# UBEfilter # v1.119 # Oct 28, 2005 # The structure here is "generic filters" to "specific filters." The # filters at the top will catch most stupid spam engines. After that # we begin targeting relayers, bad domains, suspicious senders, # suspicious subject lines, "To" headers we don't like, addresses that # seem to be uncommonly targeted, etc. If the message is not hit by # any of these rules then it's allowed to be delivered. If it is # caught be any of the rules it is silently delivered to a junk drawer # that is emptied once a week (or so). # Sadly this sucky filter can jump only down in the filter - not # up. Make sure that any "JUMP" points to something down the list. # This defines our exceptions. Anything that is destined for # postmaster or abuse is allowed through. Also allowed through is # anything from the burningman.com domain. The rest is processed. :Start From "cosmos.local" JUMP "Spam" Channel-To:envonly "(postmaster|abuse)" EXIT From "@burningman\.com" EXIT From "forum@pogues.com" EXIT Host-From:envonly ".*" JUMP "MiscHeaders" # This set of rules catches commonly bad things, and a few known Spam # mailers. If the spam is caught by this then the Spammer is truely # stupid. :MiscHeaders Channel-To:envonly "<@|<.*[%,:!]|<.*@.*@" JUMP "Spam" To "^@|.*:;|\.<>" JUMP "Spam" From "(nobody@)|([0-9][0-9]-[0-9][0-9]-[0-9][0-9]@)|(\[a-zA-Z]'[a-zA-Z])|(@<)|(\"\"<>)" JUMP "Spam" Received "GAA.*-0600.*EST" JUMP "Spam" Received "XAA.*-0700.*EDT" JUMP "Spam" Received "(xxxx)+" JUMP "Spam" Received "untrace?able" JUMP "Spam" Received "from (baby|bewellnet)" JUMP "Spam" Date "/[0-9]+/.+[AP]M.+Time" JUMP "Spam" DATE "[0-9]+ [A-Z][a-z][a-z] [0-9].* [AP]M" JUMP "Spam" Subject "^\(?ADV[:;]\)?" JUMP "Spam" Message-ID "@teqdqy" JUMP "Spam" Message-ID "<>" JUMP "Spam" Message-Id "<(419\.43|989\.28)" JUMP "Spam" X-MimeOLE "MimeOLE V[^0-9]" JUMP "Spam" MIME-Version "1.0From" JUMP "Spam" X-Mailer "mcsynmailer" JUMP "Spam" X-Mailer "Inbox 2002" JUMP "Spam" X-Mailer "DiffondiCool" JUMP "Spam" X-Mailer "Emailer Platinum" JUMP "Spam" X-Mailer "eMerge" JUMP "Spam" X-Mailer "Blastoise" JUMP "Spam" X-Mailer "Mail Bomber" JUMP "Spam" X-Mailer "Roving Constant Contact" JUMP "Spam" X-Mailer "MailWorkz" JUMP "Spam" X-Mailer "eGroups Message Poster" JUMP "Spam" X-Mailer "Jackpot" JUMP "Spam" X-Mailer "GRMessageQueue" JUMP "Spam" X-Mailer "Arclab MailList Controller" JUMP "Spam" X-Mailer "jpfree Group Mail Express" JUMP "Spam" X-Mailer "FoxMail" JUMP "Spam" X-Mailer "Flicks Softwares" JUMP "Spam" X-Mailer "EBT Reporter" JUMP "Spam" X-Mailer "ARELIS" JUMP "Spam" X-Mailer "The Bat" JUMP "Spam" X-UID "800330200" JUMP "Spam" X-PMG-Userid ".*" JUMP "Spam" # Invalid headers from MyGuestBook.exe CGI spamware - bobp MessageID "<.+>" JUMP "Spam" X-References "0[A-Z0-9]+, 0[A-Z0-9]+$" JUMP "Spam" X-Other-References "0[A-Z0-9]+$" JUMP "Spam" X-See-Also "0[A-Z0-9]+$" JUMP "Spam" X-Unsubscribe "pxlg.com" JUMP "Spam" # Some massively broken spam engine is putting "Received:" headers inside "Return-Path" headers. Return-Path "Received:" JUMP "Spam" # Lawngames only receives email. It doesn't send it. From "lawngames@dzm.com" JUMP "Spam" Content-Type "multipart/(alternative|mixed)" JUMP "Virus" Host-From:envonly ".*" JUMP "received_ip" # Trojan virus pissing me off. A lot. :Virus From "administrator@(pogues|poguetry|dzm|levinengineering|tullycreek|tullycreekranch|jmccabe)\.(com|org)" JUMP "Spam" From "admin@(pogues|poguetry|dzm|levinengineering|tullycreek|tullycreekranch|jmccabe)\.(com|org)" JUMP "Spam" From "webmaster@(pogues|poguetry|dzm|levinengineering|tullycreek|tullycreekranch|jmccabe)\.(com|org)" JUMP "Spam" From "info@(pogues|poguetry|dzm|levinengineering|tullycreek|tullycreekranch|jmccabe)\.(com|org)" JUMP "Spam" From "mail@(pogues|poguetry|dzm|levinengineering|tullycreek|tullycreekranch|jmccabe)\.(com|org)" JUMP "Spam" From "service@(pogues|poguetry|dzm|levinengineering|tullycreek|tullycreekranch|jmccabe)\.(com|org)" JUMP "Spam" From "support@(pogues|poguetry|dzm|levinengineering|tullycreek|tullycreekranch|jmccabe)\.(com|org)" JUMP "Spam" From "register@(pogues|poguetry|dzm|levinengineering|tullycreek|tullycreekranch|jmccabe)\.(com|org)" JUMP "Spam" From "accounts@(pogues|poguetry|dzm|levinengineering|tullycreek|tullycreekranch|jmccabe)\.(com|org)" JUMP "Spam" From "dave@(pogues|poguetry|dzm|levinengineering|tullycreek|tullycreekranch|jmccabe)\.(com|org)" JUMP "Spam" # Unfortunately the Klez virii are quite adaptable so I need to do a # special check for it and its variants. # Klez virii - Klez can send all of these: # Hi # Hello # How are you? # Can you help me? # We want peace # Where will you go? # Congratulations!!! # Don't cry # Look at the pretty # Some advice on your shortcoming # Free XXX Pictures # A free hot porn site # Why don't you reply to me? # How about have dinner with me together? # Never kiss a stranger # Klez.E can send these # how are you # let's be friends # darling # don't drink too much # your password # honey # some questions # please try again # welcome to my hometown # the Garden of Eden # introduction on ADSL # meeting notice # questionnaire # congratulations # sos! # japanese girl VS playboy # look,my beautiful girl friend # eager to see you # spice girls' vocal concert # japanese lass' sexy pictures # After we check for these subjects we bounce back to the rest of the filters. # I'm getting some false positives from this filter. I've commented # out most of the probable false hit generators. Somewhere my # understanding of RegEx is breaking down or NMS' support is broken. Subject "^Hi$" REJECT "This message seems to be carrying the Klez virus." # Subject "^Hello$" REJECT "This message seems to be carrying the Klez virus." Subject "How are you\"?$" REJECT "This message seems to be carrying the Klez virus." # Subject "Can you help me" REJECT "This message seems to be carrying the Klez virus." # Subject "We want peace" REJECT "This message seems to be carrying the Klez virus." # Subject "Where will you go" REJECT "This message seems to be carrying the Klez virus." Subject "Congratulations\"?$" REJECT "This message seems to be carrying the Klez virus." # Subject "Don.t cry" REJECT "This message seems to be carrying the Klez virus." # Subject "Look at the pretty" REJECT "This message seems to be carrying the Klez virus." # Subject "Some advice on your shortcoming" REJECT "This message seems to be carrying the Klez virus." # Subject "Free XXX Pictures" REJECT "This message seems to be carrying the Klez virus." # Subject "A free hot porn site" REJECT "This message seems to be carrying the Klez virus." # Subject "Why don.t you reply to me" REJECT "This message seems to be carrying the Klez virus." # Subject "How about have dinner with me together" REJECT "This message seems to be carrying the Klez virus." # Subject "Never kiss a stranger" REJECT "This message seems to be carrying the Klez virus." Subject "Let.s be friends\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "Darling$" REJECT "This message seems to be carrying the Klez virus." # Subject "Don.t drink too much" REJECT "This message seems to be carrying the Klez virus." Subject "Your password\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "Honey$" REJECT "This message seems to be carrying the Klez virus." Subject "^Language$" REJECT "This message seems to be carrying the Klez virus." Subject "Some questions\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "Please try again\"?" REJECT "This message seems to be carrying the Klez virus." Subject "Welcome to my hometown\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "The garden of eden\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "Introduction on ADSL\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "Meeting notice\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "Questionnaire\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "SOS!\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "Japanese girl vs playboy\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "Look,my beautiful girl friend\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "Eager to see you\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "Spice girls. vocal concert\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "japanese lass' sexy pictures\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "your home page\"?$" REJECT "This message seems to be carrying the Klez virus." # Subject "Begin detailing the$" REJECT "This message seems to be carrying the Klez virus." Subject "Worm Klez\.E immunity\"?$" REJECT "This message seems to be carrying the Klez virus." # Subject "Here to find out more" REJECT "This message seems to be carrying the Klez virus." Subject "Internet security update\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "A +(WinXP|IE 6\.0) +patch\"?" REJECT "This message seems to be carrying the Klez virus." Subject "A( )+(very|special)? ( )?(funny|humour|excite|powful|new|nice|good)?( )+(website|game|tool)" REJECT "This message seems to be carrying the Klez virus." Subject "W32\.(Elkern|Klez(\.E)?) +removal +tools\"?$" REJECT "This message seems to be carrying the Klez virus." # Subject "Amazon.com, Inc. or its affiliates" REJECT "This message seems to be carrying the Klez virus." Subject "(Have a )?(funny|good|Happy|new|excite) (humour )?(New Year|Assumption|Epiphany|Christmas)\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "^(Returned|Undeliverable) mail--\"[0-9a-zA-Z .]+\"$" REJECT "This message seems to be carrying the Klez virus." Subject "Of service*\"?" REJECT "This message seems to be carrying the Klez virus." Subject "So cool a flash,enjoy it\"?$" REJECT "This message seems to be carrying the Klez virus." Subject "Undelivered Mail Returned to Sender -(New Text Document|Readme|Werkwoorden|goldfish|disc one|joske|nouveau|the hives|trojan|yucom)" DROP "This message is not legitimate." # Email from "Internet Mail Service" can have a empty Subject field, # though most other mail clients can't. So ... False positives from a # single user. It's gone. # Subject "^$" JUMP "Spam" # Seems certain users are the source of lots of Klez Resent-From "brewer@prodigy.net" REJECT "Too many virus infected messages have come from \"brewer@prodigy.net\". All messages are now rejected." Return-Path "dchichester@worldnet\.att\.net" REJECT "Too many virus infected messages have come from \"dchichester@worldnet.att.net\". All messages are now rejected." Return-Path "losier@massoilheat\.org" REJECT "Too many virus infected messages have come from \"losier@massoilheat.org\". All messages are now rejected." Return-Path "dave@limerickfleamarket\.com" REJECT "Too many virus infected messages have come from \"dave@limerickfleamarket.com\". All messages are now rejected." Return-Path "toddscal@erie\.net" REJECT "Too many virus infected messages have come from \"toddscal@erie.net\". All messages are now rejected." Return-Path "imhid@charter\.net" REJECT "Too many virus infected messages have come from \"imhid@charter.net\". All messages are now rejected." Return-Path "imhid@charter\.net" REJECT "Too many virus infected messages have come from \"imhid@charter.net\". All messages are now rejected." Return-Path "service@adultprovide\.com" REJECT "Too many virus infected messages have come from \"service@adultprovide\.com\". All messages are now rejected." Return-Path "info@wstationonline\.com" REJECT "Too many virus infected messages have come from \"info@wstationonline.com\". All messages are now rejected." Return-Path "tajranco@emirates\.net\.ae" REJECT "Too many virus infected messages have come from \"tajranco@emirates.net.ae\". All messages are now rejected." Return-Path "jedaziz@tm\.net\.my" REJECT "Too many virus infected messages have come from \"jedaziz@tm.net.my\". All messages are now rejected." Return-Path "georgefj@verizon\.net" REJECT "Too many virus infected messages have come from \"georgefj@verizon.net\". All messages are now rejected." Return-Path "lchester@coe\.uga\.edu" REJECT "Too many virus infected messages have come from \"lchester@coe.uga.edu\". All messages are now rejected." X-Apparently-From "burton730@aol\.com" REJECT "Too many virus infected messages have come from \"burton730@aol.com\". All messages are now rejected." Return-Path "ricardobravo@sisisa\.podernet\.com\.mx" REJECT "Too many virus infected messages have come from \"ricardobravo@sisisa.podernet.com.mx\". All messages are now rejected." Return-Path "nuestrorock@sisisa\.podernet\.com\.mx" REJECT "Too many virus infected messages have come from \"nuestrorock@sisisa.podernet.com.mx\". All messages are now rejected." Return-Path "circoromano@wanadoo\.es" REJECT "Too many virus infected messages have come from \"circoromano@wanadoo.es\". All messages are now rejected." Return-Path "balsamolivio@liberio\.it" REJECT "Too many virus infected messages have come from \"balsamolivio@liberio.it\". All messages are now rejected." Return-Path "udb@verizon\.net" REJECT "Too many virus infected messages have come from \"udb@verizon.net\". All messages are now rejected." Return-Path "furuya@miyuki-net\.co\.jp" REJECT "Too many virus infected messages have come from \"furuya@miyuki-net.co.jp\". All messages are now rejected." Return-Path "josh@spadesoleil\.com" REJECT "Too many virus infected messages have come from \"josh@spadesoleil.com\". All messages are now rejected." Return-Path "rober1400c@mindspring\.com" REJECT "Too many virus infected messages have come from \"rober1400c@mindspring.com\". All messages are now rejected." Return-Path "imagevolution@adelphia\.net" REJECT "Too many virus infected messages have come from \"imagevolution@adelphia.net\". All messages are now rejected." Return-Path "heather@new2u\.com" REJECT "Too many virus infected messages have come from \"heather@new2u.com\". All messages are now rejected." Return-Path "dedhed@chartertn\.net" REJECT "Too many virus infected messages have come from \"dedhed@chartertn.net\". All messages are now rejected." Return-Path "shfriedman@worldsites\.net" REJECT "Too many virus infected messages have come from \"shfriedman@worldsites.net\". All messages are now rejected." Return-Path "niekske\.o@hetnet\.nl" REJECT "Too many virus infected messages have come from \"niekske.o@hetnet.nl\". All messages are now rejected." Return-Path "epoppycock@comcast\.net" REJECT "Too many virus infected messages have come from \"epoppycock@comcast.net\". All messages are now rejected." Return-Path "quitob1@verizon\.net" REJECT "Too many virus infected messages have come from \"quitob1@verizon.net\". All messages are now rejected." Return-Path "cedwards@bmb-inc\.com" REJECT "Too many virus infected messages have come from \"cedwards@bmb-inc.com\". All messages are now rejected." X-Apparently-From "JoshRebKen@aol\.com" REJECT "Too many virus infected messages have come from \"JoshRebKen@aol.com\". All messages are now rejected." X-Apparently-From "IrnBru00@aol\.com" REJECT "Too many virus infected messages have come from \"IrnBru00@aol.com\". All messages are now rejected." Return-Path "krjo@ozemail\.com\.au" REJECT "Too many virus infected messages have come from \"krjo@ozemail.com.au\". All messages are now rejected." Host-From:envonly ".