consumernotes|emailbucks|evidence-eliminator|financialfreedomadviser|justgottago|lopermanagement|m-ul|mycasinobuilder|openna|pagepath|virtual-banking|web-advs)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2001/10/09"

# Per Neil 2001/10/09 (implemented 2001/10/09)
# Open relays which sent spam, and were tested via http://www.ordb.org/
:0 Hf
* ^Received:.*\[(211\.74\.201\.4|195\.6\.211\.14|203\.197\.64\.9)\]
| formail -b -f -A "$trash_header ordinary open-relays 2001/10/09"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/10/09 (implemented 2001/10/09)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(arrakis\.es|dspsv\.ro|vsnl\.net)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/10/09"

# Per Neil 2001/10/15 (implemented 2001/10/15)
# From external sources, headers and body
:0 BHf
* .*\<(dataline\.net\.au|kawananet\.com\.au|xmarketing\.org|(golden7|hosting4u|marketingtool|networkspeed|trafficmagnet|web-advs|westwaters)\.net|(bestcasinoofweb|biggerpackage|brightteethnow|clubpie|discountusflags|dns-setup|dotinfocentral|echomail|econoporn|em5000|emailgalore|e-projectmanagers|frankdevito|getmeranked|goodfortunez|hairaccelerator|hiregate|intelliquis|itctv|loscartuchos|mall|netsitesforfree|networksstatus|newcenturydebt|orbitalmark|ouramericanliberty|ozwebhostingservices|packageperfection|pcpillstore|pissingtime|searchhound|searchound|secure-credit-card-transactions|thegreatesthost|twistedhumor|utopiads|wallstreetnewsalert|withlibertandjustice|xxx-porns)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2001/10/15"

# Per Neil 2001/10/15 (implemented 2001/10/15)
# Open relays which sent spam, and were tested via http://www.ordb.org/
:0 Hf
* ^Received:.*\[(139\.130\.41\.206|200\.61\.76\.173|202\.106\.186\.237|210\.15\.12\.76|210\.226\.117\.242|211\.116\.7\.100|32\.104\.6\.195|62\.146\.24\.31)\]
| formail -b -f -A "$trash_header ordinary open-relays 2001/10/15"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/10/15 (implemented 2001/10/15)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(gigavia\.com\.ar|intercom\.co\.cn|9448\.com\.cn|i-p-x\.de|(primenetwork|telefonica-data|vampiro)\.net|(asapcolo|techpointer)\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/10/15"

# Per Neil 2001/10/22 (implemented 2001/10/23)
# From external sources, headers and body
:0 BHf
* .*\<(dataline\.net\.au|kawananet\.com\.au|wasteland\.nl|(australianet|bokarina|buddina|currimundi|ewebnet|fx-group|minyama|newtldregistry|safetrax|warana|wurtulla)\.net|(123-credit-counseling|4secret|alemailmarketing|americancpr|anthraxsafe|bulkmailservers|caloundranet|cpr-manikin|diversifica|edventures|environmental-health-and-safety|fets|freeeroticwebspace|healthsafety|ihateterrorists|insidedvd|itctv|itctv|lolitacasino|namesecure|naturescuresonline|quickemaileuu|ravelinksstore|safety-training-product|sfimarketing|sfimg|smartsourceonline|sparks|theecorpusa|topphost|tpiz)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2001/10/23"

# Per Neil 2001/10/22 (implemented 2001/10/23)
# Open relays which sent spam, and were tested via http://www.ordb.org/
:0 Hf
* ^Received:.*\[(211\.116\.7\.100|209\.239\.8\.14)\]
| formail -b -f -A "$trash_header ordinary open-relays 2001/10/23"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/10/22 (implemented 2001/10/23)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(delanacal\.com\.ar|gigavia\.com\.ar|apanet\.com\.au|tripodasia\.com\.hk|(a-1|aitcom|hookup|tvcable)\.net|(causefx|dataregis|dotcomtoday|flightsystems|freedomhosting)\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/10/23"

# Per Neil 2001/10/28 (implemented 2001/10/31)
# From external sources, headers and body
:0 BHf
* .*\<(asian-bikini-models\.con|marketinfo\.de|greenworld\.com\.tw|(memoirsofkingbirendra|tangfeng)\.org|(363|all-amateurs|asian-pictures|eprize|estop|ewebnet|gnaps|hardcorepleasures|netsitesforfree|servercolo-usa|healthnhome)\.net|(antonkorf|aplussupport|asian-bikini-models|bayminds|bighitsnow|cheapispservice|farmygirls|fistdeep|freewebcity|fuckedvideo|fuel-savers|gamecolony|gz|hollymatic|icnewswire|ima|interferenza|launch|livesexvod|manda1|maximumhosts|medicock|melomarketing|metrowholesalemortgage|new20dollar|normalnet|optinglobal|pjbux|postmasterglobal|rlomortgageloan|securitybroken|server-colo-world|servercolo-usa|sex1hosting|sexualnectar|shopityourway|smoothgays|spaceisp|speedy-isp|tasteforasia|teens-n-cream|trackingsoft|tristateweb|web-jet)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2001/10/31"

# Per Neil 2001/10/28 (implemented 2001/10/31)
# Open relays which sent spam, and were tested via http://www.ordb.org/
# Also known dial-ups.
:0 Hf
* ^Received:.*\[(163\.24\.130\.140|194\.67\.159\.62|195\.76\.46\.35|200\.195\.207\.82|200\.9\.212\.59|200\.9\.212\.60|202\.103\.0\.113|202\.39\.181\.251|207\.248\.23\.244|210\.244\.38\.66|212\.150\.48\.98|200\.63\.161\.88)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2001/10/31"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/10/28 (implemented 2001/10/31)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(bl\.am|ilvaticano\.com\.br|pegasusip\.net\.br|onweb\.cx|infosel\.net\.mx|jx\.st|wwwap\.to|(easylink|hasehosting|ziffdavis)\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/10/31"


# Per Neil 2001/11/05 (implemented 2001/11/06)
# From external sources, headers and body
:0 BHf
* .*\<(terra\.es|allxxxvideo\.info|z24\.co\.kr|(adult-heaven|asian-school-girls|japanese-bondage|nude-asian-women)\.org|(optmeout|schoolgirl.xxx.new|smallcapnetwork|super-offers|the-peoples|toon.xxx.new)\.net|(500movies|adultfriendfinder|asian-teen-models|asianapples|asianclassmates|billcards|boatingchannel|celebdepot|coolfreehost|directforcemarketing|e-sbforum|easycasinobuilder|emailturboservice|ereeto|eternal-lolitas|friendfinder|generousgems|healthsolutioncenter|hentaigirlz|hhasia|hidden-mail|hugetitsxxx|intunetelecom|leadsinger|legalchainletter|levelogic|linkitsoftware|naturescuresonline|nothingtobuy|plan69|pointcom|pussyasians|removeregister|the-job-master|ubidcontract|wellsgreyventures|wickedchannels|wrongholio)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2001/11/06"

