[version]
spam-filter = "1.1"

[sieve.trusted.scripts.spam-filter]
name = "Spam Filter"
contents = '''

#### Script config.sieve ####

# Whether to add an X-Spam-Status header
let "ADD_HEADER_SPAM" "key_get('spam-config', 'add-spam')";

# Whether to add an X-Spam-Result header
let "ADD_HEADER_SPAM_RESULT" "key_get('spam-config', 'add-spam-result')";

# Whether message replies from authenticated users should be learned as ham
let "AUTOLEARN_REPLIES_HAM" "key_get('spam-config', 'learn-ham-replies')";

# Whether the bayes classifier should be trained automatically
let "AUTOLEARN_ENABLE" "key_get('spam-config', 'learn-enable') && !env.test";

# When to learn ham (score >= threshold)
let "AUTOLEARN_HAM_THRESHOLD" "key_get('spam-config', 'learn-ham-threshold')";

# When to learn spam (score <= threshold)
let "AUTOLEARN_SPAM_THRESHOLD" "key_get('spam-config', 'learn-spam-threshold')";

# Keep difference for spam/ham learns for at least this value
let "AUTOLEARN_SPAM_HAM_BALANCE" "key_get('spam-config', 'learn-balance')";

# If ADD_HEADER_SPAM is enabled, mark as SPAM messages with a score above this threshold
let "SCORE_SPAM_THRESHOLD" "key_get('spam-config', 'threshold-spam')";

# Discard messages with a score above this threshold
let "SCORE_DISCARD_THRESHOLD" "key_get('spam-config', 'threshold-discard')";

# Reject messages with a score above this threshold
let "SCORE_REJECT_THRESHOLD" "key_get('spam-config', 'threshold-reject')";

# Directory name to use for local domain lookups (leave empty for default)
let "DOMAIN_DIRECTORY" "key_get('spam-config', 'directory')";

# Store to use for Bayes tokens and ids (leave empty for default)
let "SPAM_DB" "key_get('spam-config', 'lookup')";


#### Script prelude.sieve ####

# Convert body to plain text
let "text_body" "body.to_text";

# Obtain all URLs in the body
let "body_urls" "tokenize(text_body, 'uri')";

# Obtain all URLs in href and src attributes
let "html_body_urls" "html_attrs(body.html, '', ['href', 'src'])";

# Obtain all URLs in the subject, combine them with all other URLs and remove duplicates
let "urls" "dedup(tokenize(header.subject, 'uri') + body_urls + html_body_urls)";

# Obtain thread name and subject
let "subject_lc" "to_lowercase(header.subject)";
let "subject_clean" "thread_name(header.subject)";
let "body_and_subject" "subject_clean + ' ' + text_body";

# Obtain all recipients
let "recipients" "to_lowercase(header.to:cc:bcc[*].addr[*])";
let "recipients_clean" "winnow(dedup(recipients))";
let "recipients_to" "header.to[*].addr[*]";
let "recipients_cc" "header.cc[*].addr[*]";

# Obtain From parts
let "from_name" "to_lowercase(trim(header.from.name))";
let "from_addr" "to_lowercase(trim(header.from.addr))";
let "from_local" "email_part(from_addr, 'local')";
let "from_domain" "email_part(from_addr, 'domain')";
let "from_domain_sld" "domain_part(from_domain, 'sld')";

# Obtain Reply-To address
let "rto_addr" "to_lowercase(header.reply-to.addr)";

# Obtain Envelope From parts
let "envfrom_local" "email_part(envelope.from, 'local')";
let "envfrom_domain" "email_part(envelope.from, 'domain')";
let "envfrom_domain_sld" "domain_part(envfrom_domain, 'sld')";

# Obtain HELO domain SLD
let "helo_domain_sld" "domain_part(env.helo_domain, 'sld')";

# Create score variable
let "score" "0.0";


#### Script from.sieve ####

let "from_count" "count(header.from[*].raw)";
let "service_accounts" "['www-data', 'anonymous', 'ftp', 'apache', 'nobody', 'guest', 'nginx', 'web', 'www']";

if eval "from_count > 0" {
    let "from_raw" "to_lowercase(header.from.raw)";

    if eval "from_count > 1" {
        let "t.MULTIPLE_FROM" "1";
    }

    if eval "is_email(from_addr)" {
        if eval "contains(service_accounts, from_local)" {
            let "t.FROM_SERVICE_ACCT" "1";
        }
        if eval "starts_with(from_domain, 'www.')" {
            let "t.WWW_DOT_DOMAIN" "1";
        }

        if eval "key_exists('spam-free', from_domain_sld)" {
            let "t.FREEMAIL_FROM" "1";
        } elsif eval "key_exists('spam-disposable', from_domain_sld)" {
            let "t.DISPOSABLE_FROM" "1";
        }
    } else {
        let "t.FROM_INVALID" "1";
    }

    if eval "is_empty(from_name)" {
        let "t.FROM_NO_DN" "1";
    } elsif eval "eq_ignore_case(from_addr, from_name)" {
        let "t.FROM_DN_EQ_ADDR" "1";
    } else {
        if eval "!t.FROM_INVALID" {
            let "t.FROM_HAS_DN" "1";
        }

        if eval "is_email(from_name)" {
            let "from_name_sld" "domain_part(email_part(from_name, 'domain'), 'sld')";
            if eval "(!t.FROM_INVALID && from_domain_sld != from_name_sld) ||
                     (!is_empty(envelope.from) && envfrom_domain_sld != from_name_sld) ||
                     (is_empty(envelope.from) && helo_domain_sld != from_name_sld)" {
                let "t.SPOOF_DISPLAY_NAME" "1";
            } else {
                let "t.FROM_NEQ_DISPLAY_NAME" "1";
            }
        } else {
            if eval "contains(from_name, 'mr. ') || contains(from_name, 'ms. ') || contains(from_name, 'mrs. ') || contains(from_name, 'dr. ')" {
                let "t.FROM_NAME_HAS_TITLE" "1";
            }
            if eval "contains(header.from.name, '  ')" {
                let "t.FROM_NAME_EXCESS_SPACE" "1";
            }
        }
    }

    if eval "is_empty(envelope.from) && 
             (from_local == 'postmaster' || 
              from_local == 'mailer-daemon' || 
              from_local == 'root')" {
        let "t.FROM_BOUNCE" "1";
    }

    if eval "(!is_empty(envelope.from) && 
               eq_ignore_case(from_addr, envelope.from)) ||
             (t.FROM_BOUNCE && 
              !is_empty(from_domain) && 
              from_domain_sld == helo_domain_sld)" {
        let "t.FROM_EQ_ENVFROM" "1";
    } elsif eval "!t.FROM_INVALID" {
        let "t.FORGED_SENDER" "1";
        let "t.FROM_NEQ_ENVFROM" "1";
    }

    if eval "contains(from_local, '+')" {
        let "t.TAGGED_FROM" "1";
    }

    if eval "count(recipients_to) + count(recipients_cc) == 1" {
        if eval "eq_ignore_case(recipients_to[0], from_addr)" {
            let "t.TO_EQ_FROM" "1";
        } elsif eval "eq_ignore_case(email_part(recipients_to[0], 'domain'), from_domain)" {
            let "t.TO_DOM_EQ_FROM_DOM" "1";
        }
    }

    if eval "!is_ascii(from_raw)" {
        if eval "!env.param.smtputf8 && env.param.body != '8bitmime' && env.param.body != 'binarymime'" {
            let "t.FROM_NEEDS_ENCODING" "1";
        }
        if eval "!is_header_utf8_valid('From')" {
            let "t.INVALID_FROM_8BIT" "1";
        }
    }

    if eval "is_ascii(header.from) && contains(from_raw, '=?') && contains(from_raw, '?=')" {
        if eval "contains(from_raw, '?q?')" {
            # From header is unnecessarily encoded in quoted-printable
            let "t.FROM_EXCESS_QP" "1";
        } elsif eval "contains(from_raw, '?b?')" {
            # From header is unnecessarily encoded in base64
            let "t.FROM_EXCESS_BASE64" "1";
        }
    }

    if eval "!is_empty(from_name) && !is_empty(from_addr) && !contains(from_raw, ' <')" {
        let "t.R_NO_SPACE_IN_FROM" "1";
    }