*" JUMP "received_ip" # This is a set of IP addresses (or subnets) that have demonstrated # themselves to be the origin of spam. The IP block owners have been # notified that their subnet/IP is being blocked. The IP addresses are # double-listed to work around a badness in NMS4.x: the final Received # header is attached /after/ the UBEfilter processes the message. So I # can kill messages that have been relayed through other SMTP # machines, but if I want to prevent an IP (or subnet) from directly # passing mail to me I need to check the Envelope instead. To make # certain that I never receive mail (directly or relayed) from an IP # or subnet I have to maintain two lists containing much the same # data. Alternatively I could maintain one list in the anti-relay # config and one in the UBEfilter, but this would cause me to be # unable to check for false positives, etc. # The 4.0 through 4.255 block is Genuity :received_ip Received "4\.3\.52\.[0-9]+" JUMP "Spam" Host-From:envonly "4\.3\.52\.[0-9]+" JUMP "Spam" Received "4\.40\.13\.[0-9]+" JUMP "Spam" Host-From:envonly "4\.40\.13\.[0-9]+" JUMP "Spam" Received "4\.42\.209\.[0-9]+" JUMP "Spam" Host-From:envonly "4\.42\.209\.[0-9]+" JUMP "Spam" Received "4\.43\.80\.[0-9]+" JUMP "Spam" Host-From:envonly "4\.43\.80\.[0-9]+" JUMP "Spam" Received "4\.43\.226\.[0-9]+" JUMP "Spam" Host-From:envonly "4\.43\.226\.[0-9]+" JUMP "Spam" Received "4\.54\.212\.[0-9]+" JUMP "Spam" Host-From:envonly "4\.54\.212\.[0-9]+" JUMP "Spam" Received "4\.61\.237\.[0-9]+" JUMP "Spam" Host-From:envonly "4\.61\.237\.[0-9]+" JUMP "Spam" Received "4\.61\.238\.[0-9]+" JUMP "Spam" Host-From:envonly "4\.61\.238\.[0-9]+" JUMP "Spam" Received "4\.62\.141\.[0-9]+" JUMP "Spam" Host-From:envonly "4\.62\.141\.[0-9]+" JUMP "Spam" # End Genuity block # The 12.0 through 12.255 block is ATT Received "12\.13\.167\.[0-9]+" JUMP "Spam" Host-From:envonly "12\.13\.167\.[0-9]+" JUMP "Spam" Received "12\.65\.210\.[0-9]+" JUMP "Spam" Host-From:envonly "12\.65\.210\.[0-9]+" JUMP "Spam" Received "12\.229\.3\.[0-9]+" JUMP "Spam" Host-From:envonly "12\.229\.3\.[0-9]+" JUMP "Spam" Received "12\.229\.93\.[0-9]+" JUMP "Spam" Host-From:envonly "12\.229\.93\.[0-9]+" JUMP "Spam" Received "12\.238\.114\.[0-9]+" JUMP "Spam" Host-From:envonly "12\.238\.114\.[0-9]+" JUMP "Spam" Received "12\.246\.79\.[0-9]+" JUMP "Spam" Host-From:envonly "12\.246\.79\.[0-9]+" JUMP "Spam" Received "12\.246\.84\.[0-9]+" JUMP "Spam" Host-From:envonly "12\.246\.84\.[0-9]+" JUMP "Spam" Received "12\.251\.34\.[0-9]+" JUMP "Spam" Host-From:envonly "12\.251\.34\.[0-9]+" JUMP "Spam" # End ATT block Received "24\.31\.83\.[0-9]+" JUMP "Spam" Host-From:envonly "24\.31\.83\.[0-9]+" JUMP "Spam" Received "24\.41\.21\.[0-9]+" JUMP "Spam" Host-From:envonly "24\.41\.21\.[0-9]+" JUMP "Spam" Received "24\.48\.80\.[0-9]+" JUMP "Spam" Host-From:envonly "24\.48\.80\.[0-9]+" JUMP "Spam" Received "24\.50\.6\.[0-9]+" JUMP "Spam" Host-From:envonly "24\.50\.6\.[0-9]+" JUMP "Spam" # Due to crappy logging I have no way of knowing how many positives are # being generated by this rule. I /do/ know how many false positives are # happening. Stubbing out and watching for fresh spam. #Received "24\.71\.223\.[0-9]+" JUMP "Spam" #Host-From:envonly "24\.71\.223\.[0-9]+" JUMP "Spam" Received "24\.73\.17\.[0-9]+" JUMP "Spam" Host-From:envonly "24\.73\.17\.[0-9]+" JUMP "Spam" # This block is the source of hundreds of virus email. A propagation # point or just a dumbass? Who knows. It's dead to me. Received "24\.112\.160\.[0-9]+" JUMP "Spam" Host-From:envonly "24\.112\.160\.[0-9]+" JUMP "Spam" # 24.128.0 through 24.128.255 is ATT Broadband Received "24\.128\.139\.[0-9]+" JUMP "Spam" Host-From:envonly "24\.128\.139\.[0-9]+" JUMP "Spam" # End ATT Broadband block # In Soviet Russia crap spam comes from these IPs Received "24\.158\.70\.[0-9]+" JUMP "Spam" Host-From:envonly "24\.158\.70\.[0-9]+" JUMP "Spam" Received "24\.169\.32\.[0-9]+" JUMP "Spam" Host-From:envonly "24\.169\.32\.[0-9]+" JUMP "Spam" Received "24\.186\.32\.[0-9]+" JUMP "Spam" Host-From:envonly "24\.186\.214\.[0-9]+" JUMP "Spam" Received "24\.186\.214\.[0-9]+" JUMP "Spam" Host-From:envonly "24\.203\.35\.[0-9]+" JUMP "Spam" Received "24\.205\.70\.[0-9]+" JUMP "Spam" Host-From:envonly "24\.205\.70\.[0-9]+" JUMP "Spam" # 24.232.0 through 24.232.255 is Cablevision, Buenos Aires Received "24\.232\.152\.[0-9]+" JUMP "Spam" Host-From:envonly "24\.232\.152\.[0-9]+" JUMP "Spam" # End Cablevision block # 24.242.0 through 24.243.175 is RoadRunner Internet Received "24\.242\.24\.[0-9]+" JUMP "Spam" Host-From:envonly "24\.242\.24\.[0-9]+" JUMP "Spam" # End RoadRunner block # 61.0 through 61.255 is from China - A haunt of # spammers looking for open relays Received "61\.13\.62\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.13\.62\.[0-9]+" JUMP "Spam" Received "61\.16\.36\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.16\.36\.[0-9]+" JUMP "Spam" Received "61\.16\.85\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.16\.85\.[0-9]+" JUMP "Spam" Received "61\.16\.91\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.16\.91\.[0-9]+" JUMP "Spam" Received "61\.16\.95\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.16\.95\.[0-9]+" JUMP "Spam" Received "61\.20\.231\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.20\.231\.[0-9]+" JUMP "Spam" Received "61\.73\.152\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.73\.152\.[0-9]+" JUMP "Spam" Received "61\.73\.226\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.73\.226\.[0-9]+" JUMP "Spam" Received "61\.78\.53\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.78\.53\.[0-9]+" JUMP "Spam" Received "61\.79\.(66|122)\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.79\.(66|122)\.[0-9]+" JUMP "Spam" Received "61\.83\.252\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.83\.35\.[0-9]+" JUMP "Spam" Received "61\.85\.35\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.85\.252\.[0-9]+" JUMP "Spam" Received "61\.88\.140\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.88\.140\.[0-9]+" JUMP "Spam" Received "61\.99\.42\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.99\.42\.[0-9]+" JUMP "Spam" Received "61\.129\.55\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.129\.55\.[0-9]+" JUMP "Spam" Received "61\.129\.121\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.129\.121\.[0-9]+" JUMP "Spam" Received "61\.133\.34\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.133\.34\.[0-9]+" JUMP "Spam" Received "61\.133\.117\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.133\.117\.[0-9]+" JUMP "Spam" Received "61\.136\.26\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.136\.26\.[0-9]+" JUMP "Spam" Received "61\.137\.91\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.137\.91\.[0-9]+" JUMP "Spam" Received "61\.138\.21\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.138\.21\.[0-9]+" JUMP "Spam" Received "61\.139\.66\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.139\.66\.[0-9]+" JUMP "Spam" Received "61\.140\.60\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.140\.60\.[0-9]+" JUMP "Spam" Received "61\.144\.17\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.144\.17\.[0-9]+" JUMP "Spam" Received "61\.144\.224\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.144\.224\.[0-9]+" JUMP "Spam" Received "61\.145\.19\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.145\.19\.[0-9]+" JUMP "Spam" Received "61\.145\.114\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.145\.114\.[0-9]+" JUMP "Spam" Received "61\.151\.244\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.151\.244\.[0-9]+" JUMP "Spam" Received "61\.153\.9\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.153\.9\.[0-9]+" JUMP "Spam" Received "61\.155\.103\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.155\.103\.[0-9]+" JUMP "Spam" Received "61\.158\.128\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.158\.128\.[0-9]+" JUMP "Spam" Received "61\.159\.235\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.159\.235\.[0-9]+" JUMP "Spam" Received "61\.166\.2\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.166\.2\.[0-9]+" JUMP "Spam" Received "61\.175\.153\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.175\.153\.[0-9]+" JUMP "Spam" Received "61\.175\.217\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.175\.217\.[0-9]+" JUMP "Spam" Received "61\.180\.240\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.180\.240\.[0-9]+" JUMP "Spam" Received "61\.183\.120\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.183\.120\.[0-9]+" JUMP "Spam" Received "61\.216\.142\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.216\.142\.[0-9]+" JUMP "Spam" Received "61\.218\.67\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.218\.67\.[0-9]+" JUMP "Spam" Received "61\.220\.255\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.220\.255\.[0-9]+" JUMP "Spam" Received "61\.222\.1(38|82)\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.222\.1(38|82)\.[0-9]+" JUMP "Spam" Received "61\.223\.146\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.223\.146\.[0-9]+" JUMP "Spam" Received "61\.250\.250\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.250\.250\.[0-9]+" JUMP "Spam" Received "61\.251\.187\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.251\.187\.[0-9]+" JUMP "Spam" Received "61\.254\.73\.[0-9]+" JUMP "Spam" Host-From:envonly "61\.254\.73\.[0-9]+" JUMP "Spam" # End China block Received "62\.5\.241\.[0-9]+" JUMP "Spam" Host-From:envonly "62\.5\.241\.[0-9]+" JUMP "Spam" Received "62\.13\.43\.[0-9]+" JUMP "Spam" Host-From:envonly "62\.13\.43\.[0-9]+" JUMP "Spam" Received "62\.15\.98\.[0-9]+" JUMP "Spam" Host-From:envonly "62\.15\.98\.[0-9]+" JUMP "Spam" Received "62\.24\.71\.[0-9]+" JUMP "Spam" Host-From:envonly "62\.24\.71\.[0-9]+" JUMP "Spam" Received "62\.24\.91\.[0-9]+" JUMP "Spam" Host-From:envonly "62\.24\.91\.[0-9]+" JUMP "Spam" Received "62\.49\.12\.[0-9]+" JUMP "Spam" Host-From:envonly "62\.49\.12\.[0-9]+" JUMP "Spam" Received "62\.57\.227\.[0-9]+" JUMP "Spam" Host-From:envonly "62\.57\.227\.[0-9]+" JUMP "Spam" Received "62\.89\.65\.[0-9]+" JUMP "Spam" Host-From:envonly "62\.89\.65\.[0-9]+" JUMP "Spam" Received "62\.110\.160\.[0-9]+" JUMP "Spam" Host-From:envonly "62\.110\.160\.[0-9]+" JUMP "Spam" Received "62\.150\.23\.[0-9]+" JUMP "Spam" Host-From:envonly "62\.150\.23\.[0-9]+" JUMP "Spam" Received "62\.168\.35\.[0-9]+" JUMP "Spam" Host-From:envonly "62\.168\.35\.[0-9]+" JUMP "Spam" Received "62\.19[45]\.[0-9]+\.[0-9]+" JUMP "Spam" Host-From:envonly "62\.16[45]\.[0-9]+\.[0-9]+" JUMP "Spam" Received "62\.214\.52\.[0-9]+" JUMP "Spam" Host-From:envonly "62\.214\.52\.[0-9]+" JUMP "Spam" Received "62\.226\.128\.[0-9]+" JUMP "Spam" Host-From:envonly "62\.226\.128\.[0-9]+" JUMP "Spam" Received "62\.241\.151\.[0-9]+" JUMP "Spam" Host-From:envonly "62\.241\.151\.[0-9]+" JUMP "Spam" Received "62\.253\.162\.43" REJECT Host-From:envonly "62\.253\.162\.43" REJECT Received "63\.59\.182\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.59\.182\.[0-9]+" JUMP "Spam" Received "63\.93\.88\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.93\.88\.[0-9]+" JUMP "Spam" Received "63\.120\.161\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.120\.161\.