# Rick's Black Hole List 
# There are many sources of spam mail on the net today.
# Use this procmail configuration file to clean the spam out of your incoming mail.
# It blocks out large parts of the Internet.
# It will sometimes let spam through or put good mail in the 'junk' folder.
# I am constantly improving it.
#
# Some of the companies named are spammers, some have been broken into by spammers,
# some are ISP's for spammers.  They are all responsible in some measure for the
# spam coming from them.
#
# I suspect that in many cases, the spammer used a server infected by CodeRed or Nimda.
#
# Am I trying to block spam, or am I trying to compile a list of spammers? 
# The 'wide' blocks save me effort in blocking spam,
# but mean that the list of spammers is incomplete.
# Likewise, the country filter (at the bottom) saves effort,
# at the expense of the list of spammers.

VERBOSE=on
MAILDIR=$HOME/mail
PMDIR=$HOME/.procmail
LOGFILE=$PMDIR/log
INCLUDERC=$PMDIR/rc.testing

PATH=/bin:/usr/bin:/usr/local/bin

#TODAY=`date +%m%d`                        # Amir's addition
TODAY=n

# Normal:
DEFAULT=$ORGMAIL

#LOGFILE=$MAILDIR/00-Procmail-Logs/$TODAY  # Amir's setup
#VERBOSE=yes

#####################################

# My mails are sacred

:0:
* ^From:.*rleir
$ORGMAIL

:0:
* ^From:.*@igs.net
$ORGMAIL

:0:
* ^To:.*505.*
$ORGMAIL

:0:
* ^To:.*iceboating.*
$ORGMAIL


#####################################
#
# Try to detect spam by Received: headers.
#
#####################################

# alternates:  web.ott.igs.net host.mid.igs.net ns2.ott.igs.net
#nj



# Global Innovations 64.186.128.0 - 64.186.143.255    wide
#  CleanDrive Software 64.186.131.0 - 64.186.131.255 www.cleandrive.net [64.186.131.37]
:0
* ^Received:.*64\.186\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# TCC Communications WI US 216.114.0.0 - 216.114.63.255 
# valid  fog.powercom.net [216.114.0.132]
#:0
#* ^Received:.*216\.114\.[0-9]+\.[0-9]+
#JunkMail.$TODAY

# Bell Atlantic  209.158.0.0 - 209.159.31.255
# SJM International  209.158.78.0 - 209.158.78.63 mail.sjminternational.com ([209.158.78.33])   wide
:0
* ^Received:.*209\.15[89]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Dragon Net (rural)  202.172.96.0 - 202.172.127.255 sydney.spin.net.au [202.172.111.13]  wide
:0
* ^Received:.*202\.172\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Quebec Telephone Rimouski 142.169.0.0 - 142.169.255.255 globetrotter.net [142.169.39.59]
:0
* ^Received:.*142\.169\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Camara Municipal Das llhas  202.175.15.0 - 202.175.15.15 xcmi2.cmi.gov.mo ([202.175.15.2])  wide
:0
* ^Received:.*202\.175\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# JTEL 64.57.192.0 - 64.57.223.255
# thebest.net  64.57.197.224 - 64.57.197.239 edirectnetwork.net [64.57.197.230]
:0
* ^Received:.*64\.57\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Broadwing Austin, TX US 67.96.0.0 - 67.99.255.255 ns2.rigidplace.com ([67.96.64.135])
:0
* ^Received:.*67\.9[6-9]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# MC-TELECOM  195.78.5.0 - 195.78.6.255 ntserver.cgm.mc ([195.78.5.78] SPC septic tank
:0
* ^Received:.*195\.78\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# TELCEL CELULAR 200.35.64.0 - 200.35.127.255
# INTERCABLE CABLE 200.35.94.0 - 200.35.94.255 [200.35.94.254]
:0
* ^Received:.*200\.35\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Satellite Data Networks  66.8.0.0 - 66.8.127.255 
# Ambassador Training 66.8.57.224 - 66.8.57.231 na.sdn.net.za [66.8.57.226]
:0
* ^Received:.*66\.8\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Digital Telecommunications Philipines 202.138.128.0 - 202.138.159.255 digitelone.com [202.138.128.1]    wide
:0
* ^Received:.*202\.138\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Concentric San Jose, CA 206.111.0.0 - 206.111.255.255 lax-ca.dsl.cnc.net [206.111.108.140])
:0
* ^Received:.*206\.111\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# westinghouse communications 205.254.0.0 - 205.254.31.255 
# CB Commerical Real Estate Group 205.254.2.0 - 205.254.3.255 smtp4.cbre.com [205.254.2.72]   wide
:0
* ^Received:.*205\.254\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Office National des Postes et Telecommunications country: MA 62.251.128.0 - 62.251.255.255 srvm.2m.tv ([62.251.160.189]   wide
# PROCURAŽ is a registered trademark of Centennial Health Products, Inc.
:0
* ^Received:.*62\.251\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# valid smtp1.ancient-scotland.co.uk [212.135.179.242])
# B2 Solutions  Bristol GB 212.135.117.128 - 212.135.117.191 newt.jungle.b2solutions.co.uk ([212.135.117.182] 64.80.217.12  wide
:0
* ^Received:.*212\.135\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Demon Internet Limited Office/Internal Machines GB 194.217.242.0 - 194.217.242.255 anchor-post-32.mail.demon.net [194.217.242.90]
:0
* ^Received:.*194\.217\.242\.[0-9]+
JunkMail.$TODAY

# Korea Network Information Center 203.232.0.0 - 203.239.255.255 websrv.pakatex.com ([203.233.4.2]) AdAd NY
:0
* ^Received:.*203\.23[2-9]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Wanadoo Cable Amsterdam NL 195.96.96.0 - 195.96.98.255 smtpf.casema.net [195.96.96.173])
:0
* ^Received:.*195\.96\.9[6-8]\.[0-9]+
JunkMail.$TODAY

