sb-rogue.rc

这是一个从音频信号里提取特征参量的程序

# Ambrose, Gary (cashfromhome.com)
#
# Updated and domains verified 5/02/02
# Last reported spam: 3/15/02
# Other Relevant Info:
#    5/02/02: Apparent reappearance as sendco.com/ultimatebizsource.com
#    6/18/99: Hullaballoo in news.admin.net-abuse.email over Ambrose's
#     abuse of Aureate Group Mail to send spam. :(
#    7/12/99: At home at Covesoft.  Figures. :(  (Covesoft is another
#     long-term net abuser.)
#    5/22/00: Now peddling spamware via wahju.com and stas.net. :/
#    6/10/00: Reportedly spamming for various other spamhouses via
#     throwaway accounts, etc.  This filter only catches spam referring
#     to his own sites.  He's responsible for plenty more.
# Status: Active Spammer
#
:0 BH
* LEANTAG ?? no
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*   800^0   ^(From|Reply-To):.*ads_4less@yahoo\.com([^a-z0-9\.]|$)
*   800^0   ^Received:.*from workathome([^a-z0-9\.]|$)
*   800^0   ^Subject: .*Your Business Opportunity Ad
*  1100^1    (^|[^-_0-9a-z])cashfromhome\.com([^a-z0-9\.]|$)
*  1100^1    (^|[^-_0-9a-z])sendco\.com([^a-z0-9\.]|$)
*  1100^1    (^|[^-_0-9a-z])ultimatebizsource\.com([^a-z0-9\.]|$)
*  1100^1    (^|[^-_0-9a-z])workathomenews\.com([^a-z0-9\.]|$)
*   500^1    (^|[^-_0-9a-z])CashFromHome([^a-z0-9\.]|$)
{
:0 f
| ${FORMAIL} -A"X-SBRule: Gary Ambrose"

:0
{ SPAMTAG=yes }

:0
* SRC ?? yes
* !ADMINTAG ?? yes
* !BULKTAG ?? yes
 {
 :0
 { SPAMPID=`echo $$` }

 :0 c:
 spamtemp.${SPAMPID}

 :0 c: spamtemp.${SPAMPID}.lock
 | (${FORMAIL} -rt \
    -I"From: ${ALTFROM}" \
    -I"To: [e-mail],[e-mail],[e-mail],[e-mail]" \
    -A"Cc: [e-mail],[e-mail],[e-mail]" \
    -A"X-Loop: ${NOLOOP}";\
    cat ${SBDIR}/spam;\
    cat spamtemp.${SPAMPID};\
    ${RM} -f spamtemp.${SPAMPID}) \
    | ${SENDMAIL} -oi -t
 }

:0
* SRB ?? yes
 { BOUNCETHIS=yes }
}


# BSB Publishing Co./"BRP Group"
#
# Updated and domains verified 9/10/02
# Last reported spam:  9/10/02
# Other Relevant Info:
#  
#  4/12/98:
#   Extremely prolific Chicago-area spammer who targets books
#   to a black male audience claiming to help them deal with
#   black women. :/  Has recently expanded into offering spamming
#   mailing lists of black people.  (The lists aren't very
#   accurate -- I'm on them and I am both female and white.) :>
#   Extremely persistent and obnoxious, has been kicked off of
#   many ISPs already.
#
#  8/20/02:
#   Still extremely prolific, but over the years has morphed
#   into a seller of general purpose "targeted email lists",
#   that probably are not targeted.  I'm sure it's the same
#   person because the morph has been slow, and at each step
#   the same methodologies were used and same spamtrap addresses
#   were targeted, in a combination no other spammer ever used.
#
#  9/10/02:
#   Spamming from attbi.com with forged From: line claiming to be
#   coming from amazon.com. :/  These despicable slimeballs have
#   no shame.
#
# Status: Active Spammer
#
:0
* ^((From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](BlackRealityPublishing\.com([^a-z0-9\.]|$)|\
          theBRPgroup|\
          bsbpub|\
          BSB.*Publishing.*Co)|\
    Subject:.*Lists: (Publicity|Libraries|Bookstores|Film Producers|Art Galleries|Record Stores)|\
    Subject:.*400,000 African American Contacts)
{ BSBPUB=yes }

