# <<< ---NOTE--- ---NOTE--- ---NOTE--- ---NOTE--- >>> # # THIS FILE IS FOR SA 3.x! SA 2.63 & 2.64 ARE NO LONGER SUPPORTED! # # <<< ---NOTE--- ---NOTE--- ---NOTE--- ---NOTE--- >>> # Add your own customisations to this file. See 'man Mail::SpamAssassin::Conf' # for details of what can be tweaked. # # ~/.spamassassin/user_prefs # $Id: user_prefs,v 1.1414 2010/05/04 08:42:30 yoh Exp $ # # http://www.flcl.org/~yoh/user_prefs # Original source from: # http://www.linux.or.jp/~ukai/l-u-spam/local.cf # modified by MATSUDA Yoh-ichi [yoh] (yoh@flcl.org) # # This file is updated frequently. You can use web antenna software for # checking this file. # # Notice for Non-Japanese natives: # Thank you for watching this file. # This is "user_prefs", SpamAssassin user-specific configuration # file "for Japanese". # But, some rules are useful for Non-Japanese natives, I believe. # # Feel free to use this file, there is no problem using whether # whole or partial. # You can use this file for personal, business, or built-in # commercial products. # # I hope happy E-mail world. # # Notice for Japanese natives: # You should read # http://spamassassin.jp/modules/xhnewbb/viewtopic.php?topic_id=64 # before using this file. # # _._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._ # If you have any problem, questions or suggestions, email to: yoh@flcl.org # _._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._ # # Copyright (c) 2002-2010 MATSUDA Yoh-ichi # This file is licensed under the Open Software License v.2.0. # # Open Software License v.2.0 at: http://opensource.org/licenses/osl-2.0.php # Japanese translation at: http://sourceforge.jp/projects/opensource/wiki/licenses/Open_Software_License # # # <<< ---NOTE--- ---NOTE--- ---NOTE--- ---NOTE--- >>> # # How to use this file: # # 1. wget -O ~/.spamassassin/user_prefs http://www.flcl.org/~yoh/user_prefs # # 2. write below rules in your ~/.spamassassin/private_prefs: # # (1) your own 'trusted_networks' # # trusted_networks 127.0.0.1/8 192.168.0.1/16 10.0.0.1/8 172.16.0.1/12 210.150.184.16/29 202.93.83.109 202.93.83.110/31 202.93.83.112 202.93.85.135 202.93.85.136/31 202.93.85.138 219.100.31.229 202.248.238.70 64.233.162.192/28 61.215.208.41 210.157.158.35 210.157.158.37 210.171.226.47 211.10.155.25 # # <<< Attention! >>> # Now, you don't need "MYMTA" setting! # 2010.01.14 by [yoh] # # for more details, see http://spamassassin.jp/modules/xhnewbb/viewtopic.php?topic_id=9&post_id=47#forumpost47 # # sample private_prefs is available at # http://www.flcl.org/~yoh/private_prefs # # <<< ---NOTE--- ---NOTE--- ---NOTE--- ---NOTE--- >>> # # ex. in my ~/.procmailrc: # #------------------ ~/.procmailrc ------------------- # SHELL=/bin/sh # LOGFILE=$HOME/Mail/procmail.log # DEFAULT=$ORGMAIL # SPAM=$HOME/spam/spam/. # DOUBT=$HOME/spam/doubt/. # # call spamassassin # :0fw: spamassassin.lock # * < 600000 # | spamassassin # # "autolearn=spam" is "spam" # :0H: # * X-Spam-Flag: YES # * X-Spam-Status:.*autolearn=spam # $SPAM # # score over 20 is "spam" # :0H: # * ^X-Spam-Level: \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* # $SPAM # # other is "doubt" # :0H: # * !^X-Spam-Probability: # * ^X-Spam-Flag: YES # $DOUBT #------------------ End of ~/.procmailrc ------------------- # # - global configuration # some definition, no depending languages etc. # you can tune threshold score level as you like. # # # threshold level up to 8.0 2004.12.14 by [yoh] # threshold level up to 13.0 2005.11.3 by [yoh] # required_score 13.0 # # autolearn threshold setting 2005.11.3 by [yoh] # bayes_auto_learn_threshold_nonspam 0.1 bayes_auto_learn_threshold_spam 12.0 # # For AWL working properly, we have to write your trusted networks. # http://article.gmane.org/gmane.mail.spam.spamassassin.general/72509 # http://wiki.apache.org/spamassassin/AwlWrongWay?highlight=%28awl%29 # 2005.09.23 by [yoh] # Thanks to OOI Keita san # 2005.11.22 by [yoh] # # You MUST write below in your ~/.spamassassin/private_prefs # 2006.04.18 by [yoh] # # trusted_networks 127.0.0.1/8 192.168.0.1/16 10.0.0.1/8 172.16.0.1/12 210.150.184.16/29 202.93.83.109 202.93.83.110/31 202.93.83.112 202.93.85.135 202.93.85.136/31 202.93.85.138 219.100.31.229 202.248.238.70 64.233.162.192/28 61.215.208.41 210.157.158.35 210.157.158.37 210.171.226.47 211.10.155.25 # 124.83.200.48/28 124.83.200.64/29 124.83.200.72/30 124.83.200.76/31 # 124.83.212.21/32 124.83.212.22/31 124.83.212.24/29 124.83.212.32/30 124.83.212.81/32 124.83.212.82/31 124.83.212.84/30 124.83.212.88/29 # 203.216.249.201/32 203.216.249.202/31 203.216.249.204/30 203.216.249.208/29 # 202.93.80.0/20 # 203.216.226.176/28 # added 2009.05.31 by [yoh] # modified 2011.06.04 by [yoh] # for checking Yahoo! Japan webmail spam. # 203.216.226.0/24 trusted_networks 124.83.168.15/32 124.83.168.16/29 124.83.168.24/30 124.83.168.28/31 124.83.168.32/29 124.83.168.40/30 124.83.168.44/31 124.83.168.46/32 203.216.226.171/32 203.216.226.172/30 203.216.226.192/31 203.216.226.194/32 # added 2011.03.05 by [yoh] # for checking US and EU Yahoo! webmail spam. trusted_networks 115.178.12.0/23 124.108.96.0/20 124.108.112.0/20 183.177.64.0/19 67.195.0.0/16 68.142.192.0/18 76.13.0.0/16 77.238.188.0/22 98.136.0.0/14 # # - tuning internal rules score # some rules need score level up, some rules need deactivate. # # modified 2009.03.22 by [yoh] # Bayes depends on learning. # So, autolearning too much spam makes false positive. # Bayes engine needs frequently maintenance and balanced corpus. # So I decided setting low score. # 2010.04.14 by [yoh] score BAYES_80 3.0 score BAYES_95 4.0 score BAYES_99 4.5 score BAYES_00 0 0 -1.665 -6.0 score BAYES_05 0 0 -0.925 -4.0 score X_LIBRARY 4.3 # score HTML_70_80 1.0 # score UPPERCASE_25_50 0.5 score NO_DNS_FOR_FROM 3.5 # score HOT_NASTY 2.0 # score RISK_FREE 2.0 score RATWARE_OE_MALFORMED 4.1 score UPPERCASE_75_100 1.0 score HTML_MESSAGE 1.0 # score MSGID_FROM_MTA_ID 2.7 score GAPPY_SUBJECT 0.5 # # This rule is no meanings because many ham sender doesn't add real name # in his/her From: area. # 2006.10.29 by [yoh] # # score NO_REAL_NAME 0 # # This rule is no meanings because some web mail agents add # X-MSMail-Priority. # 2006.10.29 by [yoh] # score MISSING_MIMEOLE 0.1 # # This rule is no meanings because some Japanese ham has this rule. # 2006.10.29 by [yoh] # score PLING_QUERY 0.1 # # This rule is no meanings because many people send "no subject" mail. # 2008.05.31 by [yoh] # score MISSING_SUBJECT 0 # # This rule is no meanings because Outlook Express send this type mail. # 2008.05.31 by [yoh] # score FROM_EXCESS_BASE64 0 # # This rule is no meanings because Outlook Express send this type mail. # So, this rule is nonsense. # 2008.05.31 by [yoh] # score TVD_SPACE_RATIO 0 # # This rule is no meanings because some hammy host send this type mail. # So, this rule is nonsense. # 2009.10.23 by [yoh] # score RCVD_HELO_IP_MISMATCH 0 # # This rule is no meanings because this rule hits many Japanese ham. # So, this rule is nonsense. # 2010.01.23 by [yoh] # score FM_FRM_RN_L_BRACK 0 # # - language definition # if you aren't native Japanese, you have to change definition below. # In 3.1.0, you have to enable plugin "Mail::SpamAssassin::Plugin::TextCat" # in /etc/spamassassin/v310.pre . # http://marc.theaimsgroup.com/?l=spamassassin-announce&m=112674318914008&w=2 # 2005.09.26 by [yoh] # ok_languages ja en ok_locales ja en # # - language definition related rules # if you aren't native Japanese, you have to change definition below. # # There is no effect whether target mail is Japanese or not. # 2004.05.28 by [yoh] header ISO2022JP_CHARSET Content-Type =~ /charset=['"]?iso-2022-jp['"]?/i describe ISO2022JP_CHARSET ISO-2022-JP message # score ISO2022JP_CHARSET -0.182 score ISO2022JP_CHARSET -0.1 header GB2312_CHARSET Content-Type =~ /charset=['"]?GB2312['"]?/i describe GB2312_CHARSET GB2312 message score GB2312_CHARSET 5.00 # thrown away 2005.09.14 by [yoh] # # header KS5601_CHARSET Content-Type =~ /charset= ?['"]?ks_c_5601/i # describe KS5601_CHARSET KS_C_5601 message # score KS5601_CHARSET 5.00 header BIG5_CHARSET Content-Type =~ /charset=['"]?big5['"]?/i describe BIG5_CHARSET Big5 message score BIG5_CHARSET 5.0 header WINDOWS_CHARSET Content-Type =~ /charset=['"]?windows-125.['"]?/i describe WINDOWS_CHARSET Windows-1252 message score WINDOWS_CHARSET 5.0 full GB2312ENC /\nContent-Type: .*; charset=.*gb2312[\n\r]/i describe GB2312ENC gb2312 message score GB2312ENC 1.0 full MIMEQENC /\nContent-Transfer-Encoding: quoted-printable[\n\r]/i describe MIMEQENC Quoted-Printable mime definition score MIMEQENC 0.2 full QENCPTR1 /=[1-9][0-9A-Fa-f]/ describe QENCPTR1 Quoted-Printable mime pattern score QENCPTR1 0.2 full QENCPTR2 /[a-zA-Z]=[\n\r]/ describe QENCPTR2 Quoted-Printable mime pattern score QENCPTR2 0.2 # thrown away 2005.09.14 by [yoh] # # meta GB2312QENC GB2312ENC && MIMEQENC && QENCPTR1 && QENCPTR2 # describe GB2312QENC GB2312 quoted-printable MIME body # score GB2312QENC 10.0 # # full BIG5_BODY /\nContent-Type:.*charset=.*big5.*[\n\r]/i # describe BIG5_BODY Big5 charset in multipart # score BIG5_BODY 10.0 # # generic, miscellaneous header rules. # # ([a-z,'\-]+ ){2,}[a-z]+[0-9]+$|([0-9a-z,'\-]+ ){1,}[a-z ,'\-]+$ # ^[0-9A-Za-z]{10,}$ # score down 2011.04.07 by [yoh] header X_MAILER X-Mailer =~ /(?:GpsMailer|SpireMail|IM200[01] Version|Pinta Magazine|MultiMail|BSMTP DLL|E-Magazine|Direct Email|Achi-Kochi Mail|MagicalMail|InternetPost for Active Platform|Web Based Pronto|Oshirase.*-Mailer|SendMailEX|Douhou\@Mail|{%xmailer%}|/i rawbody __SIMSUN /alt:SimSun;/ # Counterfeit consumer goods meta COUNTERFEIT_CHINA __MSWORD_HTML && __SIMSUN && (__JPEG_ATTACH || __GIF_ATTACH) && YAHOOWEBMAIL score COUNTERFEIT_CHINA 5.5 # # # New rules from version 3.1.0 # 2005.09.21 by [yoh] # # # # This rule has no meanings since every long Japanese Subject have twice # encode strings. # 2005.10.11 by [yoh] # # score SUBJECT_ENCODED_TWICE 0.1 score UNPARSEABLE_RELAY 0.5 # Bayes engine needs frequently maintenance and balanced corpus. # So I decided setting low score. # 2010.04.14 by [yoh] meta UNPARSEABLERELAY99 UNPARSEABLE_RELAY && BAYES_99 describe UNPARSEABLERELAY99 UNPARSEABLE_RELAY && BAYES_99 score UNPARSEABLERELAY99 1.5 meta UPRSBLRLY_DCN UNPARSEABLE_RELAY && ___DCN score UPRSBLRLY_DCN 3.5 meta DYN_UPRSBLRLY UNPARSEABLE_RELAY && ___DYNAMICIP score DYN_UPRSBLRLY 3.5 meta UPRSBLRLY_PBL UNPARSEABLE_RELAY && RCVD_IN_PBL score UPRSBLRLY_PBL 3.5 meta UPRSBLRLY_BRBL UNPARSEABLE_RELAY && RCVD_IN_BRBL_LASTEXT score UPRSBLRLY_BRBL 3.5 meta UPRSBLRLY_RNBL UNPARSEABLE_RELAY && RCVD_IN_RP_RNBL score UPRSBLRLY_RNBL 3.5 # score X_MAILER_SPAM 3.0 # meta XMAILERSPAM99 X_MAILER_SPAM && BAYES_99 # describe XMAILERSPAM99 X_MAILER_SPAM && BAYES_99 # score XMAILERSPAM99 7.0 header X_MAIL_AGENT X-Mail-Agent =~ /\(Extra Japan\)|BSMTP DLL/ describe X_MAIL_AGENT spammer's choice of X-Mail-Agent score X_MAIL_AGENT 1.0 meta DYN_XMAGNT (X_MAIL_AGENT||X_MAILER) && ___DYNAMICIP score DYN_XMAGNT 5.5 header USERAGENT User-Agent =~ /(VXmailer 1\.1|MMBoard Ver\.[0-9]+|Foxmail 4\.2 \[cn\]|MIME-tools 5\.[0-9]+ \(Entity |AspMail [0-9])/ describe USERAGENT spammer's choice of User-Agent score USERAGENT 7.0 # # http://www.google.co.jp/search?hl=ja&ie=EUC-JP&oe=EUC-JP&q=coremail&btnG=Google+%B8%A1%BA%F7&lr= # 2006.05.25 by [yoh] # modified 2011.04.23 by [yoh] # # header COREMAIL Received =~/ by [^ ]+ \(Coremail\) with SMTP id \w{14,}/ header COREMAIL Received =~/ by [^ ]+ \(Coremail\) / describe COREMAIL spamming MTA made in China score COREMAIL 5.0 meta CORE_KTC COREMAIL && ___KOREATAIWANCHINA score CORE_KTC 8.0 meta CORE_DCN COREMAIL && ___DCN score CORE_DCN 8.0 # meta CORE_B64 COREMAIL && MIME_BASE64_NO_NAME && MIME_BASE64_TEXT && MIME_BASE64_BLANKS meta CORE_B64 COREMAIL && MIME_BASE64_TEXT && MIME_BASE64_BLANKS score CORE_B64 8.0 # # added 2007.01.18 by [yoh] # header FORGEDMTAIDSTR Received =~/ id (?![A-Z0-9]{6}-[A-Z0-9]{6}-[A-Z0-9]{2})[A-Z0-9\W]{6}-[A-Z0-9\W]{6}-[A-Z0-9\W]{2}/ # # deleted 2010.09.26 by [yoh] # # meta FRGDMTAWROTE RCVD_FORGED_WROTE && FORGEDMTAIDSTR # score FRGDMTAWROTE 5.0 # # added 2007.02.04 by [yoh] # header FORGED_RCVD_BY Received =~/by (?!localhost)([a-z]{4,} \(8\.13\.\d|[A-Z]{5} \([A-Z]{3}Sys\))/ header MULTIPART_ALTERNATIVE Content-Type =~ /[mM]ultipart\/[aA]lternative/ describe MULTIPART_ALTERNATIVE Multipart/alternative score MULTIPART_ALTERNATIVE 0.1 # # generic, miscellaneous body rules. # body THANKS_GOD_BLESS /^THANKS.+GOD.+BLESS/i describe THANKS_GOD_BLESS Thanks, GOD BLESS YOU score THANKS_GOD_BLESS 2.0 # meta RISK_THANKS RISK_FREE && THANKS_GOD_BLESS # score RISK_THANKS 3.5 # # deleted 2010.09.26 by [yoh] # # rawbody RANDOM_ID2 /^[a-z]{15,}$/ # describe RANDOM_ID2 random lowercase alphabet ID-like phrase # score RANDOM_ID2 0.5 body CONGRATULATIONS /(!+ )*CONGRATULATIONS{0,1}(!| !+)/i describe CONGRATULATIONS !!!!! CONGRATULATIONS !!!!! score CONGRATULATIONS 3.0 body LOTTERY /LOTTERY/i describe LOTTERY talking about LOTTERY score LOTTERY 0.1 meta CONGLAT_LOTTERY CONGRATULATIONS && LOTTERY describe CONGLAT_LOTTERY CONGRATULATIONS && LOTTERY score CONGLAT_LOTTERY 3.5 # # deleted 2010.09.26 by [yoh] # # body CALLNOW /call now /i # describe CALLNOW "Call Now" # score CALLNOW 0.1 body YOURDIPLOMA /YOUR (DIPLOMA|Graduation)/i describe YOURDIPLOMA "YOUR DIPLOMA" score YOURDIPLOMA 0.1 body CALLDIPLOMA /call now .+YOUR (DIPLOMA|Graduation)/i describe CALLDIPLOMA call now - your Graduation score CALLDIPLOMA 1.5 rawbody REMOVEMAIL1 /mailto:remove\@/ describe REMOVEMAIL1 mailto:remove@ score REMOVEMAIL1 2.0 # thrown away 2005.09.14 by [yoh] # body PHPDONOTEMAIL /http:\/\/.+\/lx\.php\?a=donotemail\&b=/ # describe PHPDONOTEMAIL http://5.shyx.us/lx.php?a=donotemail&b=yoh%40flcl.org # score PHPDONOTEMAIL 2.0 # # body PHPSEARCH /\/lx\.php\?a=search\&b=5\&c=/ # describe PHPSEARCH http://4.shyx.biz/lx.php?a=search&b=5&c=yoh%40flcl.org # score PHPSEARCH 2.0 # # meta PHPSPAM PHPDONOTEMAIL && PHPSEARCH && BAYES_99 # describe PHPSPAM PHPDONOTEMAIL && PHPSEARCH && BAYES_99 # score PHPSPAM 7.0 # score FROM_AND_TO_SAME -0.5 score MIME_HTML_ONLY 0.4 score INVALID_DATE 5.4 # score REMOVE_PAGE 2.0 score FROM_ILLEGAL_CHARS 2.9 # score PORN_URL_SEX 1.0 # Below rule is too high. # 2006.12.10 by [yoh] score SUBJ_ILLEGAL_CHARS 1.0 # Below rules include bugs at proccessing ISO-2022-JP strings. score WEIRD_QUOTING 0.1 score OBSCURED_EMAIL 0.1 # Below rule is too high. # 2011.11.16 by [yoh] score RCVD_IN_BRBL_LASTEXT 0.5 # Below rule is too high. # 2011.11.18 by [yoh] score RCVD_IN_PSBL 0.5 # re-opened 2009.08.22 by [yoh] # Below rule has serious problem, so it needs to be disabled. # ex. Gmail HTML spam score ALL_TRUSTED 0.0 # thrown away 2005.09.14 by [yoh] # # rawbody FOXMAIL /^X-Mailer: FoxMail [1-9]\.[0-9]+ .+\[cn\]/ # describe FOXMAIL X-Mailer: FoxMail 3.11 Release [cn] # score FOXMAIL 8.0 # header RANDORG Organization =~ /^([A-Z][a-z]+ [a-z]+|[a-z]+\.[a-z]+)$/ # describe RANDORG Organization: random strings # score RANDORG 2.0 # meta SUBJ_SPACES_UNIQID SUBJ_HAS_SPACES && SUBJ_HAS_UNIQ_ID # describe SUBJ_SPACES_UNIQID SUBJ_HAS_SPACES && SUBJ_HAS_UNIQ_ID # score SUBJ_SPACES_UNIQID 2.5 # # deleted 2010.09.26 by [yoh] # # meta MIMEHEXQENC MIME_BOUND_MANY_HEX && MIMEQENC # describe MIMEHEXQENC MIME_BOUND_MANY_HEX && MIMEQENC # score MIMEHEXQENC 1.1 header TEXT_NOCHARSET Content-Type =~ /^text\/(plain|html);{0,1}$/ describe TEXT_NOCHARSET Content-Type: text/(plain|html) with no charset score TEXT_NOCHARSET 0.5 meta TEXTHOTMAIL TEXT_NOCHARSET && FORGED_HOTMAIL_RCVD2 && BAYES_99 describe TEXTHOTMAIL TEXT_NOCHARSET && FORGED_HOTMAIL_RCVD2 && BAYES_99 score TEXTHOTMAIL 10.0 # modified 2009.05.14 by [yoh] meta TEXTPYZOR TEXT_NOCHARSET && PYZOR_CHECK describe TEXTPYZOR TEXT_NOCHARSET && PYZOR_CHECK score TEXTPYZOR 3.0 # thrown away 2005.09.14 by [yoh] # # header POSTFIX_ERRCONT Content-Type =~/^multipart\/report; report-type=delivery-status;.+boundary=/ # describe POSTFIX_ERRCONT Content-Type is Postfix/Sendmail type delivery error message # score POSTFIX_ERRCONT 0.1 # # meta POSTFIXBOUNCE POSTFIX_ERRCONT && ILLEGALSTR04 # describe POSTFIXBOUNCE bounce spam using a footstool MTA Postfix # score POSTFIXBOUNCE 7.0 header EXIM_ERRWARN Received =~/ with local \(Exim .+\)/ describe EXIM_ERRWARN bounce mail from Exim score EXIM_ERRWARN 0.1 header MSES_ERRXM X-Mailer =~ /Internet Mail Service \([0-9.]+\)$/ describe MSES_ERRXM X-Mailer: is Microsoft Exchange Server type delivery error message score MSES_ERRXM 1.0 # thrown away 2005.09.14 by [yoh] # # body YOURFINANCESTHEEASYWAY /Your Finances The Easy Way\!/ # describe YOURFINANCESTHEEASYWAY Your Finances The Easy Way! # score YOURFINANCESTHEEASYWAY 1.0 # # body IFYOUWISHTOBEDELETED /If you wish to be deleted from (this|our) list, please .*CLICK/ # describe IFYOUWISHTOBEDELETED If you wish to be deleted from this list, please CLICK # score IFYOUWISHTOBEDELETED 2.0 # # full FONT_1PX_STR /([a-z'.]+ ){40,}([a-z]+.){0,1}<\/font>/ # describe FONT_1PX_STR font-size:1px and random strings are obfuscating bayesian filter # score FONT_1PX_STR 7.0 # # body ORDER_YOURS_NOW /Order Yours NOW!/ # describe ORDER_YOURS_NOW Order Yours NOW! # score ORDER_YOURS_NOW 1.5 # thrown away 2006.01.04 by [yoh] # # rawbody TABLEPRE /
\.[a-z0-9]+\.[a-z]+\.[a-z]{2,3}/
# score FAKEHOSTURI 2.5
# meta FHURI_COP FAKEHOSTURI && RCVD_IN_BL_SPAMCOP_NET
# score FHURI_COP 5.0
# meta FHURI_SBL FAKEHOSTURI && URIBL_SBL
# score FHURI_SBL 5.0
# meta FHURI_XBL FAKEHOSTURI && RCVD_IN_XBL
# score FHURI_XBL 7.0
# meta FHURI_HLDYNIP FAKEHOSTURI && HELO_DYNAMIC_IPADDR
# score FHURI_HLDYNIP 7.0


# added 2008.09.13 by [yoh]
# 
# deleted 2010.09.26 by [yoh]
# 
# rawbody MANYSLASHURI /http:\/\/.+(?:\/{5,}|[\(\)]{5,})/
# score MANYSLASHURI 4.5
# meta MANYDCC MANYSLASHURI && DCC_CHECK
# score MANYDCC 3.5
# meta MANYPROXY MANYSLASHURI && RCVD_IN_NJABL_PROXY
# meta MANYMULTI MANYSLASHURI && MULTIPART_ALTERNATIVE
# score MANYMULTI 3.5
# meta MANYFRGN MANYSLASHURI && (LACNIC||AFRINIC)
# score MANYFRGN 2.5


# added 2008.09.14 by [yoh]
# 
# deleted 2010.09.26 by [yoh]
# 
# rawbody DOTREPLACE /(www\.){0,1}[a-z]{6,} {0,3}\[DOT\] {0,3}com/
# score DOTREPLACE 2.5
# meta DOTBOGUSMX DOTREPLACE && DNS_FROM_RFC_BOGUSMX
# score DOTBOGUSMX 2.5
# meta DOTDSN DOTREPLACE && DNS_FROM_RFC_DSN
# score DOTDSN 2.5
# meta DOTPBL DOTREPLACE && RCVD_IN_PBL
# score DOTPBL 2.5
# meta DOTXBL DOTREPLACE && RCVD_IN_XBL
# score DOTXBL 2.5
# meta DOTCBL DOTREPLACE && RCVD_IN_CBL
# score DOTCBL 2.5
# meta DOTCOP DOTREPLACE && RCVD_IN_BL_SPAMCOP_NET
# score DOTCOP 2.5
# # meta DOTDUL DOTREPLACE && RCVD_IN_SORBS_DUL
# # score DOTDUL 2.5
# meta DOTDCC DOTREPLACE && DCC_CHECK
# score DOTDCC 2.5
# meta DOTJMRM DOTREPLACE && JM_REACTOR_MAILER
# score DOTJMRM 2.5
# meta DOTAHBL DOTREPLACE && RCVD_IN_AHBL
# score DOTAHBL 2.5
# meta DOTAHPRXY DOTREPLACE && RCVD_IN_AHBL_PROXY
# score DOTAHPRXY 2.5

# 
# deleted 2010.09.26 by [yoh]
# 
# meta JMRMPBL RCVD_IN_PBL && JM_REACTOR_MAILER
# score JMRMPBL 3.5

# added 2011.04.28 by [yoh]
# Because, this rule is not so reliable.
score DOS_OE_TO_MX 1.0

meta DOSMXPBL DOS_OE_TO_MX && RCVD_IN_PBL
score DOSMXPBL 3.5
meta DOSMXBRBL DOS_OE_TO_MX && RCVD_IN_BRBL_LASTEXT
score DOSMXBRBL 3.5
meta DOSMXCBL DOS_OE_TO_MX && RCVD_IN_CBL
score DOSMXCBL 3.5
meta DOSMXXBL DOS_OE_TO_MX && RCVD_IN_XBL
score DOSMXXBL 3.5
meta DOSMXSPAMCOP DOS_OE_TO_MX && RCVD_IN_BL_SPAMCOP_NET
score DOSMXSPAMCOP 3.5
meta DOSMXPSBL DOS_OE_TO_MX && RCVD_IN_PSBL
score DOSMXPSBL 3.5
meta DOSMXRNBL DOS_OE_TO_MX && RCVD_IN_RP_RNBL
score DOSMXRNBL 3.5


# score ADVANCE_FEE_1 1.0

# meta BASE64TXT60  MIME_BASE64_NO_NAME && MIME_BASE64_TEXT && MIME_BASE64_BLANKS && RATWARE_NAME_ID && TEXT_NOCHARSET
# describe BASE64TXT60 60 columns base64 encoded plain text message
# score BASE64TXT60 20

meta ___HTMLIMG HTML_IMAGE_ONLY_04 || HTML_IMAGE_ONLY_08 || HTML_IMAGE_ONLY_12 || HTML_IMAGE_ONLY_16 || HTML_IMAGE_ONLY_20 || HTML_IMAGE_ONLY_24 || HTML_IMAGE_ONLY_28 || HTML_IMAGE_ONLY_32 || HTML_IMAGE_RATIO_02

meta PASTIMG DATE_IN_PAST_06_12 && ___HTMLIMG && BAYES_99
score PASTIMG 5.0

# meta HTMLIMG_FRGDHELO (FORGED_RCVD_HELO || RCVD_NUMERIC_HELO || RCVD_NUMERIC_HELO2)&& ___HTMLIMG && BAYES_99

# Bayes engine needs frequently maintenance and balanced corpus.
# So I decided setting low score.
# 2010.04.14 by [yoh]
meta HTMLIMG_FRGDHELO (RCVD_NUMERIC_HELO || RCVD_NUMERIC_HELO2)&& ___HTMLIMG && BAYES_99
describe HTMLIMG_FRGDHELO FORGED_RCVD_HELO && HTML_IMAGE_ONLY_??
score HTMLIMG_FRGDHELO 1.5

rawbody HTML_FONT_SIZE_TINY2 /| )/i
describe HTML_FONT_SIZE_TINY2 
score HTML_FONT_SIZE_TINY2 0.5

# Bayes engine needs frequently maintenance and balanced corpus.
# So I decided setting low score.
# 2010.04.14 by [yoh]
meta IMGONLYHTML1 HTML_FONT_SIZE_TINY2 && ___HTMLIMG && BAYES_99
score IMGONLYHTML1 1.0

rawbody ___OBSCURED_TEXT1 /^(,|\!)($| \w)/
rawbody ___OBSCURED_TEXT2 /\w (,|\!) \w/

# 
# deleted 2010.09.26 by [yoh]
# 
# meta IMGONLYHTML2 ___OBSCURED_TEXT1 && ___OBSCURED_TEXT2 && ___HTMLIMG
# score IMGONLYHTML2 5.0

# 
# It's not smart rule...
# 2007.12.30 by [yoh]
# 
# 

score SHORT_HELO_AND_INLINE_IMAGE 1.5
meta SHII_OTHER SHORT_HELO_AND_INLINE_IMAGE && (ARIN || RIPE_NCC || LACNIC || AFRINIC || ___KOREATAIWANCHINA )
score SHII_OTHER 3.5
meta SHII_CBL SHORT_HELO_AND_INLINE_IMAGE && RCVD_IN_CBL
score SHII_CBL 3.5
meta SHII_SPAMCOP SHORT_HELO_AND_INLINE_IMAGE && RCVD_IN_BL_SPAMCOP_NET
score SHII_SPAMCOP 3.5
meta SHII_DSBL SHORT_HELO_AND_INLINE_IMAGE && RCVD_IN_DSBL
score SHII_DSBL 3.5
# meta SHII_DUL SHORT_HELO_AND_INLINE_IMAGE && RCVD_IN_SORBS_DUL
# score SHII_DUL 3.5


# 
# It's not smart rule...
# 2006.04.22 by [yoh]
# 
# 

# 
# debugged 2010.09.26 by [yoh]
# It seems that spammer evaded this rule.
# 
rawbody ___OBFUSCATING_FLOAT0 / \w+ <\/span>/
meta OBFUSCATING_FLOAT ___OBFUSCATING_FLOAT0 && ___OBFUSCATING_FLOAT1 
describe OBFUSCATING_FLOAT  d 
score OBFUSCATING_FLOAT 1.5

rawbody FLOATGEOCITIES /^\w+V\w+Vi
# If you want to add matching rules for Japanese:
# 
# (1) ISO-2022-JP
# 
# $ echo (Japanese strings)|nkf -j|awk '{gsub(/\x1B[$(]B/,"");print}'
# 
# (2) Shift-JIS
# 
# $ echo -n (Japanese strings)|nkf -s|od -txC
# 

# 
#
# Now, "MISHOUDAKU KOUKOKU" has changed normal ad-mail.
# "True spams" are using spamware, DNSBLed MTA, inviting scam site...
# 2004.11.20 by [yoh]
# 
# thrown away 2005.09.30 by [yoh]
# Today, "Mishoudaku Kokukoku" is meaningless. (sigh)
# 
# 
# header MISYOUDAKU Subject =~ /L\$.*(>|=3E)5.*Bz/
# describe MISYOUDAKU Misyoudaku
# score  MISYOUDAKU 1.0
# 
# header BANG_BANG Subject =~ /(!\*|\033\$[B@]).*(!\*|\033\([BJ]!)/
# describe BANG_BANG !...!
# score BANG_BANG 1.00
# 
# header STAR Subject =~ /(\"\(|\*|\!v)/
# describe STAR *
# score STAR 1.0
# 
# header KOUKOKU Subject =~ /9-9p/
# describe KOUKOKU KOUKOKU
# score KOUKOKU 2.0
# 
# meta MISYOUDAKUKOUKOKU MISYOUDAKU && KOUKOKU && STAR
# describe MISYOUDAKUKOUKOKU MISYOUDAKU && KOUKOKU && STAR
# score MISYOUDAKUKOUKOKU 1.0

# Special thanks to Satoshi IWAMOTO-san, for advice: 2002/10/21
rawbody HAISHINTEISHI /G\[\?\.(..){0,2}(Dd;_|ITMW)/
describe HAISHINTEISHI Haishin (no) Teishi
score HAISHINTEISHI 0.3

meta DYN_HAISHINTEISHI ___DYNAMICIP && HAISHINTEISHI
score DYN_HAISHINTEISHI 1.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody KOUDOKUKAIJO /9XFI(..)*2r=\|/
describe KOUDOKUKAIJO Koudoku Kaijo
score KOUDOKUKAIJO 1.0

meta DYN_KOUDOKUKAIJO ___DYNAMICIP && KOUDOKUKAIJO
score DYN_KOUDOKUKAIJO 3.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody MURYOU /L5NA/
describe MURYOU Muryou
score MURYOU 0.2

meta DYN_MURYOU ___DYNAMICIP && MURYOU
score DYN_MURYOU 1.5

header HAJIMEMASHITE Subject =~ /(\$O\$8|=i)\$a\$\^\$7\$F/
describe HAJIMEMASHITE Hajimemashite ? I don't know about you.
score HAJIMEMASHITE 1.5

#$O$8$a$^$7$F
#;O$a$^$7$F
#=i$a$^$7$F
# /\=i\$a\$\^\$7\$F/
# /(\$O\$8|\=i)\$a\$\^\$7\$F.+\$H\$\$\$\$\$\^\$9/

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody HAJIMEMASHITE2 /(\$O\$8|\=i)\$a\$\^\$7\$F/
describe HAJIMEMASHITE2 Hajimemashite ? I don't know about you.
score HAJIMEMASHITE2 0.5

meta DYN_HAJIMETE (HAJIMEMASHITE ||HAJIMEMASHITE2) && ___DYNAMICIP
score DYN_HAJIMETE 2.0


# There is no effect whether target mail is Japanese or not.
# 2004.05.28 by [yoh]
# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody ISO2022JP_BODY /\033\$[B@]/
describe ISO2022JP_BODY ISO-2022-JP message
# score ISO2022JP_BODY -2.394
score ISO2022JP_BODY -0.1

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody KOUKOKUMEERU /9\-9p\%a\!\<\%k(\$N){0,1}G\[\?\.(Dd\;_|Be9T)/
describe KOUKOKUMEERU koukokume-ru
score KOUKOKUMEERU 1.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody HAISHINDAIKOU /G\[\?\.Be9T/
describe HAISHINDAIKOU haishindaikou
score HAISHINDAIKOU 1.0


# Original source from: Jcode.pm 0.83 dankogai
# Thanks for your advice: Ikari-same, Ishioka-same.
# 2004.06.29 by [yoh]

# SJIS_C    => '[\x81-\x9f\xe0-\xfc][\x40-\x7e\x80-\xfc]',
# EUC_C     => '[\xa1-\xfe][\xa1-\xfe]',
# includes:      \xe0-\xfc  \xa1-\xfc
# so, excludes:  \x81-x9f   \x40-\x7e\x80-\x8f
# EUC_KANA  =>  '\x8e[\xa1-\xdf]',
#                \x8e \xa1-\xdf
# EUC_0212  =>  '\x8f[\xa1-\xfe][\xa1-\xfe]',
# so, excludes:  \x81-\x8d\x90-\x9f   \x40-\x7e\x80-\x8f

# 
# Umm, it's a time to need to support UTF-8 messages detection.
# http://search.luky.org/./linux-users.a/msg05613.html
# http://search.luky.org/./linux-users.a/msg05643.html
# 2005.09.29 by [yoh]
# 

# UTF8      => '[\xc0-\xdf][\x80-\xbf]|[\xe0-\xef][\x80-\xbf][\x80-\xbf]'
#              '[\xc0-\xdf]         [\x80-\xbf]
# SJIS_C    => '[\x81-\x9f\xe0-\xfc][\x40-\x7e\x80-\xfc]',
# so,excludes:   \x81-\x9f\xe0-\xfc  \x40-\x7e\xc0-\xfc
#              |[\xe0-\xef][\x80-\xbf][\x80-\xbf]'
#              '[\x81-\x9f\xe0-\xfc][\x40-\x7e\x80-\xfc]',
# so,excludes:   \x81-\x9f\xf0-\xfc  \x40-\x7e\xc0-\xfc
# so,excludes:   \xc0-\xfc           \x40-\x7e\xc0-\xfc

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
# rawbody UTF8      /(([\xe0-\xef][\x80-\xbf][\x80-\xbf])(?!([\x81-\x9f\xe0-\xfc][\x40-\x7e\xc0-\xfc]|[\x81-\x9f\xf0-\xfc][\x40-\x7e\xc0-\xfc]|[\xc0-\xfc][\x40-\x7e\xc0-\xfc]))){5,}/
# http://q.hatena.ne.jp/1209911505
# renewal 2011.01.09 by [yoh]
# rawbody UTF8  /\x30[\x40-\x9f\xa0-\xff]/
rawbody UTF8  /\xe3(?:[\x81\x82][\x80-\x9f]|[\x82\x83][\xa0-\xff])/
describe UTF8   UTF-8 message body
score UTF8  -0.1

# 
# almost completely detecting SJIS messages.
# 2005.09.29 by [yoh]
# 

# body SJIS_C /([\x81-\x9f\xe0-\xfc][\x40-\x7e\x80-\xfc]){5,}/

# 
# This rule was written at 2005.09.29 by [yoh]
# Shift-JIS: Japanese character encoding, which is not to be used for email.
# http://en.wikipedia.org/wiki/Shift-JIS
# Yes, Shift-JIS emails have high probability of spam.
# 2006.01.11 by [yoh]
# 

# 
# Todo: fix missing detecting: gb2312, koi8-r
# 2006.05.03 by [yoh]
# 

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
# re-scored 2011.11.16 by [yoh]
rawbody SJIS_C /(([\x81-\x9f\xe0-\xfc][\x40-\x7e\x80-\xfc])(?!([\xc0-\xdf][\x80-\xbf]|[\xe0-\xef][\x80-\xbf][\x80-\xbf]|[\xa1-\xfe][\xa1-\xfe]))){7,}/
describe SJIS_C SHIFT_JIS message body
score SJIS_C 1.0

# 2009.04.06 by [yoh]
header SJIS_SUBJECT Subject =~ /(([\x81-\x9f\xe0-\xfc][\x40-\x7e\x80-\xfc])(?!([\xc0-\xdf][\x80-\xbf]|[\xe0-\xef][\x80-\xbf][\x80-\xbf]|[\xa1-\xfe][\xa1-\xfe]))){7,}/

meta SJISSBJDCN ___DCN && SJIS_SUBJECT
score SJISSBJDCN 3.5


# body ___EUC_C_ONLY /([\xa1-\xfe][\xa1-\xfe]){5,}/
# describe ___EUC_C_ONLY [\xa1-\xdf][\xa1-\xfe]
# score ___EUC_C_ONLY -2.0

# 
# For only backward compatibility.
# 2005.09.29 by [yoh]
# 

# meta SJIS_BODY SJIS_C && ! ___EUC_C_ONLY
meta SJIS_BODY SJIS_C 
describe SJIS_BODY Shift_JIS message
score SJIS_BODY 0.1

header SJISFROM From =~ /([\x81-\x9f\xe0-\xfc][\x40-\x7e\x80-\xfc]){2,}@/
describe SJISFROM From: SJIS strings
score SJISFROM 2.0


# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody SHIROUTOMUSUME /AG\?ML$)/
header   ILLEGULAR_FROM From =~ /(^[\w\.-]+\@[\w\.-]+\@[\w\.-]+$|<\"[\w\.-]+\"\@[\w\.-]+\>$)/
describe ILLEGULAR_FROM From: xxxx@xxxx.jp@xxxx.jp
score    ILLEGULAR_FROM 10.0

header   ILLEGULAR_TO To =~ /^\"[\w\.-]+\@[\w\.-]+\"\@[\w\.-]+$/
describe ILLEGULAR_TO To: "xxxx@xxxx.jp"@xxxx.jp
score ILLEGULAR_TO 7.0

# header   ILLEGULAR_REPLYTO Reply-To =~ /(^[A-Za-z0-9._-]+\@[A-Za-z0-9._-]+\@[A-Za-z0-9._-]+$|<\"[a-z0-9._-]+\"\@[a-z0-9._-]+\>$)/
header   ILLEGULAR_REPLYTO Reply-To =~ /(^[\w\.-]+\@[\w\.-]+\@[\w\.-]+$|<\"[\w\.-]+\"\@[\w\.-]+\>$)/
describe ILLEGULAR_REPLYTO Reply-To: <"******...************"@***.com>
score ILLEGULAR_REPLYTO 15.0


# 
# below rules are generic, but originated from Japanese spam.
# 

header CONTENT_TYPE_PRESENT	exists:Content-Type
describe CONTENT_TYPE_PRESENT	exists:Content-Type
score CONTENT_TYPE_PRESENT	-0.1

meta NOTINCONTENTTYPE ! CONTENT_TYPE_PRESENT
describe NOTINCONTENTTYPE ! There's no Content-Type header
score NOTINCONTENTTYPE 0.2

# 
# 
# If you have yahoo.co.jp mail account, you can use below.
# 2005.09.18 by [yoh]
# But, yahoo.co.jp's "X-YahooFilteredBulk" is not reliable.
# 2005.10.12 by [yoh]
# 
# 

header XYAHOOFILTEREDBULK       exists:X-YahooFilteredBulk
describe XYAHOOFILTEREDBULK     exists:X-YahooFilteredBulk
score XYAHOOFILTEREDBULK        0.1

# Score changed low since XYAHOOFILTEREDBULK is low reliability.
# 2010.02.24 by [yoh]

meta XYAHOOFILTERED99   XYAHOOFILTEREDBULK && BAYES_99
describe XYAHOOFILTERED99   XYAHOOFILTEREDBULK && BAYES_99
score XYAHOOFILTERED99   1.5

meta XYAHOOFILTERED95   XYAHOOFILTEREDBULK && BAYES_95
describe XYAHOOFILTERED95   XYAHOOFILTEREDBULK && BAYES_95
score XYAHOOFILTERED95   0.5

meta DYN_XYFB ___DYNAMICIP && XYAHOOFILTEREDBULK
score DYN_XYFB 3.5

meta XYFB_PBL XYAHOOFILTEREDBULK && RCVD_IN_PBL
score XYFB_PBL 3.5
meta XYFB_BRBL XYAHOOFILTEREDBULK && RCVD_IN_BRBL_LASTEXT
score XYFB_BRBL 3.5
meta XYFB_CBL XYAHOOFILTEREDBULK && RCVD_IN_CBL
score XYFB_CBL 3.5
meta XYFB_XBL XYAHOOFILTEREDBULK && RCVD_IN_XBL
score XYFB_XBL 3.5
meta XYFB_SPAMCOP XYAHOOFILTEREDBULK && RCVD_IN_BL_SPAMCOP_NET
score XYFB_SPAMCOP 3.5
meta XYFB_RNBL XYAHOOFILTEREDBULK && RCVD_IN_RP_RNBL
score XYFB_RNBL 3.5

#
# detecting Japanese spam using yahoo.co.jp mail address.
# 2004.08.22 by [yoh]
# 2006.04.08 by [yoh]
#

header ___XAPPARENTLYFROM X-Apparently-From =~ /^<.+\@yahoo\.co\.jp>$/
# describe ___XAPPARENTLYFROM X-Apparently-From: 
# score ___XAPPARENTLYFROM -0.1

# header ___YAHOOJPRCVD1 Received =~ /by .+\.mail.*\.yahoo\.co\.jp with SMTP/
header ___YAHOOJPRCVD1 X-Spam-Relays-Untrusted =~ / by=\w+\.mail.*\.yahoo\.co\.jp /
# describe ___YAHOOJPRCVD1 Received: from ... by smtp18.mail.bbt.yahoo.co.jp with SMTP
# score ___YAHOOJPRCVD1 -0.1
# header ___YAHOOJPRCVD2 Received =~ /from dns.+.mail.yahoo.co.jp/
# describe ___YAHOOJPRCVD2 Received: from ....mail.yahoo.co.jp
# score ___YAHOOJPRCVD2 -0.1

header ___YAHOOJPRCVD3 Received =~ /from .+ by web.+\.mail\..+yahoo\.co\.jp via HTTP/
# describe ___YAHOOJPRCVD3 Received: from ... by web2101.mail.bbt.yahoo.co.jp via HTTP
# score ___YAHOOJPRCVD3 -0.1

header ___YAHOOJPFROM From =~ /.+\@yahoo\.co\.jp/
# describe ___YAHOOJPFROM From: ...@yahoo.co.jp
# score ___YAHOOJPFROM -0.1

# meta VALIDYAHOOJP ((___XAPPARENTLYFROM && ___YAHOOJPRCVD1) || ___YAHOOJPRCVD3) && ___YAHOOJPFROM
meta VALIDYAHOOJP ___XAPPARENTLYFROM && ___YAHOOJPRCVD1 && ___YAHOOJPFROM
describe VALIDYAHOOJP This mail is valid yahoo.co.jp mail.
score VALIDYAHOOJP -0.1

meta INVALIDYAHOOJP ___YAHOOJPFROM && ! ((___XAPPARENTLYFROM && ___YAHOOJPRCVD1 ) || ___YAHOOJPRCVD3)
describe INVALIDYAHOOJP From: is ...@yahoo.co.jp but this mail didn't come from yahoo.co.jp
score INVALIDYAHOOJP 1.0

# thrown away 2006.04.08 by [yoh]
# 
# meta FAKEVALIDYAHOOJP VALIDYAHOOJP && MSGID_FROM_MTA_HEADER
# describe FAKEVALIDYAHOOJP VALIDYAHOOJP && MSGID_FROM_MTA_HEADER
# score FAKEVALIDYAHOOJP 5.0


meta YAHOOJPSPAMCOP RCVD_IN_BL_SPAMCOP_NET && INVALIDYAHOOJP
describe YAHOOJPSPAMCOP RCVD_IN_BL_SPAMCOP_NET && INVALIDYAHOOJP
score YAHOOJPSPAMCOP 7.0

meta INVYJP_DYN INVALIDYAHOOJP && ___DYNAMICIP
score INVYJP_DYN 3.5

# 
# Thanks to WAGATSUMA Yoshiko aka kuromomo tan
# 2005.10.28 by [yoh]
# 2006.04.07 by [yoh]
# 2008.01.04 by [yoh]
# 

# header ___VALIDHOTMAILRCVD1 Received =~/from.+(hotmail\.com \(bay[0-9]+-[a-z]+[0-9]+\.bay[0-9]+\.hotmail\.com \[64\.4(\.[0-9]+){2,2}\]\)|64\.4(\.[0-9]+){2,2} +\(.+ hotmail\.com\) +\(64\.4(\.[0-9]+){2,2}\)).+by /
# header ___VALIDHOTMAILRCVD3 Received =~/from 64\.4(\.[0-9]{1,3}){2,2} by [a-z0-9]+\.[a-z0-9]+\.hotmail\.msn\.com with HTTP/
# header ___VALIDHOTMAILRCVD1 X-Spam-Relays-Untrusted =~ / ip=(64\.4|65\.5[2-5])(\.\d{1,3}){2} rdns=bay\d+-\w+\.bay\d+\.hotmail\.com helo=hotmail\.com by=.+ ident= envfrom= intl=0 id=.+ auth= /
header ___VALIDHOTMAILRCVD1 X-Spam-Relays-Untrusted =~ / ip=(64\.4|65\.5[2-5])(?:\.\d{1,3}){2} /
# header ___VALIDHOTMAILRCVD2 Received =~/from mail pickup service by hotmail\.com with Microsoft SMTPSVC/
# header ___VALIDHOTMAILRCVD3 X-Spam-Relays-Untrusted =~ / ip=64\.4(?:\.\d{1,3}){2} rdns= helo= by=\w+\.bay\d+\.hotmail\.msn\.com ident= envfrom= intl=0 id= auth=HTTP /
header ___VALIDHOTMAILRCVD4 X-Originating-IP =~/\[\d{2,3}(?:\.\d{1,3}){3}\]/
# header ___VALIDHOTMAILRCVD5 X-Originating-Email =~/\[.+\@hotmail\.co\.jp\]/
# header ___VALIDHOTMAILRCVD6 X-Sender =~/.+\@hotmail\.co\.jp/
header ___HOTMAILCOJPFROM From =~/.+\@hotmail\.co\.jp/

# meta FORGED_JPHOTMAIL_RCVD ___HOTMAILCOJPFROM && ! (___VALIDHOTMAILRCVD1 && ___VALIDHOTMAILRCVD2 && ___VALIDHOTMAILRCVD3 && ___VALIDHOTMAILRCVD4 && ___VALIDHOTMAILRCVD5 && ___VALIDHOTMAILRCVD6)
meta FORGED_JPHOTMAIL_RCVD ___HOTMAILCOJPFROM && ! (___VALIDHOTMAILRCVD1 && ___VALIDHOTMAILRCVD4)
describe FORGED_JPHOTMAIL_RCVD From: has hotmail.co.jp, but no Received: from hotmail.com
score FORGED_JPHOTMAIL_RCVD 1.5

# meta VALID_JPHOTMAIL_RCVD ___HOTMAILCOJPFROM && ___VALIDHOTMAILRCVD1 && ___VALIDHOTMAILRCVD2 && ___VALIDHOTMAILRCVD3 && ___VALIDHOTMAILRCVD4 && ___VALIDHOTMAILRCVD5 && ___VALIDHOTMAILRCVD6
meta VALID_JPHOTMAIL_RCVD ___HOTMAILCOJPFROM && ___VALIDHOTMAILRCVD1 && ___VALIDHOTMAILRCVD4
score VALID_JPHOTMAIL_RCVD -1.0


header FORGED_MSSMTP Received =~ /from (?!mail pickup service )[\w\._-]+ \((\d{1,4}\.){3}\d{1,4}\) by [\w\._-]+ with Microsoft SMTPSVC\(\d/
describe FORGED_MSSMTP MSExchange doesn't add such a Received: header
score FORGED_MSSMTP 1.5

header ___MSEX X-MimeOLE =~ /Produced By Microsoft Exchange V\d/
# probably forged MSSMTPSVC strings
meta ___FRGDMSSMTPSVC FORGED_MSSMTP && !___MSEX

meta SJISFRGDMSSMTP MIME_BASE64_TEXT && SJIS_C && ___FRGDMSSMTPSVC
score SJISFRGDMSSMTP 3.5

meta DCN_FRGDMSSMTP ___DCN && ___FRGDMSSMTPSVC
score DCN_FRGDMSSMTP 3.5


score INVALID_MSGID 1.5

header SHIFT_JIS2 Content-Type =~ /charset=\"shift_jis\"/i
describe SHIFT_JIS2 Content-Type: text/plain; charset="SHIFT_JIS"
score SHIFT_JIS2 1.5

full SHIFT_JIS1 /charset="shift_jis"/i
describe SHIFT_JIS1 charset="shift_jis"
score SHIFT_JIS1 1.0

meta INVALIDSJIS INVALID_MSGID && (SHIFT_JIS1 || SJIS_BODY)
describe INVALIDSJIS INVALID_MSGID && (SHIFT_JIS1 || SJIS_BODY)
score INVALIDSJIS 5.0



# >>>--- memo for debug 2010.09.26 by [yoh] ---<<<


# thrown away 2005.09.28 by [yoh]
# 
# full DREAMWIZ /dreamwiz\.com/
# describe DREAMWIZ http://my.dreamwiz.com/
# score DREAMWIZ 5.0
# 
# header HANMAIL_NET  Reply-To =~ /\@hanmail\.net/
# describe HANMAIL_NET  hanmail.net
# score HANMAIL_NET   2.0

rawbody SIDEBUSINESS /%5%\$%I%S%8%M%9/
describe SIDEBUSINESS SIDEBUSINESS
score SIDEBUSINESS 1.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody OTAKARA /\$\*Ju/
describe OTAKARA OTAKARA
score OTAKARA 1.0


# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody FUJITAYUZAN /F\#EDM\:\;3/
describe FUJITAYUZAN FUJITAYUZAN
score FUJITAYUZAN 0.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody HIROSHIMAKENCHIJI /9\-Eg8\)CN\;v/
describe HIROSHIMAKENCHIJI HIROSHIMAKENCHIJI
score HIROSHIMAKENCHIJI 0.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody NOMOTODENO /\$N85\$G\$N/
describe NOMOTODENO NOMOTODENO
score NOMOTODENO 0.1

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody OSOROSHIIHANASHI /62\$m\$7\$\$OC/
describe OSOROSHIIHANASHI OSOROSHIIHANASHI
score OSOROSHIIHANASHI 0.1

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody GYOUSEISOSHO /9T\@\/AJ\>Y/
describe GYOUSEISOSHO GYOUSEISOSHO
score GYOUSEISOSHO 0.1

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody SOKURYOSHI /B\,NL\;N/
describe SOKURYOSHI SOKURYOSHI
score SOKURYOSHI 0.1

meta FUJITACHIJI FUJITAYUZAN && HIROSHIMAKENCHIJI
describe FUJITACHIJI FUJITAYUZAN && HIROSHIMAKENCHIJI
score FUJITACHIJI 1.0
meta CHIJINOMOTO HIROSHIMAKENCHIJI && NOMOTODENO
describe CHIJINOMOTO HIROSHIMAKENCHIJI && NOMOTODENO
score CHIJINOMOTO 1.0
meta MOTODEOSORO NOMOTODENO && OSOROSHIIHANASHI
describe MOTODEOSORO NOMOTODENO && OSOROSHIIHANASHI
score MOTODEOSORO 1.0
meta OSOROGYOUSEI OSOROSHIIHANASHI && GYOUSEISOSHO
describe OSOROGYOUSEI OSOROSHIIHANASHI && GYOUSEISOSHO
score OSOROGYOUSEI 1.0

meta FUJITASPAM1 FUJITACHIJI && CHIJINOMOTO && MOTODEOSORO
describe FUJITASPAM1 FUJITACHIJI && CHIJINOMOTO && MOTODEOSORO
score FUJITASPAM1 3.0
meta FUJITASPAM2 FUJITACHIJI && MOTODEOSORO && OSOROGYOUSEI
describe FUJITASPAM2 FUJITACHIJI && MOTODEOSORO && OSOROGYOUSEI
score FUJITASPAM2 3.0

header NIKKEIBP From =~ /nikkeibp.co.jp/
describe NIKKEIBP nikkeibp.co.jp
score NIKKEIBP -10

# Thanks to: SHIBATA Hisaaki san
body AFAF /(zimbabwe|nigeria|angola|south afric|Sierra|UNITA)/i
describe AFAF Afaf
score AFAF 1.5

# replacing "OBFUSCATING_COMMENT"
# There are many types of OBFUSCATING_COMMENT. So, it's very difficult
# to detect various types of them.
# I think that detecting single or double rules are dangerous.

