Sample 'qrm2' rcfile - warning: foul language
# qrmrc --crb3 28nov02
#
# # or ; first nonspace in line comments the line out.
# <whsp># or <whsp>;, where whsp is tab(s)|space(s), marks trailing comment.
# these are explicit strings, NOT regexes, and are case-insensitive.
#
# user= entries are not used in qrm2, instead the program iterates through
# all Maildirs. left in for qrm1 compatibility.
#
# all the 'rex' entries ARE Perl regexes. use them sparingly; if a
# verbatim case-insensitive match will do, use that.
#
user=crb3
user=admin
user=cr
#
notrailers=1
trailercount=5
chatty=0
debug=0
#
# Received:
#
# received-chain known sources (shoulda thought of this earlier)
# the brazilians are pretty bad about that crap, it seems.
# this will have to be narrowed down once we start getting
# GPL-type mail...
# second experimental Received match: dotted-quads that don't
# resolve. if i can't bitch at their isp, i won't waste time
# on their mail. most of these are probably dark-space IPs.
# (octet triplets have been tested-dark with nschkblock.) 'Dark'
# means there's not a host to ping, but somebody's using the
# dotquad anyway.
#
received=brdterra.com.br
received=200.173.122. # spammer block. consuldata.com.br, bingonetbrasil.com.br
#12.41.205.53
#received=24.84.97.173 # shawcable.net
received=24.138.51. #150 # no response from DNS server
received=29.136.11. #165
received=61.74.67. #158
received=61.96.134. #149
received=61.111.246. #149
received=61.128.225. #229
received=61.153.22. #210
received=61.173.41. #50
received=61.183.75. #123
received=61.191.111. #151
received=61.241.234. #84
received=61.248.221. #223
received=61.250.86.241 # 3 hosts
received=63.99.230. #239
received=64.94.106.10 # 107.opt2get.com
received=64.94.106.11 # opt2get.com, jdrmail.com,jd0pt.com
received=64.94.106.12 # yea, verify and forsooth, tis a spammer's
received=64.94.106.7 # nest! the only reason i'll not block the
received=64.94.106.8 # whole class-c block is, there are a few
received=64.94.106.9 # verisign addresses in there.
received=64.143.184. # 224 hosts, all optn1c.biz
received=65.165.205. #42
received=68.68.120. #48
received=80.172.0. #14
received=82.129.206. #124
received=129.174.180.122 # 1 host, 129.174.180.1 DormRouter.gmu.edu
received=131.230.150. #165
received=141.156.30.104 # 4 hosts, pgparks.com and mednetservice.com
received=151.202.154.1 #16 2 hosts at 3 and 37.
received=151.202.154.2 #16
received=151.202.154.4 #16
received=151.202.154.5 #16
received=151.202.154.6 #16
received=151.202.154.7 #16
received=151.202.154.8 #16
received=151.202.154.9 #16
received=161.67.7.249 # 40 hosts in spain
received=193.41.150.106 # 23 hosts, most of them greek
received=195.145.212.62 # 10 hosts in germany
received=195.174.175. #252
received=200.38.226.51 # 10 hosts in mexico
received=200.47.101. #194
received=200.60.76.247 # 14 hosts in peru
received=200.84.153. #76
received=200.90.96. #153
received=200.96.3. #190
received=200.182.182. #91
received=200.186.166. #118
received=200.199.60. #47
received=202.9.152.26 # 2 hosts on eth.net
received=202.54.138. #149
received=202.107.53. #82
received=202.175.61. #18
received=202.163.88. #77
received=203.162.41.126
received=203.168.74.242 # 14 hosts in india
received=204.29.185. #154
received=205.138.96. #56
received=206.128.209. #100
received=206.150.162. #225
received=207.162.14.229 # 1 host, 207.162.14.73 arielqc.ENAP.UQuebec.ca
received=207.254.225. #83
received=210.3.251. #239
received=210.123.84. #36
received=210.124.80. #135
received=211.20.17.44 # 211.20.17.123 is mail.bigchain.com.tw, the rest is dark
received=211.44.157. #134
received=211.61.231. #131
received=211.91.200. #51
received=211.98.84. #57
received=211.191.61. #10
received=212.72.5. #95
received=213.11.4.133 # 11 hosts, in france, look like
received=213.155.213. #10
received=213.214.220. #117
received=217.109.164.252 # 17 hosts in france
received=217.199.97.87
received=218.1.219. #28
received=218.12.180. #112
received=218.13.254. #65 no DNS response ..assume compromised nameserver
received=218.15.244. #78
received=218.16.186. #230
received=218.64.247. #71
received=218.19.58. #x
received=218.72.23. #100
received=218.79.216. #105
received=218.79.226. #52
received=218.79.227. #241
received=218.104.236. #11
received=218.109.51. #40
received=219.145.124. #110
received=219.147.222. #28
received=218.148.132. #40
received=220.112.10. #206
received=220.112.109. #246
received=238.20.129. #13
#
# From: Return-path:
#
# these we exempt. anything from one of these
# addresses is something we want to read about.
#
skipfrom=Network Linux Newsletter
skipfrom=oreilly.com
skipfrom=verisign.com # assholes... but i gotta know.