# ITESM Campus Monterrey/MEXnet 200.23.0.0 - 200.23.255.255
# International VAN S.A. de C.V. 200.23.224.0 - 200.23.239.255 aaamzo.org.mx [200.23.226.229]
:0
* ^Received:.*200\.23\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Macro Computer Solutions  205.253.0.0 - 205.253.255.255
# Gillette Global Network 205.253.192.0 - 205.253.223.255
# Permanent Mission of Brazil 205.253.194.8 - 205.253.194.15 ip.ggn.net [205.253.194.13]
:0
* ^Received:.*205\.253\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Speakeasy 64.81.0.0 - 64.81.255.255
# Speakeasy 64.81.32.0 - 64.81.40.255 lax1.dsl.speakeasy.net c1marketing.net C1 Marketing [64.81.36.38]
:0
* ^Received:.*64\.81\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Cable & Wireless USA 205.216.0.0 - 205.219.255.255
# USLEC Corp.  205.218.120.0 - 205.218.123.255 email1.uslec.net ([205.218.123.51])
:0
* ^Received:.*205\.21[6-9]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# CHINANET Hebei province 202.99.128.0 - 202.99.191.255 [202.99.183.163])   wide
:0
* ^Received:.*202\.99\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Advance Telecomunicaciones 200.5.64.0 - 200.5.127.255    wide
# Unidad Ejecutora 200.5.116.0 - 200.5.117.255 [200.5.117.210]
:0
* ^Received:.*200\.5\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# EUnet Yugoslavia 194.247.192.0 - 194.247.223.255 cmarket.co.yu [194.247.212.114]   wide
:0
* ^Received:.*194\.247\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Dataframe Logistics CA US 216.168.192.0 - 216.168.223.255 power2500 ([216.168.221.2])  wide
:0
* ^Received:.*216\.168\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# YASAR LEASING, TURKEY 212.98.216.128 - 212.98.216.143 yasarfactoring.com.tr ([212.98.216.138])  wide
:0
* ^Received:.*212\.98\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Internet Access Eindhoven NL  212.61.32.0 - 212.61.35.255 hexspoor1.iae.nl [212.61.32.2]   wide
:0
* ^Received:.*212\.61\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# PaeTec Communications   64.80.0.0 - 64.80.255.255
# Monsterhut  64.80.216.0 - 64.80.221.255 monsterhut.com [64.80.217.9]
:0
* ^Received:.*\[64\.80\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Network Information Center Mexico 200.38.0.0 - 200.39.255.255
# UniNet S.A. de C.V.  200.38.128.0 - 200.38.159.255
# Consorcio Interamericano de Entretenimiento 200.38.153.128 - 200.38.153.255 uninet.net.mx [200.38.153.203]
:0
* ^Received:.*200\.3[89]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# EU-GLOBALONE-OTHER-970109  194.133.0.0 - 194.133.255.255 diva_server.divamed.net ([194.133.252.242])
:0
* ^Received:.*194\.133\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# A.R. Information & Publication Bangkok  203.148.174.0 - 203.148.174.127  ar4u.com ([203.148.174.17])   wide
:0
* ^Received:.*203\.148\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Business Internet,Tampa FL  207.238.0.0 - 207.239.255.255 [207.238.115.18]
:0
* ^Received:.*207\.23[89]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Information service lan,Ningxia country: CN  202.100.100.160 - 202.100.100.191 nx.cninfo.net [202.100.100.170]   wide
:0
* ^Received:.*202\.100\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Radiografica Costarricense 196.40.0.0 - 196.40.79.255 emerald ([196.40.39.147]     wide
:0
* ^Received:.*196\.40\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# valid hera.cuci.nl [212.125.128.1])
# STARMAILTOWER2 Messagelabs Mail 212.125.75.0 - 212.125.75.7 london-2.starlabs.net [212.125.75.4]      wide
:0
* ^Received:.*212\.125\.75\.[0-9]+
JunkMail.$TODAY

# Infortelcom Madrid ES 212.80.171.0 - 212.80.171.127 infortelecom.net ([212.80.171.4]      wide
:0
* ^Received:.*212\.80\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# CWIE LLC  Phoenix US  64.38.192.0 - 64.38.255.255 gpc.cavecreek.net ([64.38.226.214]     wide
:0
* ^Received:.*\64\.38\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# MenaNet Communications S.A.E. 163.121.197.0 - 163.121.197.255 menanet.com.eg [163.121.197.170]     wide
:0
* ^Received:.*163\.121\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Performance Systems International 154.32.0.0 - 154.32.255.255 uk.psi.net [154.32.105.6])
:0
* ^Received:.*154\.32\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Verio, Inc 204.200.0.0 - 204.203.255.255 focitech.com ([204.201.191.100]
:0
* ^Received:.*204\.20[0-3]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Martincolor GmbH & Co.KG, Frankfurt 62.132.107.16 - 62.132.107.23 martincolor.de (mail@[62.132.107.20]     wide
:0
* ^Received:.*\[62\.132\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# America Online, Inc 172.128.0.0 - 172.191.255.255 ipt.aol.com [172.191.4.208] 172.190.25.94]
:0
* ^Received:.*172\.(12[89]|1[3-8][0-9]|19[01])\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# SONOFON STANDARD IP SERVICES  212.88.64.0 - 212.88.64.255 sonofon.dk [212.88.64.10]    wide
:0
* ^Received:.*212\.88\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# TCA Internet 208.180.0.0 - 208.180.255.255 cox-internet.com [208.180.118.41]
:0
* ^Received:.*208\.180\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Bellsouth.net  66.156.0.0 - 66.156.255.255 bct.bellsouth.net [66.156.217.134]
:0
* ^Received:.*66\.156\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Bellsouth.net 216.76.0.0 - 216.79.255.255 coi.bellsouth.net [216.76.215.26]
:0
* ^Received:.*216\.7[6-9]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# VIANET Telekommunikations Vienna 194.96.0.0 - 194.96.255.255 via.at [194.96.202.21]
:0
* ^Received:.*194\.96\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Ciberlynx 216.242.0.0 - 216.242.255.255 ciberlynx.net [216.242.0.3])
:0
* ^Received:.*216\.242\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Lemberger Software GmbH country:      AT 194.112.236.0 - 194.112.236.255 ennstal.at [194.112.236.1])
:0
* ^Received:.*194\.112\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# I.T.C. E G. FLORIANI country:      IT 217.57.32.64 - 217.57.32.95 mail.istituto ([217.57.32.67]   wide
:0
* ^Received:.*217\.57\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Siemens Data country: IL 194.90.140.0 - 194.90.143.255 pixel.co.il [194.90.143.143]    wide
:0
* ^Received:.*194\.90\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# MEXnet200.36.0.0 - 200.36.255.255
# UniNet S.A. 200.36.32.0 - 200.36.63.255
# ICATEL S.A. 200.36.54.0 - 200.36.54.255 uninet.net.mx [200.36.54.85]
:0
* ^Received:.*200\.36\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Filmu studija Rija SIA country:      LV 195.13.202.128 - 195.13.202.159 rija1 ([195.13.202.156]    wide
:0
* ^Received:.*195\.13\.[0-9]+\.[0-9]+
JunkMail.$TODAY