    # Read confirmation address is different to from address
    let "crt" "header.X-Confirm-Reading-To.addr";
    if eval "!is_empty(crt) && !eq_ignore_case(from_addr, crt)" {
        let "t.HEADER_RCONFIRM_MISMATCH" "1";
    }
} else {
    let "t.MISSING_FROM" "1";
}

if eval "!is_empty(envelope.from)" {
    if eval "is_email(envelope.from)" {
        if eval "contains(service_accounts, envfrom_local)" {
            let "t.ENVFROM_SERVICE_ACCT" "1";
        }
    } else {
        let "t.ENVFROM_INVALID" "1";
    }

    if eval "!is_empty(envfrom_domain_sld)" {
        if eval "key_exists('spam-free', envfrom_domain_sld)" {
            let "t.FREEMAIL_ENVFROM" "1";
        } elsif eval "key_exists('spam-disposable', envfrom_domain_sld)" {
            let "t.DISPOSABLE_ENVFROM" "1";
        }

        # Mail from no resolve to A or MX
        if eval "!dns_exists(envfrom_domain, 'mx') && !dns_exists(envfrom_domain, 'ip')" {
            let "t.FROMHOST_NORES_A_OR_MX" "1";
        }        
    }

    # Read confirmation address is different to return path
    let "dnt" "header.Disposition-Notification-To.addr";
    if eval "!is_empty(dnt) && !eq_ignore_case(envelope.from, dnt)" {
        let "t.HEADER_FORGED_MDN" "1";
    }
}

if eval "!t.FROM_SERVICE_ACCT && 
         (contains_ignore_case(service_accounts, email_part(rto_addr, 'local')) || 
          contains_ignore_case(service_accounts, email_part(header.sender.addr, 'local')))" {
    let "t.FROM_SERVICE_ACCT" "1";
}

if eval "!t.WWW_DOT_DOMAIN && 
         (contains_ignore_case(rto_addr, '@www.') || 
          contains_ignore_case(header.sender.addr, '@www.'))" {
    let "t.WWW_DOT_DOMAIN" "1";
}



#### Script recipient.sieve ####


let "to_raw" "to_lowercase(header.to.raw)";
if eval "!is_empty(to_raw)" {
    if eval "is_ascii(header.to) && contains(to_raw, '=?') && contains(to_raw, '?=')" {
        if eval "contains(to_raw, '?q?')" {
            # To header is unnecessarily encoded in quoted-printable
            let "t.TO_EXCESS_QP" "1";
        } elsif eval "contains(to_raw, '?b?')" {
            # To header is unnecessarily encoded in base64
            let "t.TO_EXCESS_BASE64" "1";
        }
    } elsif eval "!is_ascii(to_raw) && !env.param.smtputf8 && env.param.body != '8bitmime' && env.param.body != 'binarymime'" {
        # To needs encoding
        let "t.TO_NEEDS_ENCODING" "1";
    }
} else {
    let "t.MISSING_TO" "1";
}

let "rcpt_count" "count(recipients_clean)";

if eval "rcpt_count > 0" {
    if eval "rcpt_count == 1" {
        let "t.RCPT_COUNT_ONE" "1";
    } elsif eval "rcpt_count == 2" {
        let "t.RCPT_COUNT_TWO" "1";
    } elsif eval "rcpt_count == 3" {
        let "t.RCPT_COUNT_THREE" "1";
    } elsif eval "rcpt_count <= 5" {
        let "t.RCPT_COUNT_FIVE" "1";
    } elsif eval "rcpt_count <= 7" {
        let "t.RCPT_COUNT_SEVEN" "1";
    } elsif eval "rcpt_count <= 12" {
        let "t.RCPT_COUNT_TWELVE" "1";
    } else {
        let "t.RCPT_COUNT_GT_50" "1";
    }

    let "rcpt_name" "to_lowercase(header.to:cc:bcc[*].name[*])";
    let "i" "count(recipients)";
    let "to_dn_count" "0";
    let "to_dn_eq_addr_count" "0";
    let "to_match_envrcpt" "0";

    while "i != 0" {
        let "i" "i - 1";
        let "addr" "recipients[i]";

        if eval "!is_empty(addr)" {
            let "name" "rcpt_name[i]";

            if eval "!is_empty(name)" {
                if eval "name == addr" {
                    let "to_dn_eq_addr_count" "to_dn_eq_addr_count + 1";
                } else {
                    let "to_dn_count" "to_dn_count + 1";
                    if eval "name == 'recipient' || name == 'recipients'" {
                        let "t.TO_DN_RECIPIENTS" "1";
                    }
                }
            }

            if eval "contains(envelope.to, addr)" {
                let "to_match_envrcpt" "to_match_envrcpt + 1";
            }

            # Check if the local part is present in the subject
            let "local_part" "email_part(addr, 'local')";
            if eval "!is_empty(local_part)" {
                if eval "contains(subject_lc, addr)" {
                    let "t.RCPT_ADDR_IN_SUBJECT" "1";
                } elsif eval "len(local_part) > 3 && contains(subject_lc, local_part)" {
                    let "t.RCPT_LOCAL_IN_SUBJECT" "1";
                }

                if eval "contains(local_part, '+')" {
                    let "t.TAGGED_RCPT" "1";
                }
            }

            # Check if it is an into to info 
            if eval "!t.INFO_TO_INFO_LU && 
                     local_part == 'info' && 
                     from_local == 'info' && 
                     header.List-Unsubscribe.exists" {
                let "t.INFO_TO_INFO_LU" "1";
            }