# Original rule fails to detect normal Japanese word, and scores too high.
score OBFUSCATING_COMMENT 0.0

# Outlook Express CAN send HTML in this format
# 2006.07.11 [yoh]
score FORGED_OUTLOOK_TAGS 0

# Outlook Express CAN send HTML in this format
# 2006.08.07 [yoh]
score HTML_OBFUSCATE_05_10 0.1
# score HTML_NONELEMENT_70_80 0.1

# http://jvnrss.ise.chuo-u.ac.jp/csn/index.cgi?p=SpamAssassin%A4%CEFH_DATE_PAST_20XX
# http://wiki.apache.org/spamassassin/Rules/FH_DATE_PAST_20XX
# 2010.01.04 [yoh]
score FH_DATE_PAST_20XX 0.0


# closed 2011.11.16 by [yoh]

# rawbody FAKEDWORD_ATMARK /(^| |\r|\n)[A-Za-z]{0,}(\@[A-Za-z]+){1,}(\.{0,1}$| |[:;\r\n])/
# describe FAKEDWORD_ATMARK ex. em@il (this rule is only for body)
# score FAKEDWORD_ATMARK 0.5

# full FAKEDWORD_ZERO /( |\r|\n)[A-Za-z]{0,}(0[A-Za-z]+){1,}(\.{0,1}$| |[:;\r\n])/
# describe FAKEDWORD_ZERO ex. Cust0mer
# score FAKEDWORD_ZERO 0.5

# full FAKEDWORD_ONE /( |\r|\n)[A-Za-z]{0,}(?:1[A-Za-z]+){1,}(\.{0,1}$| |[:;\r\n])/
# describe FAKEDWORD_ONE ex. l1st
# score FAKEDWORD_ONE 0.5

# full FAKEDWORD_EXCLAMATION /( |\r|\n)[A-Za-z]{0,}(\![A-Za-z]+){1,}(\.{0,1}$| |[:;\r\n])/
# describe FAKEDWORD_EXCLAMATION ex. MED!C!NE
# score FAKEDWORD_EXCLAMATION 0.5

# full FAKEDWORD_VERTICALLINE /( |\r|\n)[A-Za-z]{0,}([1|][A-Za-z]+){1,}(\.{0,1}$| |[:;\r\n])/
# describe FAKEDWORD_VERTICALLINE ex. REM|O|VED
# score FAKEDWORD_VERTICALLINE 0.5

# full FAKEDWORD_BACKQUOTE /( |\r|\n)[A-Za-z]{0,}(\`[A-Za-z]+){1,}(\.{0,1}$| |[:;\r\n])/
# describe FAKEDWORD_BACKQUOTE ex. B`uy
# score FAKEDWORD_BACKQUOTE 0.5

# full FAKEDWORD_BQONE /( |\r|\n)[A-Za-z1]{1,}[\^\`]{1,}[A-Za-z1]{2,}(\.{0,1}$| |[:;\r\n])/
# describe FAKEDWORD_BQONE ex. ava1^iable
# score FAKEDWORD_BQONE 0.5

full MULTIPART_EMPTY /(\r|\n){2}\-{6}=_NextPart_\d{3}_\d{4}_\w{8}\.\w{8}(\r|\n)Content\-Type: multipart\/alternative\;(\r|\n)\tboundary=\"\-{4}=_NextPart_\d{3}_\d{4}_\w{8}\.\w{8}\"(\r|\n){2,}\-{6}=_NextPart_\d{3}_\d{4}_\w{8}\.\w{8}(\r|\n)Content\-Type: text\/plain\;(\r|\n)\tcharset=\"Windows-1252\"(\r|\n)Content-Transfer-Encoding: quoted-printable(\r|\n){2,}/

# Bayes engine needs frequently maintenance and balanced corpus.
# So I decided setting low score.
# 2010.04.14 by [yoh]
meta MULTIEMPTY99 MULTIPART_EMPTY && BAYES_99
score MULTIEMPTY99 3.0

meta MULTIEMPTYFUTURE DATE_IN_FUTURE_06_12 && MULTIPART_EMPTY
score MULTIEMPTYFUTURE 3.5

meta EMPTYEXTRAMPARTTYPE EXTRA_MPART_TYPE && MULTIPART_EMPTY
score EMPTYEXTRAMPARTTYPE 3.5


# thrown away 2005.09.14 by [yoh]
# 
# rawbody OBFUSTAG1 /<(sup|em|font|big)><\/\1>/
# describe OBFUSTAG1 
# score OBFUSTAG1 3.0

# special thanks to: R.Takashi ISHIOKA-san! 2003/07/16
# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody SJIS_SOSHINSHA /\221\227\220M\216\322/
describe SJIS_SOSHINSHA soushinsha using sjis
score SJIS_SOSHINSHA 1.0

# thrown away 2005.09.14 by [yoh]
# 
# meta FAKED_SJISBODY1 SJIS_SOSHINSHA && ISO2022JP_BODY
# describe FAKED_SJISBODY1 SJIS_SOSHINSHA && ISO2022JP_BODY
# score FAKED_SJISBODY1 5.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody SJIS_URAVIDEO /\x97.\x83\x72\x83\x66\x83\x49/
describe SJIS_URAVIDEO uravideo using sjis
score SJIS_URAVIDEO 2.5
# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody SJIS_SAISHINRYUSHUTSU /\x8d\xc5\x90\x56\x97\xac\x8f\x6f/
describe SJIS_SAISHINRYUSHUTSU saishinryushutsu using sjis
score SJIS_SAISHINRYUSHUTSU 2.5
# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody SJIS_BURUSERA /\x83\x75\x83\x8b\x83\x5a\x83\x89/
describe SJIS_BURUSERA burusera using sjis
score SJIS_BURUSERA 2.5
# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody SJIS_SHIROUTOTOUKOU /\x91\x66\x90\x6c\x93\x8a\x8d\x65/
describe SJIS_SHIROUTOTOUKOU shiroutotoukou using sjis
score SJIS_SHIROUTOTOUKOU 2.5
# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody SJIS_YOUMONO /\x97\x6d\x95\xa8/
describe SJIS_YOUMONO youmono using sjis
score SJIS_YOUMONO 2.5
# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody SJIS_TOUSATSU /\x93\x90\x8e\x42/
describe SJIS_TOUSATSU tousatsu using sjis
score SJIS_TOUSATSU 2.5
# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody SJIS_LOLIKEI /\x83\x8d\x83\x8a\x8c\x6e/
describe SJIS_LOLIKEI lolikei using sjis
score SJIS_LOLIKEI 2.5
# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody SJIS_ZENKAKU_SM /\x82\x72\x82\x6c/
describe SJIS_ZENKAKU_SM SM in zenkaku using sjis
score SJIS_ZENKAKU_SM 1.5

# 
# added 2010.11.03 by [yoh]
# 
rawbody SJIS_SHOUZAI /\x8f\xa4\x8d\xde/
score SJIS_SHOUZAI 1.5
meta DYN_SJIS_SHOUZAI ___DYNAMICIP && SJIS_SHOUZAI
score DYN_SJIS_SHOUZAI 3.5


meta PORN_SJIS (SJIS_BURUSERA||SJIS_LOLIKEI||SJIS_SAISHINRYUSHUTSU||SJIS_SHIROUTOTOUKOU||SJIS_TOUSATSU||SJIS_URAVIDEO||SJIS_YOUMONO||SJIS_ZENKAKU_SM)&&(ISO2022JP_BODY||ISO2022JP_CHARSET)
describe PORN_SJIS (SJIS_BURUSERA||SJIS_LOLIKEI||SJIS_SAISHINRYUSHUTSU||SJIS_SHIROUTOTOUKOU||SJIS_TOUSATSU||SJIS_URAVIDEO||SJIS_YOUMONO||SJIS_ZENKAKU_SM)&&(ISO2022JP_BODY||ISO2022JP_CHARSET)
score PORN_SJIS 5.0

# thrown away 2005.09.14 by [yoh]
# 
# header HOSYOU_JPSPAM Received =~ /(\(HELO hosyou|from hosyou-.\.mine\.nu \(.+tokyo.ocn.ne.jp)/
# describe HOSYOU_JPSPAM ZAITAKUBUSINESS type Japanese spammer
# score HOSYOU_JPSPAM 7.0
# 
# body SHOUKOMISEMASU /\>Z5r.*8\+\$\;\$\^\$9/
# describe SHOUKOMISEMASU SHOUKO MISEMASU
# score SHOUKOMISEMASU 2.0




# body ZAITAKU /\:_Bp/
rawbody ZAITAKU /\:_Bp/
describe ZAITAKU ZAITAKU
score ZAITAKU 0.2

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody BUSINESS /%S%8%M%9/
describe BUSINESS BUSINESS
score BUSINESS 0.2

meta DYN_BUSINESS ___DYNAMICIP && BUSINESS
score DYN_BUSINESS 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody SHUUNYUU /\<\}F\~/
describe SHUUNYUU SHUUNYUU
score SHUUNYUU 0.2

# thrown away 2005.09.14 by [yoh]
# 
# body HOSYOU_590MYEN /\#52\/\#9\@iK\|1_/
# describe HOSYOU_590MYEN 590000000yen
# score HOSYOU_590MYEN 2.0
# 
# meta HOSYOUSPAM2 HOSYOU_JPSPAM && HOSYOU_590MYEN
# describe HOSYOUSPAM2 HOSYOU_JPSPAM && HOSYOU_590MYEN
# score HOSYOUSPAM2 5.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody OATSUI /\$\*G\.\$\$/
describe OATSUI Japanese porn word: OATSUI
score OATSUI 0.2

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody ZUKOZUKO /%:%3%:%3/
describe ZUKOZUKO Japanese porn word: ZUKOZUKO
score ZUKOZUKO 0.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody BINYUU /H~F}/
describe BINYUU Japanese porn word: BINYUU
score BINYUU 0.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody SEISHI /\@:;R/
describe SEISHI Japanese porn word: SEISHI
score SEISHI 0.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody BIMAN /H~%^%s/
describe BIMAN Japanese porn word: BIMAN
score BIMAN 0.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody DOSUKEBE /\$I\$9\$1\$Y/
describe DOSUKEBE Japanese porn word: DOSUKEBE
score DOSUKEBE 0.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody SHOJO /=h=w/
describe SHOJO Japanese porn word: SHOJO
score SHOJO 1.0

# !#$*JV;vBT$C$F$^$9!#!#

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody OHENJIMATT /\!\#\$\*JV;vBT\$C\$F\$\^\$9\!\#\!\#/
describe OHENJIMATT OHENJIMATTEMASU
score OHENJIMATT 1.0

rawbody TOOLONGSTR /^.{480,}$/
describe TOOLONGSTR too long strings without linefeed
score TOOLONGSTR 0.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody ZENKOKUSOKUJITSU /\x91\x53\x8d\x91\x91\xa6\x93\xfa.+\x97\x5a\x8e\x91/
describe ZENKOKUSOKUJITSU YAMIKIN word: zenkokusokujitsu supi-do yuushi
score ZENKOKUSOKUJITSU 3.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody TOUKYOUTOCHIJININKA /\x93\x8c\x8b\x9e\x93\x73\x92\x6d\x8e\x96\x94\x46\x89\xc2.+\x8f\xc1\x94\xef\x8e\xd2\x8b\xe0\x97\x5a/
describe TOUKYOUTOCHIJININKA YAMIKIN word: toukyoutochijininkazumi no shouhisha kin'yuu
score TOUKYOUTOCHIJININKA 3.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody GEKIYASU /(7c|3J)0B/
describe GEKIYASU GEKIYASU
score GEKIYASU 0.5

meta DYN_GEKIYASU ___DYNAMICIP && GEKIYASU
score DYN_GEKIYASU 3.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody PCSOFTHANBAI /PC...\%\=\%U\%H.*HNGd/
describe PCSOFTHANBAI PCsofthanbai
score PCSOFTHANBAI 1.0

meta DYN_PCSOFTHANBAI ___DYNAMICIP && PCSOFTHANBAI
score DYN_PCSOFTHANBAI 3.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody SAISHINPCSOFT /\:G\?7...PC...\%\=\%U\%H/
describe SAISHINPCSOFT saishinPCsoft
score SAISHINPCSOFT 2.0

meta DYN_SAISHINPCSOFT ___DYNAMICIP && SAISHINPCSOFT
score DYN_SAISHINPCSOFT 3.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody PCSOFTGEKIYASU /PC.+\%\=\%U\%H(7c|3J)0B/
describe PCSOFTGEKIYASU PCSOFTGEKIYASU
score PCSOFTGEKIYASU 1.5

meta DYN_PCSOFTGEKIYASU ___DYNAMICIP && PCSOFTGEKIYASU
score DYN_PCSOFTGEKIYASU 3.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody AITAI /(2q\$\$\$\?\$\$|\$\*2q\$\$\$7\$(\?\$\$|F\$_\$\^)|2q\$C\$F\$_\$(\^|F|\?))/
describe AITAI aitai...(sigh)
score AITAI 1.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody MATTERU /((BT|\$\^)\$C\$F(\$\$\$^\$9|\$C\$F\$b\$\$\$\$|\$F\$b\$\$\$\$|\$\^\$9|\$k|\$\$\$k)|\$\*BT\$A\$7\$F|BT\$C\$F\$\$\$\^\$9\!\#)/
describe MATTERU matteru
score MATTERU 0.3

meta DYN_MATTERU ___DYNAMICIP && MATTERU
score DYN_MATTERU 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody RENRAKU /O\"Mm/
describe RENRAKU renraku
score RENRAKU 0.2

meta DYN_RENRAKU ___DYNAMICIP && RENRAKU
score DYN_RENRAKU 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody DEAI /\=P2q\$\$/
describe DEAI deai
score DEAI 0.5

meta DYN_DEAI ___DYNAMICIP && DEAI
score DYN_DEAI 2.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody KARAMAIL /6u\%a\!\<\%k/
describe KARAMAIL karame-ru
score KARAMAIL 0.3

# thrown away 2005.09.14 by [yoh]
# 
# meta KARASCAM KARAMAIL && JPSCAMMAILADDRESS
# describe KARASCAM KARAMAIL && JPSCAMMAILADDRESS
# score KARASCAM 3.5

# $*IU$-9g$$
# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody OTSUKIAI /\$\*IU(\$\-){0,1}9g\$\$/
describe OTSUKIAI otsukiai
score OTSUKIAI 0.3

meta DYN_OTSUKIAI ___DYNAMICIP && OTSUKIAI
score DYN_OTSUKIAI 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody KONOKIMOCHI /\$3\$N5\$\;\}\$A/
describe KONOKIMOCHI konokimochi
score KONOKIMOCHI 0.3

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody UWAKI /Ib5\$/
describe UWAKI uwaki
score UWAKI 0.3

meta DYN_UWAKI ___DYNAMICIP && UWAKI
score DYN_UWAKI 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody FURIN /ITNQ/
describe FURIN furin
score FURIN 0.3

meta DYN_FURIN ___DYNAMICIP && FURIN
score DYN_FURIN 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody WARIKIRI /3d\$j\@Z\$j/
describe WARIKIRI warikiri
score WARIKIRI 0.3

meta DYN_WARIKIRI ___DYNAMICIP && WARIKIRI
score DYN_WARIKIRI 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody DOUTEI /F8Dg/
describe DOUTEI doutei
score DOUTEI 0.3

meta DYN_DOUTEI ___DYNAMICIP && DOUTEI
score DYN_DOUTEI 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody HITODZUMA /\?M\:J/
describe HITODZUMA hitodzuma
score HITODZUMA 0.3

meta DYN_HITODZUMA ___DYNAMICIP && HITODZUMA
score DYN_HITODZUMA 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody MIDARA /0\|\$i/
describe MIDARA midara
score MIDARA 0.3

meta DYN_MIDARA ___DYNAMICIP && MIDARA
score DYN_MIDARA 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody HIMITSUNO /HkL\)\$N/
describe HIMITSUNO himitsuno
score HIMITSUNO 0.1

meta DYN_HIMITSUNO ___DYNAMICIP && HIMITSUNO
score DYN_HIMITSUNO 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody HIMITSUNOHOGE /HkL\)\$N(\=P2q\$\$|M\'C\#|4X78|\$\*IU\$\-9g\$\$)/
describe HIMITSUNOHOGE himitsuno hogehoge
score HIMITSUNOHOGE 1.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody FUAN /IT0B/
describe FUAN fuan
score FUAN 0.2

meta DYN_FUAN ___DYNAMICIP && FUAN
score DYN_FUAN 2.0

# body ANATA /\$\"\$J\$\?(\$\,|\$7\$\+|\$H|\$K|\$N|\$O|\$X\$N|\$b|\$r)/
# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody ANATA /(5\.J\}|\$\"\$J\$\?)(\$\,|\$7\$\+|\$H|\$K|\$N|\$O|\$X\$N|\$b|\$r|\$\@)/
describe ANATA Anata ... call me my name.(sigh)
score ANATA 0.5

meta DYN_ANATA  ___DYNAMICIP && ANATA
score DYN_ANATA 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody ONEGAI /\$\*4j\$\$/
describe ONEGAI onegai
score ONEGAI 0.2

meta DYN_ONEGAI ___DYNAMICIP && ONEGAI
score DYN_ONEGAI 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody TOUROKU /EPO\?(\$\,|\$7\$\?|\$7\$A\$c\$\$|\$7\$F|\$7\$J\$\$|\$7\$\^\$9|\$9\$k|\$C\$F|\$G\$\-|\$H\$\$\$\&|\$H\$\+|\$N|\$O|\R2p|\$"\$j\$,\$H\$\&\$4\$6\$\$\$\^)/

#)/
describe TOUROKU touroku
score TOUROKU 0.5

meta DYN_TOUROKU ___DYNAMICIP && TOUROKU
score DYN_TOUROKU 2.0

# 
# meta ANATAONEGAITOUROKU ANATA && ONEGAI && TOUROKU && (JPSCAMURI || JPSCAMMAILADDRESS)
# describe ANATAONEGAITOUROKU ANATA ONEGAI TOUROKU to JPSCAMURI or JPSCAMMAILADDRESS
# score ANATAONEGAITOUROKU 3.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody OHENJI /\$\*JV\;v/
describe OHENJI Ohenji
score OHENJI 0.2

meta DYN_OHENJI ___DYNAMICIP && OHENJI
score DYN_OHENJI 2.0

meta OHENJIMATTERU OHENJI && MATTERU
describe OHENJIMATTERU OHENJI && MATTERU
score OHENJIMATTERU 1.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody HOTERU /\%\[\%F\%k/
describe HOTERU hoteru
score HOTERU 0.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody HOTEL /(HOTEL|\#H\#O\#T\#E\#L)/i
describe HOTEL hotel
score HOTEL 0.5

meta DYN_HOTEL ___DYNAMICIP && (HOTEL || HOTERU)
score DYN_HOTEL 2.5

# meta HOTEL __HOTERU || __HOTEL
# describe HOTEL HOTEL
# score HOTEL 0.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody TOUSATSU /Ep\;\#/
describe TOUSATSU tousatsu
score TOUSATSU 1.0

meta DYN_TOUSATSU ___DYNAMICIP && TOUSATSU
score DYN_TOUSATSU 4.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody KARESHI /H\`\;a/
describe KARESHI kareshi
score KARESHI 0.2

meta DYN_KARESHI ___DYNAMICIP && KARESHI
score DYN_KARESHI 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody CHAT /\%A\%c\%C\%H/
describe CHAT chatto
score CHAT 0.2

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody HITORIKURASHI /0l\?MJk\$i\$7/
describe HITORIKURASHI hitorikurashi
score HITORIKURASHI 0.2

meta DYN_HITORIKURASHI ___DYNAMICIP && HITORIKURASHI
score DYN_HITORIKURASHI 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody CIRCLE /\%5\!\<\%\/\%k/
describe CIRCLE sa-kuru
score CIRCLE 0.1

meta DYN_CIRCLE ___DYNAMICIP && CIRCLE
score DYN_CIRCLE 1.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody MAJIMENAKANKEI /(\?\?LLL\\\$J|3d\$j\@Z\$C\$\?|Bg\?M\$N|BN\$N)(4X78|8r\:\]|\$\*IU\$\-9g\$\$|\$\*\$D\$\-9g\$\$)/
describe MAJIMENAKANKEI majimenakankei
score MAJIMENAKANKEI 1.5

meta DYN_MAJIMENAKANKEI ___DYNAMICIP && MAJIMENAKANKEI
score DYN_MAJIMENAKANKEI 3.0

# 
# meta CIRCLEKANKEI CIRCLE && MAJIMENAKANKEI
# describe CIRCLEKANKEI CIRCLE && MAJIMENAKANKEI
# score CIRCLEKANKEI 3.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody ENQUETE /\%\"\%s\%1\!\<\%H/
describe ENQUETE anke-to
score ENQUETE 0.2

meta DYN_ENQUETE ___DYNAMICIP && ENQUETE
score DYN_ENQUETE 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody DAIHYOU /BeI\=/
describe DAIHYOU daihyou
score DAIHYOU 0.2

meta DYN_DAIHYOU ___DYNAMICIP && DAIHYOU
score DYN_DAIHYOU 2.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody BOSHUUWO /(?:Bg){0,1}Jg\=8(?:\$r){0,1}/
describe BOSHUUWO boshuuwo
score BOSHUUWO 0.1

meta DYN_BOSHUUWO ___DYNAMICIP && BOSHUUWO
score DYN_BOSHUUWO 2.0

# thrown away 2005.09.14 by [yoh]
# 
# meta DAIHYOUBOSHUUENQ ENQUETE && DAIHYOU && BOSHUUWO
# describe DAIHYOUBOSHUUENQ ENQUETE && DAIHYOU && BOSHUUWO
# score DAIHYOUBOSHUUENQ 1.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody DANSEIKAIIN /(CK|\=w)\@\-2q0w/
describe DANSEIKAIIN danseikaiin
score DANSEIKAIIN 1.5

meta DYN_DANSEIKAIIN ___DYNAMICIP && DANSEIKAIIN
score DYN_DANSEIKAIIN 3.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody TOMODACHI /M\'C\#/
describe TOMODACHI tomodachi
score TOMODACHI 0.1

meta DYN_TOMODACHI ___DYNAMICIP && TOMODACHI
score DYN_TOMODACHI 1.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody AISHOU /Aj\@\-/
describe AISHOU aishou
score AISHOU 0.2

meta DYN_AISHOU ___DYNAMICIP && AISHOU
score DYN_AISHOU 1.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody FERA /\%U\%\'\%i/
describe FERA Japanese porn word: fera
score FERA 1.0

meta DYN_FERA ___DYNAMICIP && FERA
score DYN_FERA 3.0

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody KINSENTEKI /6bA\,E\*\$[JK]/
describe KINSENTEKI Kinsenteki
score KINSENTEKI 0.2

meta DYN_KINSENTEKI ___DYNAMICIP && KINSENTEKI
score DYN_KINSENTEKI 1.5

# In SA 3.2.x, "body" rule has been changed.
# So, for matching ISO-2022-JP strings, we have to change to "rawbody" rule.
# 2008.05.24 by [yoh]
rawbody KIKONSHA /4\{\:\'\&:`/
score SHOUZAI 0.5

meta DYN_SHOUZAI ___DYNAMICIP && SHOUZAI
score DYN_SHOUZAI 3.5

rawbody JOUHOU />pJs/
score JOUHOU 0.1

meta JOUHOUSHOUZAI JOUHOU && SHOUZAI
score JOUHOUSHOUZAI 1.5

# 
# I wrote this rule at 2005.10.19 10:30.
# When the faked Received: will be disappeared?
# 2005.10.19 by [yoh]
# 
# http://www.iana.org/assignments/ipv4-address-space
# over 223.0.0.0 is invalid.
# 2005.12.15 by [yoh]
# 

# header FORGED_RCVD_IP Received =~ /from.+((2(2[3-9]|[3-9][0-9])|[3-9][0-9][0-9])(\.[0-9]+){3,3}|[0-9]+\.(2(5[6-9]|[6-9][0-9])|[3-9][0-9][0-9])(\.[0-9]+){2,2}|([0-9]+\.){2,2}(2(5[6-9]|[6-9][0-9])|[3-9][0-9][0-9])(\.[0-9]+)|(2(5[6-9]|[6-9][0-9])|[3-9][0-9][0-9])(\.[0-9]+){3,3})/
# header FORGED_RCVD_IP Received =~ /from.+((2(2[3-9]|[3-9][0-9])|[3-9][0-9][0-9])(\.[0-9]+){3,3}[^a-zA-Z0-9\._-]|[0-9]+\.(2(5[6-9]|[6-9][0-9])|[3-9][0-9][0-9])(\.[0-9]+){2,2}|([0-9]+\.){2,2}(2(5[6-9]|[6-9][0-9])|[3-9][0-9][0-9])(\.[0-9]+)|([0-9]+\.){3,3}(2(5[6-9]|[6-9][0-9])|[3-9][0-9][0-9]))/
# header FORGED_RCVD_IP Received =~ /from.+((2(2[3-9]|[3-9]\d)|[3-9]\d\d)(\.\d){3}[^a-zA-Z0-9\._-]|\d{1,3}\.(2(5[6-9]|[6-9]\d)|[3-9]\d\d)(?:\.\d{1,3}){2}|(\d{1,3}\.){2}(2(5[6-9]|[6-9]\d)|[3-9]\d\d)(?:\.\d{1,3})|(\d{1,3}\.){3}(2(5[6-9]|[6-9]\d)|[3-9]\d\d))/
# header FORGED_RCVD_IP Received =~ /from.+(\W(9[6-9]|1[01]\d|120|2(2[3-9]|[3-9]\d)|[3-9]\d\d)(?:\.\d{1,3}){3}[^\w\.-]|\d{1,3}\.(2(5[6-9]|[6-9]\d)|[3-9]\d\d)(?:\.\d{1,3}){2}|(\d{1,3}\.){2}(2(5[6-9]|[6-9]\d)|[3-9]\d\d)(?:\.\d{1,3})|(\d{1,3}\.){3}(2(5[6-9]|[6-9]\d)|[3-9]\d\d))/
# header FORGED_RCVD_IP Received =~ /(\W([01257]|2[37]|3[1679]|42|7[789]|9[6-9]|1[01]\d|120|17[3-9]|18[0-7]|197|2(2[3-9]|[3-9]\d)|[3-9]\d\d|\d{4,})(?:\.\d{1,3}){3}[^\w\.-]|\d{1,3}\.(2(5[6-9]|[6-9]\d)|[3-9]\d\d)(?:\.\d{1,3}){2}|(\d{1,3}\.){2}(2(5[6-9]|[6-9]\d)|[3-9]\d\d)(?:\.\d{1,3})|(\d{1,3}\.){3}(2(5[6-9]|[6-9]\d)|[3-9]\d\d))/
# header FORGED_RCVD_IP Received =~ /([^\w\.]([01257]|2[37]|3[1679]|42|7[789]|9[6-9]|1[01]\d|120|17[3-9]|18[0-7]|197|2(2[3-9]|[3-9]\d)|[3-9]\d\d|\d{4,})(\.\d{1,3}){3}[^\w\.-]|\d{1,3}\.(2(5[6-9]|[6-9]\d)|[3-9]\d\d)(\.\d{1,3}){2}|(\d{1,3}\.){2}(2(5[6-9]|[6-9]\d)|[3-9]\d\d)(\.\d{1,3})|(\d{1,3}\.){3}(2(5[6-9]|[6-9]\d)|[3-9]\d\d))/
# header FORGED_RCVD_IP Received =~ /[^\w\.](([01257]|2[37]|3[1679]|42|7[789]|9[6-9]|1[01]\d|120|17[3-9]|18[0-7]|197|2(2[3-9]|[3-9]\d)|[3-9]\d\d|\d{4,})(\.\d{1,3}){3}|\d{1,3}\.(2(5[6-9]|[6-9]\d)|[3-9]\d\d|\d{4,})(\.\d{1,3}){2}|(\d{1,3}\.){2}(2(5[6-9]|[6-9]\d)|[3-9]\d\d|\d{4,})(\.\d{1,3})|(\d{1,3}\.){3}(2(5[6-9]|[6-9]\d)|[3-9]\d\d|\d{4,}))[^\w\.-]/
# header FORGED_RCVD_IP Received =~ /[^\w\.](([01257]|2[37]|3[1679]|42|7[789]|9[6-9]|1[01]\d|120|17[3-9]|18[0-7]|197|2(2[3-9]|[3-9]\d)|[3-9]\d\d)(\.\d{1,3}){3}|\d{1,3}\.(2(5[6-9]|[6-9]\d)|[3-9]\d\d)(\.\d{1,3}){2}|(\d{1,3}\.){2}(2(5[6-9]|[6-9]\d)|[3-9]\d\d)(\.\d{1,3})|(\d{1,3}\.){3}(2(5[6-9]|[6-9]\d)|[3-9]\d\d))[^\w\.-]/
# header FORGED_RCVD_IP Received =~ /[^\w\.](([01257]|2[37]|3[1679]|42|7[789]|9[6-9]|1[01]\d|120|17[3-9]|18[0-7]|197|2(2[3-9]|[3-9]\d)|[3-9]\d\d|\d{4,})(\.\d{1,3}){3}|\d{1,3}\.(2(5[6-9]|[6-9]\d)|[3-9]\d\d|\d{4,})(\.\d{1,3}){2}|(\d{1,3}\.){2}(2(5[6-9]|[6-9]\d)|[3-9]\d\d|\d{4,})(\.\d{1,3})|(\d{1,3}\.){3}(2(5[6-9]|[6-9]\d)|[3-9]\d\d|\d{4,}))[^\w\.-].+with/
# header FORGED_RCVD_IP Received =~ /[^\w\.](([01257]|2[37]|3[1679]|42|7[89]|9[6-9]|1[01][0-5]|120|17[3-9]|18[0-7]|197|2(2[3-9]|[3-9]\d)|[3-9]\d\d|\d{4,})(\.\d{1,3}){3}|\d{1,3}\.(2(5[6-9]|[6-9]\d)|[3-9]\d\d|\d{4,})(\.\d{1,3}){2}|(\d{1,3}\.){2}(2(5[6-9]|[6-9]\d)|[3-9]\d\d|\d{4,})(\.\d{1,3})|(\d{1,3}\.){3}(2(5[6-9]|[6-9]\d)|[3-9]\d\d|\d{4,}))[\)\] ].+with/
# header FORGED_RCVD_IP Received =~ /[^\w\.](([01257]|2[37]|3[1679]|4[269]|50|[89]\d|10[0-7]|17[3-9]|18[156]|197|2(2[3-9]|[3-9]\d)|[3-9]\d\d|\d{4,})(\.\d{1,3}){3}|\d{1,3}\.(2(5[6-9]|[6-9]\d)|[3-9]\d\d|\d{4,})(\.\d{1,3}){2}|(\d{1,3}\.){2}(2(5[6-9]|[6-9]\d)|[3-9]\d\d|\d{4,})(\.\d{1,3})|(\d{1,3}\.){3}(2(5[6-9]|[6-9]\d)|[3-9]\d\d|\d{4,}))[\)\] ].+with/
header FORGED_RCVD_IP Received =~ /[^\w\.](?:(?:[01257]|2[37]|3[1679]|4[269]|50|10[0-7]|17[679]|18[156]|197|2(?:2[3-9]|[3-9]\d)|[3-9]\d\d|\d{4,})(?:\.\d{1,3}){3}|\d{1,3}\.(?:2(?:5[6-9]|[6-9]\d)|[3-9]\d\d|\d{4,})(?:\.\d{1,3}){2}|(?:\d{1,3}\.){2}(?:2(?:5[6-9]|[6-9]\d)|[3-9]\d\d|\d{4,})(?:\.\d{1,3})|(?:\d{1,3}\.){3}(?:2(?:5[6-9]|[6-9]\d)|[3-9]\d\d|\d{4,}))[\)\] ].+with/
describe FORGED_RCVD_IP Invalid IP number, over 255.
score FORGED_RCVD_IP 1.0


# header RCVD_NUMERIC_HELO2 X-Spam-Relays-Untrusted =~ /helo=\!([0-9]{1,3}\.){3,3}[0-9]{1,3}\! .+ ident= envfrom= intl=0 .+ auth= /
header RCVD_NUMERIC_HELO2 X-Spam-Relays-Untrusted =~ /helo=\!(\d{1,3}\.){3}\d{1,3}\! .+ ident= envfrom= intl=0 .+ auth= /
describe RCVD_NUMERIC_HELO2 Received: contains bracketted IP address string used for HELO
score RCVD_NUMERIC_HELO2 1.5


# added 2009.06.17 by [yoh]
# modified 2011.01.24 by [yoh]
# deleted 2011.03.09 by [yoh]
# 
# header __X_MAILER_PRESENT	exists:X-Mailer
# describe X_MAILER_PRESENT	exists:X-Mailer
# score X_MAILER_PRESENT	0.1

header X_SHIROYAGI_VER exists:X-Shiroyagi-Version
score X_SHIROYAGI_VER 1.5

header X_SHIROYAGI_URL exists:X-Shiroyagi-URL
score X_SHIROYAGI_URL 1.5

meta DYN_SHIROYAGI ___DYNAMICIP && (X_SHIROYAGI_VER || X_SHIROYAGI_URL)
score DYN_SHIROYAGI 3.5



# thrown away 2005.09.14 by [yoh]
# 
# meta SUNFINANCE_2 ISO2022JP_CHARSET && OBFUS_JP_TO && !(__HAS_X_MAILER)
# describe SUNFINANCE_2 ISO2022JP_CHARSET && OBFUS_JP_TO && !(__HAS_X_MAILER)
# score SUNFINANCE_2 2.4

header THREAD_INDEX exists:thread-index
describe THREAD_INDEX thread-index: AcO7Y8iR61tzADqsRmmc5wNiFHEOig==
score THREAD_INDEX 0.3

# header THREAD_TOPIC exists: Thread-Topic
# describe THREAD_TOPIC Thread-Topic: ...(Japanese Subject)...
# score THREAD_TOPIC 0.3

meta SJISNOTXMAILER (SHIFT_JIS1 || SJIS_BODY) && ! __HAS_X_MAILER
describe SJISNOTXMAILER (SHIFT_JIS1 || SJIS_BODY) && ! __HAS_X_MAILER
score SJISNOTXMAILER 2.0


# I found that "uri" testing fails to match uri strings preceding Japanese character.
# 2004.06.19 [yoh]
rawbody JPPORNURI /http:\/\/[a-z0-9.]*(5611[1-8]\.jp|117net\.net|lovemedo\.jp|miss\-you\.jp|w\-ink\.net|celebc\.com|18kin\.jp|e-dm\.org|4610\.com|koi51\.net|chachat\.net|dekichat\.com|pacificgirls\.com|altero\.tv|1919mmo\.com|008s\.be|warikiri\.to|web-wave\.com|77qq\.net|deai-tt\.com|hitkart\.com|qqq-aaa\.com|amg\.to|net-land\.info|yoitokoro\.com|okokoknet\.net|yoitokoro\.com|av-live\.com|b-tiku\.com|secretoflove\.net|39515[12]\.com|elitecities\.com|free-mode\.net|pure-sweethome\.bz|191919\.cc|garlicbutter\.net|sukeper\.net|551155\.jp|withlove\.the-ninja\.jp|na7\.dynu\.ca)\/{0,1}/
describe JPPORNURI Japanese porn site
score JPPORNURI 4.0

header JPPORNSCAMFROM From =~ /\@(5611[1-8]\.jp|117net\.net|lovemedo\.jp|e-dm\.org|55dvd\.net|koi51\.net|love2deai\.com|lily-adolescence\.|d-mail\.biz|1919japan\.com|395152\.com|vig-seet\.to|1919\.st|adadjp\.com|famail\.jp|venusnetwoerk\.cx|spacelan\.ne\.jp)/
describe JPPORNSCAMFROM Japanese porn and scam domain
score JPPORNSCAMFROM 7.0

# I found that "uri" testing fails to match uri strings preceding Japanese character.
# 2004.06.19 [yoh]
# 2004.11.05 [yoh]
# baken\.tv|hot\.hot\.com|denen-soho\.com|117mail\.net|
# combzmail\.jp|
# |[a-z0-9]+

rawbody JPSCAMURI /http:\/\/[a-z0-9-.]*(europe\.webmatrixhosting\.net|gogoway\.orgdns\.org|spread\.or\.tv|maga\.readymade\.jp|value\.webcordial\.com|pika\.tv|19191969\.com|093ana\.com|cam-cam\.net|candypop\.tv|deaiking\.com|milkymail\.net|purelove888\.com|secretoflove\.net|l1l9\.com|otegaruhp\.com\/cobra\/html\/hirokopr|online-jp\.net|outside-lover\.com|blue-ocean2004\.com|naturalget\.com|scoop-on\.(com|jp)|1092\.cn|1092\.gs|19190930\.com|i1i9\.net|l1l9\.com|yoso-zu\.com|rose-kiss\.com|members\.fortunecity\.com|up7\.cc|eyc\.jp|zl8\.jp|61\.96\.62\.167|pure1151\.com|bblive\.tv|ai-angel\.net|soku-aeru\.net|nightpita\.com|dejavu\.to|tada\.ph|peachat\.net|1919japan\.com|to-roku\.com|ceaw\.jp|59862777\.com|orange-rocket\.com|prin\.to|lolo\.ojiji\.net|ana093\.cc|eroero999\.com|love4deai\.com|kicks-ass\.net|is-a-geek\.org|lovemint\.net|e-hot-news\.jp|getget\.oops\.jp|upper\.jp|xx-mail\.jp|px\.a8\.net|pc\.lovefree\.tv|pure1107\.net|ljart\.net|(0-9a-z)+\.ifdef\.jp|(free24mail|365hdate)\.fc2\.com|odaiba-bbs\.jp|ai51\.e-city\.tv|bokumetu\.com|kissmi\.jp|party-jamjam\.org|hosting-geomax\.jp|sf-spot\.com|big-888\.com|o-oku-channel\.com|soresoreweb\.com|geocities\.jp\/(sayacchimail|poophy15)|websamba\.com|members\.lycos\.co\.uk\/cadlove|[a-z0-9-]+\.(tripod\.com|host\.sk)(\/top|\/main){0,1}|xid-love\.netfirms\.com|club-classico\.com|e-ezweb\.jp|rakuen-dx\.com|lover-kiss\.com|cross\.ne\.jp|j-sine\.com|swht\.jp|doxlive\.com|perfectharmony-ms\.org|1251\.us|servecounterstrike\.com|[a-z_-]*deai[a-z_-]*\.[a-z0-9-]+\.(jp|com|net|tv|sk|cn)|61\.197\.117\.99|redmax\.jp|morachao\.com|1251\.cc|formzu\.net|members\.ocry\.com|cbat\.page\.ne\.jp|889860\.com|89balls\.com|filltheblank\.com|members2\.jcom\.home\.ne\.jp\/3385927201|aru-aru\.jpn\.org|otz5678\.hn\.org|tinyurl\.com|choco2\.jp|buisinespp\.dyndns\.dk|abcwill\.dyn\.dhs\.org|yudoweb1\.freewebsitehosting\.com|umimono.no.sapo.pt|656566\.com|sss-japan\.co\.jp|home\.doramail\.com|www40\.brinkster\.com|shameme\.host\.sk|autocall\.jp|dm-mail\.net|www18\.ocn\.ne\.jp\/\~kio-pack|mo-v\.jp|www\.tactnet\.co\.jp|hiromirror-desighner\.net|fff\.lir\.dk|s-s\.kyed\.com|brandwholesaler\.com|nihon-cash\.com|dogyman\.com|yellowsanta\.jp|bottom-up1\.com|hime\.ontheweb\.nu|free-xx\.com|address-bank\.homeip\.net|agk-777\.jp|shotgunmarriage\.net|(minami|farewell|alstroemeria)\.dynu\.ca|kyousai\.squares\.net|gigamerimp\.net|boorats19\.info|sunnyday\.jp|life-line\.mods\.jp|lucavenus\.jp|e-shops\.jp|fox99\.staticcling\.org|e-net\.velvet\.jp|access\.main\.jp|webclick\.chu\.jp|www\.infotop\.jp|www\.mailbank\.biz|ladymaid\.net|new-homebiz\.com|777navi\.cc|riajet\.com|af-sv\.com|yy-life\.com|1151bbs\.jp|gambletips\.net|oogachi-t\.com|keiba-de-myhome-get\.seesaa\.net|pachipuro-m\.com|sugowaza\.jp|free-book\.jp|ippatu\.com|.\$B%a%k%:.\(B\.jp|data-jobbank\.from\.tv|deairooms\.com|1-coin\.jp|combzmail\.jp|insiderscoachingclub\.com|genkiclub\.net|viviani\.jp|sakakibara\.zz\.tc|miss-me\.findyou2\.net|at-soho\.rdy\.jp|pavbq\.com|kagurazaka\.biz|sc37\.vczln\.com|snsns\.my-sv\.net|e-bukken\.co\.jp|ji06\.gtwd\.biz|ktaisearch\.com|shop\.shenlihang\.info|baojpp\.com|sakuradvd\.com|oshirase-jp\.com|genkiclub1470\.com|shoppingjp\.net|rdnw\.net|i-ktai\.com|rkg\.(?:jp|cc)|megami\.hiho\.jp|infodirect\.bz|aboy\.jp|sakuses2012\.web\.fc2\.com|123direct\.info|freesianet\.co\.jp|sisoras\.info|fx-worldalliance\.com|w-net\.cc|yutori-bank\.com|jpn\.org|f\.msgs\.jp|serendipshop\.com|shop-pro\.jp|oison\.xsrv\.jp|crecomcre\.com|1lejend\.com|paz\.jp|kei\.net|reizeike\.com|megami\.hiho\.jp|auc-life\.org|icon-corp\.sub\.jp|helphealjapan\.com|sanwango\.com|serendip-corp\.com|mag-r\.net|incomes\.jp|e-mailcm\.com|air-studio1956\.jp|av-hdvd\.com|jimdo\.com|att7\.jp|uamapuro\.com|kurokage-keiba\.com)\/{0,1}/
describe JPSCAMURI Japanese scam site
score JPSCAMURI 3.5

meta JPSCAMURI99 JPSCAMURI && BAYES_99
describe JPSCAMURI99 JPSCAMURI && BAYES_99
score JPSCAMURI99 5.0

meta SJISJPSCAMURI SJIS_C && JPSCAMURI
describe SJISJPSCAMURI SJIS_C && JPSCAMURI
score SJISJPSCAMURI 10

# rawbody URLTRANSFER /(http:\/\/tinyurl\.com\/{0,1}|http:\/\/www\.google\.([a-z].|com|co\.[a-z].)\/pagead\/iclk\?sa=l\&ai=[A-Za-z]+\&num=\d+\&adurl=http:\/\/)/
rawbody URLTRANSFER /http:\/\/(?:(?:tinyurl\.com|yourl\.be)\/{0,1}|www\.google\.(?:[a-z]{2}|com|co\.[a-z]{2})\/pagead\/iclk\?sa=l\&ai=[A-Za-z]+\&num=\d+\&adurl=http:\/\/|utun\.jp|bit\.ly)/
score URLTRANSFER 0.1

meta DYN_URLTRANS ___DYNAMICIP && URLTRANSFER
score DYN_URLTRANS 3.5

meta URLT_CBL URLTRANSFER && RCVD_IN_CBL
score URLT_CBL 3.5
meta URLT_SPAMCOP URLTRANSFER && RCVD_IN_BL_SPAMCOP_NET
score URLT_SPAMCOP 3.5
meta URLT_DSBL URLTRANSFER && RCVD_IN_DSBL
score URLT_DSBL 3.5
# meta URLT_DUL URLTRANSFER && RCVD_IN_SORBS_DUL
# score URLT_DUL 3.5

meta URLT_PBL URLTRANSFER && RCVD_IN_PBL
score URLT_PBL 3.5
meta URLT_DCN URLTRANSFER && ___DCN 
score URLT_DCN 3.5


# Umm, I've not seen recent spams including telephone numbers.
# 2005.04.21 by [yoh]

body JPSCAMTEL /(?:0774-52-5633|090-8159-3461|0774-56-6428|0120-40-8689|090-8437-9455|090-8174-2533|0774-55-7505|03-3404-7373|\#0\#8\#0\!\]\#5\#4\#4\#3\!\]\#4\#0\#7\#6|0774-55-1479|0774-52-5634|090-9947-4750|090-8502-8857|090-5518-3019|080-3768-3495|090-6010-0125|090-8431-1023|03-5981-0843|09081601952|090-1568-7184|06-6263-2169|0774-52-5639|0774-55-6737|03-5979-6201|0774-55-6726|03-3392-2301|03-3392-2308|06-6556-601[67]|03-5232-6030|052-961-1470|052-961-1448|03-3299-1260|03-3299-6790|0.{0,8}5.{0,8}0.{0,8}6.{0,8}8.{0,8}6.{0,8}1.{0,8}(?:1.{0,8}5.{0,8}1.{0,8}1|1.{0,8}3.{0,8}0.{0,8}0|1.{0,8}3.{0,8}6.{0,8}4)|090-9932-1488|050-3736-035[56])/
describe JPSCAMTEL Japanese scam telephone number
score JPSCAMTEL 4.0

# body JPSCAMMAILADDRESS /(play\-M\-[0-9]{5}\@[a-z-]+\.net)/
# body JPSCAMMAILADDRESS /(play|reg)\-M\-[a-z0-9]+\@[a-z-]+\.(net|com|jp)/
body JPSCAMMAILADDRESS /\@(?:w-technology\.net|icon-corp\.info|helphealjapan\.com|clickclick\.biz\.nf|sanwango\.com|genkimaster\.jp|genkiclub1470\.com|e-mailcm\.com|rainbow\.am|i-lands\.net|kei\.net)/
describe JPSCAMMAILADDRESS Japanese scam mail address
score JPSCAMMAILADDRESS 3.0

# uri SCAMPHARM /http:\/\/[a-z0-9.]*(anadromous3344pi11s\.us|aplace2getmyrx\.com|direct-meds4less\.com|e-prescriptions\.us|ettllrx\.us|findrxfast\.com|good4umeds\.com|hasslefreerx\.com|inspiredbyachievement\.com|morning-meds\.com|okscriptsworld\.com|pharm-martworld\.com|reliableherbalproducts\.com|rxtrx\.us|seenonlyonce\.com|simpleandgreat\.com|smileyproductmall\.com|startoverproducts\.com|stream8759dryg\.us|the-medmart\.com|the-medmartworld\.com|traditionalrx\.com|where2go4rx\.com|worldofrx\.com|thepillsnational\.com)/

# thrown away 2005.09.14 by [yoh]
# 
# meta INVYAHJPFALSE ALL_TRUSTED && INVALIDYAHOOJP
# describe INVYAHJPFALSE ALL_TRUSTED && INVALIDYAHOOJP
# score INVYAHJPFALSE 3.3
# 
# meta PLAYINVYAHOOJP JPSCAMMAILADDRESS && INVALIDYAHOOJP
# describe PLAYINVYAHOOJP JPSCAMMAILADDRESS && INVALIDYAHOOJP
# score PLAYINVYAHOOJP 7.0
# 
# rawbody SWEN_A_BOUNCED /


Undelivered mail to [a-z]{6,}\@(america|aol|bigfoot|freemail|microsoft|netmail|puremail|rocketmail|yahoo)\.(com|net)<\/B>/
# describe SWEN_A_BOUNCED Faked "bounced error" message generated by I-Worm/Swen.A
# score SWEN_A_BOUNCED 10.0

# (FORGED_OUTLOOK_TAGS || FORGED_HOTMAIL_RCVD || FORGED_YAHOO_RCVD || FORGED_OUTLOOK_TAGS || FORGED_HOTMAIL_RCVD2 || FORGED_JUNO_RCVD || FORGED_MUA_OIMO || FORGED_HOTMAIL_RCVD2 || FORGED_MUA_OUTLOOK || FORGED_MX_HOTMAIL || FORGED_MUA_OUTLOOK)

meta FORGED99 BAYES_99 && ___FORGED
describe FORGED99 FORGED_* && BAYES_99
score FORGED99 2.0


# meta MTAIDRBLJP MSGID_FROM_MTA_ID && URLBL_RBLJP
# describe MTAIDRBLJP MSGID_FROM_MTA_ID && URLBL_RBLJP
# score MTAIDRBLJP 10.0

# meta UNDISCMTAID UNDISC_RECIPS && MSGID_FROM_MTA_ID
# describe UNDISCMTAID UNDISC_RECIPS && MSGID_FROM_MTA_ID
# score UNDISCMTAID 10.0

# 
# 2008.06.29 by [yoh]
# 
meta BOUNCESPAM (__BOUNCE_RPATH_NULL || __BOUNCE_FROM_DAEMON || __BOUNCE_CTYPE ||__BOUNCE_RPATH_MD) && (URIBL_BLACK || URIBL_AB_SURBL || URIBL_SC_SURBL || URIBL_JP_SURBL || URIBL_OB_SURBL || URIBL_SBL || URIBL_RHS_DOB || URIBL_PH_SURBL || URIBL_WS_SURBL || URLBL_RBLJP)
score BOUNCESPAM 7.5

# 
# - Razor and Pyzor score
# 

# Razor2 sometimes fails to recognize ham as spam.
# So I can't add score.
# In 3.1.0, you have to enable plugin "Mail::SpamAssassin::Plugin::Razor2"
# in /etc/spamassassin/v310.pre .
# http://marc.theaimsgroup.com/?l=spamassassin-announce&m=112674318914008&w=2
# 2005.09.26 by [yoh]
# 

score RAZOR2_CF_RANGE_51_100 2.5
score RAZOR2_CHECK 1.0

meta RAZORPYZOR RAZOR2_CF_RANGE_51_100 && PYZOR_CHECK && BAYES_99
describe RAZORPYZOR RAZOR2_CF_RANGE_51_100 && PYZOR_CHECK && BAYES_99
score RAZORPYZOR 10.0


# Bayes engine needs frequently maintenance and balanced corpus.
# So I decided setting low score.
# 2010.04.14 by [yoh]
meta RAZOR99 RAZOR2_CF_RANGE_51_100 && BAYES_99
describe RAZOR99 RAZOR2_CF_RANGE_51_100 && BAYES_99
score RAZOR99 1.5

# 2009.09.29 by [yoh]
# modified 2010.12.16 by [yoh]
meta DYN_RAZOR (RAZOR2_CF_RANGE_51_100 || RAZOR2_CHECK) && ___DYNAMICIP
score DYN_RAZOR 3.5

# Pyzor sometimes fails to recognize ham as spam.
# So I decided setting low score.
# 2007.07.08 by [yoh]

score PYZOR_CHECK 1.5


# Bayes engine needs frequently maintenance and balanced corpus.
# So I decided setting low score.
# 2010.04.14 by [yoh]
meta PYZOR99 PYZOR_CHECK && BAYES_99
describe PYZOR99 PYZOR_CHECK && BAYES_99
score PYZOR99 1.5

# 2009.09.29 by [yoh]
meta DYN_PYZOR PYZOR_CHECK && ___DYNAMICIP
score DYN_PYZOR 3.5


# DCC sometimes fails to recognize ham as spam.
# So I decided setting low score.
# 2009.03.22 by [yoh]

score DCC_CHECK 1.2

# 2009.09.29 by [yoh]
meta DYN_DCC DCC_CHECK && ___DYNAMICIP
score DYN_DCC 3.5


meta ___DCN RAZOR2_CF_RANGE_E8_51_100  || RAZOR2_CHECK  || RAZOR2_CF_RANGE_51_100  || PYZOR_CHECK || DCC_CHECK

# meta ___FORGED (FORGED_RCVD_HELO || FORGED_OUTLOOK_TAGS || FORGED_HOTMAIL_RCVD || FORGED_YAHOO_RCVD || FORGED_OUTLOOK_TAGS || FORGED_HOTMAIL_RCVD2 || FORGED_JUNO_RCVD || FORGED_MUA_OIMO || FORGED_HOTMAIL_RCVD2 || FORGED_MUA_OUTLOOK || FORGED_MUA_OUTLOOK)
# meta ___FORGED FORGED_HOTMAIL_RCVD || FORGED_HOTMAIL_RCVD2 || FORGED_JUNO_RCVD || FORGED_MUA_OIMO || FORGED_MUA_OUTLOOK || FORGED_RCVD_HELO || FORGED_YAHOO_RCVD
meta ___FORGED FORGED_HOTMAIL_RCVD2 || FORGED_MUA_OIMO || FORGED_MUA_OUTLOOK || FORGED_YAHOO_RCVD

meta FORGED_DCN ___DCN && ___FORGED
describe FORGED_DCN Distributed Collaborative Network and FORGED_xxx
score FORGED_DCN 5.5

meta SPF_DCN (SPF_HELO_SOFTFAIL || SPF_FAIL) && ___DCN
score SPF_DCN 5.5

# 
# deleted 2010.09.26 by [yoh]
# 
# meta THEBAT_DCN REPTO_OVERQUOTE_THEBAT && ___DCN
# score THEBAT_DCN 5.5


# meta ___TVD TVD_FW_GRAPHIC_ID1 || TVD_FW_GRAPHIC_ID2 || TVD_FW_GRAPHIC_ID3 || TVD_FW_GRAPHIC_NAME_LONG || TVD_PDF_FINGER01
meta ___TVD TVD_FW_GRAPHIC_NAME_LONG || TVD_PDF_FINGER01

meta TVDFWGR_DCN ___TVD && ___DCN
score TVDFWGR_DCN 3.5

# 
# deleted 2010.09.26 by [yoh]
# 
# meta THEBAT_TVDFWGR REPTO_OVERQUOTE_THEBAT && ___TVD
# score THEBAT_TVDFWGR 3.5

# meta MTAID_THEBAT MSGID_FROM_MTA_ID && REPTO_OVERQUOTE_THEBAT
# score MTAID_THEBAT 3.5

# meta MTAID_TVDFWGR MSGID_FROM_MTA_ID && ___TVD
# score MTAID_TVDFWGR 3.5

# 
# deleted 2010.09.26 by [yoh]
# 
# meta RCVDIP_DCN RCVD_HELO_IP_MISMATCH && ___DCN
# score RCVDIP_DCN 5.5



# These DNSBLs policy is idealism.
# We have to escape some legal sites against marking from the DNSBLs.
# DNS_FROM_RFC_WHOIS
# DNS_FROM_RFC_POST
# DNS_FROM_RFC_ABUSE

# score DNS_FROM_RFC_POST 0.1
# score DNS_FROM_RFC_ABUSE 0.1

# 
# Special thanks to: 'Koaihito' Yu-ma shishou and Nasa-n: 2005/09/21 by [yoh]
# 

header VALIDDOCOMO X-Spam-Relays-Untrusted =~ /^\[ ip=203\.138\.203\.\d{1,3} /
describe VALIDDOCOMO valid docomo.ne.jp's IP
score VALIDDOCOMO -3.5

# meta DNSFRMRFC_WHITE DNS_FROM_RFC_POST && VALIDDOCOMO
# describe DNSFRMRFC_WHITE for avoiding valid site from DNS_FROM_RFC_POST
# score DNSFRMRFC_WHITE -3.5

# 
# Special thanks to: Yajisan and Kamosame: 2005/09/29 by [yoh]
# 

header VALIDWILLCOM Received =~ /from .*pdxio[0-9]+\.pdx\.ne\.jp.+by /
describe VALIDWILLCOM valid WILLCOM IP
score VALIDWILLCOM -3.5



# -- DNSBL checking --
# Before you use DNSBL checking, you have to install
# "Net::DNS - Perl DNS Resolver Module"
# ex. apt-get install libnet-dns-perl (Debian)
# 2004.04.23 by [yoh]

#
# I found some DNSBLs have wrong IP/URI listings.
# To avoid wrong judgement, making meta rules with BAYES_99 may be a good
# solution, I believe.
# 2005.02.05 by [yoh]
#


skip_rbl_checks 0
rbl_timeout 15


# http://improbable.org/chris/index.php?ID=109

header      RCVD_IN_RFC_PM      eval:check_rbl('relay', 'postmaster.rfc-ignorant.org.')
describe    RCVD_IN_RFC_PM      Received via a relay in postmaster.rfc-ignorant.org
score       RCVD_IN_RFC_PM      0.1

header      X_CHINESE_RELAY     eval:check_rbl('relay', 'cn.rbl.cluecentral.net.')
describe    X_CHINESE_RELAY     Received via a relay in China
score       X_CHINESE_RELAY     0.1

header      X_KOREAN_RELAY      eval:check_rbl('relay', 'korea.services.net.')
describe    X_KOREAN_RELAY      Received via a relay in Korea
score       X_KOREAN_RELAY      0.1

meta XKOREAN99 X_KOREAN_RELAY && BAYES_99
describe XKOREAN99 X_KOREAN_RELAY && BAYES_99
score XKOREAN99 3.0

meta XKOREANJP X_KOREAN_RELAY && (ISO2022JP_BODY || SJIS_BODY)
describe XKOREANJP X_KOREAN_RELAY && (ISO2022JP_BODY || SJIS_BODY)
score XKOREANJP 2.0