:0
* !BSBPUB ?? yes
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z](MarketingProducts0[0-9]*@yahoo\.com|\
          \[\[\[Marketing-Products\]\]\]|\
          MediaAndMore0[0-9]*@yahoo\.com|\
          PublicityTools0[0-9]*@yahoo\.com)([^a-z0-9\.]|$)
* !^Received: from yahoo\.com \(.*yahoo\.com
{ BSBPUB=yes }

:0
* LEANTAG ?? no
* !BSBPUB ?? yes
{
 :0 BH
 * !^Subject: .*\(fwd\)
 * !--.*forwarded message --
 * !^forwarded message:
 * !^-----BEGIN PGP SIGNED MESSAGE-----
 * -1000^0
 *  -500^0   ^Subject: Re:
 *  -200^1   ^[:;#>]
 *   800^0   ^Subject: .How To Juggle Women
 *   800^0   ^Subject: .Brothers Beware
 *   200^0   ^Subject: .*African American
 *   600^0   ^Subject: .[1-9]00?,000 African American
 *   600^0   ^Subject: .*\% off African American
 *   300^1    Sisters are saying
 *   300^1    Brothers are saying
 *   500^1    Games Black Women Play
 *   500^1    (women|sisters).*burn this book
 *   500^1    Without Getting Killed or Going Broke
 *   500^1    African American Email Addresses
 *   500^1    African American Entrepreneur
 *   500^1    Boyd E\. Graves
 *   500^1    Boyd Ed Graves
 *   500^1    AIDS research logic Flow Chart
 *   500^1    ISBN:.*0-9658299-4-4
 *   500^1    ISBN:.*0-9707735-1-X
 *   800^1    800[-\. )]*305[-\. ]*1458
 *   800^1    800[-\. )]*721[-\. ]*5934
 *   800^1    800[-\. )]*830[-\. ]*2047
 *   800^1    888[-\. )]*330[-\. ]*4919
 *   800^1    800[-\. )]*993[-\. ]*151
 *   800^1    800[-\. )]*904[-\. ]*7912
 *   800^1    800[-\. )]*916[-\. ]*498
 *   800^1    900[-\. )]*961[-\. ]*354
 *   800^1    800[-\. )]*183[-\. ]*3902
 *   800^1    800[-\. )]*445[-\. ]*058
 *   800^1    800[-\. )]*301[-\. ]*207
 *   800^1    BlackRealityPublishing\.com
 *   800^1    boydgraves\.com([^a-z0-9\.]|$)
 *   800^1    brothersbeware\.com([^a-z0-9\.]|$)
 *   800^1    pulpitconfessions\.com([^a-z0-9\.]|$)
 *   800^1    BlklistRemoval@netscape\.net([^a-z0-9\.]|$)
 *   800^1    publicityremoval@netscape\.net([^a-z0-9\.]|$)
 *   800^1    sendlistinfo@netscape\.net([^a-z0-9\.]|$)
 { BSBPUB=yes }
}

:0
* BSBPUB ?? yes
{
 :0 f
 | ${FORMAIL} -A"X-SBRule: BSB Publishing/BRP Group"

 :0
 { SPAMTAG=yes }

 :0
 * SRC ?? yes
 * !ADMINTAG ?? yes
 * !BULKTAG ?? yes
 {
  :0
  { SPAMPID=`echo $$` }

  :0 c:
  spamtemp.${SPAMPID}

  :0
  { GRIPETO=[e-mail] }

  :0
  * ^Received:.*(^|[^0-9])(12\.37\.112\.[0-9]|12\.37\.112\.1[0-5])([^0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail],[e-mail] }

