# simple sieve mail filter for channel-level use on iplanet messaging server

# created by patrick conlin 04.12.02

# last modified 07.17.02

## make sure the email hasn't already been redirected

if header :contains "Received" "ORCPT" {
keep;}

## if the From field matches domains we like, keep it

elsif address :domain :contains "From" [
	".edu",
	"activetradermag.com",
	"adstockphotos.com",
	"afdesigns.com",
	"aiga.org",
	"aigany.org",
	"bendcable.com",
	"bloomberg.com",
	"bn.com",
	"borisart.com",
	"brokeland.com",
	"cantv.net",
	"career-intelligence.com",
	"countingdown.com",
	"deltek.com",
	"desertdolphin.com",
	"dowjones.com",
	"drugstore.com",
	"ediets.com",
	"eonline.com",
	"evergreeninvestments.com",
	"execpay.com",
	"farber.net",
	"fmr.com",
	"fontbureau.com",
	"forbesdigital.com",
	"foxpath.com",
	"furniturefan.com",
	"gap.com",
	"gecapital.com",
	"gettyimages.com",
	"gtnet.com",
	"heilmanphoto.com",
	"iinews.com",
	"interlocken.org",
	"internet.com",
	"intrepidmuseum.org",
	"ipcress.org",
	"kwcorp.com",
	"lyntongardiner.com",
	"mac.com",
	"marketingsherpa.com",
	"marketwatchmail.com",
	"marylandsquare.com",
	"mindspring.com",
	"nycares.org",
	"nytimes.com",
	"petsmart.com",
	"pillsburywinthrop.com",
	"portfolioview.com",
	"reubenbutchart.com",
	"rhinoskin.com",
	"smartmarkt.com",
	"smartmoney.com",
	"sonicrecruit.com",
	"theuseful.com",
	"villagevoice.com",
	"wbinews.com",
	"writershouse.com",
	"xonetwork.com"] {
keep;}

## if the subject line contains text that we like, keep it

elsif header :contains "subject" [
	"nywici",
	"wwwac"] {
keep;}

## if the From field matches the following addresses, keep it

elsif address :all :contains "From" [
	"992life(_at_)cox(_dot_)net",
	"apanagakis(_at_)ddanielspr(_dot_)net",
	"babitskaya(_at_)aol(_dot_)com",
	"conlinpg(_at_)hotmail(_dot_)com",
	"crouchinghamster(_at_)hotmail(_dot_)com",	# julie kim
	"cultureclub(_at_)pollyesthers(_dot_)com",
	"daniellepaladino614(_at_)yahoo(_dot_)com",
	"davidp(_at_)academic(_dot_)touro(_dot_)edu",
	"d_cardena(_at_)yahoo(_dot_)com",
	"debiron(_at_)aol(_dot_)com",
	"dredgers(_at_)excite(_dot_)com",
	"ehurdman(_at_)yahoo(_dot_)com",		# mara strasberg
	"eksevier(_at_)yahoo(_dot_)com",		# pia cantoni
	"eol-inbox-request(_at_)newman(_dot_)eonline(_dot_)com",
	"eonseonsago(_at_)yahoo(_dot_)com",	# julie kim
	"euforianitelife(_at_)aol(_dot_)com",
	"family(_at_)bkny(_dot_)com",
	"genasia(_at_)aol(_dot_)com",
	"hahnas(_at_)yahoo(_dot_)com",		# julie kim
	"hhpark60(_at_)hotmail(_dot_)com",		# julie kim
	"homocorps(_at_)aol(_dot_)com",
	"jehconsult(_at_)yahoo(_dot_)com",
	"jeneaton6(_at_)hotmail(_dot_)com",		# jeanne levin
	"jenn(_at_)beggars(_dot_)com",
	"jk304(_at_)nyc(_dot_)rr(_dot_)com",
	"jmillyman(_at_)yahoo(_dot_)com",		# john milly
	"jockey(_dot_)com(_at_)jockeycomfort(_dot_)com",
	"johnschott99(_at_)aol(_dot_)com",
	"kimeay(_at_)hotmail(_dot_)com",
	"kjankelowitz(_at_)hotmail(_dot_)com",
	"kyle(_dot_)turner(_at_)aig(_dot_)com",
	"la_acerita(_at_)hotmail(_dot_)com",		# rafael weil
	"le(_dot_)design(_at_)verizon(_dot_)net",
	"littlecr(_at_)ucinet(_dot_)com",
	"lmaes(_at_)rjc(_dot_)com",
	"lohara(_at_)adventcap(_dot_)com",
	"mailer(_at_)list(_dot_)nyrrc(_dot_)org",
	"mandyh(_at_)microsoft(_dot_)com",
	"manhattanmotion(_at_)msn(_dot_)com",
	"marniebevington(_at_)yahoo(_dot_)com",
	"martha_stewart_living(_at_)mail(_dot_)marthastewart(_dot_)com",
	"mspota(_at_)hotmail(_dot_)com",		# mara strasberg
	"nycares(_at_)nycares(_dot_)org",
	"patriciabusby(_at_)clearchannel(_dot_)com",
	"patriciabusby(_at_)hotmail(_dot_)com",
	"photo(_dot_)direct(_at_)bellnet(_dot_)ca",
	"sareview(_at_)saintanns(_dot_)k12(_dot_)ny(_dot_)us",
	"sergioespo(_at_)aol(_dot_)com",
	"susanwh13usa(_at_)aol(_dot_)com",
	"tenneson(_at_)mindspring(_dot_)com",
	"thedoverlittle(_at_)aol(_dot_)com",
	"totemnyc(_at_)aol(_dot_)com",
	"tutnyc(_at_)aol(_dot_)com",
	"vvaccaro(_at_)optonline(_dot_)net",
	"walkwdeo(_at_)yahoo(_dot_)com",		# julie kim
	"weekender(_at_)newsletters(_dot_)digitalcity(_dot_)com",
	"whuang3928(_at_)aol(_dot_)com",
	"winterswilson(_at_)hotmail(_dot_)com",
	"wscab(_at_)aol(_dot_)com"] {
keep;}