# Per Neil 2001/11/05 (implemented 2001/11/06)
# Open relays which sent spam, and were tested via http://www.ordb.org/
# Also known dial-ups.
:0 Hf
* ^Received:.*\[(139\.134\.194\.19|195\.202\.180\.109|200\.63\.154\.62|202\.166\.51\.108|202\.9\.178\.27|203\.149\.134\.226|211\.116\.237\.98|213\.219\.79\.6|216\.143\.33\.41)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2001/11/06"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/11/05 (implemented 2001/11/06)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(ut\.net\.ru|kabelnet\.net)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/11/06"

# Per Neil 2001/11/11 (implemented 2001/11/15)
# From external sources, headers and body
:0 BHf
* .*\<(piranhamedia\.tv|(anthraxsafe|chinadnsonline|homeown)\.org|(atf|cool-porno|networkbeat|promotionsweb|run)\.net|(1wholesaleliquidators|666host|acceptcardsinstant|alive101|anthraxexterminate|azoos|databasesoncd|doyousave|missingyou01|netgrowthinc|new-lolita|overseas-study-guiding)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2001/11/15"

# Per Neil 2001/11/11 (implemented 2001/11/15)
# Open relays which sent spam, and were tested via http://www.ordb.org/
# Also known dial-ups.
:0 Hf
* ^Received:.*\[(194\.24\.136\.184|194\.67\.43\.42|200\.161\.206\.189|200\.171\.144\.210|200\.63\.129\.171|203\.123\.140\.7|211\.131\.68\.140|61\.217\.52\.172|61\.217\.52\.37|61\.221\.152\.76|64\.174\.170\.194|200\.45\.225\.48|202\.100\.72\.51|202\.9\.178\.27|211\.116\.237\.98|211\.217\.72\.168|211\.217\.72\.168|211\.41\.52\.66|63\.170\.135\.146|64\.157\.92\.192)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2001/11/15"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/11/11 (implemented 2001/11/15)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(gddc\.com\.cn|gs\.cn|linkserve\.com\.ng|net263\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/11/15"

# Per Neil 2001/11/19 (implemented 2001/11/19)
# From external sources, headers and body
:0 BHf
* .*\<(411domains\.ca|domainstop\.org|(bestmlm|greynetwork|inkout)\.net|(bridgecap|cablebahamas|columbiahouse|ffanet|freshmanxxx|grouplotto|happypoint|hotboard|hrtcorp|imagine-success|inyouremail|kicking73|masterdownline|mediaplex|megamailservers|networkpromotion|onholdgroup|rdncorp|sunset02|superecords|ultimatetrafficsystem|westlakevillageinn|yehooz)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2001/11/19"

# Per Neil 2001/11/19 (implemented 2001/11/19)
# Open relays which sent spam, and were tested via openrbl.org
# Also known dial-ups.
:0 Hf
* ^Received:.*\[(200\.207\.122\.98|200\.253\.190\.3|200\.61\.176\.98|218\.32\.0\.5|24\.129\.0\.51|24\.26\.22\.234|61\.224\.135\.181|63\.49\.86\.40|64\.2\.164\.125|193\.54\.52\.125|196\.44\.142\.11|200\.45\.233\.71|200\.45\.251\.59|202\.215\.242\.10|64\.249\.227\.2|64\.57\.172\.24)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2001/11/19"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil, 2001/11/19 (implemented 2001/11/19)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(lz\.gs\.cn|vectant\.ne\.jp|(anaserve|anawave|psychologynetwork)\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/11/19"

# Per Neil 2001/11/26 (implemented 2001/11/27)
# From external sources, headers and body
:0 BHf
* .*\<(emarketing\.ph|(best-e-biz|peopleiknow)\.net|profax\.net|(150m|27meg|advertisingbay|arishosts|bay9|best-buyers-guide|blastomatic|cablebahamas|dslstart|internetnamesforbusiness|maxil|mediacharger|megamailservers|meganameservers|megawebservers|pipelineparable|sail-shearwater)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2001/11/27"

# Per Neil 2001/11/26 (implemented 2001/11/27)
# Open relays which sent spam, and were tested via openrbl.org
# Also known dial-ups.
:0 Hf
* ^Received:.*\[(200\.161\.191\.207|202\.86\.149\.101|203\.155\.127\.90|206\.155\.221\.114|208\.19\.55\.73|208\.19\.55\.99|24\.21\.107\.70|61\.216\.111\.134|134\.75\.155\.205|200\.37\.221\.6|202\.224\.139\.193|207\.111\.220\.139|207\.136\.80\.168|207\.230\.212\.144|209\.114\.218\.179|209\.157\.60\.20|209\.161\.206\.206|209\.239\.40\.161|209\.51\.236\.35|210\.239\.144\.65|211\.79\.76\.134|217\.127\.195\.218|61\.225\.65\.119|61\.59\.168\.15)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2001/11/27"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil 2001/11/26 (implemented 2001/11/27)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(telefonicaempresas\.net\.br|ttd\.es|datassist\.net|sentrexco\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/11/27"