#  Anglia Polytechnic University GB 194.83.40.0 - 194.83.47.255 jane.ultralab.anglia.ac.uk [194.83.41.131]    wide
:0
* ^Received:.*194\.83\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Metrix Interlink  207.139.0.0 - 207.139.255.255
# Brainhunter.com  207.139.214.128 - 207.139.214.191 [207.139.214.130
:0
* ^Received:.*207\.139\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Assumption University Bangkok 168.120.0.0 - 168.120.255.255 ksc.au.edu [168.120.17.7]
:0
* ^Received:.*168\.120\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Cableuropa ONO net in whole Spain  62.42.0.0 - 62.42.230.255 .ono.com [62.42.230.12])     wide
:0
* ^Received:.*\[62\.42\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# CHINANET Beijing province network  202.108.0.0 - 202.108.255.255 .163.com ([202.108.44.203] [202.108.44.205]
:0
* ^Received:.*202\.108\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# InternetConnect, Inc 64.148.0.0 - 64.150.255.255 dgeast.dataguide.com ([64.149.199.70]
:0
* ^Received:.*\[64\.(14[89]|150)\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# VERSATEL   Point to point connection to Dynaserv
# Versatel FBI customer bedyn001.Dynaserv.be ([62.58.96.66]    wide
:0
* ^Received:.*\[62\.58\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Bellsouth.net Atlanta GA 209.214.0.0 - 209.215.255.255 bct.bellsouth.net [209.214.92.72]
:0
* ^Received:.*209\.21[45]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Thorn Communications 216.213.0.0 - 216.213.191.255 .asnvoice.com [216.213.84.100]    wide
:0
* ^Received:.*216\.213\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# CAnet ONTARIO13  205.207.0.0 - 205.207.255.255
#  Inksetter & Associates  205.207.140.0 - 205.207.140.255 rds.tertec.com ([205.207.140.236]
:0
* ^Received:.*205\.207\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# British Telecom ADSL 213.123.120.0 - 213.123.123.255 btopenworld.com [213.123.121.140]    wide
:0
* ^Received:.*213\.123\.[0-9]+\.[0-9]+
JunkMail.$TODAY

#####################################
# U S WEST MN US  63.224.0.0 - 63.231.255.255 SUPDC.soundutilities.com ([63.224.43.17]

# valid schneier dd-b.net [63.224.10.74]
:0:
* ^Received:.*\[63\.224\.10\.74
$ORGMAIL

:0
* ^Received:.*\[63\.(22[4-9]|23[01])\.[0-9]+\.[0-9]+
JunkMail.$TODAY
#####################################

# CAnet BC  204.174.0.0 - 204.174.255.255
# MIND LINK! 204.174.16.0 - 204.174.31.255 dewey.mindlink.net [204.174.16.4]
:0
* ^Received:.*204\.174\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Lightning Internet Services NY US  209.51.160.0 - 209.51.191.255 newtronix.com [209.51.164.98]     wide
:0
* ^Received:.*209\.51\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Genuity 198.76.0.0 - 198.79.255.255
# DSL Designs 198.76.82.0 - 198.76.82.255 dsldesigns.com [198.76.82.191]
:0
* ^Received:.*198\.7[6-9]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# www.t-online.de deutscheland germany  194.25.134.0 - 194.25.134.255 .sul.t-online.com [194.25.134.80]
# this is the largest german ISP.
:0
* ^Received:.*194\.25\.134\.[0-9]+
JunkMail.$TODAY

# MEXnet 207.248.0.0 - 207.249.255.255
# Informacion Selectiva 207.248.0.0 - 207.248.31.255
# Ropa Siete Leguas 207.248.22.232 - 207.248.22.239 sleguas02.terra.net.mx [207.248.22.234]
:0
* ^Received:.*207\.24[89]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Birch Telecom MO US  216.212.0.0 - 216.212.191.255 .birch.net [216.212.30.131]    wide
:0
* ^Received:.*216\.212\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Focalnet France 195.154.86.32 - 195.154.86.63 focal-net.qg ([195.154.86.61]   wide
:0
* ^Received:.*195\.154\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Broadwing Communications, 216.140.0.0 - 216.143.255.255
# Broadslate Networks 216.142.212.0 - 216.142.220.255 aprsupply.com ([216.142.214.210]
:0
* ^Received:.*216\.14[0-3]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# State of Arkansas
# Department of Computer Services  170.94.0.0 - 170.94.255.255 nlmc.lib.ar.us [170.94.152.114]
:0
* ^Received:.*170\.94\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Deutcheland germany NTG/Xlink  192.67.192.0 - 192.67.199.255 natpost.webmailer.de [192.67.198.65])    wide
:0
* ^Received:.*192\.67\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Australia NorthPower Energy Services Pty Ltd 
# Turboweb, ISP Division.  202.74.128.0 - 202.74.159.255  edstein.com.au ([202.74.131.119]
:0
* ^Received:.*202\.74\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# France  194.51.68.160 - 194.51.68.167 capitalmedia.fr ([194.51.68.165]
:0
* ^Received:.*194\.51\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Italy  DOMINO-INLINK  212.141.195.0 - 212.141.195.31 frimm.com (qmailr@[212.141.195.5])      wide
:0
* ^Received:.*212\.141\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# CAnet       205.151.0.0 - 205.151.255.255
# CiteNet 205.151.192.0 - 205.151.207.255
# CEGEP de Saint-Hyacinthe QUEBEC .citenet.net [205.151.197.51]
:0
* ^Received:.*205\.151\.[0-9]+\.[0-9]+
JunkMail.$TODAY

#valid bur2046-a.physique.usherb.ca (IDENT:postfix@[132.210.22.97]
# Universite de Sherbrooke Quebec  132.210.0.0 - 132.210.255.255 hermes.usherb.ca [132.210.10.7]
:0
* ^Received:.*132\.210\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# singapore  LECIA-INSTRUMENTS 202.95.70.0 - 202.95.70.31  leica.com (firewall-user@[202.95.70.4])      wide
:0
* ^Received:.*202\.95\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# The Pajo Group   208.179.0.0 - 208.179.255.255
#   Dedicated Media   208.179.54.0 - 208.179.54.255 dedicatedmedia.com ([208.179.54.6]
:0
* ^Received:.*208\.179\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Cable & Wireless USA     207.0.0.0 - 207.3.255.255
# zz there was at least one valid mail
# Computer Resources of Columbia207.1.224.0 - 207.1.225.255 booneelectric.com [207.1.225.219]
:0
* ^Received:.*207\.[0-3]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# CHINANET Guangdong province network 202.103.128.0 - 202.103.191.255 netease.com ([202.103.134.9]   wide
:0
* ^Received:.*202\.103\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# SoftAware, Inc. US  209.85.0.0 - 209.85.255.255 debtauction.com ([209.85.168.56])
:0
* ^Received:.*209\.85\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# NEXTGENTEL  Norway  217.13.0.0 - 217.13.8.255 broadpark.no ([217.13.4.2])
:0
* ^Received:.*217\.13\.[0-8]\.[0-9]+
JunkMail.$TODAY