            # Check for freemail or disposable domains
            let "domain" "domain_part(email_part(addr, 'domain'), 'sld')";
            if eval "!is_empty(domain)" {
                if eval "key_exists('spam-free', domain)" {
                    if eval "!t.FREEMAIL_TO && contains_ignore_case(recipients_to, addr)" {
                        let "t.FREEMAIL_TO" "1";
                    } elsif eval "!t.FREEMAIL_CC && contains_ignore_case(recipients_cc, addr)" {
                        let "t.FREEMAIL_CC" "1";
                    }
                } elsif eval "key_exists('spam-disposable', domain)" {
                    if eval "!t.DISPOSABLE_TO && contains_ignore_case(recipients_to, addr)" {
                        let "t.DISPOSABLE_TO" "1";
                    } elsif eval "!t.DISPOSABLE_CC && contains_ignore_case(recipients_cc, addr)" {
                        let "t.DISPOSABLE_CC" "1";
                    }
                }
            }
        }
    }

    if eval "to_dn_count == 0 && to_dn_eq_addr_count == 0" {
        let "t.TO_DN_NONE" "1";
    } elsif eval "to_dn_count == rcpt_count" {
        let "t.TO_DN_ALL" "1";
    } elsif eval "to_dn_count > 0" {
        let "t.TO_DN_SOME" "1";
    }

    if eval "to_dn_eq_addr_count == rcpt_count" {
        let "t.TO_DN_EQ_ADDR_ALL" "1";
    } elsif eval "to_dn_eq_addr_count > 0" {
        let "t.TO_DN_EQ_ADDR_SOME" "1";
    }

    if eval "to_match_envrcpt == rcpt_count" {
        let "t.TO_MATCH_ENVRCPT_ALL" "1";
    } else {
        if eval "to_match_envrcpt > 0" {
            let "t.TO_MATCH_ENVRCPT_SOME" "1";
        }

        if eval "is_empty(header.List-Unsubscribe:List-Id[*])" {
            let "i" "count(envelope.to)";
            while "i != 0" {
                let "i" "i - 1";
                let "env_rcpt" "envelope.to[i]";

                if eval "!contains(recipients, env_rcpt) && env_rcpt != envelope.from" {
                    let "t.FORGED_RECIPIENTS" "1";
                    break;
                }
            }
        }
    }

    # Message from bounce and over 1 recipient
    if eval "rcpt_count > 1 &&
             (is_empty(envelope.from) || 
              envfrom_local == 'postmaster' || 
              envfrom_local == 'mailer-daemon')" {
        let "t.RCPT_BOUNCEMOREONE" "1";
    }

    # Check for sorted recipients
    if eval "rcpt_count >= 7 && sort(recipients_clean, false) == recipients_clean" {
        let "t.SORTED_RECIPS" "1";
    }

    # Check for suspiciously similar recipients
    if eval "!t.SORTED_RECIPS && rcpt_count => 5" {
        let "i" "rcpt_count";
        let "hits" "0";
        let "combinations" "0";

        while "i" {
            let "i" "i - 1";
            let "j" "i";
            while "j" {
                let "j" "j - 1";
                let "a" "recipients_clean[i]";
                let "b" "recipients_clean[j]";

                if eval "levenshtein_distance(email_part(a, 'local'), email_part(b, 'local')) < 3" {
                    let "hits" "hits + 1";
                }

                let "a" "email_part(a, 'domain')";
                let "b" "email_part(b, 'domain')";

                if eval "a != b && levenshtein_distance(a, b) < 4" {
                    let "hits" "hits + 1";
                }

                let "combinations" "combinations + 1";
            }
        }

        if eval "hits / combinations > 0.65" {
            let "t.SUSPICIOUS_RECIPS" "1";
        }
    }

    # Check for spaces in recipient addresses
    let "raw_to" "header.to:cc[*].raw";
    let "i" "len(raw_to)";
    while "i != 0" {
        let "i" "i - 1";
        let "raw_addr" "rsplit(raw_to[i], '<')[0]";
        if eval "contains(raw_addr, '>') && (starts_with(raw_addr, ' ' ) || ends_with(raw_addr, ' >'))" {
            let "t.TO_WRAPPED_IN_SPACES" "1";
            break;
        }
    }

} else {
    let "t.RCPT_COUNT_ZERO" "1";

    if eval "contains(to_raw, 'undisclosed') && contains(to_raw, 'recipients')" {
        let "t.R_UNDISC_RCPT" "1";
    }
}


#### Script subject.sieve ####


let "raw_subject_lc" "to_lowercase(header.subject.raw)";
let "is_ascii_subject" "is_ascii(subject_lc)";

if eval "len(subject_clean) >= 10 && count(tokenize(subject_clean, 'words')) > 1 && is_uppercase(subject_clean)" {
    # Subject contains mostly capital letters
	let "t.SUBJ_ALL_CAPS" "1";
}

if eval "count_chars(subject_clean) > 200" {
    # Subject is very long
    let "t.LONG_SUBJ" "1";
}

if eval "!is_empty(tokenize(subject_lc, 'uri_strict'))" {
    # Subject contains a URL
    let "t.URL_IN_SUBJECT" "1";
}

if eval "!is_ascii(raw_subject_lc) && !env.param.smtputf8 && env.param.body != '8bitmime' && env.param.body != 'binarymime'" {
    # Subject needs encoding
    let "t.SUBJECT_NEEDS_ENCODING" "1";
}

if eval "!header.Subject.exists" {
    # Missing subject header
    let "t.MISSING_SUBJECT" "1";
} elsif eval "is_empty(trim(subject_lc))" {
    # Subject is empty
    let "t.EMPTY_SUBJECT" "1";
}

if eval "is_ascii(subject_lc) && contains(raw_subject_lc, '=?') && contains(raw_subject_lc, '?=')" {
    if eval "contains(raw_subject_lc, '?q?')" {
        # Subject header is unnecessarily encoded in quoted-printable
        let "t.SUBJ_EXCESS_QP" "1";
    } elsif eval "contains(raw_subject_lc, '?b?')" {
        # Subject header is unnecessarily encoded in base64
        let "t.SUBJ_EXCESS_BASE64" "1";
    }
}

if eval "starts_with(subject_lc, 're:') && is_empty(header.in-reply-to) && is_empty(header.references)" {
    # Fake reply
    let "t.FAKE_REPLY" "1";
}

let "subject_lc_trim" "trim_end(subject_lc)";
if eval "subject_lc != subject_lc_trim" {
    # Subject ends with space characters
    let "t.SUBJECT_ENDS_SPACES" "1";
}

if eval "contains(subject_lc, '$') || 
         contains(subject_lc, '€') || 
         contains(subject_lc, '£') || 
         contains(subject_lc, '¥')" {
    # Subject contains currency symbols
    let "t.SUBJECT_HAS_CURRENCY" "1";
}

if eval "ends_with(subject_lc_trim, '!')" {
    # Subject ends with an exclamation mark
    let "t.SUBJECT_ENDS_EXCLAIM" "1";
} elsif eval "ends_with(subject_lc_trim, '?')" {
    # Subject ends with a question mark
    let "t.SUBJECT_ENDS_QUESTION" "1";
}

if eval "contains(subject_lc_trim, '!')" {
    # Subject contains an exclamation mark
    let "t.SUBJECT_HAS_EXCLAIM" "1";
}

if eval "contains(subject_lc_trim, '?')" {
    # Subject contains a question mark
    let "t.SUBJECT_HAS_QUESTION" "1";
}


#### Script replyto.sieve ####

let "rto_raw" "to_lowercase(header.reply-to.raw)";
if eval "!is_empty(rto_raw)" {
    let "rto_name" "to_lowercase(header.reply-to.name)";

    if eval "is_email(rto_addr)" {
        let "t.HAS_REPLYTO" "1";
        let "rto_domain_sld" "domain_part(email_part(rto_addr, 'domain'), 'sld')";

        if eval "eq_ignore_case(header.reply-to, header.from)" {
            let "t.REPLYTO_EQ_FROM" "1";
        } else {
            if eval "rto_domain_sld == from_domain_sld" {
                let "t.REPLYTO_DOM_EQ_FROM_DOM" "1";
            } else {
                let "is_from_list" "!is_empty(header.List-Unsubscribe:List-Id:X-To-Get-Off-This-List:X-List:Auto-Submitted[*])";
                if eval "!is_from_list && contains_ignore_case(recipients_clean, rto_addr)"  {
                    let "t.REPLYTO_EQ_TO_ADDR" "1";
                } else {
                    let "t.REPLYTO_DOM_NEQ_FROM_DOM" "1";
                }

                if eval "!is_from_list &&
                         !eq_ignore_case(from_addr, header.to.addr) && 
                         !(count(envelope.to) == 1 && envelope.to[0] == from_addr)" {
                    let "i" "count(envelope.to)";
                    let "found_domain" "0";

                    while "i != 0" {
                        let "i" "i - 1";