# block.blars.org is not reliable. see http://check.jippg.org/rblchk.cgi
# 
# header    RCVD_IN_BLARS                 eval:check_rbl('blars', 'block.blars.org.')
# describe  RCVD_IN_BLARS                 BLARS: in Blacklist / Blocklist block.blars.org
# score     RCVD_IN_BLARS                 0.1
# tflags    RCVD_IN_BLARS                 net
# 
# header    RCVD_IN_BLARS_SPAM            eval:check_rbl_sub('blars', '1')
# describe  RCVD_IN_BLARS_SPAM            BLARS: Spam sending domain in Blacklist / Blocklist block.blars.org
# score     RCVD_IN_BLARS_SPAM            0.5
# tflags    RCVD_IN_BLARS_SPAM            net
# 
# header    RCVD_IN_BLARS_MULTI           eval:check_rbl_sub('blars', '2')
# describe  RCVD_IN_BLARS_MULTI           BLARS: Multi-hop relay in Blacklist / Blocklist block.blars.org
# score     RCVD_IN_BLARS_MULTI           0.1
# tflags    RCVD_IN_BLARS_MULTI           net
# 
# header    RCVD_IN_BLARS_DIALUP          eval:check_rbl_sub('blars-notfirsthop', '4')
# describe  RCVD_IN_BLARS_DIALUP          BLARS: Dynamic / Dialups in Blacklist / Blocklist block.blars.org
# score     RCVD_IN_BLARS_DIALUP          0.1
# tflags    RCVD_IN_BLARS_DIALUP          net
# 
# header    RCVD_IN_BLARS_HOOPS           eval:check_rbl_sub('blars', '8')
# describe  RCVD_IN_BLARS_HOOPS           BLARS: Wants spam complainers to jump through hoops in Blacklist / Blocklist block.blars.org
# score     RCVD_IN_BLARS_HOOPS           0.1
# tflags    RCVD_IN_BLARS_HOOPS           net
# 
# header    RCVD_IN_BLARS_ABUSE           eval:check_rbl_sub('blars', '16')
# describe  RCVD_IN_BLARS_ABUSE           BLARS: No working abuse address in Blacklist / Blocklist block.blars.org
# score     RCVD_IN_BLARS_ABUSE           0.1
# tflags    RCVD_IN_BLARS_ABUSE           net
# 
# header    RCVD_IN_BLARS_SPAM_WEB        eval:check_rbl_sub('blars', '32')
# describe  RCVD_IN_BLARS_SPAM_WEB        BLARS: Hosts spamers web sites in Blacklist / Blocklist block.blars.org
# score     RCVD_IN_BLARS_SPAM_WEB        0.01
# tflags    RCVD_IN_BLARS_SPAM_WEB        net
# 
# header    RCVD_IN_BLARS_SPAMDROP       eval:check_rbl_sub('blars', '64')
# describe  RCVD_IN_BLARS_SPAMDROP       BLARS: Hosts spammers email dropboxes in Blacklist / Blocklist block.blars.org
# score     RCVD_IN_BLARS_SPAMDROP       0.01
# tflags    RCVD_IN_BLARS_SPAMDROP       net
# 
# header    RCVD_IN_BLARS_HACK            eval:check_rbl_sub('blars', '128')
# describe  RCVD_IN_BLARS_HACK            BLARS: Breakin attempts in Blacklist / Blocklist block.blars.org
# score     RCVD_IN_BLARS_HACK            0.1
# tflags    RCVD_IN_BLARS_HACK            net
# 
# header    RCVD_IN_BLARS_SUE             eval:check_rbl_sub('blars', '256')
# describe  RCVD_IN_BLARS_SUE             BLARS: Sued or prosecuted DNSBL lister in Blacklist / Blocklist block.blars.org
# score     RCVD_IN_BLARS_SUE             0.1
# tflags    RCVD_IN_BLARS_SUE             net
# 
# header    RCVD_IN_BLARS_DOS             eval:check_rbl_sub('blars', '512')
# describe  RCVD_IN_BLARS_DOS             BLARS: DOS attack in Blacklist / Blocklist block.blars.org
# score     RCVD_IN_BLARS_DOS             0.01
# tflags    RCVD_IN_BLARS_DOS             net
# 
# header    RCVD_IN_BLARS_SPAMWARE       eval:check_rbl_sub('blars', '1024')
# describe  RCVD_IN_BLARS_SPAMWARE       BLARS: Supplier of spamware in Blacklist / Blocklist block.blars.org
# score     RCVD_IN_BLARS_SPAMWARE       0.1
# tflags    RCVD_IN_BLARS_SPAMWARE       net
# 
# header    RCVD_IN_BLARS_SPSPRT    eval:check_rbl_sub('blars', '2048')
# describe  RCVD_IN_BLARS_SPSPRT    BLARS: Knowingly supports spammers in Blacklist / Blocklist block.blars.org
# score     RCVD_IN_BLARS_SPSPRT    0.1
# tflags    RCVD_IN_BLARS_SPSPRT    net
# 
# header    RCVD_IN_BLARS_CARTOON       eval:check_rbl_sub('blars', '4096')
# describe  RCVD_IN_BLARS_CARTOON       BLARS: Legal threats in Blacklist / Blocklist block.blars.org
# score     RCVD_IN_BLARS_CARTOON       0.1
# tflags    RCVD_IN_BLARS_CARTOON       net
# 
# header    RCVD_IN_BLARS_HIJCKRLY      eval:check_rbl_sub('blars', '8192')
# describe  RCVD_IN_BLARS_HIJCKRLY      BLARS: Attempted mail relay exploits in Blacklist / Blocklist block.blars.org
# score     RCVD_IN_BLARS_HIJCKRLY      0.1
# tflags    RCVD_IN_BLARS_HIJCKRLY      net
# 
# header    RCVD_IN_BLARS_HIJCKCGI      eval:check_rbl_sub('blars', '16384')
# describe  RCVD_IN_BLARS_HIJCKCGI      BLARS: Attempted formmail exploits exploits in Blacklist / Blocklist block.blars.org
# score     RCVD_IN_BLARS_HIJCKCGI      0.1
# tflags    RCVD_IN_BLARS_HIJCKCGI      net
# 
# meta BLARS00 RCVD_IN_BLARS && BAYES_00
# describe BLARS00 RCVD_IN_BLARS is very low reliability.
# score BLARS00 -5
# 
# meta BLARS_SPAM00 RCVD_IN_BLARS_SPAM && BAYES_00
# describe BLARS_SPAM00 RCVD_IN_BLARS_SPAM is very low reliability.
# score BLARS_SPAM00 -5
# 

# SpamAssassin local.cf for AHBL BlackList / BlockList
# "Old blackholes.2mbit.com resurrected as AHBL (dnsbl.ahbl.org)"
# URL: http://www.ahbl.org
header RCVD_IN_AHBL eval:check_rbl('AHBL', 'dnsbl.ahbl.org.')
describe RCVD_IN_AHBL AHBL: sender is listed in BlackList / BlockList dnsbl.ahbl.org
score RCVD_IN_AHBL 0.5
tflags RCVD_IN_AHBL net header RCVD_IN_AHBL_UNKNOWN_1 eval:check_rbl_sub('AHBL', '127.0.0.1')
# describe RCVD_IN_AHBL_UNKNOWN_1 AHBL: Unknown Category 1 in BlackList / BlockList dnsbl.ahbl.org
# score RCVD_IN_AHBL_UNKNOWN_1 0.01
# tflags RCVD_IN_AHBL_UNKNOWN_1 net
# 
# header RCVD_IN_AHBL_SMTP eval:check_rbl_sub('AHBL', '127.0.0.2')
# describe RCVD_IN_AHBL_SMTP AHBL: Open SMTP relay in BlackList / BlockList dnsbl.ahbl.org
# score RCVD_IN_AHBL_SMTP 0.5
# tflags RCVD_IN_AHBL_SMTP net

header RCVD_IN_AHBL_PROXY eval:check_rbl_sub('AHBL', '127.0.0.3')
describe RCVD_IN_AHBL_PROXY AHBL: Open Proxy server in BlackList / BlockList dnsbl.ahbl.org
score RCVD_IN_AHBL_PROXY 0.2
tflags RCVD_IN_AHBL_PROXY net

header RCVD_IN_AHBL_SPAM eval:check_rbl_sub('AHBL', '127.0.0.4')
describe RCVD_IN_AHBL_SPAM AHBL: Spam Source in BlackList / BlockList dnsbl.ahbl.org
score RCVD_IN_AHBL_SPAM 0.1
tflags RCVD_IN_AHBL_SPAM net

# header RCVD_IN_AHBL_RTB eval:check_rbl_sub('AHBL', '127.0.0.5')
# describe RCVD_IN_AHBL_RTB AHBL: Real-Time Blocked in BlackList / BlockList dnsbl.ahbl.org
# score RCVD_IN_AHBL_RTB 0.01
# tflags RCVD_IN_AHBL_RTB net
# 
# header RCVD_IN_AHBL_FORMMAIL eval:check_rbl_sub('AHBL', '127.0.0.6')
# describe RCVD_IN_AHBL_FORMMAIL AHBL: Abuseable Form Mail in BlackList / BlockList dnsbl.ahbl.org
# score RCVD_IN_AHBL_FORMMAIL 0.5
# tflags RCVD_IN_AHBL_FORMMAIL net

header RCVD_IN_AHBL_SPSUPPORT eval:check_rbl_sub('AHBL', '127.0.0.7')
describe RCVD_IN_AHBL_SPSUPPORT AHBL: Spam Supporter in BlackList / BlockList dnsbl.ahbl.org
score RCVD_IN_AHBL_SPSUPPORT 0.5
tflags RCVD_IN_AHBL_SPSUPPORT net

# header RCVD_IN_AHBL_I_SPAM_SUPPORT eval:check_rbl_sub('AHBL', '127.0.0.8')
# describe RCVD_IN_AHBL_I_SPAM_SUPPORT AHBL: Indirect Spam supporter in BlackList / BlockList dnsbl.ahbl.org
# score RCVD_IN_AHBL_I_SPAM_SUPPORT 0.5
# tflags RCVD_IN_AHBL_I_SPAM_SUPPORT net
# 
# header RCVD_IN_AHBL_ENDUSER eval:check_rbl_sub('AHBL', '127.0.0.9')
# describe RCVD_IN_AHBL_ENDUSER AHBL: End User (non mail system) in BlackList / BlockList dnsbl.ahbl.org
# score RCVD_IN_AHBL_ENDUSER 0.5
# tflags RCVD_IN_AHBL_ENDUSER net
# 
# header RCVD_IN_AHBL_SOS eval:check_rbl_sub('AHBL-notfirsthop', '127.0.0.10')
# describe RCVD_IN_AHBL_SOS AHBL: Shoot On Sight in BlackList / BlockList dnsbl.ahbl.org
# score RCVD_IN_AHBL_SOS 0.5
# tflags RCVD_IN_AHBL_SOS net
# 
# header RCVD_IN_AHBL_RFCI_PA eval:check_rbl_sub('AHBL', '127.0.0.11')
# describe RCVD_IN_AHBL_RFCI_PA AHBL: Missing Postmaster or Abuse Address in BlackList / BlockList dnsbl.ahbl.org
# score RCVD_IN_AHBL_RFCI_PA 0.5
# tflags RCVD_IN_AHBL_RFCI_PA net
# 
# header RCVD_IN_AHBL_5XXI eval:check_rbl_sub('AHBL', '127.0.0.12')
# describe RCVD_IN_AHBL_5XXI AHBL: Does not properly handle 5xx errors in BlackList / BlockList dnsbl.ahbl.org
# score RCVD_IN_AHBL_5XXI 0.5
# tflags RCVD_IN_AHBL_5XXI net
# 
# header RCVD_IN_AHBL_RFCI_MISC eval:check_rbl_sub('AHBL', '127.0.0.13')
# describe RCVD_IN_AHBL_RFCI_MISC AHBL: Other Non-RFC Compliant in BlackList / BlockList dnsbl.ahbl.org
# score RCVD_IN_AHBL_RFCI_MISC 0.5
# tflags RCVD_IN_AHBL_RFCI_MISC net
# 
# header RCVD_IN_AHBL_MISC eval:check_rbl_sub('AHBL', '127.0.0.127')
# describe RCVD_IN_AHBL_MISC AHBL: Misc (other) in BlackList / BlockList dnsbl.ahbl.org
# score RCVD_IN_AHBL_MISC 0.5
# tflags RCVD_IN_AHBL_MISC net

# Listed in cbl.abuseat.org http://cbl.abuseat.org/
header RCVD_IN_CBL              eval:check_rbl_txt('cbl', 'cbl.abuseat.org.')
describe RCVD_IN_CBL            Received via a relay in cbl.abuseat.org
tflags RCVD_IN_CBL              net
score RCVD_IN_CBL               0.1


# Subject: Re: 2 Questions
# From: Matt Kettler 
# Date: Wed, 13 Jul 2005 17:25:19 -0400
# http://mail-archives.apache.org/mod_mbox/spamassassin-users/200507.mbox/%3c42D586BF.6060600@evi-inc.com%3e

# removed 2011.04.17 by [yoh]
# http://bui.asablo.jp/blog/2010/10/31/5459612
# http://hibari.2ch.net/test/read.cgi/unix/1124772932/394
# header RCVD_IN_CHINA_KR         eval:check_rbl('countrycnkr','cn-kr.blackholes.us.')
# describe RCVD_IN_CHINA_KR       Received from China or Korea
# tflags  RCVD_IN_CHINA_KR        net
# score RCVD_IN_CHINA_KR          0.1
# added 2011.04.17 by [yoh]
header RCVD_IN_KOREA         eval:check_rbl('wariate.jp','kr.cc.wariate.jp.')
describe RCVD_IN_KOREA       Received via a Korea IP address in kr.cc.wariate.jp
tflags  RCVD_IN_KOREA        net
score RCVD_IN_KOREA          0.1



# header __RCVD_IN_NERDS    eval:check_rbl('nerds', 'zz.countries.nerd.dk.')
# describe __RCVD_IN_NERDS    Rule to match every country
# tflags __RCVD_IN_NERDS    net
# score RCVD_IN_NERDS_US    2.0
# 
# header RCVD_IN_NERDS_US    eval:check_rbl_sub('nerds', '127.0.3.72)
# describe RCVD_IN_NERDS_US    Rule to deduct weight for US sourced messages
# tflags RCVD_IN_NERDS_US    net nice
# score RCVD_IN_NERDS_US    -2.0
# 
# header __RCVD_IN_NERDS    eval:check_rbl('nerds', 'zz.countries.nerd.dk.')
# 
# 
# header __RCVD_IN_NERDS                  eval:check_rbl('nerds','zz.countries.nerd.dk.')
# describe __RCVD_IN_NERDS                Received from a spam country
# tflags __RCVD_IN_NERDS                  net
# 
# header RCVD_IN_NERDS_AR                 eval:check_rbl_sub('nerds','127.0.0.32')
# describe RCVD_IN_NERDS_AR               Received from Argentina
# tflags RCVD_IN_NERDS_AR                 net
# score RCVD_IN_NERDS_AR                  2.5
# 
# header RCVD_IN_NERDS_BR                 eval:check_rbl_sub('nerds','127.0.0.76')
# describe RCVD_IN_NERDS_BR               Received from Brazil
# tflags RCVD_IN_NERDS_BR                 net
# score RCVD_IN_NERDS_BR                  3.5
# 
# header RCVD_IN_NERDS_CL                 eval:check_rbl_sub('nerds','127.0.0.152')
# describe RCVD_IN_NERDS_CL               Received from Chile
# tflags RCVD_IN_NERDS_CL                 net
# score RCVD_IN_NERDS_CL                  2.5
# 
# header RCVD_IN_NERDS_CN                 eval:check_rbl_sub('nerds','127.0.0.156')
# describe RCVD_IN_NERDS_CN               Received from China
# tflags RCVD_IN_NERDS_CN                 net
# score RCVD_IN_NERDS_CN                  3.5
# 
# header RCVD_IN_NERDS_HK                 eval:check_rbl_sub('nerds','127.0.1.88')
# describe RCVD_IN_NERDS_HK               Received from Hong Kong
# tflags RCVD_IN_NERDS_HK                 net
# score RCVD_IN_NERDS_HK                  2.0
# 
# header RCVD_IN_NERDS_IN                 eval:check_rbl_sub('nerds','127.0.1.100')
# describe RCVD_IN_NERDS_IN               Received from India
# tflags RCVD_IN_NERDS_IN                 net
# score RCVD_IN_NERDS_IN                  2.5
# 
# header RCVD_IN_NERDS_JP                 eval:check_rbl_sub('nerds','127.0.1.136')
# describe RCVD_IN_NERDS_JP               Received from Japan
# tflags RCVD_IN_NERDS_JP                 net
# score RCVD_IN_NERDS_JP                  2.0
# 
# header RCVD_IN_NERDS_KP                 eval:check_rbl_sub('nerds','127.0.1.152')
# describe RCVD_IN_NERDS_KP               Received from North Korea
# tflags RCVD_IN_NERDS_KP                 net
# score RCVD_IN_NERDS_KR                  3.5
# 
# header RCVD_IN_NERDS_KR                 eval:check_rbl_sub('nerds','127.0.1.154')
# describe RCVD_IN_NERDS_KR               Received from South Korea
# tflags RCVD_IN_NERDS_KR                 net
# score RCVD_IN_NERDS_KR                  3.5
# 
# header RCVD_IN_NERDS_MY                 eval:check_rbl_sub('nerds','127.0.1.202')
# describe RCVD_IN_NERDS_MY               Received from Malaysia
# tflags RCVD_IN_NERDS_MY                 net
# score RCVD_IN_NERDS_MY                  2.5
# 
# header RCVD_IN_NERDS_MX                 eval:check_rbl_sub('nerds','127.0.1.228')
# describe RCVD_IN_NERDS_MX               Received from Mexico
# tflags RCVD_IN_NERDS_MX                 net
# score RCVD_IN_NERDS_MX                  2.0
# 
# header RCVD_IN_NERDS_NG                 eval:check_rbl_sub('nerds','127.0.2.54')
# describe RCVD_IN_NERDS_NG               Received from Nigera
# tflags RCVD_IN_NERDS_NG                 net
# score RCVD_IN_NERDS_NG                  3.5
# 
# header RCVD_IN_NERDS_RU                 eval:check_rbl_sub('nerds','127.0.2.131')
# describe RCVD_IN_NERDS_RU               Received from Russia
# tflags RCVD_IN_NERDS_RU                 net
# score RCVD_IN_NERDS_RU                  2.5
# 
# header RCVD_IN_NERDS_SG                 eval:check_rbl_sub('nerds','127.0.2.190')
# describe RCVD_IN_NERDS_SG               Received from North Singapore
# tflags RCVD_IN_NERDS_SG                 net
# score RCVD_IN_NERDS_SG                  2.0
# 
# header RCVD_IN_NERDS_TW                 eval:check_rbl_sub('nerds','127.0.0.158')
# describe RCVD_IN_NERDS_TW               Received from South Taiwan
# tflags RCVD_IN_NERDS_TW                 net
# score RCVD_IN_NERDS_TW                  2.5
# 
# header RCVD_IN_NERDS_TH                 eval:check_rbl_sub('nerds','127.0.2.252')
# describe RCVD_IN_NERDS_TH               Received from Thailand
# tflags RCVD_IN_NERDS_TH                 net
# score RCVD_IN_NERDS_TH                  2.5
# 
# header RCVD_IN_NERDS_TR                 eval:check_rbl_sub('nerds','127.0.3.24')
# describe RCVD_IN_NERDS_TR               Received from Turkey
# tflags RCVD_IN_NERDS_TR                 net
# score RCVD_IN_NERDS_TR                  2.0


# SORBS, list.dsbl.org, dnsbl.njabl.org have ISP's DHCP IP in Japan.
# So, meta rules of bayes is needed while using this DNSBL.
# 2005.1.28 by [yoh]

# SORBS will be closed.
# 2009.7.1 by [yoh]

# score       RCVD_IN_SORBS_DUL     0.5
# score       RCVD_IN_SORBS_HTTP    1.0
# score       RCVD_IN_SORBS_MISC    0.5
# score       RCVD_IN_SORBS_SOCKS   1.0
# score       RCVD_IN_SORBS_WEB     1.0

# meta SORBSDUL99 RCVD_IN_SORBS_DUL && BAYES_99
# describe SORBSDUL99 RCVD_IN_SORBS_DUL && BAYES_99
# score SORBSDUL99 2.0

# meta SORBSDUL00 RCVD_IN_SORBS_DUL && BAYES_00
# describe SORBSDUL00 RCVD_IN_SORBS_DUL && BAYES_00
# score SORBSDUL00 -2.0

# meta DYN_SORBSDUL RCVD_IN_SORBS_DUL && ___DYNAMICIP
# score DYN_SORBSDUL 3.5


# score       RCVD_IN_SORBS_SOCKS 1.50
# score       RCVD_IN_SORBS_HTTP  1.50
# score       RCVD_IN_OPM         1.50
# score       RCVD_IN_OPM_HTTP_POST 1.50

# 
# ORDB has been shutdowned. 2006.12.19 by [yoh]
# 
# header RCVD_IN_RELAYS_ORDBORG  rbleval:check_rbl('relay', 'relays.ordb.org.')
# describe RCVD_IN_RELAYS_ORDBORG Received via a relay in relays.ordb.org
# tflags RCVD_IN_RELAYS_ORDBORG  net
# score RCVD_IN_RELAYS_ORDBORG 0.5


score       RCVD_IN_DSBL        0.5

# 
# SPAMCOP - very strict DNSBL, but it's not complete.
# Sometimes SPAMCOP records hammy IPs.
# 2005.09.25 by [yoh]
# 
score       RCVD_IN_BL_SPAMCOP_NET 0.1

meta SPAMCOP99 RCVD_IN_BL_SPAMCOP_NET && BAYES_99
describe SPAMCOP99 RCVD_IN_BL_SPAMCOP_NET && BAYES_99
score SPAMCOP99 3.0

meta SPAMCOP95 RCVD_IN_BL_SPAMCOP_NET && BAYES_95
describe SPAMCOP95 RCVD_IN_BL_SPAMCOP_NET && BAYES_95
score SPAMCOP95 1.5

meta SPAMCOP00 RCVD_IN_BL_SPAMCOP_NET && BAYES_00
describe SPAMCOP00 RCVD_IN_BL_SPAMCOP_NET && BAYES_00
score SPAMCOP00 -5.0

meta RAZORSPAMCOP RCVD_IN_BL_SPAMCOP_NET && RAZOR2_CF_RANGE_51_100
describe RAZORSPAMCOP RCVD_IN_BL_SPAMCOP_NET && RAZOR2_CF_RANGE_51_100
score RAZORSPAMCOP 8.0

# meta FORGEDSPAMCOP RCVD_IN_BL_SPAMCOP_NET && ___FORGED
# describe FORGEDSPAMCOP Distributed Collaborative Network and RCVD_IN_BL_SPAMCOP_NET
# score FORGEDSPAMCOP 3.0


score       RCVD_IN_SBL         0.1
score       RCVD_IN_XBL         0.5

# added 2011.04.28 by [yoh]
score       RCVD_IN_PBL         0.5

# meta SBL99 RCVD_IN_SBL && BAYES_99
# describe SBL99 RCVD_IN_SBL && BAYES_99
# score SBL99 3.50

score       RCVD_IN_NJABL_PROXY 0.50
# score       RCVD_IN_NJABL       0.50

score       RCVD_IN_NJABL_RELAY 0.50
# score       DNS_FROM_RFCI_DSN   1.50

# score       RCVD_IN_NJABL_DUL   0.50

# meta NJABLDUL99  RCVD_IN_NJABL_DUL && BAYES_99
# describe NJABLDUL99  RCVD_IN_NJABL_DUL && BAYES_99
# score NJABLDUL99  0.5

# meta DYN_NJABLDUL RCVD_IN_NJABL_DUL && ___DYNAMICIP
# score DYN_NJABLDUL 1.5


# score RCVD_IN_WHOIS_INVALID 1.0

# URIBL_BLACK includes false positive URIs.
# 2007.12.09 by [yoh]
score URIBL_BLACK 1.0


# meta RCVD_COP_SORBS_DSBL RCVD_IN_BL_SPAMCOP_NET && (RCVD_IN_SORBS || RCVD_IN_DSBL) && BAYES_99
# describe RCVD_COP_SORBS_DSBL RCVD_IN_BL_SPAMCOP_NET && (RCVD_IN_SORBS || RCVD_IN_DSBL) && BAYES_99
# score RCVD_COP_SORBS_DSBL 3.0

meta RCVDSBL99 RCVD_IN_SBL && BAYES_99
describe RCVDSBL99 RCVD_IN_SBL && BAYES_99
score RCVDSBL99 2.5

meta RCVDSBLBLACK RCVD_IN_SBL && URIBL_BLACK
score RCVDSBLBLACK 5.5


meta FORGEDDSBL RCVD_IN_DSBL && ___FORGED
describe FORGEDDSBL Distributed Collaborative Network and RCVD_IN_DSBL
score FORGEDDSBL 2.5



meta RCVDCBL99 RCVD_IN_CBL && BAYES_99
describe RCVDCBL99 RCVD_IN_CBL && BAYES_99
score RCVDCBL99 3.5

meta RCVDXBL99 RCVD_IN_XBL && BAYES_99
describe RCVDXBL99 RCVD_IN_XBL && BAYES_99
score RCVDXBL99 3.5

meta FORGEDXBL RCVD_IN_XBL && ___FORGED
describe FORGEDXBL Distributed Collaborative Network and RCVD_IN_XBL
score FORGEDXBL 2.5

meta TVDFWGR_XBL ___TVD && RCVD_IN_XBL
score TVDFWGR_XBL 3.5

meta TVDFWGR_COP ___TVD && RCVD_IN_BL_SPAMCOP_NET
score TVDFWGR_COP 3.5

meta SPF_COP (SPF_HELO_SOFTFAIL || SPF_FAIL) && RCVD_IN_BL_SPAMCOP_NET
score SPF_COP 3.5

meta SPF_PBL (SPF_HELO_SOFTFAIL || SPF_FAIL) && RCVD_IN_PBL
score SPF_PBL 3.5


# added 2011.02.2 by [yoh]
# deleted 2011.05.20 by [yoh]
# meta DYN_SPF_XMAILER SPF_PASS && ___DYNAMICIP && ! __HAS_X_MAILER
# score DYN_SPF_XMAILER 5.5



meta XBL_DCN ___DCN && RCVD_IN_XBL
score XBL_DCN 3.5
meta CBL_DCN ___DCN && RCVD_IN_CBL
score CBL_DCN 3.5
meta PBL_DCN ___DCN && RCVD_IN_PBL
score PBL_DCN 3.5
meta BLACK_DCN ___DCN && URIBL_BLACK
score BLACK_DCN 3.5
meta SBL_DCN ___DCN && URIBL_SBL
score SBL_DCN 3.5
# meta DUL_DCN ___DCN && RCVD_IN_SORBS_DUL
# score DUL_DCN 3.5



# meta RCVD_COP_SBL_XBL RCVD_IN_BL_SPAMCOP_NET && RCVD_IN_SBL && BAYES_99
# describe RCVD_COP_SBL_XBL RCVD_IN_BL_SPAMCOP_NET && RCVD_IN_SBL && BAYES_99
# score RCVD_COP_SBL_XBL 3.0
# 
# meta RCVD_COP_CBL RCVD_IN_BL_SPAMCOP_NET && RCVD_IN_CBL && BAYES_99
# describe RCVD_COP_CBL RCVD_IN_BL_SPAMCOP_NET && RCVD_IN_CBL && BAYES_99
# score RCVD_COP_CBL 3.0
# 
# meta RCVD_CBL_SBL_XBL RCVD_IN_SBL && RCVD_IN_CBL && BAYES_99
# describe RCVD_CBL_SBL_XBL RCVD_IN_SBL && RCVD_IN_CBL && BAYES_99
# score RCVD_CBL_SBL_XBL 3.0


# URIBL_SBL has missing uri.
# So, it's not reliable.
# 2005.02.02 by [yoh]
# 2006.01.02 by [yoh]
# score URIBL_SBL 2.0
score URIBL_SBL 0.1

meta URIBLSBL99 URIBL_SBL && BAYES_99
describe URIBLSBL99 URIBL_SBL && BAYES_99
score URIBLSBL99 2.0

meta URIBLSBL00 URIBL_SBL && BAYES_00
describe URIBLSBL00 URIBL_SBL && BAYES_00
score URIBLSBL00 -2.0

# 
# deleted 2010.09.26 by [yoh]
# 
# meta RCVDIP_URIBLSBL URIBL_SBL && RCVD_HELO_IP_MISMATCH
# score RCVDIP_URIBLSBL 3.5

# 2009.07.30 by [yoh]
# 2010.12.25 renamed by [yoh]
meta DYN_URLSBL URIBL_SBL && ___DYNAMICIP
score DYN_URLSBL 3.5
# 2010.12.25 by [yoh]
meta DYN_SBL RCVD_IN_SBL && ___DYNAMICIP
score DYN_SBL 3.5


# 2011.11.21 by [yoh]
meta DYN_URIBL (URIBL_BLACK || URIBL_AB_SURBL || URIBL_SC_SURBL || URIBL_JP_SURBL || URIBL_OB_SURBL || URIBL_SBL || URIBL_RHS_DOB || URIBL_PH_SURBL || URIBL_WS_SURBL || URLBL_RBLJP) && ___DYNAMICIP
score DYN_URIBL 3.5

# Now, URIBL_WS_SURBL is reliable.
# 2005.06.07 by [yoh]
# score URIBL_WS_SURBL 1.0

# Now, URIBL_JP_SURBL is reliable.
# 2005.06.07 by [yoh]
urirhssub URIBL_JP_SURBL  multi.surbl.org.        A   64
body      URIBL_JP_SURBL  eval:check_uridnsbl('URIBL_JP_SURBL')
describe  URIBL_JP_SURBL  Has URI in JP at http://www.surbl.org/lists.html
tflags    URIBL_JP_SURBL  net
score URIBL_JP_SURBL    1.0


# From: Jeff Chan 
# Subject: Please test sc2.surbl.org (and xs.surbl.org)
# Date: Mon, 25 Jul 2005 06:14:59 GMT
# http://mail-archives.apache.org/mod_mbox/spamassassin-users/200507.mbox/%3c1974834350.20050724231459@surbl.org%3e
# From: Jeff Chan 
# Subject: Re: Please test sc2.surbl.org (and xs.surbl.org)
# Date: Mon, 25 Jul 2005 08:55:12 GMT
# http://mail-archives.apache.org/mod_mbox/spamassassin-users/200507.mbox/%3c497174917.20050725015512@surbl.org%3e

urirhsbl  URIBL_SC2_SURBL  sc2.surbl.org.   A
body      URIBL_SC2_SURBL  eval:check_uridnsbl('URIBL_SC2_SURBL')
describe  URIBL_SC2_SURBL  Has URI in SC2 at http://www.surbl.org/lists.html
tflags    URIBL_SC2_SURBL  net

score     URIBL_SC2_SURBL  1.0

urirhsbl  URIBL_XS_SURBL   xs.surbl.org.    A
body      URIBL_XS_SURBL   eval:check_uridnsbl('URIBL_XS_SURBL')
describe  URIBL_XS_SURBL   Has URI in XS - Testing
tflags    URIBL_XS_SURBL   net

score     URIBL_XS_SURBL   1.0



# score RCVD_IN_SORBS_WEB 1.5
# meta SORBSWEB99 RCVD_IN_SORBS_WEB && BAYES_99
# describe SORBSWEB99 RCVD_IN_SORBS_WEB && BAYES_99
# score SORBSWEB99 1.5

score URIBL_OB_SURBL 0.1

meta SURBL99 (URIBL_AB_SURBL || URIBL_OB_SURBL || URIBL_PH_SURBL || URIBL_SC_SURBL || URIBL_WS_SURBL || URIBL_JP_SURBL || URIBL_SC2_SURBL || URIBL_XS_SURBL) && BAYES_99
describe SURBL99 URIBL_??_SURBL && BAYES_99
score SURBL99 3.5

meta SURBL_DCN (URIBL_AB_SURBL || URIBL_OB_SURBL || URIBL_PH_SURBL || URIBL_SC_SURBL || URIBL_WS_SURBL || URIBL_JP_SURBL || URIBL_SC2_SURBL || URIBL_XS_SURBL) && ___DCN
describe SURBL_DCN Distributed Collaborative Network and URIBL_??_SURBL
score SURBL_DCN 5.5


# 
# rbl.jp: strict and reliable DNSBL originated from Japan: 2004.11.27 by [yoh]
# 

urirhssub URLBL_RBLJP url.rbl.jp. A 2
body URLBL_RBLJP eval:check_uridnsbl('URLBL_RBLJP')
describe URLBL_RBLJP Has URI in url.rbl.jp
tflags URLBL_RBLJP net

uridnsbl_skip_domain livedoor.com reset.jp asahi-net.or.jp hi-ho.ne.jp 2ch.net hatena.ne.jp
uridnsbl_skip_domain mixi.jp
score URLBL_RBLJP 1.5

meta URLRBLJP99 URLBL_RBLJP && BAYES_99
describe URLRBLJP99 URLBL_RBLJP && BAYES_99
score URLRBLJP99 2.0

meta URLRBLJP_DCN URLBL_RBLJP && ___DCN
describe URLRBLJP_DCN URLBL_RBLJP && ___DCN
score URLRBLJP_DCN 10

meta URLRBLJP_DYN URLBL_RBLJP && ___DYNAMICIP
score URLRBLJP_DYN 5.5


header  RCVD_IN_SHORT_RBL_JP   eval:check_rbl_txt('rbl.jp', 'short.rbl.jp.')
describe RCVD_IN_SHORT_RBL_JP Received via a relay in short.rbl.jp
tflags RCVD_IN_SHORT_RBL_JP   net
score RCVD_IN_SHORT_RBL_JP 1.5

header  RCVD_IN_VIRUS_RBL_JP   eval:check_rbl_txt('rbl.jp', 'virus.rbl.jp.')
describe RCVD_IN_VIRUS_RBL_JP Received via a relay in virus.rbl.jp
tflags RCVD_IN_VIRUS_RBL_JP   net
score RCVD_IN_VIRUS_RBL_JP 1.0


meta SHORTRBLJP99 RCVD_IN_SHORT_RBL_JP && BAYES_99
describe SHORTRBLJP99 RCVD_IN_SHORT_RBL_JP && BAYES_99
score SHORTRBLJP99 1.5

meta RBLJP_URL_SHORT URLBL_RBLJP && RCVD_IN_SHORT_RBL_JP
score RBLJP_URL_SHORT 5.0


meta OTHER_RBLJIS (URLBL_RBLJP || JPSCAMURI) && (ARIN || RIPE_NCC || LACNIC || AFRINIC || ___KOREATAIWANCHINA )
score OTHER_RBLJIS 1.5

# 
# I stopped using fiveten.
# 2006.12.14 by [yoh]
# 

# http://marc.theaimsgroup.com/?l=spamassassin-users&m=111558903223018&w=2

# header __RCVD_IN_FIVETENSG    eval:check_rbl('blackholes', 'blackholes.five-ten-sg.com.')
# describe __RCVD_IN_FIVETENSG  Received via a relay in blackholes.five-ten-sg.com
# tflags __RCVD_IN_FIVETENSG    net

# header RCVD_IN_FIVETENSG    eval:check_rbl_sub('blackholes', '127.0.0.2')
# describe RCVD_IN_FIVETENSG  Received via a spam relay in blackholes.five-ten-sg.com
# tflags RCVD_IN_FIVETENSG    net
# score RCVD_IN_FIVETENSG     0.1

# meta FIVETEN99 RCVD_IN_FIVETENSG && BAYES_99
# describe FIVETEN99 RCVD_IN_FIVETENSG && BAYES_99
# score FIVETEN99 0.2

# meta RAZORFIVETEN RCVD_IN_FIVETENSG && RAZOR2_CF_RANGE_51_100
# describe RAZORFIVETEN RCVD_IN_FIVETENSG && RAZOR2_CF_RANGE_51_100
# score RAZORFIVETEN 1.0

# meta DYN_FIVETEN RCVD_IN_FIVETENSG && ___DYNAMICIP
# score DYN_FIVETEN 3.0

#
# http://mail-archives.apache.org/mod_mbox/spamassassin-users/200508.mbox/%3cLLEAJOOJPGKIFDOKCKLCEEFKDEAA.salist@floridacpu.com%3e
#

# removed 2011.04.17 by [yoh]
# http://bui.asablo.jp/blog/2010/10/31/5459612
# http://hibari.2ch.net/test/read.cgi/unix/1124772932/394
# header RCVD_IN_CHINA		eval:check_rbl('country', 'china.blackholes.us')
# describe RCVD_IN_CHINA		Received via a China IP address in china.blackholes.us
# tflags RCVD_IN_CHINA		net
# score RCVD_IN_CHINA		0.1

# header RCVD_IN_TAIWAN		eval:check_rbl('country', 'taiwan.blackholes.us.')
# describe RCVD_IN_TAIWAN		Received via a Taiwan IP address in taiwan.blackholes.us
# tflags  RCVD_IN_TAIWAN		net
# score RCVD_IN_TAIWAN		0.1

# added 2011.04.17 by [yoh]
header RCVD_IN_CHINA		eval:check_rbl('wariate.jp', 'cn.cc.wariate.jp.')
describe RCVD_IN_CHINA		Received via a China IP address in cn.cc.wariate.jp
tflags RCVD_IN_CHINA		net
score RCVD_IN_CHINA		0.1

header RCVD_IN_TAIWAN		eval:check_rbl('wariate.jp', 'tw.cc.wariate.jp.')
describe RCVD_IN_TAIWAN		Received via a Taiwan IP address in tw.cc.wariate.jp
tflags  RCVD_IN_TAIWAN		net
score RCVD_IN_TAIWAN		0.1


# http://mailspike.org/anubis/implementation_sa.html
# 2010/12/29 added by [yoh]
## Spam sources
header __RCVD_IN_MSPIKE          eval:check_rbl('mspike-lastexternal', 'bl.mailspike.net.')
tflags __RCVD_IN_MSPIKE          net 

##### Reputation compensations
# Definitions
header __RCVD_IN_MSPIKE_Z     eval:check_rbl_sub('mspike-lastexternal', '^127\.0\.0\.2$')
describe __RCVD_IN_MSPIKE_Z   Spam wave participant
tflags __RCVD_IN_MSPIKE_Z     net 
header RCVD_IN_MSPIKE_L5     eval:check_rbl_sub('mspike-lastexternal', '^127\.0\.0\.10$')
describe RCVD_IN_MSPIKE_L5   Very bad reputation (-5)
tflags RCVD_IN_MSPIKE_L5     net 
header RCVD_IN_MSPIKE_L4     eval:check_rbl_sub('mspike-lastexternal', '^127\.0\.0\.11$')
describe RCVD_IN_MSPIKE_L4   Bad reputation (-4)
tflags RCVD_IN_MSPIKE_L4     net 
header RCVD_IN_MSPIKE_L3     eval:check_rbl_sub('mspike-lastexternal', '^127\.0\.0\.12$')
describe RCVD_IN_MSPIKE_L3   Low reputation (-3)
tflags RCVD_IN_MSPIKE_L3     net 

# *_L and *_Z may overlap each other, so account for that
meta __RCVD_IN_MSPIKE_LOW RCVD_IN_MSPIKE_L5 || RCVD_IN_MSPIKE_L4 || RCVD_IN_MSPIKE_L3
meta RCVD_IN_MSPIKE_ZBI __RCVD_IN_MSPIKE_Z && !__RCVD_IN_MSPIKE_LOW

# Scores
score RCVD_IN_MSPIKE_ZBI     4.1
score RCVD_IN_MSPIKE_L5      4.1
score RCVD_IN_MSPIKE_L4      3.5
score RCVD_IN_MSPIKE_L3      2.9



# meta DNSFRMRFCPST99 DNS_FROM_RFC_POST && BAYES_99 && ! VALIDDOCOMO
# describe DNSFRMRFCPST99 DNS_FROM_RFC_POST && BAYES_99 && ! VALIDDOCOMO
# score DNSFRMRFCPST99 1.5

# meta DYN_DNSFRMRFCPST DNS_FROM_RFC_POST && ___DYNAMICIP
# score DYN_DNSFRMRFCPST 3.5

meta DYN_JPSCAMURI JPSCAMURI && ___DYNAMICIP
score DYN_JPSCAMURI 3.0

# added 2011.04.07 by [yoh]
meta DYN_JPSCAMTEL JPSCAMTEL && ___DYNAMICIP
score DYN_JPSCAMTEL 3.0

# added 2011.04.07 by [yoh]
meta DYN_JPSCAMMAILADDRESS JPSCAMMAILADDRESS && ___DYNAMICIP
score DYN_JPSCAMMAILADDRESS 3.0

# added 2011.07.01 by [yoh]
meta XMAILER_JPSCAMTEL JPSCAMTEL && ! __HAS_X_MAILER && ! ___DYNAMICIP
score XMAILER_JPSCAMTEL 3.0



score MISSING_MID 1.0

meta DYN_MISSMID MISSING_MID && ___DYNAMICIP
score DYN_MISSMID 3.5


# 2010.01.18 by [yoh]
meta DYN_XYHFB XYAHOOFILTEREDBULK && ___DYNAMICIP
score DYN_XYHFB 3.5

meta DYN_XKR X_KOREAN_RELAY && ___DYNAMICIP
score DYN_XKR 3.5


# 2010.06.25 by [yoh]
meta DYN_CBL RCVD_IN_CBL && ___DYNAMICIP 
score DYN_CBL 3.5

meta DYN_RBLJP RCVD_IN_SHORT_RBL_JP && ___DYNAMICIP 
score DYN_RBLJP 3.5

meta DYN_BRBL RCVD_IN_BRBL_LASTEXT && ___DYNAMICIP 
score DYN_BRBL 3.5

meta DYN_PBL RCVD_IN_PBL && ___DYNAMICIP 
score DYN_PBL 3.5

# 2011.04.26 by [yoh]
meta DYN_RNBL RCVD_IN_RP_RNBL && ___DYNAMICIP 
score DYN_RNBL 3.5


# 
# 
# New rules from version 3.1.0
# 2005.09.20 by [yoh]
# 
# 

# meta DNSFRMRFCABS99 DNS_FROM_RFC_ABUSE && BAYES_99 && ! VALIDDOCOMO
# describe DNSFRMRFCABS99 DNS_FROM_RFC_ABUSE && BAYES_99 && ! VALIDDOCOMO
# score DNSFRMRFCABS99 0.2

# RCVD_IN_WHOIS_BOGONS is very low reliability.
# 2007.08.11 by [yoh]
#
# score RCVD_IN_WHOIS_BOGONS 0.1

# meta RCVDINWHSBGNS99 RCVD_IN_WHOIS_BOGONS && BAYES_99
# describe RCVDINWHSBGNS99 RCVD_IN_WHOIS_BOGONS && BAYES_99
# score RCVDINWHSBGNS99 1.0

# meta RCVDINWHSINV99 RCVD_IN_WHOIS_INVALID && BAYES_99
# describe RCVDINWHSINV99 RCVD_IN_WHOIS_INVALID && BAYES_99
# score RCVDINWHSINV99 4.5

# meta DNSFRMSCRSG99 DNS_FROM_SECURITYSAGE && BAYES_99
# describe DNSFRMSCRSG99 DNS_FROM_SECURITYSAGE && BAYES_99
# score DNSFRMSCRSG99 4.5

# These rules are needless and have bad influence for detecting bounce spams.
# 2008.09.06 by [yoh]
score RCVD_IN_DNSWL_LOW 0
score RCVD_IN_DNSWL_MED 0
score RCVD_IN_DNSWL_HI 0

# =-=-=-=-=-=-=-=-=-=-=-=-=-=- detecting ISP's IP =-=-=-=-=-=-=-=-=-=-=-=-=-=-

# 
# But, some ham's Received: includes private IP with same HELO & BY.
# 2006.02.25 by [yoh]
# Revised for strictly matching.
# 2006.02.25 by [yoh]
# 

# header HELO_BY_SAME X-Spam-Relays-Untrusted =~ /^\[ ip=(?!(?:127\.0\.0\.1|192\.168(?:\.\d{1,3}){2}|172\.(?:1[6-9]|2\d|3[01])(?:\.\d{1,3}){2}|10(?:\.\d{1,3}){3}))\d{2,3}(?:\.\d{1,3}){3} rdns=[^\[]* helo=([\w\._-]+) by=\1 [^\[\]]+ \]/
header HELO_BY_SAME X-Spam-Relays-Untrusted =~ /^\[ ip=(?!(?:127\.0\.0\.1|192\.168(?:\.\d{1,3}){2}|172\.(?:1[6-9]|2\d|3[01])(?:\.\d{1,3}){2}|10(?:\.\d{1,3}){3}))\d{2,3}(?:\.\d{1,3}){3} rdns=[^\[]* helo=([\w\._-]+) by=\1 /
describe HELO_BY_SAME HELO is same received MTA's FQDN
score HELO_BY_SAME 1.5

# header HELO_BY_PARTIALSAME X-Spam-Relays-Untrusted =~ /^\[ ip=(?!(?:127\.0\.0\.1|192\.168(?:\.\d{1,3}){2}|172\.(?:1[6-9]|2\d|3[01])(?:\.\d{1,3}){2}|207\.46(?:\.\d{1,3}){2}|10(?:\.\d{1,3}){3}))\d{2,3}(?:\.\d{1,3}){3} rdns=[^\[]* helo=([\w\._-]+) by=[\w\._-]+\1 [^\[\]]+ \]/
header HELO_BY_PARTIALSAME X-Spam-Relays-Untrusted =~ /^\[ ip=(?!(?:127\.0\.0\.1|192\.168(?:\.\d{1,3}){2}|172\.(?:1[6-9]|2\d|3[01])(?:\.\d{1,3}){2}|207\.46(?:\.\d{1,3}){2}|10(?:\.\d{1,3}){3}))\d{2,3}(?:\.\d{1,3}){3} rdns=[^\[]* helo=([\w\._-]+) by=[\w\._-]+\1 /
describe HELO_BY_PARTIALSAME HELO is same received MTA's domain name
score HELO_BY_PARTIALSAME 1.5

meta HLBYPRSM_KTC HELO_BY_PARTIALSAME && (___KOREATAIWANCHINA || DIRECTYOURNET) && ISO2022JP_BODY
score HLBYPRSM_KTC 5

# meta HLBY_MTAID HLBYPRSM_KTC && MSGID_FROM_MTA_ID
# score HLBY_MTAID 5

meta HLBYPRSM_DCN HELO_BY_PARTIALSAME && ___DCN 
score HLBYPRSM_DCN 5


meta ASIA1HOPHLBYPTSM ONLY1HOPDIRECT &&  ___DYNAMICIP && HELO_BY_PARTIALSAME
score ASIA1HOPHLBYPTSM 5


header RCVD_IPNUMONLY Received =~ /from (\d{1,3}\.){3}\d{1,3} by (\d{1,3}\.){3}\d{1,3}\;/
describe RCVD_IPNUMONLY Received: contains only IP numbers and date str
score RCVD_IPNUMONLY 3.5

meta RCVDIP_ILLCHR RCVD_IPNUMONLY && (SUBJ_ILLEGAL_CHARS || FROM_ILLEGAL_CHARS)
score RCVDIP_ILLCHR 5.0

# 
#
# detecting Japanese spammer's heaven.
# 2004.08.23 by [yoh]
# 
#

# 210.143.144.0-210.143.159.255
# 220.150.0.0 - 220.150.255.255
# 220.215.0.0 - 220.215.127.255
# 221.113.64.0 - 221.113.127.255
# 43.244.0.0/16
# 61.203.160.0-61.203.175.255
# 61.44.0.0 - 61.44.127.255
# 61.12.128.0 - 61.12.255.255


# header YOURNET Received =~ /from .+ap\.yournet\.ne\.jp /
# header YOURNET Received =~ /(from .+ap\.yournet\.ne\.jp |.+fbb\.ReSET\.JP |61\.203\.((16[0-9]|17[0-4])\.[0-9]{1,3}|175\.0)|220\.215\.([0-9]|[1-9][0-9]|1[01][0-9]|12[0-7])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]))/
# header YOURNET Received =~ /(from .+ap\.yournet\.ne\.jp |.+fbb\.ReSET\.JP |61\.203\.((16[0-9]|17[0-4])\.[0-9]{1,3}|175\.0)|220\.215\.([0-9]|[1-9][0-9]|1[01][0-9]|12[0-7])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|43\.244(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2})/

# header YOURNET Received =~ /(from .+ap\.yournet\.ne\.jp |.+fbb\.ReSET\.JP |61\.203\.((16[0-9]|17[0-4])\.[0-9]{1,3}|175\.0)|220\.215\.([0-9]|[1-9][0-9]|1[01][0-9]|12[0-7])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|(43\.244|220\.150)(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2})/

# header YOURNET Received =~ /from .+(.+(fbb\.ReSET\.JP|ap\.yournet\.ne\.jp)[^a-z]+[0-9]{2,3}(\.[0-9]{1,3}){3,3}|61\.203\.(16[0-9]|17[0-5])\.[0-9]{1,3}|61\.44\.([0-9]|[1-9][0-9]|1(1[0-9]|2[0-7]))\.[0-9]{1,3}|220\.215\.([0-9]|[1-9][0-9]|1[01][0-9]|12[0-7])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|(43\.244|220\.150)(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2})[^(a-z]{0,3}by /

# header YOURNET X-Spam-Relays-Untrusted =~ /(ip=((43\.244|220\.(150|215))(\.[0-9]{1,3}){2}|(61\.203\.1(6[0-9]|7[0-5])|61\.44\.([0-9]|[1-9][0-9]|1[01][0-9]|12[0-7])|61\.12\.(12[89]|1[3-9][0-9]|2[0-4][0-9]|25[0-5])|210\.143\.1(4[4-9]|5[0-9])|221\.113\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7]))\.[0-9]{1,3})|rdns=.+(fbb\.ReSET\.JP|ap\.yournet\.ne\.jp)) .+ident= envfrom= intl=0 .+auth= /
# thrown away 2011.12.02 by [yoh]
# header YOURNET X-Spam-Relays-Untrusted =~ /(ip=((43\.244|220\.(?:150|215))(?:\.\d{1,3}){2}|(61\.203\.1(6\d|7[0-5])|61\.44\.(\d|[1-9]\d|1[01]\d|12[0-7])|61\.12\.(?:12[89]|1[3-9]\d|2[0-4]\d|25[0-5])|210\.143\.1(4[4-9]|5\d)|219\.112\.(\d|[1-9]\d|1[01]\d|12[0-7])|221\.113\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7]))\.\d{1,3})|rdns=.+(fbb\.ReSET\.JP|ap\.yournet\.ne\.jp)) .+ ident= envfrom= intl=0 [^\[\]]+auth= /
# describe YOURNET Japanese spammer's heaven: yournet.ne.jp
# score YOURNET 0.5

# thrown away 2005.09.14 by [yoh]
# 
# meta RFCIYOURNET RCVD_IN_RFCI && YOURNET
# describe RFCIYOURNET RCVD_IN_RFCI && YOURNET
# score RFCIYOURNET 4.0

# meta SORBSYOURNET RCVD_IN_SORBS && YOURNET
# describe SORBSYOURNET RCVD_IN_SORBS && YOURNET
# score SORBSYOURNET 3.0

# 
# thrown away 2006.04.09 by [yoh]
# 
# meta COPYOURNET RCVD_IN_BL_SPAMCOP_NET && YOURNET
# describe COPYOURNET RCVD_IN_BL_SPAMCOP_NET && YOURNET
# score COPYOURNET 5.0
# 
# # meta INVALIDYAHOOJPYOURNET INVALIDYAHOOJP && YOURNET && RCVDFRMLOCALIP
# meta INVALIDYAHOOJPYOURNET INVALIDYAHOOJP && YOURNET
# describe INVALIDYAHOOJPYOURNET INVALIDYAHOOJP && YOURNET
# score INVALIDYAHOOJPYOURNET 10.0


# 163.139.0.0 - 163.139.255.255
# 202.215.32.0-202.215.33.0
# 202.215.175.0-202.215.179.255
# 202.215.181.0-202.215.192.255
# 202.215.194.0-202.215.195.255
# 202.215.196.0-202.215.197.255
# 202.215.198.0-202.215.203.255
# 202.215.204.0-202.215.205.255
# 202.215.206.0-202.215.207.255
# 202.215.211.0-202.215.211.255
# 202.215.214.0-202.215.215.255
# 202.215.216.0-202.215.219.255
# 202.215.224.0-202.215.224.255
# 202.215.225.0-202.215.230.255
# 202.215.232.0-202.215.233.255
# 202.215.234.0-202.215.239.255
# (202.215.242.0-202.215.251.255)

# 220.247.0.0 - 220.247.127.255

# 202.215.132.0-202.215.133.0
# header VECTANTDYNIP Received =~ /from .*(202\.215\.13[23]\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|(d[0-9]{1,3}\.JgunmaFL1|s[0-9]{1,3}\.ItokyoFL18)\.vectant\.ne\.jp)/
# header VECTANTDYNIP Received =~ /from .*(202\.215\.13[23]\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|(d[0-9]{1,3}\.JgunmaFL1|[ds][0-9]{1,3}\.[GI]tokyoFL[0-9]+)\.vectant\.ne\.jp)/

# header VECTANTDYNIP Received =~ /from .*(d[0-9]{2,3}\.[A-Z][a-z]+FL[0-9]+|wd[0-9]+\.(afl|AFL)[0-9]+)\.vectant\.ne\.jp/
# X-Spam-Relays-Untrusted =~ /(ip=202\.215(\.\d{1,3}){2}|rdns=(d[0-9]{2,3}\.[A-Z][a-z]+FL[0-9]+|wd[0-9]+\.(afl|AFL)[0-9]+)\.vectant\.ne\.jp) .+ ident= envfrom= intl=0 [^\[\]]+auth= /
# header VECTANTDYNIP X-Spam-Relays-Untrusted =~ /(ip=((202\.215|222\.228)(\.\d{1,3}){2}|222\.229\.(\d|[1-5]\d|6[0-3])\.\d{1,3})|rdns=(d[0-9]{2,3}\.[A-Z][a-z]+FL[0-9]+|wd[0-9]+\.([ab]fl|[AB]FL)[0-9a-fA-F]+)\.vectant\.ne\.jp) [^\[\]]+ ident= envfrom= intl=0 [^\[\]]+auth= /
header VECTANTDYNIP X-Spam-Relays-Untrusted =~ /rdns=((e|w|w4|)d\d+\.[ABFGHIJNS]+[a-z]*(DS[AI]|FL){0,1}[bcd0-9]+|(?:163-139|202-215)(-\d{1,3}){2}\.(uis){0,1}rv)\.vectant\.ne\.jp [^\[\]]+ ident= envfrom= intl=0 [^\[\]]+auth= /
describe VECTANTDYNIP vectant.ne.jp: seems to be almost same yournet.ne.jp
score VECTANTDYNIP 0.1

# thrown away 2005.09.14 by [yoh]
# 
# meta VFLETSYAHOO INVALIDNOTYAHOO && VECTANTDYNIP
# describe VFLETSYAHOO INVALIDNOTYAHOO && VECTANTDYNIP
# score VFLETSYAHOO 3.5

# 61.197.0.0-61.197.127.0
# 210.165.128.0-210.165.255.0
# 219.102.248.0 - 219.102.255.255
# header INFOSPHERE Received =~ /from.*(61\.197\.([0-9]|[1-9][0-9]|1[01][0-9]|12[0-7])\.([0-9]|[1-9][0-9]|2[0-4][0-9]|25[0-5])|\.nttpc\.ne\.jp)/
# header INFOSPHERE Received =~ /from.*(61\.197\.([0-9]|[1-9][0-9]|1[01][0-9]|12[0-7])\.([0-9]|[1-9][0-9]|2[0-4][0-9]|25[0-5])|\.nttpc\.ne\.jp|210\.165\.(12[89]|1[3-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|2[0-4][0-9]|25[0-5]))/
# header INFOSPHERE X-Spam-Relays-Untrusted =~ /(ip=(61\.197\.(\d|[1-9]\d|1[01]\d|12[0-7])\.\d{1,3}|210\.165\.(12[89]|1[3-9]\d|2[0-4]\d|25[0-5])\.\d{1,3}|219\.102(\.\d{1,3}){2})|rdns=.+\.nttpc\.ne\.jp) .+ ident= envfrom= intl=0 .+auth= /
# header INFOSPHERE X-Spam-Relays-Untrusted =~ /(ip=(210\.165\.(12[89]|1[3-9]\d|2[0-4]\d|25[0-5])\.\d{1,3}|(61\.197|203\.138|219\.102)(\.\d{1,3}){2})|rdns=.+\.nttpc\.ne\.jp) .+ ident= envfrom= intl=0 .+auth= /
# header INFOSPHERE X-Spam-Relays-Untrusted =~ /(ip=(210\.165\.(12[89]|1[3-9]\d|2[0-4]\d|25[0-5])\.\d{1,3}|(61\.197|203\.138|210\.136|219\.102)(\.\d{1,3}){2})|rdns=.+\.nttpc\.ne\.jp) .+ ident= envfrom= intl=0 [^\[\]]+auth= /
# describe INFOSPHERE The Business Provider: InfoSphere
# score INFOSPHERE 0.1

# 
# thrown away 2006.04.09 by [yoh]
# 
# # meta YAHOOJPINFOSPHERE (VALIDYAHOOJP || INVALIDYAHOOJP) && INFOSPHERE && RCVDFRMLOCALIP
# meta YAHOOJPINFOSPHERE (VALIDYAHOOJP || INVALIDYAHOOJP) && INFOSPHERE
# describe YAHOOJPINFOSPHERE Why business user uses yahoo.co.jp free Mail address?
# score YAHOOJPINFOSPHERE 5.0

# thrown away 2005.09.15 by [yoh]
# 
# 67.18.0.0 - 67.19.255.255
# header ___THEPLANET Received =~ /from.*(61\.1[89](\.([0-9]|[1-9][0-9]|2[0-4][0-9]|25[0-5])){1,2}|reverse\.theplanet\.com)/
# describe ___THEPLANET a farm of 3rd party relay hosts: ThePlanet.com
# score ___THEPLANET 7.0

# Received: .+p[0-9]+-[a-z0-9-]+\.[a-z]+\.ocn.ne.jp
# header OCNNEJP Received =~ /from .+\.[a-z]+\.ocn\.ne\.jp/

# 219.160.0.0 - 219.165.255.255
# 219\.16[0-5](\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2}
# 222.144.0.0 - 222.151.255.255
# 222\.(14[4-9]|15[01])(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2}

# Received =~ /from .+(p[0-9]+-[a-z0-9-]+\.[a-z]+\.ocn\.ne\.jp|(219\.16[0-5]|222\.(14[4-9]|15[01]))(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2})/
header OCNNEJP X-Spam-Relays-Untrusted =~ /(ip=((219\.16[0-5]|222\.(?:14[4-9]|15[01]))(\.\d){2}|222\.146\.(?:12[89]|1[3-9]\d|2[0-4]\d|25[0-5])\.\d{1,3})|rdns=p[0-9]+-[a-z0-9-]+\.[a-z]+\.ocn\.ne\.jp) .+ ident= envfrom= intl=0 [^\[\]]+auth= /
describe OCNNEJP OCN - Open Computer Network
score OCNNEJP 0.1

# 
# thrown away 2006.04.09 by [yoh]
# 
# header ___VALIDOCN Received =~ /from .+p[0-9]+-[a-z0-9-]+\.[a-z]+\.ocn\.ne\.jp.+by smtp\.[a-z]+\.ocn\.ne\.jp /
# describe ___VALIDOCN valid ocn sender
# score ___VALIDOCN 0.1

# meta DIRECTOCN OCNNEJP && ! ___VALIDOCN
# describe DIRECTOCN seems to post from ocn.ne.jp dynamic IP to receiver's MTA
# score DIRECTOCN 1.0