# Per Neil 2001/11/26 (implemented 2001/11/27)
# From external sources special, headers and body
# http://inetekk.com/domains.html (spamhaus)
:0 BHf
* .*\<(postings\.cgi|(dotcomracing|gifthorse|grassfedbeef|marketingdoctor|successchannel)\.org|(1stop-shopping|2nd-income|4legalhelp|5th-avenue|abacus-marketing|absolute-free|access-800|ameri-health|aol-mlm|aquarx|attorneyads|big-e-biz|biz-on-net|bizvertising|born2befree|buycities|cashflowmarketing|changesintl|commercecities|computer-giveaway|dot-conomy|e-wav|ebasebusiness|ecommercecities|entreportunities|entreportunity|eternize|etracking|ewaav|ewav|execvertising|ffaomatic|fifth-avenue|flat-rates|free-computers|free-free|free-mart|free-page|freelifenet|get-rich|give-a-way|global-op|globelcom|gononi|h20health|homeomatic|identity-crisis|incomecities|incomegenerator|iwav|just-call-me|kids-stuff|km-online|lawads|lawvertising|lawyerads|life-biz|marketcities|marketing-doctor|melalueca|mlm-cities|mlmcities|mlmcity|mlmmail|mlmomatic|mlmsearch|money-machine|moneyomatic|morinda-noni|mortgagecities|myownhome|mysocalledlife|neo-wave|netbizonline|new-york-fasions|newpath|nobasebusiness|noni-morinda|nouveaunet|own-mlm|paid2bfree|power-on-line|pre-paid-law|prendergast|pure-trust|realestatecities|realtorcities|realty-agents|realtyads|realtyestates|realtytown|realtywalk|realvertising|reddy-killowatt|rodeo-drive|salescities|silentrevolution|stopshopping|submitomatic|success-biz|success-channel|teamyahoo|the-paradigm|the-trust|thekmgroup|theteatree|union-square|voiceactivate|wave-4|web-mall-lounge|web-tv-mall|web-vision|webcatch|winafreecomputer|wireless-concepts|workathomesuccess|worldwidescam)\.net)\>
| formail -b -f -A "$trash_header ordinary external-sources 2001/11/27a"
#
:0 BHf
* .*\<((1-family|1-op|1onlineincome|4life-online|aaafreemart|absolute-free|ace-free|affordableattorneys|aguarx|alternatecareer|american-freeway100|amerihealthonline|ameriplanonline|ameriplanonlinex|aol-mlm|aol-network|aolmlm|aolms|arcltd|arizonaprepaidlegal|attorneyads|autovertising|azcarolers|bababwy|balmeo|bbco-op|best-biz-op|best-e-biz|bigsupport|blastomatic|blessedwithfortune|brokeragecities|brought2youonline|bryanandjulie|bryanmoody|buycities|cashflow-marketing|commercecities|concordequestrian|dailymessageonline|deltajohnsons|discountbenefitsplans|dishnetcentral|docentonline|dotcombusinessonline|dothei|drscot|e-biz-money|e-biz-op|e-businessonlinecentral|e-global-biz|e-globalsuccess|e-incomeonline|e-nature-online|e-success-biz|e-successonline|e-wav|e-wave|ebasebusiness|eclickmarketing|eclickwin|ecommercecities|efinitee|ehorsey|electricteam|empoweryourselfonline|enrollamerica|entracontest|entreportunities|entreportunity|esalescities|estatetial|europe-excell|ewaav|ewealthonline|excel-biz|execvertising|free-digital-satellite|free-life|free-long-distance|free-phone-call|free2uonline|freesavewin|freeweb-access|freewinsave|futurenet-lounge|getdigisat|ghtonline|gifthorse-online|ginza-mall|ginzamall|globalincomeonline|go-noni|guestbookcity|h20health|healthdentalvisionplan|herbal-e-biz|hot-e-biz|incomecities|incomehome|incomehometeam|incomehomewin|inetekk.cominovatomatic|insurvertising|internetdotconomy|interneteagles|isp4-free|juliemoody|kids-furnishings|lakechemicals|lakemaintenance|lakemaintenanceservice|lawinfo4u|lawvertising|leadsomatic|leclubonline|legalforms4free|leveragedsolutions|life-forces|lifeforcers|liquidorganics)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2001/11/27b"
#
:0 BHf
* .*\<((market-cities|marketing-blitz|marketing-doctor|marketingcities|marketingomatic|melafreedom|melanews|mlm-cities|mlm-city|mlm-search|mlmcities|mlmcrawler|mlmfactory|mlmmail|moodyfamily|moremoneyonlinecentral|mortgagecities|mzbz|neo-wave|new-york-fasions|nex-hot-biz|nobasebiz|nomore-long-distance|noni-morinda|nouveau-net|nouveau-wave|nova-wave|olexchange|oneop|onlineincomecentral|paid2bfree|palma-real|paris-mall|pms-nbc|poodledoodleonline|power-on-line|pre-paid-law|pre-paid-lawyers|pre-paid-leads|prvalet|pure-profits|pure-trust|pwrnet|real-town|realestatecities|realtorcities|realtorestates|realty-walk|realtycities|rebeccaconley|richomatic|richweare|savewin|savewinfree|sbcanetwork|sbcaonline|silentsunami|smallbusinesshomebase|sohomadness|sohomatic|stop-shopping|stupid-girl|success-training|systomatic|syzygyjob|tdg-network|the-trust|thelakeman|theprivatenetwork|trafficomatic|training-system|trip4free|tuffbitch|tvcwin|twindependent|usa-com|vacation-4-free|wahoo4u|wahooforyou|waterandlakes|wavefour|waveomatic|web-mall-lounge|web-tv-mall|webwins|win-a-computer|workathomebusinessonline|world-op|yessiredobob|youhavebusiness|yoursolutioncentral|youvegotbusiness|youvegotfriends|youvegotincome|youvegotmoney|yuletidecarolers)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2001/11/27c"

# Per Neil 2001/12/09 (implemented 2001/12/17)
# From external sources, headers and body
:0 BHf
* .*\<(free-bizzz\.biz|new\.chapters\.ca|lolazzz\.cc|waredet\.net\.co\.fr|smilefoot\.co\.kr|hacom\.nl|businesslinkwessex\.co\.uk|taxinvestmentstrategy\.ws|atlantys\.org|(freehostnet|net-email)\.net|(1031network|200hits|acculeads|bzah|cash5|casinotreasure|christianet|compumarket|daychore|divx|divxlibrary|divxnetworks|e-paydayloanonline|gasaw|greatdomainrace|hotboard|indigo-profit-hosting|inside-offers|investorsuniverse|isellercentral|lolitaspese|monitor724|namezero|netster|omnimale|poxteam2001|rellingup|tonerbuys|tonersforyou|tradeposter|underwriters|yournamepromo)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2001/12/17"

# Per Neil 2001/12/09 (implemented 2001/12/17)
# Open relays which sent spam, and were tested via openrbl.org
# Also known dial-ups.
:0 Hf
* ^Received:.*\[(12\.86\.201\.190|12\.86\.201\.224|200\.161\.195\.246|203\.204\.82\.106|208\.24\.93\.96|212\.1\.137\.134|218\.32\.0\.20|64\.3\.154\.125|66\.81\.29\.65|130\.94\.92\.220|169\.207\.241\.12|195\.199\.101\.189|195\.238\.3\.135|199\.72\.147\.213|200\.46\.17\.226|200\.49\.208\.124|202\.205\.32\.253|206\.46\.170\.37|208\.247\.65\.70|209\.21\.234\.2|210\.188\.252\.19|211\.0\.31\.130|211\.162\.33\.88|211\.201\.95\.213|217\.52\.98\.3|61\.140\.60\.248|61\.224\.134\.226|64\.132\.181\.22|65\.171\.144\.5)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2001/12/17"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil 2001/12/09 (implemented 2001/12/17)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(egyptair\.com\.eg|vmsite4\.info|edu\.pa|dns\.ht\.net\.tw)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/12/17"

# Per Neil 2001/12/09 (implemented 2001/12/17)
# spamhaus.org update
# Check in header and body
:0 BHf
* .*\<(emailprospector\.com\.br|(direct-email-marketing|email-advertising|flashsendmail|g-forcemarketing|natlpark|network-2001|softwareshop|the-peoples|usa-e-mail)\.net|(abx001|ajmarketingsolutions|alemailmarketing|anastasov|biz-help|bulkemailprograms|bulklist|desktopserver|e-saje|ebprofits|emailbroadcaster|emailgremlin|emailmarketingsystems|genuine-power|likee|marketforce1|mlmhelp|share2|sohoany|stealthmassmailer|straight-shootin-golf|targetedbulkemail|theinternetbiz|usa-marketers|usaplaza|webmole|websiteshq|webyellowpages|windows100|yourbizz)\.com)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org 2001/12/17"