[0-9]+" JUMP "Spam" Received "63\.126\.72\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.126\.72\.[0-9]+" JUMP "Spam" Received "63\.142\.129\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.142\.129\.[0-9]+" JUMP "Spam" Received "63\.170\.11\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.170\.11\.[0-9]+" JUMP "Spam" Received "63\.172\.198\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.172\.198\.[0-9]+" JUMP "Spam" Received "63\.189\.244\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.189\.244\.[0-9]+" JUMP "Spam" Received "63\.194\.246\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.194\.246\.[0-9]+" JUMP "Spam" Received "63\.195\.144\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.195\.144\.[0-9]+" JUMP "Spam" Received "63\.196\.4\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.196\.4\.[0-9]+" JUMP "Spam" Received "63\.209\.159\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.209\.159\.[0-9]+" JUMP "Spam" Received "63\.214\.212\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.214\.212\.[0-9]+" JUMP "Spam" Received "63\.218\.77\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.218\.77\.[0-9]+" JUMP "Spam" Received "63\.227\.39\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.227\.39\.[0-9]+" JUMP "Spam" Received "63\.233\.([01]|151)\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.233\.([01]|151)\.[0-9]+" JUMP "Spam" Received "63\.252\.1[0-9]+\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.252\.1[0-9]+\.[0-9]+" JUMP "Spam" Received "63\.255\.13[6789]\.[0-9]+" JUMP "Spam" Host-From:envonly "63\.255\.13[6789]\.[0-9]+" JUMP "Spam" Received "64\.0\.198\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.0\.198\.[0-9]+" JUMP "Spam" Received "64\.1\.192\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.1\.192\.[0-9]+" JUMP "Spam" Received "64\.2\.255\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.2\.255\.[0-9]+" JUMP "Spam" Received "64\.7\.200\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.7\.200\.[0-9]+" JUMP "Spam" Received "64\.12\.34\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.12\.34\.[0-9]+" JUMP "Spam" Received "64\.19\.30\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.19\.30\.[0-9]+" JUMP "Spam" Received "64\.23\.75\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.23\.75\.[0-9]+" JUMP "Spam" Received "64\.24\.138\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.24\.138\.[0-9]+" JUMP "Spam" Received "64\.38\.249\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.38\.249\.[0-9]+" JUMP "Spam" Received "64\.48\.60\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.48\.60\.[0-9]+" JUMP "Spam" Received "64\.57\.2[0-2]+\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.57\.2[0-2]+\.[0-9]+" JUMP "Spam" Received "64\.65\.228\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.65\.228\.[0-9]+" JUMP "Spam" Received "64\.68\.76\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.68\.76\.[0-9]+" JUMP "Spam" Received "64\.71\.140\.1[34][0-9]+" JUMP "Spam" Host-From:envonly "64\.71\.140\.1[34][0-9]+" JUMP "Spam" Received "64\.83\.29\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.83\.29\.[0-9]+" JUMP "Spam" Received "64\.84\.15\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.84\.15\.[0-9]+" JUMP "Spam" Received "64\.86\.192\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.86\.192\.[0-9]+" JUMP "Spam" Received "64\.108\.91\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.108\.91\.[0-9]+" JUMP "Spam" Received "64\.110\.29\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.110\.29\.[0-9]+" JUMP "Spam" # Received "64\.115\.0\.[0-9]+" JUMP "Spam" # Host-From:envonly "64\.115\.0\.[0-9]+" JUMP "Spam" Received "64\.125\.181\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.125\.181\.[0-9]+" JUMP "Spam" Received "64\.156\.136\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.156\.136\.[0-9]+" JUMP "Spam" Received "64\.159\.95\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.159\.95\.[0-9]+" JUMP "Spam" # 64.160.0 through 64.175.255 is PacBell Internet Received "64\.165\.105\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.165\.105\.[0-9]+" JUMP "Spam" Received "64\.165\.128\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.165\.128\.[0-9]+" JUMP "Spam" Received "64\.167\.73\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.167\.73\.[0-9]+" JUMP "Spam" # End PacBell Internet block Received "64\.224\.9\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.224\.9\.[0-9]+" JUMP "Spam" Received "64\.242\.41\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.242\.41\.[0-9]+" JUMP "Spam" Received "64\.246\.28\.[0-9]+" JUMP "Spam" Host-From:envonly "64\.246\.28\.[0-9]+" JUMP "Spam" Received "65\.28\.147\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.28\.147\.[0-9]+" JUMP "Spam" Received "65\.32\.113\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.32\.113\.[0-9]+" JUMP "Spam" Received "65\.34\.201\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.34\.201\.[0-9]+" JUMP "Spam" Received "65\.60\.10\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.60\.10\.[0-9]+" JUMP "Spam" Received "65\.60\.160\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.60\.160\.[0-9]+" JUMP "Spam" Received "65\.69\.200\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.69\.200\.[0-9]+" JUMP "Spam" Received "65\.83\.24\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.83\.24\.[0-9]+" JUMP "Spam" Received "65\.85\.92\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.85\.92\.[0-9]+" JUMP "Spam" Received "65\.90\.104\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.90\.104\.[0-9]+" JUMP "Spam" # 65.91.0 through 65.91.255 is Broadwing dialup Received "65\.91\.(65|188|104)\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.91\.(65|188|104)\.[0-9]+" JUMP "Spam" Received "65\.104\.15\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.104\.15\.[0-9]+" JUMP "Spam" Received "65\.104\.30\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.104\.30\.[0-9]+" JUMP "Spam" Received "65\.105\.189\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.105\.189\.[0-9]+" JUMP "Spam" Received "65\.118\.155\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.118\.155\.[0-9]+" JUMP "Spam" Received "65\.130\.48\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.130\.48\.[0-9]+" JUMP "Spam" Received "65\.139\.[0-9]+\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.139\.[0-9]+\.[0-9]+" JUMP "Spam" Received "65\.141\.123\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.141\.123\.[0-9]+" JUMP "Spam" Received "65\.165\.152\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.165\.152\.[0-9]+" JUMP "Spam" Received "65\.166\.232\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.166\.232\.[0-9]+" JUMP "Spam" Received "65\.172\.3\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.172\.3\.[0-9]+" JUMP "Spam" Received "65\.215\.91\.[0-9]+" JUMP "Spam" Host-From:envonly "65\.215\.91\.[0-9]+" JUMP "Spam" Received "66\.8\.45\.[0-9]+" JUMP "Spam" Host-From:envonly "66\.8\.45\.[0-9]+" JUMP "Spam" Received "66\.20\.179\.[0-9]+" JUMP "Spam" Host-From:envonly "66\.20\.179\.[0-9]+" JUMP "Spam" Received "66\.35\.37\.[0-9]+" JUMP "Spam" Host-From:envonly "66\.35\.37\.[0-9]+" JUMP "Spam" Received "66\.37\.154\.[0-9]+" JUMP "Spam" Host-From:envonly "66\.37\.154\.[0-9]+" JUMP "Spam" Received "66\.45\.40\.[0-9]+" JUMP "Spam" Host-From:envonly "66\.45\.40\.[0-9]+" JUMP "Spam" Received "66\.77\.22\.[0-9]+" JUMP "Spam" Host-From:envonly "66\.77\.22\.[0-9]+" JUMP "Spam" Received "66\.106\.28\.[0-9]+" JUMP "Spam" Host-From:envonly "66\.106\.28\.[0-9]+" JUMP "Spam" Received "66\.108\.113\.[0-9]+" JUMP "Spam" Host-From:envonly "66\.108\.113\.[0-9]+" JUMP "Spam" Received "66\.115\.190\.[0-9]+" JUMP "Spam" Host-From:envonly "66\.115\.190\.[0-9]+" JUMP "Spam" Received "66\.123\.105\.[0-9]+" JUMP "Spam" Host-From:envonly "66\.123\.105\.[0-9]+" JUMP "Spam" Received "66\.125\.12\.[0-9]+" JUMP "Spam" Host-From:envonly "66\.125\.12\.[0-9]+" JUMP "Spam" Received "66\.134\.56\.[0-9]+" JUMP "Spam" Host-From:envonly "66\.134\.56\.[0-9]+" JUMP "Spam" Received "66\.180\.247\.[0-9]+" JUMP "Spam" Host-From:envonly "66\.180\.247\.[0-9]+" JUMP "Spam" Received "66\.228\.138\.[0-9]+" JUMP "Spam" Host-From:envonly "66\.228\.138\.[0-9]+" JUMP "Spam" Received "66\.232\.239\.[0-9]+" JUMP "Spam" Host-From:envonly "66\.232\.239\.[0-9]+" JUMP "Spam" Received "67\.34\.1\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.34\.1\.[0-9]+" JUMP "Spam" Received "67\.34\.6\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.34\.6\.[0-9]+" JUMP "Spam" Received "67\.68\.224\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.68\.224\.[0-9]+" JUMP "Spam" Received "67\.89\.2\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.89\.2\.[0-9]+" JUMP "Spam" Received "67\.89\.77\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.89\.77\.[0-9]+" JUMP "Spam" Received "67\.104\.238\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.104\.238\.[0-9]+" JUMP "Spam" Received "67\.115\.80\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.115\.80\.[0-9]+" JUMP "Spam" Received "67\.160\.186\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.160\.186\.[0-9]+" JUMP "Spam" Received "67\.164\.103\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.164\.103\.[0-9]+" JUMP "Spam" Received "67\.193\.229\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.193\.229\.[0-9]+" JUMP "Spam" Received "67\.193\.243\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.193\.243\.[0-9]+" JUMP "Spam" # 67.192 through 67.247 is UUNet Received "67\.203\.184\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.203\.184\.[0-9]+" JUMP "Spam" Received "67\.217\.141\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.217\.141\.[0-9]+" JUMP "Spam" Received "67\.234\.2\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.234\.2\.[0-9]+" JUMP "Spam" Received "67\.234\.6\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.234\.6\.[0-9]+" JUMP "Spam" Received "67\.234\.77\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.234\.77\.[0-9]+" JUMP "Spam" Received "67\.234\.87\.[0-9]+" JUMP "Spam" Host-From:envonly "67\.234\.87\.[0-9]+" JUMP "Spam" # End UUNet block Received "68\.15\.22\.[0-9]+" JUMP "Spam" Host-From:envonly "68\.15\.22\.[0-9]+" JUMP "Spam" Received "68\.23\.92\.[0-9]+" JUMP "Spam" Host-From:envonly "68\.23\.92\.[0-9]+" JUMP "Spam" Received "68\.60\.185\.[0-9]+" JUMP "Spam" Host-From:envonly "68\.60\.185\.[0-9]+" JUMP "Spam" Received "68\.82\.16\.[0-9]+" JUMP "Spam" Host-From:envonly "68\.82\.16\.[0-9]+" JUMP "Spam" # 69.6.*.* has been the source of a whole crapload of spam. # They're dead to me now. Received "69\.6\.[0-9]+\.[0-9]+" JUMP "Spam" Host-From:envonly "69\.6\.[0-9]+\.[0-9]+" JUMP "Spam" Received "69\.24\.239\.[0-9]+" JUMP "Spam" Host-From:envonly "69\.24\.239\.[0-9]+" JUMP "Spam" Received "80\.35\.221\.[0-9]+" JUMP "Spam" Host-From:envonly "80\.35\.221\.[0-9]+" JUMP "Spam" Received "80\.207\.90\.[0-9]+" JUMP "Spam" Host-From:envonly "80\.207\.90\.[0-9]+" JUMP "Spam" Received "117\.77\.213\.[0-9]+" JUMP "Spam" Host-From:envonly "117\.77\.213\.[0-9]+" JUMP "Spam" Received "128\.121\.244\.[0-9]+" JUMP "Spam" Host-From:envonly "128\.121\.244\.[0-9]+" JUMP "Spam" Received "129\.37\.1(67|70)\.[0-9]+" JUMP "Spam" Host-From:envonly "129\.37\.1(67|70)\.[0-9]+" JUMP "Spam" Received "129\.67\.7\.[0-9]+" JUMP "Spam" Host-From:envonly "129\.67\.7\.[0-9]+" JUMP "Spam" Received "130\.94\.20\.[0-9]+" JUMP "Spam" Host-From:envonly "130\.94\.20\.[0-9]+" JUMP "Spam" # 134.219.16*.* has been the source of a whole crapload of virii. # They're dead to me now. Received "134\.219\.16[0-9]+\.[0-9]+" JUMP "Spam" Host-From:envonly "134\.219\.16[0-9]+\.[0-9]+" JUMP "Spam" Received "139\.130\.214\.[0-9]+" JUMP "Spam" Host-From:envonly "139\.130\.214\.[0-9]+" JUMP "Spam" Received "140\.136\.251\.[0-9]+" JUMP "Spam" Host-From:envonly "140\.136\.251\.[0-9]+" JUMP "Spam" Received "140\.186\.49\.[0-9]+" JUMP "Spam" Host-From:envonly "140\.186\.49\.[0-9]+" JUMP "Spam" Received "141\.154\.103\.[0-9]+" JUMP "Spam" Host-From:envonly "141\.154\.103\.[0-9]+" JUMP "Spam" Received "147\.46\.14\.[0-9]+" JUMP "Spam" Host-From:envonly "147\.46\.14\.[0-9]+" JUMP "Spam" Received "148\.74\.255\.[0-9]+" JUMP "Spam" Host-From:envonly "148\.74\.255\.[0-9]+" JUMP "Spam" Received "148\.235\.168\.[0-9]+" JUMP "Spam" Host-From:envonly "148\.235\.168\.[0-9]+" JUMP "Spam" Received "148\.245\.158\.[0-9]+" JUMP "Spam" Host-From:envonly "148\.245\.158\.[0-9]+" JUMP "Spam" Received "148\.246\.52\.[0-9]+" JUMP "Spam" Host-From:envonly "148\.246\.52\.[0-9]+" JUMP "Spam" # This subnet is a PPP dialup in Italy. A virus is sending mail from # it and going through a SMTP server also in Italy (smtp1.libero.it) # It's dead to me now. Received "151\.29\.[0-9]+\.[0-9]+" JUMP "Spam" Host-From:envonly "151\.29\.[0-9]+\.[0-9]+" JUMP "Spam" Received "151\.39\.241\.[0-9]+" JUMP "Spam" Host-From:envonly "151\.39\.241\.[0-9]+" JUMP "Spam" Received "161\.58\.176\.[0-9]+" JUMP "Spam" Host-From:envonly "161\.58\.176\.[0-9]+" JUMP "Spam" Received "164\.100\.101\.[0-9]+" JUMP "Spam" Host-From:envonly "164\.100\.101\.[0-9]+" JUMP "Spam" Received "167\.160\.186\.[0-9]+" JUMP "Spam" Host-From:envonly "167\.160\.186\.[0-9]+" JUMP "Spam" Received "168\.234\.145\.