# thrown away 2005.09.14 by [yoh]
# 
# meta OCNPLANET (___THEPLANET || ___EVERYONE) && OCNNEJP
# describe OCNPLANET probably this mail came from OCN through THEPLANET
# score OCNPLANET 10.0
# 
# meta YAHOOJPOCNPLANET (VALIDYAHOOJP || INVALIDYAHOOJP) && OCNPLANET
# describe YAHOOJPOCNPLANET free yahoo.co.jp mail address user uses THEPLANET
# score YAHOOJPOCNPLANET 10.0

# 
# thrown away 2006.04.09 by [yoh]
# 
# meta ___YAHOOJPOCN (VALIDYAHOOJP || INVALIDYAHOOJP) && OCNNEJP
# describe ___YAHOOJPOCN free yahoo.co.jp mail address user uses OCN
# score ___YAHOOJPOCN 2.0

# header RCVDFRMLOCALIP Received =~ /from (\[(192\.168\.[0-9]{1,3}\.[0-9]{1,3}|127\.0\.0\.1)]|[a-z0-9-.]+ \(HELO \?(192\.168\.[0-9]{1,3}\.[0-9]{1,3}|127\.0\.0\.1)\?\))/
# header RCVDFRMLOCALIP Received =~ /from [a-z0-9-.]+ \(\[127\.0\.0\.1\]\)/
# header RCVDFRMLOCALIP Received =~ /from (\[(192\.168\.[0-9]{1,3}\.[0-9]{1,3}|127\.0\.0\.1)\]|[a-z0-9-.]+ \(HELO \?(192\.168\.[0-9]{1,3}\.[0-9]{1,3}|127\.0\.0\.1)\?\)|[a-z0-9-.]+ \(\[127\.0\.0\.1\]\) by local)/
# header RCVDFRMLOCALIP Received =~ /from (\[192\.168\.[0-9]{1,3}\.[0-9]{1,3} \([a-z0-9-.]+ \[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\)|\[\(192\.168\.[0-9]{1,3}\.[0-9]{1,3}|127\.0\.0\.1)\]|[a-z0-9-.]+ \(HELO \?(192\.168\.[0-9]{1,3}\.[0-9]{1,3}|127\.0\.0\.1)\?\)|[a-z0-9-.]+ \(\[127\.0\.0\.1\]\) by local)/
# header RCVDFRMLOCALIP Received =~ /from \[192\.168\.[0-9]{1,3}\.[0-9]{1,3}\] \([a-z0-9-.]+ \[[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}/
# 
# thrown away 2005.09.29 by [yoh]
# 
# header RCVDFRMLOCALIP Received =~ /from ([a-z0-9-.]+ \(HELO \?(192\.168\.[0-9]{1,3}\.[0-9]{1,3}|127\.0\.0\.1)\?\)|[a-z0-9-.]+ \(\[127\.0\.0\.1\]\) by local)/
# describe RCVDFRMLOCALIP Received: from [127.0.0.1]
# score RCVDFRMLOCALIP 0.1
# 
# 
# thrown away 2006.04.09 by [yoh]
# 
# # meta YAHOOJPOCN ___YAHOOJPOCN && RCVDFRMLOCALIP
# meta YAHOOJPOCN ___YAHOOJPOCN
# describe YAHOOJPOCN free yahoo.co.jp mail address user uses OCN
# score YAHOOJPOCN 5.0


# thrown away 2005.09.15 by [yoh]
# 
# 66.98.128.0 - 66.98.255.255
# header ___EVERYONE Received =~ /from.*(66\.98\.(12[89]|1[3-9][0-9]|2[0-4][0-9]|25[0-5])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|\.ev1servers\.net)/
# describe ___EVERYONE Everyones Internet, Inc.
# score ___EVERYONE 1.0

# 202.215.247.0 <-> 202.215.247.127
header ANNIENET Received =~ /from.*(202\.215\.247\.(\d|[1-9]\d|1[01]\d|12[0-7])|\.annie\.ne\.jp)/
describe ANNIENET Annie Corporation
score ANNIENET 3.0

# thrown away 2005.09.14 by [yoh]
# 
# meta ANNIEINFOS INFOSPHERE && ___ANNIENET
# describe ANNIEINFOS INFOSPHERE user uses annie.ne.jp for sending spam.
# score ANNIEINFOS 10.0

# thrown away 2006.09.03 by [yoh]
# 
# 210.173.72.0-210.173.73.0
# header CCNET Received =~ /from.*(210\.173\.7[23]\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|\.cc-net\.or\.jp)/
# describe CCNET City Connection Corp.
# score CCNET 3.0

# thrown away 2005.09.14 by [yoh]
# 
# meta CCNETYOURNET ___CCNET && YOURNET
# describe CCNETYOURNET yournet.ne.jp user uses relay site.
# score CCNETYOURNET 10.0

# 210.239.63.0 <-> 210.239.63.63
header IDATAKRP2 Received =~ /from.*210\.239\.63\.([0-9|[1-5][0-9]|6[0-3])/
describe IDATAKRP2 IDATA Co.,Ltd.
score IDATAKRP2 15.0

#
#202.181.105.181
#202.181.105.184
#202.181.105.185
#202.181.105.237
#202.181.105.238
#202.181.98.207
#202.181.98.208
#202.222.28.194
#202.222.30.140
#202.222.30.20
#202.222.31.188
#
# 210.188.205.24
# 202.222.31.180
# 202.222.30.196
# 210.188.205.24
# 
# 
# Received =~ /from .*sv[0-9]{1,3}\.lolipop\.jp/
header LOLIPOP X-Spam-Relays-Untrusted =~ /^\[ ip=(?:202\.181\.105\.136|202\.222\.(?:19\.80|30\.196|31\.180)|210\.172\.144\.(?:16|85|144|176)|210\.188\.(?:205\.(?:24|55|211)|220\.157)|219\.94\.(?:131\.186|167\.177)) /
describe LOLIPOP Japanese spammer's footstool: lolipop.jp
score LOLIPOP 1.5

# 202.61.29.93
# 202.61.29.82

header IMAPCC Received =~ /from .*[a-z0-9]+\.i-map\.cc/
describe IMAPCC i-map.cc
score IMAPCC 5.0


#
#202.181.99.18
#202.181.99.20
#202.181.99.32
#202.181.99.36
#202.181.99.42
#202.181.99.43
#202.181.99.51
#202.181.99.56
#202.181.99.59
#202.181.99.70
#202.181.99.72
#
#59.106.13.43
#
header SAKURAWEB Received =~ /from .*www[0-9]{1,3}\.sakura\.ne\.jp/
describe SAKURAWEB Japanese spammer uses footstool web hosting service: sakura.ne.jp
score SAKURAWEB 0.1

# meta SAKURAYAHOO INVALIDYAHOOJP && SAKURAWEB
# describe SAKURAYAHOO SAKURA web servers are used for spammer's mta
# score SAKURAYAHOO 3.0

# meta LOLIPOPYAHOO INVALIDYAHOOJP && LOLIPOP
# describe LOLIPOPYAHOO LOLIPOP web servers are used for spammer's mta
# score LOLIPOPYAHOO 3.0


# [210.239.39.128 <-> 210.239.39.191]     210.239.39.128/26
header SOHO Received =~ /from .*210\.239\.39\.1(2[89]|[3-8][0-9]|9[01])/
describe SOHO SOHO CO., LTD.
score SOHO 1.5

# 210.166.236.128 <-> 210.166.236.255
header CSIDENET Received =~ /from .*(.+cside\.jp|210\.166\.236\.(?:12[89]|1[3-9][0-9]|2[0-4][0-9]|25[0-5]))/
describe CSIDENET CsideNet: some spammers live in and use for footstool.
score CSIDENET 1.5

# meta CSIDEYAHOO CSIDENET && INVALIDYAHOOJP
# describe CSIDEYAHOO CSIDENET && INVALIDYAHOOJP
# score CSIDEYAHOO 3.5

# 220.151.197.64 - 220.151.197.79
header NICNAME Received =~ /220\.151\.197\.(6[4-9]|7[0-9])/
describe NICNAME NIC-NAME.com
score NICNAME 0.5

# meta NICNAMEYAHOO NICNAME && INVALIDYAHOOJP
# describe NICNAMEYAHOO NICNAME && INVALIDYAHOOJP
# score NICNAMEYAHOO 3.5


header SONETDYNIP Received =~ /from .+p[a-z0-9]{5,6}\.[a-z0-9]{7,8}\.ap\.so-net\.ne\.jp/
describe SONETDYNIP so-net.ne.jp dynamic IP
score SONETDYNIP 0.1

header ___VALIDSONET Received =~ /from .+p[a-z0-9]{5,6}\.[a-z0-9]{7,8}\.ap\.so-net\.ne\.jp.*by (mail\.[a-z][a-z][0-9][0-9]|mx[0-9][0-9]\.ms)\.so-net\.ne\.jp/
describe ___VALIDSONET valid so-net sender
score ___VALIDSONET 0.1

# meta DIRECTSONET SONETDYNIP && ! ___VALIDSONET
# describe DIRECTSONET seems to post from so-net.ne.jp dynamic IP to receiver's MTA
# score DIRECTSONET 1.0

# thrown away 2005.09.14 by [yoh]
# 
# meta YAHOOJPSONET INVALIDYAHOOJP && DIRECTSONET
# describe YAHOOJPSONET INVALIDYAHOOJP && DIRECTSONET
# score YAHOOJPSONET 3.5

# thrown away 2006.04.09 by [yoh]
# Why?
# Because, all 'INVALIDYAHOOJP' doesn't pass through yahoo.co.jp's MTA,
# so this rule is meaningless.
# 
# # header ___NOTYAHOO Message-ID =~ /(?!.*yahoo)/
# header ___NOTYAHOO Message-ID !~ /.+\@(?=yahoo\.co\.jp)/
# describe ___NOTYAHOO Message-ID is not yahoo.co.jp
# score ___NOTYAHOO 0.1
# 
# meta INVALIDNOTYAHOO INVALIDYAHOOJP && ___NOTYAHOO
# describe INVALIDNOTYAHOO This mail didn't pass through yahoo.co.jp's MTA
# score INVALIDNOTYAHOO 1.5
# 
# meta NOTYAHOOMSGID INVALIDNOTYAHOO && MSGID_FROM_MTA_ID
# describe NOTYAHOOMSGID INVALIDNOTYAHOO && MSGID_FROM_MTA_ID
# score NOTYAHOOMSGID 2.0


# thrown away 2005.12.26 by [yoh]
# 
# meta INVYAHOOJPBLARS INVALIDYAHOOJP && RCVD_IN_BLARS && (RCVD_IN_BLARS_SPAM || RCVD_IN_BLARS_ABUSE)
# describe INVYAHOOJPBLARS INVALIDYAHOOJP && RCVD_IN_BLARS && (RCVD_IN_BLARS_SPAM || RCVD_IN_BLARS_ABUSE)
# score INVYAHOOJPBLARS 3.0

meta INVYAHOOJPDCN INVALIDYAHOOJP && ___DCN
score INVYAHOOJPDCN 3.5


# 211.10.191.64/26 
header EMNETNEJP Received =~ /from .+rev\.em-net\.ne\.jp/
describe EMNETNEJP em-net.ne.jp
score EMNETNEJP 0.1

# 
# deleted 2010.10.16 by [yoh]
# 
# 61.7.0.0 - 61.7.127.255
# header SNI_NOC X-Spam-Relays-Untrusted =~ /ip=61\.7\.(\d|[1-9]\d|1[01]\d|12[0-7])\.\d{1,3} .+ ident= envfrom= intl=0 [^\[\]]+auth= /
# describe SNI_NOC Sagashimbun Co., Ltd.
# score SNI_NOC 0.1


# 
# deleted 2010.10.16 by [yoh]
# 
# 202.171.224.0 - 202.171.224.255
# header XEXONNET X-Spam-Relays-Untrusted =~ /ip=202\.171\.224\.[0-9]{1,3} .+ ident= envfrom= intl=0 [^\[\]]+auth= /
# describe XEXONNET spammer's hosting service (see `host spamsrv[2-6].hn.org` `host xexon.net`)
# score XEXONNET 3.5
# 
# meta XEXON99 XEXONNET && (BAYES_99 || BAYES_95)
# describe XEXON99 XEXONNET && (BAYES_99 || BAYES_95)
# score XEXON99 10


# http://www.google.co.jp/search?as_q=spam&num=100&hl=ja&inlang=ja&ie=EUC-JP&oe=EUC-JP&btnG=Google+%B8%A1%BA%F7&as_epq=combzmail+jp&as_oq=&as_eq=&lr=&as_ft=i&as_filetype=&as_qdr=all&as_occt=any&as_dt=i&as_sitesearch=&as_rights=
# 60.32.107.224 - 60.32.107.239
# 60.32.176.224 - 60.32.176.231
# 61.115.238.96-61.115.238.127
# 211.133.130.128-211.133.130.255
# 210.188.215.0-210.188.215.63
# 210.188.215.128-210.188.215.191
# header COMBZMAIL_JP X-Spam-Relays-Untrusted =~ /ip=(60\.32\.107\.2(2[4-9]|3\d)|60\.32\.176\.2(2[4-9]|3[01])|60\.32\.177\.(\d|1[0-5])|61\.115\.238\.(9[6-9]|1[01]\d|12[0-7])|210\.188\.215\.(\d|[1-5]\d|6[0-3]|12[89]|1[3-8]\d|19[01])|211\.133\.130\.(12[89]|1[3-9]\d|2\d\d)) .+ ident= envfrom= intl=0 [^\[\]]+auth= /
header COMBZMAIL_JP X-Spam-Relays-Untrusted =~ /(ip=(60\.32\.107\.2(2[4-9]|3\d)|60\.32\.176\.2(2[4-9]|3[01])|60\.32\.177\.(\d|1[0-5])|61\.115\.238\.(9[6-9]|1[01]\d|12[0-7])|210\.188\.215\.(\d|[1-5]\d|6[0-3]|12[89]|1[3-8]\d|19[01])|211\.133\.130\.(?:12[89]|1[3-9]\d|2\d\d))|helo=[\d\w.]+\.combzmail\.jp) .+ ident= envfrom= intl=0 [^\[\]]+auth= /
describe COMBZMAIL_JP Combz Inc.
score COMBZMAIL_JP 1.5

# 203.131.192.0 - 203.131.207.255
# 125.6.0.0 - 125.6.255.255
header DATAHOTEL_JP X-Spam-Relays-Untrusted =~ /^\[ ip=(?:125\.6\.(?:140\.5|141\.(?:24|39|4[0-3]))|203\.(?:104\.97\.101|131\.198\.71)) /
describe DATAHOTEL_JP Livedoor Co., Ltd.
score DATAHOTEL_JP 1.5


header EXCITEWEB X-Spam-Relays-Untrusted =~ /^\[ ip=180\.235\.97\.1(?:8[789]|9[01]) /
describe EXCITEWEB web mail from Excite Japan Co., Ltd.
score EXCITEWEB 1.5


# =-=-=-=-=-=- Foreign ISP rules using X-Spam-Relays-Untrusted =-=-=-=-=-=- 
# 2005.12.5 by [yoh]
# 

# 222.101.0.80 - 222.122.255.254
# 222.122.45.0-222.122.46.255
# 222.101.0.80 - 222.122.255.254
# header KORNET Received =~ /from .+(222\.122\.4[56]\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|59\.([0-9]|[12][0-9]|3[0-3])(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2})/
# 222\.1(0[1-9]|1[0-9]|2[0-2])(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2}
# 218.144.0.0 - 218.159.255.255
# 221.144.0.0 - 221.168.255.255
# 222.101.0.80 - 222.122.255.255
# 59.0.0.0 - 59.31.255.255
# KORNET Smile Serv
# header KORNET Received =~ /from .+(218\.1(4[4-9]|5[0-9])|221\.1(4[4-9]|5[0-9]|6[0-8])|222\.1(0[1-9]|1[0-9]|2[012])|59\.([0-9]|[12][0-9]|3[01]))(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2}/
# describe KORNET Korea Telecom
# score KORNET 1.5
# 59.0.0.0 - 59.31.255.255
# 211.54.0.0 - 211.55.255.255
# 211.192.0.0 - 211.199.255.255
# 211.216.0.0 - 211.231.255.255
# 218.144.0.0 - 218.159.255.255
# 220.70.0.0 - 220.95.255.255
# 221.144.0.0 - 221.168.255.255
# 222.96.0.0 - 222.122.255.255

# 61.72.0.0 - 61.85.255.255

# 220.116.0.0 - 220.127.255.255

# header KOREATELECOM Received =~ /from .+(218\.1(4[4-9]|5[0-9])|221\.1(4[4-9]|5[0-9]|6[0-8])|59\.([0-9]|[12][0-9]|3[0-3])|222\.(9[6-9]|1([01][0-9]|2[012]))|211\.(19[2-9]|5[45]|2(1[6-9]|2[0-9]|3[01])))(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2}/
# header KOREATELECOM X-Spam-Relays-Untrusted =~ /ip=(218\.1(4[4-9]|5[0-9])|221\.1(4[4-9]|5[0-9]|6[0-8])|59\.([0-9]|[12][0-9]|3[0-3])|222\.(9[6-9]|1([01][0-9]|2[012]))|211\.(19[2-9]|5[45]|2(1[6-9]|2[0-9]|3[01])))(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2} rdns= .+ident= envfrom= intl=0 .+auth= /
# header KOREATELECOM X-Spam-Relays-Untrusted =~ /ip=(59\.(\d|[12]\d|3[0-3])|61\.(7[2-9]|8[0-5])|211\.(19[2-9]|5[45]|2(1[6-9]|2\d|3[01]))|218\.1(4[4-9]|5\d)|220\.([78]\d|9[0-5]|11[6-9]|12[0-7])|221\.1(4[4-9]|5\d|6[0-8])|222\.(9[6-9]|1([01]\d|2[012])))(\.\d{1,3}){2,2} .+ident= envfrom= intl=0 .+auth= /
# 211.38.0.0 - 211.38.255.255
# 203.236.44.0 - 203.236.127.255
# header KOREATELECOM X-Spam-Relays-Untrusted =~ /ip=((59\.(\d|[12]\d|3[0-3])|61\.(7[2-9]|8[0-5])|211\.(38|19[2-9]|5[45]|2(1[6-9]|2\d|3[01]))|218\.1(4[4-9]|5\d)|220\.([78]\d|9[0-5]|11[6-9]|12[0-7])|221\.1(4[4-9]|5\d|6[0-8])|222\.(9[6-9]|1([01]\d|2[012])))(\.\d{1,3}){2}|203\.234\.(1(2[89]|[3-9]\d)|2([0-4]\d|5[0-5]))\.\d{1,3}) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
# 210.91.0.0 - 210.91.255.255
# 210.92.0.0 - 210.92.63.255
# 210.101.64.0 - 210.101.127.255
# 210.105.0.0 - 210.105.255.255
# 210.113.0.0 - 210.113.255.255
# 210.121.128.0 - 210.121.255.255
# 210.123.0.0 - 210.123.255.255
# 210.126.0.0 - 210.126.127.255
# 210.183.0.0 - 210.183.255.255
# 210.217.0.0 - 210.217.127.255
# 210.222.0.0 - 210.222.255.255
# 210.223.0.0 - 210.223.255.255
# 211.48.0.0 - 211.48.255.255
# 203.228.0.0 - 203.228.127.255
# 125.128.0.0 - 125.159.255.255
# 211.107.1.0-211.107.255.255
# 203.232.2.0- 203.232.125.255
# 121.128.0.0 - 121.191.255.255
# 168.126.0.0 - 168.126.255.255
# 211.105.0.0 - 211.106.255.255
# 210.92.0.0 - 210.92.63.255
# header KOREATELECOM X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:59\.(?:\d|[12]\d|3[0-3])|61\.(?:7[2-9]|8[0-5])|112\.1(?:[678]\d|9[01])|115\.(?:1[6-9]|2[0-3])|118\.(?:3[2-9]|[45]\d|6[0-3])|119\.(?:19[2-9]|2[01]\d|22[0-3])|121\.1(?:2[89]|[3-8]\d|9[01])|125\.1(?:2[89]|[345]\d)|128\.134|168\.126|175\.(?:19[2-9]|2\d\d)|183\.(?:9[6-9]|1[01]\d|12[0-7])|210\.(?:9[19]|105|113|123|183|22[23])|211\.(?:34|46|[34]8|19[2-9]|5[14-7]|10[4-7]|11[34]|18[45]|2(?:1[6-9]|2\d|3[01]))|218\.1(?:4[4-9]|5\d)|220\.(?:[78]\d|9[0-5]|11[6-9]|12[0-7])|221\.1(?:4[4-9]|5\d|6[0-8])|222\.(?:9[6-9]|1(?:[01]\d|2[012])))(?:\.\d{1,3}){2}|(?:203\.234\.(?:1(?:2[89]|[3-9]\d)|2(?:[0-4]\d|5[0-5]))|203\.236\.(?:4[4-9]|[5-9]\d|1[01]\d|12[0-7])|203\.251\.(?:\d|\d\d|1[0-8]\d|19[01])|(?:210\.92|211\.35)\.(?:\d|[1-5]\d|6[0-3])|(?:210\.121|211\.3[35])\.(?:12[89]|1[3-9]\d|2\d\d)|(?:203\.2(?:28|32)|210\.(?:9[56]|10[14]|126|217))\.(?:\d|\d\d|1[01]\d|12[0-7])|211\.43\.(?:\d|[12]\d|3[01]))\.\d{1,3}) /

# PUBNET-KR
# Korea Telecom-PUBNET
# KTFWING Korea Telecom Freetel Corp
header KOREATELECOM X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:1\.(?:9[6-9]|10\d|11[01])|14\.(?:3[2-9]|[45]\d|6[0-3])|59\.(?:\d|[12]\d|3[0-3])|61\.(?:7[2-9]|8[0-5]|108)|112\.1(?:[678]\d|9[01])|115\.(?:1[6-9]|2[0-3])|118\.(?:3[2-9]|[45]\d|6[0-3])|119\.(?:19[2-9]|2[01]\d|22[0-3])|121\.1(?:2[89]|[3-8]\d|9[01])|125\.1(?:2[89]|[345]\d)|128\.134|168\.126|175\.(?:19[2-9]|2\d\d)|183\.(?:9[6-9]|1[01]\d|12[0-7])|210\.(?:9[159]|105|113|123|183|22[23])|211\.(?:34|46|[34]8|19[2-9]|5[14-7]|10[4-7]|11[34]|18[45]|2(?:1[6-9]|2\d|3[01]))|218\.1(?:4[4-9]|5\d)|220\.(?:[78]\d|9[0-5]|11[6-9]|12[0-7])|221\.1(?:4[4-9]|5\d|6[0-8])|222\.(?:9[6-9]|1(?:[01]\d|2[012])))(?:\.\d{1,3}){2}|(?:203\.236\.(?:4[4-9]|[5-9]\d|1[01]\d|12[0-7])|203\.249\.1(?:[678]\d|9[01])|203\.251\.(?:\d|\d\d|1[0-8]\d|19[01])|203\.252\.27|211\.39\.1(?:2[89]|[345]\d)|(?:203\.234|210\.121|211\.3[35])\.(?:12[89]|1[3-9]\d|2\d\d)|(?:210\.92|211\.35)\.(?:\d|[1-5]\d|6[0-3])|(?:203\.2(?:28|32)|210\.(?:9[56]|10[14]|126|217))\.(?:\d|\d\d|1[01]\d|12[0-7])|211\.43\.(?:\d|[12]\d|3[01]|6[4-9]|[789]\d|1[01]\d|12[0-7]))\.\d{1,3}) /
describe KOREATELECOM [KR]Korea Telecom
score KOREATELECOM 1.5


# 211.200.0.0-211.215.255.255

# 221.138.0.0 - 221.143.255.255
# 221.139.0.0 - 221.139.7.255
# 218.38.14.0-218.38.14.255

# 58.224.0.0 - 58.239.255.255
# 221.138.0.0 - 221.143.255.255
# 218.38.0.0-218.39.255.255

# 218.48.0.0-218.55.255.255
# 218.232.0.0-218.239.255.255

# 219.240.0.0-219.241.255.255

# 222.232.0.0-222.239.255.255
# 211.176.0.0-211.179.255.255
# 211.52.128.0-211.52.143.255

# header HANAROTELECOM Received =~ /from .+(58\.2(2[4-9]|3[0-9])|211\.(17[6-9]|20[0-9]|21[0-5])|221\.1(3[89]|4[0-3])|218\.(3[89]|4[89]|5[0-5]|23[2-9])|219\.24[01]|222\.23[2-9])(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2}/

# rdns= helo=mail\.[a-z0-9_-]+\.(com|net)/
# header HANAROTELECOM X-Spam-Relays-Untrusted =~ /ip=(58\.2(2[4-9]|3[0-9])|211\.(17[6-9]|20[0-9]|21[0-5])|221\.1(3[89]|4[0-3])|218\.(3[89]|4[89]|5[0-5]|23[2-9])|219\.(24[01]|25[45])|222\.23[2-9])(\.[0-9]{1,3}){2,2} .+ident= envfrom= intl=0 .+auth= /
# header HANAROTELECOM X-Spam-Relays-Untrusted =~ /ip=(58\.2(2[4-9]|3[0-9])|211\.(49|17[6-9]|20[0-9]|21[0-5])|221\.1(3[89]|4[0-3])|218\.(3[89]|4[89]|5[0-5]|23[2-9])|219\.(24[01]|25[45])|222\.23[2-9])(\.[0-9]{1,3}){2,2} .+ident= envfrom= intl=0 .+auth= /
# 219.248.0.0-219.251.255.255
# 61.254.0.0 - 61.254.127.255
# 124.111.0.0 - 124.111.255.255
# 211.44.15.0-211.44.253.255
# 211.108.0.0-211.108.255.255
# 61.98.0.0 - 61.99.255.255
# 211.117.0.0 - 211.117.255.255
# 61.254.160.0 - 61.255.255.255
# 61.254.0.0 - 61.254.127.255
# 61.105.0.0 - 61.105.255.255
# 123.212.0.0 - 123.215.255.255
# 211.244.0.0 - 211.244.255.255
# 211.33.0.0 - 211.33.127.255
# header HANAROTELECOM X-Spam-Relays-Untrusted =~ /ip=((58\.(12[0-7]|2(2[4-9]|3\d))|61\.(9[89]|105|25[35])|121\.12[45]|123\.21[2-5]|124\.111|211\.(49|5[289]|108|117|17[6-9]|20\d|21[0-5]|24[345])|218\.(3[89]|4[89]|5[0-5]|23[2-9])|219\.(24[0189]|25[0145])|221\.1(3[89]|4[0-3])|222\.23[2-9])(\.\d{1,3}){2}|(61\.254\.(\d|[1-9]\d|1[01]\d|12[0-7]|1[6-9]\d|2\d\d)|211\.33\.(\d|\d\d|1[01]\d|12[0-7])|211\.44\.(1[5-9]|[2-9]\d|1\d\d|2[0-4]\d|25[0-3])|211\.52\.1(2[89]|3\d|4[0-3]))\.\d{1,3}) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
header HANAROTELECOM X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:58\.(?:12[0-7]|2(?:2[4-9]|3\d))|61\.(?:9[89]|105|25[35])|110\.(?:[89]|1[0-5])|114\.20[0-7]|116\.12[0-7]|118\.2(?:1[6-9]|2[0-3])|121\.12[45]|123\.21[2-5]|12[34]\.111|175\.1(?:1[2-9]|2[0-7])|180\.(?:6[4-9]|7[01])|211\.(?:49|5[289]|108|117|17[6-9]|20\d|21[0-5]|24[345])|218\.(?:3[89]|4[89]|5[0-5]|23[2-9])|219\.(?:24[0189]|25[0145])|221\.1(?:3[89]|4[0-3])|222\.23[2-9])(?:\.\d{1,3}){2}|(?:61\.254\.(?:\d|\d\d|1[01]\d|12[0-7]|1[6-9]\d|2\d\d)|211\.33\.(?:\d|\d\d|1[01]\d|12[0-7])|211\.44\.(?:1[5-9]|[2-9]\d|1\d\d|2[0-4]\d|25[0-3])|211\.52\.1(?:2[89]|3\d|4[0-3]))\.\d{1,3}) /
describe HANAROTELECOM [KR]Hanaro Telecom, Inc.(also AKA HANANET)
score HANAROTELECOM 1.5


# 211.36.0.0-211.36.63.255
# 211.240.60.0-211.240.60.255
# 211.52.113.0-211.52.113.255
# 211.174.128.0 - 211.174.255.255
# 210.219.242.64-210.219.242.255
# header ELIMNET Received =~ /from .+(211\.36\.([0-9]|[1-5][0-9]|6[0-3])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|(211\.240\.60|211\.52\.113)\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]))/
# header ELIMNET X-Spam-Relays-Untrusted =~ /ip=(211\.36\.([0-9]|[1-5][0-9]|6[0-3])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])|(211\.240\.60|211\.52\.113)\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])) rdns= .+ident= envfrom= intl=0 .+auth= /
# header ELIMNET X-Spam-Relays-Untrusted =~ /ip=211\.(36\.([0-9]|[1-5][0-9]|6[0-3])|52\.(6[4-9]|[7-9][0-9]|1[01][0-9]|12[0-7])|174\.(12[89]|1[3-9][0-9]|2[0-4][0-9]|25[0-5])|240\.([0-9]|[1-9][0-9]|1[01][0-9]|12[0-7]))\.[0-9]{1,3} rdns= [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
# header ELIMNET X-Spam-Relays-Untrusted =~ /^\[ ip=(?:210\.219\.(?:19[2-9]|2\d\d)\.\d{1,3}|211\.(?:36\.(?:\d|[1-5]\d|6[0-3])|52\.(?:6[4-9]|[7-9]\d|1[01]\d|12[0-7])|112\.(?:\d|[1-5]\d|6[0-3])|174\.(?:12[89]|1[3-9]\d|2\d\d)|210\.181\.2(?:2[4-9]|[345]\d)|211\.174\.(?:12[89]|1[3-9]\d|2\d\d)|240\.(?:\d|\d\d|1[01]\d|12[0-7]))\.\d{1,3}) /
# header ELIMNET X-Spam-Relays-Untrusted =~ /^\[ ip=(?:210\.181\.2(?:2[4-9]|[345]\d)|210\.2(?:19|20)\.(?:19[2-9]|2\d\d)|211\.(?:36\.(?:\d|[1-5]\d|6[0-3])|52\.(?:6[4-9]|[7-9]\d|1[01]\d|12[0-7])|112\.(?:\d|[1-5]\d|6[0-3])|174\.(?:12[89]|1[3-9]\d|2\d\d)|240\.(?:\d|\d\d|1[01]\d|12[0-7])))\.\d{1,3} /
header ELIMNET X-Spam-Relays-Untrusted =~ /^\[ ip=(?:203\.239\.1(?:2[89]|[4-8]\d|9[01])|210\.118\.(?:\d|[12]\d|3[01])|210\.181\.2(?:2[4-9]|[345]\d)|210\.2(?:19|20)\.(?:19[2-9]|2\d\d)|211\.(?:36\.(?:\d|[1-5]\d|6[0-3])|52\.(?:6[4-9]|[7-9]\d|1[01]\d|12[0-7])|112\.(?:\d|[1-5]\d|6[0-3])|174\.(?:12[89]|1[3-9]\d|2\d\d)|240\.(?:\d|\d\d|1[01]\d|12[0-7])))\.\d{1,3} /
describe ELIMNET [KR]ELIMNET-IDC
score ELIMNET 1.5

# 220.230.0.0 - 220.230.255.255
# 59.150.0.0 - 59.150.255.255
# 125.57.0.0 - 125.57.255.255
# 211.183.0.0 - 211.183.255.255
# 211.175.0.0 - 211.175.255.255
# 211.61.128.0-211.61.255.255

# header DREAMX Received =~ /from .+(220\.230|59\.150|125\.57)(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2}/
# header DREAMX X-Spam-Relays-Untrusted =~ /ip=(220\.230|59\.150|125\.57|211\.1(75|83))(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2} rdns= .+ident= envfrom= intl=0 .+auth= /
# 211.247.128.0 - 211.247.255.255
# 61.103.0.0 - 61.103.255.255
# header DREAMX X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:220\.230|59\.150|61\.103|125\.57|211\.1(?:75|83))(?:\.\d{1,3}){2}|(?:61\.96|211\.(?:61|247))\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}) /
# header DREAMX X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:220\.230|59\.150|61\.103|125\.57|211\.1(?:75|83))(?:\.\d{1,3}){2}|(?:(?:61\.96|211\.(?:61|247))\.(?:12[89]|1[3-9]\d|2\d\d)|211\.242\.(?:19[2-9]|2\d\d))\.\d{1,3}) /
header DREAMX X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:61\.96|220\.(?:64|230)|59\.150|61\.103|125\.57|211\.1(?:75|83))(?:\.\d{1,3}){2}|(?:211\.111\.(?:\d|\d\d|1[01]\d|12[0-7])|(?:211\.(?:61|247))\.(?:12[89]|1[3-9]\d|2\d\d)|211\.242\.(?:19[2-9]|2\d\d))\.\d{1,3}) /
describe DREAMX [KR]DREAMLINE CO.
score DREAMX 1.5

# 58.180.0.0 - 58.180.255.255
# 211.190.0.0-211.191.255.255
# 61.248.0.0 - 61.249.246.255
# 210.111.0.0-210.111.127.255
# 211.113.128.0-211.113.255.255

# header SHINBIRO Received =~ /from .+58\.180(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2}/
# header SHINBIRO X-Spam-Relays-Untrusted =~ /ip=58\.180(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2} .+ident= envfrom= intl=0 .+auth= /
# header SHINBIRO X-Spam-Relays-Untrusted =~ /ip=(58\.180|211\.19[01])(\.[0-9]{1,3}){2,2} .+ident= envfrom= intl=0 .+auth= /
# 210.127.204.0-210.127.255.255
# 61.110.0.0 - 61.111.255.255
# 203.240.128.0 - 203.240.255.255
# 210.114.220.0-210.114.250.255
# header SHINBIRO X-Spam-Relays-Untrusted =~ /ip=((58\.180|61\.11[01]|211\.19[01]|61\.248)(\.\d{1,3}){2}|(61\.249\.(\d|[1-9]\d|1\d\d|2[0-3]\d|24[0-6])|203\.251\.(19[2-9]|2\d\d)|210\.111\.(\d|\d\d|1[01]\d|12[0-7])|210\.114\.2([234]\d|50)|210\.127\.2(0[4-9]|[1-5]\d)|(203\.240|211\.113)\.(12[89]|1[3-9]\d|2\d\d))\.\d{1,3}) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /

# 211.61.64.0 - 211.61.127.255
# header SHINBIRO X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:58\.180|61\.11[01]|211\.19[01]|61\.248)(?:\.\d{1,3}){2}|(?:61\.249\.(?:\d|[1-9]\d|1\d\d|2[0-3]\d|24[0-6])|203\.251\.(?:19[2-9]|2\d\d)|210\.111\.(?:\d|\d\d|1[01]\d|12[0-7])|210\.114\.2(?:[234]\d|50)|210\.127\.2(?:0[4-9]|[1-5]\d)|211\.61\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|(?:203\.240|211\.113)\.(?:12[89]|1[3-9]\d|2\d\d))\.\d{1,3}) /
header SHINBIRO X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:58\.180|61\.11[01]|211\.19[01]|61\.248)(?:\.\d{1,3}){2}|(?:61\.249\.(?:\d|[1-9]\d|1\d\d|2[0-3]\d|24[0-6])|113\.130\.(?:6[4-9]|[78]\d|9[0-5])|203\.251\.(?:19[2-9]|2\d\d)|210\.111\.(?:\d|\d\d|1[01]\d|12[0-7])|210\.127\.2(?:0[4-9]|[1-5]\d)|211\.61\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|(?:202\.30|203\.228|203\.240|210\.11[48]|211\.113)\.(?:12[89]|1[3-9]\d|2\d\d))\.\d{1,3}) /
describe SHINBIRO [KR]ONSE Telecom Co.
score SHINBIRO 1.5


# 219.252.0.0-219.253.255.255
# 58.102.0.0 - 58.103.255.255
# 61.104.0.0 - 61.104.255.255
# header SKNETWORKS Received =~ /from .+219\.25[23](\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2}/
# 124.136.0.0 - 124.139.255.255
# 124.0.0.0 - 124.1.255.255
# 61.254.128.0 - 61.254.159.255
# header SKNETWORKS X-Spam-Relays-Untrusted =~ /ip=((58\.10[23]|61\.104|124\.([01]|13[6-9])|219\.25[23])(\.\d{1,3}){2}|61\.254\.1(2[89]|[345]\d)\.\d{1,3}) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
# SK Telecom
header SKNETWORKS X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:1\.2(?:2[4-9]|[345]\d)|27\.1(?:[67]\d|8[0-3])|42\.(?:1[6-9]|[23]\d|4[0-7])|58\.10[23]|61\.104|114\.5[23]|124\.(?:[0-3]|13[6-9])|211\.58|219\.25[2-5])(?:\.\d{1,3}){2}|(?:61\.254|210\.221)\.1(?:2[89]|[345]\d)\.\d{1,3}|(?:61\.101|210\.221|211\.3[37])\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}|210\.205\.(?:\d|[1-5]\d|6[0-3])\.\d{1,3}|210\.219\.1(?:2[89]|[3-8]\d|9[01])\.\d{1,3}|211\.(?:63|115)\.(?:\d|[12]\d|3[01])\.\d{1,3}|218\.36\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}) /
describe SKNETWORKS [KR]SK Networks co., Ltd
score SKNETWORKS 1.5

# 61.32.0.0 - 61.43.255.255
# 125.176.0.0 - 125.191.255.255
# 210.124.0.0 - 210.124.255.255
# 211.180.0.0 - 211.181.255.255
# 211.168.0.0 - 211.171.255.255
# 211.45.192.0 - 211.45.255.255
# header BORANET Received =~ /from .+61\.(3[2-9]|4[0-3])(\.[0-9]{1,3}){2,2}[\)\] ]/
# header BORANET X-Spam-Relays-Untrusted =~ /ip=(61\.(3[2-9]|4[0-3])|125\.1(7[6-9]|8[0-9]|9[01]))(\.[0-9]{1,3}){2,2} .+ident= envfrom= intl=0 .+auth= /
# header BORANET X-Spam-Relays-Untrusted =~ /ip=(61\.(3[2-9]|4[0-3])|125\.1(7[6-9]|8[0-9]|9[01])|210\.124|211\.1(6[89]|7[01]|8[01]))(\.[0-9]{1,3}){2,2} .+ident= envfrom= intl=0 .+auth= /
# header BORANET X-Spam-Relays-Untrusted =~ /ip=((61\.(3[2-9]|4[0-3])|125\.1(7[6-9]|8[0-9]|9[01])|210\.124|211\.1(6[89]|7[01]|8[01]))(\.[0-9]{1,3}){2,2}|211\.45\.(19[2-9]|2[0-4][0-9]|25[0-5])\.[0-9]{1,3}) .+ident= envfrom= intl=0 .+auth= /
# header BORANET X-Spam-Relays-Untrusted =~ /ip=((58\.7[2-9]|61\.(3[2-9]|4[0-3])|125\.1(7[6-9]|8\d|9[01])|210\.124|211\.1(6[89]|7[01]|8[01]))(\.\d{1,3}){2}|211\.45\.(19[2-9]|2[0-4]\d|25[0-5])\.\d{1,3}) .+ident= envfrom= intl=0 .+auth= /
# 211.118.0.0 - 211.119.255.255
# 60.196.0.0 - 60.197.255.255
# 210.92.64.0 - 210.92.255.255
# 211.40.0.0 - 211.40.255.255
# 210.101.128.0 - 210.101.191.255
# 211.53.0.0 - 211.53.255.255
# 210.216.0.0 - 210.216.255.255
# 125\.(1(7[6-9]|8\d|9[01])|24[0-7])|
# 164.124.0.0 - 164.124.255.255
# 203.248.128.0 - 203.248.255.255
# 210.108.0.0 - 210.108.255.255
# 121.64.0.0 - 121.67.255.255
# 125.248.0.0 - 125.251.255.255
# 58.150.0.0 - 58.151.255.255
# 123.140.0.0 - 123.143.255.255
# 210.98.128.0 - 210.98.191.255
# header BORANET X-Spam-Relays-Untrusted =~ /ip=((58\.(7[2-9]|15[01]|184)|59\.18[67]|60\.19[67]|61\.(3[2-9]|4[0-3])|121\.6[4-7]|123\.14[0-3]|125\.2(4\d|5[01])|164\.124|203\.248\.(1(2[89]|[3-9]\d)|2\d\d)|210\.(10[78]|12[04]|182|216)|211\.(32|40|5[03]|1(1[89]|6[89]|7[01]|8[01])))(\.\d{1,3}){2}|210\.92\.(6[4-9]|[7-9]\d|1\d\d|2[0-4]\d|25[0-5])\.\d{1,3}|210\.98\.1(2[89]|[3-8]\d|9[01])\.\d{1,3}|210\.101\.(12[89]|1[3-8]\d|19[01])\.\d{1,3}|211\.45\.(19[2-9]|2[0-4]\d|25[0-5])\.\d{1,3}) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
# LG POWERCOMM
header BORANET X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:1\.2(?:0[89]|1\d|2[0-3])|58\.(?:7[2-9]|15[01]|184)|59\.18[67]|60\.19[67]|61\.(?:3[2-9]|4[0-3])|112\.(?:7[67]|2(?:1[6-9]|2[0-3]))|115\.(?:8[89]|9[0-5])|117\.11[01]|118\.1(?:2[89]|3[01])|121\.6[4-7]|123\.14[0-3]|125\.2(?:4\d|5[01])|164\.124|203\.248\.(?:1(?:2[89]|[3-9]\d)|2\d\d)|210\.(?:10[78]|12[04]|182|20[67]|216)|211\.(?:32|40|5[03]|1(?:1[89]|6[89]|7[01]|8[01])))(?:\.\d{1,3}){2}|110\.45\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|114\.108\.1(?:2[89]|[3-8]\d|9[01])\.\d{1,3}|121\.254\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|203\.247\.1(?:2[89]|[3-5]\d)\.\d{1,3}|203\.252\.(?:\d|1[0-5])\.\d{1,3}|210\.92\.(?:6[4-9]|[7-9]\d|1\d\d|2\d\d)\.\d{1,3}|210\.96\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|210\.98\.1(?:2[89]|[3-8]\d|9[01])\.\d{1,3}|210\.101\.(?:12[89]|1[3-8]\d|19[01])\.\d{1,3}|210\.220\.(?:9[6-9]|1[01]\d|12[0-7])\.\d{1,3}|211\.42\.1(?:[678]\d|9[01])\.\d{1,3}|211\.43\.(?:19[2-9]|2[01]\d|22[0-3])\.\d{1,3}|211\.45\.(?:19[2-9]|2\d\d)\.\d{1,3}|211\.63\.(?:3[2-9]|[45]\d|6[0-3])\.\d{1,3}|(?:210\.116|211\.115)\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])\.\d{1,3}|211\.174\.(?:4[89]|5\d|6[0-3])\.\d{1,3}|211\.233\.(?:\d|[1-8]\d|9[0-5])\.\d{1,3}|211\.234\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}|211\.238\.(?:9[6-9]|1[01]\d|12[0-7])\.\d{1,3}|222\.231\.(?:\d|[1-5]\d|6[0-3])\.\d{1,3}) /
describe BORANET [KR]DACOM Corp.
score BORANET 1.5

# 218.37.0.0-218.37.255.255
# 61.109.0.0 - 61.109.127.255
# 124.80.0.0 - 124.80.255.255
# 61.247.64.0 - 61.247.127.255
# 124.199.128.0 - 124.199.255.255
# header HANVITINB X-Spam-Relays-Untrusted =~ /ip=((124\.80|218\.37)(\.[0-9]{1,3}){2}|(61\.109\.(\d|[1-9]\d|1[01]\d|12[0-7])|61\.247\.(6[4-9]|[789]\d|1[01]\d|12[0-7])|124\.199\.(12[89]|1[3-9]\d|2\d\d)|211\.237\.(1[678]\d|19[01]))\.\d{1,3}) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
header HANVITINB X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:124\.80|218\.37)(?:\.\d{1,3}){2}|(?:61\.109\.(?:\d|\d\d|1[01]\d|12[0-7])|61\.247\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|(?:124\.199|218\.101)\.(?:12[89]|1[3-9]\d|2\d\d)|211\.237\.(?:1[678]\d|19[01]))\.\d{1,3}) /
describe HANVITINB [KR]Hanvitinb 
score HANVITINB 1.5

# 58.140.0.0 - 58.143.255.255
header CNM_COMM X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:58\.14[0-3]|112\.214|118\.176|120\.142|121\.88|124\.5)(?:\.[0-9]{1,3}){2}|(?:114\.30|211\.172)\.(?:\d|[12]\d|3[01])\.\d{1,3}) /
describe CNM_COMM [KR]C&M Communication Co., Ltd.
score CNM_COMM 1.5

# 211.109.0.0 - 211.110.255.255
# 211.186.0.0 - 211.187.255.255
# header THRUNET X-Spam-Relays-Untrusted =~ /ip=211\.1(09|10|8[67])(\.[0-9]{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
header THRUNET X-Spam-Relays-Untrusted =~ /^\[ ip=211\.1(?:09|10|8[67])(?:\.\d{1,3}){2} /
describe THRUNET [KR]Thrunet Co., Ltd.
score THRUNET 1.5

# 211.236.128.0-211.236.223.255
header TACHYNET X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.4\.(?:19[2-9]|2\d\d)|211\.236\.(?:12[89]|1[3-9]\d|2[01]\d|22[0-3]))\.\d{1,3} /
describe TACHYNET [KR]TACHYNET-INFRA
score TACHYNET 1.5

# 211.247.0.0 - 211.247.127.255
# 203.90.32.0 - 203.90.63.255
# 203.210.32.0 - 203.210.63.255
# 211.115.224.0-211.115.255.255
# 61.252.192.0-61.252.255.255
# 211.173.128.0-211.173.159.255
# 210.2.32.0 - 210.2.63.255
# 211.172.64.0 - 211.172.79.255
header CHEONANVITSSEN_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.252\.(?:19[2-9]|2\d\d)|203\.(?:90|210)\.(?:3[2-9]|[45]\d|6[0-3])|210\.2\.(?:3[2-9]|[45]\d|6[0-3])|210\.210\.(?:19[2-9]|2\d\d)|211\.115\.2(?:2[4-9]|[345]\d)|211\.172\.(?:6[4-9]|7\d)|211\.173\.1(?:2[89]|[345]\d)|211\.247\.(?:\d|[1-9]\d|1[01]\d|12[0-7]))\.\d{1,3} /
describe CHEONANVITSSEN_KR [KR] Cable TV Cheonan BroadcasMunhwa-dong, Cheonan-si
score CHEONANVITSSEN_KR 1.5

# 61.247.64.0 - 61.247.127.255
header CABLELINE_KR X-Spam-Relays-Untrusted =~ /^\[ ip=61\.247\.(?:6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.\d{1,3} /
describe CABLELINE_KR [KR]BANDOCABLELINE
score CABLELINE_KR 1.5

# 211.112.64.0 - 211.112.95.255
header ICNDIGITAL_KR X-Spam-Relays-Untrusted =~ /^\[ ip=211\.112\.(?:6[4-9]|[78]\d|9[0-5])\.\d{1,3} /
describe ICNDIGITAL_KR [KR]Korea Cable TV Namincheon Brodcasting Co., Ltd.
score ICNDIGITAL_KR 1.5

# 218.209.0.0 - 218.209.255.255
# 222.251.128.0 - 222.251.255.255
# header TBROAD_KR X-Spam-Relays-Untrusted =~ /ip=218\.209(\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
header TBROAD_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(218\.209(?:\.\d{1,3}){2}|222\.251\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}) /
describe TBROAD_KR [KR]Korea Cable Television Suwon Broadcating Co.
score TBROAD_KR 1.5

# 61.106.64.0 - 61.106.79.255
# 202.136.128.0 - 202.136.159.255
# 211.237.208.0-211.237.223.255
# 211.172.208.0-211.172.223.255
# 203.130.96.0 - 203.130.127.255
header KNCTV_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.106\.(?:6[4-9]|7\d)|110\.92\.(?:12[89]|1[[3-9]\d|2\d\d)|111\.84\.(?:\d|\d\d|1[01]\d|12[0-7])|113\.10\.(?:\d|[1-5]\d|6[0-3])|202\.136\.1(?:2[89]|[3-5]\d)|203\.130\.(?:9[6-9]|1[01]\d|12[0-7])|211\.(?:172|237)\.2(?:0[89]|1\d|2[0-3]))\.\d{1,3} /
describe KNCTV_KR [KR]KangNam CableTV
score KNCTV_KR 1.5

# 163.180.0.0 - 163.180.255.255
header KHUNET_KR X-Spam-Relays-Untrusted =~ /ip=163\.180(?:\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe KHUNET_KR [KR]Kyung Hee University
score KHUNET_KR 1.5

# 203.240.0.0 - 203.243.255.255
# 61.96.0.0 - 61.111.255.255
# 211.41.0.0 - 211.41.255.255
# 211.104.0.0 - 211.119.255.255
# 211.54.0.0 - 211.59.255.255
# 211.232.0.0 - 211.255.255.255
# 203.226.0.0 - 203.231.255.255
# 220.64.0.0 - 220.71.255.255
# 210.90.0.0 - 210.91.255.255
# 210.125.0.0 - 210.127.255.255
# 203.224.0.0 - 203.255.255.255
# 218.36.0.0 - 218.39.255.255
header KRNIC_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.(?:9[6-9]|10\d|11[01]|24[89]|25\d)|203\.2(?:2[4-9]|[345]\d)|210\.(?:9\d|1[01]\d|12[0-7]|17[89]|18[0-3]|217)|211\.(?:3[2-9]|[45]\d|6[0-3]|10[4-9]|11\d|16[89]|17[2-9]|1[89]\d|2\d\d)|218\.3[6-9]|220\.(?:6[4-9]|7[01]))(?:\.\d{1,3}){2} /
describe KRNIC_KR [KR]Korea Network Information Center
score KRNIC_KR 1.5

# 58.65.64.0 - 58.65.127.255
# 211.246.128.0 - 211.246.255.255
# header SCSNET_KR X-Spam-Relays-Untrusted =~ /ip=58\.65\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.\d{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
header SCSNET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:58\.65\.(?:6[4-9]|[7-9]\d|1[01]\d|12[0-7])|(?:124\.153|211\.246)\.(?:12[89]|1[3-9]\d|2\d\d))\.\d{1,3} /
describe SCSNET_KR [KR]Seokyung Cable Television Co.. Ltd.
score SCSNET_KR 1.5

# 168.188.0.0 - 168.188.255.255
header CHUNGNAM_KR X-Spam-Relays-Untrusted =~ /ip=168\.188(?:\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe CHUNGNAM_KR [KR]Chungnam National University
score CHUNGNAM_KR 1.5

# 165.132.0.0 - 165.132.255.255
header YONSEI_NET_KR X-Spam-Relays-Untrusted =~ /ip=165\.132(?:\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe YONSEI_NET_KR [KR]imported inetnum object for YONSEI
score YONSEI_NET_KR 1.5

# 124.48.0.0 - 124.63.255.255
# 125.176.0.0 - 125.191.255.255
# 122.32.0.0 - 122.47.255.255
# 116.32.0.0 - 116.47.255.255
# /ip=(116\.(3[2-8]|4[0-7])|119\.(6[4-9]|7[01])|122\.(3[2-9]|4[0-7])|124\.(4[89]|5\d|6[0-3])|125\.1(7[6-9]|8\d|9[01]))(\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /

header XPEED_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:58\.148|112\.1(?:4[4-9]|5\d)|115\.1(?:3[6-9]|4[0-3])|116\.(?:3[2-9]|4[0-7])|119\.(?:6[4-9]|7[01])|122\.(?:3[2-9]|4[0-7])|124\.(?:4[89]|5\d|6[0-3])|125\.1(?:7[6-9]|8\d|9[01])|180\.2(?:2[4-9]|3[01])|182\.2(?:0[89]|1\d|2[0-3]))(?:\.\d{1,3}){2} /
describe XPEED_KR [KR]POWERCOM
score XPEED_KR 1.5

header __XPEEDMAILER X-Mailer =~ /(NEXTism Mailer|Shadow Mail v)/

meta XPEEDMAILER ISO2022JP_BODY && __XPEEDMAILER && XPEED_KR
score XPEEDMAILER 5.5



# 168.131.0.0 - 168.131.255.255
header CHONNAM_NET_KR X-Spam-Relays-Untrusted =~ /ip=168\.131(?:\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe CHONNAM_NET_KR [KR]Chonnam National University
score CHONNAM_NET_KR 1.5

# 203.210.16.0 - 203.210.31.255
header DOTNAME_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:121\.0\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|203\.210\.(?:1[6-9]|2\d|3[01]))\.\d{1,3} /
describe DOTNAME_KR [KR]Dotname Korea Corp
score DOTNAME_KR 1.5

# 124.197.128.0 - 124.197.223.255
header DONGDAEMUN_KR X-Spam-Relays-Untrusted =~ /ip=124\.197\.(?:12[89]|1[3-9]\d|2[01]\d|22[0-3])\.\d{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe DONGDAEMUN_KR [KR]Dongdaemun cable networks,Inc.
score DONGDAEMUN_KR 1.5

# 58.145.0.0 - 58.145.127.255
# 203.229.0.0 - 203.229.127.255
header QRIXNET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:58\.145|123\.109|203\.229)\.(?:\d|\d\d|1[01]\d|12[0-7])|61\.102\.(?:12[89]|1[3-8]\d|2[01]\d|22[0-3])|111\.65\.1(?:2[89]|[3-8]\d|9[01])|124\.254\.(?:12[89]|1[3-9]\d|2\d\d)|(?:61\.251|211\.189)\.2(?:2[4-9]|[345]\d))\.\d{1,3} /
describe QRIXNET_KR [KR]QRIXNET
score QRIXNET_KR 1.5

# 211.41.0.0-211.41.46.255
header KITINET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=211\.41\.(\d|[1-5]\d|6[0-3])\.\d{1,3} /
describe KITINET_KR [KR]KITINET-INFRA
score KITINET_KR 1.5

# 124.198.0.0 - 124.198.127.255
header HAIONNET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:115\.144|121\.1[25]6)(?:\.\d{1,3}){2}|124\.198\.(\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}|202\.133\.(?:1[6-9]|2\d|3[01])\.\d{1,3}|203\.109\.(?:\d|[12]\d|3[01])\.\d{1,3}) /
describe HAIONNET_KR [KR]HAIonNet
score HAIONNET_KR 1.5


# 210.97.134.0-210.97.159.255
# 220.66.0.0-220.69.249.255
# 203.230.128.0-203.230.255.255
# 210.110.0.0-210.110.127.255
# 220.66.0.0-220.66.127.255
header KREN_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:203\.23[02]|210\.102)\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|203\.249\.(?:9[6-9]|1[01]\d|12[0-7])\.\d{1,3}|203\.2(?:34|50)\.(?:6[4-9]|[78]\d|9[0-5])\.\d{1,3}|(?:203\.246|210\.93)\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}|210\.97\.1(?:3[4-9]|[45]\d)\.\d{1,3}|210\.110\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}|220\.(?:6[6-9]|149)(?:\.\d{1,3}){2}) /
describe KREN_KR [KR]kyungdongjeongbodaehak
score KREN_KR 1.5

# 202.150.176.0 - 202.150.191.255
# 211.47.80.0 - 211.47.127.255
# 120.50.64.0 - 120.50.127.255
# 114.199.128.0 - 114.199.255.255
header HCN_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:114\.199\.(?:1(2[89]|[3-9]\d)|2\d\d)|111\.118\.(\d|\d\d|1[01]\d|12[0-7])|112\.72\.(?:12[89]|1[3-9]\d|2\d\d)|120\.50\.(6[4-9]|[789]\d|1[01]\d|12[0-7])|202\.150\.1(7[6-9]|8\d|9[01])|211\.(41\.(?:19[2-9]|20[0-7])|47\.([89]\d|1[01]\d|12[0-7])|237\.2[45]\d))\.\d{1,3} /
describe HCN_KR [KR]HYUNDAI COMMUNICATIONS & NETWORK
score HCN_KR 1.5


replace_tag VAAN_IPS (?:58\.181\.(?:\d|[1-5]\d|6[0-3])|(?:112\.136|122\.199)\.(?:12[89]|1[3-9]\d|2\d\d)|211\.47\.2(?:2[4-9]|3\d)|211\.45\.(?:9[6-9]|1[01]\d|12[0-7])|211\.56\.2(?:2[4-9]|[345]\d)|211\.232\.(?:\d|\d\d|1[0-8]\d|19[01])|221\.132\.(?:6[4-9]|[78]\d|9[0-5]))\.\d{1,3}

# 211.56.224.0 - 211.56.255.255
# 58.181.0.0 - 58.181.63.255
header VAAN_KR X-Spam-Relays-Untrusted =~ /^\[ ip= /
describe VAAN_KR [KR]NexG
score VAAN_KR 1.5
header ___GOOMAIL_VAAN_KR X-Original-IP =~ /\[\]/
header ___INFOSEEK_WEBMAIL_VAAN_KR X-OriginalIP =~ //

meta WM_VAAN_KR ___GOOMAIL_VAAN_KR || ___INFOSEEK_WEBMAIL_VAAN_KR
describe WM_VAAN_KR [KR]webmail from VAAN_KR
score WM_VAAN_KR 1.5