# Per Neil 2001/12/09 (implemented 2001/12/17)
# Spamware sites
# Check in header and body
:0 BHf
* .*\<(mailorders\.cc|listbank\.ne\.jp|sunmoon\.co\.jp|vip2000\.tw\.to|bullnet\.co\.uk|graphicbox\.co\.uk|neomode\.co\.uk|(263|advertisersinc|bulkdepot|email-advertising|email-marketing|emaillistclub|flashsendmail|g-forcemarketing|globaldirectmarketing|ic24|ispcom|myemailcenter|network-2001|targetedemail|webmarketingconsultants)\.net)\>
| formail -b -f -A "$trash_header ordinary spamware 2001/12/17a"
:0 BHf
* .*\<((1bz|1st-bulk-email-software-superstore|a1emailsoftware|abx001|alemailmarketing|all-about-mall|arkysoft|atspider|beegeemarketing|biz-help|bizassist-jp|biznizsource|bulk-eboy|bulkemail|bulkemailpeople|bulklist|business-start-ups|businessinternational|cb-marketing1|ccnow|cybertechinternet|downme|drlr|e-dms|earthtrade|ecorpworldwide|efunsoft|einfodirect|emailcdrom|emailgremlin|emaillistclub|emailpowertools|emailtools|esberner|f10inc|fantasticsoftware|fastbulkemail|flashfindmail|getyoursoftware|goodlife-enterprises|gorillamarketing|grandspam|heebeha|infonownet|kdksoftware|kimfo|kingcard|kingsolomon|l5software|lk-soft|lucifersoft)\.com)\>
| formail -b -f -A "$trash_header ordinary spamware 2001/12/17b"
:0 BHf
* .*\<((mailharvester|mailresults|mailutilities|marketing-toolz|massmail.rumazepath|mycomputer|netbroker.uk|newsgrouper|nim-corp|onlinehere|sajemarketing|snackbar|submissionsplus|superscripts|target-market|targeted-addresses|targeted-lists|theecorpusa|theinternetbiz|treblasoft|triconweb|webattack|welcomail|yesgoal)\.com)\>
| formail -b -f -A "$trash_header ordinary spamware 2001/12/17c"


# Per Neil 2001/12/17 (implemented 2001/12/20)
# From external sources, headers and body
:0 BHf
* .*\<(dada\.it|(alicee|cpuguys|cumshooters|ezprovider|nocostporn|peer1|thebest|virtualdirtygirl)\.net|(188maillist|alotta34|bigaffiliator|bringitnow|bustonherface|cashexpert|celebrityorgy|commercialmortgageyes|cyberxworld|easy-teen|ezprovider|freecaminfo|hottasses|insight|internutrition|jumbojugs|lubeduplesbians|megavisit|mypleasurecam|nocostporn|orientalteenslut|orientalteenslut|pbits|pornstar|poxteam2001|realsexsurfing|reamedass|somacho|strike-up|teenslut|ultrameds|visualtraining|web4porno|xpays)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2001/12/20"

# Per Neil 2001/12/17 (implemented 2001/12/20)
# Open relays which sent spam, and were tested via openrbl.org
# Also known dial-ups.
:0 Hf
* ^Received:.*\[(163\.30\.58\.135|172\.180\.62\.40|200\.161\.209\.181|200\.168\.151\.3|211\.37\.0\.173|213\.121\.105\.250|216\.126\.160\.82|4\.33\.33\.59|66\.125\.200\.51|194\.51\.41\.4|195\.25\.213\.193|195\.64\.224\.210|195\.64\.225\.233|200\.177\.77\.25|200\.61\.187\.188|202\.120\.189\.104|203\.144\.176\.162|203\.146\.102\.233|208\.177\.54\.250|210\.117\.202\.66|210\.143\.98\.200|210\.224\.161\.213|211\.214\.226\.46|211\.236\.190\.139|211\.238\.217\.131|212\.137\.242\.159|212\.35\.66\.35|216\.22\.147\.162|24\.0\.95\.144|24\.95\.72\.222|61\.132\.4\.117|63\.198\.202\.115|63\.65\.0\.138|64\.187\.1\.66|64\.57\.223\.40|64\.78\.234\.98|66\.12\.196\.10|66\.60\.22\.90)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2001/12/20"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil 2001/12/17 (implemented 2001/12/20)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(lighthouse\.ns\.ca|first\.net\.jo|js\.cn|(chameli|gtconnect)\.net|(bzam|cpmaru|e-serverbank|katelecom|usepapa|vanish)\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2001/12/20"

# Per Neil 2001/12/17 (implemented 2001/12/20)
# spamhaus.org update
# Check in header and body
:0 BHf
* .*\<((1tips|bulletproofwebhosting|natlpark|speedymailer)\.net|(1affiliateprograms|1bulkemailsoftware|1worldmarket|bulletproofisp|cb-marketing1|getyoursoftware|hoast|seabreeze-enterprises|send-safe|web-jet|website2003)\.com)\>
| formail -b -f -A "$trash_header ordinary spamhaus.org 2001/12/20"

# Per Neil 2001/12/17 (implemented 2001/12/20)
# Spamware sites
# Check in header and body
:0 BHf
* .*\<(eletromarketing2002\.com\.br|superdownloads\.com\.br|epsilondirect\.co\.uk|netpagesuk\.ltd\.uk|informacja\.pl|bulkemail\.ca|bulkemailsoftware\.ca|email-marketing\.ca|(1marketing|1tips|bulk|bulkemails|bulkmarketing|direct-email-marketing|dotnetdns|email-advertising|email-marketing|groomed|investmentmail|listsorcerer|mail-software|softwareshop|speedymailer)\.net)\>
| formail -b -f -A "$trash_header ordinary spamware 2001/12/20a"
:0 BHf
* .*\<((1desktopserver|action-email|biznizsource|btsmailer|buildahomebusiness|bulkemailnetwork|bulkingpro|bulkmailstore|bulkthisway|business-start-ups|cyberstore2000|desktopserver|desktopserver2000|e-maillisting|e2marketing|easybiz|emagnet|emailmania|emailmarketingsystems|emailsgalore|extractor-pro|extractor-pro98|f10inc|global-domination|hot-new|infiniteleads|leadleader|listguy|madwebextractor|makemoneyworkathome|market-2-sales|marketingmasters|massmailer|mcmail|millionsofemails|mywebwholesaler|netfirms|ontarget98|order-bulk-email-software|plumpointpost|pro-email|prolinkexpress|relyconsulting|safehavenhosting|speedymailer|stealthmassmailer|tajmarketing|target-market|targeted-addresses|targeted-lists|tecnomarketing|tradeposter|u-bulk|vome|wallstreetlist|wiseoldmule|wstudios)\.com)\>
| formail -b -f -A "$trash_header ordinary spamware 2001/12/20b"