                        if eval "domain_part(email_part(envelope.to[i], 'domain'), 'sld') == from_domain_sld" {
                            let "found_domain" "1";
                            break;
                        }
                    }

                    if eval "!found_domain" {
                        let "t.SPOOF_REPLYTO" "1";
                    }
                }
            }

            if eval "!is_empty(rto_name) && eq_ignore_case(rto_name, header.from.name)" {
                let "t.REPLYTO_DN_EQ_FROM_DN" "1";
            }
        }

        if eval "rto_addr == envelope.from" {
            let "t.REPLYTO_ADDR_EQ_FROM" "1";
        }

        if eval "key_exists('spam-free', rto_domain_sld)" {
            let "t.FREEMAIL_REPLYTO" "1";
            if eval "rto_domain_sld != from_domain_sld && key_exists('spam-free', from_domain_sld)" {
                let "t.FREEMAIL_REPLYTO_NEQ_FROM_DOM" "1";
            }
        } elsif eval "key_exists('spam-disposable', rto_domain_sld)" {
            let "t.DISPOSABLE_REPLYTO" "1";
        }

    } else {
        let "t.REPLYTO_UNPARSABLE" "1";
    }

    if eval "is_ascii(header.reply-to) && contains(rto_raw, '=?') && contains(rto_raw, '?=')" {
        if eval "contains(rto_raw, '?q?')" {
            # Reply-To header is unnecessarily encoded in quoted-printable
            let "t.REPLYTO_EXCESS_QP" "1";
        } elsif eval "contains(rto_raw, '?b?')" {
            # Reply-To header is unnecessarily encoded in base64
            let "t.REPLYTO_EXCESS_BASE64" "1";
        }
    }

    if eval "contains(rto_name, 'mr. ') || contains(rto_name, 'ms. ') || contains(rto_name, 'mrs. ') || contains(rto_name, 'dr. ')" {
        let "t.REPLYTO_EMAIL_HAS_TITLE" "1";
    }
}



#### Script date.sieve ####

if eval "header.date.exists" {
    let "date" "header.date.date";

    if eval "date != 0" {
        let "date_diff" "env.now - date";

        if eval "date_diff > 86400" {
            # Older than a day
            let "t.DATE_IN_PAST" "1";
        } elsif eval "-date_diff > 7200" {
            # More than 2 hours in the future
            let "t.DATE_IN_FUTURE" "1";
        }
    } else {
        let "t.INVALID_DATE" "1";
    }
} else {
    let "t.MISSING_DATE" "1";
}


#### Script messageid.sieve ####

let "mid_raw" "trim(header.message-id.raw)";

if eval "!is_empty(mid_raw)" {
    let "mid_lcase" "to_lowercase(header.message-id)";
    let "mid_rhs" "email_part(mid_lcase, 'domain')";

    if eval "!is_empty(mid_rhs)" {
        if eval "starts_with(mid_rhs, '[') && ends_with(mid_rhs, ']') && is_ip_addr(strip_suffix(strip_prefix(mid_rhs, '['), ']'))" {
            let "t.MID_RHS_IP_LITERAL" "1";
        } elsif eval "is_ip_addr(mid_rhs)" {
            let "t.MID_BARE_IP" "1";
        } elsif eval "!contains(mid_rhs, '.')" {
            let "t.MID_RHS_NOT_FQDN" "1";
        }

        if eval "starts_with(mid_rhs, 'www.')" {
            let "t.MID_RHS_WWW" "1";
        }

        if eval "!is_ascii(mid_raw) || contains(mid_raw, '(') || starts_with(mid_lcase, '@')" {
            let "t.INVALID_MSGID" "1";
        }

        # From address present in Message-ID checks
        let "sender" "from_addr";
        if eval "is_empty(sender)" {
            let "sender" "envelope.from";
        }
        if eval "!is_empty(sender)" {
            if eval "contains(mid_lcase, sender)" {
                let "t.MID_CONTAINS_FROM" "1";
            } else {
                let "from_domain" "email_part(sender, 'domain')";
                let "mid_sld" "domain_part(mid_rhs, 'sld')";

                if eval "mid_rhs == from_domain" {
                    let "t.MID_RHS_MATCH_FROM" "1";
                } elsif eval "!is_empty(mid_sld) && domain_part(from_domain, 'sld') == mid_sld" {
                    let "t.MID_RHS_MATCH_FROMTLD" "1";
                }
            }
        }

        # To/Cc addresses present in Message-ID checks
        let "recipients_len" "count(recipients)";        
        let "i" "0";

        while "i < recipients_len" {
            let "rcpt" "recipients[i]";
            let "i" "i + 1";
            if eval "contains(mid_lcase, rcpt)" {
                let "t.MID_CONTAINS_TO" "1";
            } elsif eval "email_part(rcpt, 'domain') == mid_rhs" {
                let "t.MID_RHS_MATCH_TO" "1";
            }
        }
    } else {
        let "t.INVALID_MSGID" "1";
    }

    if eval "!starts_with(mid_raw, '<') || !contains(mid_raw, '>')" {
        let "t.MID_MISSING_BRACKETS" "1";
    }

} else {
    let "t.MISSING_MID" "1";
}



#### Script received.sieve ####

let "rcvd_raw" "header.received[*].raw";
let "rcvd_count" "count(rcvd_raw)";

# Count received headers
if eval "rcvd_count == 0" {
    let "t.RCVD_COUNT_ZERO" "1";
} elsif eval "rcvd_count == 1" {
    let "t.RCVD_COUNT_ONE" "1";
} elsif eval "rcvd_count == 2" {
    let "t.RCVD_COUNT_TWO" "1";
} elsif eval "rcvd_count == 3" {
    let "t.RCVD_COUNT_THREE" "1";
} elsif eval "rcvd_count <= 5" {
    let "t.RCVD_COUNT_FIVE" "1";
} elsif eval "rcvd_count <= 7" {
    let "t.RCVD_COUNT_SEVEN" "1";
} elsif eval "rcvd_count <= 12" {
    let "t.RCVD_COUNT_TWELVE" "1";
}

# Received from an authenticated user
if eval "!is_empty(env.authenticated_as)" {
    let "t.RCVD_VIA_SMTP_AUTH" "1";
}

# Received headers have non-ASCII characters
if eval "!is_ascii(rcvd_raw)" {
    let "t.RCVD_ILLEGAL_CHARS" "1";
}

let "i" "0";
let "tls_count" "0";
let "rcvd_from_ip" "0";
while "i < rcvd_count" {
    let "i" "i + 1";
    let "helo_domain" "received_part(i, 'from')";