  :0
  * ^Received:.*(^|[^0-9])(24\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\
                           24\.99\.[0-9]\.[0-9][0-9]?[0-9]?|\
                           24\.99\.[1-7][0-9]\.[0-9][0-9]?[0-9]?)([^0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail] }

  :0
  * ^Received:.*(^|[^0-9])63\.238\.14[0-7]\.[0-9][0-9]?[0-9]?([^0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail] }

  :0
  * ^Received:.*(^|[^0-9])200\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?([^0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail] }

  :0
  * ^Received:.*(^|[^0-9])208\.31\.17[6-7]\.[0-9][0-9]?[0-9]?([^0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail] }

  :0
  * ^Received:.*(^|[^0-9])208\.160\.14[4-7]\.[0-9][0-9]?[0-9]?([^0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail],[e-mail],[e-mail],[e-mail] }

  :0
  * ^Received:.*(^|[^0-9])(209\.88\.5[6-9]\.[0-9][0-9]?[0-9]?|\
                           209\.88\.6[0-2]\.[0-9][0-9]?[0-9]?|\
                           cable\.net\.co)([^0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail],[e-mail],[e-mail] }

  :0 BH
  * (^|[^0-9a-z])aol\.com([^a-z0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail] }

  :0 BH
  * (^|[^0-9a-z])cp\.net([^a-z0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail] }

  :0 BH
  * (^|[^0-9a-z])hotmail\.com([^a-z0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail] }

  :0 BH
  * (^|[^0-9a-z])interbusiness\.it([^a-z0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail] }

  :0 BH
  * (^|[^0-9a-z])netscape\.net([^a-z0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail] }

  :0 BH
  * (^|[^0-9a-z])onebox\.com([^a-z0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail] }

  :0 BH
  * (^|[^0-9a-z])(lycos|mailcity)\.com([^a-z0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail] }

  :0 BH
  * (^|[^0-9a-z])rediffmail\.com([^a-z0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail],[e-mail] }

  :0 BH
  * (^|[^0-9a-z])whowhere\.(com|[a-z][a-z])\.?([a-z][a-z])?([^a-z0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail],[e-mail] }

  :0 BH
  * (^|[^0-9a-z])yahoo\.(com|[a-z][a-z])\.?([a-z][a-z])?([^a-z0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail] }

  :0 BH
  * (^|[^0-9a-z])ziplip\.com([^a-z0-9\.]|$)
  { GRIPETO=$GRIPETO,[e-mail],[e-mail],[e-mail],[e-mail] }

  :0 BH c: spamtemp.${SPAMPID}.lock
  | (${FORMAIL} -rt \
     -I"From: ${ALTFROM}" \
     -I"To: ${GRIPETO}" \
     -A"X-Loop: ${NOLOOP}";\
      echo " ";\
      echo "Attached is a spam from the BRP Group, previously known as BSB";\
      echo "Publishing.  These spammers send spam under email addresses";\
      echo "that contain the strings \"Marketing Products\", \"MediaAndMore\",";\
      echo "or \"Publicity Removal\" instead of using the company name,";\
      echo "to avoid spam filtering and blacklists.";\
      echo " ";\
      echo "They have also spammed as [e-mail], violating";\
      echo "Amazon's copyright and lying about their identity.";\
      echo " ";\
      echo "My spam filter automatically forwards these spams to the abuse";\
      echo "addresses at the ISPs from which the spam was sent, or where they";\
      echo "refer their spammees for more information.";\
      echo " ";\
      echo "Please close all accounts associated with this spam, and take any";\
      echo "other appropriate action.";\
      echo " ";\
      echo "=-=-=-=-=-=-=-=-=-=";\
      echo " ";\
      cat spamtemp.${SPAMPID};\
      ${RM} -f spamtemp.${SPAMPID}) \
      | ${SENDMAIL} -oi -t
 }