skipfrom=mlr.output # mlr comment
skipfrom=abuse@ # returns on bitchmails
skipto=abuse@ # bitchmails returns on bitchmails
skipto=postmaster@ # bitchmails returns on bitchmails
skipfrom=stormbringer.org
skipfrom=redhat.com
skipfrom=neopets # kids
skipfrom=bobandgeorge.com # kids
skipfrom=dudemanlopez # kids
skipfrom=shockwave.com # kids
skipfrom=list.pandorabots.com # kids
skipfrom=airattack.co.uk # kids
skipfrom=Final Fantasy Forums # kids
skipfrom=TechRepublic
skipfrom=EE Times Newsletter
skipfrom=EDTN.com
skipfrom=middle-earth.us
skipfrom=MAILER-DAEMON@earthlink.net
#
# these we shunt as spam.
# these are spammers and pseudo-optins.
;
from=(8.13.6/8.13.6)
from=thisisadomainallright.com
from=foxbox.tv
from=sex.com
from=dailyoffer
from=hanginthere.net
from=registerednurses
from=consultant.com
from=buy.com
from=smallcapnetwork.net
from=colonize.com
from=onlinecommercesolution.com
from=Offers
from=optin
from=enteresting.com
from=BestOffer
from=moneyonline.com
from=bigtime.com
from=finance.yahoo.com
from=dealz.biz
from=soft4all.biz
from=dementedmindz
from=pornhosts
from=databaseassociate.com
from=cantinamail.com
#
#
# To: Cc:
#
# These regexes trade on a feature of my username crb3:
# spammers will pile on a group of near-sorted addies
# with numeric-suffix names, but human lifeforms won't.
# anything sent also to crb42, i don't need, whether it
# went to earthlink.net or computer.org.
#
#rexto=crb[0-24-9]+.*?\@(?:earthlink|computer)
#rexto=cr[^b].*?\@(?:earthlink|computer)
#rexto=[0-24-9]\d*?\@(?:earthlink|computer)
#
#
# Subject:
#
# tokens in subject-line flag things we want to see.
# mail-list tokens, for one.
#
skipsubj=[smokersclubforum]
skipsubj=EE Times
skipsubj=EETimes
skipsubj=CSO Enews
skipsubj=[wots] # writers on the storm
skipsubj=[rakhacks] # rakhacks
#skipsubj=on your network
#
rexsubj=V.c.d.n
subj=Rolex
subj=Forclosures
subj=per week
subj=Printer Cartridges
subj=Viagra
subj=prescription
subj=anti-spam
subj=pay-per-view
subj=bedroom
subj=protect your
subj=free!
subj=rented DVD
subj=sexual
subj=kinky
subj=adv
subj=granny
subj=ADV:
subj=hardcore site
subj=fuck
subj=penis
subj=cunt
subj=erection
subj=trial sample
subj=porn
subj=special offer
subj=amateur mov
subj=discount
subj=diazepam
subj=prozac
subj=nookie
subj=coochie
subj=refinance
subj=gas mileage
subj=hardcore
subj=spy software
subj=mortgage rate
subj=mortgage quote
subj=doctor approved
subj=systemworks
subj=phentermine
# --crb3 21jan04: moved the following from ALL.
# adults' filters need them spam-tuned.
# kids filters need them broad, but that's handled in the
# kids' ~/.qrmrc's.
subj=ejaculation
subj=erection
subj=nude girl
subj=pussy
subj=penis
subj=erotic
subj=rape
subj=nymphet
subj=hentai
#
# (Body Text)
#
# Bayes-dodger text-dumps have gifs as payloads. exempt any whitelist
# sources with skipfrom.
#
body=Content-Type: image/gif;
rexbody=\<META\scontent\=3D\"MSHTML\s6\.00\.\d{4}\.\d{4}\"\sname\=3DGENERATOR\>
#
# first line, clues of a Klez-type virus
#
body=TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
body=R0lGODlhaAA7APcAAP///+rp6puSp6GZrDUjUUc6Zn53mFJMdbGvvVtXh2xre8bF1x8cU4yLprOy
body=TVqQAAMAAAAEAAAA
body=R0lGODlhaAA7APcAAP
# further in, so no slashes gum up the match
body=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
body=zIGArlZWu25ux319xWpqnnNzppaWy46OvKKizZqavLa2176+283N5sfH34uLmpKSoNvb7c7O3L29
body=name=font.scr
body=Content-Type: audio/x-midi;
body=Content-Type: audio/x-wav;
from=confidence_microsoft.com
#
# MiMail / MyDoom...
#
body=-'á|âkýÂÐIêý&
#
# sure sign of a bayesian-killer spam
#
body=</font></font></font>
body=<font color="#fffff
body=<font color=#FFFFF
body=<font color=3D"#FFFFF
body=<font color=3D#FFFFF
#
body=month supply
body=this email in error
body=unsubscribe
body=to be removed from
body=further promotions
body=this is not spam
body=increases productivity
body=beautiful young
body=satisfaction guarant
body=savings on
body=spam remedy
body=snorex
body=buy alert
body=opt-in
body=Stock Profile of the Week
body=Nymphomax
body=Human Growth Hormone
#
# URLS in body fields are typically "click here" or webbug hyperlinks
#
body=ever-co.com
body=noticeyouhere.com
body=grasp7x24.com
body=Limited Time
body=leadsboulevard.net
body=mybargains.cc
body=buyy.