    # Check for a forged received trail
    if eval "!t.FORGED_RCVD_TRAIL" {
        let "iprev" "received_part(i, 'iprev')";

        if eval "!is_empty(iprev) && !is_empty(helo_domain) && !eq_ignore_case(helo_domain, iprev)" {
            let "t.FORGED_RCVD_TRAIL" "1";
        }
    }

    if eval "!t.PREVIOUSLY_DELIVERED" {
        let "for" "received_part(i, 'for')";
        # Recipient appears on Received trail
        if eval "!is_empty(for) && contains_ignore_case(recipients, for)" {
            let "t.PREVIOUSLY_DELIVERED" "1";
        }
    }

    if eval "!t.RCVD_HELO_USER && eq_ignore_case(helo_domain, 'user')" {
        # Received: HELO contains 'user'
        let "t.RCVD_HELO_USER" "1";
    }

    if eval "!is_empty(received_part(i, 'from.ip'))" {
        # Received from an IP address rather than a FQDN
        let "rcvd_from_ip" "rcvd_from_ip + 1";
    }

    if eval "!is_empty(received_part(i, 'tls'))" {
        # Received with TLS
        let "tls_count" "tls_count + 1";
    }
}

if eval "rcvd_from_ip >= 2 || (rcvd_from_ip == 1 && is_ip_addr(env.helo_domain))" {
    # Has two or more Received headers containing bare IP addresses
    let "t.RCVD_DOUBLE_IP_SPAM" "1";
}

if eval "rcvd_count == 0" {
    # One received header in a message (currently zero but one header will be added later by the MTA)
    let "t.ONCE_RECEIVED" "1";
    
    # Message has been directly delivered from MUA to local MX
    if eval "header.User-Agent.exists || header.X-Mailer.exists" {
        let "t.DIRECT_TO_MX" "1";
    }
}

# Received with TLS checks
if eval "rcvd_count > 0 && tls_count == rcvd_count && !is_empty(env.tls.version)" {
    let "t.RCVD_TLS_ALL" "1";
} elsif eval "!is_empty(env.tls.version)" {
    let "t.RCVD_TLS_LAST" "1";
} else {
    let "t.RCVD_NO_TLS_LAST" "1";
}


#### Script headers.sieve ####

# Mailing list scores
let "ml_score" "count(header.List-Id:List-Archive:List-Owner:List-Help:List-Post:X-Loop:List-Subscribe:List-Unsubscribe[*].exists) * 0.125";
if eval "ml_score < 1" {
    if eval "header.List-Id.exists" {
        let "ml_score" "ml_score + 0.50";
    }
    if eval "header.List-Subscribe.exists && header.List-Unsubscribe.exists" {
        let "ml_score" "ml_score + 0.25";
    }
    if eval "header.Precedence.exists && (eq_ignore_case(header.Precedence, 'list') || eq_ignore_case(header.Precedence, 'bulk'))" {
        let "ml_score" "ml_score + 0.25";
    }
}
if eval "ml_score >= 1" {
    let "t.MAILLIST" "1";
}

# X-Priority
if eval "header.x-priority.exists" {
    let "xp" "header.x-priority";
    if eval "xp == 0" {
        let "t.HAS_X_PRIO_ZERO" "1";
    } elsif eval "xp == 1" {
        let "t.HAS_X_PRIO_ONE" "1";
    } elsif eval "xp == 2" {
        let "t.HAS_X_PRIO_TWO" "1";
    } elsif eval "xp <= 4" {
        let "t.HAS_X_PRIO_THREE" "1";
    } elsif eval "xp >= 5" {
        let "t.HAS_X_PRIO_FIVE" "1";
    }
}

let "unique_header_names" "to_lowercase(header.Content-Type:Content-Transfer-Encoding:Date:From:Sender:Reply-To:To:Cc:Bcc:Message-ID:In-Reply-To:References:Subject[*].raw_name)";
let "unique_header_names_len" "count(unique_header_names)";
if eval "unique_header_names_len != count(dedup(unique_header_names))" {
    let "t.MULTIPLE_UNIQUE_HEADERS" "1";
} elsif eval "unique_header_names_len == 0" {
    let "t.MISSING_ESSENTIAL_HEADERS" "1";
}

# Wrong case X-Mailer
if eval "header.x-mailer.exists && header.x-mailer.raw_name != 'X-Mailer'" {
    let "t.XM_CASE" "1";
}

# Has organization header
if eval "header.organization:organisation.exists" {
    let "t.HAS_ORG_HEADER" "1";
}

# Has X-Originating-IP header
if eval "header.X-Originating-IP.exists" {
    let "t.HAS_XOIP" "1";
}

# Has List-Unsubscribe header
if eval "header.List-Unsubscribe.exists" {
    let "t.HAS_LIST_UNSUB" "1";
}

# Missing version number in X-Mailer or User-Agent headers
if eval "(header.X-Mailer.exists && !has_digits(header.X-Mailer)) || (header.User-Agent.exists && !has_digits(header.User-Agent))" {
    let "t.XM_UA_NO_VERSION" "1";
}

# Precedence is bulk
if eval "eq_ignore_case(header.Precedence, 'bulk')" {
    let "t.PRECEDENCE_BULK" "1";
}

# Upstream SPAM filtering
if eval "contains_ignore_case(header.X-KLMS-AntiSpam-Status, 'spam')" {
    # Kaspersky Security for Mail Server says this message is spam
    let "t.KLMS_SPAM" "1";
}
let "spam_hdr" "to_lowercase(header.X-Spam:X-Spam-Flag:X-Spam-Status)";
if eval "contains(spam_hdr, 'yes') || contains(spam_hdr, 'true') || contains(spam_hdr, 'spam')" {
    # Message was already marked as spam
    let "t.SPAM_FLAG" "1";
}
if eval "contains_ignore_case(header.X-UI-Filterresults:X-UI-Out-Filterresults, 'junk')" {
    # United Internet says this message is spam
    let "t.UNITEDINTERNET_SPAM" "1";
}

# Compromised hosts
if eval "header.X-PHP-Originating-Script.exists" {
    let "t.HAS_X_POS" "1";
    if eval "contains(header.X-PHP-Originating-Script, 'eval()')" {
        let "t.X_PHP_EVAL" "1";
    }
    if eval "contains(header.X-PHP-Originating-Script, '../')" {
        let "t.HIDDEN_SOURCE_OBJ" "1";
    }
}
if eval "header.X-PHP-Script.exists" {
    let "t.HAS_X_PHP_SCRIPT" "1";
    if eval "contains(header.X-PHP-Script, 'eval()')" {
        let "t.X_PHP_EVAL" "1";
    }
    if eval "contains(header.X-PHP-Script, 'sendmail.php')" {
        let "t.PHP_XPS_PATTERN" "1";
    }
    if eval "contains(header.X-PHP-Script, '../')" {
        let "t.HIDDEN_SOURCE_OBJ" "1";
    }
}
if eval "contains_ignore_case(header.X-Mailer, 'PHPMailer')" {
    let "t.HAS_PHPMAILER_SIG" "1";
}
if eval "header.X-Source:X-Source-Args:X-Source-Dir.exists" {
    let "t.HAS_X_SOURCE" "1";
    if eval "contains(header.X-Source-Args, '../')" {
        let "t.HIDDEN_SOURCE_OBJ" "1";
    }
}
if eval "contains(header.X-Authenticated-Sender, ': ')" {
    let "t.HAS_X_AS" "1";
}
if eval "contains(header.X-Get-Message-Sender-Via, 'authenticated_id:')" {
    let "t.HAS_X_GMSV" "1";
}
if eval "header.X-AntiAbuse.exists" {
    let "t.HAS_X_ANTIABUSE" "1";
}
if eval "header.X-Authentication-Warning.exists" {
    let "t.HAS_XAW" "1";
}