# 124.217.192.0 - 124.217.223.255
# 180.210.0.0 - 180.210.127.255
header HCLC_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:101\.79\.\d{1,3}|(?:110\.4|113\.30)\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|114\.141\.(?:\d|[12]\d|3[01])|124\.217\.(?:19[2-9]|2[01]\d|22[0-3])|180\.210\.(?:\d|\d\d|1[01]\d|12[0-7])|182\.252\.(?:12[89]|1[3-9]\d|2\d\d)|210\.4\.2(?:1[6-9]|2[0-3]))\.\d{1,3} /
describe HCLC_KR [KR]395-65 Korea Computer BLDG F3 Sindaebang-dong Dongjak-gu Seoul
score HCLC_KR 1.5

header GDSYS_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:180\.131\.(\d|[1-5]\d|6[0-3])|183\.86\.(?:19[2-9]|2\d\d))\.\d{1,3} /
describe GDSYS_KR [KR]INCHON Incheon IT Tower Nam-gu Dohwa 1-dong Incheon
score GDSYS_KR 1.5

header BOLU_TELECOM_KR X-Spam-Relays-Untrusted =~ /^\[ ip=202\.173\.2(?:2[4-9]|[345]\d)\.\d{1,3} /
describe BOLU_TELECOM_KR [KR]DONGGUAN BOLU TELECOM SCIENCE&TECHNOLOGY CORPORATINOLTD
score BOLU_TELECOM_KR 1.5

header JNDINFO_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.97\.1(?:[678]\d|9[01])|110\.93\.1(?:1[2-9]|2[0-7])|110\.165\.(?:\d|[12]\d|3[01])|115\.85\.1(?:[678]\d|9[01])|121\.101\.(?:19[2-9]|20[0-7])|175\.106\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|211\.174\.(?:3[2-9]|4[0-7])|(?:101\.101|223\.130)\.(?:12[89]|1[3-9]\d|2\d\d))\.\d{1,3} /
describe JNDINFO_KR [KR]JND Communication
score JNDINFO_KR 1.5

header DITIZONE_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.97\.2(?:2[4-9]|3\d)|113\.199\.(?:\d|\d\d|1[01]\d|12[0-7])|210\.97\.1(?:6\d|[78]\d|9[01])|211\.111\.2(?:2[4-9]|[345]\d)|211\.112\.(?:9[6-9]|1[01]\d|12[0-7]))\.\d{1,3} /
describe DITIZONE_KR [KR]ABN 23-3, Jeongja-dong, Seongnam-Si, Bundang-gu, GYEONGGI-DO
score DITIZONE_KR 1.5

header SEJONGNET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.100\.(?:\d|\d\d|1[0-8]\d|19[01])|61\.250\.(?:6[4-9]|[78]\d|9[0-5])|61\.252\.1(?:[678]\d|9[01])|(?:203\.227|210\.1(?:09|22))\.\d{1,3}|(?:203\.2(?:3[589]|48)|210\.112)\.(?:\d|\d\d|1[01]\d|12[0-7])|(?:61\.109|203\.243|210\.1(?:03|16))\.(?:12[89]|1[3-9]\d|2\d\d)|211\.115\.(?:19[2-9]|20[0-7])|211\.172\.(?:9[6-9]|10\d|11[01])|211\.189\.1(?:[678]\d|9[01])|211\.236\.2(?:2[4-9]|[345]\d)|211\.238\.(?:\d|[12]\d|3[01])|211\.239\.(?:\d|\d\d|1[0-8]\d|19[01]))\.\d{1,3} /
describe SEJONGNET_KR [KR]SEJONG TELECOM
score SEJONGNET_KR 1.5

header KINXINC_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:121\.78(?:\.\d{1,3}){2}|122\.49\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])\.\d{1,3}|203\.84\.2[45]\d\.\d{1,3}|203\.236\.(?:19[2-9]|2\d\d)\.\d{1,3}|203\.238\.1(?:7[6-9]|8\d|9[01])\.\d{1,3}|203\.246\.1(?:6\d|7[0-5])\.\d{1,3}) /
describe KINXINC_KR [KR]KINX 5F, Daelim Acrotel, Dogok-Dong, Gangnam-gu,SEOUL
score KINXINC_KR 1.5

header SAMSUNGSDS_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:180\.23[6-9]\.\d{1,3}|210\.94\.(?:3[2-9]|[45]\d|6[0-3])|210\.118\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|211\.189\.(?:\d|\d\d|1[01]\d|12[0-7]))\.\d{1,3} /
describe SAMSUNGSDS_KR [KR]SamsungSDS Inc.
score SAMSUNGSDS_KR 1.5

header RAYNET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:122\.129\.2[45]\d|211\.238\.(?:3[2-9]|[45]\d|6[0-3]))\.\d{1,3} /
describe RAYNET_KR [KR]GORayNet
score RAYNET_KR 1.5

# HANINTERNET
header DURUAN_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.97\.1(?:2[89]|[345]\d)|121\.0\.(?:12[89]|1[3-9]\d|2\d\d)|211\.(?:47\.1(?:7[6-9]|8\d|9[01])|63\.(?:7[6-9]|8\d|9[0-5])|237\.(?:3[2-9]|4[0-7])|238\.1(?:2[89]|3\d|4[0-3])))\.\d{1,3} /
describe DURUAN_KR [KR]Duruan
score DURUAN_KR 1.5

# header HINETWORKS_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.250\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|211\.47\.(?:12[89]|1[345]\d)\.\d{1,3}|211\.241\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|(?:211\.254|218\.36)\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}) /
header HINETWORKS_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:61\.250|211\.241)\.(?:12[89]|1[3-9]\d|2\d\d)|211\.47\.1(?:2[89]|[345]\d)|211\.235\.2(?:2[4-9]|[345]\d)|(?:211\.254|218\.36)\.(?:\d|\d\d|1[01]\d|12[0-7])|211\.255\.(?:3[2-8]|[45]\d|6[0-3]))\.\d{1,3} /
describe HINETWORKS_KR [KR]HiLine Internet Service Inc.
score HINETWORKS_KR 1.5

# header OK_NET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.97\.1(?:1[2-9]|2[0-7])|125\.7\.(?:19[2-9]|2\d\d)|210\.221\.(?:19[2-9]|2[01]\d|22[0-3]))\.\d{1,3} /
header OK_NET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.97\.1(?:1[2-9]|2[0-7])|125\.7\.(?:19[2-9]|2\d\d)|210\.221\.(?:19[2-9]|2[01]\d|22[0-3])|211\.238\.2[45]\d)\.\d{1,3} /
describe OK_NET_KR [KR]OK-NET Co,. Ltd
score OK_NET_KR 1.5

header KTNET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:203\.242\.(?:12[89]|1[3-9]\d|2\d\d)|210\.181\.(?:19[2-9]|2[01]\d|22[0-3])|210\.217\.1(?:2[89]|[345]\d)|211\.37\.(?:19[2-9]|2[01]\d|22[0-3]))\.\d{1,3} /
describe KTNET_KR [KR]Korea Trade Network
score KTNET_KR 1.5

header EHOSTIDC_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:27\.255\.(?:6[4-9]|[78]\d|9[0-5])|61\.97\.2[45]\d|180\.150\.2(?:2[4-9]|3[01]))\.\d{1,3} /
describe EHOSTIDC_KR [KR]EHOST IDC 916 Newticastle Geumcheon-gu Gasan-dong Seoul
score EHOSTIDC_KR 1.5

header GYEONG_NET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=203\.255\.(?:\d|[1-5]\d|6[0-3])\.\d{1,3} /
describe GYEONG_NET_KR [KR]GyeongSang National University
score GYEONG_NET_KR 1.5

header SMILESERV_KR X-Spam-Relays-Untrusted =~ /^\[ ip=115\.68(?:\.\d{1,3}){2} /
describe SMILESERV_KR [KR]2F Daeryung Techno Tower 2-cha Gasan-dong Geumcheon-gu
score SMILESERV_KR 1.5

header PETINET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:210\.180\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|211\.182(?:\.\d{1,3}){2}) /
describe PETINET_KR [KR]BUSAN EDUCATION RESEARCH & INFORMATION CENTER 
score PETINET_KR 1.5

header CDNETWORKS_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:116\.193\.(?:8\d|9[0-5])|118\.107\.1(?:6\d|7[0-5]))\.\d{1,3} /
describe CDNETWORKS_KR [KR]828-7 Yeoksam 1-dong gangnamgu Seoul
score CDNETWORKS_KR 1.5

header KAIST_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:143\.248(?:\.\d{1,3}){2}|110\.76\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])\.\d{1,3}) /
describe KAIST_KR [KR]Korea Advanced Institute of Science and Technology
score KAIST_KR 1.5

# 211.255.192.0 - 211.255.207.255
header KOINS_KR X-Spam-Relays-Untrusted =~ /^\[ ip=211\.255\.(?:19[2-9]|20[0-7])\.\d{1,3} /
describe KOINS_KR [KR]KOSCOM Korea Exchange Yeongdeungpo-gu Yeouido-dong Seoul
score KOINS_KR 1.5

# 203.252.128.0 - 203.252.191.255
# 192.203.145.0 - 192.203.145.255
header KONKUKNET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:192\.203\.145|203\.252\.1(?:2[89]|[3-8]\d|9[01]))\.\d{1,3} /
describe KONKUKNET_KR [KR]Konkuk University
score KONKUKNET_KR 1.5

header CABLENET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:112\.133\.(?:\d|\d\d|1[01]\d|12[0-7])|119\.77\.(?:9[6-9]|1[01]\d|12[0-7])|122\.202\.(?:12[89]|1[3-9]\d|2\d\d))\.\d{1,3} /
describe CABLENET_KR [KR]422 KCTV JEJU BROADCASTING, yeon-dong jeju si jejudo,690-815
score CABLENET_KR 1.5

header PIRANHA_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:110\.165\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|114\.141\.2(?:2[4-9]|[345]\d)|182\.163\.(?:12[89]|1[3-9]\d|2\d\d))\.\d{1,3} /
describe PIRANHA_KR [KR]Piranha Systems 48-14, Ganseok-dong Namdong-gu Incheon
score PIRANHA_KR 1.5

header LDCC_KR X-Spam-Relays-Untrusted =~ /^\[ ip=210\.93\.1(?:2[89]|[3-8]\d|9[01])\.\d{1,3} /
describe LDCC_KR [KR]Lotte Data Communication Company
score LDCC_KR 1.5

header CST21_KR X-Spam-Relays-Untrusted =~ /^\[ ip=115\.178\.(?:6[4-9]|[5-8]\d|9[0-5])\.\d{1,3} /
describe CST21_KR [KR]13F Daelim Acrotel C-Dong,467-6 Dogok-dong Gangnam-gu Seoul
score CST21_KR 1.5

header DAEWOO_KR X-Spam-Relays-Untrusted =~ /^\[ ip=152\.149(?:\.\d{1,3}){2} /
describe DAEWOO_KR [KR]Daewoo Infomation Systems co.
score DAEWOO_KR 1.5

header NHN_KR X-Spam-Relays-Untrusted =~ /^\[ ip=175\.158\.(?:\d|[12]\d|3[01])\.\d{1,3} /
describe NHN_KR [KR]Venture Town 25-1, Jeongjadong, Bundang-gu,Seongnam-si, Kyounggi-do
score NHN_KR 1.5

header ESONET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=122\.99\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3} /
describe ESONET_KR [KR]3F 1577-8, Sillim-dong, Gwanak-gu, Seoul-si
score ESONET_KR 1.5

header JCNIDC_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:27\.96|49\.50)\.1(?:2[89]|[3-8]\d|9[01])\.\d{1,3} /
describe JCNIDC_KR [KR]60-44, EnC Dream Tower 7-cha Gasan-dong Geumcheon-gu Seoul-si
score JCNIDC_KR 1.5

header JIGUNET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=211\.172\.1(?:1[2-9]|2[0-7])\.\d{1,3} /
describe JIGUNET_KR [KR]IOSYSTEM
score JIGUNET_KR 1.5

# SPEEDONSTV
# SOOSUNG CABLE TELEVISION INC
# CJ-HELLOVISION-KR
header CJ_CABLENET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:1\.17[67]|110\.4[67]|119\.149|180\.182)(?:\.\d{1,3}){2}|(?:(?:119\.75|122\.128)\.1(?:2[89]|[3-8]\d|9[01])|(?:120\.136|180\.92)\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7]))\.\d{1,3}) /
describe CJ_CABLENET_KR [KR]1254, sinjeongdong, yangcheongu, Seoul, 158-070
score CJ_CABLENET_KR 1.5

header HANINTERNET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:121\.0\.(?:12[89]|1[3-9]\d|2\d\d)|210\.16\.(?:19[2-9]|2\d\d))\.\d{1,3} /
describe HANINTERNET_KR [KR]Guro-dong, Guro-gu, SEOUL, 152-050
score HANINTERNET_KR 1.5

# 221.133.48.0 - 221.133.63.255
# 211.35.64.0 - 211.35.79.255
header KPIN_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:211\.35\.(?:6[4-9]|7\d)|221\.133\.(?:4[89]|5\d|6[0-3]))\.\d{1,3} /
describe KPIN_KR [KR]INet Technologies Co., Ltd.
score KPIN_KR 1.5

header AES_KR X-Spam-Relays-Untrusted =~ /^\[ ip=58\.87\.(?:3[2-9]|[45]\d|6[0-3])\.\d{1,3} /
describe AES_KR [KR]AutoEverSystems Corp.
score AES_KR 1.5

header YAHOO_KR X-Spam-Relays-Untrusted =~ /^\[ ip=111\.67\.2(?:2[4-9]|[345]\d)\.\d{1,3} /
describe YAHOO_KR [KR]Yahoo! Korea, Corp.
score YAHOO_KR 1.5

header GINAMHANVITNET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:117\.123(?:\.\d{1,3}){2}|211\.116\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])\.\d{1,3}) /
describe GINAMHANVITNET_KR [KR]Tbroad Ginam Broadcating Co., Ltd.
score GINAMHANVITNET_KR 1.5

header KREONET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:202\.30\.(?:\d|[12]\d|3[01])|210\.110\.(?:12[89]|1[3-9]\d|2\d\d))\.\d{1,3} /
describe KREONET_KR [KR]KISTI
score KREONET_KR 1.5

header ILINKKOREA_KR X-Spam-Relays-Untrusted =~ /^\[ ip=61\.251\.1(?:7[6-9]|8\d|9[01])\.\d{1,3} /
describe ILINKKOREA_KR [KR]613ho, Seoul Donggyo-dong Mapo-gu LG Palace Bldg.
score ILINKKOREA_KR 1.5

header NETROPY_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:211\.174\.(?:9[6-9]|1[01]\d|12[0-7])|211\.233\.(?:12[89]|1[3-9]\d|2\d\d))\.\d{1,3} /
describe NETROPY_KR [KR]NETROPY CO.,Ltd
score NETROPY_KR 1.5

header IP4NET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:119\.30\.1(?:2[89]|1[3-8]\d|9[01])|202\.68\.2(?:2[4-9]|[345]\d))\.\d{1,3} /
describe IP4NET_KR [KR]P4Networks Inc 2F Modern Bldg 680-77 Jayang 2-dong Gwangjin-gu descr: SEOUL, 151-050
score IP4NET_KR 1.5

header KDTIDC_KR X-Spam-Relays-Untrusted =~ /^\[ ip=101\.55\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3} /
describe KDTIDC_KR [KR]8F, Sindorim technomart Guro 5(o)-dong Guro-gu Seoul
score KDTIDC_KR 1.5

header DSUNET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=203\.241\.1(?:7[6-9]|8\d|9[01]\d)\.\d{1,3} /
describe DSUNET_KR [KR]Dongseo University
score DSUNET_KR 1.5

header CMBI_NETDJ_KR X-Spam-Relays-Untrusted =~ /^\[ ip=110\.35\.(?:\d|[1-5]\d|6[0-3])\.\d{1,3} /
describe CMBI_NETDJ_KR [KR]CMB Daejeon Broadcasting Co,.Ltd 95-3, CMB Building, Seonhwa-dong Jung-gu Daejeon-si
score CMBI_NETDJ_KR 1.5

header SAERONET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=(?:113\.59\.1(?:2[89]|[3-8]\d|9[01])|119\.56\.(?:12[89]|[3-9]\d|2\d\d))\.\d{1,3} /
describe SAERONET_KR [KR]Saero Network Service LTD 274-9, Gumi-si, Songjeong-dong, Gyeongsangbuk-do
score SAERONET_KR 1.5

header NAMDONGNET_KR X-Spam-Relays-Untrusted =~ /^\[ ip=124\.28\.1(?:2[89]|[3-8]\d|9[01])\.\d{1,3} /
describe NAMDONGNET_KR [KR]Inchon cable TV namdong broadcasting 1124, Guwol-dong namdong-gu, Inchon, 405-220
score NAMDONGNET_KR 1.5



# 203.67.0.0 - 203.67.255.255
# 210.64.0.0 - 210.64.255.255
# 210.66.0.0 - 210.66.255.255
# 210.68.0.0 - 210.68.255.255
# 203.70.0.0 - 203.70.255.255
# 210.243.127.0 - 210.243.255.255
# 139.175.0.0 - 139.175.255.255

# 203.73.0.0 - 203.73.255.255
# 211.74.0.0 - 211.74.255.255
# 210.244.0.0 - 210.244.127.255
# header SEEDNET Received =~ /from .+(203\.67|210\.6[468])(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2}/
# header SEEDNET X-Spam-Relays-Untrusted =~ /ip=((59\.10[45]|139\.175|203\.(67|7[03])|210\.6[468]|211\.74)(\.\d{1,3}){2}|(210\.243\.(12[7-9]|1[3-9]\d|2\d\d)|210\.244\.(\d|\d\d|1[01]\d|12[0-7]))\.\d{1,3}) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
header SEEDNET X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:59\.10[45]|112\.10[45]|123\.20[45]|139\.175|203\.(?:67|7[03])|210\.6[468]|211\.74)(?:\.\d{1,3}){2}|(?:210\.243\.(?:12[7-9]|1[3-9]\d|2\d\d)|210\.244\.(?:\d|\d\d|1[01]\d|12[0-7]))\.\d{1,3}) /
describe SEEDNET [TW]Digital United Inc.
score SEEDNET 1.0

# 210.200.0.0 - 210.201.255.255
# 210.202.0.0 - 210.202.255.255
# 210.203.0.0 - 210.203.127.255
# 218.187.0.0 - 218.187.255.255

# header APOL Received =~ /from .+(21(0\.20[0-2]|8\.187)(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2}|210\.203\.([0-9]|[1-9][0-9]|1[01][0-9]|12[0-7])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]))/
# header APOL X-Spam-Relays-Untrusted =~ /ip=(21(0\.20[0-2]|8\.187)(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2}|210\.203\.([0-9]|[1-9][0-9]|1[01][0-9]|12[0-7])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])) rdns=.+(vdsl\.static|dialup\.dynamic)\.apol\.com\.tw .+ident= envfrom= intl=0 .+auth= /

# header APOL X-Spam-Relays-Untrusted =~ /ip=((210\.20[0-2]|218\.187)(\.[0-9]{1,3}){2,2}|210\.203\.([0-9]|[1-9][0-9]|1[01][0-9]|12[0-7])\.[0-9]{1,3}) rdns=.+(vdsl\.static|dialup\.dynamic)\.apol\.com\.tw .+ident= envfrom= intl=0 .+auth= /
# header APOL X-Spam-Relays-Untrusted =~ /(ip=((210\.20[0-2]|218\.187)(\.[0-9]{1,3}){2,2}|210\.203\.([0-9]|[1-9][0-9]|1[01][0-9]|12[0-7])\.[0-9]{1,3})|rdns=.+(vdsl\.static|dialup\.dynamic)\.apol\.com\.tw) .+ident= envfrom= intl=0 .+auth= /
# 222.156.0.0 - 222.157.255.255
# 219.91.0.0 - 219.91.127.255
# header APOL X-Spam-Relays-Untrusted =~ /^\[ (ip=((124\.218|210\.20[0-2]|218\.(3[45]|187)|222\.15[67])(\.\d{1,3}){2}|(210\.203|219\.91)\.(\d|[1-9]\d|1[01]\d|12[0-7])\.\d{1,3})|rdns=.+(vdsl\.static|(cm|dialup)\.dynamic)\.apol\.com\.tw) /
header APOL X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:60\.244|124\.218|210\.20[0-2]|218\.(?:3[45]|187)|222\.15[67])(?:\.\d{1,3}){2}|(?:124\.219|210\.203|219\.91)\.(?:\d|[1-9]\d|1[01]\d|12[0-7])\.\d{1,3}|\d{2,3}(?:\.\d{1,3}){3} rdns=.+(?:vdsl\.static|(?:cm|dialup)\.dynamic)\.apol\.com\.tw) /
describe APOL [TW]Asia Pacific On-line Services Inc.
score APOL 1.5

# 220.228.0.0 - 220.229.255.255
# 218.210.0.0 - 218.211.255.255

# header NCICNET Received =~ /from .+220\.22[89](\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2}/
# 122.146.0.0 - 122.147.255.255
header NCICNET X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:113\.196|122\.14[67]|218\.21[01]|220\.22[89])(?:\.\d{1,3}){2}|211\.78\.1(?:[678]\d|9[01])\.\d{1,3}) /
describe NCICNET [TW]New Centry InfoComm Tech. Co., Ltd.
score NCICNET 1.5

# 61.56.0.0 - 61.56.15.255
# header NCREE_GSN_NET
# describe NCREE_GSN_NET [TW]

# 61.56.80.0 - 61.56.95.255
# 61.56.64.0 - 61.56.79.255
# header DYXNET
# describe DYXNET [TW]Diyixian.com(TW)Ltd.

# TW: 61.56.0.0 - 61.71.255.255
# header TW_61_56_71 Received =~ /from .+61\.(5[6-9]|6[0-9]|7[01])(\.[0-9]{1,3}){2,2}[\)\] ]/
header TW_61_56_71 X-Spam-Relays-Untrusted =~ /ip=61\.(5[6-9]|6[0-9]|7[01])(\.[0-9]{1,3}){2,2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe TW_61_56_71 [TW]61.56.0.0 - 61.71.255.255
score TW_61_56_71 1.0

# 203.207.0.0 - 203.207.15.255
header ASIAINFRA X-Spam-Relays-Untrusted =~ /ip=203\.207\.([0-9]|1[0-5])\.[0-9]{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe ASIAINFRA [TW]AsiaInfra International Ltd.
score ASIAINFRA 1.0

# 218.160.0.0 - 218.175.255.255
# 220.128.0.0 - 220.143.255.255
# 59.112.0.0 - 59.127.255.255
# 61.228.0.0 - 61.231.255.255
# 60.248.0.0 - 60.251.255.255
# 125.232.0.0 - 125.233.255.255
# 211.20.0.0 - 211.23.255.255
# 125.224.0.0 - 125.231.255.255
# header HINET_TW X-Spam-Relays-Untrusted =~ /ip=(59\.1(1[2-9]|2[0-7])|60\.2(4[89]|5[01])|61\.2(2[89]|3[01])|125\.(22[4-9]|23[0-3])|211\.2[0-3]|218\.1(6\d|7[0-5])|220\.1(2[89]|3\d|4[0-3]))(\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
# 61.220.0.0 - 61.227.255.255
# 61.216.0.0 - 61.219.255.255
# 122.120.0.0 - 122.127.255.255
# 125.224.0.0 - 125.231.255.255
# header HINET_TW X-Spam-Relays-Untrusted =~ /(ip=(59\.1(1[2-9]|2[0-7])|60\.2(4[89]|5[01])|61\.2(1[6-9]|2\d|3[01])|122\.12[0-7]|125\.2(2[4-9]|3[0-3])|211\.75|218\.1(6\d|7[0-5])|220\.1(2[89]|3\d|4[0-3]))(\.\d{1,3}){2}|rdns=\d{2,3}(\-\d{1,3}){3}\.dynamic\.hinet\.net) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
# header HINET_TW X-Spam-Relays-Untrusted =~ /^\[ ip=(?:59\.1(?:1[2-9]|2[0-7])|60\.2(?:4[89]|5[01])|61\.2(?:1[6-9]|2\d|3[01])|114\.(?:3[2-9]|4[0-7])|118\.1(?:6[89]|7[01])|122\.1(?:1[67]|2[0-7])|125\.2(?:2[4-9]|3[0-3])|203\.66|210\.242|211\.(?:20|7[25])|218\.1(?:6\d|7[0-5])|220\.1(?:2[89]|3\d|4[0-3]))(?:\.\d{1,3}){2} /
header HINET_TW X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:59\.1(?:1[2-9]|2[0-7])|60\.2(?:4[89]|5[01])|61\.2(?:1[6-9]|2\d|3[01])|111\.2[45]\d|114\.(?:2[4-7]|3[2-9]|4[0-7])|118\.1(?:6[89]|7[01])|122\.1(?:1[67]|2[0-7])|125\.2(?:2[4-9]|3[0-3])|168\.95|203\.(?:6[69]|75)|210\.242|211\.(?:2[012]|7[25])|218\.1(?:6\d|7[0-5])|220\.1(?:2[89]|3\d|4[0-3]))(?:\.\d{1,3}){2}|(?:202\.39|210\.71)\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}) /
describe HINET_TW [TW]CHTD, Chunghwa Telecom Co.,Ltd.
score HINET_TW 1.5

# 222.250.0.0 - 222.251.127.255
# 210.85.0.0 - 210.85.255.255
# 202.178.128.0 - 202.178.191.255
header ETWEBS_TW X-Spam-Relays-Untrusted =~ /ip=((210\.85|222\.250)(?:\.\d{1,3}){2}|202\.178\.1(2[89]|[3-8]\d|9[01])\.\d{1,3}|222\.251\.(\d|[1-9]\d|1[01]\d|12[0-7])\.\d{1,3}) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe ETWEBS_TW [TW]ETWebs Taiwan Co. Ltd.
score ETWEBS_TW 1.5

# 61.30.0.0 - 61.31.255.255
# 124.8.0.0 - 124.12.255.255
# 219.80.0.0 - 219.81.255.255
# 219.86.0.0 - 219.87.255.255
# header TFN_NET_TW X-Spam-Relays-Untrusted =~ /ip=(61\.3[01]|124\.([89]|1[012])|219\.8[0167])(\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
# TFN MEDIA CO., LTD. UBBNET-NET TFN-TW-NET GCNet  (Reach & Range Inc.)
header TFN_NET_TW X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:61\.3[01]|124\.(?:[89]|1[012])|219\.8[0167])(?:\.\d{1,3}){2}|(?:203\.77\.(?:\d|\d\d|1[01]\d|12[0-7])|211\.79\.(?:\d|[12]\d|3[01]))\.\d{1,3}) /
describe TFN_NET_TW [TW]Taiwan Fixed Network CO.,LTD.
score TFN_NET_TW 1.5

# 202.165.128.0 - 202.165.159.255
header SINGTEL_TW X-Spam-Relays-Untrusted =~ /ip=202\.165\.1(2[89]|[345]\d)\.\d{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe SINGTEL_TW [TW]Singtel Taiwan Limited
score SINGTEL_TW 1.5


# 219.84.0.0 - 219.85.255.255
header SONET_TW X-Spam-Relays-Untrusted =~ /ip=219\.8[45](?:\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe SONET_TW [TW]Sony Network Taiwan Limited
score SONET_TW 1.5

# 123.192.0.0 - 123.195.255.255
# 118.232.0.0 - 118.233.255.255
# header TUNGHO_NET_TW X-Spam-Relays-Untrusted =~ /ip=(118\.23[23]|123\.19[2-5])(\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
header TUNGHO_NET_TW X-Spam-Relays-Untrusted =~ /^\[ ip=(?:118\.23[23]|123\.19[2-5])(\.\d{1,3}){2} /
describe TUNGHO_NET_TW [TW]TUNG HO MULTIMEDIA CO. Ltd.
score TUNGHO_NET_TW 1.5

# 219.68.0.0 - 219.69.255.255
header GIGAMEDIA_TW X-Spam-Relays-Untrusted =~ /ip=219\.6[89](?:\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe GIGAMEDIA_TW [TW]Hoshin Gigamedia Center Inc.
score GIGAMEDIA_TW 1.5

# 202.132.0.0 - 202.132.255.255
# 210.192.0.0 - 210.192.63.255
# 210.192.128.0 - 210.192.255.255
header TTN_TW X-Spam-Relays-Untrusted =~ /ip=(202\.132(?:\.\d{1,3}){2}|210\.192\.(\d|[1-5]\d|6[0-3]|12[89]|1[3-9]\d|2\d\d)\.\d{1,3}) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe TTN_TW [TW]Taiwan Telecommunication Network Services Co.,LTD.
score TTN_TW 1.5

# 123.240.0.0 - 123.241.255.255
header TBCOM_NET_TW X-Spam-Relays-Untrusted =~ /^\[ ip=123\.(?:110|24[01])(?:\.\d{1,3}){2} /
describe TBCOM_NET_TW [TW]TBC
score TBCOM_NET_TW 1.5

# 123.252.0.0 - 123.252.127.255
# 124.155.128.0 - 124.155.159.255
# 122.99.0.0 - 122.99.63.255
header KE_ING_NET_TW X-Spam-Relays-Untrusted =~ /^\[ ip=(?:122\.99\.(\d|[1-5]\d|6[0-3])|123\.252\.(\d|\d\d|1[01]\d|12[0-7])|124\.155\.1(2[89]|[345]\d))\.\d{1,3} /
describe KE_ING_NET_TW [TW]KE-ing Co , Ltd
score KE_ING_NET_TW 1.5


# 211.78.32.0 - 211.78.63.255
header KGT_TW X-Spam-Relays-Untrusted =~ /^\[ ip=211\.78\.(3[2-9]|[45]\d|6[0-3])\.\d{1,3} /
describe KGT_TW [TW]KGEx.com
score KGT_TW 1.5

header TAIWANMOBILE_NET_TW X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:101\.(?:[89]|1[0-5])|115\.8[0-3]|117\.19|180\.20[4-7])(?:\.\d{1,3}){2}|123\.99\.(?:\d|[1-5]\d|6[0-3])\.\d{1,3}) /
describe TAIWANMOBILE_NET_TW [TW]taiwanmobile-net
score TAIWANMOBILE_NET_TW 1.5

header FETNET_TW X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.20|110\.(?:2[4-9]|3[01])|118\.231)(?:\.\d{1,3}){2} /
describe FETNET_TW [TW]Far EasTone Telecommunication Co., Ltd.
score FETNET_TW 1.5

header GMO_TW X-Spam-Relays-Untrusted =~ /^\[ ip=122\.255\.81\.\d{1,3} /
describe GMO_TW [TW]GMO Hosting&Security, Inc Sinhuya-ku. Tokyo, 150-8512 Taiwan
score GMO_TW 1.5

header UNIGATENET_TW X-Spam-Relays-Untrusted =~ /^\[ ip=(?:202\.(?:55|133)\.2(?:2[4-9]|[345]\d)|202\.153\.(?:1[6-9]\d|20[0-7]))\.\d{1,3} /
describe UNIGATENET_TW [TW]Network topology of Unigate Telecom Inc.
score UNIGATENET_TW 1.5

header TWGATE_TW X-Spam-Relays-Untrusted =~ /^\[ ip=(?:175\.111\.(?:19[2-9]|2\d\d)|203\.78\.1(?:7[6-9]|8\d|9[01]))\.\d{1,3} /
describe TWGATE_TW [TW]Taiwan Internet Gateway Chunghwa Telecom - International Business Group (CHTI)
score TWGATE_TW 1.5

header TANET_TW X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:120\.(?:9[6-9]|1[01]\d|12[0-7])|140\.1(?:09|[12]\d|3[0-8])|163\.(?:1[3-9]|2\d|3[012])|192\.192|203\.(?:6[48]|7[12])|210\.(?:60|70))(?:\.\d{1,3}){2}|210\.62\.(?:6[4-9]|[78]\d|9[0-5])\.\d{1,3}|210\.71\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}) /
describe TANET_TW [TW]Ministry of Education Computer Center
score TANET_TW 1.5

header UBBNET_TW X-Spam-Relays-Untrusted =~ /^\[ ip=(?:119\.77\.(?:12[89]|1[3-9]\d|2\d\d)|122\.100\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|122\.254\.(?:\d|[1-5]\d|6[0-3]))\.\d{1,3} /
describe UBBNET_TW [TW]UNION BROADBAND NETWORK
score UBBNET_TW 1.5

header HOSHIN_TW X-Spam-Relays-Untrusted =~ /^\[ ip=(?:58\.11[45]|219\.7[01])(?:\.\d{1,3}){2} /
describe HOSHIN_TW [TW]Hoshin Multimedia Center Inc
score HOSHIN_TW 1.5

header TWNAP_TW X-Spam-Relays-Untrusted =~ /^\[ ip=(?:210\.208(?:\.\d{1,3}){2}|210\.209\.(?:\d|[1-5]\d|6[0-3])\.\d{1,3}) /
describe TWNAP_TW [TW]Taiwan Network Access Point Taipei
score TWNAP_TW 1.5

header NCICNET_TW X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:113\.196|218\.32)\.\d{1,3}|211\.78\.1(?:[678]\d|9[01]))\.\d{1,3} /
describe NCICNET_TW [TW]New Centry InfoComm Tech. Co., Ltd. 12F, No. 468, Rueguang Rd. Taipei Taiwan 114
score NCICNET_TW 1.5

header EMOME_NET_TW X-Spam-Relays-Untrusted =~ /^\[ ip=(?:42\.(?:6[4-9]|7\d)|111\.8[0-3])(?:\.\d{1,3}){2} /
describe EMOME_NET_TW [TW]Mobile Business Group, Chunghwa Telecom Co., Ltd. No.35, Aiguo E. Rd. Taipei, Taiwan 106 EMOME Network
score EMOME_NET_TW 1.5



# CSLOXINFO || CNCGROUPNP || 
# WASU_HZDTV_COM_CN || CMNET


meta ___KOREATAIWANCHINA CNCGROUP || KOREATELECOM || HANAROTELECOM || ELIMNET || DREAMX || SHINBIRO || SEEDNET || SKNETWORKS || BORANET || HANVITINB || APOL || NCICNET || CRTC || CHINATELECOM || CHINANET || UNICOM || SEEHULINE || KDD_HK || NWTNET || HGC_HK || TW_61_56_71 || XDSLSTREAMYX || CN_211_136_167 || ASIAINFRA || CNM_COMM || DXTNET || CPCNET_HK || THRUNET || HKCABLE_HK || CN_202_127 || DEFENSNET || LOXINFO_TH || BTV_BEIJING || SINNET_CN || BAYANTELDSL_AP || ISP_TH || TACHYNET || GLOBAL_CN || DQTNET_CN || BSNLNET_IN || VSNL_IN || EXATTNET_IN || HINET_TW || HTXX_CN || TOPWAY_NET_CN || CERNET_CN || BHARTI_IN || NGNNET_CN || ETWEBS_TW || SINGNET_SG || SKYCABLENET_PH || RELIANCE_IN || IQARANET_IN || CMNET_CN || TFN_NET_TW || GWBN_CN || BEELINK_CN || THAINET_TH || VIETEL_VNNIC_VN || CNNIC_CN || SKYINET_PH || CHINACOMM_CN || SINGTEL_TW || CHEONANVITSSEN_KR || TELKOMNET_ZA || CABLELINE_KR || SIAMIDC_TH || ICNDIGITAL_KR || TBROAD_KR || SILNET_IN || KNCTV_KR || HFCCABLE_AU || KHUNET_KR || WORLDCALL_PK || BGCTVNET_CN || KRNIC_KR || CNNIC_CN || SCSNET_KR || VNPT_VNNIC_VN || IPG_PH || NBIP_CN || CHUNGNAM_KR || YONSEI_NET_KR || SGCABLEVISION_SG || XPEED_KR || CHONNAM_NET_KR || PLDTDSL_PH || INDONET_ID || INFOCOM_PH || DOTNAME_KR || LKTELECOM_LK || WASU_CN || TELKOMNET_ID || BBNET_CN || SIFYNET_IN || CJWXNET_CN || HRXT_CN || GLOBET_PH || COLNET_CN || TM_IDC_MY || DONGDAEMUN_KR || QRIXNET_KR || COMNETTH || PI_PH || KITINET_KR || ASIANET_ID || STPI_IN || CONS_PH || INET_CO_TH || HCMPT_NET_VN || TRIDEL_TECH_PH || STN_CN || SONET_TW || HAIONNET_KR || TUNGHO_NET_TW || GIGAMEDIA_TW || TIG_NZ || KREN_KR || TTN_TW || AIMS_MY || TOT_IP_NET_TH || EXTREME_MY || TBCOM_NET_TW || HATHWAY_NET_IN || PI_IN || INFOVISION_PH || NLSS_CN || FOUNDERBN_CN || BJJSNET_CN || ETPI_PH || AORONG_CN || THBA_CN || DRCSCNET_CN || HCN_KR || RINGLINK_CN || GDJS_CN || YOUTELE_IN || KE_ING_NET_TW || TOPNEWNET_CN || TYNET_CN || TUNET_CN || IOLNET_IN || HUARUI_CN || KGT_TW || WM_CNCGROUP_CN || SGATHER_CN || TAIWANMOBILE_NET_TW || BM_ID || OPTUSINTERNET_AU || YYNET_CN || FETNET_TW || DCL_BD || ORTELCOMM_IN || INDOSAT_ID || CHINANETCENTER_CN || JARDIKNAS_ID || PTCL_PK || CTTNET_CN || BEAMCABLE_IN || HKCIX_HK || ETC_VNNIC_VN || GPRS_IN || HKNET_HK || CTINET_HK || PRIMANET_ID || PACENET_IN || HLJ_CN || GENESIS_HK || SINGTEL_HK || LINKDOTNET_PK || ISATNET_ID || FNCL_HK || GLOBALSPEED_PH || FPT_NET_VN || NEXTWEB_PH || WOTONE_CN || CYBERNET_PK || MULTINETBROADBAND_PK || SUNINFO_MDC_CN || FHGROUP_CN || WM_VAAN_KR || VAAN_KR || INTERISLANDNET_PH || BUDDYB_TH || HCLC_KR || CDKNET_CN || CAT_TH || GDSYS_KR || FASTNET_ID || TATACOMM_IN || NOVA_CN || GMO_TW || P4NETWORKS_IN || BOLU_TELECOM_KR || SDHT_NET_CN || PACNET_HK || JNDINFO_KR || HAOWEIGAOKE_CN || DITIZONE_KR || COMCLARK_PH || MOBILEONE_SG || CNI_ID || CAPITALNETWORK_CN || UNIGATENET_TW || APACSERVER_HK || QALA_SG || TRUENET_TH || PRIMETELECOM_CN || TELSTRAINTERNET_AU || TWGATE_TW || NETVIGATOR_HK || MTNLISP_IN || HKDNET_CN || SEJONGNET_KR || SNW_HK || TANET_TW || SIMCENT_HK || KINXINC_KR || SAMSUNGSDS_KR || RAYNET_KR || DURUAN_KR || HINETWORKS_KR || OK_NET_KR || NTCPKNET_PK || ADI_HK || SCTV_VN || BTTB_BD || RWTS_AU || BITNET_CN || DIGITELONE_PH || KTNET_KR || EHOSTIDC_KR || GYEONG_NET_KR || SMILESERV_KR || UBBNET_TW || PIRADIUS_MY || PETINET_KR || PROENNET_TH || GTPL_IN || IPC_NEWTT_HK || SKYDIO_SG || EQUINIXAP_NET_SG || GEMNET_MN || NEWMEDIAEXPRESS_SG || CDNETWORKS_KR || MAXISNET_MY || AIS_TH || KAIST_KR || ONE_NET_SG || JASNITA_ID || TRUEMOVE_TH || BB_BROADBAND_TH || DTAC_TH || KOINS_KR || KONKUKNET_KR || DIGI_MY || TPNET_SG || HONGKONG_NET_HK || PUTIAN_CN || INFOMOVE_HK || CABLENET_KR || HOSHIN_TW || PIRANHA_KR || WEEK5_CN || LBNI_PH || TTT_TH || DCTECH_PH || LDCC_KR || TELECOMPLUS_MU || CST21_KR || CALLPLUS_NZ || GUANGZHOUHONGXUNWANGDING_CN || FTTH_TH || PANGNET_HK || P1NETWORKS_MY || ABITCOOL_CN || CTM_MO || VIETTEL_CAMBODIA_KH || BESTINFONET_CN || TPG_AU || JARING_MY || MOBILE8_ID || HASINDONET_ID || DAEWOO_KR || NHN_KR || DIGINET_ID || ESONET_KR || JCNIDC_KR || VASAICABLEPVTLTD_IN || DNET_ID || JIGUNET_KR || LINKTOM_CN || WATEEN_PK || BELLTELECOM_PH || CSTNET_CN || WORLDPHONE_IN || CJ_CABLENET_KR || TWNAP_TW || HANINTERNET_KR || DISHNET_IN || CCCNET_CN || SMARTBRO_PH || PACIFICONENET_HK || XUNTONG_CN || NET263_CN || DVOIS_IN || YOURWEBSTREAM_PH || YOKOZUNANET_MN || PDSN_IN || MONGOLNET_MN || ISERVICES_HK || RITELE_CN || WEBVISIONS_SG || KPIN_KR || ICL_NET_IN || HRWIRE2008_PH || CAMSHIN_KH || MCSCOM_MN || VAINAVIINDUSTRIESLTD_IN || SPT_VN || MTT_LK || NET_SYS_HK || SPECTRANET_IN || AES_KR || YAHOO_KR || NETZAP_ID || CITINET_MN || PIONEER_IN || DODO_AU || ANKHNET_IN || OFFRATEL_NC || NETNAM_VN || WLIN_HK || FIPD_XTRA_NZ || EXCELLMEDIA_IN || GINAMHANVITNET_KR || MARBELNETWORKS_PH || THREE_ID || CYBERPLUS_ID || VZPACIFICA_MP || WICAM_KH || MOBINET_MN || RAILTEL_IN || TELSTRACLEAR_NZ || USONYX_NET_SG || TIMETELEKOM_MY || LAOTELECOM_LA || XLNET_ID || ALLIANCEBROADBAND_IN || KREONET_KR || FREENET_MY || TRIPLETNET_TH || REACH2NET_IN || MLS_NC || CNXNET_MY || MOBITEL_LK || WISHNET_IN || SYSCON_IN || SINGTEL_SG || NCICNET_TW || NEOCOM_KH || ULUSNET_MN || AGNISYS_BD || I4HKLIMITED_CN || WITRIBE_PK || XRNET_CN || SANXIN_CN || NEXLINX_PK || CABLE51_PH || BTTELECOM_BT || DAKARA_ID || CELCOMNET_MY || BELLNET_LK || ORCONNET_NZ || CAPTURE_IN || H3GHK_HK || GRAMEENPHONEIT_BD || SPIDIGO_IN || TIKONANET_IN || HUTCHVAS_IN || IINET_AU || DAFFODILNET_BD || RIT_TH || LINTASARTA_ID || CALLPLUS_NZ || ILINKKOREA_KR || DESTINYNOC_PH || SMARTONE_HK || ERNET_IN || BJSKIDC_CN || VODAFONE_AU || M2TELECOMMUNICATIONS_AU || NAPINFO_ID || NTS_ID || SBS_IN || HTXX_CN || HNS_IN || DIGILAND_CN || NETROPY_KR || GERRYSNET_PK || BBTEC_HK || ZSPNET_CN || IP4NET_KR || YTLCOMMS_MY || KIRZ_TH || KDTIDC_KR || DSUNET_KR || TULIP_IN || CMBI_NETDJ_KR || BIZNET_ID || GITN_MY || DIGITALWAYS_CN || SAERONET_KR || NAMDONGNET_KR || RSMANI_NKN_IN || TIMOR_TELECOM_TL || NEUVIZ_ID || ALAPCOM_BD || FOCUSINFOCOM_MV || GIANT_CN || HKT_HK || ETISALATLKNET_LK || CEPATNET_ID || PEMDA_NAD_ID || EMOME_NET_TW || HICHINA_CN || PUNET_CN || SLT_LK || NSTPL_IN || CERGISNETWORKS_ID || WNET_IN || UNITEL_LA || BB_BROADBAND_TH || ERDEMNET_MN || MICT_NET_TH || BLAZENET_IN || DTVSTAR_KH || TIANLIANHUTONG_NET_CN || VIVIDWIRELESS_AU || VPLS_TH || TELEMAX_MN || ICONPLN_ID || AIRTEL_LK || AIRCEL_IN || FIBERLINK_PK || NTCISP_PK || SKYCC_MN || RAILCOM_MN || DIGICOM_MN || HYPERNET_ID || CABLELITE_IN || ALISOFT_CN || INSTA_AF || KEWIKONET_MN || BDCOM_BD || MMS_ID || MUL_MINDING_CN || WIRELESSNET_ID || EDONGNET_CN || HUT_VN 



meta JPSUBJTWKRCN ___KOREATAIWANCHINA && SUBJ_ILLEGAL_CHARS && ISO2022JP_BODY
describe JPSUBJTWKRCN JaPan and SUBJ_illegal_chars and TaiWan KoRea ChiNa
score JPSUBJTWKRCN 2.0

# modified 2009.07.26 by [yoh]
# because, SA's Bayes is not reliable.
# meta DCNTWKRCN ___KOREATAIWANCHINA && ___DCN && (BAYES_99 || BAYES_95)
meta DCNTWKRCN ___KOREATAIWANCHINA && ___DCN
describe DCNTWKRCN Distributed Collaborative Network and TaiWan KoRea ChiNa
# score DCNTWKRCN 6.5
score DCNTWKRCN 3.5

# 218.24.0.0 - 218.25.255.255

# thrown away 2008.07.26 by [yoh]
# header CNCGROUPNP Received =~ /(from .*218\.2[45](\.([0-9]|[1-9][0-9]{1,2}|2[0-4][0-9]|25[0-5])){2})/
# describe CNCGROUPNP [CN]All IPs are "cncln.online.ln.cn"
# score CNCGROUPNP 4.0
# 
# meta CNCNPJP CNCGROUPNP && (ISO2022JP_BODY || SJIS_BODY)
# describe CNCNPJP CNCGROUPNP && (ISO2022JP_BODY || SJIS_BODY)
# score CNCNPJP 10.0

# 
# ToDo: Merge CNCGROUP and CHINATELECOM IP addresses.
# CNCGROUP and CHINATELECOM are same ISP.
# 2006.04.17 by [yoh]
# 
# done.
# 2008.07.26 by [yoh]


#       58.16.0.0-58.23.255.255   (524288)
#       58.32.0.0-58.63.255.255   (2097152)
#      58.208.0.0-58.223.255.255  (1048576)
#      58.240.0.0-58.255.255.255  (1048576)
# 
# 58\.(1[6-9]|2[0-3]|3[2-9]|[45]\d|6[0-3]|2(0[89]|1\d|2[0-3]|[45]\d))
# 
#       59.32.0.0-59.63.255.255   (2097152)
# 
# 59\.(3[2-9]|[45]\d|6[0-3])
# 
#        60.0.0.0-60.31.255.255   (2097152)
#      60.160.0.0-60.191.255.255  (2097152)
#      60.208.0.0-60.223.255.255  (1048576)
# 
# 60\.(\d|[12]\d|3[01]|1([678]\d|9[01])|2(0[89]|1\d|2[0-3]))
# 
#       61.48.0.0-61.55.255.255   (524288)
#      61.128.0.0-61.191.255.255  (4194304)
# 
# 61\.(4[89]|5[0-5]|1(2[89]|[3-8]\d|9[01]))
# 
#       116.1.0.0-116.1.255.255   (65536)
#       116.2.0.0-116.3.255.255   (131072)
#       116.4.0.0-116.7.255.255   (262144)
#       116.8.0.0-116.11.255.255  (262144)
#      116.16.0.0-116.31.255.255  (1048576)
#     116.224.0.0-116.239.255.255 (1048576)
# 
# 116\.([1-9]|1[016-9]|2\d|3[01]|2(2[4-9]|3\d))
# 
# 
#     119.112.0.0-119.119.255.255 (524288)
# 
# 119\.11[2-9]
# 
#       121.8.0.0-121.15.255.255  (524288)
#      121.16.0.0-121.31.255.255  (1048576)
#      121.32.0.0-121.35.255.255  (262144)
# 
# 121\.([89]|[12]\d|3[0-5])
# 
#       122.4.0.0-122.7.255.255   (262144)
#     122.136.0.0-122.143.255.255 (524288)
#     122.156.0.0-122.159.255.255 (262144)
#     122.224.0.0-122.239.255.255 (1048576)
# 
# 122\.([4-7]|1([35][6-9]|4[0-3])|2(2[4-9]|3\d))
# 
#       123.4.0.0-123.7.255.255   (262144)
#       123.8.0.0-123.15.255.255  (524288)
#     123.144.0.0-123.151.255.255 (524288)
#     123.152.0.0-123.155.255.255 (262144)
#     123.156.0.0-123.156.255.255 (65536)
#     123.170.0.0-123.171.255.255 (131072)
#     123.172.0.0-123.175.255.255 (262144)
#     123.177.0.0-123.177.255.255 (65536)
#     123.178.0.0-123.179.255.255 (131072)
#     123.180.0.0-123.183.255.255 (262144)
#     123.184.0.0-123.191.255.255 (524288)
# 
# 123\.([4-9]|1[0-5]|1(4[4-9]|5[0-6]|7[0-5789]|8\d|9[01]))
# 
#      124.64.0.0-124.67.255.255  (262144)
#      124.72.0.0-124.79.255.255  (524288)
#      124.88.0.0-124.95.255.255  (524288)
#     124.114.0.0-124.115.255.255 (131072)
#     124.128.0.0-124.135.255.255 (524288)
#     124.160.0.0-124.161.255.255 (131072)
#     124.164.0.0-124.167.255.255 (262144)
#     124.226.0.0-124.227.255.255 (131072)
#     124.234.0.0-124.235.255.255 (131072)
# 
# 124\.(6[4-7]|7[2-9]|8[89]|9[0-5]|1(1[45]|2[89]|3[0-5]|6[014-7]|)|2(2[67]|3[45]))
# 
#      125.40.0.0-125.47.255.255  (524288)
#      125.64.0.0-125.95.255.255  (2097152)
#     125.104.0.0-125.111.255.255 (524288)
#     125.112.0.0-125.127.255.255 (1048576)
#     125.211.0.0-125.211.255.255 (65536)
# 
# 125\.(4[0-7]|6[4-9]|[78]\d|9[0-5]|1(0[4-9]|1\d|2[0-7])|211)
# 
#     129.128.0.0-129.135.255.255 (524288)
#     129.136.0.0-129.137.255.255 (131072)
#     129.141.0.0-129.141.255.255 (65536)
#     129.142.0.0-129.143.255.255 (131072)
#     129.144.0.0-129.151.255.255 (524288)
#     129.152.0.0-129.153.255.255 (131072)
# 
# 129\.1(2[89]|3[0-7]|4[1-9]|5[0-3])
# 
# 
#      202.96.0.0-202.111.255.255 (1048576)
# 
# 202\.(9[6-9]|10\d|11[01])
# 
#      210.12.0.0-210.13.255.255  (131072)
# 
#    210.14.160.0-210.14.191.255  (8192)
#    210.14.192.0-210.14.255.255  (16384)
#      210.15.0.0-210.15.127.255  (32768)
#    210.15.128.0-210.15.191.255  (16384)
# 
#      210.21.0.0-210.21.255.255  (65536)
#      210.22.0.0-210.22.255.255  (65536)
#      210.51.0.0-210.51.255.255  (65536)
#      210.52.0.0-210.53.255.255  (131072)
# 
#     210.74.96.0-210.74.127.255  (8192)
#    210.74.128.0-210.74.159.255  (8192)
# 
#      210.78.0.0-210.78.31.255   (8192)
# 
#      210.82.0.0-210.83.255.255  (131072)
# 
# 210\.(1[23]|2[12]|5[123]|8[23])
# 
# 210\.14\.(1[6-9]\d|2\d\d)
# 210\.15\.(\d|\d\d|1[0-8]\d|19[01])
# 210\.74\.(9[6-9]|1[0-5]\d)
# 210\.78\.(\d|[12]\d|3[01])
# 
#       218.0.0.0-218.31.255.255  (2097152)
#      218.56.0.0-218.63.255.255  (524288)
#      218.64.0.0-218.95.255.255  (2097152)
#      218.96.0.0-218.97.255.255  (131072)
#     218.104.0.0-218.107.255.255 (262144)
# 
# 218\.(\d|[12]\d|3[01]|5[6-9]|[678]\d|9[0-7]|10[4-7])
# 
# 
#     219.128.0.0-219.159.255.255 (2097152)
#     219.232.0.0-219.233.255.255 (131072)
#     219.234.0.0-219.234.255.255 (65536)
# 
# 219\.(12[89]|1[345]\d|23[234])
# 
#     220.160.0.0-220.191.255.255 (2097152)
#     220.248.0.0-220.251.255.255 (262144)
# 
# 220\.(1[678]\d|19[01]|24[89]|25\d)
# 
#       221.0.0.0-221.15.255.255  (1048576)
#     221.192.0.0-221.223.255.255 (2097152)
#     221.224.0.0-221.239.255.255 (1048576)
# 
# 221\.(\d|1[0-5]|19[2-9]|2[0-3]\d)
# 
#      222.64.0.0-222.95.255.255  (2097152)
#     222.128.0.0-222.159.255.255 (2097152)
#     222.160.0.0-222.163.255.255 (262144)
#     222.168.0.0-222.175.255.255 (524288)
#     222.176.0.0-222.191.255.255 (1048576)
#     222.208.0.0-222.223.255.255 (1048576)
#     222.240.0.0-222.247.255.255 (524288)
# 
# 222\.(6[4-9]|[78]\d|9[0-5]|12[89]|1[34578]\d|16[0-8]|19[01]|20[89]|21\d|22[0-3]|24[0-7])
# 202.75.208.0-202.75.223.255

replace_tag CNCGROUP_IPS (?:(?:1\.(?:5[6-9]|6[0-3]|8[0-7]|19[2-9])|14\.1(?:0[4-9]|1\d|2[0-7]|4[4-9]|5\d)|27\.(?:[89]|[12]\d|3[016-9]|4[0-7]|14[89]|15[01]|18[4-9]|19\d|2[01]\d|22[0-7])|49\.(?:6[4-9]|[78]\d|9[0-5])|58\.(?:1[6-9]|2[0-3]|3[2-9]|[45]\d|6[0-3]|11[6-9]|12[89]|13[0-5]|2(?:0[89]|1\d|2[0-3]|[45]\d))|59\.(?:3[2-9]|[45]\d|6[0-3]|17[2-5])|60\.(?:\d|[12]\d|3[01]|1(?:[678]\d|9[01])|2(?:0[89]|1\d|2[0-3]))|61\.(?:4[89]|5[0-5]|1(?:2[89]|[3-8]\d|9[01]))|110\.(?:1[6-9]|5[23]|8[0-7]|16[67]|18[4-9]|19[01]|22[89]|23[01]|2[45]\d)|111\.(?:7[2-9]|1(?:20|6[0-7]|7[6-9]|[89]\d)|20[0-7]|22[4-8])|112\.(?:6[4-7]|8[0-7]|9[89]|10[0-3]|2(?:2[4-9]|[345]\d))|113\.(?:\d|1[2-8]|2[4-7]|31|5[67]|6[4-9]|[789]\d|10\d|1[12]\d|13[2-9]|14[0-3]|19[45]|20[4-7]|22[4-9]|2[34]\d|25[01])|114\.(?:5[45]|[89]\d|10[0-3]|2(?:1[6-9]|[2-5]\d))|115\.(?:4[689]|5\d|6[0-3]|1(?:0[0-3]|4[89]|5\d|6[0-389]|7[01]|9[678])|2(?:01|15|2[4-9]|3\d))|116\.(?:[1-9]|1[016-9]|2\d|3[01]|5[2-5]|6[0-3]|1(?:1[2-7]|9[2456])|2(?:0[789]|1[01]|2[4-9]|3\d|4[67]|5[23]))|117\.(?:[89]|1[0-5]|2[1-9]|3\d|4[0-5]|6[4-9]|[78]\d|9[0-5]|11[2-9])|118\.(?:7[2-9]|11[2-9]|12[0-6]|14[4-7]|18\d|19[0-5]|21[23]|22[4-7]|239|24[4-9]|25\d)|119\.(?:[4-7]|3[2-9]|4[014589]|5[0-5]|6[02]|8[4-7]|9[6-9]|1(?:0[0-389]|1[2-9]|[23]\d|4[0-7]|7[6-9]|8\d|9[01])|2(?:4[89]|5\d))|120\.(?:\d|1[0-5]|3[2-9]|4[0-3]|6[5689]|7[01]|8[0-7])|121\.(?:[89]|[12]\d|3[0-5]|6[0-3]|20[4-7]|22[4-9]|23\d)|122\.(?:[4-7]|9[67]|1(?:[35][6-9]|4[0-3]|5[6-9]|9[2-5])|2(?:2[4-9]|3\d|4[0-7]))|123\.(?:[4-9]|1[0-5]|5[2-5]|62|9[67]|1(?:1[2-9]|[23]\d|4[4-9]|[56]\d|7[0-5789]|8\d|9[0167])|24[4-9]|25\d)|124\.(?:31|42|6[4-7]|7[2-9]|8[89]|9[0-5]|1(?:1[2-9]|2[89]|3[0-5]|6[0-7]|)|2(?:2[4567]|3[2-9]))|125\.(?:3[2-9]|4[0-7]|6[4-9]|[78]\d|9[0-5]|1(?:0[4-9]|1\d|2[0-7])|211)|129\.1(?:2[89]|3[0-7]|4[1-9]|5[0-3])|175\.(?:4[23]|16\d|17[0-5])|180\.(?:9[6-9]|1[016]\d|12[0-7]|13[06-9]|14[0-3]|15[2-9]|17[0-5]|21[23])|182\.(?:3[2-9]|4[0-7]|8[89]|9[016-9]|10\d|1[123]\d|14[0-3])|183\.(?:\d|[1-6]\d|7[01]|9[2-5]|16[0-7]|18[4-9]|19[01])|202\.(?:9[6-9]|10\d|11[01])|203\.93|210\.(?:1[23]|2[12]|5[123]|8[23])|218\.(?:\d|[12]\d|3[01]|5[6-9]|[678]\d|9[0-7]|10[4-7])|219\.(?:12[89]|1[345]\d|23[234])|220\.(?:1[678]\d|19[01]|24[2389]|25\d)|221\.(?:\d|1[0-5]|19[2-9]|2[0-3]\d)|222\.(?:6[4-9]|[78]\d|9[0-5]|12[89]|13\d|14[0-3]|16[0-8]|19[01]|20[89]|21\d|22[0-3]|24[0-7])|223\.(?:16[67]|19[89]|24[0-7]))(?:\.\d{1,3}){2}|(?:(?:27\.106|116\.254)\.1(?:2[89]|[3-8]\d|9[01])|(?:27\.50|116\.255|119\.59|180\.(?:95|129)|220\.152)\.(?:12[89]|1[3-9]\d|2\d\d)|103\.3\.(?:9[6-9]|1[01]\d|12[0-7])|110\.232\.(?:3[2-9]|[45]\d|6[0-3])|119\.148\.1(?:6\d|7[0-5])|120\.88\.(?:[89]|1[0-5])|(?:27\.115|121\.58)\.(?:\d|\d\d|1[01]\d|12[0-7])|122\.102\.(?:6[4-9]|[78]\d|9[0-5])|124\.14\.(?:19[2-9]|2[01]\d|22[0-3])|202\.75\.2(?:0[89]|1\d|2[0-3])|(?:27\.98|202\.91)\.2(?:2[4-9]|[345]\d)|210\.(?:14\.(?:1[6-9]\d|2\d\d)|15\.(?:\d|\d\d|1[0-8]\d|19[01])|74\.(?:9[6-9]|1[0-5]\d)|76\.1(?:[678]\d|9[01])|78\.(?:\d|[12]\d|3[01]))|211\.102\.1(?:2[89]|[3-8]\d|9[01])|(?:219\.235|220\.231)\.(?:\d|[1-5]\d|6[0-3]))\.\d{1,3})

header CNCGROUP X-Spam-Relays-Untrusted =~ /^\[ ip= /
describe CNCGROUP [CN]Japanese spammer's footstool: CNCGROUP
score CNCGROUP 1.5

meta CNCJP CNCGROUP && (ISO2022JP_BODY || SJIS_BODY)
describe CNCJP CNCGROUP && (ISO2022JP_BODY || SJIS_BODY)
score CNCJP 1.5