############################################
# valid kym.edu.my ([202.188.253.2]
:0:
* ^Received:.*202\.188\.253\.2
$ORGMAIL

# JARING Flamingo Institute Of Further Education 202.187.163.0 - 202.187.163.31   wide
# FIFE.edu.my([202.187.163.3]
:0
* ^Received:.*202\.187\.[0-9]+\.[0-9]+
JunkMail.$TODAY
############################################

# Longwood Medical Area  134.174.0.0 - 134.174.255.255 rogue.med.harvard.edu [134.174.141.70]
:0
* ^Received:.*134\.174\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Estonian Telephone Co/Estpak Data 194.126.101.0 - 194.126.101.255 zen.estpak.ee [194.126.101.100])
#  backbone and servers 
:0
* ^Received:.*194\.126\.101\.[0-9]+
JunkMail.$TODAY

# Cable & Wireless Global (Switzerland) 195.15.0.0 - 195.15.255.255  ham1856 ([195.15.11.145])
:0
* ^Received:.*195\.15\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# IBM Global Services Bedford, NH 32.0.0.0 - 32.255.255.255 hamay ([32.94.114.3]
:0
* ^Received:.*\[32\.[0-9]+\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Koc.net country: Turkey  212.115.0.0 - 212.115.6.255 compaq.com.tr ([212.115.5.26])
:0
* ^Received:.*212\.115\.[0-6]\.[0-9]+
JunkMail.$TODAY

# Verio, Inc. Englewood, CO  209.39.0.0 - 209.39.255.255  bydomino.com ([209.39.13.171])
:0
* ^Received:.*209\.39\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Capital Area Internet Service Mclean, VA 205.252.0.0 - 205.252.255.255 netvigator.com [205.252.144.55]
:0
* ^Received:.*205\.252\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# China Telecom Shanghai  61.169.0.0 - 61.171.255.255 [61.170.130.217]
:0
* ^Received:.*\[61\.(169|17[0-1])\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# CAnet  205.211.0.0 - 205.211.255.255
#  Healthlink Clinical Data Network 205.211.160.0 - 205.211.160.255  uhnsmtp.uhn.on.ca ([205.211.160.40])
:0
* ^Received:.*205\.211\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# palm developer program postdirect.com (c4g1.postdirect.com [64.14.218.153])

# Exodus Communications  64.14.0.0 - 64.14.255.255 postdirect.com [64.14.218.124]
#:0
#* ^Received:.*\[64\.14\.[0-9]+\.[0-9]+
#JunkMail.$TODAY

############################################
# valid Bert van den Berg  cyberus.ca [216.191.240.111]
:0:
* ^Received:.*216\.191\.240\.111
$ORGMAIL
# MetroNet Communications Group Toronto 216.191.0.0 - 216.191.255.255 mightymaxcorp.com ([216.191.140.90]
:0
* ^Received:.*216\.191\.[0-9]+\.[0-9]+
JunkMail.$TODAY
############################################

# Webvisions Pte SG 202.157.153.0 - 202.157.153.255 [202.157.153.2]
:0
* ^Received:.*202\.157\.153\.[0-9]+
JunkMail.$TODAY

# Global Crossing 64.208.0.0 - 64.215.255.255
# Lifeline Data Center 64.215.152.0 - 64.215.152.255 [64.215.152.22]
:0
* ^Received:.*\[64\.(20[8-9]|21[0-5])\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Nildram ADSL Accounts 213.208.127.0 - 213.208.127.255 gotadsl.co.uk [213.208.127.246]
:0
* ^Received:.*213\.208\.127\.[0-9]+
JunkMail.$TODAY

#  XI'AN DATA BUREAU CN 61.134.3.0 - 61.134.20.95 dtwx.com.cn ([61.134.9.52])
:0
* ^Received:.*\[61\.134\.([3-9]|1[0-9]|20)\.[0-9]+
JunkMail.$TODAY

# Concentric Network Corporation 64.220.0.0 - 64.221.255.255 chi-il.dsl.cnc.net [64.221.68.36]
:0
* ^Received:.*\[64\.22[0-1]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# DEBIS-SYSTEMHAUS-AUSTRIA  212.31.88.0 - 212.31.95.255
#  NETHOTELS-AUSTRIA 212.31.85.128 - 212.31.85.159 [212.31.85.146]
:0
* ^Received:.*212\.31\.(8[8-9]|9[0-5])\.[0-9]+
JunkMail.$TODAY

# Level 3 Communications, Inc. US  209.244.0.0 - 209.247.255.255 [209.247.166.227]
:0
* ^Received:.*209\.24[4-7]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

#  Les Collines de l'Arche - Opera C France 213.56.195.0 - 213.56.195.255 scolagora.com [213.56.195.34]
:0
* ^Received:.*213\.56\.195\.[0-9]+
JunkMail.$TODAY

# Pacific Bell  206.13.0.0 - 206.13.127.255 .snfc21.pbi.net [206.13.28.241]     wide
:0
* ^Received:.*206\.13\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# concentric.net Concentric Network Corporation  207.155.128.0 - 207.155.255.255 [207.155.198.79]     wide
:0
* ^Received:.*207\.155\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# cybercable.tm.fr 195.132.0.0  - 195.132.0.255  (195.132.0.241) 
# cybercable.tm.fr 195.132.16.0 - 195.132.16.255
# Dual Ingenering  FR 195.132.5.136 - 195.132.5.138 dual-ingenierie.fr [195.132.5.136]     wide
:0
* ^Received:.*195\.132\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# TMnet Telekom Malaysia  202.188.0.0 - 202.188.255.255 .edu.my ([202.188.113.3]
:0
* ^Received:.*202\.188\.[0-9]+\.[0-9]+
JunkMail.$TODAY

####################################
# UUNET  208.192.0.0 - 208.255.255.255
# Innerhost, Inc  208.238.102.0 - 208.238.102.255 ns1.ascend.net [208.238.102.48])
:0
* ^Received:.*208\.(19[2-9]|2[0-5][0-9])\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# UUNET Singapore 202.95.96.0 - 202.95.127.255 stts.com.sg [202.95.121.178]
:0
* ^Received:.*202\.95\.(9[6-9]|10[0-9]|11[0-9]|12[0-7])\.[0-9]+
JunkMail.$TODAY

# UUNET, a WorldCom Company France 194.98.0.0 - 194.98.0.255 carlcox.iway.fr [194.98.0.128])    wide
:0
* ^Received:.*194\.98\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# UUNET  63.64.0.0 - 63.127.255.255 
#  Neucom  63.114.40.64 - 63.114.40.95 corprelay.com ([63.114.40.92]
:0
* ^Received:.*\[63\.(6[4-9]|[7-9][0-9]|1[0-1][0-9]|12[0-7])\.[0-9]+\.[0-9]+ 
JunkMail.$TODAY