# Per Neil 2001/12/25 (implemented 2002/01/03)
# From external sources, headers and body
:0 BHf
* .*\<(emailer\.cl|mediatools\.cl|dot\.name\.net\.co\.fr|mojo\.net\.co\.fr|backpoint\.co\.kr|(etoll|ted2|tm00|tm01|tm02|tm03|tm04|tm05|tm06|tm07|tm08|tm09)\.net|(allnudepics|coopt|developingdots|dreammakernetwork|emailfactory|gotopeople|mailmediary|newc|niit|tablepads|theuseful|vcdz4free|zoosporn)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2002/01/03"

# Per Neil 2001/12/25 (implemented 2002/01/03)
# Open relays which sent spam, and were tested via openrbl.org
# Also known dial-ups.
:0 Hf
* ^Received:.*\[(12\.64\.222\.180|200\.207\.156\.134|200\.63\.162\.155|208\.29\.30\.228|212\.137\.246\.156|213\.97\.238\.169|218\.32\.16\.23|4\.33\.33\.59|63\.60\.230\.120|66\.12\.101\.98|195\.167\.179\.22|200\.42\.82\.110|200\.9\.212\.55|202\.103\.108\.248|202\.110\.217\.75|202\.96\.106\.130|203\.2\.192\.85|204\.127\.131\.47|210\.143\.98\.200|210\.96\.165\.5|212\.113\.174\.249|24\.221\.252\.51|61\.226\.71\.26|63\.198\.170\.90|64\.225\.255\.10|66\.1\.178\.5|66\.33\.60\.96)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2002/01/03"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil 2001/12/25 (implemented 2002/01/03)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(iplanisp\.com\.ar|wzptt\.zj\.cn|globetel\.com\.ph|unir\.ru|(neckar|pemail|pmail|sparqnet)\.net|(cam-point|dash-po|eatel|moneykey|mplanet|scool)\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2002/01/03"

# Per Neil 2001/12/25 (implemented 2002/01/03)
# spamhaus.org project and other spamware
# Check in header and body
:0 BHf
* .*\<(avcmarketing\.cc|eurekadns\.net|(411bulk-email-mass-marketing-software|a1bulkemail|action-emailer|free-bulk-email-software|targetedemailsextractorsoftware|theemailtools)\.com)\>
| formail -b -f -A "$trash_header ordinary spamhaus/spamware 2002/01/03a"

# Per Neil 2002/01/07
# From a suggestion by Stormy Weather and Paul Chvostek on spam-l.
:0 Hf
*   ^Content-type: text/html
* ! html; charset=
* ! from hotmail
| formail -b -f -A "$trash_header ordinary non-hotmail-ratware"

# Per Neil 2002/01/07 (implemented 2002/01/07)
# From external sources, headers and body
:0 BHf
* .*\<(camelduck\.org|(dhscleads|dynamicleads|lamarket|luckyoffers|mortgagepower|reallycooloffers|vosn)\.net)\>
| formail -b -f -A "$trash_header ordinary external-sources 2002/01/07a"

# Per Neil 2002/01/07 (implemented 2002/01/07)
# From external sources, headers and body
:0 BHf
* .*\<((123asdf|abcde123|casinoent|casinovaent|checkingone01|checkingone02|checkingone03|checkingone04|checkingone05|checkingone06|checkingone07|checkingone08|checkingone09|checkingone10|checkingone11|checkingone12|checkingone13|checkingone14|checkingone15|checkingone16|checkingone17|checkingone18|checkingone19|checkingone20|emailfish|essencomp|exittrap|freecreditalerts|freejokes4u|freejokesforyou|getpaid4readingemails|headoutta|hi-speedoffers|hispeedoffers|host4profit|hsmoffers|iconqueredfibromyalgia|joke-land|looklean)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2002/01/07b"

# Per Neil 2002/01/07 (implemented 2002/01/07)
# From external sources, headers and body
:0 BHf
* .*\<((memberpro|newpowerdomain|oceanviewenterprises|promote-a-site|quickinspirations|reallycooldeals|reallycooloffers|santassluts|sxpress|techpia|teenycherry|trackinglink|venturesonline|yourfreepreview|zones)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2002/01/07c"

# Per Neil 2002/01/07 (implemented 2002/01/07)
# Open relays which sent spam, and were tested via openrbl.org
# Also known dial-ups.
:0 Hf
* ^Received:.*\[(12\.86\.200\.235|12\.102\.39\.239|24\.39\.107\.108|61\.216\.101\.77|63\.222\.160\.34|64\.91\.50\.7|200\.80\.18\.69|209\.205\.160\.23|212\.159\.167\.201|213\.97\.238\.169|216\.77\.219\.217|24\.0\.95\.83|24\.94\.162\.160|24\.94\.240\.32|63\.72\.203\.5|64\.225\.255\.11|65\.141\.13\.245|65\.211\.57\.60|65\.211\.62\.2|140\.174\.2\.1|163\.19\.239\.1|169\.207\.31\.10|194\.22\.194\.26|200\.53\.64\.127|200\.181\.57\.203|200\.192\.100\.11|202\.106\.196\.67|203\.124\.227\.227|205\.152\.58\.80|207\.202\.64\.36|210\.90\.12\.253|210\.90\.34\.1|210\.90\.55\.2|210\.90\.118\.1|210\.91\.23\.9|210\.143\.106\.74|213\.41\.96\.92|216\.94\.62\.242)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2002/01/07"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil 2002/01/07 (implemented 2002/01/07)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(inadvance\.com\.ar|infoviaplus\.net\.ar|ifxnw\.com\.ar|oo\.ru|fasthosts\.co\.uk|tiscali\.co\.uk|interkey\.net|mail2zeus\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2002/01/07"

# Per Neil 2002/01/21 (implemented 2002/01/22)
# From external sources, headers and body
:0 BHf
* .*\<((0o0o0o0oo0o0o0o0o0o|ewasher|hothosting|listwasher)\.org|(8848b2b|beaverhome|captain|catworks|cyberwebhosting|elcarajo|furniture4free|ghzpc|jtel|kaptan|offermail|paid4survey|powerbuyer|vivicatania|webfinity)\.net|(advancewebcreation|beaverhome|bigideals|bulkmailhosting|dataconnexs|dynamicpipe|emaillistclub|freehotcoeds|globalmediaresources|ioxphere|jobseekernews|lowticket|measureup|moneymailbits|national-directories|naughtychat|networksstatus|pansw|pythonpays|pythonvideo|resumerabbit|secretlykissed|stanleyhogaming|themembersdirectory|topweddinglinks|vrsite2|webkrew|wesomecontent)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2002/01/22a"