[0-9]+" JUMP "Spam" Host-From:envonly "168\.234\.145\.[0-9]+" JUMP "Spam" # Annoying little shit from the Pogues fora # Sadly, a false postive. Removing. # X-Originating-IP "172\.[12][014][123459]\.[0-9]+\.[0-9]+" REJECT Received "192\.104\.15\.[0-9]+" JUMP "Spam" Host-From:envonly "192\.104\.15\.[0-9]+" JUMP "Spam" # Mail server from blueworld.com. They spam. Received "192\.147\.161\.11" JUMP "Spam" Host-From:envonly "192\.147\.161\.11" JUMP "Spam" Received "192\.168\.30\.[0-9]+" JUMP "Spam" Host-From:envonly "192\.168\.30\.[0-9]+" JUMP "Spam" Received "193\.70\.192\.[0-9]+" JUMP "Spam" Host-From:envonly "193\.70\.192\.[0-9]+" JUMP "Spam" Received "193\.159\.182\.[0-9]+" JUMP "Spam" Host-From:envonly "193\.159\.182\.[0-9]+" JUMP "Spam" Received "193\.178\.241\.[0-9]+" JUMP "Spam" Host-From:envonly "193\.178\.241\.[0-9]+" JUMP "Spam" Received "193\.198\.128\.[0-9]+" JUMP "Spam" Host-From:envonly "193\.198\.128\.[0-9]+" JUMP "Spam" Received "194\.9\.184\.[0-9]+" JUMP "Spam" Host-From:envonly "194\.9\.184\.[0-9]+" JUMP "Spam" Received "194\.98\.23\.[0-9]+" JUMP "Spam" Host-From:envonly "194\.98\.23\.[0-9]+" JUMP "Spam" Received "194\.149\.76\.[0-9]+" JUMP "Spam" Host-From:envonly "194\.149\.76\.[0-9]+" JUMP "Spam" Received "194\.176\.58\.[0-9]+" JUMP "Spam" Host-From:envonly "194\.176\.58\.[0-9]+" JUMP "Spam" Received "194\.222\.195\.[0-9]+" JUMP "Spam" Host-From:envonly "194\.222\.195\.[0-9]+" JUMP "Spam" Received "194\.228\.[0-9]+" JUMP "Spam" Host-From:envonly "194\.228\.[0-9]+" JUMP "Spam" Received "194\.242\.43\.18[0-9]" JUMP "Spam" Host-From:envonly "194\.242\.43\.18[0-9]" JUMP "Spam" # 195.0 through 195.255 is from Italy. A lot of porn # spam seems to come from here. Received "195\.5\.47\.[0-9]+" JUMP "Spam" Host-From:envonly "195\.5\.47\.[0-9]+" JUMP "Spam" Received "195\.20\.224\.[0-9]+" JUMP "Spam" Host-From:envonly "195\.20\.224\.[0-9]+" JUMP "Spam" Received "195\.58\.189\.[0-9]+" JUMP "Spam" Host-From:envonly "195\.58\.189\.[0-9]+" JUMP "Spam" Received "195\.114\.230\.[0-9]+" JUMP "Spam" Host-From:envonly "195\.114\.230\.[0-9]+" JUMP "Spam" Received "195\.120\.117\.[0-9]+" JUMP "Spam" Host-From:envonly "195\.120\.117\.[0-9]+" JUMP "Spam" Received "195\.145\.209\.[0-9]+" JUMP "Spam" Host-From:envonly "195\.145\.209\.[0-9]+" JUMP "Spam" Received "195\.161\.74\.[0-9]+" JUMP "Spam" Host-From:envonly "195\.161\.74\.[0-9]+" JUMP "Spam" Received "195\.197\.147\.[0-9]+" JUMP "Spam" Host-From:envonly "195\.197\.147\.[0-9]+" JUMP "Spam" Received "195\.201\.91\.[0-9]+" JUMP "Spam" Host-From:envonly "195\.201\.91\.[0-9]+" JUMP "Spam" Received "195\.226\.249\.[0-9]+" JUMP "Spam" Host-From:envonly "195\.226\.249\.[0-9]+" JUMP "Spam" Received "195\.229\.51\.[0-9]+" JUMP "Spam" Host-From:envonly "195\.229\.51\.[0-9]+" JUMP "Spam" Received "195\.245\.179\.[0-9]+" JUMP "Spam" Host-From:envonly "195\.245\.179\.[0-9]+" JUMP "Spam" # End Italy block Received "196\.40\.3\.[0-9]+" JUMP "Spam" Host-From:envonly "196\.40\.3\.[0-9]+" JUMP "Spam" Received "196\.41\.204\.[0-9]+" JUMP "Spam" Host-From:envonly "196\.41\.204\.[0-9]+" JUMP "Spam" Received "199\.99\.178\.[0-9]+" JUMP "Spam" Host-From:envonly "199\.99\.178\.[0-9]+" JUMP "Spam" Received "199\.120\.99\.[0-9]+" JUMP "Spam" Host-From:envonly "199\.120\.99\.[0-9]+" JUMP "Spam" Received "199\.181\.77\.[0-9]+" JUMP "Spam" Host-From:envonly "199\.181\.77\.[0-9]+" JUMP "Spam" Received "199\.217\.212\.[0-9]+" JUMP "Spam" Host-From:envonly "199\.217\.212\.[0-9]+" JUMP "Spam" Received "199\.239\.79\.[0-9]+" JUMP "Spam" Host-From:envonly "199\.239\.79\.[0-9]+" JUMP "Spam" Received "200\.1\.13[2-9]\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.1\.13[2-9]\.[0-9]+" JUMP "Spam" Received "200\.4\.81\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.4\.81\.[0-9]+" JUMP "Spam" Received "200\.24\.192\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.24\.192\.[0-9]+" JUMP "Spam" Received "200\.37\.195\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.37\.195\.[0-9]+" JUMP "Spam" Received "200\.38\.16\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.38\.16\.[0-9]+" JUMP "Spam" Received "200\.40\.197\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.40\.197\.[0-9]+" JUMP "Spam" Received "200\.45\.23\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.45\.23\.[0-9]+" JUMP "Spam" Received "200\.48\.7\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.48\.7\.[0-9]+" JUMP "Spam" Received "200\.48\.52\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.48\.52\.[0-9]+" JUMP "Spam" Received "200\.48\.97\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.48\.97\.[0-9]+" JUMP "Spam" Received "200\.48\.214\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.48\.214\.[0-9]+" JUMP "Spam" Received "200\.49\.87\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.49\.87\.[0-9]+" JUMP "Spam" Received "200\.49\.97\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.49\.97\.[0-9]+" JUMP "Spam" Received "200\.60\.117\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.60\.117\.[0-9]+" JUMP "Spam" Received "200\.60\.214\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.60\.214\.[0-9]+" JUMP "Spam" Received "200\.60\.232\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.60\.232\.[0-9]+" JUMP "Spam" Received "200\.60\.246\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.60\.246\.[0-9]+" JUMP "Spam" Received "200\.63\.166\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.63\.166\.[0-9]+" JUMP "Spam" Received "200\.68\.61\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.68\.61\.[0-9]+" JUMP "Spam" Received "200\.75\.4\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.75\.4\.[0-9]+" JUMP "Spam" Received "200\.78\.1\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.78\.1\.[0-9]+" JUMP "Spam" Received "200\.80\.136\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.80\.136\.[0-9]+" JUMP "Spam" Received "200\.93\.35\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.93\.35\.[0-9]+" JUMP "Spam" Received "200\.141\.122\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.141\.122\.[0-9]+" JUMP "Spam" Received "200\.161\.189\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.161\.189\.[0-9]+" JUMP "Spam" Received "200\.177\.110\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.177\.110\.[0-9]+" JUMP "Spam" Received "200\.192\.6\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.192\.6\.[0-9]+" JUMP "Spam" Received "200\.206\.159\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.206\.159\.[0-9]+" JUMP "Spam" Received "200\.207\.122\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.207\.122\.[0-9]+" JUMP "Spam" Received "200\.210\.106\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.210\.106\.[0-9]+" JUMP "Spam" Received "200\.213\.185\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.213\.185\.[0-9]+" JUMP "Spam" Received "200\.218\.19\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.218\.19\.[0-9]+" JUMP "Spam" Received "200\.230\.34\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.230\.34\.[0-9]+" JUMP "Spam" Received "200\.254\.13\.[0-9]+" JUMP "Spam" Host-From:envonly "200\.254\.13\.[0-9]+" JUMP "Spam" # 202.0 through 209.255 is China. A favorite haunt of # spammers looking for open relays Received "202\.9\.136\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.9\.136\.[0-9]+" JUMP "Spam" Received "202\.78\.91\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.78\.91\.[0-9]+" JUMP "Spam" Received "202\.96\.137\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.96\.137\.[0-9]+" JUMP "Spam" Received "202\.100\.18\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.100\.18\.[0-9]+" JUMP "Spam" Received "202\.100\.57\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.100\.57\.[0-9]+" JUMP "Spam" Received "202\.100\.106\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.100\.106\.[0-9]+" JUMP "Spam" Received "202\.101\.10\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.101\.10\.[0-9]+" JUMP "Spam" Received "202\.103\.218\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.103\.218\.[0-9]+" JUMP "Spam" Received "202\.107\.196\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.107\.196\.[0-9]+" JUMP "Spam" Received "202\.108\.253\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.108\.253\.[0-9]+" JUMP "Spam" Received "202\.108\.255\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.108\.255\.[0-9]+" JUMP "Spam" Received "202\.109\.73\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.109\.73\.[0-9]+" JUMP "Spam" Received "202\.138\.145\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.138\.145\.[0-9]+" JUMP "Spam" Received "202\.145\.216\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.145\.216\.[0-9]+" JUMP "Spam" Received "202\.145\.204\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.145\.204\.[0-9]+" JUMP "Spam" Received "202\.164\.166\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.164\.166\.[0-9]+" JUMP "Spam" Received "202\.166\.23\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.166\.23\.[0-9]+" JUMP "Spam" Received "202\.181\.72\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.181\.72\.[0-9]+" JUMP "Spam" Received "202\.182\.5\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.182\.5\.[0-9]+" JUMP "Spam" Received "202\.190\.164\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.190\.164\.[0-9]+" JUMP "Spam" Received "202\.249\.50\.[0-9]+" JUMP "Spam" Host-From:envonly "202\.249\.50\.[0-9]+" JUMP "Spam" Received "203\.39\.3\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.39\.3\.[0-9]+" JUMP "Spam" Received "203\.42\.242\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.42\.242\.[0-9]+" JUMP "Spam" Received "203\.69\.88\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.69\.88\.[0-9]+" JUMP "Spam" Received "203\.69\.107\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.69\.107\.[0-9]+" JUMP "Spam" Received "203\.69\.200\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.69\.200\.[0-9]+" JUMP "Spam" Received "203\.92\.75\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.92\.75\.[0-9]+" JUMP "Spam" Received "203\.92\.128\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.92\.128\.[0-9]+" JUMP "Spam" Received "203\.93\.244\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.93\.244\.[0-9]+" JUMP "Spam" Received "203\.107\.244\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.107\.244\.[0-9]+" JUMP "Spam" Received "203\.107\.245\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.107\.245\.[0-9]+" JUMP "Spam" Received "203\.121\.30\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.121\.30\.[0-9]+" JUMP "Spam" Received "203\.146\.(7|116)\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.146\.(7|116)\.[0-9]+" JUMP "Spam" Received "203\.149\.159\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.149\.159\.[0-9]+" JUMP "Spam" Received "203\.162\.12\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.162\.12\.[0-9]+" JUMP "Spam" Received "203\.168\.16\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.168\.16\.[0-9]+" JUMP "Spam" Received "203\.186\.145\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.186\.145\.[0-9]+" JUMP "Spam" Received "203\.231\.237\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.231\.237\.[0-9]+" JUMP "Spam" Received "203\.254\.192\.[0-9]+" JUMP "Spam" Host-From:envonly "203\.254\.192\.[0-9]+" JUMP "Spam" Received "204\.1\.157\.[0-9]+" JUMP "Spam" Host-From:envonly "204\.1\.157\.[0-9]+" JUMP "Spam" Received "204\.31\.42\.[0-9]+" JUMP "Spam" Host-From:envonly "204\.31\.42\.[0-9]+" JUMP "Spam" Received "204\.32\.146\.[0-9]+" JUMP "Spam" Host-From:envonly "204\.32\.146\.[0-9]+" JUMP "Spam" Received "204\.42\.45\.[0-9]+" JUMP "Spam" Host-From:envonly "204\.42\.45\.[0-9]+" JUMP "Spam" Received "204\.211\.30\.[0-9]+" JUMP "Spam" Host-From:envonly "204\.211\.30\.[0-9]+" JUMP "Spam" Received "205\.177\.223\.[0-9]+" JUMP "Spam" Host-From:envonly "205\.177\.223\.[0-9]+" JUMP "Spam" Received "205\.205\.113\.[0-9]+" JUMP "Spam" Host-From:envonly "205\.205\.113\.[0-9]+" JUMP "Spam" Received "205\.208\.148\.[0-9]+" JUMP "Spam" Host-From:envonly "205\.208\.148\.[0-9]+" JUMP "Spam" Received "205\.244\.64\.[0-9]+" JUMP "Spam" Host-From:envonly "205\.244\.64\.[0-9]+" JUMP "Spam" Received "206\.58\.38\.[0-9]+" JUMP "Spam" Host-From:envonly "206\.58\.38\.[0-9]+" JUMP "Spam" Received "206\.117\.8\.[0-9]+" JUMP "Spam" Host-From:envonly "206\.117\.8\.[0-9]+" JUMP "Spam" Received "206\.128\.13\.[0-9]+" JUMP "Spam" Host-From:envonly "206\.128\.13\.[0-9]+" JUMP "Spam" Received "206\.136\.197\.[0-9]+" JUMP "Spam" Host-From:envonly "206\.136\.197\.[0-9]+" JUMP "Spam" Received "206\.168\.187\.[0-9]+" JUMP "Spam" Host-From:envonly "206\.168\.187\.[0-9]+" JUMP "Spam" Received "206\.173\.179\.[0-9]+" JUMP "Spam" Host-From:envonly "206\.173\.179\.[0-9]+" JUMP "Spam" Received "206\.180\.85\.[0-9]+" JUMP "Spam" Host-From:envonly "206\.180\.85\.[0-9]+" JUMP "Spam" Received "206\.222\.93\.[0-9]+" JUMP "Spam" Host-From:envonly "206\.222\.93\.[0-9]+" JUMP "Spam" # 207.14.96 through 207.14.111 is Time Warner Data Received "207\.14\.99\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.14\.99\.[0-9]+" JUMP "Spam" Received "207\.33\.16\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.33\.16\.