# UUNET Canada  204.92.0.0 - 204.92.255.255
#  W2P2 Technologies 204.92.52.0 - 204.92.52.255 logik-net.com [204.92.52.182]

# valid travel-net
:0:
* ^Received:.*204\.92\.71\.26\]
$ORGMAIL

:0
* ^Received:.*204\.92\.[0-9]+\.[0-9]+
JunkMail.$TODAY
####################################

# StarSoft Ltd. Ternopil UA 212.109.59.232 - 212.109.59.239 networkacad.net [212.109.59.234]    wide
:0
* ^Received:.*212\.109\.59\.[0-9]+
JunkMail.$TODAY

# DE deutscheland POP Point of Presence 195.222.192.0 - 195.222.255.255 KIESSLING.COM ([195.222.214.198]   wide
:0
* ^Received:.*195\.222\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# ICNT Inc.  216.70.128.0 - 216.70.191.255     wide
#   Kwong Quest 216.70.155.0 - 216.70.155.31 Benwin.com ([216.70.155.4]
:0
* ^Received:.*216\.70\.[0-9]+\.[0-9]+
JunkMail.$TODAY

#Custom service Skopje, Macedonia 195.26.131.192 - 195.26.131.223 makcis.customs.gov.mk ([195.26.131.194])     wide
:0
* ^Received:.*195\.26\.131\.[0-9]+
JunkMail.$TODAY

# Telefonica del Peru S.A.A.  200.48.0.0 - 200.48.255.255
#  Chart Internet Courier 200.48.149.96 - 200.48.149.127 scharff.com.pe [200.48.149.98]
:0
* ^Received:.*200\.48\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Pacific Bell Internet Services,Inc. 209.232.0.0 - 209.233.255.255
#  Forsyte Tech Inc  209.232.78.224 - 209.232.78.231 foresyte.com [209.232.78.226]
:0
* ^Received:.*209\.23[2-3]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Southwestern Bell Internet Services 216.60.0.0 - 216.63.255.255
# Pen Virginia   216.62.190.0 - 216.62.190.127 pvawest.com [216.62.190.3]
# valid? 216.61.218.6  tcworks.net  
:0
* ^Received:.*216\.6[0-3]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Cyber Internet Pakistan  202.163.96.0 - 202.163.127.255 cyber.net.pk ([202.163.96.133]    wide
:0
* ^Received:.*202\.163\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Indosat 202.155.32.0 - 202.155.63.255 indosat.net.id [202.155.50.3]     wide
:0
* ^Received:.*202\.155\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Netherlands  CS Net bv  194.69.16.0 - 194.69.31.255 hypotheekshop.nl [194.69.17.37]     wide
:0
* ^Received:.*194\.69\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# BBN Planet  Cambridge, MA 02138 US  4.0.0.0 - 4.255.255.255 dsl.gtei.net [4.42.116.201]
#valid? washdc3-ar2-4-60-196-160.vz.dsl.gtei.net [4.60.196.160])
:0
* ^Received:.*\[4\.[0-9]+\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Level 3 Communications, Inc. Colorado US 64.152.0.0 - 64.159.255.255 relayerone.com ([64.156.25.130]
:0
* ^Received:.*\[64\.15[2-9]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# iAsiaWorks(H.K.)Ltd.  202.77.144.0 - 202.77.147.255  stanley.com.hk ([202.77.146.2]
:0
* ^Received:.*202\.77\.14[4-7]\.[0-9]+
JunkMail.$TODAY

# Advance Telecomunicaciones Argentina 209.13.0.0 - 209.13.255.255 [209.13.96.98]
:0
* ^Received:.*209\.13\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Qwest Communications  216.111.0.0 - 216.111.255.255
# INTEGRATED AIRLINE SERVICES 216.111.8.0 - 216.111.8.31 iasair.com ([216.111.8.29]
:0
* ^Received:.*216\.111\.[0-9]+\.[0-9]+
JunkMail.$TODAY

#  Lyonnaise Communications 195.132.184.0 - 195.132.187.255 .cybercable.tm.fr [195.132.184.219])
:0
* ^Received:.*195\.132\.18[4-7]\.[0-9]+
JunkMail.$TODAY

# ATLAS CZ 212.47.13.0 - 212.47.13.255  cuk.a2.atlas ([212.47.13.61])
:0
* ^Received:.*212\.47\.13\.[0-9]+
JunkMail.$TODAY

# TRIBUS France  213.56.82.240 - 213.56.82.247  bolet ([213.56.82.242])
:0
* ^Received:.*213\.56\.82\.24[0-7]+
JunkMail.$TODAY

#  Access Vantage ON CA 209.188.64.0 - 209.188.95.255 [209.188.73.194]
:0
* ^Received:.*209\.188\.(6[4-9]|[78][0-9]|9[0-5])\.[0-9]+
JunkMail.$TODAY

# Pacific Bell 216.100.0.0 - 216.103.255.255
#   Los Angeles Weekly  216.100.184.0 - 216.100.191.255  tritech.org [216.100.185.130]
:0
* ^Received:.*216\.10[0-3]\.[0-9]+\.[0-9]+
JunkMail.$TODAY
      
# Business Internet  FL US 216.0.0.0 - 216.5.255.255 freyimaging.com [216.0.233.2]
:0
* ^Received:.*216\.[0-5]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

#-----------------------------------------------------------------
# valid earthlink mail site:
# from harrier.mail.pas.earthlink.net (harrier.mail.pas.earthlink.net [207.217.121.12])
# Received: from infi.net (dialup-64.157.57.130.Dial1.Washington1.Level3.net [64.157.57.130])

#-----------------------------------------------------------------
# Astra Infonets (Pvt) Ltd  Hitech City, Madhapur, Hyd  India   202.125.80.0 - 202.125.95.255 ispacesoftware.com ([202.125.80.50]  wide
:0
* ^Received:.*202\.125\.[0-9]+\.[0-9]+
JunkMail.$TODAY

####################################################################
# @Home is not so quick to stop its customers from spamming.