 :0
 * SRB ?? yes
 { BOUNCETHIS=yes }
}


# Cyberentertainment group
#
# Updated and domains verified 6/10/00
# Last reported spam:  5/08/00
# Other Relevant Info:
#    Porno spammers who put people on porno mailing lists and send
#    "confirmation" notices to find out if addresses are live.
#    1/25/00 -- *ssh*les forged a spam in the name of an Internet
#     greeting card company, with a URL link that displayed the
#     greeting card company's name, but linked to a hard core
#     porn web page run by the spammers. :(
# Status: Active Spammer
#
:0
* ^(From.|Reply-To:|Message-ID:|Received:).*[^0-9a-z].*(204\.178\.98\.[0-9]([^a-z0-9\.]|$)|\
          204\.178\.98\.[1-5][0-9]([^a-z0-9\.]|$)|\
          204\.178\.98\.6[0-3]([^a-z0-9\.]|$)|\
          204\.178\.107\.17[6-9]([^a-z0-9\.]|$)|\
          204\.178\.107\.18[0-9]([^a-z0-9\.]|$)|\
          204\.178\.107\.19[0-1]([^a-z0-9\.]|$)|\
          204\.178\.124\.([^a-z0-9\.]|$)|\
          208\.2\.8[0-3]\.|\
          208\.50\.1[6-7]\.|\
          badgirlsclub\.com([^a-z0-9\.]|$)|\
          britishbombshells\.com([^a-z0-9\.]|$)|\
          cyberentertainment\.(com|net)([^a-z0-9\.]|$)|\
          eroticeye\.com([^a-z0-9\.]|$)|\
          innovativecreations\.com([^a-z0-9\.]|$)|\
          pornzine\.com([^a-z0-9\.]|$)|\
          prettyinpink\.com([^a-z0-9\.]|$)|\
          privategold\.com([^a-z0-9\.]|$)|\
          puritansex\.com([^a-z0-9\.]|$)|\
          schoolgirls\.com([^a-z0-9\.]|$)|\
          sexcenterfolds\.com([^a-z0-9\.]|$)|\
          sexillustrated\.com([^a-z0-9\.]|$)|\
          threesomes\.com([^a-z0-9\.]|$)|\
          truly18\.com([^a-z0-9\.]|$)|\
          vixxens\.com([^a-z0-9\.]|$)|\
          xxasians\.com([^a-z0-9\.]|$))
{ CYBERENTERTAINMENT=yes }

:0 BH
* LEANTAG ?? no
* !^Subject: .*\(fwd\)
* !--.*forwarded message --
* !^forwarded message:
* !^-----BEGIN PGP SIGNED MESSAGE-----
* -1000^0
*  -500^0   ^Subject: Re:
*  -200^1   ^[:;#>]
*  1100^1   badgirlsclub\.com([^a-z0-9\.]|$)
*  1100^1   britishbombshells\.com([^a-z0-9\.]|$)
*  1100^1   cyberentertainment\.(com|net)([^a-z0-9\.]|$)
*  1100^1   eroticeye\.com([^a-z0-9\.]|$)
*  1100^1   innovativecreations\.com([^a-z0-9\.]|$)
*  1100^1   pornzine\.com([^a-z0-9\.]|$)
*  1100^1   prettyinpink\.com([^a-z0-9\.]|$)
*  1100^1   privategold\.com([^a-z0-9\.]|$)
*  1100^1   puritansex\.com([^a-z0-9\.]|$)
*  1100^1   schoolgirls\.com([^a-z0-9\.]|$)
*  1100^1   sexcenterfolds\.com([^a-z0-9\.]|$)
*  1100^1   sexillustrated\.com([^a-z0-9\.]|$)
*  1100^1   threesomes\.com([^a-z0-9\.]|$)
*  1100^1   truly18\.com([^a-z0-9\.]|$)
*  1100^1   vixxens\.com([^a-z0-9\.]|$)
*  1100^1   xxasians\.com([^a-z0-9\.]|$)
{ CYBERENTERTAINMENT=yes }

:0
* CYBERENTERTAINMENT ?? yes
{
:0 f
| ${FORMAIL} -A"X-SBRule: Cyberentertainment Group"

:0
{ SPAMTAG=yes }