# Check for empty delimiters in raw headers
let "raw_headers" "header.from:to:cc:subject:reply-to:date[*].raw";
let "i" "count(raw_headers)";
while "i > 0" {
    let "i" "i - 1";
    if eval "!starts_with(raw_headers[i], ' ')" {
        let "t.HEADER_EMPTY_DELIMITER" "1";
        break;
    }
}


#### Script bounce.sieve ####


if eval "(contains(subject_lc, 'delivery') && 
            (contains(subject_lc, 'failed') || 
             contains(subject_lc, 'report') || 
             contains(subject_lc, 'status') || 
             contains(subject_lc, 'warning'))) ||
         (contains(subject_lc, 'failure') && 
            (contains(subject_lc, 'delivery') || 
             contains(subject_lc, 'notice') || 
             contains(subject_lc, 'mail') )) ||
         (contains(subject_lc, 'delivered') &&
            (contains(subject_lc, 'couldn\\'t be') || 
             contains(subject_lc, 'could not be') || 
             contains(subject_lc, 'hasn\\'t been') || 
             contains(subject_lc, 'has not been'))) ||
         contains(subject_lc, 'returned mail') ||
         contains(subject_lc, 'undeliverable') || 
         contains(subject_lc, 'undelivered')" {
    # Subject contains words or phrases typical for DSN
    let "t.SUBJ_BOUNCE_WORDS" "1";
}

if eval "is_empty(envelope.from)" {
    if eval "eq_ignore_case(header.content-type, 'multipart/report') && 
             ( eq_ignore_case(header.content-type.attr.report-type, 'delivery-status') ||
               eq_ignore_case(header.content-type.attr.report-type, 'disposition-notification'))" {
        let "t.BOUNCE" "1";
    } else {
        let "from" "to_lowercase(header.from)";

        if eval "contains(from, 'mdaemon') && !is_empty(header.X-MDDSN-Message)" {
            let "t.BOUNCE" "1";
        } elsif eval "contains(from, 'postmaster') || contains(from, 'mailer-daemon')" {
            if eval "t.SUBJ_BOUNCE_WORDS" {
                let "t.BOUNCE" "1";
            } else {
                foreverypart {
                    if eval "(eq_ignore_case(header.content-type.type, 'message') ||
                              eq_ignore_case(header.content-type.type, 'text')) &&
                             (eq_ignore_case(header.content-type.subtype, 'rfc822-headers') ||
                              eq_ignore_case(header.content-type.subtype, 'rfc822'))" {
                        let "t.BOUNCE" "1";
                        break;
                    }
                }
            }
        }
    }
}


#### Script html.sieve ####


# Message only has text/html MIME parts
if eval "header.content-type == 'text/html'" {
    let "t.MIME_HTML_ONLY" "1";
} 

foreverypart {
    if eval "eq_ignore_case(header.content-type, 'text/html')" {
        # Tokenize HTML
        let "is_body_part" "is_body()";
        let "html_tokens" "tokenize(part.text, 'html')";
        let "html_tokens_len" "len(html_tokens)";
        let "html_char_count" "0";
        let "html_space_count" "0";
        let "html_img_words" "0";
        let "html_words" "0";
        let "has_link_to_img" "0";
        let "has_uri" "0";
        let "has_text" "0";
        let "in_head" "0";
        let "in_body" "0";
        let "in_anchor" "0";
        let "in_anchor_href_ip" "0";
        let "in_anchor_href" "";

        let "i" "0";
        while "i < html_tokens_len" {
            let "token" "html_tokens[i]";
            let "i" "i + 1";

            # Tokens starting with '_' are text nodes
            if eval "starts_with(token, '_')" {
                if eval "in_head == 0" {
                    let "html_char_count" "html_char_count + count_chars(token)";
                    let "html_space_count" "html_space_count + count_spaces(token)";

                    let "text" "to_lowercase(trim(strip_prefix(token, '_')))";
                    let "html_words" "html_words + len(tokenize(text, 'words'))";

                    let "uris" "tokenize(text, 'uri')";

                    if eval "!is_empty(uris)" {
                        let "has_uri" "1";
                        let "uri" "uris[0]";

                        if eval "in_anchor && !is_empty(in_anchor_href)" {
                            if eval "contains(text, '://') &&
                                    uri_part(uri, 'scheme') != uri_part(in_anchor_href, 'scheme')" {
                                # The anchor text contains a distinct scheme compared to the target URL
                                let "t.HTTP_TO_HTTPS" "1";
                            }
                            if eval "(!in_anchor_href_ip && (domain_part(uri_part(uri, 'host'), 'sld') != domain_part(uri_part(in_anchor_href, 'host'), 'sld'))) ||
                                     (in_anchor_href_ip && (uri_part(uri, 'host') != uri_part(in_anchor_href, 'host')))" {
                                let "t.PHISHING" "1";
                            }
                        }
                    } elsif eval "!is_empty(text)" {
                        let "has_text" "1";
                    }
                }
            } elsif eval "starts_with(token, '<img')" {
                if eval "is_body_part" {
                    let "dimensions" "html_attr_size(token, 'width', 800) + html_attr_size(token, 'height', 600)";

                    if eval "in_anchor && dimensions >= 210" {
                        let "has_link_to_img" "1";
                    }
                    if eval "dimensions > 100" {
                        # We assume that a single picture 100x200 contains approx 3 words of text
                        let "html_img_words" "html_img_words + dimensions / 100";
                    }

                    let "img_src" "html_attr(token, 'src')";
                    if eval "starts_with(img_src, 'data:') && contains(img_src, ';base64,')" {
                        # Has Data URI encoding
                        let "t.HAS_DATA_URI" "1";
                    }
                }
            } elsif eval "starts_with(token, '<head')" {
                let "in_head" "in_head + 1";
            } elsif eval "starts_with(token, '</head')" {
                let "in_head" "in_head - 1";
            } elsif eval "starts_with(token, '<body')" {
                let "in_body" "in_body + 1";
            } elsif eval "starts_with(token, '</body')" {
                let "in_body" "in_body - 1";
            } elsif eval "starts_with(token, '<a ')" {
                let "in_anchor" "1";
                let "in_anchor_href_ip" "0";
                let "in_anchor_href" "to_lowercase(trim(html_attr(token, 'href')))";

                if eval "is_body_part && starts_with(in_anchor_href, 'data:') && contains(in_anchor_href, ';base64,')" {
                    # Has Data URI encoding
                    let "t.HAS_DATA_URI" "1";
                    if eval "contains(in_anchor_href, 'text/')" {
                        # Uses Data URI encoding to obfuscate plain or HTML in base64
                        let "t.DATA_URI_OBFU" "1";
                    }
                } elsif eval "is_ip_addr(uri_part(in_anchor_href, 'host'))" {
                    # HTML anchor points to an IP address
                    let "t.HTTP_TO_IP" "1";
                    let "in_anchor_href_ip" "1";
                }
            } elsif eval "in_anchor && starts_with(token, '</a')" {
                let "in_anchor" "0";
            } elsif eval "starts_with(token, '<meta ')" {
                if eval "eq_ignore_case(html_attr(token, 'http-equiv'), 'refresh') &&
                         contains_ignore_case(html_attr(token, 'content'), 'url=')" {
                    # HTML meta refresh tag
                    let "t.HTML_META_REFRESH_URL" "1";
                }
            } elsif eval "starts_with(token, '<link') && is_body_part &&
                            (contains_ignore_case(html_attr(token, 'rel'), 'stylesheet') ||
                             contains_ignore_case(html_attr(token, 'href'), '.css') )" {
                let "t.EXT_CSS" "1";
            }
        }

        if eval "is_body_part" {
            # Check for unbalanced tags
            if eval "in_head != 0 || in_body != 0" {
                let "t.HTML_UNBALANCED_TAG" "1";
            }