# Per Neil 2002/01/21 (implemented 2002/01/22)
# Open relays which sent spam, and were tested via openrbl.org
# Also known dial-ups.
:0 Hf
* ^Received:.*\[(139\.175\.82\.74|200\.161\.218\.50|200\.227\.154\.102|203\.204\.155\.181|206\.133\.195\.204|217\.80\.133\.194|62\.225\.222\.238|64\.110\.31\.18|66\.19\.3\.131|194\.109\.38\.127|203\.102\.153\.179|203\.129\.70\.59|203\.204\.230\.201|210\.111\.240\.19|210\.143\.106\.74|210\.67\.170\.220|210\.67\.170\.220|210\.95\.103\.34|211\.185\.200\.2|212\.105\.203\.66|212\.65\.243\.172|213\.24\.58\.17|216\.220\.25\.102|32\.104\.6\.200|61\.226\.71\.129|63\.77\.144\.35|66\.0\.26\.162)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2002/01/22"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil 2002/01/21 (implemented 2002/01/22)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(tripod\.fr|ttnet\.net\.tr|above\.net|(queer69|virtualis|weedmail)\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2002/01/22"

# Per Neil 2002/01/28 (implemented 2002/01/29)
# From external sources, headers and body
:0 BHf
* .*\<(t3direct\.com\.au|webmasterdirect\.org|(copydvd|ghostnight|jtel|secure-webs)\.net|(2001mall|ahajokes|bulkemailcds|bulkersclub|chineselocal|dbldirect|ezboard|freecontentmegasite|grindbind|hoast|jojo10|laughparty|linkcounter|loanconnectionusa|massmedium|milesource|missingyou02|missingyou03|missingyou04|missingyou05|missingyou06|missingyou07|missingyou08|missingyou09|mticd|netline|nexdeals|numberop|qualys|savingbot|visualware|webmiles|yourmailinglistprovider)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2002/01/29a"

# Per Neil 2002/01/28 (implemented 2002/01/29)
# Open relays which sent spam, and were tested via openrbl.org
# Also known dial-ups.
:0 Hf
* ^Received:.*\[(198\.142\.246\.21|200\.204\.201\.197|200\.207\.212\.126|211\.22\.132\.180|4\.33\.36\.110|61\.59\.174\.104|62\.64\.239\.218|65\.34\.200\.209|65\.43\.101\.189|142\.169\.121\.4|168\.95\.4\.115|202\.102\.243\.3|202\.109\.73\.90|202\.110\.113\.66|202\.155\.73\.180|203\.2\.75\.173|211\.162\.34\.223|211\.185\.205\.130|211\.22\.132\.180|211\.250\.213\.130|211\.46\.159\.66|211\.98\.24\.57|211\.99\.8\.140|61\.151\.244\.158|61\.153\.9\.21|61\.226\.68\.119|61\.226\.71\.129|61\.30\.168\.7|64\.2\.49\.186)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2002/01/29"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil 2002/01/28 (implemented 2002/01/29)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(cursinhodapoli.com.br|js.cn|zj.cn|indosat.net.id|anet.net.tr|(263|gstis)\.net|(bcentral|chinaren|inetmedia|jackawu|listbuilder|net263|tripinsurancecentral|unitedstates)\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2002/01/29"

# Per Neil 2002/02/02 (implemented 2002/02/07)
# Open relays which sent spam, and were tested via openrbl.org
# Also known dial-ups.
:0 Hf
* ^Received:.*\[(217\.135\.193\.153|212\.140\.65\.128|66\.19\.0\.200|192\.216\.34\.15|213\.25\.121\.254|128\.121\.239\.10|203\.244\.4\.3|164\.77\.209\.190|168\.95\.4\.68)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2002/02/07"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil 2002/02/02 (implemented 2002/02/07)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(inadvance\.com\.ar|sa\.edu\.au|ttnet\.net\.tr|(tronline|safe-mail)\.net|sex\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2002/02/07"

# Special
# Per Neil 2001/10/31 (implemented 2002/02/08)
# Consumer Reports Online persists in sending unsolicited mail to
# former subscribers despite having been contacted about the problem
# in March 2001.  Very sad.
:0 Hf
* ^From: Consumer Reports Online
| formail -b -f -A "$trash_header ordinary consumer-reports 2002/02/08"

# Per Neil 2002/02/11 (implemented 2002/02/12)
# From external sources, headers and body
:0 BHf
* .*\<(freeearlysignup\.biz|uscensus\.info|(emaildirect|xmarketing)\.org|(dreamtime|dreamx|ebattlestation|edirectoptin|is-online|opt-track|rm03|spro|terminations|tfmb)\.net|(500minutecard|adprosolutions|alemailmarketing|bigfishsubmit|biz-building|boostops|buyerbroadcast|dirbuy|edirectmessage|edirectoptin|email-blaster|gm10|gm11|gm12|gm13|gm14|gm15|gm16|gm17|gm18|gm19|gotmarketing|hopecancerfund|netdomination|network60|onesitemarket|optmails|penisshopstore|silverpop|surecom|theeigroup|vansdigital|vansdigitals|vanselectronics|vanstec|vivatrim)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2002/02/12a"

# Per Neil 2002/02/11 (implemented 2002/02/12)
# Open relays which sent spam, and were tested via openrbl.org
# Also known dial-ups.
:0 Hf
* ^Received:.*\[(194\.186\.111\.173|198\.142\.70\.16|200\.51\.235\.57|61\.216\.165\.92|156\.46\.117\.213|209\.198\.245\.41|210\.73\.135\.3|211\.200\.30\.128|63\.202\.190\.222|64\.2\.210\.21)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2002/02/12"

# RFC 822 (bounced complaints to postmaster or forged (invalid) domain)
# Per Neil 2002/02/11 (implemented 2002/02/12)
# Check in header and body for all RFC 822
:0 BHf
* .*\<(emirates\.net\.ae|cwbda\.net\.bm|hz\.zj\.cn|js\.cn|osan\.af\.mil|(cyberjack|eatel|koc|primus-india|tbwt)\.net|(diamondrental|freewhoa|usagreetings)\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822 2002/02/12"

# Per Neil 2002/02/18 (implemented 2002/02/19)
# From external sources, headers and body
:0 BHf
* .*\<(whoa\.bz|(internich|phxinternet|xfileformularz)\.net|(2002stockreport|4playmail|adreporting|africunt|ashercom|blastdirect|boobizon|bulkemailcompany|cigarettestation|colonize|dslreports|fantasymatch|fetishgalaxy|freeaccountsonline|gangbangdeli|garbagetraffic|girlspark|gloryboy|gtxcash|hged|informu|jjiconsulting|jumbomailer|lesbofarm|lgagroup|millionairesinthemaking|mitika|mpogd|myasianpussy|orgasmageddon|pemaso|resumeblaster|rodson|screensaverin|sex2go|sexier|supermen|thedigitaldrum|totalmerchantservices|two-river|twtelecom|ynotcash).com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2002/02/19a"