[0-9]+" JUMP "Spam" Received "207\.44\.212\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.44\.212\.[0-9]+" JUMP "Spam" Received "207\.93\.2(25|44)\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.93\.2(25|44)\.[0-9]+" JUMP "Spam" Received "207\.100\.227\.1[0-9]+" JUMP "Spam" Host-From:envonly "207\.100\.227\.1[0-9]+" JUMP "Spam" Received "207\.121\.72\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.121\.72\.[0-9]+" JUMP "Spam" Received "207\.122\.162\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.122\.162\.[0-9]+" JUMP "Spam" Received "207\.127\.75\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.127\.75\.[0-9]+" JUMP "Spam" Received "207\.136\.1(65|84)\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.136\.1(65|84)\.[0-9]+" JUMP "Spam" Received "207\.158\.45\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.158\.45\.[0-9]+" JUMP "Spam" Received "207\.190\.94\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.190\.94\.[0-9]+" JUMP "Spam" Received "207\.192\.197\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.192\.197\.[0-9]+" JUMP "Spam" Received "207\.208\.150\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.208\.150\.[0-9]+" JUMP "Spam" Received "207\.218\.187\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.218\.187\.[0-9]+" JUMP "Spam" Received "207\.221\.78\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.221\.78\.[0-9]+" JUMP "Spam" Received "207\.246\.40\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.246\.40\.[0-9]+" JUMP "Spam" Received "207\.248\.48\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.248\.48\.[0-9]+" JUMP "Spam" Received "207\.249\.166\.[0-9]+" JUMP "Spam" Host-From:envonly "207\.249\.166\.[0-9]+" JUMP "Spam" Received "208\.4\.55\.[0-9]+" JUMP "Spam" Host-From:envonly "208\.4\.55\.[0-9]+" JUMP "Spam" Received "208\.144\.139\.[0-9]+" JUMP "Spam" Host-From:envonly "208\.144\.139\.[0-9]+" JUMP "Spam" Received "208\.144\.23[89]\.[0-9]+" JUMP "Spam" Host-From:envonly "208\.144\.23[89]\.[0-9]+" JUMP "Spam" Received "208\.171\.152\.[0-9]+" JUMP "Spam" Host-From:envonly "208\.171\.152\.[0-9]+" JUMP "Spam" Received "208\.177\.29\.[0-9]+" JUMP "Spam" Host-From:envonly "208\.177\.29\.[0-9]+" JUMP "Spam" Received "208\.178\.66\.[0-9]+" JUMP "Spam" Host-From:envonly "208\.178\.66\.[0-9]+" JUMP "Spam" Received "208\.181\.210\.[0-9]+" JUMP "Spam" Host-From:envonly "208\.181\.210\.[0-9]+" JUMP "Spam" Received "208\.189\.194\.[0-9]+" JUMP "Spam" Host-From:envonly "208\.189\.194\.[0-9]+" JUMP "Spam" Received "208\.216\.49\.[0-9]+" JUMP "Spam" Host-From:envonly "208\.216\.49\.[0-9]+" JUMP "Spam" Received "208\.234\.102\.[0-9]+" JUMP "Spam" Host-From:envonly "208\.234\.102\.[0-9]+" JUMP "Spam" Received "208\.247\.4\.[0-9]+" JUMP "Spam" Host-From:envonly "208\.247\.4\.[0-9]+" JUMP "Spam" Received "208\.253\.75\.[0-9]+" JUMP "Spam" Host-From:envonly "208\.253\.75\.[0-9]+" JUMP "Spam" Received "209\.0\.207\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.0\.207\.[0-9]+" JUMP "Spam" Received "209\.0\.211\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.0\.211\.[0-9]+" JUMP "Spam" Received "209\.9\.143\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.9\.143\.[0-9]+" JUMP "Spam" Received "209\.12\.159\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.12\.159\.[0-9]+" JUMP "Spam" # End second China block Received "209\.15\.59\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.15\.59\.[0-9]+" JUMP "Spam" Received "209\.31\.210\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.31\.210\.[0-9]+" JUMP "Spam" Received "209\.51\.9\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.51\.9\.[0-9]+" JUMP "Spam" Received "209\.58\.41\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.58\.41\.[0-9]+" JUMP "Spam" Received "209\.61\.184\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.61\.184\.[0-9]+" JUMP "Spam" Received "209\.77\.191\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.77\.191\.[0-9]+" JUMP "Spam" Received "209\.88\.14\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.88\.14\.[0-9]+" JUMP "Spam" Received "209\.92\.231\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.92\.231\.[0-9]+" JUMP "Spam" Received "209\.114\.157\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.114\.157\.[0-9]+" JUMP "Spam" # Email from gregATewol.com on 03/05/2002 tells me # that the account that sent spam from this subnet has # been terminated. Block is conditionally removed. # Received "209\.118\.106\.[0-9]+" JUMP "Spam" # Host-From:envonly "209\.118\.106\.[0-9]+" JUMP "Spam" Received "209\.136\.113\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.136\.113\.[0-9]+" JUMP "Spam" Received "209\.186\.140\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.186\.140\.[0-9]+" JUMP "Spam" Received "209\.216\.92\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.216\.92\.[0-9]+" JUMP "Spam" Received "209\.214\.93\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.214\.93\.[0-9]+" JUMP "Spam" Received "209\.245\.91\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.245\.91\.[0-9]+" JUMP "Spam" Received "209\.245\.92\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.245\.92\.[0-9]+" JUMP "Spam" Received "209\.248\.195\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.248\.195\.[0-9]+" JUMP "Spam" Received "209\.253\.224\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.253\.224\.[0-9]+" JUMP "Spam" Received "209\.253\.231\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.253\.231\.[0-9]+" JUMP "Spam" Received "209\.255\.8[01]\.[0-9]+" JUMP "Spam" Host-From:envonly "209\.255\.8[01]\.[0-9]+" JUMP "Spam" # 210.0 through 211.255 are Korea and China and seems # to be a favorite haunt of spammers looking for # relays # Too much from the 210.0.* domains. They're dead to me. Received "210\.0\.[0-9]+\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.0\.[0-9]+\.[0-9]+" JUMP "Spam" Received "210\.51\.21\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.51\.21\.[0-9]+" JUMP "Spam" Received "210\.52\.13\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.52\.13\.[0-9]+" JUMP "Spam" Received "210\.52\.88\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.52\.88\.[0-9]+" JUMP "Spam" Received "210\.52\.252\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.52\.252\.[0-9]+" JUMP "Spam" Received "210\.54\.151\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.54\.151\.[0-9]+" JUMP "Spam" Received "210\.59\.146\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.59\.146\.[0-9]+" JUMP "Spam" Received "210\.64\.24\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.64\.24\.[0-9]+" JUMP "Spam" Received "210\.71\.208\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.71\.208\.[0-9]+" JUMP "Spam" Received "210\.73\.88\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.73\.88\.[0-9]+" JUMP "Spam" Received "210\.74\.245\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.74\.245\.[0-9]+" JUMP "Spam" Received "210\.74\.251\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.74\.251\.[0-9]+" JUMP "Spam" Received "210\.83\.126\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.83\.126\.[0-9]+" JUMP "Spam" Received "210\.90\.1(04|35)\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.90\.1(04|35)\.[0-9]+" JUMP "Spam" Received "210\.91\.26\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.91\.26\.[0-9]+" JUMP "Spam" Received "210\.95\.1[0-9]+" JUMP "Spam" Host-From:envonly "210\.95\.1[0-9]+" JUMP "Spam" Received "210\.96\.31\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.96\.31\.[0-9]+" JUMP "Spam" Received "210\.96\.71\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.96\.71\.[0-9]+" JUMP "Spam" Received "210\.97\.(42|121)\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.97\.(42|121)\.[0-9]+" JUMP "Spam" Received "210\.99\.108\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.99\.108\.[0-9]+" JUMP "Spam" Received "210\.99\.176\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.99\.176\.[0-9]+" JUMP "Spam" Received "210\.100\.171\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.100\.171\.[0-9]+" JUMP "Spam" Received "210\.101\.136\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.101\.136\.[0-9]+" JUMP "Spam" # Way too much spam has been coming from this # particular set of subnets. They're dead to me now. Received "210\.104\.[0-9]+" JUMP "Spam" Host-From:envonly "210\.104\.[0-9]+" JUMP "Spam" # Received "210\.107\.253\.[0-9]" JUMP "Spam" Host-From:envonly "210\.107\.253\.[0-9]" JUMP "Spam" Received "210\.111\.247\.[0-9]" JUMP "Spam" Host-From:envonly "210\.111\.247\.[0-9]" JUMP "Spam" Received "210\.115\.117\.[0-9]" JUMP "Spam" Host-From:envonly "210\.115\.117\.[0-9]" JUMP "Spam" Received "210\.122\.205\.[0-9]" JUMP "Spam" Host-From:envonly "210\.122\.205\.[0-9]" JUMP "Spam" Received "210\.127\.235\.[0-9]" JUMP "Spam" Host-From:envonly "210\.127\.235\.[0-9]" JUMP "Spam" Received "210\.141\.1(43|28)\.[0-9]" JUMP "Spam" Host-From:envonly "210\.141\.1(43|29)\.[0-9]" JUMP "Spam" Received "210\.168\.255\.[0-9]" JUMP "Spam" Host-From:envonly "210\.168\.255\.[0-9]" JUMP "Spam" Received "210\.17[67]\.50\.[0-9]" JUMP "Spam" Host-From:envonly "210\.17[67]\.50\.[0-9]" JUMP "Spam" Received "210\.178\.97\.[0-9]" JUMP "Spam" Host-From:envonly "210\.178\.97\.[0-9]" JUMP "Spam" Received "210\.179\.103\.[0-9]" JUMP "Spam" Host-From:envonly "210\.179\.103\.[0-9]" JUMP "Spam" Received "210\.200\.225\.[0-9]" JUMP "Spam" Host-From:envonly "210\.200\.225\.[0-9]" JUMP "Spam" Received "210\.201\.254\.[0-9]" JUMP "Spam" Host-From:envonly "210\.201\.254\.[0-9]" JUMP "Spam" # 210.202.* is the source (or pass-through) of way too much spam. # Blocking the whole damn thing and watching for false postives. Received "210\.202\.[0-9]+\.[0-9]" JUMP "Spam" Host-From:envonly "210\.202\.[0-9]+\.[0-9]" JUMP "Spam" Received "210\.212\.1\.[0-9]" JUMP "Spam" Host-From:envonly "210\.212\.1\.[0-9]" JUMP "Spam" Received "210\.221\.1(2)*0\.[0-9]" JUMP "Spam" Host-From:envonly "210\.221\.1(2)*0\.[0-9]" JUMP "Spam" Received "210\.226\.80\.[0-9]" JUMP "Spam" Host-From:envonly "210\.226\.80\.[0-9]" JUMP "Spam" Received "210\.248\.118\.[0-9]" JUMP "Spam" Host-From:envonly "210\.248\.118\.[0-9]" JUMP "Spam" Received "210\.254\.161\.[0-9]" JUMP "Spam" Host-From:envonly "210\.254\.161\.[0-9]" JUMP "Spam" Received "211\.20\.183\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.20\.183\.[0-9]+" JUMP "Spam" Received "211\.21\.(61|53)\.[0-9]" JUMP "Spam" Host-From:envonly "211\.21\.(61|53)\.[0-9]" JUMP "Spam" Received "211\.23\.60\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.23\.60\.[0-9]+" JUMP "Spam" Received "211\.23\.184\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.23\.184\.[0-9]+" JUMP "Spam" Received "211\.34\.78\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.34\.78\.[0-9]+" JUMP "Spam" Received "211\.41\.185\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.41\.185\.[0-9]+" JUMP "Spam" Received "211\.43\.249\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.43\.249\.[0-9]+" JUMP "Spam" Received "211\.45\.214\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.45\.214\.[0-9]+" JUMP "Spam" Received "211\.45\.222\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.45\.222\.[0-9]+" JUMP "Spam" Received "211\.46\.157\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.46\.157\.[0-9]+" JUMP "Spam" Received "211\.55\.43\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.55\.43\.[0-9]+" JUMP "Spam" Received "211\.57\.77\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.57\.77\.[0-9]+" JUMP "Spam" Received "211\.57\.204\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.57\.204\.[0-9]+" JUMP "Spam" Received "211\.62\.65\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.62\.65\.[0-9]+" JUMP "Spam" Received "211\.63\.185\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.63\.185\.[0-9]+" JUMP "Spam" Received "211\.84\.128\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.84\.128\.[0-9]+" JUMP "Spam" Received "211\.92\.[0-9]+\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.92\.[0-9]+\.[0-9]+" JUMP "Spam" Received "211\.93\.35\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.93\.35\.[0-9]+" JUMP "Spam" Received "211\.99\.175\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.99\.175\.[0-9]+" JUMP "Spam" Received "211\.107\.65\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.107\.65\.[0-9]+" JUMP "Spam" # Way too much spam has been coming from this # particular set of subnets. They're dead to me now. Received "211\.114\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.114\.[0-9]+" JUMP "Spam" # Received "211\.136\.104\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.136\.104\.[0-9]+" JUMP "Spam" Received "211\.144\.168\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.144\.168\.[0-9]+" JUMP "Spam" Received "211\.148\.193\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.148\.193\.[0-9]+" JUMP "Spam" Received "211\.161\.192\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.161\.192\.[0-9]+" JUMP "Spam" Received "211\.184\.106\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.184\.106\.[0-9]+" JUMP "Spam" Received "211\.189\.18\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.189\.18\.[0-9]+" JUMP "Spam" Received "211\.192\.139\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.192\.139\.