            # Check for short HTML parts with a link to an image
            if eval "has_link_to_img" {
                if eval "html_char_count < 1024" {
                    let "t.HTML_SHORT_LINK_IMG_1" "1";
                } elsif eval "html_char_count < 1536" {
                    let "t.HTML_SHORT_LINK_IMG_2" "1";
                } elsif eval "html_char_count < 2048" {
                    let "t.HTML_SHORT_LINK_IMG_3" "1";
                }
            } 
            
            if eval "(!has_link_to_img || html_char_count >= 2048) && 
                    (html_img_words / (html_words + html_img_words) > 0.5)" {
                # Message contains more images than text
                let "t.HTML_TEXT_IMG_RATIO" "1";
            }

            if eval "has_uri && !has_text" {
                let "t.BODY_URI_ONLY" "1";
            }
        }
    }
}



#### Script mime.sieve ####

if eval "!header.mime-version.exists" {
    if eval "header.content-type.exists || header.content-transfer-encoding.exists" {
        let "t.MISSING_MIME_VERSION" "1";
    }
} elsif eval "header.mime-version.raw_name != 'MIME-Version'" {
    let "t.MV_CASE" "1";
}

let "has_text_part" "0";
let "is_encrypted" "0";
let "parts_num" "0";
let "parts_max_len" "0";

if eval "header.Content-Type.exists && !header.Content-Disposition:Content-Transfer-Encoding:MIME-Version.exists && !eq_ignore_case(header.Content-Type, 'text/plain')" {
    # Only Content-Type header without other MIME headers
    let "t.MIME_HEADER_CTYPE_ONLY" "1";
}

foreverypart {
    let "content_type" "to_lowercase(header.content-type)";
    let "type" "to_lowercase(header.content-type.type)";
    let "subtype" "to_lowercase(header.content-type.subtype)";
    let "cte" "header.content-transfer-encoding";
    let "part_is_attachment" "is_attachment()";

    if eval "cte != '' && !is_lowercase(cte)" {
        let "cte" "to_lowercase(cte)";
        let "t.CTE_CASE" "1";
    }

    if eval "ends_with(header.content-type.raw, ';')" {
        # Content-Type header ends with a semi-colon
        let "t.CT_EXTRA_SEMI" "1";
    }

    if eval "type == 'multipart'" {
        if eval "subtype == 'alternative'" {
            let "has_plain_part" "0";
            let "has_html_part" "0";
            
            let "text_part_words" "";
            let "text_part_uris" "0";

            let "html_part_words" "";
            let "html_part_uris" "0";

            foreverypart {
                let "ma_ct" "to_lowercase(header.content-type)";

                if eval "!has_plain_part && ma_ct == 'text/plain'" {
                    let "text_part" "part.text";
                    let "text_part_words" "tokenize(text_part, 'words')";
                    let "text_part_uris" "count(dedup(uri_part(tokenize(text_part, 'uri_strict'), 'host')))";
                    let "has_plain_part" "1";
                } elsif eval "!has_html_part && ma_ct == 'text/html'" {
                    let "html_part" "html_to_text(part.text)";
                    let "html_part_words" "tokenize(html_part, 'words')";
                    let "html_part_uris" "count(dedup(uri_part(tokenize(part.text, 'uri_strict'), 'host')))";
                    let "has_html_part" "1";
                }
            }

            # Multipart message mostly text/html MIME
            if eval "has_html_part" {
                if eval "!has_plain_part" {
                    let "t.MIME_MA_MISSING_TEXT" "1";
                } 
            } elsif eval "has_plain_part" {
                let "t.MIME_MA_MISSING_HTML" "1";
            }

            # HTML and text parts are different
            if eval "!t.R_PARTS_DIFFER && has_html_part && has_plain_part &&
                     (!is_empty(text_part_words) || !is_empty(html_part_words)) &&
                     cosine_similarity(text_part_words, html_part_words) < 0.95" {
                let "t.R_PARTS_DIFFER" "1";
            }

            # Odd URI count between parts
            if eval "text_part_uris != html_part_uris" {
                set "t.URI_COUNT_ODD" "1";
            }
        } elsif eval "subtype == 'mixed'" {
            let "num_text_parts" "0";
            let "has_other_part" "0";

            foreverypart {
                if eval "eq_ignore_case(header.content-type.type, 'text') && !is_attachment()" {
                    let "num_text_parts" "num_text_parts + 1";
                } elsif eval "!eq_ignore_case(header.content-type.type, 'multipart')" {
                    let "has_other_part" "1";
                }
            }
            
            # Found multipart/mixed without non-textual part
            if eval "!has_other_part && num_text_parts < 3" {
                let "t.CTYPE_MIXED_BOGUS" "1";
            }
        } elsif eval "subtype == 'encrypted'" {
            set "is_encrypted" "1";
        }
    } else {
        if eval "type == 'text'" {
            # MIME text part claims to be ASCII but isn't
            if eval "cte == '' || cte == '7bit'" {
                if eval "!is_ascii(part.raw)" {
                    let "t.R_BAD_CTE_7BIT" "1";
                }
            } else {
                if eval "cte == 'base64'" {
                    if eval "is_ascii(part.text)" {
                        # Has text part encoded in base64 that does not contain any 8bit characters
                        let "t.MIME_BASE64_TEXT_BOGUS" "1";
                    } else {
                        # Has text part encoded in base64
                        let "t.MIME_BASE64_TEXT" "1";
                    }
                }

                if eval "subtype == 'plain' && is_empty(header.content-type.attr.charset)" {
                    # Charset header is missing
                    let "t.R_MISSING_CHARSET" "1";
                }
            }
            let "has_text_part" "1";
        } elsif eval "type == 'application'" {
            if eval "subtype == 'pkcs7-mime'" {
                let "t.ENCRYPTED_SMIME" "1";
                let "part_is_attachment" "0";
            } elsif eval "subtype == 'pkcs7-signature'" {
                let "t.SIGNED_SMIME" "1";
                let "part_is_attachment" "0";
            } elsif eval "subtype == 'pgp-encrypted'" {
                let "t.ENCRYPTED_PGP" "1";
                let "part_is_attachment" "0";
            } elsif eval "subtype == 'pgp-signature'" {
                let "t.SIGNED_PGP" "1";
                let "part_is_attachment" "0";
            } elsif eval "subtype == 'octet-stream'" {
                if eval "!is_encrypted &&
                        !header.content-id.exists && 
                        (!header.content-disposition.exists || 
                        (!eq_ignore_case(header.content-disposition.type, 'attachment') && 
                        is_empty(header.content-disposition.attr.filename)))" {
                    let "t.CTYPE_MISSING_DISPOSITION" "1";
                }
            }
        }