# @Home 24.36.0.0 - 24.39.255.255 taylor1.mi.home.com [24.36.112.45]
:0
* ^Received:.*\[24\.3[6-9]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# @Home 24.176.0.0 - 24.183.255.255
#       24.181.224.0 - 24.181.255.255 mi.home.com [24.181.229.86]
:0
* ^Received:.*\[24\.(17[6-9]|18[0-3])\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# @Home216.216.0.0 - 216.217.255.255
# Asyst Data Group, 216.217.21.0 - 216.217.21.255 server.beegroup.com ([216.217.21.80]
:0
* ^Received:.*216\.21[67]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# valid: sonicboom.org (cx175057-a.ocnsd1.sdca.home.com [24.13.23.40])
:0:
* ^Received:.*\[24\.13\.23\.40\]
$ORGMAIL


#############################################################
# Sprint 65.160.0.0 - 65.174.255.255
# APPLICATIONS SALES 65.168.244.0 - 65.168.244.255 creditfix.net ([65.168.244.13])
:0
* ^Received:.*65\.(16[0-9]|17[0-4])\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Sprint ION   64.133.0.0 - 64.133.127.255     wide
#       Physiotherapy Associ.  64.133.6.8 - 64.133.6.15 [64.133.6.10]
:0
* ^Received:.*64\.133\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# US SPRINT 205.160.0.0 - 205.163.255.255 
# GAMETECH INTL  205.162.156.0 - 205.162.156.255 [205.162.156.22]
:0
* ^Received:.*205\.16[0-3]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# valid dcms.com (c633906-a.ptbrg1.sfba.home.com [24.0.84.161]
:0:
* ^Received:.*24\.0\.84\.161
$ORGMAIL

# valid jfreylt ([24.5.212.46]
# valid silby.com (cb34181-a.mdsn1.wi.home.com [24.14.173.39])

# Intelligent Communications  24.142.0.0 - 24.142.255.255
#   Moffat Communications - Doral 24.142.218.0 - 24.142.220.255 [24.142.219.17]
# Sprint BWG    24.221.0.0 - 24.221.255.255
#   SPEEDCHOICE   24.221.176.0 - 24.221.191.255 sprintbbd.net [24.221.183.79]
#
# @Home 24.0.0.0 - 24.23.255.255 wa.home.com [24.19.204.159]
:0
* ^Received:.*\[24\.([0-9]|1[0-9]|2[0-3])\.[0-9]+\.[0-9]+
JunkMail.$TODAY
####################################################################

####################################################################
#-----------------------------------------------------------------
# valid sites in the sprint block:
# net-kitchen.com [208.13.57.206]
# Wintek Corporation 208.13.56.0 - 208.13.63.255
:0:
* ^Received:.*208\.13\.(5[6-9]|6[0-3])\.[0-9]+
$ORGMAIL

# Sprint  208.0.0.0 - 208.35.255.255
#   MAIL BOXES ETC 208.16.219.0 - 208.16.219.255 MBE3784 ([208.16.219.10]
:0
* ^Received:.*208\.([0-2][0-9]|3[0-5])\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# VANDERBILT INTERNATIONAL Sprint 63.167.188.176 - 63.167.188.191 [63.167.188.185]
:0
* ^Received:.*\[63\.167\.188\.(17[6-9]|18[0-9]19[01])
JunkMail.$TODAY

# sprint alliance webcommerce
:0
* ^Received:.*207\.107\.10\.[0-9]+
JunkMail.$TODAY
#####################################################################


# NIC-Mexico (NETBLK-REDMEX-BNETS)REDMEX-BNETS     148.203.0.0 - 148.250.255.255     wide
#      UniNet S.A. de C.V. (NETBLK-UNINET-NETBLK9) UNINET-NETBLK9 148.233.0.0 - 148.233.255.255 telmex.net.mx dm.com.mx [148.233.131.229]
:0
* ^Received:.*148\.2[0-9][0-9]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

#NTS Communications  lubbock, TX 216.167.128.0 - 216.167.191.255 [216.167.177.72]    wide
:0
* ^Received:.*216\.167\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Concentric San Jose, CA 206.173.0.0 - 206.173.255.255
:0
* ^Received:.*206\.173\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Farpost inc.  Vladivostok, Russia 212.107.197.32 - 212.107.197.47      wide
:0
* ^Received:.*212\.107\.197\.[0-9]+
JunkMail.$TODAY

# Verio, Inc. Englewood, CO  168.143.0.0 - 168.143.255.255 switchgrass.net[168.143.160.77] 
:0
* ^Received:.*168\.143\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Verio, Inc. Englewood, CO  209.189.0.0 - 209.189.127.255 [209.189.73.39]    wide
:0
* ^Received:.*209\.189\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Angkasa Pura Indonesia  202.152.6.32 - 202.152.6.63 angkasapura2.co.id ([202.152.6.34]      wide
:0
* ^Received:.*202\.152\.6\.[0-9]+
JunkMail.$TODAY

# CANTV Servicios, Venezuela 200.44.0.0 - 200.44.159.255
# SEGUROS LOS ANDES 200.44.57.208 - 200.44.57.223 aaasa.net ([200.44.57.210]
:0
* ^Received:.*200\.44\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Easynet Group PLC 195.40.196.0 - 195.40.203.255  easynet.co.uk [195.40.201.229]     wide
:0
* ^Received:.*195\.40\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# US WEST - Interact Internet Services 209.180.0.0 - 209.181.255.255
# financier.com joslenregion.com [209.180.167.97])
:0
* ^Received:.*209\.180\.[0-9]+\.[0-9]+
JunkMail.$TODAY


# Nepustil.NET 194.55.100.0 - 194.55.101.255  falkenburger.com [194.55.100.8]
# Dr.-Ing. Nepustil
# Internet Service Center und Ingenieurbuero fuer Systemsoftware und Kommunikationstechnik
:0
* ^Received:.*194\.55\.10[01]\.[0-9]+
JunkMail.$TODAY

# ONTel Ontario 209.105.192.0 - 209.105.223.255  [209.105.201.234]     wide
:0
* ^Received:.*209\.105\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Daewoo Auto trading dwat.ro ROMANIA   193.226.156.0 - 193.226.156.255  [193.226.156.10]
:0
* ^Received:.*193\.226\.156\.[0-9]+
JunkMail.$TODAY

########################################
# valid  pool-141-155-157-72.ny5030.east.verizon.net (HELO meyer.westegg.com) (141.155.157.72)

# bellatlantic.net  141.149.0.0 - 141.158.255.255 [141.151.142.25]
:0
* ^Received:.*141\.(149|15[0-8])\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# WiBand Winnipeg 64.56.128.0 - 64.56.143.255 [64.56.142.130]       wide
:0
* ^Received:.*\[64\.56\.[0-9]+\.[0-9]+
JunkMail.$TODAY

##########################################
# valid ip174.gte12.rb1.bel.nwlink.com [207.202.147.174]
:0:
* ^Received:.*207\.202\.147\.174
$ORGMAIL

# IDT Corporation  207.202.0.0 - 207.202.127.255      wide
# Lipo Chemicals  207.202.46.192 - 207.202.46.255 [207.202.46.253]
:0
* ^Received:.*207\.202\.[0-9]+\.[0-9]+
JunkMail.$TODAY
#########################################