[0-9]+" JUMP "Spam" Received "211\.196\.96\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.196\.96\.[0-9]+" JUMP "Spam" Received "211\.197\.227\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.197\.227\.[0-9]+" JUMP "Spam" Received "211\.198\.160\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.198\.160\.[0-9]+" JUMP "Spam" Received "211\.215\.246\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.215\.246\.[0-9]+" JUMP "Spam" Received "211\.219\.(49|90)\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.219\.(49|90)\.[0-9]+" JUMP "Spam" Received "211\.225\.20\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.225\.20\.[0-9]+" JUMP "Spam" Received "211\.239\.160\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.239\.160\.[0-9]+" JUMP "Spam" Received "211\.248\.213\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.248\.213\.[0-9]+" JUMP "Spam" # Way too much spam has been coming from this # particular set of subnets. They're dead to me now. Received "211\.25[01]\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.25[01]\.[0-9]+" JUMP "Spam" # Received "211\.252\.(5|19)\.[0-9]+" JUMP "Spam" Host-From:envonly "211\.252\.(5|19)\.[0-9]+" JUMP "Spam" # End Korea block Received "212\.0\.216\.[0-9]+" JUMP "Spam" Host-From:envonly "212\.0\.216\.[0-9]+" JUMP "Spam" Received "212\.12\.240\.[0-9]+" JUMP "Spam" Host-From:envonly "212\.12\.240\.[0-9]+" JUMP "Spam" Received "212\.65\.19(3|4)\.[0-9]+" JUMP "Spam" Host-From:envonly "212\.65\.19(3|4)\.[0-9]+" JUMP "Spam" Received "212\.67\.110\.[0-9]+" JUMP "Spam" Host-From:envonly "212\.67\.110\.[0-9]+" JUMP "Spam" Received "212\.90\.213\.[0-9]+" JUMP "Spam" Host-From:envonly "212\.90\.213\.[0-9]+" JUMP "Spam" Received "212\.100\.224\.[0-9]+" JUMP "Spam" Host-From:envonly "212\.100\.224\.[0-9]+" JUMP "Spam" Received "212\.122\.6\.[0-9]+" JUMP "Spam" Host-From:envonly "212\.122\.6\.[0-9]+" JUMP "Spam" Received "212\.131\.31\.[0-9]+" JUMP "Spam" Host-From:envonly "212\.131\.31\.[0-9]+" JUMP "Spam" Received "212\.217\.49\.[0-9]+" JUMP "Spam" Host-From:envonly "212\.217\.49\.[0-9]+" JUMP "Spam" Received "212\.243\.26\.[0-9]+" JUMP "Spam" Host-From:envonly "212\.243\.26\.[0-9]+" JUMP "Spam" Received "212\.247\.57\.[0-9]+" JUMP "Spam" Host-From:envonly "212\.247\.57\.[0-9]+" JUMP "Spam" Received "213\.10\.28\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.10\.28\.[0-9]+" JUMP "Spam" Received "213\.67\.144\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.67\.144\.[0-9]+" JUMP "Spam" Received "213\.70\.100\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.70\.100\.[0-9]+" JUMP "Spam" Received "213\.74\.41\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.74\.41\.[0-9]+" JUMP "Spam" Received "213\.76\.134\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.76\.134\.[0-9]+" JUMP "Spam" Received "213\.76\.23[01]\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.76\.23[01]\.[0-9]+" JUMP "Spam" Received "213\.77\.142\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.77\.142\.[0-9]+" JUMP "Spam" Received "213\.96\.132\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.96\.132\.[0-9]+" JUMP "Spam" Received "213\.96\.180\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.96\.180\.[0-9]+" JUMP "Spam" Received "213\.98\.53\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.98\.53\.[0-9]+" JUMP "Spam" Received "213\.98\.118\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.98\.118\.[0-9]+" JUMP "Spam" Received "213\.120\.56\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.120\.56\.[0-9]+" JUMP "Spam" Received "213\.131\.70\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.131\.70\.[0-9]+" JUMP "Spam" Received "213\.154\.75\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.154\.75\.[0-9]+" JUMP "Spam" Received "213\.190\.46\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.190\.46\.[0-9]+" JUMP "Spam" Received "213\.236\.176\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.236\.176\.[0-9]+" JUMP "Spam" Received "213\.255\.128\.[0-9]+" JUMP "Spam" Host-From:envonly "213\.255\.128\.[0-9]+" JUMP "Spam" Received "216\.6\.90\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.6\.90\.[0-9]+" JUMP "Spam" Received "216\.6\.91\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.6\.91\.[0-9]+" JUMP "Spam" Received "216\.11\.79\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.11\.79\.[0-9]+" JUMP "Spam" Received "216\.15\.189\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.15\.189\.[0-9]+" JUMP "Spam" Received "216\.15\.211\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.15\.211\.[0-9]+" JUMP "Spam" Received "216\.20\.113\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.20\.113\.[0-9]+" JUMP "Spam" Received "216\.25\.72\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.25\.72\.[0-9]+" JUMP "Spam" Received "216\.28\.73\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.28\.73\.[0-9]+" JUMP "Spam" Received "216\.44\.72\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.44\.72\.[0-9]+" JUMP "Spam" Received "216\.54\.8\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.54\.8\.[0-9]+" JUMP "Spam" Received "216\.71\.84\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.71\.84\.[0-9]+" JUMP "Spam" Received "216\.72\.167\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.72\.167\.[0-9]+" JUMP "Spam" Received "216\.78\.96\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.78\.96\.[0-9]+" JUMP "Spam" Received "216\.95\.201\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.95\.201\.[0-9]+" JUMP "Spam" Received "216\.103\.188\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.103\.188\.[0-9]+" JUMP "Spam" Received "216\.122\.3\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.122\.3\.[0-9]+" JUMP "Spam" Received "216\.126\.162\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.126\.162\.[0-9]+" JUMP "Spam" Received "216\.129\.(11|201)\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.129\.(11|201)\.[0-9]+" JUMP "Spam" Received "216\.143\.32\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.143\.32\.[0-9]+" JUMP "Spam" Received "216\.144\.160\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.144\.160\.[0-9]+" JUMP "Spam" Received "216\.171\.16\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.171\.16\.[0-9]+" JUMP "Spam" Received "216\.173\.225\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.173\.225\.[0-9]+" JUMP "Spam" Received "216\.176\.54\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.176\.54\.[0-9]+" JUMP "Spam" Received "216\.187\.106\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.187\.106\.[0-9]+" JUMP "Spam" Received "216\.203\.199\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.203\.199\.[0-9]+" JUMP "Spam" Received "216\.231\.22\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.231\.22\.[0-9]+" JUMP "Spam" Received "216\.232\.172\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.232\.172\.[0-9]+" JUMP "Spam" Received "216\.232\.228\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.232\.228\.[0-9]+" JUMP "Spam" Received "216\.242\.(65|154)\.[0-9]+" JUMP "Spam" Host-From:envonly "216\.242\.(65|154)\.[0-9]+" JUMP "Spam" Received "217\.0\.223\.[0-9]+" JUMP "Spam" Host-From:envonly "217\.0\.223\.[0-9]+" JUMP "Spam" Received "217\.56\.69\.[0-9]+" JUMP "Spam" Host-From:envonly "217\.56\.69\.[0-9]+" JUMP "Spam" Received "217\.57\.9\.[0-9]+" JUMP "Spam" Host-From:envonly "217\.57\.9\.[0-9]+" JUMP "Spam" Received "217\.58\.184\.[0-9]+" JUMP "Spam" Host-From:envonly "217\.58\.184\.[0-9]+" JUMP "Spam" Received "217\.81\.93\.[0-9]+" JUMP "Spam" Host-From:envonly "217\.81\.93\.[0-9]+" JUMP "Spam" Received "217\.96\.28\.[0-9]+" JUMP "Spam" Host-From:envonly "217\.96\.28\.[0-9]+" JUMP "Spam" Received "217\.160\.72\.[0-9]+" JUMP "Spam" Host-From:envonly "217\.160\.72\.[0-9]+" JUMP "Spam" Received "217\.192\.142\.[0-9]+" JUMP "Spam" Host-From:envonly "217\.192\.142\.[0-9]+" JUMP "Spam" Received "217\.218\.193\.[0-9]+" JUMP "Spam" Host-From:envonly "217\.218\.193\.[0-9]+" JUMP "Spam" Received "218\.20\.74\.[0-9]+" JUMP "Spam" Host-From:envonly "218\.20\.74\.[0-9]+" JUMP "Spam" Received "218\.37\.38\.[0-9]+" JUMP "Spam" Host-From:envonly "218\.37\.38\.[0-9]+" JUMP "Spam" Received "218\.49\.245\.[0-9]+" JUMP "Spam" Host-From:envonly "218\.49\.245\.[0-9]+" JUMP "Spam" Received "218\.55\.101\.[0-9]+" JUMP "Spam" Host-From:envonly "218\.55\.101\.[0-9]+" JUMP "Spam" Received "218\.79\.65\.[0-9]+" JUMP "Spam" Host-From:envonly "218\.79\.65\.[0-9]+" JUMP "Spam" Received "218\.150\.217\.[0-9]+" JUMP "Spam" Host-From:envonly "218\.150\.217\.[0-9]+" JUMP "Spam" Received "218\.242\.255\.[0-9]+" JUMP "Spam" Host-From:envonly "218\.242\.255\.[0-9]+" JUMP "Spam" Received "218\.252\.218\.[0-9]+" JUMP "Spam" Host-From:envonly "218\.252\.218\.[0-9]+" JUMP "Spam" Received "219\.240\.31\.[0-9]+" JUMP "Spam" Host-From:envonly "219\.240\.31\.[0-9]+" JUMP "Spam" Host-From:envonly ".*" JUMP "received_dmn" # This is a set of domains that have shown themselves to either be # sources for spam, or have open relays that allows spammers to # obfuscate the origin of their mail. Where possible the domain owners # have been notified of their inclusion in this list. :received_dmn Received "ioffersdirect\.com" JUMP "Spam" # Some dumb-ass mis-configured spam engine is always including {%DOMAIN_FROM} and {%MAIL_TO} into a received header Received "(DOMAIN_FROM|MAIL_TO)" JUMP "Spam" # Some dumb-ass spam engine is always setting the Return-Path to anonymous@{domain} Return-Path "anonymous@" JUMP "Spam" # Some dumb-ass has left their spam engine being invoked by UID 510 for each message Received "invoked by uid 510" JUMP "Spam" Return-Path "chtah\.com" JUMP "Spam" Return-Path "macd999\.com" JUMP "Spam" Received "redlightmail\.com" JUMP "Spam" Received "freshstudios\.(net|com)" JUMP "Spam" Received "(adsl|sdi)\.tpnet\.pl" JUMP "Spam" Received "vie\.surfer\.at" JUMP "Spam" Received "t-net\.net\.ve" JUMP "Spam" Received "videotron\.ca" JUMP "Spam" Received "chello\.[np]l" JUMP "Spam" Return-Path "web-superstore\.com" JUMP "Spam" Received "web-superstore\.com" JUMP "Spam" Return-Path "edirectadvertising\.com" JUMP "Spam" Received "edirectadvertising\.com" JUMP "Spam" Return-Path "ew01\.com" JUMP "Spam" Received "ew01\.com" JUMP "Spam" Received "tigeronline\.com" JUMP "Spam" Received "markets.com" JUMP "Spam" Received "discountdeals.net" JUMP "Spam" Received "interbusiness\.it" JUMP "Spam" Return-Path "artmarket\.com" JUMP "Spam" Return-Path "seed\.net\.tw" JUMP "Spam" Message-ID "seed\.net\.tw" JUMP "Spam" Received "seed\.net\.tw" JUMP "Spam" Received "targetedemailsolutions\.com" JUMP "Spam" Received "espotsdirect\.com" JUMP "Spam" Received "innovativeinsite\.net" JUMP "Spam" Received "epromodirect\.com" JUMP "Spam" Received "nuways\.com" JUMP "Spam" Received "blueworld\.com" JUMP "Spam" Received "tobaccoteds\.com" JUMP "Spam" Received "jumbomailer\.com" JUMP "Spam" Received "xtn\.net" JUMP "Spam" Received "emediamusic\.org" JUMP "Spam" Received "emediamusic\.com" JUMP "Spam" Received "optmailing\.com" JUMP "Spam" Received "mb00\.net" JUMP "Spam" Received "freeoptinfo\.com" JUMP "Spam" Received "hostcn\.net" JUMP "Spam" Received "toyaku\.ac\.jp" JUMP "Spam" Received "guru-email\.com" JUMP "Spam" Received "cbi\.pt" JUMP "Spam" Received "ethome\.net\.tw" JUMP "Spam" Received "heerim\.co\.kr" JUMP "Spam" Received "bzznet\.net" JUMP "Spam" Received "directbizpromo\.com" JUMP "Spam" Received "japungu\.com\.br" JUMP "Spam" Reply-To "mediaone\.net" JUMP "Spam" Received "ecommerce-tech\.com" JUMP "Spam" Received "dongshin-eng\.co\.kr" JUMP "Spam" Received "hinet\.net" JUMP "Spam" Recevied "vitalberry\.com" JUMP "Spam" Received "sidanaonline\.com" JUMP "Spam" Received "osoon\.com" JUMP "Spam" Received "mynb\.com\.tw" JUMP "Spam" Received "giga\.net\.tw" JUMP "Spam" Received "jce\.ne\.jp" JUMP "Spam" Received "atarc\.co\.jp" JUMP "Spam" Received "dipucuenca\.es" JUMP "Spam" Received "murdock\.orbex\.net" JUMP "Spam" Received "mycrony\.com" JUMP "Spam" Received "ny5030\.east\.verizon\.net" JUMP "Spam" Received "offertime\.com" JUMP "Spam" Received "caseng\.co\.kr" JUMP "Spam" Received "hbpc\.com\.cn" JUMP "Spam" Received "dns\.leasci\.com\.cn" JUMP "Spam" Received "proxyserv\.ebret\.toscana\.it" JUMP "Spam" Received "biology\.yonsei\.ac\.kr" JUMP "Spam" Received "japan-systems\.co\.jp" JUMP "Spam" Received "kitkor\.co\.kr" JUMP "Spam" Received "emailbucks\.com" JUMP "Spam" Received "monsoon\.berkstech\.com" JUMP "Spam" Received "seed\.net\.tw" JUMP "Spam" Received "amerimedcun.\com" JUMP "Spam" Received "my-ehost\.com" JUMP "Spam" Received "tengaz-mail\.com" JUMP "Spam" Received "processrequest\.com" JUMP "Spam" Received "fuc-king\.com" JUMP "Spam" Received "pentasoft\.co\.kr" JUMP "Spam" Received "udechile\.cl" JUMP "Spam" Received "anyang-gch\.hs\.kr" JUMP "Spam" Received "server\.istream\.co\.kr" JUMP "Spam" Received "bvv(bnv)+b" JUMP "Spam" Received "monsterhut\.com" JUMP "Spam" Host-From:envonly ".