# for catching webmail ips.
# 2008.07.26 by [yoh]
header ___GOOMAIL_CNCGROUP X-Original-IP =~ /\[\]/
# added 2011.11.21 by [yoh]
header ___HOTMAIL_CNCGROUP X-Originating-IP =~ /\[\]/
header ___INFOSEEK_WEBMAIL_CNCGROUP X-OriginalIP =~ //

meta WM_CNCGROUP_CN ___GOOMAIL_CNCGROUP || ___INFOSEEK_WEBMAIL_CNCGROUP || ___HOTMAIL_CNCGROUP
describe WM_CNCGROUP_CN [CN]webmail from CNCGROUP
score WM_CNCGROUP_CN 1.5




# 61.232.0.0 - 61.237.255.255
# 222.32.0.0 - 222.63.255.255

header CRTC X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:61\.23[2-7]|122\.(?:6[4-9]|[78]\d|9[0-5])|221\.17[2-5]|222\.(?:3[2-9]|[45]\d|6[0-3]))(?:\.\d{1,3}){2}|58\.83\.1(?:1[2-9]|2[0-7])\.\d{1,3}) /
describe CRTC [CN]CHINA RAILWAY TELECOMMUNICATIONS CENTER
score CRTC 1.5

# 219.147.128.0 - 219.147.255.255
# 222.170.0.0 - 222.172.127.255
# 222.168.0.0 - 222.169.255.255

# 222.76.0.0 - 222.79.255.255
# 219.234.0.0 - 219.234.31.255
# 222.173.0.0 - 222.175.255.255
# 221.224.0.0 - 221.231.255.255

# 218.22.0.0 - 218.23.255.255
# 222.64.0.0 - 222.73.255.255
# 59.32.0.0 - 59.63.255.255
# 60.160.0.0 - 60.161.255.255
# 60.162.0.0 - 60.165.255.255
# 60.166.0.0 - 60.175.255.255
# 60.176.0.0 - 60.191.255.255
# 218.70.0.0 - 218.95.255.255
# 222.64.0.0 - 222.95.255.255
# 222.168.0.0 - 222.191.255.255
# 222.208.0.0 - 222.223.255.255

# 220.160.0.0 - 220.191.255.255

# 61.169.0.0 - 61.175.255.255
# 124.72.0.0 - 124.79.255.255
# 121.32.0.0 - 121.35.255.255
header CHINATELECOM X-Spam-Relays-Untrusted =~ /ip=((61\.18[09]\.(\d|[1-9]\d|1[01]\d|12[0-8])|61\.159\.(?:12[89]|1[3-9]\d|2[0-4]\d|25[0-5])|219\.147\.(?:12[89]|1[3-9]\d|2[0-4]\d|25[0-5])|219\.234\.(\d|[12]\d|3[01])|222\.172\.(\d|[1-9]\d|1[01]\d|12[0-7]))\.\d{1,3}|(58\.(3[2-9]|[45]\d|6[0-3])|59\.(3[2-9]|[45]\d|6[0-3])|60\.(?:1[678]\d|19[01])|61\.(?:14[0-6]|15[457]|16[04-69]|17[0-578]|18[3-8]|19[01])|121\.3[2-5]|124\.(7[2-9]|11[45])|202\.103|218\.([0-6]|1[3-9]|2[023]|[678]\d|9[0-5])|219\.1(2[89]|3[0-7]|4[1-9]|5[0-3])|220\.1([678]\d|9[01])|221\.(22[4-9]|23\d)|222\.(6[4-9]|[78]\d|9[0-5]|17[01345]|16[89]|1[78]\d|19[01]|20[89]|21\d|22[0-3]))(?:\.\d{1,3}){2}) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe CHINATELECOM [CN]China Telecom
score CHINATELECOM 1.5

header HAERBINTELECOM X-Spam-Relays-Untrusted =~ /ip=222\.171\.([0-9]|[1-9][0-9]|1[01][0-9]|12[0-7])\.[0-9]{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe HAERBINTELECOM [CN]HAERBIN TELECOM
score HAERBINTELECOM 1.5


# 218.65.128.0 - 218.65.255.255
# 218.66.0.0 - 218.67.127.255

#-218.1.0.0 - 218.1.255.255
#-218.6.128.0 - 218.6.255.255
#-218.13.0.0 - 218.18.255.255

# 218.19.0.0 - 218.20.255.255
#-218.21.0.0 - 218.21.47.255
#-218.21.48.0 - 218.21.63.255
#-218.21.64.0 - 218.21.127.255
##218.21.0.0 - 218.21.127.255
# (CNCGROUP)
# 218.22.0.0 - 218.23.255.255
#-218.31.0.0 - 218.31.255.255

##218.0.0.0 - 218.31.255.255

#-218.56.0.0 - 218.59.255.255(CNCGROUP)
# 218.64.0.0 - 218.65.127.255
#-218.66.0.0 - 218.67.127.255
# (CNCGROUP)
#-218.70.0.0 - 218.70.255.255
#-218.71.0.0 - 218.71.127.255
#-218.71.128.0 - 218.71.135.255
#-218.71.136.0 - 218.71.143.255
#-218.71.144.0 - 218.71.159.255
#-218.71.160.0 - 218.71.191.255
# 218.71.192.0 - 218.71.255.255
# 218.78.0.0 - 218.83.255.255
# 218.85.0.0 - 218.86.127.255
# 218.95.0.0 - 218.95.127.255
#-218.95.224.0 - 218.95.255.255

##218.56.0.0 - 218.95.255.255

# 219.128.0.0 - 219.137.255.255
#-219.159.64.0 - 219.159.255.255

##219.128.0.0 - 219.159.255.255
# (includes CHINATELECOM, CNCGROUP)

#-220.160.0.0 - 220.162.255.255
# 220.175.0.0 - 220.177.255.255
# 220.189.96.0 - 220.189.111.255
# 220.191.0.0 - 220.191.127.255
#-220.191.252.0 - 220.191.255.255

##220.160.0.0 - 220.191.255.255

# 222.64.220.0 - 222.64.223.255
# 222.65.60.0 - 222.65.63.255

# 222.64.0.0 - 222.73.255.255
# 222.76.0.0 - 222.79.255.255
#-222.92.0.0 - 222.95.255.255

##222.64.0.0 - 222.95.255.255

#-222.128.0.0 - 222.131.255.255(CNCGROUP)
#-222.136.0.0 - 222.143.255.255(CNCGROUP)

##222.128.0.0 - 222.143.255.255

# 58.33.180.0 - 58.33.183.255
#-58.32.0.0 - 58.41.255.255
#-58.60.0.0 - 58.63.255.255

##58.32.0.0 - 58.63.255.255

# 59.32.0.0 - 59.42.255.255
# 59.62.0.0 - 59.63.255.255

##59.32.0.0 - 58.63.255.255

#-60.160.0.0 - 60.161.255.255
#-60.166.0.0 - 60.175.255.255
# 60.177.0.0 - 60.177.255.255
#-60.176.0.0 - 60.191.255.255

##60.160.0.0 - 60.191.255.255

#-61.128.0.0 - 61.128.31.255
# 61.140.0.0 - 61.146.255.255
# 61.172.0.0 - 61.173.255.255
# 61.180.0.0 - 61.180.127.255
# 61.190.0.0 - 61.190.255.255
#-61.191.0.0 - 61.191.255.255

##61.128.0.0 - 61.191.255.255

# 202.96.0.0 - 202.111.255.255

# 125.112.0.0 - 125.127.255.255
# 58.208.0.0 - 58.223.255.255
# 124.234.0.0 - 124.235.255.255
# 122.4.0.0 - 122.7.255.255
header CHINANET X-Spam-Relays-Untrusted =~ /ip=(5[89]\.(3[2-9]|[45]\d|6[0-3])|58\.2(0[89]|1\d|2[0-3])|60\.1([6-8]\d|9[01])|61\.1(2[89]|[3-8]\d|9[01])|122\.[4-7]|124\.23[45]|125\.(6[4-9]|[78]\d|9[0-5]|10[4-9]|11\d|12[0-7])|202\.(9[6-9]|10\d|11[01])|218\.(\d|[12]\d|3[01]|5[6-9]|[678]\d|9[0-7])|219\.1(2[89]|[345]\d)|220\.1([678]\d|9[01])|221\.(\d|1[0-5]|19[2-9]|2[0-3]\d)|222\.(6[4-9]|[78]\d|9[0-5]|1(2[89]|3\d|4[0-3]|6[0-3])|24[0-7]))(?:\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe CHINANET [CN]Chinanet - large provider in China
score CHINANET 1.0

# 211.90.0.0 - 211.97.255.255
# 220.192.0.0 - 220.207.255.255
# (\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2}
# (\.[0-9]{1,3}){2,2}
# 61.240.0.0 - 61.243.255.255
# header UNICOM Received =~ /from .+(211\.9[0-7]|220\.(19[2-9]|20[0-7]))(\.[0-9]{1,3}){2,2}[\)\] ]/
# header UNICOM X-Spam-Relays-Untrusted =~ /ip=(61\.24[0-3]|119\.16[4-7]|211\.9[0-7]|220\.(19[2-9]|20[0-7]))(\.[0-9]{1,3}){2,2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
header UNICOM X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.24[0-3]|112\.(?:8[3-9]|9[0-5])|119\.16[2-7]|120\.(?:\d|1[0-5])|123\.23[2-5]|211\.9[0-7]|220\.(?:19[2-9]|20[0-7]))(?:\.\d{1,3}){2} /
describe UNICOM [CN]China United Telecommunications Corporation
score UNICOM 1.0

# 59.191.0.0 - 59.191.127.255

# header SEEHULINE Received =~ /from .+59\.191\.([0-9]|[1-9][0-9]|1([01][0-9]|2[0-7]))\.[0-9]{1,3}[\)\] ]/
header SEEHULINE X-Spam-Relays-Untrusted =~ /ip=59\.191\.([0-9]|[1-9][0-9]|1([01][0-9]|2[0-7]))\.[0-9]{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe SEEHULINE [CN]SeeHuline-New dream
score SEEHULINE 1.5

# 211.136.0.0 - 211.167.255.255
header CN_211_136_167 X-Spam-Relays-Untrusted =~ /ip=211\.1(3[6-9]|[45][0-9]|6[0-7])(\.[0-9]{1,3}){2,2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe CN_211_136_167 [CN]211.136.0.0 - 211.167.255.255
score CN_211_136_167 1.0

# 211.155.245.0 - 211.155.245.255
header BTV_BEIJING X-Spam-Relays-Untrusted =~ /ip=211\.155\.245\.\d{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe BTV_BEIJING [CN]BEIJING DIAN-SHI-TAI CO.LTD
score BTV_BEIJING 1.5


# 219.238.0.0 - 219.239.255.255
# 60.194.0.0 - 60.195.255.255
# 218.247.0.0 - 218.247.31.255
# 218.249.0.0 - 218.249.255.255
# 124.200.0.0 - 124.207.255.255
# header DXTNET X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:60\.(?:19[45]|207)|124\.(?:19[23]|20[0-7])|218\.249|219\.23[89])(?:\.\d{1,3}){2,2}|218\.247\.(?:\d|[12]\d|3[01])\.\d{1,3}) /
header DXTNET X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:60\.(?:19[45]|207)|124\.(?:19[23]|20[0-7])|218\.249|219\.23[89])(?:\.\d{1,3}){2}|(?:211\.100\.2(?:2[4-9]|[345]\d)|218\.247\.(?:\d|[12]\d|3[01]))\.\d{1,3}) /
describe DXTNET [CN]Beijing Teletron Telecom Engineering Co., Ltd.
score DXTNET 1.5

# 202.127.0.0 - 202.127.255.255
header CN_202_127 X-Spam-Relays-Untrusted =~ /ip=202\.127(\.[0-9]{1,3}){2,2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe CN_202_127 [CN]202.127.0.0 - 202.127.255.255
score CN_202_127 1.0


# 124.42.0.0 - 124.42.127.255
header SINNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=124\.42\.(?:\d|\d\d|1([01]\d|12[0-7]))\.\d{1,3} /
describe SINNET_CN [CN]Beijing Guanghuan Xinwang Digital Technology co.Ltd
score SINNET_CN 1.5

# 203.156.192.0 - 203.156.255.255
header GLOBAL_CN X-Spam-Relays-Untrusted =~ /^\[ ip=203\.156\.(?:19[2-9]|2\d\d)\.\d{1,3} /
describe GLOBAL_CN [CN]ShangHai Global Network Co.Ltd
score GLOBAL_CN 1.5

# 203.90.128.0 - 203.90.223.255
# 61.47.128.0 - 61.47.191.255
# 125.58.128.0 - 125.58.255.255
# 219.235.64.0 - 219.235.127.255
# header DQTNET_CN X-Spam-Relays-Untrusted =~ /ip=(203\.90\.(12[89]|1[3-9]\d|2[01]\d|22[0-3])\.\d{1,3}|61\.47\.(12[89]|1[3-8]\d|19[01])\.\d{1,3}) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
# header DQTNET_CN X-Spam-Relays-Untrusted =~ /ip=(?:61\.47\.(?:12[89]|1[3-8]\d|19[01])|125\.58\.(?:12[89]|1[3-9]\d|2\d\d)|203\.90\.(?:12[89]|1[3-9]\d|2[01]\d|22[0-3])|219\.235\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7]))\.\d{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
header DQTNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.252\.\d{1,3}|61\.47\.(?:12[89]|1[3-8]\d|19[01])|125\.58\.(?:12[89]|1[3-9]\d|2\d\d)|203\.90\.(?:12[89]|1[3-9]\d|2[01]\d|22[0-3])|219\.235\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7]))\.\d{1,3} /
describe DQTNET_CN [CN]Daqing Zhongji Petroleum Communication Construction Co.,Ltd.
score DQTNET_CN 1.5

# 202.8.128.0 - 202.8.159.255
header HTXX_CN X-Spam-Relays-Untrusted =~ /^\[ ip=202\.8\.(?:12[89]|1[345]\d)\.\d{1,3} /
describe HTXX_CN [CN]Huabei Petroleum Huatong
score HTXX_CN 1.5

# 222.248.0.0 - 222.248.255.255
# 219.234.96.0 - 219.234.127.255
# 222.125.0.0 - 222.125.255.255
header TOPWAY_NET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:219\.234\.(?:9[6-9]|1[01]\d|12[0-7])\.\d{1,3}|222\.(?:125|248)(?:\.\d{1,3}){2}) /
describe TOPWAY_NET_CN [CN]Topway-Net
score TOPWAY_NET_CN 1.5


# 58.66.0.0 - 58.67.255.255
# 59.107.0.0 - 59.107.255.255
# 124.172.0.0 - 124.175.255.255
# header NGNNET_CN X-Spam-Relays-Untrusted =~ /ip=(58\.6[67]|59\.107)(\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 /
header NGNNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(58\.6[67]|59\.107|124\.17[2-5])(?:\.\d{1,3}){2}|203\.88\.(?:19[2-9]|2[01]\d|22[0-3])\.\d{1,3}) /
describe NGNNET_CN [CN]World Crossing Telecom(GuangZhou) Ltd.
score NGNNET_CN 1.5

# 218.108.0.0 - 218.109.255.255
# 
# see http://www.hzdtv.com/
# 2006.04.23 by [yoh]
# 
# 219.82.0.0 - 219.82.255.255
# header WASU_HZDTV_COM_CN X-Spam-Relays-Untrusted =~ /ip=(218\.10[89]|219\.82)(?:\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 /
# describe WASU_HZDTV_COM_CN [CN]WASU TV & Communication Holding Co.,Ltd.
# score WASU_HZDTV_COM_CN 2.0

# 202.112.0.0 - 202.121.255.255
# 202.192.0.0 - 202.207.255.255
# 219.216.0.0 - 219.231.255.255
# 222.16.0.0 - 222.31.255.255
# 222.206.0.0 - 222.207.255.255
# 58.200.0.0 - 58.207.255.255
# 210.25.0.0 - 210.47.255.255
# 58.192.0.0 - 58.207.255.255
# 218.192.0.0 - 218.199.255.255
# 222.192.0.0 - 222.207.255.255
header CERNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:58\.(?:19[2-9]|20[0-7])|59\.7\d|114\.213|118\.2(?:2[89]|30)|125\.219|202\.(?:11[2-9]|12[01]|19[2-9]|20[0-7])|210\.(?:2[5-9]|3\d|4[0-7])|211\.8[0-7]|218\.19[2-9]|219\.2(?:1[6-9]|2\d|3[01]|4[2-7])|222\.(?:1[6-9]|2\d|3[01]|19[2-9]|20[0-7]))(?:\.\d{1,3}){2} /
describe CERNET_CN [CN]China Education and Research Network
score CERNET_CN 1.5


# 218.200.0.0 - 218.207.255.255
# 221.176.0.0 - 221.183.255.255
# 221.130.0.0 - 221.131.255.255
# header CMNET_CN X-Spam-Relays-Untrusted =~ /ip=(218\.20[0-7]|221\.1(3[01]|7[6-9]|8[0-3]))(\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 /
header CMNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:11[12]\.(?:\d|[1-5]\d|6[0-3])|117\.1(?:2[89]|[3-8]\d|9[01])|120\.(?:19[2-9]|2[01]\d|22[0-3])|121\.37|218\.20[0-7]|221\.1(?:3[01]|7[6-9]|8[0-3]))(?:\.\d{1,3}){2}|203\.86\.(?:\d|[12]\d|3[01])\.\d{1,3}|220\.231\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}) /
describe CMNET_CN [CN]China Mobile Communications Corporation
score CMNET_CN 1.5

# 220.112.0.0 - 220.115.255.255
header GWBN_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:115\.17[2-5]|175\.1(?:8[89]|9[01])|220\.11[2-5])(?:\.\d{1,3}){2} /
describe GWBN_CN [CN]FOR GREAT WALL BROADBAND NETWORK SERVICE ACCESS
score GWBN_CN 1.5

# 59.80.0.0 - 59.83.255.255
header BEELINK_CN X-Spam-Relays-Untrusted =~ /^\[ ip=59\.8[0-3](?:\.\d{1,3}){2} /
describe BEELINK_CN [CN]Beelink Information Science & Technology Co.,Ltd.
score BEELINK_CN 1.5

# 218.96.0.0 - 218.99.255.255
header CNNIC_CN X-Spam-Relays-Untrusted =~ /^\[ ip=218\.9[6-9](?:\.\d{1,3}){2} /
describe CNNIC_CN [CN]China Network Information Center
score CNNIC_CN 1.5

# 221.122.0.0 - 221.123.255.255
# 124.68.0.0 - 124.71.255.255
header CHINACOMM_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:124\.(?:6[89]|7[01])|221\.12[23])(?:\.\d{1,3}){2} /
describe CHINACOMM_CN [CN]CETC-CHINACOMM COMMUNICATIONS Co.,Ltd.
score CHINACOMM_CN 1.5

# 219.236.0.0 - 219.237.255.255
header BGCTVNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:116\.21[6-9]|219\.23[67])(?:\.\d{1,3}){2} /
describe BGCTVNET_CN [CN]BEIJING GEHUA CATV NETWORK CO., LTD.
score BGCTVNET_CN 1.5

# 218.240.0.0 - 218.245.255.255
# 218.246.0.0 - 218.247.255.255
header CNNIC_CN X-Spam-Relays-Untrusted =~ /^\[ ip=218\.24[0-7](?:\.\d{1,3}){2} /
describe CNNIC_CN [CN]China Network Information Center
score CNNIC_CN 1.5

# 221.136.0.0 - 221.136.255.255
header NBIP_CN X-Spam-Relays-Untrusted =~ /^\[ ip=221\.136(?:\.\d{1,3}){2} /
describe NBIP_CN [CN]NBIP CNC(Ningbo)info-Port co.,Ltd
score NBIP_CN 1.5

# 58.100.0.0 - 58.101.255.255
# header WASU_CN X-Spam-Relays-Untrusted =~ /^\[ ip=58\.10[01](?:\.\d{1,3}){2} /
header WASU_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:58\.10[01]|218\.10[89]|219\.82)(?:\.\d{1,3}){2} /
describe WASU_CN [CN]WASU TV & Communication Holding Co.,Ltd.
score WASU_CN 1.5

# 121.68.0.0 - 121.71.255.255      
header BBNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=121\.(6[89]|7[01])(?:\.\d{1,3}){2} /
describe BBNET_CN [CN]BeiJing Kuandaitong Telecom Technology Co.,Ltd
score BBNET_CN 1.5

# 124.20.0.0 - 124.20.255.255
header CJWXNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=124\.2[01](?:\.\d{1,3}){2} /
describe CJWXNET_CN [CN]Ningbo CJWX Communication Technology Ltd
score CJWXNET_CN 1.5

# 124.248.0.0 - 124.248.127.255
header HRXT_CN X-Spam-Relays-Untrusted =~ /^\[ ip=124\.248\.(?:\d|[1-9]\d|1[01]\d|12[0-7]).\d{1,3} /
describe HRXT_CN [CN]Beijing HongRuiXunTong science & technology
score HRXT_CN 1.5

# 220.234.0.0 - 220.234.255.255
# 60.63.0.0 - 60.63.255.255
# 58.24.0.0 - 58.25.255.255
header COLNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:58\.2[45]|60\.63|220\.234)(?:\.\d{1,3}){2} /
describe COLNET_CN [CN]Oriental Cable Network Co., Ltd.
score COLNET_CN 1.5

# 122.0.128.0 - 122.0.255.255
# header STN_CN X-Spam-Relays-Untrusted =~ /ip=122\.0\.(12[89]|1[3-9]\d|2\d\d)\.\d{1,3} [^\[\]]+ident= envfrom= intl=0 /
header STN_CN X-Spam-Relays-Untrusted =~ /^\[ ip=122\.0\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3} /
describe STN_CN [CN]Science & Technology Network Communication Co., Ltd.
score STN_CN 1.5

# 116.90.184.0 - 116.90.191.255
# header NLSS_CN X-Spam-Relays-Untrusted =~ /^\[ ip=116\.90\.1(8[4-9]|9[01])\.\d{1,3} rdns=[^ \[\]]* helo=[^ \[\]]+ by=[^ \[\]]+ ident= envfrom= intl=0 id=[^\[\] ]* auth= \]/
header NLSS_CN X-Spam-Relays-Untrusted =~ /^\[ ip=116\.90\.1(?:8[4-9]|9[01])\.\d{1,3} /
describe NLSS_CN [CN]Beijing North Latitude Starlit Sky Network Co.,Ltd
score NLSS_CN 1.5

# 59.108.0.0 - 59.109.255.255
# header FOUNDERBN_CN X-Spam-Relays-Untrusted =~ /^\[ ip=59\.10[89](\.\d{1,3}){2} rdns=[^ \[\]]* helo=[^ \[\]]+ by=[^ \[\]]+ ident= envfrom= intl=0 id=[^\[\] ]* auth= \]/
header FOUNDERBN_CN X-Spam-Relays-Untrusted =~ /^\[ ip=59\.10[89](?:\.\d{1,3}){2} /
describe FOUNDERBN_CN [CN]Beijing Founder Broadband Network Technology Co.,Ltd
score FOUNDERBN_CN 1.5

# 122.8.0.0 - 122.9.255.255
# header BJJSNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=122\.[89](\.\d{1,3}){2} rdns=[^ \[\]]* helo=[^ \[\]]+ by=[^ \[\]]+ ident= envfrom= intl=0 id=[^\[\] ]* auth= \]/
header BJJSNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=122\.[89](?:\.\d{1,3}){2} /
describe BJJSNET_CN [CN]Beijing Jiasheng Lianhua technical Co. Ltd
score BJJSNET_CN 1.5

# 59.155.0.0 - 59.155.255.255
header AORONG_CN X-Spam-Relays-Untrusted =~ /^\[ ip=59\.155(?:\.\d{1,3}){2} /
describe AORONG_CN [CN]Shanghai AORONG Info & Tech Service Co.Ltd
score AORONG_CN 1.5

# 124.254.0.0 - 124.254.63.255
header THBA_CN X-Spam-Relays-Untrusted =~ /^\[ ip=124\.254\.(?:\d|[1-5]\d|6[0-3])\.\d{1,3} /
describe THBA_CN [CN]Beijing THBA Technology Co,.Ltd.
score THBA_CN 1.5

# 220.101.192.0 - 220.101.255.255
header DRCSCNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=220\.101\.(?:19[2-9]|2\d\d)\.\d{1,3} /
describe DRCSCNET_CN [CN]Development & Research Center of State Council Net.
score DRCSCNET_CN 1.5

header RINGLINK_CN X-Spam-Relays-Untrusted =~ /^\[ ip=59\.11[01](?:\.\d{1,3}){2} /
describe RINGLINK_CN [CN]RingLink telecom Ltd.
score RINGLINK_CN 1.5

header GDJS_CN X-Spam-Relays-Untrusted =~ /^\[ ip=123\.242\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3} /
describe GDJS_CN [CN]Guangdong Jinsheng Investment Development Co.,Ltd
score GDJS_CN 1.5

header TOPNEWNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=121\.52\.2(?:0[89]|1\d|2[0-3])\.\d{1,3} /
describe TOPNEWNET_CN [CN]Beijing Topnew Info&Tech co,.LTD.
score TOPNEWNET_CN 1.5

header TYNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=119\.19(?:\.\d{1,3}){2} /
describe TYNET_CN [CN]Tianying Information and Technology Co. Ltd.
score TYNET_CN 1.5

header TUNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=166\.111(?:\.\d{1,3}){2} /
describe TUNET_CN [CN]Tsinghua University
score TUNET_CN 1.5

header HUARUI_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:118\.102\.(?:1[6-9]|2\d|3[01])|119\.25[45]\.\d{1,3})\.\d{1,3} /
describe HUARUI_CN [CN]Langfang Development Area Huarui Xintong Network Technology Co., Ltd.
score HUARUI_CN 1.5

header SGATHER_CN X-Spam-Relays-Untrusted =~ /^\[ ip=122\.200\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])\.\d{1,3} /
describe SGATHER_CN [CN]Beijing HeJu ShuZi Telecom Engineering Co.Ltd.
score SGATHER_CN 1.5

header YYNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=116\.24[45](?:\.\d{1,3}){2} /
describe YYNET_CN [CN]Beijing Yiliyou Date Co.,Ltd
score YYNET_CN 1.5

header CHINANETCENTER_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:123\.103\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}|203\.130\.(?:3[2-9]|[45]\d|6[0-3])\.\d{1,3}) /
describe CHINANETCENTER_CN [CN]ChinaNetCenter Ltd.
score CHINANETCENTER_CN 1.5

header CTTNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:110\.(?:19[2-9]|2[01]\d|22[0-3])|12[23]\.(?:6[4-9]|[78]\d|9[0-5]))(?:\.\d{1,3}){2} /
describe CTTNET_CN [CN]China TieTong Telecommunications Corporation
score CTTNET_CN 1.5

header HLJ_CN X-Spam-Relays-Untrusted =~ /^\[ ip=210\.76\.(?:3[2-9]|[45]\d|6[0-3])\.\d{1,3} /
describe HLJ_CN [CN]Heilongjiang Province
score HLJ_CN 1.5

header WOTONE_CN X-Spam-Relays-Untrusted =~ /^\[ ip=116\.20[45](?:\.\d{1,3}){2} /
describe WOTONE_CN [CN]Wotone Network Ltd.
score WOTONE_CN 1.5

header SUNINFO_MDC_CN X-Spam-Relays-Untrusted =~ /^\[ ip=121\.101\.2(?:0[89]|1\d|2[0-3])\.\d{1,3} /
describe SUNINFO_MDC_CN [CN]Beijing Sun Rise Technology CO.LTD
score SUNINFO_MDC_CN 1.5

header FHGROUP_CN X-Spam-Relays-Untrusted =~ /^\[ ip=124\.40\.1(?:1[2-9]|2[0-7])\.\d{1,3} /
describe FHGROUP_CN [CN]BeiJing FeiHuaLingHang Technology Development Co.,Ltd
score FHGROUP_CN 1.5

header CDKNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=60\.247(?:\.\d{1,3}){2} /
describe CDKNET_CN [CN]China Digital Kingdom Technology Co.,Ltd.
score CDKNET_CN 1.5

# It seems to be very doubtful. 2011.11.12 by [yoh]
header NOVA_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:210\.75\.(?:[5-9]|1\d|2[012])|219\.235\.2(?:2[4-9]|[345]\d))\.\d{1,3} /
describe NOVA_CN [CN]Shenzhen Nova Technology Development Co., Ltd.
score NOVA_CN 1.5

header SDHT_NET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=180\.18[67](?:\.\d{1,3}){2} /
describe SDHT_NET_CN [CN]Beijing Telvison Telecom Engineering Corporation Limited
score SDHT_NET_CN 1.5

header HAOWEIGAOKE_CN X-Spam-Relays-Untrusted =~ /^\[ ip=114\.114(?:\.\d{1,3}){2} /
describe HAOWEIGAOKE_CN [CN]FHAOWEIGAOKE TECHOLOGIES CO.,LTD
score HAOWEIGAOKE_CN 1.5

header CAPITALNETWORK_CN X-Spam-Relays-Untrusted =~ /^\[ ip=211\.102(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3} /
describe CAPITALNETWORK_CN [CN]Capital network, LTD
score CAPITALNETWORK_CN 1.5

# (?:1[3-9]\d|20[0-8])
header PRIMETELECOM_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:58\.3[01]|203\.20[0-8])(?:\.\d{1,3}){2}|125\.208\.(?:\d|[12]\d|3[01])\.\d{1,3}) /
describe PRIMETELECOM_CN [CN]Beijing Primezone Technologies Inc.
score PRIMETELECOM_CN 1.5

header HKDNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:183\.182\.(?:\d|[12]\d|3[01])|202\.131\.(?:4[89]|5\d|6[0-3]))\.\d{1,3} /
describe HKDNET_CN [CN]HongKong Dragon-NET InternaTional Co., Ltd.
score HKDNET_CN 1.5

header BITNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:115\.18[123](?:\.\d{1,3}){2}|211\.103\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}) /
describe BITNET_CN [CN]Beijing Bitone United Networks Technology Service Co.,Ltd
score BITNET_CN 1.5

# ZHENGZHOUZITIAN NETWORKS TECHNOLOGY CO.,LTD
# SUNINFO-MDC
header PUTIAN_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:114\.11[2-5]|119\.57)(?:\.\d{1,3}){2}|122\.102\.(?:\d|1[0-5])\.\d{1,3}) /
describe PUTIAN_CN [CN]22D, No.1 building, International Pioneering Park No2. Xinxi Road, Shangdi, Haidian district, Beijingg
score PUTIAN_CN 1.5

header WEEK5_CN X-Spam-Relays-Untrusted =~ /^\[ ip=111\.67\.(?:19[2-9]|20[0-7])\.\d{1,3} /
describe WEEK5_CN [CN]Beijing Lingse Feidian Network Science&Technology Co Ltd No. 2 Unit 3 Tiantongyuan East, Beijing ,China
score WEEK5_CN 1.5

header GUANGZHOUHONGXUNWANGDING_CN X-Spam-Relays-Untrusted =~ /^\[ ip=211\.102\.(?:8\d|9[0-5])\.\d{1,3} /
describe GUANGZHOUHONGXUNWANGDING_CN [CN]2308 Yinlaige, #22 Jinsui Road, Guangzhou Guangdong Provice P.R.China
score GUANGZHOUHONGXUNWANGDING_CN 1.5

header ABITCOOL_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:59\.151\.(?:\d|\d\d|1[01]\d|12[0-7])|120\.132\.(?:12[89]|1[3-9]\d|2\d\d))\.\d{1,3} /
describe ABITCOOL_CN [CN]Abitcool(China) Inc. Beijing, China
score ABITCOOL_CN 1.5

header BESTINFONET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=210\.76\.(?:9[6-9]|10\d|11[0-5])\.\d{1,3} /
describe BESTINFONET_CN [CN]Beijing Software Industry Productivity Center F12, Baiyan Building, NO.238, Beisihuanzhong Road, Haidian District, Beijing, P.R. China
score BESTINFONET_CN 1.5

header LINKTOM_CN X-Spam-Relays-Untrusted =~ /^\[ ip=61\.4\.8[0-3]\.\d{1,3} /
describe LINKTOM_CN [CN]Beijing Linktom Network Technology Co.,Ltd. No.132,Zhichun Road,Haidian District,Beijing,China
score LINKTOM_CN 1.5

header CSTNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:116\.213\.(?:6[4-9]|[789]\d|[12]\d\d)|(?:124\.1[67]|159\.226)\.\d{1,3})\.\d{1,3} /
describe CSTNET_CN [CN]China Science & Technology Network No.4,4th South Street, Zhong Guan Cun, Haidian District, P.O.Box 349,Beijing 100080
score CSTNET_CN 1.5

header CCCNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=202\.165\.1(?:7[6-9]|8\d|9[01])\.\d{1,3} /
describe CCCNET_CN [CN]China Communication Co., Ltd Tower F.12# Yumin Road, Chaoyang District, descr: P.R.China
score CCCNET_CN 1.5

header XUNTONG_CN X-Spam-Relays-Untrusted =~ /^\[ ip=120\.72\.(?:3[2-9]|[45]\d|6[0-3])\.\d{1,3} /
describe XUNTONG_CN [CN]Beijing zhonglian xuntong co.,ltd No.1 xichengqu sanlihe Beijing
score XUNTONG_CN 1.5

header NET263_CN X-Spam-Relays-Untrusted =~ /^\[ ip=211\.99\.2(?:2[4-9]|[345]\d)\.\d{1,3} /
describe NET263_CN [CN]NET263 Group in China. 16th  floor,JianDa Buliding ,14 East Tucheng Road,Heping Li Chaoyang Distric,Beijing , P.R.CHINA
score NET263_CN 1.5

header RITELE_CN X-Spam-Relays-Untrusted =~ /^\[ ip=124\.12[67](?:\.\d{1,3}){2} /
describe RITELE_CN [CN]Research Institution of Telecom No.1 Gaojiayuan,Xicheng District,Beijing,China
score RITELE_CN 1.5

header I4HKLIMITED_CN X-Spam-Relays-Untrusted =~ /^\[ ip=223\.252\.1(?:[678]\d|9[01])\.\d{1,3} /
describe I4HKLIMITED_CN [CN]Rm A19, 2/F, Wofoo Building, 204-210 Texaco Road. Tsuen Wan. NT. HK
score I4HKLIMITED_CN 1.5

header XRNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=115\.47(?:\.\d{1,3}){2} /
describe XRNET_CN [CN]Beijing XiRang Media Cultural Co., Ltd. Build A6-1702,Fenghuahaojing,No.6 Guanganmennei Road Xuanwu, Beijing, China, 100053
score XRNET_CN 1.5

header SANXIN_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:60\.206|123\.62)(?:\.\d{1,3}){2}|110\.232\.(?:3[2-9]|[45]\d|6[0-3])\.\d{1,3}) /
describe SANXIN_CN [CN]Beijing Sanxin Shidai Co. Ltd 1513 Xinjishu building Beijing link west road, Haidian District, Beijing, PRC
score SANXIN_CN 1.5

header BJSKIDC_CN X-Spam-Relays-Untrusted =~ /^\[ ip=119\.161\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3} /
describe BJSKIDC_CN [CN]Beijing Capital Telecom Co.,LTD No.B2-2809 Phoenix Town No.5 ShuguangLi. Chaoyang District. Beijing
score BJSKIDC_CN 1.5

header HTXX_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:122\.0\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|202\.180\.1(?:2[89]|[345]\d))\.\d{1,3} /
describe HTXX_CN [CN]HuaBei Oil Communication CO. Information Center huizhan street, Renqiu city, Hebei
score HTXX_CN 1.5

header WASU_CN X-Spam-Relays-Untrusted =~ /^\[ ip=125\.210(?:\.\d{1,3}){2} /
describe WASU_CN [CN] WASU TV & Communication Holding Co.,Ltd. 6/F, Jian Gong Building, NO.20 Wen San Road, Hangzhou Zhejiang province, P.R.China 310012
score WASU_CN 1.5

header DIGILAND_CN X-Spam-Relays-Untrusted =~ /^\[ ip=113\.11\.(?:19[2-9]|2[01]\d|22[0-3])\.\d{1,3} /
describe DIGILAND_CN [CN]Beijing Digiland media technology Co. Ltd Apt2 No5 Jinyuanzhuang AVE shijingshan district Beijing
score DIGILAND_CN 1.5

header ZSPNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=202\.85\.2(?:0[89]|1\d|2[0-3])\.\d{1,3} /
describe ZSPNET_CN [CN]BEIJING ZHONGGUANCUN SOFTWARE PARK DEVELOPMENT CO.,Ltd. P.O.Box 5118,Zhongguancun Software Park, Haidian District, Beijing P.R.C.
score ZSPNET_CN 1.5

header DIGITALWAYS_CN X-Spam-Relays-Untrusted =~ /^\[ ip=124\.14\.(?:\d|[1-5]\d|6[0-3])\.\d{1,3} /
describe DIGITALWAYS_CN [CN]FOR BEIJING Digitalways  ACCESS IN SHANGHAI
score DIGITALWAYS_CN 1.5

header GIANT_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:116\.255\.(?:12[89]|1[3-9]\d|2\d\d)|203\.171\.2(?:2[4-9]|3\d))\.\d{1,3} /
describe GIANT_CN [CN]ZhengZhou GIANT Computer Network Technology Co., Ltd Room 701 Information Building NO.144 Garden Road, Zhenzhou Henan, P.R.China
score GIANT_CN 1.5

header HICHINA_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:112\.12[4-7]|114\.215|121\.19[6-9]|223\.[4-7])(?:\.\d{1,3}){2} /
describe HICHINA_CN [CN]HiChina Web Solutions (Beijing) Limited No.27 Gulouwai Avenue,Dongcheng District, Beijing 100011,China
score HICHINA_CN 1.5

header PUNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=162\.105(?:\.\d{1,3}){2} /
describe PUNET_CN [CN]imported inetnum object for PEKING
score PUNET_CN 1.5

header TIANLIANHUTONG_NET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=122\.11\.4[0-7]\.\d{1,3} /
describe TIANLIANHUTONG_NET_CN [CN]BEIJING TIANLIANHUTONG TECHNOLOGY DEVELOPMET CO., LTD 2302 ZhongYu Plaza No.Jia-6 GongTiBeiRoad ChaoYang District BeiJing
score TIANLIANHUTONG_NET_CN 1.5

header ALISOFT_CN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:42\.12[01]\.\d{1,3}|110\.75\.1(?:[678]\d|9[01]))\.\d{1,3} /
describe ALISOFT_CN [CN]Aliyun Computing Co., LTD 5F, Builing D, the West Lake International Plaza of S&T No.391 Wen'er Road, Hangzhou, Zhejiang, China, 310099
score ALISOFT_CN 1.5

header MUL_MINDING_CN X-Spam-Relays-Untrusted =~ /^\[ ip=211\.106\.(?:9[6-9]|10[0-3])\.\d{1,3} /
describe MUL_MINDING_CN [CN]Mul-minding Net Technology Com. Ltd. Rm.902,North Real Estate Building, Build. No.3,  #81Yuan , ZiZhuyuan Rd, Haidian Dist., Beijing
score MUL_MINDING_CN 1.5

header EDONGNET_CN X-Spam-Relays-Untrusted =~ /^\[ ip=203\.191\.1(?:4[4-9]|5\d)\.\d{1,3} /
describe EDONGNET_CN [CN]Edong Network
score EDONGNET_CN 1.5


# 60.48.0.0 -  60.54.255.255
# 202.75.32.0 - 202.75.63.255
# 218.208.128.0 - 218.208.255.255
# 219.92.0.0 - 219.93.255.255
# 219.94.0.0 - 219.94.127.255
# 202.71.96.0 - 202.71.111.255
# header XDSLSTREAMYX X-Spam-Relays-Untrusted =~ /ip=(60\.(4[89]|5[0-4])(\.\d{1,3}){2}|(202\.75\.(3[2-9]|[45]\d|6[0-3])|218\.208\.(12[89]|1[3-9]\d|2[0-4]\d|25[0-5]))\.\d{1,3}) .+ident= envfrom= intl=0 /
# 218.111.0.0 - 218.111.255.255
# 219.95.0.0 - 219.95.255.255
# 218.208.0.0 - 218.208.255.255
# 118.100.0.0 - 118.101.255.255
# 124.13.0.0 - 124.13.255.255
header XDSLSTREAMYX X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:60\.(?:4[89]|5[0-4])|118\.10[01]|124\.(?:13|82)|175\.1(?:3[6-9]|4[0-3])|218\.(?:111|208)|219\.9[235])(?:\.\d{1,3}){2}|(?:202\.71\.(?:9[6-9]|10\d|11[01])|202\.75\.(?:3[2-9]|[45]\d|6[0-3])|218\.208\.(?:12[89]|1[3-9]\d|2\d\d)|219\.94\.(?:\d|\d\d|1[01]\d|12[0-7]))\.\d{1,3}) /
describe XDSLSTREAMYX [MY]Telekom Malaysia Berhad
score XDSLSTREAMYX 1.5

# 210.48.144.0 - 210.48.159.255 
# TMNET
header TM_IDC_MY X-Spam-Relays-Untrusted =~ /^\[ ip=(?:58\.26\.\d{1,3}|58\.27\.(?:\d|\d\d|1[01]\d|12[0-7])|119\.110\.(?:9[6-9]|10\d|11[01])|210\.48\.1(?:4[4-9]|5\d))\.\d{1,3} /
describe TM_IDC_MY [MY]TM NET SDN BHD
score TM_IDC_MY 1.5

# 116.0.96.0 - 116.0.127.255
header AIMS_MY X-Spam-Relays-Untrusted =~ /ip=116\.0\.(9[6-9]|1[01]\d|12[0-7])\.\d{1,3} [^\[\]]+ident= envfrom= intl=0 /
describe AIMS_MY [MY]Applied Information Management Services Kuala Lumper Malaysia
score AIMS_MY 1.5

# 203.188.232.0 - 203.188.239.255
header EXTREME_MY X-Spam-Relays-Untrusted =~ /ip=203\.188\.23[2-9]\.\d{1,3} [^\[\]]+ident= envfrom= intl=0 /
describe EXTREME_MY [MY]Extreme Broadband Sdn. Bhd.
score EXTREME_MY 1.5

header PIRADIUS_MY X-Spam-Relays-Untrusted =~ /^\[ ip=(?:111\.90\.1(?:2[89]|[345]\d)|124\.217\.2(?:2[4-9]|[345]\d))\.\d{1,3} /
describe PIRADIUS_MY [MY]PIRADIUS NET Unit 21-3A, Level 21 Plaza DNP 59, Jalan Abdullah Tahir Taman Century Garden 80300 Johor Bahru, Johor Malaysia
score PIRADIUS_MY 1.5

header MAXISNET_MY X-Spam-Relays-Untrusted =~ /^\[ ip=(?:113\.21[01]\.\d{1,3}|121\.123\.1(?:2[89]|3\d|4[0-3])|202\.75\.1(?:2[89]|[345]\d)|202\.151\.(?:19[2-9]|2\d\d))\.\d{1,3} /
describe MAXISNET_MY [MY]Maxis Broadband Sdn Bhd Jalan Delima 1/1 Subang Hi-Tech Industrial Park 40000 Shah Alam, Selangor, Malaysia
score MAXISNET_MY 1.5

header DIGI_MY X-Spam-Relays-Untrusted =~ /^\[ ip=(?:115\.164|116\.197|182\.6[23])(?:\.\d{1,3}){2} /
describe DIGI_MY [MY]DiGi Telecommunications Sdn Bhd
score DIGI_MY 1.5

header P1NETWORKS_MY X-Spam-Relays-Untrusted =~ /^\[ ip=(?:120\.1(?:39|4[01])|180\.7[2-5])(?:\.\d{1,3}){2} /
describe P1NETWORKS_MY [MY]Packet One Networks (M) Sdn Internet Service Provider Kuala Lumpur, Malaysia
score P1NETWORKS_MY 1.5

header JARING_MY X-Spam-Relays-Untrusted =~ /^\[ ip=202\.1(?:8[4-7]|90)(?:\.\d{1,3}){2} /
describe JARING_MY [MY]JARING Communications Sdn Bhd Technology Park Malaysia 57000 Kuala Lumpur
score JARING_MY 1.5

header TIMETELEKOM_MY X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:210\.19|211\.2[45])(?:\.\d{1,3}){2}|203\.121\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])\.\d{1,3}) /
describe TIMETELEKOM_MY [MY]TIME Telecommunications Sdn Bhd Kuala Lumpur
score TIMETELEKOM_MY 1.5

header FREENET_MY X-Spam-Relays-Untrusted =~ /^\[ ip=209\.9\.(?:9[6-9]|10\d|11[01])\.\d{1,3} /
describe FREENET_MY [MY]Free Net Business Solutions Sdn Bhd ISP Network Cyberjaya, Malaysia
score FREENET_MY 1.5

header CNXNET_MY X-Spam-Relays-Untrusted =~ /^\[ ip=(?:202\.46\.1(?:1[2-9]|2[0-7])|203\.142\.(?:3[2-9]|[45]\d|6[0-3]))\.\d{1,3} /
describe CNXNET_MY [MY]Wireless Broadband Service Provider, Malaysia
score CNXNET_MY 1.5

header CELCOMNET_MY X-Spam-Relays-Untrusted =~ /^\[ ip=203\.82\.(?:6[4-9]|[78]\d|9[0-5])\.\d{1,3} /
describe CELCOMNET_MY [MY]Celcom Internet Service Provider
score CELCOMNET_MY 1.5

header YTLCOMMS_MY X-Spam-Relays-Untrusted =~ /^\[ ip=183\.78\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3} /
describe YTLCOMMS_MY [MY]YTL COMMUNICATIONS SDN BHD
score YTLCOMMS_MY 1.5

header GITN_MY X-Spam-Relays-Untrusted =~ /^\[ ip=(?:202\.60\.5[6-9]|203\.127\.17[6-9])\.\d{1,3} /
describe GITN_MY [MY]Gitn-schoolnet-my Internet Service Provider GITN Sdn. Bhd. 31st Floor Menara TM, Jln Pantai Baharu, 50672 Kuala Lumpur
score GITN_MY 1.5



# 203.113.128.0 - 203.113.191.255
# header VIETEL_VNNIC_VN X-Spam-Relays-Untrusted =~ /ip=203\.113\.1(2[89]|[3-8]\d|9[01])\.\d{1,3} [^\[\]]+ident= envfrom= intl=0 /
header VIETEL_VNNIC_VN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:27\.(?:6[4-9]|7\d)|115\.7[2-9]|117\.[0-7]|125\.23[45]|171\.2(?:2[4-9]|[345]\d))(?:\.\d{1,3}){2}|(?:203\.113\.1(?:2[89]|[3-8]\d|9[01])|210\.211\.(?:9[6-9]|1[01]\d|12[0-7]))\.\d{1,3}) /
describe VIETEL_VNNIC_VN [VN]Vietel Corporation - Internet service/exchange provider
score VIETEL_VNNIC_VN 1.5

# 222.252.0.0 -  222.255.255.255
# 203.210.128.0 - 203.210.255.255
# header VNPT_VNNIC_VN X-Spam-Relays-Untrusted =~ /ip=(203\.210\.(12[89]|1[3-9]\d|2[0-4]\d|25[0-5])\.\d{1,3}|222\.25[2-5](\.\d{1,3}){2}) [^\[\]]+ident= envfrom= intl=0 /
header VNPT_VNNIC_VN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:203\.210\.(?:12[89]|1[3-9]\d|2[0-4]\d|25[0-5])\.\d{1,3}|(?:(?:14|113)\.1(?:[678]\d|9[01])|123\.(?:1[6-9]|2\d|3[01])|222\.25[2-5])(?:\.\d{1,3}){2}) /
describe VNPT_VNNIC_VN [VN]Vietnam Posts and Telecommunications Corp (VNPT)
score VNPT_VNNIC_VN 1.5

# 222.253.32.0 - 222.253.175.255
header HCMPT_NET_VN X-Spam-Relays-Untrusted =~ /ip=222\.253\.(3[2-9]|[4-9]\d|1[0-6]\d|17[0-5])\.\d{1,3} [^\[\]]+ident= envfrom= intl=0 /
describe HCMPT_NET_VN [VN]Ho Chi Minh City Post and Telecom Company
score HCMPT_NET_VN 1.5

header ETC_VNNIC_VN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:116\.(?:9[6-9]|10\d|11[01])(?:\.\d{1,3}){2}|125\.214\.(?:\d|[1-5]\d|6[0-3])\.\d{1,3}) /
describe ETC_VNNIC_VN [VN]Electric Telecommunication Company
score ETC_VNNIC_VN 1.5

# header FPT_NET_VN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:58\.18[67]|118\.(?:6[89]|7[01]))(?:\.\d{1,3}){2} /
header FPT_NET_VN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:1\.5[2-5]|42\.11[2-9]|58\.18[67]|113\.22|118\.(?:6[89]|7[01])|183\.80)(?:\.\d{1,3}){2}|(?:(?:113\.23|183\.81)\.(?:\d|\d\d|1[01]\d|12[0-7])|210\.245\.8[0-7])\.\d{1,3}) /
describe FPT_NET_VN [VN]FPT Broadband Service
score FPT_NET_VN 1.5

header SCTV_VN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:27\.[23]|112\.197)(?:\.\d{1,3}){2} /
describe SCTV_VN [VN]SaiGon Tourist Cable Television
score SCTV_VN 1.5

# ADSL-NET
header SPT_VN X-Spam-Relays-Untrusted =~ /^\[ ip=116\.118\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3} /
describe SPT_VN [VN]ADSL service
score SPT_VN 1.5

# 119.15.160.0 - 119.15.184.255
# 210.86.224.0 - 210.86.239.255
# FTTX-NET
header NETNAM_VN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:119\.15\.1(?:[67]\d|8[0-4])|183\.91\.\d|210\.86\.2(?:2[4-9]|3\d))\.\d{1,3} /
describe NETNAM_VN [VN]NetNam Corporation Internet service provider
score NETNAM_VN 1.5

header HUT_VN X-Spam-Relays-Untrusted =~ /^\[ ip=202\.191\.5[6-9]\.\d{1,3} /
describe HUT_VN [VN]Hanoi Universsity of Technology Number 1, Dai Co Viet str, Hai Ba Trung Dist, Ha Noi
score HUT_VN 1.5




# 202.159.0.0 - 202.159.127.255
header INDONET_ID X-Spam-Relays-Untrusted =~ /ip=202\.159\.(\d|[1-9]\d|1[01]\d|12[0-7])\.\d{1,3} [^\[\]]+ident= envfrom= intl=0 /
describe INDONET_ID [ID]PT. IndoInternet
score INDONET_ID 1.5

# 222.124.0.0 - 222.124.255.255
# 203.130.192.0 - 203.130.255.255
# 202.3.208.0 - 202.3.223.255
# header TELKOMNET_ID X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:114\.12[0-7]|118\.9[67]|125\.16[0-7]|182\.(?:\d|1[0-5])|222\.124)(?:\.\d{1,3}){2}|110\.138\.(?:\d|[012]\d|3[01])\.\d{1,3}|125\.163\.1(?:2[89]|[3-8]\d|9[01])\.\d{1,3}|202\.3\.2(?:0[89]|1\d|2[0-3])\.\d{1,3}|203\.130\.(?:19[2-9]|2\d\d)\.\d{1,3}) /
# header TELKOMNET_ID X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:61\.94|110\.13[6-9]|114\.12[0-7]|118\.9[67]|125\.16[0-7]|180\.2(?:4\d|5[0-4])|182\.(?:\d|1[0-5])|222\.124)(?:\.\d{1,3}){2}|110\.136\.1(?:1[2-9]|[23]\d|4[0-3])\.\d{1,3}|110\.138\.(?:\d|[012]\d|3[01])\.\d{1,3}|110\.139\.(?:4[89]|[5-8]\d|9[0-5])\.\d{1,3}|118\.98\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}|125\.163\.1(?:2[89]|[3-8]\d|9[01])\.\d{1,3}|202\.3\.2(?:0[89]|1\d|2[0-3])\.\d{1,3}|203\.130\.(?:19[2-9]|2\d\d)\.\d{1,3}) /
header TELKOMNET_ID X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:39\.(?:19[2-9]|2\d\d)|61\.94|110\.13[6-9]|114\.12[0-7]|118\.9[67]|125\.16[0-7]|180\.2(?:4\d|5[0-4])|182\.(?:\d|1[0-5])|222\.124)(?:\.\d{1,3}){2}|(?:110\.136\.1(?:1[2-9]|[23]\d|4[0-3])|110\.138\.(?:\d|[012]\d|3[01])|110\.139\.(?:4[89]|[5-8]\d|9[0-5])|(?:61\.5|118\.98)\.(?:\d|\d\d|1[01]\d|12[0-7])|125\.163\.1(?:2[89]|[3-8]\d|9[01])|202\.3\.2(?:0[89]|1\d|2[0-3])|203\.130\.(?:19[2-9]|2\d\d))\.\d{1,3}) /
describe TELKOMNET_ID [ID]PT. TELEKOMUNIKASI INDONESIA
score TELKOMNET_ID 1.5

# 202.150.224.0 - 202.150.255.255
header ASIANET_ID X-Spam-Relays-Untrusted =~ /ip=202\.150\.2(2[4-9]|[345]\d)\.\d{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe ASIANET_ID [ID]PT.Medialintas Antar Buana
score ASIANET_ID 1.5

header BM_ID X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.247\.(?:[\d|[1-5]\d|6[0-3])\.\d{1,3}|(?:118\.13[67]|139\.(?:19[2-5]|255))(?:\.\d{1,3}){2}) /
describe BM_ID [ID]PT. Broadband Multimedia, Tbk
score BM_ID 1.5

# 219.83.0.0 - 219.83.127.255
# 114.56.0.0 - 114.59.255.255
header INDOSAT_ID X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:114\.5[6-9]|120\.1(?:[678]\d|9[01])|124\.81|182\.30)(?:\.\d{1,3}){2}|202\.93\.(?:3[2-9]|4[0-7])\.\d{1,3}|202\.152\.1(?:6\d|7[0-5])\.\d{1,3}|202\.155\.(?:9[6-9]|1[01]\d|12[0-7])\.\d{1,3}|(?:124\.195|219\.83)\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}) /
describe INDOSAT_ID [ID]Indosat Internet Service Provider
score INDOSAT_ID 1.5

header JARDIKNAS_ID X-Spam-Relays-Untrusted =~ /^\[ ip=118\.98\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3} /
describe JARDIKNAS_ID [ID]Departemen Pendidikan Nasional Tim Data Center Jardiknas
score JARDIKNAS_ID 1.5