## if the From field matches suspicious domains, redirect to spamcatcher(_at_)wechsler(_dot_)com

elsif address :domain :contains "From" [
	"4u.com",
	"address.com",
	"adpromailer.com",
	"adpromailer.net",
	"adprooffers.net",
	"adprosender.com",
	"adprosender.net",
	"allflip.com",
	"animeigo.com",
	"arabia.com",
	"ayna.com",
	"bigfoot.com",
	"businesscreditusa.com",
	"caramail.com",
	"consumerpackage.net",
	"cyberclicks.com",
	"dailydeals4you.com",
	"databynet.com",
	"dlbdirect.com",
	"e-klk.com",
	"emaildelivery.org",
	"emailoffersdirect.com",
	"emsiweb.com",
	"eudoramail.com",
	"export2000.ro",
	"flashmail.com",
	"flowgo.com",
	"funfabdeals.com",
	"gamblinglinks.com",
	"gossipflash.com",
	"hotmail.com",
	"infousa.com",
	"int01e.com",
	"irstupid.com",
	"itsonlybest.com",
	"julib.com",
	"kooloffers.com",
	"korea.com",
	"legacy.it",
	"link2buy.com",
	"mail.com",
	"migada.com",
	"milespree.com",
	"nexdeals.com",
	"offer888.com",
	"offer888.net",
	"offerbymail.com",
	"opmnetwork.net",
	"polbox.com",
	"quickinspirations.com",
	"real-net.net",
	"rsc02.com",
	"sky08.com",
	"smartcruit.com",
	"speedi-list.com",
	"subscriberbase.net",
	"urbanasian.com",
	"venomjeans.com",
	"vmadmin.com",
	"winning.com",
	"xmr3.com",
	"xumx.com",
	"yahoo.com",
	"ynmail.com"] {
redirect "spamcatcher(_at_)wechsler(_dot_)com";}

## if the subject line contains suspicious text, redirect to spamcatcher(_at_)wechsler(_dot_)com

elsif header :contains "subject" [
	"          ",
	"adult",
	"adv",
	"*anything*about*anyone*",
	"cartridges",
	"credit",
	"*credit*card*",
	"dvd",
	"*find*out*",
	"free",
	"inkjet",
	"leads",
	"loans",
	"*look*great*",
	"*lower*interest*rates*",
	"*make*money*",
	"money",
	"*more*info*inside*",
	"mortgage",
	"mtg",
	"overweight",
	"*pay*off*",
	"penile",
	"penis",
	"refinance",
	"romance",
	"removal",
	"septic",
	"sex",
	"*teen*",
	"viagra",
	"xxx",
	"*you*may*have*"] {
redirect "spamcatcher(_at_)wechsler(_dot_)com";}

## if the To, Cc, or Bcc fields do not match the following domains, redirect to spamcatcher(_at_)wechsler(_dot_)com

elsif not address :domain :contains ["To", "Cc", "Bcc"] [
	"acm.org",
	"americansforathirdway.com",
	"artic.edu",
	"barebones.com",
	"bitterlemons.org",
	"bloomberg.com",
	"chartoftheday.com",
	"chowhound.com",
	"cnnimail12.cnn.com",
	"dailycandy.com",
	"darediablo.com",
	"deloitte.com",
	"envirolink.org",
	"girlsclub.org",
	"imc.org",
	"internetwire.com",
	"jiscmail.ac.uk",
	"list.ediets.com",
	"list.onetravel.com",
	"lists.evolt.org",
	"lists.samba.org",
	"lists.sierraclub.org",
	"listserv.acns.nwu.edu",
	"listserv.dowjones.com",
	"listserv.performancebike.com",
	"listserv.webster.m-w.com",
	"lockbox24.com",
	"lucas-online.info",
	"majordomo.pobox.com",
	"mariascoop.com",
	"mwhse.com",
	"nywici.org",
	"packer.edu",
	"pallottateamworks.com",
	"rosswords.com",
	"rtn.columbiarecordsemail.com",
	"shamash.org",
	"ssc.com",
	"structurehouse.com",
	"treebranch.com",
	"uiuc.edu",
	"velo.qc.ca",
	"webb.org",
	"webelists.com",
	"wechsler.com",
	"wordsmith.org",
	"workbookstock.com",
	"yahoogroups.com",
	"yiwh.org",
	"ysaleagues.com"] {
redirect "spamcatcher(_at_)wechsler(_dot_)com";}