# Per Neil 2002/02/18 (implemented 2002/02/19)
# Open relays which sent spam, and were tested via openrbl.org
# Also known dial-ups.
:0 Hf
* ^Received:.*\[(151\.38\.159\.187|195\.239\.3\.251|198\.142\.248\.168|213\.250\.62\.156|213\.250\.62\.156|217\.134\.12\.153|217\.134\.38\.123|163\.138\.70\.12|202\.101\.18\.252|202\.130\.4\.195|202\.54\.22\.193|209\.149\.254\.181|211\.251\.132\.130|212\.54\.197\.98)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2002/02/19"

# RFC 822 and WHOIS (bounced complaints to postmaster or forged (invalid)
#    domain or mail to WHOIS-registered contacts bounces)
# Check in header and body for all RFC 822 / WHOIS
# Per Neil 2002/02/18 (implemented 2002/02/19)
:0 BHf
* .*\<(gddc\.com\.cn|guangzhou\.gd\.cn|ihw\.co\.cn|szptt\.net\.cn|osan\.af\.mil|com\.mt|turnet\.net\.tr|(cyberjack|msft|nameservices|safe-mail)\.net|(ch76tr|eleads2success|global2000|madhive|popsite)\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822/whois 2002/02/19"

# Per Neil 2002/02/04 (implemented 2002/02/20)
# From external sources, headers and body
:0 BHf
* .*\<(resumebiz\.cc|mojo\.co\.fr|marketing-results\.co\.uk|simple-loans\.co\.uk|iex-exhibition\.com\.vn|cityofpinkston\.org|(cyberspacereality|hispeedoffers|kooldeals|quickydeals|reallycooldeals|terminations|wowdeals)\.net|(500minutecard|adultdomains|alemailmarketing|bluemedianetworks|brentwoodwine|freehosting2001|freepornpage|giantrewards|global2way|goopt|hispeedmailer|hispeedmedia|i8|jtsterlings|mylottomail|oxygen-productions|sneakemail|unseenteens)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2002/02/20a"

# Per Neil 2002/02/04 (implemented 2002/02/20)
# Open relays which sent spam, and were tested via openrbl.org
# Also known dial-ups.
:0 Hf
* ^Received:.*\[(198\.142\.149\.115|200\.204\.146\.80|200\.207\.16\.151|212\.140\.65\.128|217\.135\.193\.153|66\.19\.0\.200|128\.121\.239\.10|164\.77\.209\.190|168\.95\.4\.68|192\.216\.34\.15|199\.172\.146\.130|200\.248\.190\.50|203\.244\.4\.3|210\.208\.200\.65|213\.25\.121\.254)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2002/02/20"

# RFC 822 and WHOIS (bounced complaints to postmaster or forged (invalid)
#    domain or mail to WHOIS-registered contacts bounces)
# Check in header and body for all RFC 822 / WHOIS
# Per Neil 2002/02/04 (implemented 2002/02/20)
:0 BHf
* .*\<(inadvance\.com\.ar|sa\.edu\.au|fz\.fj\.cn|interbusiness\.it|ttnet\.net\.tr|(mangoosta|primus-india|safe-mail|tronline)\.net|(charter|katelecom|sex)\.com)\>
| formail -b -f -A "$trash_header ordinary rfc822/whois 2002/02/20"

# Per Neil 2002/04/03 (implemented 2002/04/05)
# From external sources, headers and body
:0 BHf
* .*\<(border\.ocunix\.on\.ca|entrepreneurship\.qc\.ca|wowEshop\.co\.kr|onlineinformation\.org|(austincreations|betterleads|4dealsonline|freehgh|innovativeinsite|internet-cd|rboen|stock-watch|stoen|webdir)\.net|(2checkout|adult-life|affordable-domains|atlbiz|bmkmarketing|bulkmailman|clearflow|clubdefi|enom|freejokemail|freewebcounter|getpennytalk|gottabet|howtokillviolence|justmarket|karizmaoffers|kcircle|makeyourfortunenow|messpro|mindmedia|moneymadeeasily|nastymovies|naver|onlinedvdcopy|ordermusic|pages54|rapid-traffic|safelockrecords|seinfeldthemovie|sexteentop|spyproductions|strevenue|successteamathome|superior98|tips88|visosite|westnet24)\.com)\>
| formail -b -f -A "$trash_header ordinary external-sources 2002/04/05a"

# Per Neil 2002/04/03 (implemented 2002/04/05)
# Open relays which sent spam, and were tested via openrbl.org
# Also known dial-ups.
# -- split this week: this part is dial-up *networks*
:0 Hf
* ^Received:.*\[((165\.121\.24|194\.250\.150|200\.158\.176|200\.158\.178|200\.158\.180|200\.158\.62|200\.161\.215|200\.49\.205|200\.49\.86|200\.59\.140|200\.59\.45|200\.63\.129|200\.63\.158|203\.79\.131|203\.79\.71|204\.32\.146|206\.117\.161|207\.217\.120|209\.26\.235|210\.139\.100|210\.201\.178|211\.2\.42|211\.74\.233|212\.239\.161|212\.46\.232|213\.96\.135|217\.8\.19|217\.82\.18|217\.82\.31|24\.24\.199|4\.33\.72|4\.35\.245|4\.63\.100|61\.216\.164|61\.216\.167|61\.59\.52|62\.67\.197|63\.233\.84|64\.160\.235|64\.3\.22|64\.3\.70|64\.56\.225|65\.101\.254|65\.82\.56|66\.122\.29|67\.234\.81|67\.34\.55|67\.37\.129)\.[0-9])\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2002/04/05a"

# Per Neil 2002/04/03 (implemented 2002/04/05)
# Open relays which sent spam, and were tested via openrbl.org
# Also known dial-ups.
# -- split this week: this part is open relay hosts
:0 Hf
* ^Received:.*\[(128\.121\.8\.27|12\.246\.118\.140|139\.130\.215\.245|139\.142\.230\.134|161\.58\.221\.205|168\.103\.192\.25|192\.72\.81\.219|195\.55\.218\.70|195\.6\.193\.2|200\.14\.206\.2|200\.243\.191\.2|200\.244\.153\.14|200\.45\.191\.5|200\.50\.0\.246|202\.105\.115\.118|202\.107\.117\.17|202\.108\.109\.222|202\.129\.76\.232|202\.181\.164\.138|202\.185\.26\.131|202\.64\.193\.34|203\.102\.153\.165|203\.2\.192\.87|204\.71\.191\.179|205\.244\.47\.253|206\.173\.11\.21|206\.65\.178\.49|207\.250\.144\.70|208\.10\.137\.5|208\.178\.66\.(35|37|45|130|131|132|133|150)|209\.110\.27\.15|209\.214\.93\.163|209\.29\.197\.226|209\.61\.185\.88|209\.88\.60\.146|209\.88\.62\.6|210\.161\.232\.210|210\.92\.213\.13|210\.95\.106\.65|210\.95\.248\.194)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2002/04/05b"