# Pacific Bell Internet Services 207.212.0.0 - 207.215.255.255      wide
# MainNet  207.214.160.0 - 207.214.163.255 [207.214.160.223]
:0
* ^Received:.*209\.150\.[0-9]+\.[0-9]+
JunkMail.$TODAY
     
# Quantum Internet Services US 209.150.96.0 - 209.150.127.255     wide
# brennanlawyers.com [209.150.98.222]
:0
* ^Received:.*209\.150\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# HongKong Commercial Internet Exchange  202.181.192.0 - 202.181.223.255 [202.181.196.213]     wide
:0 
* ^Received:.*202\.181\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Great Works Internet 207.5.128.0 - 207.5.255.255     wide
#     Susquenhanna Communications  207.5.224.0 - 207.5.239.255 bennettengineering.net suscom-maine.net [207.5.232.31]
:0
* ^Received:.*207\.5\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# RITEX interbusiness.it  213.26.68.0 - 213.26.68.63 [213.26.68.5]   wide
:0
* ^Received:.*213\.26\.68\.[0-9]+
JunkMail.$TODAY

# NEXTLINK Communications nextlink.net [64.50.122.34]  64.50.0.0 - 64.50.127.255  wide
# Vacation Homes Las Vegas 64.50.122.32 - 64.50.122.47
:0
* ^Received:.*\[64\.50\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Kivex [209.193.206.10]   209.193.128.0 - 209.193.255.255    wide
#     Wilkinson, Barker, Knauer & Quinn, LLP   209.193.206.0 - 209.193.206.127
:0
* ^Received:.*209\.193\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Technotrade Germany  212.185.75.112 - 212.185.75.119 e-centrum.net [212.185.75.114]
# (212.185.75.11[2-9)
# Deutsche Telekom 212.185.0.0/16
:0
* ^Received:.*212.185\.[0-9]+\.[0-9]+
JunkMail.$TODAY
        
# COLT FRANCE  213.41.78.0 - 213.41.78.255 fr.colt.net [213.41.78.25]
:0
* ^Received:.*213\.41\.78\.[0-9]+
JunkMail.$TODAY

# epix Internet Services 209.74.0.0 - 209.74.63.255 dayton parts daytonparts.com [209.74.1.161]  wide
:0
* ^Received:.*209\.74\.[0-6][0-9]\.[0-9]+
JunkMail.$TODAY

#  AT&T Canada netcom.ca  216.129.0.0 - 216.129.95.255 [216.129.73.101])   wide
:0
* ^Received:.*216\.129\.[0-9][0-9]\.[0-9]+
JunkMail.$TODAY

##########################
# pacbell.net Seagate Machining  64.160.0.0 - 64.175.255.255 [64.165.222.218]

# valid (mta7.pltn13.pbi.net [64.164.98.8]) andrew
:0:
* ^Received:.*64\.164\.98\.8
$ORGMAIL

# valid: pure-chaos Andrew Edelstein
:0:
* ^Received:.*\[64\.166\.2\.237
$ORGMAIL

:0
* ^Received:.*\[64\.(16[0-9]|17[0-5])\.[0-9]+\.[0-9]+
JunkMail.$TODAY
##########################
        
# APEX Network Technology Corporation Taiwan     202.143.128.0 - 202.143.159.255  [202.143.135.3]   wide
:0
* ^Received:.*202\.143\.1[0-9][0-9]\.[0-9]+
JunkMail.$TODAY

# Nerim ISP France  castelis.com  [62.4.23.23] 62.4.21.0 - 62.4.23.255
:0
* ^Received:.*\[62\.4\.2[123]\.[0-9]+
JunkMail.$TODAY

# Euronet Digital Communications (Israel)   192.114.160.0 - 192.114.191.255  [192.114.186.14]
:0
* ^Received:.*192\.114\.(1[6-8][0-9]|19[01])\.[0-9]+
JunkMail.$TODAY

#  SCUDELETTI-FABIO IT  217.56.37.176 - 217.56.37.191 [217.56.37.181]
:0
* ^Received:.*217\.56\.37\.(17[6-9]18[0-9]|19[01])
JunkMail.$TODAY

# Optilink Communications, Inc. US GA   216.128.128.0 - 216.128.207.255 [216.128.176.9]
:0
* ^Received:.*216\.128\.(12[89]|1[3-9][0-9]|20[0-7])\.[0-9]+
JunkMail.$TODAY

#   ZUT POZNAN  212.160.103.0 - 212.160.103.127 zut.pl ([212.160.103.5])   wide
:0
* ^Received:.*212\.160\.103\.[0-9]+
JunkMail.$TODAY

# Essential Services  SKYPORT US-FL europort.net [216.169.96.24] 216.169.96.0 - 216.169.127.255
:0
* ^Received:.*216\.169\.(9[6-9]|10[0-9]|11[0-9]|12[0-7])\.[0-9]+
JunkMail.$TODAY
      
# Internet Allegiance, Inc. worldcell.com [64.48.62.244]  64.48.0.0 - 64.48.255.255
:0
* ^Received:.*\[64\.48\.[0-9]+\.[0-9]+
JunkMail.$TODAY
       
# PSINet Mexico SA de CV www.ctaragon.com.mx [200.39.119.4]    200.39.112.0 - 200.39.127.255
:0
* ^Received:.*200\.39\.(11[2-9]|12[0-7])\.[0-9]+
JunkMail.$TODAY

# xcien.com  UNETE.COM SA de CV Mexico [200.53.211.194] 200.53.160.0 - 200.53.223.255   wide
:0
* ^Received:.*200\.53\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Combined Transport Ltd [194.203.21.165]  194.203.21.160 - 194.203.21.175
:0
* ^Received:.*194\.203\.21\.(16[0-9]|17[0-5])
JunkMail.$TODAY

#  FR-CLINIQUE-DES-LILAS CLINIQUE DES LILAS
:0
* ^Received:.*194\.250\.97\.194
JunkMail.$TODAY

# JOHN JANSEN 64.163.237.152 - 64.163.237.159
:0
* ^Received:.*\[64\.163\.237\.15[2-9]
JunkMail.$TODAY

#  Videsh Sanchar Nigam Ltd - India.  valcare.com
:0
* ^Received:.*203\.197\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# DSL.net, Inc. (NETBLK-DSLNET-5)
:0
* ^Received:.*\[64\.20[45]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Infocom, Inc. (NETBLK-UU-208-247-88) UU-208-247-88  M. Fabrikant & Sons
:0
* ^Received:.*208\.247\.8[89]\.[0-9]+
JunkMail.$TODAY