*" JUMP "char_set" # I have little reason to allow foreign charsets. For now I'll forward # them all to Google. Once I determine that no bad things are # happening as a result I'll just start burying them. :char_set From "^=\?koi8-r" JUMP "gmail" From "^=\?windows-1251" JUMP "gmail" From "^=\?GB2312" JUMP "gmail" From "^=\?Big5" JUMP "gmail" From "^=\?ISO-2022-JP" JUMP "gmail" From "^=\?windows-1255" REJECT "This server believes that your message is Unsolicited Bulk Email. If this is in error please re-send the message with a Latin-1 character encoding of the From line." From "[ÅÄ¥é]" REJECT "This message was rejected due to badly encoded content. Check your mail program settings and try re-sending the message." Subject "^=\?koi8-r" JUMP "gmail" Subject "^=\?windows-1251" JUMP "gmail" Subject "^=\?GB2312" JUMP "gmail" Subject "^=\?Big5" JUMP "gmail" Subject "^=\?ISO-2022-JP" JUMP "gmail" Subject "^=\?windows-1255" REJECT "This server believes that your message is Unsolicited Bulk Email. If this is in error please re-send the message with a Latin-1 character encoding of the Subject line." Subject "[ÅÄ¥é]" REJECT "This message was rejected due to badly encoded content. Check your mail program settings and try re-sending the message." Content-type "koi8-r" JUMP "gmail" Content-type "windows-1251" JUMP "gmail" Content-type "GB2312" JUMP "gmail" Content-type "Big5" JUMP "gmail" Content-type "ISO-2022-JP" JUMP "gmail" Content-type "windows-1255" REJECT "This server believes that your message is Unsolicited Bulk Email. If this is in error please re-send the message with a Latin-1 character encoding." Host-From:envonly ".*" JUMP "sender" # Spammers will often try to legitimize the look of their spam by # giving false "From" data that will somehow appeal to their target # audience. This makes it somewhat possible to kill a great deal of # spam by watching for certain words or phrases in the "From" header. :sender From ".*@optonline\.com" JUMP "Spam" From "(NAME|MAIL)_FROM" JUMP "Spam" # Assholes sending much Russian spam with large animated GIFs From "anastomotic@aha.ru" JUMP "Spam" From "Jennifer A\. Clark" JUMP "Spam" From "csarkis@almullagroup" REJECT From "centralreliability\.com" JUMP "Spam" From "OfferFinder" JUMP "Spam" From "centrapoint\.com" JUMP "Spam" From "aa[0-9]+\.com" JUMP "Spam" From "11mail\.com" JUMP "Spam" From "ueml.*\.com" JUMP "Spam" From "classoffers\.com" JUMP "Spam" From "[0-9]+\.com" JUMP "Spam" From "myeasyloans\.com" JUMP "Spam" From "premiumdiscounts\.com" JUMP "Spam" From "wereallycare(aboutyou|really|wedo)\.net" JUMP "Spam" From "lesmcm@telus" JUMP "Spam" From "gercolgan@eircom" JUMP "Spam" From "clancy@dcidenver" JUMP "Spam" From "p\.mouyios@sasktel" JUMP "Spam" From "mba student 03" JUMP "Spam" From "chunksaah\.com" JUMP "Spam" From "Johan Wesemann" JUMP "Spam" From "texstar2" JUMP "Spam" From "thecareernews.com" JUMP "Spam" From "petedge\.com" JUMP "Spam" From "ghostk\.com" JUMP "Spam" Reply-To "mm459\.com" JUMP "Spam" From "^Microsoft" JUMP "Microsoft" From "unbeelievableoffers\.net" JUMP "Spam" From "big@boss\.com" REJECT "Virus virus virus." From "benting" REJECT "Virus virus virus." From "de_kerel" REJECT "Virus virus virus." From "Richard Hoff" JUMP "Spam" From "Important Message!" JUMP "Spam" From "annette(gold|bond|harding|silver)" JUMP "Spam" From "consumerdirect" JUMP "Spam" From "anlin[0-9]*@ms[0-9]*.url.com.tw" JUMP "Spam" From "nuhe@xinhuanet.com" JUMP "Spam" From "s\.roberts437" REJECT X-Apparently-From "Felgeo1@aol\.com" REJECT "Virus virus virus." From "fiestacasinos\.com" JUMP "Spam" From "blondi6325" JUMP "Spam" From "brad_4@downcity" JUMP "Spam" From "xinga\.com\.cn" JUMP "Spam" From "(Stoner|Cheech|Garcia)" JUMP "Spam" From "eadultdirect\.com" JUMP "Spam" From "trafficmagnet\.net" JUMP "Spam" From "ProcessRequest\.com" JUMP "Spam" From "aitaxi\.org" JUMP "Spam" From "interlinksyscorp\.com" JUMP "Spam" From "carsmart\.co\.kr" JUMP "Spam" From "hyim\.com" JUMP "Spam" From "stoen\.net" JUMP "Spam" From "sportfabe\.com" JUMP "Spam" From "pm0\.net" JUMP "Spam" From "manfane\.com" JUMP "Spam" From "seekercente\.net" JUMP "Spam" From "LeadsUnlimited" JUMP "Spam" From "IRS.*Trial" JUMP "Spam" From "Buisness.*Promotions" JUMP "Spam" From "partner_announcements" JUMP "Spam" Reply-To "mediaone\.net" JUMP "Spam" From "sexy" JUMP "Spam" From "specialoffers" JUMP "Spam" From "xorbix\.com" JUMP "Spam" From "4cats\.com" JUMP "Spam" From "supremetraffic" JUMP "Spam" From "Men.*Women" JUMP "Spam" From "homeloans[0-9]+" JUMP "Spam" From "ironing-board-covers\.co\.uk" JUMP "Spam" From "free.*offer" JUMP "Spam" From "gozilla\.com" JUMP "Spam" From "force.*traffic" JUMP "Spam" From "nude" JUMP "Spam" From "(free|copy_)dvd" JUMP "Spam" From "btamail\.net" JUMP "Spam" From "gangwo\.com\.tw" JUMP "Spam" From "righttolife\.com" JUMP "Spam" From "amacway@ntlworld\.com" JUMP "Spam" From "dvdburner" JUMP "Spam" From "jobseekernews\.com" JUMP "Spam" From "pussy.*" JUMP "Spam" From "getyourgoods\.com" JUMP "Spam" From "<[0-9]+[a-z]+@hotmail\.com" JUMP "Spam" From "pcdj\.com" JUMP "Spam" From "webpreviews\.net" JUMP "Spam" From "domainsforu\.net" JUMP "Spam" From "officedepot\.rsc.*com" JUMP "Spam" From "network60\.com" JUMP "Spam" From "bestbuy\.com" JUMP "Spam" From "usncc\.com" JUMP "Spam" From "163\.com" JUMP "Spam" From "netflip\.com" JUMP "Spam" From "emailpack\.net" JUMP "Spam" From "inside-offers\.com" JUMP "Spam" From "responsebase\.com" JUMP "Spam" From "doody\.com" JUMP "Spam" From "online-messenger\.net" JUMP "Spam" From "continental\.com" JUMP "Spam" From "sci3.com" JUMP "Spam" From "mypoints\.com" JUMP "Spam" From "quicken\.com" JUMP "Spam" From "4at1\.net" JUMP "Spam" From "real-net\.net" JUMP "Spam" From "responsebase\.com" JUMP "Spam" From "mycda\.com" JUMP "Spam" From "\.pm0\.net" JUMP "Spam" From "em5000\.com" JUMP "Spam" From "customoffers\.com" JUMP "Spam" From "play4keeps\.com" JUMP "Spam" From "vmadmin\.com" JUMP "Spam" From "virtumundo\.com" JUMP "Spam" From "teachco.com" JUMP "Spam" From "would.*@yahoo\.com" JUMP "Spam" From "zones.com" JUMP "Spam" From "sex.*mail" JUMP "Spam" From "Email.*Promotions" JUMP "Spam" From "Tcicasino\.com" JUMP "Spam" From "quickleads\.com" JUMP "Spam" From "top-10\.com" JUMP "Spam" From "extremezone\.com" JUMP "Spam" From "keggler\.com" JUMP "Spam" From "letuknow\.com" JUMP "Spam" From "classmates\.com" JUMP "Spam" From "money[a-z]*[0-9]*@" JUMP "Spam" From "Search-Magic" JUMP "Spam" From "hotmil\.com" JUMP "Spam" From "privacy\.nu" JUMP "Spam" From "delivere\.com" JUMP "Spam" From "anotheruniverse\.(net|com)" JUMP "Spam" From "tm(re)*direct\.com" JUMP "Spam" From "surfree\.com" JUMP "Spam" From "@groupweb\.com" JUMP "Spam" From "financier\.com" JUMP "Spam" From "mwhse\.com" JUMP "Spam" From "apha\.org" JUMP "Spam" From "technobrands\.com" JUMP "Spam" From "daemon@ns\.vpszk.*\.hu" JUMP "Spam" From "technobrands\.com" JUMP "Spam" From "@database-systems\.com" JUMP "Spam" From "@clubsoulmates\.com" JUMP "Spam" From "lists\.autoweb\.com" JUMP "Spam" From "autoeurope\.com" JUMP "Spam" From "winvite\.com" JUMP "Spam" From "glenixa@aol\.com" JUMP "Spam" From "msgeorge@airmail\.net" JUMP "Spam" From "clinele@vbe\.com" JUMP "Spam" From "rocknroyrus@yahoo\.com" JUMP "Spam" From "hahaha@sexyfun" JUMP "Spam" From "savebig@list" JUMP "Spam" From "MacWarehouse@.*warehouse\.com" JUMP "Spam" From "jjdru@the-i\.net" JUMP "Spam" From "gq9NsjcYY@mci.com" JUMP "Spam" From "mgic@.*fsnet\.co\.uk" JUMP "Spam" From "announce@starnine\.com" JUMP "Spam" From "sales@bigappleherp\.com" JUMP "Spam" From "alliare@burnett\.com" JUMP "Spam" From "JoshandHolly@aol\.com" JUMP "Spam" From "munoz@.*com" JUMP "Spam" From "Linda\.Smith@mhmr\.state\.tx\.us" JUMP "Spam" From "jimrix@ev1\.net" JUMP "Spam" From "jshockley@sprintmail\.com" JUMP "Spam" From "hodges@jdwilliams\.com" JUMP "Spam" From "zlyon@centurytel\.net" JUMP "Spam" From "varbusiness@mail" JUMP "Spam" From "callago@worldnet\.att\.net" JUMP "Spam" From "homeloans@" JUMP "Spam" From "aladdinspecials" JUMP "Spam" From "elcherry@nationwide\.net" JUMP "Spam" From "rayz@elpn\.com" JUMP "Spam" From "healy@flash\.net" JUMP "Spam" From "roy_yeo51@yahoo\.com" JUMP "Spam" From "q4@3com-email\.com" JUMP "Spam" From "midget40_99@yahoo\.com" JUMP "Spam" From "theproject@excite\.com" JUMP "Spam" From "promotions.*@.*deja\.com" JUMP "Spam" From "Galaxyngc.*@webtv\.net" JUMP "Spam" From "April.Gunn@wcom\.com" JUMP "Spam" Host-From:envonly ".*" JUMP "to" # We got here because the From line claims this email came from Microsoft. # An annoying virus is sending itself around with predictable headers: # FROM: Microsoft # TO: Microsoft Client < > # # and # # FROM: Microsoft Security Section # TO: Microsoft Customer <> # # etc :Microsoft To "^Microsoft .*< *>" JUMP "Spam" Host-From:envonly ".*" JUMP "to" # Suspicious "To" entries :to To "(NAME|MAIL)_TO" JUMP "Spam" # Address that I use only for a single mail list but is getting spam To "svlug@dzm\.com" JUMP "svlug" # Dead or no longer used email addresses - They're dead to me now To "bugzilla" REJECT "This address is no longer used." To "notreal" REJECT "This address is no longer used." To "Horny Guy" JUMP "Spam" To "[0-9]\.txt," JUMP "Spam" To "Home.*Owner" JUMP "Spam" To "^Investor" JUMP "Spam" To "Valued Client" JUMP "Spam" To "itl\.net\.ua" JUMP "Spam" To "Undisclosed.*@nanaka\.com" JUMP "Spam" To "naseej\.com" JUMP "Spam" To "friend@public\.com" JUMP "Spam" To "user@the[-_]internet" JUMP "Spam" To "TheCandyStore" JUMP "Spam" To "printerinc" JUMP "Spam" To "bestiff" JUMP "Spam" To "spinner\.com" JUMP "Spam" CC "@naqt\.com" JUMP "Spam" Host-From:envonly ".*" JUMP "Subjects" :svlug Subject "\[svlug\]" !JUMP "Spam" Host-From:envonly ".*" JUMP "Subjects" :gmail Host-From:envonly ".*" DROP "jmccabe@gmail.com, spam" Host-From:envonly ".*" EXIT #:gmail_clean Host-From:envonly ".*" DROP "jmccabe@gmail.com" # Host-From:envonly ".*" EXIT # Like the "From" header, the "Subject" is often manipulated in such a # way as to notify the target audience that this is for them, but at # the same time to avoid being hit by filters just like this one. The # "Subject" hit list is constantly being tuned to catch the latest # mangled spelling of "H!O!T!!S!E!X!". Once a month or so I will go # through the "Subject" filter to see what I can combine into a faster # RegExp filter. :Subjects Subject:case "^Re: (your|test) [ACV][a-zA-Z]*[ANMS]$" REJECT "This mail server believes that your message is junk mail. Try changing your Subject line. Bad001" Subject:case " - .*(% OFF|price(s)*)$" JUMP "Spam" # Fucktard spammer using generically reassembled subject line in the form of "Re: NAME's - [story] Something [story]". Blocking this one without false positives will be hard. Subject "^Re: ( -|[a-z]'s) .*story[^?!]" JUMP "Spam" Subject:case "^Fw: [a-z]$" REJECT "This mail server believes that your message is Unsolicited Bulk Email." Subject:case "^SEXUALLY-EXPLICIT:" JUMP "Spam" Subject "$[0-9]{5,6}" JUMP "Spam" Subject:case "^Hi hunnie\s{3,}\w+" JUMP "Spam" Subject:case "^StopJackingOff\.\." JUMP "Spam" Subject:case "^You`ve got 1 VoiceMessage!$" JUMP "Spam" Subject:case "^Don`t worry, be happy!$" JUMP "Spam" Subject:case "^Check this out kid!!!$" JUMP "Spam" Subject:case "^you must be worried +" JUMP "Spam" Subject "Free.*TV" JUMP "Spam" Subject "McAfee" JUMP "Spam" Subject "Viaga*ra" REJECT "We're plenty hard here, thanks." Subject "\* *You.*(Approved|Approval)" JUMP "Spam" Subject "^Get .*($?[0-9]+|FREE|cash|psychic|penis|compliments of|loan|hair|American Express|hard|credit|virus|paid|rid of|rich|credit|your)" JUMP "Spam" Subject "(Herbal|Generic) Viagra" JUMP "Spam" Subject:case "^Hiya!!$" JUMP "Spam" Subject "(fortune|profit|learn|income|big money)EBay" JUMP "Spam" Subject "M\.I\.L\.F" JUMP "Spam" Subject "your free" JUMP "Spam" Subject "48 HOURS!!!" JUMP "Spam" Subject "^Your bed and breakfast web" JUMP "Spam" Subject "^Are you losing? the(answer|figure) would" JUMP "Spam" Subject "^- .* -$" JUMP "Spam" Subject "^- Earn 150.*hour -" JUMP "Spam" Subject "went by your web site-" JUMP "Spam" Subject "looked at your webpages-" JUMP "Spam" Subject "been to your site-" JUMP "Spam" Subject "process credit cards" JUMP "Spam" Subject "george rosenberg" REJECT Subject "oregon instant winner" JUMP "Spam" Subject "international money club" JUMP "Spam" Subject "lo+se.*weight" JUMP "Spam" Subject "Free Adult Entertainment" JUMP "Spam" Subject "Pay your legal fees.*[0-9]+$" JUMP "Spam" Subject "Need a vacation.*[0-9]+$" JUMP "Spam" Subject "Refinance.*(any reason|home).*[0-9]+$" JUMP "Spam" Subject "Earn From Home" JUMP "Spam" Subject "Make.*girl.*happy.*[0-9]+$" JUMP "Spam" Subject "Chart.*Men.*[0-9]+$" JUMP "Spam" Subject "Men.*Minutes.*Day.*[0-9]+$" JUMP "Spam" Subject "Legal.*Services.*[0-9]+$" JUMP "Spam" Subject "Fight.*Traffic.*Ticket.*Win" JUMP "Spam" Subject "Pleasure.*Being.*Man" JUMP "Spam" Subject "Instant.*Internet.*Empire" JUMP "Spam" Subject "Lender.*for.*you( )+[a-zA-Z0-9]+$" JUMP "Spam" Subject "Trick.*Cell.*Phone" JUMP "Spam" Subject "Pay.*Monthly.*Mini" JUMP "Spam" Subject "Unlimited.*Domains" JUMP "Spam" Subject "Hot.*Porn *Stars" JUMP "Spam" Subject "Underground.*Sex" JUMP "Spam" Subject "Farm.*Sex" JUMP "Spam" Subject:case "HGH" JUMP "Spam" Subject "Time:[0-9]+:[0-9][0-9]:[0-9][0-9]( )+[AP]M$" JUMP "Spam" Subject "Cock.*Cunt" JUMP "Spam" Subject "J-*Lo" JUMP "Spam" Subject "Save.*\$\$\$" JUMP "Spam" Subject "penis.*enlarg" JUMP "Spam" Subject "merch.*account" JUMP "Spam" Subject "celeb.