# Per Neil 2002/04/03 (implemented 2002/04/05)
# Open relays which sent spam, and were tested via openrbl.org
# Also known dial-ups.
# -- split this week: this part is more open relay hosts
:0 Hf
* ^Received:.*\[(211\.101\.143\.222|211\.114\.56\.209|211\.114\.58\.34|211\.114\.59\.81|211\.144\.168\.22|211\.152\.107\.30|211\.184\.134\.131|211\.192\.139\.10|211\.193\.182\.88|211\.217\.220\.87|211\.23\.22\.195|211\.251\.68\.3|211\.251\.74\.130|211\.251\.86\.194|211\.34\.252\.2|211\.34\.42\.130|211\.57\.155\.3|211\.74\.27\.164|212\.113\.23\.195|212\.138\.47\.16|212\.155\.223\.6|212\.176\.55\.219|212\.192\.227\.55|212\.88\.187\.41|213\.24\.21\.130|216\.148\.227\.87|216\.161\.127\.65|216\.240\.140\.16|216\.240\.159\.11|216\.240\.159\.118|216\.240\.159\.43|216\.72\.24\.196|217\.8\.19\.202|218\.150\.113\.7|4\.35\.245\.241|61\.30\.0\.133|62\.159\.151\.235|62\.7\.231\.146|63\.170\.11\.(4|5|6|7|32|130|131|132|133|150|189|198|200|201|202|203)|63\.251\.135\.75|64\.215\.52\.(99|100|101|120)|64\.8\.206\.106|65\.139\.102\.156|65\.171\.144\.14|65\.82\.111\.43|65\.82\.56\.52|65\.82\.72\.2|65\.89\.250\.69|66\.231\.133\.63|68\.60\.185\.28)\]
| formail -b -f -A "$trash_header ordinary open-relays-dialups 2002/04/05c"

# RFC 822 and WHOIS (bounced complaints to postmaster or forged (invalid)
#    domain or mail to WHOIS-registered contacts bounces)
# Check in header and body for all RFC 822 / WHOIS
# Per Neil 2002/04/03 (implemented 2002/04/05)
# Includes 210.95.106.64/26, which is the mess at the end.
:0 BHf
* .*\<(micla\.com\.ar|connect\.com\.au|comdominio\.com\.br|gwbn\.net\.cn|ha\.cn|cable\.net\.co|united-internet\.de|email\.it|ipasaule\.lv|levi-systems\.sk|loxley\.co\.th|lycos\.co\.uk|domino4\.co\.uk|region6-lifehelp\.org|(cynet|europaglobal|hitron|iadvantage|ph.inter|ripn|soft|thisis4real)\.net|(aboutq8|cashinjection|china-netcom|costalwarehouse|cpol|cyrunner|dec|emailaccount|hanmir|itsagoodlifenow|mastak|mediacity|pacific-coral|prodigy|psigh|rediffmail|sistemor|skyrivercom|webhost4all|worldstart|yah)\.com|210\.95\.106\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7]))\>
| formail -b -f -A "$trash_header ordinary rfc822/whois 2002/04/05"

# Special
# Per Neil 2002/04/03 (implemented 2002/04/12)
# Advertising spam outfits on Cable & Wireless:
# SBL Ref     IP                  Spam Outfit
# -------     ----------------    -----------
# ROK1524     204.188.146.0/24    Brendan Battles / IMG Online
# ROK1459     205.218.178.0/23    Ronnie Scelson
# ROK1569     206.128.145.0/24    Gaven Stubberfield
# SBX586      206.28.104.0/24     Ronnie Scelson
# SBX587      206.28.108.0/24     Ronnie Scelson
# SBX2410     206.28.80.0/23      Ernesto Haberli / cyrunner
# SBX2334     206.28.82.0/23      Ernesto Haberli / cyrunner
# SBX2373     206.28.84.0/23      Ernesto Haberli / cyrunner
# SBX2411     206.28.86.0/23      Ernesto Haberli / cyrunner
# SBX336      207.0.62.0/23       Cybermall Enterprises/spaceisp
# SBX2490     207.2.128.0/24      Scott Edward Abadjian
# SBX2429     208.128.162.112/28  SAMCO (Atlanta Internet Consulting, Inc.)
# SBX2440     208.137.250.0/23    Ernesto Haberli / cyrunner
# SBX2347     208.144.138.0/23    Ernesto Haberli / cyrunner
# SBX2441     208.144.140.0/23    Ernesto Haberli / cyrunner
# SBX2442     208.144.142.0/23    Ernesto Haberli / cyrunner
# SBX2524     208.151.54.0/23     SAMCO (Atlanta Internet Consulting, Inc.)
# SBX2428     66.45.30.106/31     SAMCO

:0 Hf
* ^Received:.*\[(204\.188\.146\.(([0-9]|[1-9][0-9])|(1[0-9][0-9]|2([0-4][0-9]|5[0-5])))|205\.218\.17[8-9]\.(([0-9]|[1-9][0-9])|(1[0-9][0-9]|2([0-4][0-9]|5[0-5])))|206\.128\.145\.(([0-9]|[1-9][0-9])|(1[0-9][0-9]|2([0-4][0-9]|5[0-5])))|206\.28\.104\.(([0-9]|[1-9][0-9])|(1[0-9][0-9]|2([0-4][0-9]|5[0-5])))|206\.28\.108\.(([0-9]|[1-9][0-9])|(1[0-9][0-9]|2([0-4][0-9]|5[0-5])))|206\.28\.8[0-7]\.(([0-9]|[1-9][0-9])|(1[0-9][0-9]|2([0-4][0-9]|5[0-5])))|207\.0\.6[2-3]\.(([0-9]|[1-9][0-9])|(1[0-9][0-9]|2([0-4][0-9]|5[0-5])))|207\.2\.128\.(([0-9]|[1-9][0-9])|(1[0-9][0-9]|2([0-4][0-9]|5[0-5])))|208\.128\.162\.1(1[2-9]|2[0-7])|208\.137\.25[0-1]\.(([0-9]|[1-9][0-9])|(1[0-9][0-9]|2([0-4][0-9]|5[0-5])))|208\.144\.13[8-9]\.(([0-9]|[1-9][0-9])|(1[0-9][0-9]|2([0-4][0-9]|5[0-5])))|208\.144\.14[0-3]\.(([0-9]|[1-9][0-9])|(1[0-9][0-9]|2([0-4][0-9]|5[0-5])))|208\.151\.5[4-5]\.(([0-9]|[1-9][0-9])|(1[0-9][0-9]|2([0-4][0-9]|5[0-5])))|66\.45\.30\.10[6-7])\]
| formail -b -f -A "$trash_header special netblocks 2002/04/12"