# italian isp 195.110.96.0 - 195.110.127.255
:0
* ^Received:.*195\.110\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# University of Mannheim  uni-heidelberg.de
:0
* ^Received:.*134\.155\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Telefonica del Peru
:0
* ^Received:.*200\.37\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# shaw  24.64.0.0 - 24.71
:0
* ^Received:.*\[24\.(6[4-9]|7[12])\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# telocity.com 64.192 .. 195
# valid?orwell.monkeys-boning.apt (dsl-64-192-101-81.telocity.com [64.192.101.81])
:0
* ^Received:.*\[64\.19[2-5]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# inoquest
:0
* ^Received:.*\[63\.109\.115\.[0-9]+
JunkMail.$TODAY

# 01.com  
:0
* ^Received:.*\[66\.81\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# aussie Telstra.net
:0
* ^Received:.*139\.130\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Web Air Internet Development (supersphere)
:0
* ^Received:.*209\.10\.24[67]\.[0-9]+
JunkMail.$TODAY

# Performance Systems International (NET-PSINETA)
#  510 Huntmar Park Drive
#  Herndon, VA  22070
#  The valid mail exchange: (hvmta02-ext.us.psimail.psi.net )
:0:
* ^Received:.*\[38\.202\.36\.30
$ORGMAIL
#
# all other psi mail is likely spam:
:0
* ^Received:.*\[38\.[0-9]+\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Shanghai Fengxian Telecom Bureau  202.101.8.0 - 202.101.8.127  wide
:0
* ^Received:.*202\.101\.8\.[0-9]+
JunkMail.$TODAY

# Development Research Center of the
# State Councile of China
:0
* ^Received:.*202\.106\.171\.[0-9]+
JunkMail.$TODAY

# Flip Forward, Inc.   216.198.192.0 - 216.198.192.31  wide
:0
* ^Received:.*216\.198\.192\.[0-9]+
JunkMail.$TODAY

# CYRUNNER   216.49.96.0 - 216.49.111.255   wide
:0
* ^Received:.*216\.49\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Blue Star Communications
:0
* ^Received:.*\[64\.18[23]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Korea Network Information Center
# 211.32.0.0 - 211.39.255.255
# 211.40.0.0 - 211.41.255.255
# 211.41.0.0 - 211.51.255.255
# 211.52.0.0 - 211.63.255.255
#
# 211.168.0.0 - 211.171.255.255
# 211.172.0.0 - 211.199.255.255
#(aussie blocks in between)
:0
* ^Received:.*211\.[0-9]+\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Hookup Oshawa
:0
* ^Received:.*165\.154\.[0-9]+\.[0-9]+
JunkMail.$TODAY


# Asia Pacific 210, 211
#valid  acidic.ars.org) (210.186.207.91)
:0
* ^Received:.*21[01]\.[0-9]+\.[0-9]+\.[0-9]+                     
JunkMail.$TODAY

# THAINET university 202.28.0.0 - 202.29.255.255
:0
* ^Received:.*202.2[89]\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# CHINANET Jiangsu province network
# Data Communication Division
# China Telecom  61.132.0.0 - 61.132.127.255   wide
:0
* ^Received:.*\[61\.132\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# E C GEIGER FLORISTS SUPPLIES  12.104.32.0 - 12.104.32.15  wide
:0
* ^Received:.*\[12\.104\.32\.[0-9]+
JunkMail.$TODAY

# Brickwell Business Machines  208.241.109.0 - 208.241.109.31   wide
:0
* ^Received:.*208\.241\.109\.[0-9]+
JunkMail.$TODAY

# CONCENTRIC 64.0.0.0 - 64.3.255.255
:0
* ^Received:.*\[64.[0123]\.[0-9]+\.[0-9]+\.[0-9]+
JunkMail.$TODAY

# Ronco
:0
* ^Received:.*\[63\.70\.62\.[0-9]+  
JunkMail.$TODAY  

# Cannect Communications    64.16.0.0 - 64.16.63.255
#     Via Vid Broadcasting  64.16.44.0 - 64.16.44.31
:0
* ^Received:.*\[64\.16\.44\.[0-9]+
JunkMail.$TODAY

# DUSE SRL interbusiness.it 194.243.114.192 - 194.243.114.255  wide
:0
* ^Received:.*194\.243\.114\.[0-9]+
JunkMail.$TODAY


####################################################################
# valid sites in the Cable & Wireless block:
# icti-usa.com  206.142.7.128 - 206.142.7.191  [206.142.7.145]
#:0:
#* ^Received:.*()
#$ORGMAIL

# Cable & Wireless, Inc.  206.142.0.0 - 206.142.255.255
# but no spam yet
#:0
#* ^Received:.*206.142\.[0-9]+\.[0-9]+
#JunkMail.$TODAY
####################################################################


##########################

# Thanks to Pegasus mail, we have this:

:0
* ^X-Distribution: (moderate|bulk|mass)
JunkMail.$TODAY

# And if anyone is using Floodgate, he deserves a quick death, too

:0
* ^X-Mailer: (Floodgate|Emailer)
JunkMail.$TODAY

:0
* ^From:.*Floodgate
JunkMail.$TODAY

:0
* ^X-Sender: .*bizpromote
JunkMail.$TODAY

:0
* ^X-Advertis[e]*ment: .*removal
JunkMail.$TODAY
:0

* ^X-Advertis[e]*ment: .*address blocking
JunkMail.$TODAY

:0
* ^X-Advertis[e]*ment: .*bulk email
JunkMail.$TODAY

:0
* ^X-Authentication-Warning: didn't use HELO protocol
JunkMail.$TODAY

# Tricky headers from Cyber Promotions and other assholes...

:0
* ^X-[0-9]+:.*(cyberpromo|quantcom)\.com
/dev/null

:0
* ^X-[0-9]+:.*www\.iemmc\.org
/dev/null

:0
* ^X-[0-9]+:.*lostvegas
/dev/null


##################################
# Procmail mailing lists
:0
* ^TOprocmail
PROCMAIL

#:0 
#* ^To:.*procmail
#PROCMAIL
#:0 
#* ^Cc:.*procmail
#PROCMAIL


##################################
# The Country Filter
# I have found that spam blocking by country is ineffective, and I recommend that instead 
# you use spambouncer.
# This list of countries was an experiment at spam blocking, as most of my spam was coming
# from them and at the time I did not have any correspondents from them.  Most of these
# countries are not a big source of spam, and are (on balance) good guys.
# However, some of these countries send so much spam that you would think that they just
# don't understand netiquette.  China! Korea!
:0
* ^(Received|From):.*\.(kr|hu|tw|ru|cn|br|jp|pt|cz|cl|gr|es|it|cc|th|pl|ro|mo)\>
JunkMaybe.$TODAY 

##################################
:0:
*       Content-Type: text/html
{
        :0 B:
        *