# 202.57.0.0 - 202.57.15.255
header PRIMANET_ID X-Spam-Relays-Untrusted =~ /^\[ ip=202\.57\.(?:\d|1[0-5])\.\d{1,3} /
describe PRIMANET_ID [ID]PRIMANET - ISP
score PRIMANET_ID 1.5

header ISATNET_ID X-Spam-Relays-Untrusted =~ /^\[ ip=58\.65\.24[0-7]\.\d{1,3} /
describe ISATNET_ID [ID]PT Insan Sarana Telematika
score ISATNET_ID 1.5

header FASTNET_ID X-Spam-Relays-Untrusted =~ /^\[ ip=(?:111\.9[45]|118\.13[67])(?:\.\d{1,3}){2} /
describe FASTNET_ID [ID]PT. First Media, Tbk. ISP Jakarta - 12950
score FASTNET_ID 1.5

header CNI_ID X-Spam-Relays-Untrusted =~ /^\[ ip=116\.66\.20[0-7]\.\d{1,3} /
describe CNI_ID [ID]PT Cyber Network Indonesia
score CNI_ID 1.5

header JASNITA_ID X-Spam-Relays-Untrusted =~ /^\[ ip=202\.146\.1(?:2[89]|[345]\d)\.\d{1,3} /
describe JASNITA_ID [ID]PT. Jasnita Telekomindo
score JASNITA_ID 1.5

header MOBILE8_ID X-Spam-Relays-Untrusted =~ /^\[ ip=203\.128\.2(?:4[89]|5[01])\.\d{1,3} /
describe MOBILE8_ID [ID]Jl. Kuningan Barat No 8 Jakarta 12710
score MOBILE8_ID 1.5

header HASINDONET_ID X-Spam-Relays-Untrusted =~ /^\[ ip=116\.0\.[0-7]\.\d{1,3} /
describe HASINDONET_ID [ID]PT Hasindo Net Ruko Mega Sunter B/6 lt.3 Jl. Danau Sunter Selatan Jakarta
score HASINDONET_ID 1.5

header DIGINET_ID X-Spam-Relays-Untrusted =~ /^\[ ip=122\.200\.(?:4[89]|5[0-5])\.\d{1,3} /
describe DIGINET_ID [ID]PT Digital Wireless Indonesia ISP Gedung Cyber 7th Floor Jl. Kuningan Barat No 8, Jakarta 12710
score DIGINET_ID 1.5

header DNET_ID X-Spam-Relays-Untrusted =~ /^\[ ip=202\.148\.(?:\d|[12]\d|3[01])\.\d{1,3} /
describe DNET_ID [ID]Dnet Surabaya Promenade Arcade, Hyatt Regency Hotel Jl. Basuki Rachmat 106-128 Surabaya 60271 - INDONESIA
score DNET_ID 1.5

header NETZAP_ID X-Spam-Relays-Untrusted =~ /^\[ ip=114\.199\.(?:9[6-9]|1[01]\d|12[0-7])\.\d{1,3} /
describe NETZAP_ID [ID]netZAP Wireless Broadband Provider
score NETZAP_ID 1.5

header THREE_ID X-Spam-Relays-Untrusted =~ /^\[ ip=(?:180\.214\.23[2-5]|223\.255\.2(?:2[4-9]|3[01]))\.\d{1,3} /
describe THREE_ID [ID]PT Hutchison CP Telecommunications Corporate / Direct Member IDNIC 10/F Menara Mulia Jl. Jend. Gatot Subroto Kav 9-11 Jakarta Selatan 12930 DKI Jakarta
score THREE_ID 1.5

header CYBERPLUS_ID X-Spam-Relays-Untrusted =~ /^\[ ip=114\.141\.(?:4[89]|5[0-5])\.\d{1,3} /
describe CYBERPLUS_ID [ID]PT Cyberplus Media Pratama Jl. Delta Barat XII Blok C / 137 Delta Pekayon Jaya Bekasi - Jawa Barat
score CYBERPLUS_ID 1.5

header XLNET_ID X-Spam-Relays-Untrusted =~ /^\[ ip=(?:112\.215\.(?:\d|[1-6]\d|7[0-5])|121\.52\.(?:\d|\d\d|1[01]\d|12[0-7])|202\.152\.2(?:2[4-9]|[345]\d))\.\d{1,3} /
describe XLNET_ID [ID]Excelcomindo Pratama, PT. Cellular, GPRS and Internet Service Provider
score XLNET_ID 1.5

header DAKARA_ID X-Spam-Relays-Untrusted =~ /^\[ ip=203\.160\.(?:5[6-9]|6[0-3])\.\d{1,3} /
describe DAKARA_ID [ID]Infrastruktur Dakara Jl. Gatot Subroto Kav. 58 Kuningan Timur Setiabudi Jakarta Selatan, DKI Jakarta
score DAKARA_ID 1.5

header LINTASARTA_ID X-Spam-Relays-Untrusted =~ /^\[ ip=(?:182\.23\.(?:\d|\d\d|1[01]\d|12[0-7])|183\.91\.(?:6[4-9]|[78]\d|9[0-5])|202\.152\.(?:\d|[12]\d|3[01]))\.\d{1,3} /
describe LINTASARTA_ID [ID]PT Aplikanusa Lintasarta MH Thamrin Kav 3 Menara Thamrin Bulding 12th Floor Jakarta 10250
score LINTASARTA_ID 1.5

header NAPINFO_ID X-Spam-Relays-Untrusted =~ /^\[ ip=110\.35\.8[0-7]\.\d{1,3} /
describe NAPINFO_ID [ID]NAP Info Lintas Nusa Jakarta, Indonesia
score NAPINFO_ID 1.5

header NTS_ID X-Spam-Relays-Untrusted =~ /^\[ ip=(?:110\.35\.8[0-7]|203\.78\.1(?:1[2-9]|2[0-7]))\.\d{1,3} /
describe NTS_ID [ID]allocated for ip pool  for mobile data subs
score NTS_ID 1.5

header BIZNET_ID X-Spam-Relays-Untrusted =~ /^\[ ip=(?:117\.102\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|203\.142\.(?:6[4-9]|7\d|8[0-7]))\.\d{1,3} /
describe BIZNET_ID [ID]Biznet ISP Internet Service Provider Jakarta, Indonesia
score BIZNET_ID 1.5

header NEUVIZ_ID X-Spam-Relays-Untrusted =~ /^\[ ip=203\.128\.(?:6[4-9]|[78]\d|9[0-5])\.\d{1,3} /
describe NEUVIZ_ID [ID]Jl. Hayam Wuruk No.1 RST Jakarta Pusat 10120 DKI Jakarta
score NEUVIZ_ID 1.5

header CEPATNET_ID X-Spam-Relays-Untrusted =~ /^\[ ip=202\.43\.1(?:7[6-9]|8\d|9[01])\.\d{1,3} /
describe CEPATNET_ID [ID]CepatNet PT. Mora Telematika Indonesia Gedung Dana Pensiun Telkom lt. 4 Jl. Panataran No. 9 Jakarta 10320
score CEPATNET_ID 1.5

header PEMDA_NAD_ID X-Spam-Relays-Untrusted =~ /^\[ ip=123\.108\.(?:9[6-9]|10[0-3])\.\d{1,3} /
describe PEMDA_NAD_ID [ID]Dinas Perhubungan,komunikasi, informasi dan Telematika -NAD Goverment Jl.Mayjed T.Hamzah Bendahara no.52 Banda Aceh NAD
score PEMDA_NAD_ID 1.5

header CERGISNETWORKS_ID X-Spam-Relays-Untrusted =~ /^\[ ip=122\.129\.(?:9[6-9]|1[01]\d)\.\d{1,3} /
describe CERGISNETWORKS_ID [ID]Cergis Route Object
score CERGISNETWORKS_ID 1.5

header ICONPLN_ID X-Spam-Relays-Untrusted =~ /^\[ ip=(?:103\.3\.7[6-9]|119\.252\.1(?:6\d|7[0-5]))\.\d{1,3} /
describe ICONPLN_ID [ID]PT Indonesia Comnets Plus JL PLN EHV Gandul CInere Depok 16512
score ICONPLN_ID 1.5

header HYPERNET_ID X-Spam-Relays-Untrusted =~ /^\[ ip=(?:120\.29\.15[2-9]|180\.178\.(?:9[6-9]|10\d|11[01]))\.\d{1,3} /
describe HYPERNET_ID [ID]PT. Hipernet Indodata Internet Service Provider Jakarta
score HYPERNET_ID 1.5

header MMS_ID X-Spam-Relays-Untrusted =~ /^\[ ip=119\.110\.68\.\d{1,3} /
describe MMS_ID [ID]Infrastructure_MMS_Jakarta_5 Maxindo Mitra Solusi, PT. Internet Service Provider
score MMS_ID 1.5

header WIRELESSNET_ID X-Spam-Relays-Untrusted =~ /^\[ ip=114\.79\.(?:\d|[1-5]\d|6[0-3])\.\d{1,3} /
describe WIRELESSNET_ID [ID]PT WIRELESS INDONESIA (PT SMART TELECOM) Jl. H Agus Salim No.45, Menteng Jakarta Pusat 10340
score WIRELESSNET_ID 1.5



# 203.109.128.0 - 203.109.255.255
header TIG_NZ X-Spam-Relays-Untrusted =~ /^\[ ip=(?:118\.9[23]\.\d{1,3}|203\.109\.(?:12[89]|1[3-9]\d|2\d\d))\.\d{1,3} /
describe TIG_NZ [NZ]The Internet Group Ltd.
score TIG_NZ 1.5

header CALLPLUS_NZ X-Spam-Relays-Untrusted =~ /^\[ ip=119\.224\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3} /
describe CALLPLUS_NZ [NZ]CallPlus Services Limited
score CALLPLUS_NZ 1.5

# NZTELECOM
header FIPD_XTRA_NZ X-Spam-Relays-Untrusted =~ /^\[ ip=(?:122\.57|125\.23[6-9]|219\.8[89]|222\.15[2-5])(?:\.\d{1,3}){2} /
describe FIPD_XTRA_NZ [NZ]Telecom Xtra Telecom Internet Registry Level 9, Mayoral Drive BLDG Private Bag 92028 Auckland
score FIPD_XTRA_NZ 1.5

header TELSTRACLEAR_NZ X-Spam-Relays-Untrusted =~ /^\[ ip=(?:121\.7[2-5](?:\.\d{1,3}){2}|218\.101\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}) /
describe TELSTRACLEAR_NZ [NZ]Telecommunications Company and Internet Service Provider
score TELSTRACLEAR_NZ 1.5

header ORCONNET_NZ X-Spam-Relays-Untrusted =~ /^\[ ip=(?:60\.234\.\d{1,3}|202\.150\.(?:9[6-9]|1[01]\d|12[0-7]))\.\d{1,3} /
describe ORCONNET_NZ [NZ]Orcon Internet Ltd PO Box 302-362 North Harbour Auckland
score ORCONNET_NZ 1.5

header CALLPLUS_NZ X-Spam-Relays-Untrusted =~ /^\[ ip=119\.224\.(?:\d|\d\d|1[0123]\d|14[0-3])\.\d{1,3} /
describe CALLPLUS_NZ [NZ]CallPlus Services Limited
score CALLPLUS_NZ 1.5




# 69.240.0.0 - 69.255.255.255
# header COMCAST Received =~ /from .+((c-[0-9]+.+|(pc|bg)p[0-9]+.+|rmhc[0-9]+)\.comcast\.net|69\.2(4[0-9]|5[0-5])(\.[0-9]{1,3}){2,2}[\)\] ])/
# header COMCAST X-Spam-Relays-Untrusted =~ /rdns=(c-[0-9]+.+|(pc|bg)p[0-9]+.+|rmhc[0-9]+)\.comcast\.net/
# header COMCAST X-Spam-Relays-Untrusted =~ /(ip=69\.2(4[0-9]|5[0-5])(\.[0-9]{1,3}){2,2}|rdns=(c-[0-9]+.+|(pc|bg)p[0-9]+.+|rmhc[0-9]+)\.comcast\.net) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
# header COMCAST X-Spam-Relays-Untrusted =~ /(ip=69\.2(4[0-9]|5[0-5])(\.[0-9]{1,3}){2,2}|rdns=c-\d{2,3}(-\d{1,3}){3}\.hsd1\.\w\w\.comcast\.net) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
# header COMCAST X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:69\.2[45]\d|71\.(?:19[2-9]|20[0-7])|98\.(?:19[2-9]|2[0-3]\d|24[0-7])|174\.58)(?:\.\d{1,3}){2}|\d{2,3}(?:\.\d{1,3}){3} rdns=c-\d{2,3}(-\d{1,3}){3}\.hsd1\.\w\w\.comcast\.net) /
header COMCAST X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:69\.2[45]\d|71\.(?:19[2-9]|20[0-7])|98\.(?:19[2-9]|2[0-3]\d|24[0-7])|107\.[0-5]|174\.(?:4[89]|5\d|6[0-3]))(?:\.\d{1,3}){2}|\d{2,3}(?:\.\d{1,3}){3} rdns=c-\d{2,3}(-\d{1,3}){3}\.hsd1\.\w\w\.comcast\.net) /
describe COMCAST [US]Comcast Cable Communications, Inc.
score COMCAST 1.0

# 24.151.0.0 - 24.151.255.255 
# 24.159.0.0 - 24.159.255.255 
# 24.176.0.0 - 24.183.255.255 
# 68.112.0.0 - 68.119.255.255 
# 68.184.0.0 - 68.191.255.255 
# 71.80.0.0 - 71.95.255.255 
# 75.128.0.0 - 75.143.255.255 
# 97.80.0.0 - 97.95.255.255 
header CHARTER_NET_US X-Spam-Relays-Untrusted =~ /^\[ ip=(?:24\.15[19]|24\.1(?:7[6-9]|8[0-3])|68\.11[2-9]|68\.1(?:8[4-9]|9[01])|71\.(?:8\d|9[0-5])|75\.1(?:2[89]|3\d|4[0-3])|96\.(?:3[2-9]|4[012])|97\.(?:8\d|9[0-5]))(?:\.[0-9]{1,3}){2,2} /
describe CHARTER_NET_US [US]Charter Communications
score CHARTER_NET_US 1.0

# 66.16.0.0 - 66.16.127.255 
header CAVTEL_BLK X-Spam-Relays-Untrusted =~ /ip=66\.16\.([0-9]|[1-9][0-9]|1[01][0-9]|12[0-7])\.[0-9]{1,3} .+ ident= envfrom= intl=0 [^\[\]]+auth= /
describe CAVTEL_BLK [US]Cavalier Telephone
score CAVTEL_BLK 1.0

# header ROADRUNNER X-Spam-Relays-Untrusted =~ / rdns=.+\.res\.rr\.com .+ ident= envfrom= intl=0 .+ auth= /
header ROADRUNNER X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:70\.1(?:1[2-9]|2[0-7])|97\.(?:9[6-9]|10[0-6])|98\.14|107\.(?:[89]|1[0-5]))(?:\.\d{1,3}){2}|\d{2,3}(?:\.\d{1,3}){3} rdns=.+\.res\.rr\.com) /
describe ROADRUNNER [US]Road Runner 
score ROADRUNNER 1.0

header WAVEB_US X-Spam-Relays-Untrusted =~ /^\[ ip=66\.119\.206\.(48|60) /
describe WAVEB_US [US]Wave Broadband, LLC 
score WAVEB_US 1.5

# NetRange:   209.160.0.0 - 209.160.79.255
# CIDR:       209.160.0.0/18, 209.160.64.0/20
header HOPONE_US X-Spam-Relays-Untrusted =~ /^\[ ip=209\.160\.40\.176 /
describe HOPONE_US [US]HopOne Internet Corporation
score HOPONE_US 1.5

# 72.55.128.0 - 72.55.191.255
header IWEBGROUP_US X-Spam-Relays-Untrusted =~ /^\[ ip=72\.55\.165\.209 /
describe IWEBGROUP_US [US]Groupe iWeb Technologies inc.
score IWEBGROUP_US 1.5

# 68.24.0.0 - 68.31.255.255
# 70.0.0.0 - 70.14.255.255
header SPCS_US X-Spam-Relays-Untrusted =~ /^\[ ip=(?:68\.(?:2[4-9]|3[01]|24[0-7])|70\.(?:\d|1[0-4])|99\.20[0-7])(?:\.\d{1,3}){2} /
describe SPCS_US [US]Sprint PCS
score SPCS_US 1.5

header GNAXNET_US X-Spam-Relays-Untrusted =~ /^\[ ip=209\.51\.154\.66 /
describe GNAXNET_US [US]Global Net Access, LLC
score GNAXNET_US 1.5

# 38.0.0.0 - 38.255.255.255
header PSINET_US X-Spam-Relays-Untrusted =~ /^\[ ip=38\.(?:99\.86|110\.146|113\.205)\.\d{1,3} /
describe PSINET_US [US]PSINet, Inc.
score PSINET_US 1.5

header AKANOC_US X-Spam-Relays-Untrusted =~ /^\[ ip=208\.77\.4[0-7]\.\d{1,3} /
describe AKANOC_US [US]45535 Northport Loop East Fremont CA
score AKANOC_US 1.5

header AMAZON_EC_US X-Spam-Relays-Untrusted =~ /^\[ ip=(?:50\.1[6-9]|107\.2[0-3])(?:\.\d{1,3}){2} /
describe AMAZON_EC_US [US]Amazon Web Services, Elastic Compute Cloud, EC2 1200 12th Avenue South Seattle
score AMAZON_EC_US 1.5

# 82.64.0.0 - 82.67.255.255
# header PROXAD Received =~ /from .+[a-z0-9-]+(-[0-9]{1,3}){4,4}\.(fbx|adsl)\.proxad\.net/
header PROXAD X-Spam-Relays-Untrusted =~ /rdns=[a-z0-9-]+(-[0-9]{1,3}){4,4}\.(fbx|adsl)\.proxad\.net [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe PROXAD [FR]Proxad / Free SAS
score PROXAD 1.0

# 62.38.32.0 - 62.38.35.255
# header HOL_INFRA Received =~ /from .+62\.38\.3[2-5]\.[0-9]{1,3}[\)\] ]/
header HOL_INFRA X-Spam-Relays-Untrusted =~ /ip=62\.38\.3[2-5]\.[0-9]{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe HOL_INFRA [GR]Hellas On Line S.A.
score HOL_INFRA 1.0

# 80.233.216.0 - 80.233.223.255
# header NEOLAINTELIALV Received =~ /from .+80\.233\.2(1[6-9]|2[0-3])\.[0-9]{1,3}[\)\] ]/
header NEOLAINTELIALV X-Spam-Relays-Untrusted =~ /ip=80\.233\.2(?:1[6-9]|2[0-3])\.[0-9]{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe NEOLAINTELIALV [LV]Neolain Ltd. (Latvia)
score NEOLAINTELIALV 1.0

# 200.81.0.0-200.81.31.255
# header MILLICOMAR Received =~ /from .+200\.81\.([0-9]|[12][0-9]|3[01])\.[0-9]{1,3}[\)\] ]/
header MILLICOMAR X-Spam-Relays-Untrusted =~ /ip=200\.81\.([0-9]|[12][0-9]|3[01])\.[0-9]{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe MILLICOMAR [AR]Millicom Argentina S.A.
score MILLICOMAR 1.0

# header RIMA_TDE_NET Received =~ /from .+[0-9]{1,3}\.Red(-[0-9]{1,3}){3,3}\.(dynamicIP|staticIP|pooles)\.rima-tde\.net/
header RIMA_TDE_NET X-Spam-Relays-Untrusted =~ /rdns=[0-9]{1,3}\.Red(-[0-9]{1,3}){3,3}\.(dynamicIP|staticIP|pooles)\.rima-tde\.net [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe RIMA_TDE_NET [ES]RIMA (Red IP Multi Acceso)TELEFONICA DE ESPANA
score RIMA_TDE_NET 1.0


# .revip.asianet.co.th
# header ASIANET_TH Received =~ /from .+\.revip[2-9]{0,1}\.asianet\.co\.th/
# header ASIANET_TH X-Spam-Relays-Untrusted =~ /(ip=(58\.([89]|1[01])|124\.12[012])(\.\d{1,3}){2}|rdns=.+\.(revip[2-9]{0,1}|static)\.asianet\.co\.th) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
header ASIANET_TH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:58\.(?:[89]|1[01])|61\.9[01]|124\.12[012])(?:\.\d{1,3}){2}|210\.86\.(?:19[2-9]|2[01]\d|22[0-3])\.\d{1,3}|\d{2,3}(?:\.\d{1,3}){3} rdns=.+\.(?:revip[2-9]{0,1}|static)\.asianet\.co\.th) /
describe ASIANET_TH [TH]Asianet Corperation
score ASIANET_TH 2.0

# Thai: 203.150.0.0 - 203.159.255.255
# 203.155.0.0 - 203.155.255.255
# 202.149.96.0 - 202.149.127.255
# header COMNETTH Received =~ /from .+203\.155(\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])){2,2}[\)\] ]/
# header COMNETTH X-Spam-Relays-Untrusted =~ /ip=(202\.149\.(9[6-9]|1[01]\d|12[0-7])\.\d{1,3}|203\.155(\.\d{1,3}){2}|203\.188\.(\d|[1-5]\d|6[0-3]).\d{1,3}) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
header COMNETTH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:58\.181\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|202\.149\.(?:9[6-9]|1[01]\d|12[0-7])\.\d{1,3}|203\.209\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}|203\.155(?:\.\d{1,3}){2}|203\.188\.(?:\d|[1-5]\d|6[0-3]).\d{1,3}) /
describe COMNETTH [TH]KSC Commercial Internet Co. Ltd.
score COMNETTH 1.5

# 
# thrown away due to same provider 2007.01.04 by [yoh]
# 
# header CSLOXINFO X-Spam-Relays-Untrusted =~ /(ip=58\.136(\.\d{1,3}){2}|rdns=p\d+-\w+\d+\.C\.csloxinfo\.net) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
# describe CSLOXINFO [TH]csloxinfo-th
# score CSLOXINFO 1.5

# 203.170.128.0 - 203.170.255.255
# header LOXINFO_TH X-Spam-Relays-Untrusted =~ /ip=(203\.170\.(12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|(58\.13[67]|203\.146)(\.\d{1,3}){2}) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
header LOXINFO_TH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:202\.183\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|203\.170\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|210\.1\.(?:\d|[1-5]\d|6[0-3])\.\d{1,3}|(?:58\.13[67]|203\.146)(?:\.\d{1,3}){2}) /
describe LOXINFO_TH [TH]Loxley Information Company Ltd.
score LOXINFO_TH 1.5

# 202.57.128.0 - 202.57.191.255
# 203.153.160.0 - 203.153.175.255
header ISP_TH X-Spam-Relays-Untrusted =~ /ip=(202\.57\.1(2[89]|[3-8][0-9]|9[01])|203\.153\.1(6\d|7[0-5]))\.\d{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe ISP_TH [TH]Internet Service Provider Co., Ltd.
score ISP_TH 1.5

# 202.28.0.0 - 202.29.255.255
header THAINET_TH X-Spam-Relays-Untrusted =~ /ip=202\.2[89](?:\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe THAINET_TH [TH]UniNet(Inter-university network)
score THAINET_TH 1.5

# 202.151.176.0 - 202.151.191.255
header SIAMIDC_TH X-Spam-Relays-Untrusted =~ /ip=202\.151\.1(7[6-9]|8\d|9[01])\.\d{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe SIAMIDC_TH [TH]SIAMIDC,Internet Datacenter , Bangkok, Thailand
score SIAMIDC_TH 1.5

# 203.151.0.0 - 203.151.255.255
header INET_CO_TH X-Spam-Relays-Untrusted =~ /ip=203\.151(?:\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe INET_CO_TH [TH]Internet Thailand Company Limited
score INET_CO_TH 1.5

# 125.24.0.0 - 125.24.255.255
# header TOT_IP_NET_TH X-Spam-Relays-Untrusted =~ /ip=125\.24(\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
header TOT_IP_NET_TH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:101\.(?:51|108)|113\.53|118\.17[2-5]|125\.24|180\.180|182\.5[23])(?:\.\d{1,3}){2}|118\.210\.21[6-9]\.\d{1,3}|180\.210\.21[6-9]\.\d{1,3}|203\.113\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}|203\.114\.(?:9[6-9]|1[01]\d|12[0-7])\.\d{1,3}|221\.128\.(?:8[89]|9\d|1[01]\d)\.\d{1,3}) /
describe TOT_IP_NET_TH [TH]tot ip network ip address pool for adsl services
score TOT_IP_NET_TH 1.5

header BUDDYB_TH X-Spam-Relays-Untrusted =~ /^\[ ip=58\.64\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3} /
describe BUDDYB_TH [TH]BuddyB Broadband service network, Advance Datanetwork Communications Co.,Ltd.
score BUDDYB_TH 1.5

header CAT_TH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:61\.19|122\.154)(?:\.\d{1,3}){2}|(?:61\.7|110\.77)\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|119\.42\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])\.\d{1,3}|122\.155\.(?:\d|1[0-5])\.\d{1,3}|202\.129\.(?:\d|[1-5]\d|6[0-3])\.\d{1,3}) /
describe CAT_TH [TH]CAT Telecom public company Ltd
score CAT_TH 1.5

# header PACNET_TH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.47\.(?:\d|\d\d|1[01]\d|12[0-7])|202\.64\.\d{1,3}|203\.121\.1(?:2[89]|[3-8]\d|9[01])|203\.152\.(?:\d|[1-5]\d|6[0-3])|220\.232\.(?:12[89]|1[3-9]\d|2\d\d))\.\d{1,3} /
# describe PACNET_TH [TH]PACNET
# score PACNET_TH 1.5

# MAINT-AP-TRUEINTERNET
header TRUENET_TH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:110\.16[89]|115\.87|119\.46|171\.(?:9[6-9]|100))\.\d{1,3}|202\.133\.1(?:2[89]|[3-8]\d|9[01])|210\.213\.(?:\d|[1-5]\d|6[0-3]))\.\d{1,3} /
describe TRUENET_TH [TH]True Internet Co., Ltd.
score TRUENET_TH 1.5

# CAT TELECOM
header PROENNET_TH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.[78]\.1(?:2[89]|[3-8]\d|9[01])|(?:110\.77|112\.121)\.1(?:2[89]|[345]\d)|111\.223\.(?:3[2-9]|4[0-8])|122\.125\.(?:\d|1[0-5])|202\.139\.(?:19[2-9]|2[01]\d|22[0-3]))\.\d{1,3} /
describe PROENNET_TH [TH]Proen Internet, Internet Service Provider, Bangkok, Thailand
score PROENNET_TH 1.5

# AISNET
header AIS_TH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:110\.49\.\d{1,3}|119\.31\.(?:\d|\d\d|1[01]\d|12[0-7])|(?:49\.2(?:2[89]|3[01])|182\.232)\.\d{1,3})\.\d{1,3} /
describe AIS_TH [TH]Advanced Info Service Public Company Limited NMC, 1291/1 Phaholyothin Road, Phayathai, Bangkok 10400, THAILAND
score AIS_TH 1.5

header TRUEMOVE_TH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:27\.55|49\.237|223\.24)(?:\.\d{1,3}){2}|180\.214\.(?:19[2-9]|2[01]\d|22[0-3])\.\d{1,3}) /
describe TRUEMOVE_TH [TH]18 True Tower, Ratchadaphisek Rd. Huai Khwang, Bangkok
score TRUEMOVE_TH 1.5

header BB_BROADBAND_TH X-Spam-Relays-Untrusted =~ /^\[ ip=115\.31\.1(?:2[89]|[3-8]\d|19[01])\.\d{1,3} /
describe BB_BROADBAND_TH [TH]INTERNET SERVICE PROVIDER BANGKOK,THAILAND
score BB_BROADBAND_TH 1.5

header DTAC_TH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:1\.4[67]|111\.84|115\.67)(?:\.\d{1,3}){2} /
describe DTAC_TH [TH]DTAC-GPRS-NET Total Access Communication PLC.
score DTAC_TH 1.5

#TTTNET
header TTT_TH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:58\.147\.(?:\d|\d\d|1[01]\d|12[0-7])|124\.157\.(?:12[89]|1[3-9]\d|2\d\d)|203\.156\.1(?:2[89]|3[0-5]))\.\d{1,3} /
describe TTT_TH [TH]Maxnet ISP, Bangkok Thailand, for Dynamic IP pools of ADSL service.
score TTT_TH 1.5

header FTTH_TH X-Spam-Relays-Untrusted =~ /^\[ ip=119\.148\.(?:9[6-9]|10[0-3])\.\d{1,3} /
describe FTTH_TH [TH]FTTH Thailand Internet Service Provider/Content Provider Bangkok, Thailand
score FTTH_TH 1.5

header TRIPLETNET_TH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:27\.130|49\.4[89]|110\.164|171\.[4-7]|180\.183|183\.8[89]|223\.20[4-7])(?:\.\d{1,3}){2} /
describe TRIPLETNET_TH [TH]3BB Broadband Internet service provider in Thailand
score TRIPLETNET_TH 1.5

header RIT_TH X-Spam-Relays-Untrusted =~ /^\[ ip=203\.158\.(?:9[6-9]|[12]\d\d)\.\d{1,3} /
describe RIT_TH [TH]Rajamangala Institute of Technology Institute of Information Technology RIT center, Pathum Thani
score RIT_TH 1.5

header KIRZ_TH X-Spam-Relays-Untrusted =~ /^\[ ip=27\.131\.1(?:2[89]|[3-8]\d|9[01])\.\d{1,3} /
describe KIRZ_TH [TH]KIRZ Company Limited 192 Soi Ladprao 107 Klongchan
score KIRZ_TH 1.5

header BB_BROADBAND_TH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:115\.31\.1(?:2[89]|[3-8]\d|9[01])|119\.63\.(?:6[4-9]|[78]\d|9[0-5]))\.\d{1,3} /
describe BB_BROADBAND_TH [TH]BB BROADBAND CO. LTD. INTERNET SERVICE PROVIDER BANGKOK, THAILAND
score BB_BROADBAND_TH 1.5

header MICT_NET_TH X-Spam-Relays-Untrusted =~ /^\[ ip=123\.242\.1(?:2[89]|[3-8]\d|9[01])\.\d{1,3} /
describe MICT_NET_TH [TH]Ministry of Infomation Communication Technology Goverment network provider
score MICT_NET_TH 1.5

header VPLS_TH X-Spam-Relays-Untrusted =~ /^\[ ip=110\.34\.1(?:2[89]|[3-9]\d|2\d\d)\.\d{1,3} /
describe VPLS_TH [TH]740 W. Katella Ave.
score VPLS_TH 1.5


# 202.83.32.0 - 202.83.63.255
# 202.164.128.0 - 202.164.159.255
# header ASIANET_IN Received =~ /from .+202\.83\.(3[2-9]|[4-7][0-9]|8[0-3])\.[0-9]{1,3}[\)\] ]/
# header ASIANET_IN X-Spam-Relays-Untrusted =~ /ip=202\.83\.(3[2-9]|[4-7][0-9]|8[0-3])\.[0-9]{1,3} .+ident= envfrom= intl=0 .+auth= /
# header ASIANET_IN X-Spam-Relays-Untrusted =~ /ip=202\.(83\.(3[2-9]|[4-7][0-9]|8[0-3])|164\.1(2[89]|[345]\d))\.[0-9]{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
header ASIANET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:111\.92\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}|202\.(?:83\.(?:3[2-9]|[4-7]\d|8[0-3])|164\.1(?:2[89]|[345]\d))\.\d{1,3}) /
describe ASIANET_IN [IN]Asianet ISP providing broadband internet access through Cable Network
score ASIANET_IN 1.5


# 59.88.0.0 - 59.99.255.255
# 210.212.0.0 - 210.212.255.255
# 61.0.0.0 - 61.1.255.255
# 117.192.0.0 - 117.255.255.255
header BSNLNET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:59\.(?:8[89]|9\d)|61\.[0-3]|117\.(?:19[2-9]|2\d\d)|210\.212|218\.248)(\.[\d]{1,3}){2} /
describe BSNLNET_IN [IN]NIB (National Internet Backbone)
score BSNLNET_IN 1.5

# 61.17.0.0 - 61.17.255.255
# 59.160.0.0 - 59.165.255.255
# 202.54.0.0 - 202.54.255.255
# 219.64.0.0 - 219.65.255.255
# 202.9.128.0 - 202.9.191.255
# 203.197.0.0 - 203.197.255.255
# 61.11.0.0 - 61.11.127.255
# 203.200.0.0 - 203.200.255.255
# 121.240.0.0 - 121.247.255.255
# 210.211.128.0 - 210.211.255.255
header VSNL_IN X-Spam-Relays-Untrusted =~ /(ip=((59\.16[0-5]|61\.17|121\.24[0-7]|202\.54|203\.(?:19[79]|200)|219\.6[45])(\.[\d]{1,3}){2}|(61\.11\.(\d|\d\d|1[01]\d|12[0-7])|202\.9\.1(2[89]|[3-8]\d|9[01])|210\.211\.(?:12[89]|1[3-9]\d|2\d\d))\.\d{1,3})|rdns=\d{2,3}(?:\.\d{1,3}){3}\.[A-Z-]+\.dialup\.vsnl\.net\.in) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe VSNL_IN [IN]Videsh Sanchar Nigam Ltd - India.
score VSNL_IN 1.5

# 221.128.128.0 - 221.128.255.255
header EXATTNET_IN X-Spam-Relays-Untrusted =~ /ip=221\.128\.(?:12[89]|1[3-9]\d|2[0-4]\d|25[0-5])\.[\d]{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe EXATTNET_IN [IN]EXATTNET
score EXATTNET_IN 1.5

# 61.246.0.0 - 61.246.255.255
# 59.144.0.0 - 59.145.255.255
# 203.101.0.0 - 203.101.127.255
# 125.16.0.0 - 125.23.255.255
# 203.145.128.0 - 203.145.191.255
# BHARTI-AIRTEL-LTD-MOBILITY-SERVICES-IN
header BHARTI_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:27\.(?:5[6-9]|6[0-3])|59\.14[45]|61\.246|106\.(?:19[2-9]|2[01]\d|22[0-3])|110\.22[4-7]|117\.9[6-9]|122\.1(?:[67]\d|8[0-7])|125\.(?:1[6-9]|2[0-3])|182\.(?:6[4-9]|7\d)|223\.(?:17[6-9]|18\d|19[01]|22[4-9]|23\d))(?:\.\d{1,3}){2}|(?:117\.99|122\.183|203\.101)\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}|(?:122\.183|203\.145|223\.176)\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|182\.71\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])\.\d{1,3}|203\.192\.(?:19[2-9]|2\d\d)\.\d{1,3}) /
describe BHARTI_IN [IN]Bharti Broadband networks Limited
score BHARTI_IN 1.5

# 220.226.128.0 - 220.226.191.255
# 220.224.0.0 - 220.227.255.255
# 123.236.0.0 - 123.239.255.255
# 115.240.0.0 - 115.255.255.255
header RELIANCE_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:101\.(?:5[6-9]|6[0-3])|115\.(?:18[45]|2[45]\d)|123\.23[6-9]|124\.12[45]|220\.22[4-7])(?:\.\d{1,3}){2} /
describe RELIANCE_IN [IN]Reliance Infocom Ltd Internet Data Centre
score RELIANCE_IN 1.5

# 219.91.128.0 - 219.91.255.255
header IQARANET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:123\.201(\.\d{1,3}){2}|219\.91\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}) /
describe IQARANET_IN [IN]Iqara Telecom India Pvt Ltd Cable Internet Service Provider
score IQARANET_IN 1.5

# 210.214.0.0 - 210.214.255.255
# header SILNET_IN X-Spam-Relays-Untrusted =~ /ip=210\.214(\.\d{1,3}){2} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
header SILNET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=210\.214(?:\.\d{1,3}){2} /
describe SILNET_IN [IN]Satyam Infoway Pvt.Ltd. Value Added Network service provider in India.
score SILNET_IN 1.5

# 202.177.144.0 - 202.177.191.255
header SIFYNET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:118\.95\.(?:5[6-9]|6\d)|202\.177\.1(?:4[4-9]|[5-8]\d|9[01])|210\.210\.(?:\d|\d\d|1[01]\d|12[0-7])|(?:119\.22[67]|124\.30|221\.13[45])\.\d{1,3})\.\d{1,3} /
describe SIFYNET_IN [IN]Satyam Infoway (P) Ltd. National Internet Service Provider
score SIFYNET_IN 1.5

# 203.129.192.0 - 203.129.255.255
header STPI_IN X-Spam-Relays-Untrusted =~ /^\[ ip=203\.129\.(?:19[2-9]|2\d\d)\.\d{1,3} /
describe STPI_IN [IN]Software Technology Parks of India
score STPI_IN 1.5

# 202.88.128.0 - 202.88.191.255
# 203.212.192.0 - 203.212.255.255
# 60.243.0.0 - 60.243.255.255
# 125.99.0.0 - 125.99.255.255
# 60.254.0.0 - 60.254.127.255
# 210.18.128.0 - 210.18.191.255
# 202.88.208.0 - 202.88.223.255
# 116.72.0.0 - 116.75.255.255
# header HATHWAY_NET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:60\.243|115\.9[6-9]|116\.7[2-5]|125\.99)(?:\.\d{1,3}){2}|(?:60\.254\.(?:\d|\d\d|1[01]\d|12[0-7])|202\.88\.(?:1(?:2[89]|[3-8]\d|9[01])|20[2-9]|21\d|22[0-3])|203\.212\.(?:19[2-9]|2\d\d)|210\.18\.1(?:2[89]|[3-8]\d|9[01]))\.\d{1,3}) /
header HATHWAY_NET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:27\.[4-7]|60\.243|115\.9[6-9]|116\.7[2-5]|125\.99)(?:\.\d{1,3}){2}|(?:60\.254\.(?:\d|\d\d|1[01]\d|12[0-7])|202\.88\.(?:1(?:2[89]|[3-8]\d|9[01])|20[2-9]|21\d|22[0-3])|203\.163\.2(?:2[4-9]|[345]\d)|203\.212\.(?:19[2-9]|2\d\d)|210\.18\.1(?:2[89]|[3-8]\d|9[01]))\.\d{1,3}) /
describe HATHWAY_NET_IN [IN]Hathway IP Over Cable Internet Access Service
score HATHWAY_NET_IN 1.5

# 203.123.128.0 - 203.123.191.255
header PI_IN X-Spam-Relays-Untrusted =~ /^\[ ip=203\.123\.1(2[89]|[3-8]\d|9[01])\.\d{1,3} /
describe PI_IN [IN]Pacific Internet Limited
score PI_IN 1.5

header YOUTELE_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:123.201(?:\.\d{1,3}){2}|203.109.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.\d{1,3}|203\.187\.(?:19[2-9]|2\d\d)\.\d{1,3}|219.91.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}) /
describe YOUTELE_IN [IN]Iqara Telecom India Pvt Ltd
score YOUTELE_IN 1.5

# 202.70.192.0 - 202.70.207.255
header IOLNET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=202\.(?:63\.1(?:[678]\d|9[01])\.\d{1,3}|70\.198\.133) /
describe IOLNET_IN [IN]India Online Network Ltd.
score IOLNET_IN 1.5

header ORTELCOMM_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:27\.4[89]|113\.19)(?:\.\d{1,3}){2}|122\.50\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|202\.137\.2(?:0[89]|1\d|2[0-3])\.\d{1,3}|203\.98\.(?:9[6-9]|1[01]\d|12[0-7])\.\d{1,3}) /
describe ORTELCOMM_IN [IN]ORTELCOMMUNICATIONS INTERNET SERVICE PROVIDER
score ORTELCOMM_IN 1.5

header BEAMCABLE_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:123\.176\.(?:3[2-9]|4[0-7])\.\d{1,3}|(?:124\.123|183\.8[23])(?:\.\d{1,3}){2}|202\.53\.(?:[89]|1[0-5])\.\d{1,3}) /
describe BEAMCABLE_IN [IN]Internet Telephony Service Provider
score BEAMCABLE_IN 1.5

header GPRS_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:110\.225(?:\.\d{1,3}){2}|112\.110(?:\.\d{1,3}){2}|117\.9[67](?:\.\d{1,3}){2}) /
describe GPRS_IN [IN]GPRS-Subscribers
score GPRS_IN 1.5

header PACENET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:180\.188\.2(?:2[4-9]|[345]\d)|(?:101\.0|210\.89)\.(?:3[2-9]|[45]\d|6[0-3])|203\.76\.(?:17[6-9]|18\d|19[01])|203\.115\.(?:6[4-9]|[78]\d|9[0-5]))\.\d{1,3} /
describe PACENET_IN [IN]India's Premeir Broadband and IPTV services, Mumbai.
score PACENET_IN 1.5

# header TATACOMM_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:115\.1(?:0[89]|1\d)(?:\.\d{1,3}){2}|61\.12\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}|61\.16\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}) /
header TATACOMM_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:14\.(?:9[6-9]|14[0-3]|19[45])|27\.107|49\.2(?:0[0-3]|4[89])|111\.93|114\.143|115\.1(?:0[89]|1\d)|121\.24[0-7]|182\.156)(?:\.\d{1,3}){2}|61\.12\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}|61\.16\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|210\.7\.(?:6[4-9]|[78]\d|9[0-5])\.\d{1,3}) /
describe TATACOMM_IN [IN]TATA Communications formerly VSNL is Leading ISP, Data and Voice Carrier in India
score TATACOMM_IN 1.5

header P4NETWORKS_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:183\.87(?:\.\d{1,3}){2}|111\.125\.(?:19[2-9]|2\d\d)\.\d{1,3}) /
describe P4NETWORKS_IN [IN]Parshwa Purushotam Parind Parekh Networks Limited
score P4NETWORKS_IN 1.5

header MTNLISP_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:59\.1(?:7[6-9]|8[0-5])|120\.(?:5[6-9]|6[0-3]))(?:\.\d{1,3}){2}|202\.159\.(?:19[2-9]|2\d\d)\.\d{1,3}) /
describe MTNLISP_IN [IN]MTNL CAT B ISP
score MTNLISP_IN 1.5

header GTPL_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:27\.10[0-3]|182\.237\.(?:[89]|1[0-5]))\.\d{1,3} /
describe GTPL_IN [IN]Gujarat Telelink Pvt Ltd.
score GTPL_IN 1.5

# 27.0.48.0 - 27.0.63.255
# 115.69.240.0 - 115.69.255.255
header VASAICABLEPVTLTD_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:27\.0\.(?:4[89]|5\d|6[0-3])|115\.69\.2[45]\d)\.\d{1,3} /
describe VASAICABLEPVTLTD_IN [IN]Vasai Cable Pvt Ltd
score VASAICABLEPVTLTD_IN 1.5

# WPISPL
# 202.89.79.0/24 202.89.64.0/24
header WORLDPHONE_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:14\.102\.(?:\d|\d\d|1[01]\d|12[0-7])|110\.172\.1(?:2[89]|[3-8]\d|9[01])|114\.69\.(?:22[4-9]|2[345]\d)|118\.91\.1(?:7[6-9]|8\d|9[01])|202\.89\.(?:6[4-9]|7\d))\.\d{1,3} /
describe WORLDPHONE_IN [IN]World Phone Internet Service Pvt. Ltd. C-153 , OKHLA PHASE I , New Delhi
score WORLDPHONE_IN 1.5

# DWL
header DISHNET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:27\.2(?:4[89]|5[01])\.\d{1,3}|58\.68\.(?:\d|\d\d|1[01]\d|12[0-7])|118\.102\.(?:12[89]|1[3-9]\d|2\d\d))\.\d{1,3} /
describe DISHNET_IN [IN]Dishnet Wireless Ltd, India
score DISHNET_IN 1.5

header DVOIS_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:1\.186\.\d{1,3}|114\.79\.1(?:2[89]|[3-8]\d|9[01])|182\.48\.(?:19[2-9]|2\d\d))\.\d{1,3} /
describe DVOIS_IN [IN]Dvois Broadband Pvt Ltd
score DVOIS_IN 1.5

header PDSN_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:116\.20[23]\.\d{1,3}|180\.215\.(?:\d|\d\d|1[01]\d|12[0-7]))\.\d{1,3} /
describe PDSN_IN [IN]PDSN8-CHENNAI-MTS-INDIA-IN
score PDSN_IN 1.5

header ICL_NET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:1\.187|27\.97|49\.1[45]|106\.(?:67|7[6-9])|112\.110)(?:\.\d{1,3}){2} /
describe ICL_NET_IN [IN]Idea Cellular Limited 5th Floor, Windsor Building Off: CST Road Kalina, Santacruz (East) Mumbai 400 098
score ICL_NET_IN 1.5

header VAINAVIINDUSTRIESLTD_IN X-Spam-Relays-Untrusted =~ /^\[ ip=119\.235\.(?:4[89]|5[0-5])\.\d{1,3} /
describe VAINAVIINDUSTRIESLTD_IN [IN]Vainavi Industries Ltd
score VAINAVIINDUSTRIESLTD_IN 1.5

header SPECTRANET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:119\.82|125\.63)\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|180\.151\.\d{1,3})\.\d{1,3} /
describe SPECTRANET_IN [IN]Broadband ISP, India
score SPECTRANET_IN 1.5

header PIONEER_IN X-Spam-Relays-Untrusted =~ /^\[ ip=202\.65\.1(?:2[89]|[345]\d)\.\d{1,3} /
describe PIONEER_IN [IN]Pioneer Elabs Ltd. Andhara Pradesh State of India
score PIONEER_IN 1.5

header ANKHNET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=202\.179\.(?:6[4-9]|[78]\d|9[0-5])\.\d{1,3} /
describe ANKHNET_IN [IN]Ankhnet Informations Pvt. Ltd., Mumbai, India.
score ANKHNET_IN 1.5

header EXCELLMEDIA_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:202\.133\.(?:4[89]|5\d|6[0-3])|202\.153\.(?:3[2-9]|4[0-7]))\.\d{1,3} /
describe EXCELLMEDIA_IN [IN]Excell Media Pvt Ltd Cable ISP Hyderabad A.P, India
score EXCELLMEDIA_IN 1.5

# RAILNET-IN
# SELNET-IN
header RAILTEL_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:112\.133\.(?:19[2-9]|2\d\d)|122\.252\.2(?:2[4-9]|[345]\d))\.\d{1,3} /
describe RAILTEL_IN [IN]RailTel Corporation of India Ltd.
score RAILTEL_IN 1.5

# ABSPL
header ALLIANCEBROADBAND_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:115\.187\.(?:3[2-9]|[45]\d|6[0-3])|116\.193\.1(?:2[89]|3\d|4[0-3])|202\.78\.23[2-9])\.\d{1,3} /
describe ALLIANCEBROADBAND_IN [IN]Alliance Broadband Services Pvt. Ltd. P-89, C.I.T. Road,2nd Floor Kolkata Pin- 700 014 India
score ALLIANCEBROADBAND_IN 1.5

header REACH2NET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=202\.90\.(?:9[6-9]|10\d|11[01])\.\d{1,3} /
describe REACH2NET_IN [IN]Descon Limited Internet SErvice Provider Block - EP, Sector V, Plot - X1,2 & 3 Salt Lake City Kolkata 700 091
score REACH2NET_IN 1.5

header WISHNET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:27\.131\.2(?:0[89]|1[0-5])|113\.21\.(?:6[4-9]|7\d)|223\.223\.1(?:2[89]|[345]\d))\.\d{1,3} /
describe WISHNET_IN [IN]WISH NET PRIVATE LIMITED 86, GOLAGHATA ROAD JAMUNA APARTMENTS GROUND FLOOR
score WISHNET_IN 1.5

header SYSCON_IN X-Spam-Relays-Untrusted =~ /^\[ ip=111\.119\.(?:19[2-9]|2\d\d)\.\d{1,3} /
describe SYSCON_IN [IN]Syscon Infoway Pvt. Ltd., Internet Service Provider, INDIA.
score SYSCON_IN 1.5

header CAPTURE_IN X-Spam-Relays-Untrusted =~ /^\[ ip=116\.199\.1(?:6[89]|7[0-5])\.\d{1,3} /
describe CAPTURE_IN [IN]B/217, Rolex Shopping Center, Station Road,
score CAPTURE_IN 1.5

header SPIDIGO_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:49\.213\.(?:3[2-9]|[45]\d|6[0-3])|110\.172\.(?:2[4-9]|3[01])|122\.102\.12[0-7])\.\d{1,3} /
describe SPIDIGO_IN [IN]Spidigo Broadband & Internet Services Chandranet Pvt.Ltd. 401, Parshwa Tower, 4th floor, S.G. Highway, Near Pakwan Restaurant Bodakdev
score SPIDIGO_IN 1.5

header TIKONANET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:1\.2[23]|113\.193)(?:\.\d{1,3}){2} /
describe TIKONANET_IN [IN]Tikona Digital Networks Pvt. Ltd.
score TIKONANET_IN 1.5

# InternetAPN OpenInternetAccessAPN
# Vodafone Essar Limited-Value Added Services ,India
header HUTCHVAS_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:1\.3[89]\.\d{1,3}|42\.1(?:0[4-9]|1[01])\.\d{1,3}|112\.79\.\d{1,3}|114\.31\.1(?:6\d|7[0-5]))\.\d{1,3} /
describe HUTCHVAS_IN [IN]Vodafone Essar Limited GPRS service
score HUTCHVAS_IN 1.5

header ERNET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=202\.141\.(?:\d|\d\d|1[0-5]\d)\.\d{1,3} /
describe ERNET_IN [IN]Education and Research Network
score ERNET_IN 1.5

header SBS_IN X-Spam-Relays-Untrusted =~ /^\[ ip=103\.1\.8[0-3]\.\d{1,3} /
describe SBS_IN [IN]Star Broadband Services (I) Pvt. Ltd. 19/48, 1st Floor, Malcha Marg Shopping Complex, Chanakyapuri
score SBS_IN 1.5

header HNS_IN X-Spam-Relays-Untrusted =~ /^\[ ip=111\.91\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3} /
describe HNS_IN [IN]Honesty Net Solution (I) Pvt Ltd
score HNS_IN 1.5

header TULIP_IN X-Spam-Relays-Untrusted =~ /^\[ ip=110\.23[45](?:\.\d{1,3}){2} /
describe TULIP_IN [IN]IPVPN/INTERNET SERVICE PROVIDER TULIP TELECOM LTD. PLANNING & TECHNOLOGY TEAM C-160, Okhla Phase-1 New Delhi-110020
score TULIP_IN 1.5

header RSMANI_NKN_IN X-Spam-Relays-Untrusted =~ /^\[ ip=14\.139(?:\.\d{1,3}){2} /
describe RSMANI_NKN_IN [IN]National Knowledge Network C/0 National Informatics Centre Ministry Of Comm & IT A-Block CGO Complex Lodhi Road
score RSMANI_NKN_IN 1.5

header NSTPL_IN X-Spam-Relays-Untrusted =~ /^\[ ip=27\.124\.(?:\d|[1-5]\d|6[0-3])\.\d{1,3} /
describe NSTPL_IN [IN]NOIDA Software Technology Park Ltd Scindia Villa, Sarojini Nagar, Ring Road,
score NSTPL_IN 1.5

header WNET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:49\.128\.1(?:6\d|7[1-5])|103\.29\.9[6-9])\.\d{1,3} /
describe WNET_IN [IN]Wan & Lan Internet Pvt. Ltd.
score WNET_IN 1.5

header BLAZENET_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:180\.211\.(?:9[6-9]|1[01]\d|12[0-7])|202\.131\.(?:9[6-9]|1[01]\d|12[0-7]))\.\d{1,3} /
describe BLAZENET_IN [IN]Blazenet Pvt Ltd 403 / 404 Sarita Complex Behind Hotel Classic Gold Off C. G. Road
score BLAZENET_IN 1.5

header AIRCEL_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:101\.2(?:0[89]|1\d|2[0-3])|175\.40)(?:\.\d{1,3}){2} /
describe AIRCEL_IN [IN]Aircel gprs customer Hyderabad
score AIRCEL_IN 1.5

header CABLELITE_IN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:106\.51\.\d{1,3}|202\.83\.(?:1[6-9]|2\d|3[01]))\.\d{1,3} /
describe CABLELITE_IN [IN]Broad Band Internet Service Provider, India
score CABLELITE_IN 1.5


# 68.32.0.0 - 68.63.255.255

# 24.0.0.0 - 24.15.255.255
# 24.16.0.0 - 24.23.255.255

# 24.0.0.0 - 24.23.255.255

# 24.30.0.0 - 24.30.95.255
# 24.30.96.0 - 24.30.127.255

# 24.30.0.0 -  24.30.127.255

# 24.60.0.0 - 24.63.255.255
# 24.130.224.0 - 24.130.255.255


# 202.177.0.0 - 202.177.31.255
header KDD_HK Received =~ /from .+202\.177\.([0-9]|[12][0-9]|3[01])\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])/
describe KDD_HK [HK]KDDI HONG KONG LIMITED
score KDD_HK 1.5

# 210.245.128.0 - 210.245.255.255
# 59.188.0.0 - 59.188.255.255
# 210.209.64.0 - 210.209.127.255
# NEWWORLDTEL
header NWTNET X-Spam-Relays-Untrusted =~ /^\[ ip=(?:59\.188(?:\.\d{1,3}){2}|(?:(?:58\.64|113\.10|210\.245)\.(?:12[89]|1[3-9]\d|2\d\d)|203\.98\.1(?:2[89]|[3-8]\d|9[01])|210\.209\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7]))\.\d{1,3}) /
describe NWTNET [HK]New World Telephone
score NWTNET 1.5

# 218.190.0.0 - 218.191.255.255
# 221.124.0.0 - 221.127.255.255
# 210.0.128.0 - 210.0.255.255
# 218.188.0.0 - 218.189.255.255
# 210.3.0.0 - 210.3.255.255
header HGC_HK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:113\.25[2-5]|118\.14[0-3]|210\.3|218\.1(?:8[89]|9[01])|221\.12[4-7])(?:\.\d{1,3}){2}|210\.0\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}) /
describe HGC_HK [HK]Hutchison Global Communications
score HGC_HK 1.5

# 202.66.0.0 - 202.66.255.255
header CPCNET_HK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:202\.66|203\.85)(?:\.\d{1,3}){2}|202\.76\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}) /
describe CPCNET_HK [HK]CPCNet Hong Kong Ltd.
score CPCNET_HK 1.5

# 218.252.0.0 - 218.255.255.255
# 222.166.0.0 - 222.166.255.255
# header HKCABLE_HK X-Spam-Relays-Untrusted =~ /ip=(218\.25[2-5]|222\.16[67])(\.[0-9]{1,3}){2} .+ident= envfrom= intl=0 .+auth= /
header HKCABLE_HK X-Spam-Relays-Untrusted =~ /(rdns=cm\d{2,3}(-\d{1,3}){3}\.hkcable\.com\.hk|ip=(218\.25[2-5]|222\.16[67])(\.[0-9]{1,3}){2}) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe HKCABLE_HK [HK]HK Cable TV Ltd
score HKCABLE_HK 1.5


header HKCIX_HK X-Spam-Relays-Untrusted =~ /^\[ ip=202\.181\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3} /
describe HKCIX_HK [HK]Hongkong Commercial Internet Exchange
score HKCIX_HK 1.5

header HKNET_HK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:121\.127\.2(?:4[89]|5[01])|(?:202\.67|203\.169)\.(?:12[89]|1[3-9]\d|2\d\d))\.\d{1,3} /
describe HKNET_HK [HK]HKNet Company Ltd.
score HKNET_HK 1.5

# 203.80.192.0 - 203.80.255.255
header CTINET_HK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.92(?:\.\d{1,3}){2}|203\.80\.250\.1(?:2[89]|[345]\d)) /
describe CTINET_HK [HK]City Telecom (H.K.) Ltd.
score CTINET_HK 1.5

header GENESIS_HK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:114\.142\.1(?:4[4-9]|5\d)|202\.65\.(?:19[2-9]|2[01]\d|22[0-3])|202\.134\.(?:9[6-9]|10\d|11[01])|219\.90\.1(?:1[2-9]|2[0-7]))\.\d{1,3} /
describe GENESIS_HK [HK]Genesis Net Limited
score GENESIS_HK 1.5

header SINGTEL_HK X-Spam-Relays-Untrusted =~ /^\[ ip=202\.83\.(?:19[2-9]|2[012]\d|22[0-3])\.\d{1,3} /
describe SINGTEL_HK [HK]Singtel Hong Kong Limited
score SINGTEL_HK 1.5

header FNCL_HK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:116\.212\.11[2-8]|118\.102\.(?:[89]|1[0-5])|202\.59\.15[2-9])\.\d{1,3} /
describe FNCL_HK [HK]First Network Communications Limited, ISP at HK
score FNCL_HK 1.5

header APACSERVER_HK X-Spam-Relays-Untrusted =~ /^\[ ip=111\.68\.(?:\d|1[0-5])\.\d{1,3} /
describe APACSERVER_HK [HK]ASIA PACIFIC SERVER COMPANY
score APACSERVER_HK 1.5