*expose" JUMP "Spam" Subject "stoned.*( )+[0-9]+$" JUMP "Spam" Subject "young.*again( )+[0-9]+$" JUMP "Spam" Subject "free.*life.*insur" JUMP "Spam" Subject "save.*inkjet" JUMP "Spam" Subject "order( )+\[[a-zA-Z0-9]+\]$" JUMP "Spam" Subject "XXX.*Teen" JUMP "Spam" Subject "prohibition.*bust.*( )+[0-9]+$" JUMP "Spam" Subject "want.*lot.*money?" JUMP "Spam" Subject "Sexually.*Attract.*Women" JUMP "Spam" Subject "Celebs.*Gone.*Wild" JUMP "Spam" Subject "Make.*Money.*Home" JUMP "Spam" Subject "Increase.*Sexual.*Energy" JUMP "Spam" Subject "Reduce.*Body.*Fat" JUMP "Spam" Subject "Improve.*Health.*Now" JUMP "Spam" Subject "Leather.*Jacket.*Sale" JUMP "Spam" Subject "Let.*Internet.*Make.*Rich" JUMP "Spam" Subject "Diet.*Weight.*Loss" JUMP "Spam" Subject "Viagra.*Alternative" JUMP "Spam" Subject "Home.*Loan.*Finance.*Low" JUMP "Spam" Subject "viapro" JUMP "Spam" Subject "Pay.*Leads" JUMP "Spam" Subject "fax.*money" JUMP "Spam" Subject "DVD.*copy.*software" JUMP "Spam" Subject "Pics.*Love.*Zoo" JUMP "Spam" Subject "You \+ Visa" JUMP "Spam" Subject "Protect.*Internet.*Predator.*[0-9]+$" JUMP "Spam" Subject "fortune.*cookie.*[0-9]$" JUMP "Spam" Subject "mortgage.*quote.*pay.*much" JUMP "Spam" Subject "College.*Sluts" JUMP "Spam" Subject "Domain.*Hosting.*[0-9]+.*mo" JUMP "Spam" Subject "Never.*Know.*( )+[0-9]+$" JUMP "Spam" Subject "Refinan.*Save.*low.*rate" JUMP "Spam" Subject "Check.*out.*[0-9]$" JUMP "Spam" Subject "(Huge|Heavy).*Breast" JUMP "Spam" Subject "Windows.*Fault.*More.*Toler" JUMP "Spam" Subject:case "Pay.*Much.*( )+[A-Z]+$" JUMP "Spam" Subject "(Movie|Convert).*(CD-R|DVD).*[0-9]+$" JUMP "Spam" Subject "I *R *S Notice" JUMP "Spam" Subject "Merchant.*Account.*Money.*\]$" JUMP "Spam" Subject "want.*customer.*[0-9]+$" JUMP "Spam" Subject "Download.*Vid.*[0-9]+$" JUMP "Spam" Subject "Wrinkle.*Remover" JUMP "Spam" Subject "Attract.*Opposite.*Sex" JUMP "Spam" Subject "Watch.*Channels.*( ) +[A-Z]+$" JUMP "Spam" Subject "Breast.*Enhancement" JUMP "Spam" Subject "Life.*Stinks.*[0-9]+$" JUMP "Spam" Subject "Burn.*(Video|Own).*DVD" JUMP "Spam" Subject "@[0-9]+\)$" JUMP "Spam" Subject "(Overnight|Free).*Viagra" JUMP "Spam" Subject "Custom.*Web.*Site.*Design" JUMP "Spam" Subject "maker.*million.*[0-9]+$" JUMP "Spam" Subject "(inches|enlarge).*penis" JUMP "Spam" Subject "Cum.*Farm" JUMP "Spam" Subject "Double.*Internet.*Speed" JUMP "Spam" Subject "Home.*(Business|Biz)" JUMP "Spam" Subject "Cum.*Face" JUMP "Spam" Subject "Get.*Phone.*Record" JUMP "Spam" Subject "Invest.*Back.*Govern" JUMP "Spam" Subject "Nude.*Celebrity" JUMP "Spam" Subject "Treasure.*Nose.*[0-9]+\)$" JUMP "Spam" Subject "Girl.*Animal.*Pic" JUMP "Spam" Subject "Lucri.*Investment.*[0-9][0-9]+$" JUMP "Spam" Subject "Bulk.*Email.*List" JUMP "Spam" Subject "Free.*Porn" JUMP "Spam" Subject "Save.*Store.*[0-9][0-9]+$" JUMP "Spam" Subject "Cash.*Lower.*Rate" JUMP "Spam" Subject "Mak.*Money.*(online|[0-9][0-9]+$)" JUMP "Spam" Subject "Teen.*(Slits|Porn)" JUMP "Spam" Subject "Wall.*Street.*[0-9][0-9]+$" JUMP "Spam" Subject "Girl.*Zoo" JUMP "Spam" Subject "Toke.*Legally.*[0-9][0-9]+$" JUMP "Spam" Subject "Tax.*[0-9][0-9]+$" JUMP "Spam" Subject "order.*front.*thous.*[0-9][0-9]+$" JUMP "Spam" Subject "septic.*system.*maint" JUMP "Spam" Subject "weight.*(lose|ruined.*life)" JUMP "Spam" Subject "Home.*Worker" JUMP "Spam" Subject "family\!.*[0-9][0-9]+$" JUMP "Spam" Subject "animals.*[0-9][0-9]+$" JUMP "Spam" Subject "start.*$[0-9]+k.*career.*[0-9][0-9]+$" JUMP "Spam" Subject "Lose.*(lbs|pounds).*guarant" JUMP "Spam" Subject "Million.*Address" JUMP "Spam" Subject "Tired.*Speed.*Tick" JUMP "Spam" Subject "Pure.*Pleasure.*[0-9][0-9]+$" JUMP "Spam" Subject "Internet.*Market.*[0-9][0-9]+$" JUMP "Spam" Subject "Universal.*Descrambler" JUMP "Spam" Subject "Loved.*One.*Flowers" JUMP "Spam" Subject "Florida.*Car.*Rental" JUMP "Spam" Subject "own.*Casino" JUMP "Spam" Subject "Treffen wir uns" JUMP "Spam" Subject "Ink.*Price.*[0-9][0-9]+$" JUMP "Spam" Subject "(Foreign)*.*Currency.*(investing|trading)" JUMP "Spam" Subject "([0-9]+\.)+([0-9]+\.)+([0-9]+\.)+([0-9]+)+ ([A-Z][A-Z])+$" JUMP "Spam" Subject "call.*me.*[0-9]+$" JUMP "Spam" Subject "Gov.*Grant" JUMP "Spam" Subject "Spy.*(Spouse|Software)" JUMP "Spam" Subject "$[0-9]+.[0-9][0-9].*(week|month)" JUMP "Spam" Subject "(Amateur|Teen|Horny).*Girls.* +[a-z0-9]+$" JUMP "Spam" Subject "Firm.*Erection" JUMP "Spam" Subject "Paid.*Daily.*Featured" JUMP "Spam" Subject "Debt.*\[[a-zA-Z0-9]+\]$" JUMP "Spam" Subject "Online.*(Approval|Pharmacy)" JUMP "Spam" Subject "Relatives *[0-9]+$" JUMP "Spam" Subject "Lose.*(Pounds|Weight).*Guar" JUMP "Spam" Subject "Monitor.*(Spouse|Child).*Internet" JUMP "Spam" Subject "Reduce.*Insurance.*Cost" JUMP "Spam" Subject "Boost.*(Wind.*Reliab|Reliab.*Wind)" JUMP "Spam" Subject "(Cash|Equity).*Apply" JUMP "Spam" Subject "Customers.*find.*you.*buy" JUMP "Spam" Subject "Saving.*Insurance" JUMP "Spam" Subject "Too.*many.*bills" JUMP "Spam" Subject:case "(XXX|FREE!)" JUMP "Spam" Subject:case "BILLS.*CONSOLIDATE" JUMP "Spam" Subject "([a-zA-Z] +[a-zA-Z] +[a-zA-Z] +[a-zA-Z] +[a-zA-Z] +)+" JUMP "Spam" Subject "Win.*Dream.*Vacation" JUMP "Spam" Subject:case "ADV" JUMP "Spam" Subject:case "(Diet|Age|Young).*H\.*G\.*H" JUMP "Spam" Subject "bulk.*(email|advertise).*free" JUMP "Spam" Subject "Your.*Business.*Head" JUMP "Spam" Subject "lenders.*compete" JUMP "Spam" Subject "Beast.*Babes.*[0-9]+" JUMP "Spam" Subject "Trad.*Alert.*\([0-9]+[a-z]+.*\)" JUMP "Spam" Subject "Advertise.*(millions|consumer)" JUMP "Spam" Subject "(Niche|Market|Selected).*Special" JUMP "Spam" Subject "Business.*S *e *c *r *e *t" JUMP "Spam" Subject "Custom.*Website.*[0-9]+$" JUMP "Spam" Subject "Exclusive.*offer" JUMP "Spam" Subject "\.name.*reg.*inst" JUMP "Spam" Subject "Requested.*(Info|Report)" JUMP "Spam" Subject "Slash.*Payment" JUMP "Spam" Subject "40( X 40)+" JUMP "Spam" Subject "Home.*Loan.*Sav" JUMP "Spam" Subject "(Consolidate|Relief).*(Checks|Debt|Today)" JUMP "Spam" Subject "Background.*Check" JUMP "Spam" Subject "Secret.*Monitor.*Anywhere" JUMP "Spam" Subject "Find.*(Info|Anything).*Anyone" JUMP "Spam" Subject "Copy.*DVD.*(Free|Penn)" JUMP "Spam" Subject "Porn.*Web" JUMP "Spam" Subject "Credit.*Loan" JUMP "Spam" Subject "Loan.*Credit" JUMP "Spam" Subject "printer.*cart(ri|ir)dge" JUMP "Spam" Subject "(hot|nude).*teen" JUMP "Spam" Subject "ANAL.*SEX" JUMP "Spam" Subject "(imag|toner).*(suppl|cart)" JUMP "Spam" Subject "turn.*key.*system" JUMP "Spam" Subject "MLM.*success" JUMP "Spam" Subject "financ.*(freedom|business)" JUMP "Spam" Subject "Accept.*(Visa|Master|credit)" JUMP "Spam" Subject "earn.*\$10+,0+" JUMP "Spam" Subject "Stock.*(Alert|Tip).*[0-9][0-9]+$" JUMP "Spam" Subject "Resistance.*Fitness" JUMP "Spam" Subject "Make.*\$\$\$" JUMP "Spam" Subject "^\$[0-9,]+" JUMP "Spam" Subject "Your.*Visibility" JUMP "Spam" Subject "Pennystock.*Report" JUMP "Spam" Subject "Internet.*(SIC|spy)" JUMP "Spam" Subject "ANSWERS.*Business" JUMP "Spam" Subject "Special.*Selected" JUMP "Spam" Subject "Unlimited.*Income" JUMP "Spam" Subject:case "IRS.*$[0-9]+" JUMP "Spam" Subject "Sale.*Lead" JUMP "Spam" Subject "Home.*Typ" JUMP "Spam" Subject "recommend.*stock" JUMP "Spam" Subject "(Fire.*boss)|(Work.*home)" JUMP "Spam" Subject "Tired.*(Earning.*Worth|9 to 5)" JUMP "Spam" Subject "University.*Diploma" JUMP "Spam" Subject "Opera.*Portables" JUMP "Spam" Subject "Offsore.*Account" JUMP "Spam" Subject "Hot.*Money.*Make" JUMP "Spam" Subject "[0-9.]*.*Mortgage" JUMP "Spam" Subject "Profit.*Secret.*Currency" JUMP "Spam" Subject "[0-9.]+.*million.*prospect" JUMP "Spam" Host-From:envonly ".*" JUMP "user" # This is a set of filters that applies only to my server. These are # addresses that don't exist yet seem to receive a great deal of # UBE/UCE. Rather than deal with the bad delivery I simply kill any # message destined for these addys. :user Channel-To:envonly "dzmt@dzm\.com" JUMP "Spam" # Essentially honeypots at this point # Channel-To:envonly "bm_photos@dzm" JUMP "gmail" # Channel-To:envonly "bman@dzm" JUMP "gmail" # Channel-To:envonly "photos@dzm" JUMP "gmail" # Channel-To:envonly "webmaster@(dzm|pogues|jmccabe|tullycreek)" JUMP "gmail" Channel-To:envonly "dwdzmm" REJECT "User does not exist." Channel-To:envonly "fta@dzm\.com" JUMP "Spam" Channel-To:envonly "yvp@dzm\.com" JUMP "Spam" Channel-To:envonly "wi0ldmnfjs@dzm\.com" JUMP "Spam" Channel-To:envonly "ncmznmznv@dzm\.com" JUMP "Spam" Channel-To:envonly "kjuwhb" JUMP "Spam" Channel-To:envonly "info@(dzm|jmccabe|pogues)\.(com|org)" JUMP "Spam" Channel-To:envonly "hotguy" JUMP "Spam" Channel-To:envonly "gemje" JUMP "Spam" Channel-To:envonly "^scj@dzm" JUMP "Spam" Channel-To:envonly "remax@dzm" REJECT "No longer wish to receive this service" Channel-To:envonly "trugirlz.r.us[0-9]+@dzm" JUMP "Spam" Channel-To:envonly "richardv@dzm" JUMP "Spam" Channel-To:envonly "rshelton@dzm" JUMP "Spam" Channel-To:envonly "rrvoges@dzm" JUMP "Spam" Channel-To:envonly "THELEEFAMILY@dzm" JUMP "Spam" Channel-To:envonly "theeds@dzm" JUMP "Spam" Channel-To:envonly "karenf@dzm" JUMP "Spam" Channel-To:envonly "hnbuck@dzm" JUMP "Spam" Channel-To:envonly "tobinpark@dzm" JUMP "Spam" Channel-To:envonly "sos@dzm" JUMP "Spam" Channel-To:envonly "zab@dzm" JUMP "Spam" Channel-To:envonly "trimtab@dzm" JUMP "Spam" Channel-To:envonly "sales@dzm" JUMP "Spam" Channel-To:envonly "jtomas@dzm" JUMP "Spam" Channel-To:envonly "marinas@dzm" JUMP "Spam" Channel-To:envonly "fraternity1111@dzm" JUMP "Spam" Channel-To:envonly "seam@dzm" JUMP "Spam" Channel-To:envonly "argy@dzm" JUMP "Spam" Channel-To:envonly "njohiwz@dzm" JUMP "Spam" Channel-To:envonly "andymazo@DZM" JUMP "Spam" Channel-To:envonly "aaa@dzm" JUMP "Spam" Channel-To:envonly "jerryodom@dzm" JUMP "Spam" Channel-To:envonly "flickl@dzm" JUMP "Spam" Channel-To:envonly "steelers@dzm" JUMP "Spam" Channel-To:envonly "mlwelborn@dzm" JUMP "Spam" Channel-To:envonly "mps_com@dzm" JUMP "Spam" Channel-To:envonly "frank@dzm" JUMP "Spam" Channel-To:envonly "rshaw@dzm" JUMP "Spam" Channel-To:envonly "0432@dzm" JUMP "Spam" Channel-To:envonly "po@pogues" JUMP "Spam" Channel-To:envonly "ccrdav@dzm" JUMP "Spam" Channel-To:envonly "wmyounger@dzm" JUMP "Spam" Channel-To:envonly "dmkz@dzm" JUMP "Spam" Channel-To:envonly "drose@dzm" JUMP "Spam" Channel-To:envonly "ddslkn@dzm" JUMP "Spam" Channel-To:envonly "gandon@dzm" JUMP "Spam" Channel-To:envonly "kittydarling2" JUMP "Spam" Channel-To:envonly "apmco@dzm" JUMP "Spam" Channel-To:envonly "solomon@dzm" JUMP "Spam" Channel-To:envonly "ae@dzm" JUMP "Spam" Channel-To:envonly "clm" JUMP "Spam" Channel-To:envonly "bauer@" JUMP "Spam" Channel-To:envonly "olivy" JUMP "Spam" Channel-To:envonly "p7hdbobeg" JUMP "Spam" Channel-Tp:envonly "rgalindo" JUMP "Spam" Channel-To:envonly "jvm@dzm" JUMP "Spam" Channel-To:envonly "allainace" JUMP "Spam" Channel-To:envonly "kk5vf" JUMP "Spam" Channel-To:envonly "fmg" JUMP "Spam" Channel-To:envonly "mysf" JUMP "Spam" Channel-To:envonly "guitarman" JUMP "Spam" Channel-To:envonly "hendryx" JUMP "Spam" Channel-To:envonly "snqclrl" JUMP "Spam" Channel-To:envonly "the@pogues" JUMP "Spam" Channel-To:envonly "donovan" JUMP "Spam" Channel-To:envonly "mkeyser" JUMP "Spam" Channel-To:envonly "faz@dzm" JUMP "Spam" Channel-To:envonly "sllk@dzm" JUMP "Spam" Channel-To:envonly "david@dzm" JUMP "Spam" Channel-To:envonly "waltermetcalf" JUMP "Spam" Channel-To:envonly "bhoover" JUMP "Spam" Channel-To:envonly "nitam" JUMP "Spam" Channel-To:envonly "drobles" JUMP "Spam" Channel-To:envonly "denselc" JUMP "Spam" Channel-To:envonly "blackwood" JUMP "Spam" Channel-To:envonly "hoverton" JUMP "Spam" Channel-To:envonly "piercent" JUMP "Spam" Channel-To:envonly "csmus" JUMP "Spam" Channel-To:envonly "elmar" JUMP "Spam" Channel-To:envonly "hawk" JUMP "Spam" Channel-To:envonly "kayhan" JUMP "Spam" Channel-To:envonly "ronniebarker" JUMP "Spam" Channel-To:envonly "micpowers" JUMP "Spam" Channel-To:envonly "dd[ls]+kn" JUMP "Spam" Channel-To:envonly "jimsharon" JUMP "Spam" Channel-To:envonly "jlmc" JUMP "Spam" Channel-To:envonly "dward" JUMP "Spam" Channel-To:envonly "davealan" JUMP "Spam" Channel-To:envonly "cpc" JUMP "Spam" Channel-To:envonly "bobbyebasket" JUMP "Spam" Channel-To:envonly "rhayden" JUMP "Spam" Channel-To:envonly "gqyyoeq" JUMP "Spam" Channel-To:envonly "hotmoney" JUMP "Spam" Channel-To:envonly "dthunhurst" JUMP "Spam" Channel-To:envonly "csvalles" JUMP "Spam" Channel-To:envonly "oldtimer" JUMP "Spam" Channel-To:envonly "mgardner" JUMP "Spam" Channel-To:envonly "tompoq" JUMP "Spam" Channel-To:envonly "hhmcherry" JUMP "Spam" Channel-To:envonly "pfcain" JUMP "Spam" Channel-To:envonly "mcard" JUMP "Spam" Channel-To:envonly "spoil" JUMP "Spam" Channel-To:envonly "tereseone" JUMP "Spam" Channel-To:envonly "lam@" JUMP "Spam" Channel-To:envonly "djimenez" JUMP "Spam" Channel-To:envonly "jakl" JUMP "Spam" # Channel my own email through Google to act as a more complete SPAM filter # Channel-To:envonly "dzm@dzm.com" JUMP "gmail_clean" Host-From:envonly ".*" EXIT # This is where the Spam messages are dealt with. Ideally I'd like to # have the messages copied to the junk drawer /and/ bounce an error, # but the UBE filter in NMS4.x doesn't support doing something as # obviously usefull as this. :Spam Host-From:envonly ".*" DROP "spam" Host-From:envonly ".*" EXIT # Stupid filter needs a at the end