body=opt-first.
body=365.com
body=hitandget.com
body=decode6.com
body=timehere.com
body=specialdealz.
body=gadgitz.biz
body=Langdon looked again at the fax
body=JFK and his advisers were concerned with the
body=He was in such a bad mood by the time he got to Divinat
body=Bad weather for the past few days had made it impossible to proceed with a
#
# * ALL *
# added into To, Cc, From, Return-path, Subject, BODY arrays
#
#
all=landofbiz.com.br
all=BIZLAND.COM.BR
all=Valium
all=Xanax
all=Pheromones
all=Sildenafil
all=H-G-H
all=HGH
all=Fioricet
all=Prozac
all=Buspar
all=Vicodin
all=inchz.
all=sec1001.biz
all=s.p.a.m
all=a.n.a.l
all=p.u.s.s
all=f.u.c.k
all=c.o.c.k
all=s.e.x
all=r.a.p.e
all=a.r.d.c.o.r
all=immoraldreams
all=pay per view
all=cable co
all=cable box
all=life insuran
all=casino
all=no pump
all=no surgery
all=full inches
all=copy a dvd
all=dvd pro
all=dvd burner
all=artistsearch
all=artauction
all=artlist
all=artaddiction
all=artcompendium
all=artlist
all=artprice
all=artmarket
all=artdirect
all=hebal remed
all=homethrill
all=pussies
all=cruelviolation
all=fuuck
all=lolita
all=sluts
all=fuck
all=lonely housewi
all=horny amateur
all=masturbat
all=hardcore
all=porn
all=rape vid
all=nigger
all=mortgage quote
all=barely legal
all=bestiality
all=be$tiality
all=S E ><
all=S E ><
all=forced sex
all=marketing technique
all=further mailings
all=opted in
all=opt-in
all=clearance sale
all=life insurance policy
all=copulati
all=ejaculat
all=incest
all=copy any dvd
all= sekks
all= seks
#all= anal ...which part of 'analysis' did you dislike?
all=cocks
all=nymphet
all=bestial
all=forced se
all=freesex
all=sexworld
all=freecherry
all=cherryworld
#all=condom
all=little-model
all=hot girl
all=brassiere
all=secks
all=inkjet cart
all=sick of spam
all=snoring your
all=securediscount
all=destuctive virus
all=government grant
all=you rich
all=cryingirls
all=pussies
all=g.a.y.
all=s.e.x
#all=obsession
all=lewdmother
all=h.a.r.d
all=internetsweeper
#
all=buyn0w.com
all=xanami.com
all=enforcex.com
all=s-girls.net
all=rented dvd
all=loextrim.com
all=shanghaizhan.com
all=evil.com
all=scaredgirls.com
all=Newageoptin
all=ulikeit.biz
all=optindatacorp.com
all=discountdomainsource.com
all=brightertimes.net
all=feelgr8.biz
all=netfirms.com
all=waltersmountains.com
all=danihughes.com
all=blue.biz
all=offers.com
all=offerz
all=householdcredit.com
all=getinnow.com
all=optout
all=goteverything.com
all=freeyourmindnow.info
all=optinbiz
all=medremind
all=epromotion
all=kingofrxsales
all=cashgiveawayprogram.com
all=quickeasysolution.com
all=prosize.
all=pluckz.biz
all=pharmacyplace.biz
all=addlebrain.com
all=FINANCES.COM.BR
all=jupiter.com
all=adultmatch.
all=topsites.com
all=optn1b.us
all=advantagemeds.biz
all=we3xe.com
all=freewellnessite.com
all=replicamate.biz
all=20fr.com
all=superauctioncity.info
all=parallelpaperparcel.com
all=nicheapain.com
all=blackmanraygonegood.com
all=ace-gold.com
all=fulmun.biz
all=pastpaymentwager.com
all=accesskm.com
all=dvdad.com
all=com-click.com
all=www.terra.es
all=abinteriors.com
all=dbs54d.com
all=thechoicesyoumake.com
all=orangeornament.com
all=smilingdoctor.net
all=healthypractise.biz
all=letsgout.com
all=nnaew1=2ecom
all=recordreg.biz
all=riceriver.biz
all=definitivemail.com
all=ewe3xe=2ecom
all=best-rate-search.biz
all=cleavageonline.com
all=46.biz/
all=yesoutsource.com/
all=findinside.info/
all=98.com/
all=mnasnw.biz/
all=getintothisnow.biz/
all=seem468.biz/
all=extrasatisfaction.com/
all=orderdiscountgeneric.com
all=zoo-action.com
all=gfd-online.com
#
__END__