# header NETVIGATOR_HK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:116\.4[89]|218\.10[23]|220\.24[16])(?:\.\d{1,3}){2}|(?:(?:113\.28|202\.85)\.(?:\d|\d\d|1[01]\d|12[0-7])|125\.214\.(?:19[2-9]|2\d\d)|125\.215\.(?:12[89]|1[3-9]\d|2\d\d)|210\.176\.(?:4[89]|[5-9]\d|1[01]\d|12[0-7]))\.\d{1,3}) /
# MAINT-HK-PCCW-BIA
header NETVIGATOR_HK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:112\.120|116\.4[89]|119\.23[67]|202\.82|203\.198|218\.10[23]|219\.7[6-9]|220\.24[16]|223\.197)\.\d{1,3}|(?:113\.28|202\.85|220\.241)\.(?:\d|\d\d|1[01]\d|12[0-7])|125\.214\.(?:19[2-9]|2\d\d)|(?:113\.28|125\.215|210\.177)\.(?:12[89]|1[3-9]\d|2\d\d)|210\.87\.2[45]\d|210\.176\.(?:4[89]|[5-9]\d|1[01]\d|12[0-7])|223\.130\.(?:3[2-9]|[45]\d|6[0-3]))\.\d{1,3} /
describe NETVIGATOR_HK [HK]PCCW Limited
score NETVIGATOR_HK 1.5

header SNW_HK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:112\.213\.(?:9[6-9]|1[01]\d|12[0-7])|121\.54\.1(?:6[89]|7[45])|210\.56\.(?:4[89]|5\d|6[0-3]))\.\d{1,3} /
describe SNW_HK [HK]Sun Network (Hong Kong) Limited
score SNW_HK 1.5

header SIMCENT_HK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:112\.121\.1(?:[678]\d|9[01])|180\.178\.(?:3[2-9]|[45]\d|6[0-3])|182\.16\.(?:\d|\d\d|1[01]\d|12[0-7]))\.\d{1,3} /
describe SIMCENT_HK [HK]Simcentric Solutions, Internet Service Provider
score SIMCENT_HK 1.5

header ADI_HK X-Spam-Relays-Untrusted =~ /^\[ ip=183\.90\.1(?:8[4-9]|9[01])\.\d{1,3} /
describe ADI_HK [HK]Asia Data (Hong kong) Inc. Limited
score ADI_HK 1.5

header IPC_NEWTT_HK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:59\.152\.2(?:2[4-9]|[345]\d)|101\.78\.(?:12[89]|1[3-9]\d|2\d\d)|115\.160\.1(?:2[89]|[3-8]\d|9[01])|175\.45\.(?:\d|[1-5]\d|6[0-3])|202\.126\.2(?:0[89]|1\d|2[0-3])|202\.130\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|202\.131\.(?:6[4-9]|7\d)|202\.155\.(?:19[2-9]|2\d\d)|210\.5\.1(?:[678]\d|9[01]))\.\d{1,3} /
describe IPC_NEWTT_HK [HK]Wharf T&T Limited Fixed Telecommunication Network Service (FTNS) Harbour City, Hong Kong SAR
score IPC_NEWTT_HK 1.5

header HONGKONG_NET_HK X-Spam-Relays-Untrusted =~ /^\[ ip=152\.104(?:\.\d{1,3}){2} /
describe HONGKONG_NET_HK [HK]imported inetnum object for HKI
score HONGKONG_NET_HK 1.5

header INFOMOVE_HK X-Spam-Relays-Untrusted =~ /^\[ ip=119\.42\.1(?:4[4-9]|5[012])\.\d{1,3} /
describe INFOMOVE_HK [HK]INFOMOVE SOLUTIONS LIMITED Unit 2001, 20/F, New Tech Plaza, 34 Tai Yau Street, San Po Kong, KLN
score INFOMOVE_HK 1.5

# 123.108.108.0-123.108.111.255
header PANGNET_HK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:103\.246\.24[4-7]|123\.108\.1(?:0[89]|1[01])|182\.237\.[0-3])\.\d{1,3} /
describe PANGNET_HK [HK]Pang International Limited
score PANGNET_HK 1.5

header PACNET_HK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:58\.145\.(?:19[2-9]|2\d\d)|61\.47\.(?:\d|\d\d|1[01]\d|12[0-7])|202\.64\.\d{1,3}|203\.121\.1(?:2[89]|[3-8]\d|9[01])|203\.152\.(?:\d|[1-5]\d|6[0-3])|210\.24\.\d{1,3}|(?:210\.17|220\.232)\.(?:12[89]|1[3-9]\d|2\d\d))\.\d{1,3} /
describe PACNET_HK [HK]PACNET
score PACNET_HK 1.5

header PACIFICONENET_HK X-Spam-Relays-Untrusted =~ /^\[ ip=202\.180\.1(?:6\d|7[0-5])\.\d{1,3} /
describe PACIFICONENET_HK [HK]Pacific One Net Limited, Internet Service Provider, Hong Kong
score PACIFICONENET_HK 1.5

header ISERVICES_HK X-Spam-Relays-Untrusted =~ /^\[ ip=111\.92\.2(?:2[4-9]|3\d)\.\d{1,3} /
describe ISERVICES_HK [HK]Room 1204 , Chong Fat Comm Bldg
score ISERVICES_HK 1.5

header NET_SYS_HK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:27\.98\.(?:19[2-9]|20[0-7])|180\.214\.16[0-7])\.\d{1,3} /
describe NET_SYS_HK [HK]Net Sys International Limited - Internet Service Provider
score NET_SYS_HK 1.5

header WLIN_HK X-Spam-Relays-Untrusted =~ /^\[ ip=122\.10\.2(?:0\d|1[0-5])\.\d{1,3} /
describe WLIN_HK [HK]World Link International Network Co., Limited Unit D,16/F,Cheuk Nang Plaza 250 Hennessy Road, Wanchai HongKong
score WLIN_HK 1.5

# HTHKITNMC
header H3GHK_HK X-Spam-Relays-Untrusted =~ /^\[ ip=180\.188\.1(?:2[89]|[3-8]\d|9[01])\.\d{1,3} /
describe H3GHK_HK [HK]DOMAIN FIVE ENTERPRISES LIMITED Internet Service Provider Kwaichung
score H3GHK_HK 1.5

header SMARTONE_HK X-Spam-Relays-Untrusted =~ /^\[ ip=121\.202\.5\d\.\d{1,3} /
describe SMARTONE_HK [HK]31/F, Millennium City 2, 378 Kwun Tong Road, Kwun Tong, Kowloon, Hong Kong
score SMARTONE_HK 1.5

header BBTEC_HK X-Spam-Relays-Untrusted =~ /^\[ ip=103\.29\.7[2-5]\.\d{1,3} /
describe BBTEC_HK [HK]Tower One,Royal Sea Crest,8 Lung Road,New Territories
score BBTEC_HK 1.5

header HKT_HK X-Spam-Relays-Untrusted =~ /^\[ ip=202\.4\.(?:19[2-9]|2[01]\d|22[0-3])\.\d{1,3} /
describe HKT_HK [HK]Hong Kong Telecommunications (HKT) Limited
score HKT_HK 1.5



# 203.215.80.0-203.215.95.255
# 203.115.144.0-203.115.159.255
# 203.115.128.0-203.115.159.255
# 203.115.176.0-203.115.191.255
# 203.115.128.0-203.115.191.255
# 121.96.0.0 - 121.97.255.255
header SKYINET_PH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:121\.9[67](?:\.\d{1,3}){2}|114\.108\.(?:19[2-9]|2\d\d)\.\d{1,3}|203\.(?:115\.1(?:2[89]|[3-8]\d|9[01])|215\.(?:8[0-9]|9[0-5]))\.\d{1,3}) /
describe SKYINET_PH [PH]Bayan Telecommunications Inc.
score SKYINET_PH 1.5

# 203.82.16.0 - 203.82.23.255
header DEFENSNET X-Spam-Relays-Untrusted =~ /^\[ ip=203\.82\.(?:1[6-9]|2[0-3])\.\d{1,3} /
describe DEFENSNET [PH]DEFENSNET, Hosting Service and Content Provider from Antonio Defensor Consulting
score DEFENSNET 1.5

# 210.4.0.0 - 210.4.63.255
header BAYANTELDSL_AP X-Spam-Relays-Untrusted =~ /^\[ ip=(?:125\.212\.(?:\d|\d\d|1[01]\d|12[0-7])|202\.78\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|210\.4\.(\d|[1-5]\d|6[0-3]))\.\d{1,3} /
describe BAYANTELDSL_AP [PH]Bayantel DSL Infrastructure
score BAYANTELDSL_AP 1.5

# 202.78.96.0-202.78.111.255
# SKYBB8 PILIPINO CABLE CORPORATION
# skycable.com
header SKYCABLENET_PH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:111\.68\.(?:3[2-9]|[45]\d|6[0-3])|114\.108\.(?:19[2-9]|2\d\d)|202\.78\.(?:9[6-9]|10\d|11[01]))\.\d{1,3} /
describe SKYCABLENET_PH [PH]Sky Internet http://www.skyinet.net/
score SKYCABLENET_PH 1.5



# 210.14.0.0 - 210.14.31.255
# 124.104.0.0 - 124.107.255.255
# 58.71.0.0 - 58.71.127.255
# 58.69.0.0 - 58.69.255.255
# 122.52.0.0 - 122.55.255.255
# 122.2.0.0 - 122.3.255.255
# 119.92.0.0 - 119.95.255.255
#PHIX PLDT
header IPG_PH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:49\.1(?:4[4-9]|5[01])|58\.69|119\.9[2-5]|122\.(?:[23]|5[2-5])|124\.10[4-7])(?:\.\d{1,3}){2}|(?:58\.71\.(?:\d|\d\d|1[01]\d|12[0-7])|210\.1\.(?:6[4-9]|[78]\d|9[0-5])|210\.14\.(?:\d|[12]\d|3[01])|210\.213\.(?:6[4-9]|[789]\d|[12]\d\d))\.\d{1,3}) /
describe IPG_PH [PH]Philippine Long Distance Telephone Company
score IPG_PH 1.5

# 58.69.0.0 - 58.69.127.0
header PLDTDSL_PH X-Spam-Relays-Untrusted =~ /^\[ ip=58\.69\.(\d|[1-9]\d|1[01]\d|12[0-7])\.\d{1,3} /
describe PLDTDSL_PH [PH]DSL_Consumer
score PLDTDSL_PH 1.5

# 203.131.64.0 - 203.131.191.255
header INFOCOM_PH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:111\.221\.[0-7]|203\.131\.(6[4-9]|[7-9]\d|1[0-8]\d|19[01]))\.\d{1,3} /
describe INFOCOM_PH [PH]INFOCOM Technologies Inc
score INFOCOM_PH 1.5

# 124.6.128.0 - 124.6.191.255
# 203.177.0.0 - 203.177.255.255
# 222.127.0.0 - 222.127.127.255
header GLOBET_PH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:124\.6\.1(2[89]|[3-8]\d|9[01])\.\d{1,3}|(203\.177|222\.127)(?:\.\d{1,3}){2}) /
describe GLOBET_PH [PH]Globe Telecom/Innove Communication
score GLOBET_PH 1.5

# 210.23.96.0 - 210.23.127.255
header PI_PH X-Spam-Relays-Untrusted =~ /^\[ ip=210\.23\.(9[6-9]|1[01]\d|12[0-7])\.\d{1,3} /
describe PI_PH [PH]Pacific Internet Philippines
score PI_PH 1.5

# 124.104.176.0 - 124.104.191.255
header CONS_PH X-Spam-Relays-Untrusted =~ /^\[ ip=124\.104\.1(7[6-9]|8\d|9[01])\.\d{1,3} /
describe CONS_PH [PH]GNTC7300i02_Consumer
score CONS_PH 1.5

# 203.167.0.0 - 203.167.31.255
header TRIDEL_TECH_PH X-Spam-Relays-Untrusted =~ /^\[ ip=203\.167\.(\d|[12]\d|3[01])\.\d{1,3} /
describe TRIDEL_TECH_PH [PH]Tridel Technologies, Inc.
score TRIDEL_TECH_PH 1.5

# 117.103.40.0 - 117.103.47.255
# 119.27.128.0 - 119.27.159.255
# 115.166.64.0 - 115.166.95.255
header INFOVISION_PH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:115\.166.(6[4-9]|[78]\d|9[0-5])|117\.103\.4[0-7]|119\.27\.1(2[89]|[345]\d))\.\d{1,3} /
describe INFOVISION_PH [PH]Infovision Data Hosting Services
score INFOVISION_PH 1.5

# 61.28.128.0 - 61.28.191.255
# 117.104.240.0 - 117.104.255.255
# 116.50.128.0 - 116.50.255.255
# 203.167.64.0 - 203.167.95.255
header ETPI_PH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.28\.1(?:2[89]|[3-8]\d|9[01])|112\.199\.(?:\d|\d\d|1[01]\d|12[0-7])|113\.61\.(?:3[2-9]|[45]\d|6[0-3])|(?:112\.196|115\.84)\.2(?:2[4-9]|[345]\d)|115\.85\.(?:\d|[1-5]\d|6[0-3])|116\.50\.(?:12[89]|1[3-9]\d|2\d\d)|117\.104\.2[45]\d|120\.89\.(?:\d|[1-5]\d|6[0-3])|180\.232\.\d{1,3}|202\.164\.(?:1[678]\d|19[01])|202\.167\.(?:9[6-9]|1[01]\d|12[0-7])|202\.175\.(?:19[2-9]|2\d\d)|203\.167\.(?:6[4-9]|[78]\d|9[0-5]))\.\d{1,3} /
describe ETPI_PH [PH]Eastern Telecoms Philippines, Inc.
score ETPI_PH 1.5

header GLOBALSPEED_PH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:27\.123\.2(?:2[4-9]|[345]\d)|27\.124\.(?:6[4-9]|7\d)|180\.94\.(?:\d|[12]\d|3[01])|182\.54\.1(?:2[89]|[345]\d))\.\d{1,3} /
describe GLOBALSPEED_PH [PH]GLOBALSPEED-PH
score GLOBALSPEED_PH 1.5

# 110.232.160.0-110.232.175.255
# 122.202.96.0 - 122.202.127.255
header NEXTWEB_PH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:110\.44\.1(?:2[89]|3\d|4[0-3])|110\.232\.1(?:6\d|7[0-5])|112\.109\.(?:\d|1[0-5])|113\.20\.1(?:[678]\d|9[01])|122\.202\.(?:9[6-9]|1[01]\d|12[0-7])|182\.255\.(?:3[2-9]|[45]\d|6[0-3]))\.\d{1,3} /
describe NEXTWEB_PH [PH]NEXT WEB PHIL
score NEXTWEB_PH 1.5

# 219.90.64.0 - 219.90.95.255
header INTERISLANDNET_PH X-Spam-Relays-Untrusted =~ /^\[ ip=219\.90\.(?:6[4-9]|[78]\d|9[0-5])\.\d{1,3} /
describe INTERISLANDNET_PH [PH]INTERISLANDNET Internet Service Provider
score INTERISLANDNET_PH 1.5

# 121.58.192.0 - 121.58.255.255
header COMCLARK_PH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:111\.125|120\.29)\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|121\.58\.(?:19[2-9]|2\d\d)|210\.4\.(?:9[6-9]|1[01]\d|12[0-7]))\.\d{1,3} /
describe COMCLARK_PH [PH]Comclark Bldg. Pres. M.A. Roxas Hi-way, CSEZ Clarkfield, Pampanga
score COMCLARK_PH 1.5

header DIGITELONE_PH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:115\.147|180\.19[2-5])(?:\.\d{1,3}){2}|115\.146\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}) /
describe DIGITELONE_PH [PH]Digitel Philippines
score DIGITELONE_PH 1.5

header LBNI_PH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:27\.110|110\.54)\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3} /
describe LBNI_PH [PH]Liberty Broadcasting Network Inc.
score LBNI_PH 1.5

# 192-223
# 120.72.16.0 - 120.72.31.255
header DCTECH_PH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:120\.72\.(?:1[6-9]|2\d|3[01])|202\.133\.(?:19[2-9]|2[01]\d|22[0-3]))\.\d{1,3} /
describe DCTECH_PH [PH]DctecH Micro Services, Inc.
score DCTECH_PH 1.5

header BELLTELECOM_PH X-Spam-Relays-Untrusted =~ /^\[ ip=202\.86\.(?:19[2-9]|20[0-7])\.\d{1,3} /
describe BELLTELECOM_PH [PH]Bell Telecommunications Philippines, Inc. 4th floor Pacific Star Bldg. Sen. Gil Puyat Avenue cor. Makati Avenue, Makati City, Philippines
score BELLTELECOM_PH 1.5

header SMARTBRO_PH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:121\.54\.(?:\d|\d\d|1[01]\d|12[0-7])|(?:125\.60|203\.87)\.(?:12[89]|1[3-9]\d|2\d\d)|175\.158\.(?:19[2-9]|2\d\d))\.\d{1,3} /
describe SMARTBRO_PH [PH]Smart Broadband Incorporated Wireless Broadband Access Ayala Avenue, Makati City
score SMARTBRO_PH 1.5

header YOURWEBSTREAM_PH X-Spam-Relays-Untrusted =~ /^\[ ip=101\.78\.(?:1[6-9]|2\d|3[01])\.\d{1,3} /
describe YOURWEBSTREAM_PH [PH]Webstream Bldg ,J Palma Gil Street, Davao City,Philippines
score YOURWEBSTREAM_PH 1.5

header HRWIRE2008_PH X-Spam-Relays-Untrusted =~ /^\[ ip=14\.192\.(?:\d|[12]\d|3[01])\.\d{1,3} /
describe HRWIRE2008_PH [PH]Ground Floor TBS Bldg., Corrales Avenue,Cagayan de Oro City, Philippines
score HRWIRE2008_PH 1.5

header MARBELNETWORKS_PH X-Spam-Relays-Untrusted =~ /^\[ ip=119\.42\.(?:3[2-9]|[45]\d|6[0-3])\.\d{1,3} /
describe MARBELNETWORKS_PH [PH]Gnd Flr , Marbel Telecom Bldg General Paulino Drive
score MARBELNETWORKS_PH 1.5

header CABLE51_PH X-Spam-Relays-Untrusted =~ /^\[ ip=202\.5\.(?:1[6-9]|2\d|3[01])\.\d{1,3} /
describe CABLE51_PH [PH]Pendatun Avenue, cor National Highway
score CABLE51_PH 1.5

header DESTINYNOC_PH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:202\.8\.2(?:2[4-9]|[345]\d)|202\.128\.(?:2[2-9]|[345]\d|6[0-3]))\.\d{1,3} /
describe DESTINYNOC_PH [PH]Destiny Inc. Cable Internet Service Provider Makati City, Philippines
score DESTINYNOC_PH 1.5


# 220.255.0.0 - 220.255.255.255
# 219.74.0.0 - 219.75.127.255
# 121.6.0.0 - 121.7.255.255
# header SINGNET_SG X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:58\.185|119\.74|121\.[67]|203\.127|219\.74|220\.255)(?:\.\d{1,3}){2}|116\.12\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|(?:203\.125|219\.75)\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}) /
header SINGNET_SG X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:58\.185|116\.1[45]|119\.74|121\.[67]|203\.12[67]|219\.74|220\.255)(?:\.\d{1,3}){2}|(?:115\.42|116\.12|119\.73)\.(?:12[89]|1[3-9]\d|2\d\d)\.\d{1,3}|(?:203\.125|219\.75)\.(?:\d|\d\d|1[01]\d|12[0-7])\.\d{1,3}|203\.126\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])\.\d{1,3}) /
describe SINGNET_SG [SG]SingNet Pte Ltd
score SINGNET_SG 1.5

# 222.164.0.0 - 222.165.127.255
# header SGCABLEVISION_SG X-Spam-Relays-Untrusted =~ /ip=(222\.164(\.\d{1,3}){2}|222\.165\.(\d|[1-9]\d|1[01]\d|12[0-7])\.\d{1,3}) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
# StarHub HSPA HSDPA STARHUB starhub AS4657
header SGCABLEVISION_SG X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:58\.182|59\.189|116\.8[678]|202\.156|203\.11[67]|218\.186|222\.164)(?:\.\d{1,3}){2}|58\.146\.(?:12[89]|1[3-8]\d|19[01])\.\d{1,3}|61\.8\.(?:19[2-9]|2\d\d)\.\d{1,3}|113\.10\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])\.\d{1,3}|117\.20\.1(?:2[89]|[3-8]\d|9[01])\.\d{1,3}|124\.155\.(?:19[2-9]|2[01]\d|22[0-3])\.\d{1,3}|202\.156\.(9[6-9]|1[01]\d|12[0-7])\.\d{1,3}|(?:27\.54|203\.118)\.(\d|[1-5]\d|6[0-3])\.\d{1,3}|222\.165\.(\d|[1-9]\d|1[01]\d|12[0-7])\.\d{1,3}) /
describe SGCABLEVISION_SG [SG]StarHub Cable Vision Ltd Singapore Broadband Access Provider
score SGCABLEVISION_SG 1.5

header MOBILEONE_SG X-Spam-Relays-Untrusted =~ /^\[ ip=(?:27\.104\.\d{1,3}|49\.245\.\d{1,3}|112\.199\.(?:12[89]|1[3-9]\d|2\d\d)|116\.197\.(?:19[2-9]|2\d\d)|(?:119\.56|124\.197)\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|175\.156\.\d{1,3}|180\.129\.(?:\d|\d\d|1[01]\d|12[0-7]))\.\d{1,3} /
describe MOBILEONE_SG [SG]MobileOne Ltd
score MOBILEONE_SG 1.5

# SPARKSTATION PTE LTD
# AIDI-SG
header QALA_SG X-Spam-Relays-Untrusted =~ /^\[ ip=(?:112\.140\.18[4-7]|120\.50\.(?:3[2-9]|4[0-7])|180\.210\.20[0-7]|(?:202\.63|203\.211)\.1(?:2[89]|[345]\d)|202\.172\.(?:3[2-9]|[45]\d|6[0-3])|210\.193\.(?:\d|[1-5]\d|6[0-3]))\.\d{1,3} /
describe QALA_SG [SG]M1 CONNECT PTE. LTD.
score QALA_SG 1.5

header SKYDIO_SG X-Spam-Relays-Untrusted =~ /^\[ ip=(?:114\.129\.(?:3[2-9]|4[0-7])|203\.83\.250|203\.169\.[67])\.\d{1,3} /
describe SKYDIO_SG [SG]Skydio Pte Ltd, Server Hosting Provider, Singapore
score SKYDIO_SG 1.5

header EQUINIXAP_NET_SG X-Spam-Relays-Untrusted =~ /^\[ ip=(?:122\.50\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|202\.167\.2(?:2[4-9]|[345]\d)|202\.177\.(?:19[2-9]|2[01]\d|22[0-3])|203\.190\.2(?:2[4-9]|3\d))\.\d{1,3} /
describe EQUINIXAP_NET_SG [SG]Equinix Asia Pacific
score EQUINIXAP_NET_SG 1.5

header NEWMEDIAEXPRESS_SG X-Spam-Relays-Untrusted =~ /^\[ ip=202\.150\.2(?:0[89]|1\d|2[0-3])\.\d{1,3} /
describe NEWMEDIAEXPRESS_SG [SG]NewMedia Express Pte Ltd, Singapore Web Hosting
score NEWMEDIAEXPRESS_SG 1.5

# 202.172.160.0 - 202.172.255.255
header ONE_NET_SG X-Spam-Relays-Untrusted =~ /^\[ ip=202\.172\.(?:1[6-9]\d|2\d\d)\.\d{1,3} /
describe ONE_NET_SG [SG]1-Net Singapore Pte Ltd
score ONE_NET_SG 1.5

header TPNET_SG X-Spam-Relays-Untrusted =~ /^\[ ip=152\.226(?:\.\d{1,3}){2} /
describe TPNET_SG [SG]imported inetnum object for TEMASE
score TPNET_SG 1.5

# 203.142.10.0 - 203.142.31.255
header WEBVISIONS_SG X-Spam-Relays-Untrusted =~ /^\[ ip=(?:123\.100\.2(?:2[4-9]|[345]\d)|202\.157\.1(?:2[89]|[3-8]\d)|203\.142\.(?:[12]\d|3[01]))\.\d{1,3} /
describe WEBVISIONS_SG [SG]Webvisions Pte Ltd
score WEBVISIONS_SG 1.5

header USONYX_NET_SG X-Spam-Relays-Untrusted =~ /^\[ ip=113\.197\.3[2-9]\.\d{1,3} /
describe USONYX_NET_SG [SG]USONYX Singapore Broadband Web Hosting Services Sumitomo Shibadaimon Bldg. 10F 2-5-5, Shibadaimon Minato-ku, Tokyo 105-0012 Japan
score USONYX_NET_SG 1.5

header SINGTEL_SG X-Spam-Relays-Untrusted =~ /^\[ ip=(?:119\.234\.\d{1,3}|202\.63\.2(?:2[4-9]|3\d))\.\d{1,3} /
describe SINGTEL_SG [SG]SingTel Ltd Regional Satelite Business Service Provider Singapore
score SINGTEL_SG 1.5


# 203.208.64.0 - 203.208.127.255
header HFCCABLE_AU X-Spam-Relays-Untrusted =~ /ip=203\.208\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\.\d{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe HFCCABLE_AU [AU]Provider of  Internet, Telecommunications services and PayTV over Broadband HFC cable network throughout regional VIC.
score HFCCABLE_AU 1.5

header OPTUSINTERNET_AU X-Spam-Relays-Untrusted =~ /^\[ ip=(?:1\.4[0-3]|42\.241|58\.1(?:0[4-9]|1[01])|114\.7[2-5]|119\.225|122\.1(?:0[4-9]|1[01])|220\.23[6-9])(?:\.\d{1,3}){2} /
describe OPTUSINTERNET_AU [AU]OPTUS INTERNET - RETAIL INTERNET SERVICES
score OPTUSINTERNET_AU 1.5

header TELSTRAINTERNET_AU X-Spam-Relays-Untrusted =~ /^\[ ip=(?:1\.1[2-5]\d|58\.1(?:6\d|7[0-5])|60\.2(?:2[4-9]|3[01])|101\.1(?:[678]\d|9[01])|110\.14[0-3]|120\.1(?:4[4-9]|5\d)|121\.2(?:0[89]|1\d|2[0-3])|144\.13[12]|203\.(?:3[6-9]|4[0-7]))(?:\.\d{1,3}){2} /
describe TELSTRAINTERNET_AU [AU]Telstra Internet
score TELSTRAINTERNET_AU 1.5

header RWTS_AU X-Spam-Relays-Untrusted =~ /^\[ ip=114\.141\.(?:9[6-9]|10\d|11[01])\.\d{1,3} /
describe RWTS_AU [AU]Real World Internet
score RWTS_AU 1.5

header TPG_AU X-Spam-Relays-Untrusted =~ /^\[ ip=(?:27\.3[23]|60\.24[01]|110\.17[45]|115\.64|220\.24[45])(?:\.\d{1,3}){2} /
describe TPG_AU [AU]TPG Internet Pty Ltd.
score TPG_AU 1.5

header DODO_AU X-Spam-Relays-Untrusted =~ /^\[ ip=(?:122\.1(?:4[89]|5[01])|123\.[23])(?:\.\d{1,3}){2} /
describe DODO_AU [AU]Layer 2 Broadband Customer Network
score DODO_AU 1.5

header IINET_AU X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:58\.[67]|124\.1(?:4[89]|7[01]))\.\d{1,3}|202\.72\.1(?:2[89]|[3-8]\d|9[01]))\.\d{1,3} /
describe IINET_AU [AU]iiNet Limited
score IINET_AU 1.5

header VODAFONE_AU X-Spam-Relays-Untrusted =~ /^\[ ip=(?:101\.11[2-9]|120\.(?:1[6-9]|2[0-3]))(?:\.\d{1,3}){2} /
describe VODAFONE_AU [AU]Vodafone Australia Pty. Mobile Service Provider 799 Pacific Highway Chatswood NSW 2067
score VODAFONE_AU 1.5

header M2TELECOMMUNICATIONS_AU X-Spam-Relays-Untrusted =~ /^\[ ip=111\.220(?:\.\d{1,3}){2} /
describe M2TELECOMMUNICATIONS_AU [AU]M2 Telecommunications Group Ltd
score M2TELECOMMUNICATIONS_AU 1.5

header VIVIDWIRELESS_AU X-Spam-Relays-Untrusted =~ /^\[ ip=180\.216(?:\.\d{1,3}){2} /
describe VIVIDWIRELESS_AU [AU]vividwireless Pty Ltd Level 21, 1 Market Street, Sydney, NSW 2000
score VIVIDWIRELESS_AU 1.5


# 203.81.192.0 - 203.81.239.255
# header WORLDCALL_PK X-Spam-Relays-Untrusted =~ /ip=203\.81\.(19[2-9]|2[0-3]\d)\.\d{1,3} [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
header WORLDCALL_PK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:115\.186\.(?:\d|\d\d|1[01]\d|12[0-7])|117\.102\.(?:\d|[1-5]\d|6[0-3])|203\.81\.(?:19[2-9]|2[0-3]\d))\.\d{1,3} /
describe WORLDCALL_PK [PK]WorldCALL Multimedia Ltd
score WORLDCALL_PK 1.5

# 119.152.0.0 - 119.159.255.255
# 221.120.192.0 - 221.120.255.255
header PTCL_PK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:39\.(?:3[2-9]|[45]\d|6[0-3])|59\.103|116\.71|119\.15[2-9]|182\.1(?:7[6-9]|8\d|9[01]))(?:\.\d{1,3}){2}|(?:203\.99\.1(?:[678]\d|9[01])|203\.135\.(?:\d|[1-5]\d|6[0-3])|221\.120\.(?:19[2-9]|2\d\d))\.\d{1,3}) /
describe PTCL_PK [PK]Pakistan Telecommunication Company Limited
score PTCL_PK 1.5

header LINKDOTNET_PK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:119\.30\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|119\.73\.(?:\d|\d\d|1[01]\d|12[0-7])|202\.61\.(?:3[2-9]|[45]\d|6[0-3])|203\.223\.1(?:6\d|7[0-5])|210\.2\.(?:12[89]|1[3-8]\d|19[01]))\.\d{1,3} /
describe LINKDOTNET_PK [PK]LINKdotNET Telecom Limited
score LINKDOTNET_PK 1.5

header CYBERNET_PK X-Spam-Relays-Untrusted =~ /^\[ ip=61\.5\.1(?:2[89]|[345]\d)\.\d{1,3} /
describe CYBERNET_PK [PK]CYBER INTERNET SERVICES (PVT.) LTD. PAKISTAN BASED ISP
score CYBERNET_PK 1.5

# SNET-PK
header MULTINETBROADBAND_PK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:118\.107\.1(?:2[89]|3\d|4[0-3])|125\.209\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7]))\.\d{1,3} /
describe MULTINETBROADBAND_PK [PK]MULTINETBROADBAND Karachi
score MULTINETBROADBAND_PK 1.5

header NTCPKNET_PK X-Spam-Relays-Untrusted =~ /^\[ ip=202\.83\.1(?:6\d|7[0-5])\.\d{1,3} /
describe NTCPKNET_PK [PK]National Telecom Corporation Sector F 5/1, Islamabad Pakistan
score NTCPKNET_PK 1.5

header WATEEN_PK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:58\.27\.(?:12[89]|1[3-9]\d|2\d\d)|110\.3[6-9]\.\d{1,3})\.\d{1,3} /
describe WATEEN_PK [PK]National WiMAX/IMS environment
score WATEEN_PK 1.5

# MAINT-PK-BURRAQTEL-ASADKARIM
header WITRIBE_PK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:115\.167\.(?:\d|\d\d|1[01]\d|12[0-7])|(?:139\.190|175\.110)\.\d{1,3})\.\d{1,3} /
describe WITRIBE_PK [PK]Telecom Services (DLI/WLL) Provider
score WITRIBE_PK 1.5


header NEXLINX_PK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:116\.58\.(?:\d|\d\d|1[01]\d|12[0-7])|202\.59\.(?:6[4-9]|[78]\d|9[0-5]))\.\d{1,3} /
describe NEXLINX_PK [PK]Nexlinx ISP Pakistan Nexlinx Networks
score NEXLINX_PK 1.5

header GERRYSNET_PK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:202\.69\.(?:3[2-9]|4[0-6])|202\.142\.1(?:4[4-9]|5\d))\.\d{1,3} /
describe GERRYSNET_PK [PK]Gerrys Information Technology (PVT) Ltd 4th Floor,Central Hotel Building, Mereweather Road Karachi
score GERRYSNET_PK 1.5

header FIBERLINK_PK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:27\.255\.(?:\d|[1-5]\d|6[0-3])|110\.34\.3[2-9])\.\d{1,3} /
describe FIBERLINK_PK [PK]611 6th Floor Park Avenue
score FIBERLINK_PK 1.5

header NTCISP_PK X-Spam-Relays-Untrusted =~ /^\[ ip=175\.107\.(?:\d|[1-5]\d|6[0-3])\.\d{1,3} /
describe NTCISP_PK [PK]National Telecommunication Corporation NTC Headquarters Sector F-5/1
score NTCISP_PK 1.5


# 222.165.128.0 - 222.165.191.255
header LKTELECOM_LK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:(?:112\.13[45]|124\.43)\.\d{1,3}|222\.165\.(?:12[89]|1[3-8]\d|139[01]))\.\d{1,3} /
describe LKTELECOM_LK [LK]Sri Lanka Telecom Internet Service Provider in Sri Lanka
score LKTELECOM_LK 1.5

# 123.231.0.0 - 123.231.127.255
# DIALOG
# Dialog Telekom PLC
# MAINT-LK-MTTADMIN
header MTT_LK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:111\.223\.1(?:2[89]|[3-8]\d|9[01])|123\.231\.(?:\d|\d\d|1[01]\d|12[0-7])|175\.157\.\d{1,3})\.\d{1,3} /
describe MTT_LK [LK]MTT Network Pvt Ltd 278, 4th Level, Aceccess towers, Union Place, descr: Colombo 02
score MTT_LK 1.5

header MOBITEL_LK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:61\.245\.1(?:6\d|7[0-5])|202\.129\.23[2-5])\.\d{1,3} /
describe MOBITEL_LK [LK]IS Group No 108 W A D Ramanayake Mawatha,
score MOBITEL_LK 1.5

header BELLNET_LK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:113\.59\.(?:19[2-9]|2[01]\d|22[0-3])|119\.235\.(?:\d|1[0-5]))\.\d{1,3} /
describe BELLNET_LK [LK]LankaBell (pvt) Limited, WLL, Broad band Telecom provider, ISP Colombo Sri Lanka
score BELLNET_LK 1.5

header ETISALATLKNET_LK X-Spam-Relays-Untrusted =~ /^\[ ip=203\.189\.1(?:8[4-9]|9[01])\.\d{1,3} /
describe ETISALATLKNET_LK [LK]Etisalat Lanka (Private) Ltd
score ETISALATLKNET_LK 1.5

# 112.135.-
# 220.247.192-
header SLT_LK X-Spam-Relays-Untrusted =~ /^\[ ip=(?:112\.135\.\d{1,3}|220\.247\.(?:19[2-9]|2\d\d))\.\d{1,3} /
describe SLT_LK [LK]SRI LANKA TELECOM Internet Division 7th floor OTS Building Sri Lanka Telecom Lotus Road Colombo-1
score SLT_LK 1.5

header AIRTEL_LK X-Spam-Relays-Untrusted =~ /^\[ ip=101\.2\.1(?:7[6-9]|8\d|9[01])\.\d{1,3} /
describe AIRTEL_LK [LK]Bharti Airtel Lanka Pvt. Limited 598, Elvitigala Mawatha
score AIRTEL_LK 1.5


header DCL_BD X-Spam-Relays-Untrusted =~ /^\[ ip=202\.4\.(?:9[6-9]|1[01]\d|12[0-7])\.\d{1,3} /
describe DCL_BD [BD]DhakaCom Limited
score DCL_BD 1.5

header BTTB_BD X-Spam-Relays-Untrusted =~ /^\[ ip=(?:123\.49\.(?:\d|[1-5]\d|6[0-3])|180\.211\.(?:12[89]|1[3-9]\d|2\d\d)|202\.79\.(?:1[6-9]|2[0-3])|203\.112\.(?:19[2-9]|2[01]\d|22[0-3]))\.\d{1,3} /
describe BTTB_BD [BD]Bangladesh Telecommunications Company Ltd. (BTCL)
score BTTB_BD 1.5

header AGNISYS_BD X-Spam-Relays-Untrusted =~ /^\[ ip=116\.68\.(?:19[2-9]|20[0-7])\.\d{1,3} /
describe AGNISYS_BD [BD]Agni Systems Ltd. Navana Tower, 11th Floor, Suite-A 45 Gulshan Avenue, Gulshan-1, Dhaka-1212.
score AGNISYS_BD 1.5

header GRAMEENPHONEIT_BD X-Spam-Relays-Untrusted =~ /^\[ ip=119\.30\.(?:3[2-9]|4[0-7])\.\d{1,3} /
describe GRAMEENPHONEIT_BD [BD]Grameenphone Ltd. Telecommunication Company Internet service provider via GPRS/EDGE Dhaka, Bangladesh
score GRAMEENPHONEIT_BD 1.5

header DAFFODILNET_BD X-Spam-Relays-Untrusted =~ /^\[ ip=203\.190\.(?:[89]|1[0-5])\.\d{1,3} /
describe DAFFODILNET_BD [BD]Daffodil Online Limited, Internet Service Provider, Dhaka, Bangladesh
score DAFFODILNET_BD 1.5

header ALAPCOM_BD X-Spam-Relays-Untrusted =~ /^\[ ip=202\.161\.1(?:7[6-9]|8\d|9[01])\.\d{1,3} /
describe ALAPCOM_BD [BD]ALAPCOMMUNICATION Alap Communication Ltd. ,Data/Internet Service Provider,Bangladesh
score ALAPCOM_BD 1.5

header BDCOM_BD X-Spam-Relays-Untrusted =~ /^\[ ip=210\.4\.(?:6[4-9]|7\d)\.\d{1,3} /
describe BDCOM_BD [BD]BDCOM Online Limited, Internet Service Provider, Dhaka, Bangladesh
score BDCOM_BD 1.5



header GEMNET_MN X-Spam-Relays-Untrusted =~ /^\[ ip=180\.149\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])\.\d{1,3} /
describe GEMNET_MN [MN]Code M building #305
score GEMNET_MN 1.5

header YOKOZUNANET_MN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:49\.0\.(?:12[89]|1[3-9]\d|2\d\d)|180\.235\.1(?:[678]\d|9[01]))\.\d{1,3} /
describe YOKOZUNANET_MN [MN]internet service provider ulaanbaatar, mongolia
score YOKOZUNANET_MN 1.5

# BODICOM 
header MONGOLNET_MN X-Spam-Relays-Untrusted =~ /^\[ ip=202\.170\.(?:6[4-9]|[78]\d|9[0-5])\.\d{1,3} /
describe MONGOLNET_MN [MN]Bodicomputer Co.,ltd. Ulaanbaatar,MONGOLIA
score MONGOLNET_MN 1.5

header MCSCOM_MN X-Spam-Relays-Untrusted =~ /^\[ ip=202\.70\.(?:3[2-9]|4[0-7])\.\d{1,3} /
describe MCSCOM_MN [MN]The first E-commerce ISP in Mongolia.
score MCSCOM_MN 1.5

header CITINET_MN X-Spam-Relays-Untrusted =~ /^\[ ip=124\.158\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])\.\d{1,3} /
describe CITINET_MN [MN]CITINET LLC
score CITINET_MN 1.5

header MOBINET_MN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:202\.21\.(?:9[6-9]|1[01]\d|12[0-7])|202\.131\.2(?:2[4-9]|[345]\d))\.\d{1,3} /
describe MOBINET_MN [MN]MobiCom Corporation Ulaanbaatar
score MOBINET_MN 1.5

header ULUSNET_MN X-Spam-Relays-Untrusted =~ /^\[ ip=202\.126\.(?:8[89]|9[0-5])\.\d{1,3} /
describe ULUSNET_MN [MN]Ulusnet, ISP, Ulaanbaatar, Mongolia
score ULUSNET_MN 1.5

header ERDEMNET_MN X-Spam-Relays-Untrusted =~ /^\[ ip=202\.5\.(?:19[2-9]|20[0-7])\.\d{1,3} /
describe ERDEMNET_MN [MN]ERDEMNET ISP Center, Computer Science Management School of MUST P.O.Box - 313, Postal code - 210349 Ulaanbaatar - 49, Mongolia
score ERDEMNET_MN 1.5

header TELEMAX_MN X-Spam-Relays-Untrusted =~ /^\[ ip=(?:103\.23\.(?:4[89]|5[01])|202\.9\.4[0-7])\.\d{1,3} /
describe TELEMAX_MN [MN]Telemax Communication 3rd Floor Azmon Building Peace avenue SBD
score TELEMAX_MN 1.5

header SKYCC_MN X-Spam-Relays-Untrusted =~ /^\[ ip=202\.55\.1(?:7[6-9]|8\d|9[01])\.\d{1,3} /
describe SKYCC_MN [MN]SKYCC, VoIP and ISP, Ulaanbaatar, Mongolia
score SKYCC_MN 1.5

header RAILCOM_MN X-Spam-Relays-Untrusted =~ /^\[ ip=202\.72\.24[0-7]\.\d{1,3} /
describe RAILCOM_MN [MN]Mongolian Railway Commercial Center - Railcom,
score RAILCOM_MN 1.5

header DIGICOM_MN X-Spam-Relays-Untrusted =~ /^\[ ip=203\.169\.(?:4[89]|5[0-5])\.\d{1,3} /
describe DIGICOM_MN [MN]MN-DIGICOM-20081224
score DIGICOM_MN 1.5

header KEWIKONET_MN X-Spam-Relays-Untrusted =~ /^\[ ip=103\.10\.2[0-3]\.\d{1,3} /
describe KEWIKONET_MN [MN]15 Seoul street  Suite #3 2-r Horoo Bayangol District
score KEWIKONET_MN 1.5



header CTM_MO X-Spam-Relays-Untrusted =~ /^\[ ip=(?:60\.246\.\d{1,3}|122\.100\.(?:12[89]|1[3-9]\d|2\d\d)|180\.94\.1(?:2[89]|[3-8]\d|9[01])|(?:125\.31|182\.93)\.(?:\d|[1-5]\d|6[0-3])|202\.175\.(?:\d|\d\d|1[01]\d|12[0-7]))\.\d{1,3} /
describe CTM_MO [MO]Companhia de Telecomunicacoes de Macau
score CTM_MO 1.5

header VIETTEL_CAMBODIA_KH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:36.37.(?:12[89]|1[3-9]\d|2\d\d)|111.118.1(?:2[89]|[345]\d)|117\.120\.(?:2[4-9]|3[01])|175\.100\.(?:\d|\d\d|1[01]\d|12[0-7]))\.\d{1,3} /
describe VIETTEL_CAMBODIA_KH [KH]VIETTEL (CAMBODIA) PTE., LTD.
score VIETTEL_CAMBODIA_KH 1.5

header CAMSHIN_KH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:114\.29\.2(?:2[4-9]|[345]\d)|202\.71\.(?:3[2-9]|4[0-7]))\.\d{1,3} /
describe CAMSHIN_KH [KH]Cambodia Shinawatra Co., Ltd. 66 Mao Tse Toung Blvd., Phnom Penh, Cambodia
score CAMSHIN_KH 1.5

header WICAM_KH X-Spam-Relays-Untrusted =~ /^\[ ip=(?:119\.15\.(?:8\d|9[0-5])|202\.79\.(?:2[4-9]|3[01]))\.\d{1,3} /
describe WICAM_KH [KH]WiCAM ISP, Ltd. Internet Service Provider Phnom Penh, Cambodia
score WICAM_KH 1.5

header NEOCOM_KH X-Spam-Relays-Untrusted =~ /^\[ ip=123\.108\.2(?:4[89]|5\d)\.\d{1,3} /
describe NEOCOM_KH [KH]Neocomisp Internet Service Provider
score NEOCOM_KH 1.5

#DTV-STARNET
header DTVSTAR_KH X-Spam-Relays-Untrusted =~ /^\[ ip=111\.92\.24[0-3]\.\d{1,3} /
describe DTVSTAR_KH [KH]DTV-STar Co.,Ltd.Phnom Penh, Cambodia
score DTVSTAR_KH 1.5


header VZPACIFICA_MP X-Spam-Relays-Untrusted =~ /^\[ ip=(?:202\.88\.(?:6[4-9]|[78]\d|9[0-5])|210\.23\.(?:8\d|9[0-5]))\.\d{1,3} /
describe VZPACIFICA_MP [MP]Verizon Pacifica Telecommunications Northern Marianas Islands P.O. Box 500306 Saipan, MP 96950
score VZPACIFICA_MP 1.5


# 200.74.0.0 - 200.74.127.255
header METROPOLISINTERCOM Received =~ /from .+200\.74\.([0-9]|[1-9][0-9]|1([01][0-9]|2[0-7]))\.([0-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5])/
describe METROPOLISINTERCOM [CL]Metropolis Intercom
score METROPOLISINTERCOM 1.5

# 86.101.0.0 - 86.101.127.255
header UPCMK Received =~ /from .+86\.101\.([0-9]|[1-9][0-9]|1([01][0-9]|2[0-7]))\.[0-9]{1,3}/
describe UPCMK [HU]UPC Magyarorszag Kft.
score UPCMK 1.5

# 165.143.0.0 - 165.149.255.255
header TELKOMNET_ZA X-Spam-Relays-Untrusted =~ /(ip=165\.14[3-9](?:\.\d{1,3}){2}|rdns=dsl(-\d{1,3}){3}\.telkomadsl\.co\.za) [^\[\]]+ident= envfrom= intl=0 [^\[\]]+auth= /
describe TELKOMNET_ZA [ZA]Telkom SA Limited
score TELKOMNET_ZA 1.5

header TELECOMPLUS_MU X-Spam-Relays-Untrusted =~ /ip=202\.123\.(?:\d|[12]\d|3[01])\.\d{1,3} /
describe TELECOMPLUS_MU [MU]Telecom Plus Ltd 7th Floor, Telecom Tower Edith Cavell Street Port Louis
score TELECOMPLUS_MU 1.5

header LAOTELECOM_LA X-Spam-Relays-Untrusted =~ /^\[ ip=(?:115\.84\.(?:6[4-9]|[789]\d|1[01]\d|12[0-7])|202\.137\.1(?:2[89]|[345]\d))\.\d{1,3} /
describe LAOTELECOM_LA [LA]Telecommunication Service
score LAOTELECOM_LA 1.5

# STAR TELECOM
header UNITEL_LA X-Spam-Relays-Untrusted =~ /^\[ ip=183\.182\.1(?:1[2-9]|2[0-7])\.\d{1,3} /
describe UNITEL_LA [LA]PO box T511 Phonexay road - Xaysettha district
score UNITEL_LA 1.5


header OFFRATEL_NC X-Spam-Relays-Untrusted =~ /ip=(?:175\.158|202\.22)\.1(?:2[89]|[3-8]\d|9[01])\.\d{1,3} /
describe OFFRATEL_NC [NC]BP 8253 98807 Noumea Sud 101 route de l'Anse Vata Shop Center Vata 1er etage
score OFFRATEL_NC 1.5

header MLS_NC X-Spam-Relays-Untrusted =~ /^\[ ip=(?:118\.179\.2(?:4[4-9]|5\d)|202\.22\.2(?:2[4-9]|3\d))\.\d{1,3} /
describe MLS_NC [NC]Micro Logic Systems 28 rue FVvix Broche P.O BOX 13885 98 803 Noumea Cedex New Caledonia
score MLS_NC 1.5

#Bhutan
header BTTELECOM_BT X-Spam-Relays-Untrusted =~ /^\[ ip=(?:119\.2\.(?:9[6-9]|1[01]\d|12[0-7])|202\.144\.1(?:2[89]|[345]\d))\.\d{1,3} /
describe BTTELECOM_BT [BT]DrukNet, Bhutan Telecom Thimphu
score BTTELECOM_BT 1.5

#Timor-Leste
header TIMOR_TELECOM_TL X-Spam-Relays-Untrusted =~ /^\[ ip=180\.189\.1(?:6\d|7[0-5])\.\d{1,3} /
describe TIMOR_TELECOM_TL [TL]ISP network for Timor Telecom
score TIMOR_TELECOM_TL 1.5

#Maldives
#202.21.176.0-202.21.191.255
header FOCUSINFOCOM_MV X-Spam-Relays-Untrusted =~ /^\[ ip=202\.21\.1(?:7[6-9]|8\d|9[01])\.\d{1,3} /
describe FOCUSINFOCOM_MV [MV]Focus Infocom Pvt Ltd 4th Floor Fasmeeru Building Boduthakurufaanu Magu
score FOCUSINFOCOM_MV 1.5

header INSTA_AF X-Spam-Relays-Untrusted =~ /^\[ ip=(?:117\.104\.2(?:2[4-9]|3[01])|175\.106\.(?:3[2-9]|[345]\d|6[0-3]))\.\d{1,3} /
describe INSTA_AF [AF]Instatelecom Broadband Satellite, DSL, Wireless, Wi-Fi and Dial-Up Internet service provider.
score INSTA_AF 1.5


# 
# added 2007.01.21 by [yoh]
# modified 2007.07.04 by [yoh]
# 
header ONLY1HOPDIRECT X-Spam-Relays-Untrusted =~ /^\[ ip=(\d{1,3}\.){3}\d{1,3} [^\[\]]+ \]($| \[ ip=127\.0\.0\.1 rdns=localhost helo=localhost [^\[\]]+ \]$)/



# 1st BY is same 2nd HELO
# added 2007.07.08 by [yoh]
# 
header SAMEHELOBY2HOP X-Spam-Relays-Untrusted =~ /^\[ ip=(?:\d{1,3}\.){3}\d{1,3} rdns=[^\[\] ]* helo=([^\[\] ]+) by=(?:[^ ]+) [^\[\]]+ \] \[ ip=(?:\d{1,3}\.){3}\d{1,3} rdns=[^\[\] ]* helo=[a-z]{3,} by=\1 [^\[\]]+ \]/

mimeheader MIMEPDF Content-Type =~ /application\/pdf.+name=\".+\.pdf\"/
score MIMEPDF 0.1

meta PDFSPAM SAMEHELOBY2HOP && MIMEPDF && (ARIN || RIPE_NCC || LACNIC || AFRINIC || ___KOREATAIWANCHINA )
score PDFSPAM 3.5


# added 2007.08.02 by [yoh]
# modified 2007.08.18 by [yoh]
# 
full NULLTXTPDF /(\n(?:-{12,}0\d{22,}|--={19,}_\d{6,}==_|-{12,}[0-9A-F]{16,})\n)Content-Type: text\/plain; charset=\"{0,1}[\w-]{5,}\"{0,1}(?:; format=flowed){0,1}(?:\nContent-Transfer-Encoding: 7bit){0,1}\n{2,}\1Content-Type: application\/(?:pdf|octet-stream);(?:\n| name=\")/


meta NULLPDF_DCN (NULLTXTPDF || HTMLPDF) && ___DCN
score NULLPDF_DCN 3.5


# added 2008.01.02 by [yoh]
# modified 2008.02.10 by [yoh]
# 
full NULLTXTGIF /\nContent-Type: multipart\/mixed;\n  boundary=\"(----=_NextPart_000_000[6E]_0[0-9A-F]{7}\.[0-9A-F]{8}|----------[0-9A-F]{16})\"\n(?:.+\n)+\n(?:.+\n\n){0,1}--\1\nContent-Type: text\/plain;(| charset=.+)\n(?:.+\n){0,3}Content-Transfer-Encoding: 7bit\n{2,}--\1\nContent-Type: image\/gif;/


meta NULLGIF_OTHER NULLTXTGIF && (ARIN || RIPE_NCC || LACNIC || AFRINIC || ___KOREATAIWANCHINA )
score NULLGIF_OTHER 3.5
meta NULLGIF_CBL NULLTXTGIF && RCVD_IN_CBL
score NULLGIF_CBL 3.5
meta NULLGIF_SPAMCOP NULLTXTGIF && RCVD_IN_BL_SPAMCOP_NET
score NULLGIF_SPAMCOP 3.5
meta NULLGIF_DSBL NULLTXTGIF && RCVD_IN_DSBL
score NULLGIF_DSBL 3.5
# meta NULLGIF_DUL NULLTXTGIF && RCVD_IN_SORBS_DUL
# score NULLGIF_DUL 3.5


# added 2008.02.01 by [yoh]
# 
full NUMURLWITHWORDS /\n\n[A-Za-z]\S{0,10} (\S{1,10} ){1,}http:\/\/\d{2,3}(?:\.\d{1,3}){3}\/\n\n+$/

meta NUMURL_OTHER NUMURLWITHWORDS && (ARIN || RIPE_NCC || LACNIC || AFRINIC || ___KOREATAIWANCHINA )
score NUMURL_OTHER 3.5
meta NUMURL_CBL NUMURLWITHWORDS && RCVD_IN_CBL
score NUMURL_CBL 3.5
meta NUMURL_SPAMCOP NUMURLWITHWORDS && RCVD_IN_BL_SPAMCOP_NET
score NUMURL_SPAMCOP 3.5
meta NUMURL_DSBL NUMURLWITHWORDS && RCVD_IN_DSBL
score NUMURL_DSBL 3.5
# meta NUMURL_DUL NUMURLWITHWORDS && RCVD_IN_SORBS_DUL
# score NUMURL_DUL 3.5

# added 2008.03.01 by [yoh]
# 
full LONGCHARHTTP /\nContent-Type: text\/plain;\n(?:.+\n)+\n[A-Z][a-z]{2,}[A-Za-z]{15,}\nhttp:\/\/[a-z.]+[a-z]\n{1,}$/
meta L_C_HTTP_OTHER LONGCHARHTTP && (ARIN || RIPE_NCC || LACNIC || AFRINIC || ___KOREATAIWANCHINA )
score L_C_HTTP_OTHER 3.5
meta L_C_HTTP_CBL LONGCHARHTTP && RCVD_IN_CBL
score L_C_HTTP_CBL 3.5
meta L_C_HTTP_SPAMCOP LONGCHARHTTP && RCVD_IN_BL_SPAMCOP_NET
score L_C_HTTP_SPAMCOP 3.5
meta L_C_HTTP_DSBL LONGCHARHTTP && RCVD_IN_DSBL
score L_C_HTTP_DSBL 3.5
# meta L_C_HTTP_DUL LONGCHARHTTP && RCVD_IN_SORBS_DUL
# score L_C_HTTP_DUL 3.5

# added 2008.03.03 by [yoh]
# 
full CHATGIRL /\nContent-Type: text\/plain;\n(?:.+\n)+\nHello\! I am .+ I am .+ that would like to chat with you\. Email me at [A-Z][a-z]+@[A-Za-z.]+ only/
meta C_G_OTHER CHATGIRL && (ARIN || RIPE_NCC || LACNIC || AFRINIC || ___KOREATAIWANCHINA )
score C_G_OTHER 3.5
meta C_G_CBL CHATGIRL && RCVD_IN_CBL
score C_G_CBL 3.5
meta C_G_SPAMCOP CHATGIRL && RCVD_IN_BL_SPAMCOP_NET
score C_G_SPAMCOP 3.5
meta C_G_DSBL CHATGIRL && RCVD_IN_DSBL
score C_G_DSBL 3.5
# meta C_G_DUL CHATGIRL && RCVD_IN_SORBS_DUL
# score C_G_DUL 3.5

meta C_G_PBL CHATGIRL && RCVD_IN_PBL
score C_G_PBL 3.5
meta C_G_DCN CHATGIRL && ___DCN 
score C_G_DCN 3.5


# added 2008.11.29 by [yoh]
# MultiPart/ALTernative but, Shift_JIS Quoted-Printable ONLY
# 
full MPALTSJISQPONLY /\nContent-Type: multipart\/alternative;\n\tboundary=\"(--=.+(?:[a-zA-Z0-9]|=_)|--[0-9]{14,}|--)\"\n(?:.+\n){2,}\n--\1\nContent-Type: text\/plain;(?: charset=\"shift_jis\"){0,1}\nContent-Transfer-Encoding: quoted-printable\n\n(?:(?!\n--\1\n).+\n|\n){2,}--\1--\n/

meta M_A_S_Q_O_OTHER MPALTSJISQPONLY && (ARIN || RIPE_NCC || LACNIC || AFRINIC || ___KOREATAIWANCHINA )
score M_A_S_Q_O_OTHER 3.5
meta M_A_S_Q_O_PBL MPALTSJISQPONLY && RCVD_IN_PBL
score M_A_S_Q_O_PBL 3.5
meta M_A_S_Q_O_XBL MPALTSJISQPONLY && RCVD_IN_XBL
score M_A_S_Q_O_XBL 3.5
meta M_A_S_Q_O_CBL MPALTSJISQPONLY && RCVD_IN_CBL
score M_A_S_Q_O_CBL 3.5
meta M_A_S_Q_O_BLACK MPALTSJISQPONLY && URIBL_BLACK
score M_A_S_Q_O_BLACK 3.5
meta M_A_S_Q_O_COP MPALTSJISQPONLY && RCVD_IN_BL_SPAMCOP_NET
score M_A_S_Q_O_COP 3.5
meta M_A_S_Q_O_DCN MPALTSJISQPONLY && ___DCN 
score M_A_S_Q_O_DCN 3.5


# added 2010.06.26 by [yoh]
full RTFONLY /\nContent-Type: application\/octet-stream; name=\"[a-z]+\.rtf\"\nContent-Transfer-Encoding: base64\n(?:.+\n){0,}\n[A-Za-z0-9]{69,}\n/
meta RTFOLDCN RTFONLY && ___DCN
score RTFOLDCN 3.5
meta DYN_RTFOL RTFONLY && ___DYNAMICIP
score DYN_RTFOL 3.5


# added 2007.08.11 by [yoh]
# 
full HTMLPDF /(-{6}=_NextPart_000_00[0-9A-F]{2}_[0-9A-F]{8}\.[0-9A-F]{8})\nContent-Type: multipart\/alternative;\n.boundary=\"(----=_NextPart_001_00[0-9A-F]{2}_[0-9A-F]{8}\.[0-9A-F]{8})\"\n\n\n--\2\nContent-Type: text\/plain;\n.charset=\"{0,1}[\w-]{5,}\"{0,1}\nContent-Transfer-Encoding: quoted-printable\n\n\n--\2\nContent-Type: text\/html;\n.charset=\"{0,1}[\w-]{5,}\"{0,1}\nContent-Transfer-Encoding: quoted-printable\n\n(?:.+\n){5}