        # Increase part count
        let "parts_num" "parts_num + 1";
        if eval "parts_num == 1" {
            let "parts_len" "mime_part_len()";
            if eval "parts_len > parts_max_len" {
                let "parts_max_len" "parts_len";
            }
        }
    }

    if eval "is_empty(type) && header.content-type.exists" {
        let "t.BROKEN_CONTENT_TYPE" "1";
    }

    if eval "part_is_attachment" {
        # Has a MIME attachment
        let "t.HAS_ATTACHMENT" "1";

        # Detect and compare mime type
        let "detected_mime_type" "detect_file_type('mime')";
        if eval "!is_empty(detected_mime_type)" {
            if eval "detected_mime_type == content_type" {
                # Known content-type
                let "t.MIME_GOOD" "1";
            } elsif eval "content_type != 'application/octet-stream'" {
                # Known bad content-type
                let "t.MIME_BAD" "1";
            }
        }
    }

    # Analyze attachment name
    let "attach_name" "attachment_name()";
    if eval "!is_empty(attach_name)" {
        if eval "has_obscured(attach_name)" {
            let "t.MIME_BAD_UNICODE" "1";
        }
        let "name_parts" "rsplit(to_lowercase(attach_name), '.')";
        if eval "count(name_parts) > 1" {
            let "ext_type" "key_get('spam-mime', name_parts[0])";
            if eval "!is_empty(ext_type)" {
                let "ext_type_double" "key_get('spam-mime', name_parts[1])";
                if eval "contains(ext_type, 'BAD')" {
                    # Bad extension
                    if eval "contains(ext_type_double, 'BAD')" {
                        let "t.MIME_DOUBLE_BAD_EXTENSION" "1";
                    } else {
                        let "t.MIME_BAD_EXTENSION" "1";
                    }
                }
                if eval "contains(ext_type, 'AR') && contains(ext_type_double, 'AR')" {
                    # Archive in archive
                    let "t.MIME_ARCHIVE_IN_ARCHIVE" "1";
                }

                if eval "contains(ext_type, '/') && 
                            content_type != 'application/octet-stream' && 
                            !contains(split(ext_type, '|'), content_type)" {
                    # Invalid attachment mime type
                    let "t.MIME_BAD_ATTACHMENT" "1";
                }
            }
        }
    }

}

# Message contains both text and encrypted parts
if eval "has_text_part && (t.ENCRYPTED_SMIME || t.ENCRYPTED_PGP)" {
    let "t.BOGUS_ENCRYPTED_AND_TEXT" "1";
}

# Message contains only one short part
if eval "parts_num == 1 && parts_max_len < 64" {
    let "t.SINGLE_SHORT_PART" "1";
} elsif eval "parts_max_len == 0" {
    let "t.COMPLETELY_EMPTY" "1";
}

# Check for mixed script in body
if eval "!is_single_script(text_body)" {
    let "t.R_MIXED_CHARSET" "1";
}


#### Script dmarc.sieve ####

if eval "env.spf.result == 'pass'" {
    let "t.SPF_ALLOW" "1";
} elsif eval "env.spf.result == 'fail'" {
    let "t.SPF_FAIL" "1";
} elsif eval "env.spf.result == 'softfail'" {
    let "t.SPF_SOFTFAIL" "1";
} elsif eval "env.spf.result == 'neutral'" {
    let "t.SPF_NEUTRAL" "1";
} elsif eval "env.spf.result == 'temperror'" {
    let "t.SPF_DNSFAIL" "1";
} elsif eval "env.spf.result == 'permerror'" {
    let "t.SPF_PERMFAIL" "1";
} else {
    let "t.SPF_NA" "1";
}

if eval "env.dkim.result == 'pass'" {
    let "t.DKIM_ALLOW" "1";
} elsif eval "env.dkim.result == 'fail'" {
    let "t.DKIM_REJECT" "1";
} elsif eval "env.dkim.result == 'temperror'" {
    let "t.DKIM_TEMPFAIL" "1";
} elsif eval "env.dkim.result == 'permerror'" {
    let "t.DKIM_PERMFAIL" "1";
} else {
    let "t.DKIM_NA" "1";
}

if eval "env.arc.result == 'pass'" {
    let "t.ARC_ALLOW" "1";
} elsif eval "env.arc.result == 'fail'" {
    let "t.ARC_REJECT" "1";
} elsif eval "env.arc.result == 'temperror'" {
    let "t.ARC_DNSFAIL" "1";
} elsif eval "env.arc.result == 'permerror'" {
    let "t.ARC_INVALID" "1";
} else {
    let "t.ARC_NA" "1";
}

if eval "env.dmarc.result == 'pass'" {
    let "t.DMARC_POLICY_ALLOW" "1";
} elsif eval "env.dmarc.result == 'temperror'" {
    let "t.DMARC_DNSFAIL" "1";
} elsif eval "env.dmarc.result == 'permerror'" {
    let "t.DMARC_BAD_POLICY" "1";
} elsif eval "env.dmarc.result == 'fail'" {
    if eval "env.dmarc.policy == 'quarantine'" {
        let "t.DMARC_POLICY_QUARANTINE" "1";
    } elsif eval "env.dmarc.policy == 'reject'" {
        let "t.DMARC_POLICY_REJECT" "1";
    } else {
        let "t.DMARC_POLICY_SOFTFAIL" "1";
    }
} else {
    let "t.DMARC_NA" "1";
}

if eval "header.DKIM-Signature.exists" {
    let "t.DKIM_SIGNED" "1";
    if eval "header.ARC-Seal.exists" {
        let "t.ARC_SIGNED" "1";
    }
}

# Check allowlists
if eval "key_exists('spam-dmarc', from_domain)" {
    if eval "t.DMARC_POLICY_ALLOW" {
        let "t.ALLOWLIST_DMARC" "1";
    } else {
        let "t.BLOCKLIST_DMARC" "1";
    }
} elsif eval "key_exists('spam-spdk', from_domain)" {
    let "is_dkim_pass" "contains(env.dkim.domains, from_domain) || t.ARC_ALLOW";

    if eval "is_dkim_pass && t.SPF_ALLOW" {
        let "t.ALLOWLIST_SPF_DKIM" "1";
    } elsif eval "is_dkim_pass" {
        let "t.ALLOWLIST_DKIM" "1";
        if eval "!t.SPF_DNSFAIL" {
            let "t.BLOCKLIST_SPF" "1";
        }
    } elsif eval "t.SPF_ALLOW" {
        let "t.ALLOWLIST_SPF" "1";
        if eval "!t.DKIM_TEMPFAIL" {
            let "t.BLOCKLIST_DKIM" "1";
        }
    } elsif eval "!t.SPF_DNSFAIL && !t.DKIM_TEMPFAIL" {
        let "t.BLOCKLIST_SPF_DKIM" "1";
    }
}


#### Script ip.sieve ####

# Reverse ip checks
if eval "env.iprev.result != ''" {
    if eval "env.iprev.result == 'temperror'" {
        let "t.RDNS_DNSFAIL" "1";
    } elsif eval "env.iprev.result == 'fail' || env.iprev.result == 'permerror'" {
        let "t.RDNS_NONE" "1";
    }
}


#### Script helo.sieve ####

if eval "!is_ip_addr(env.helo_domain)" {
    let "helo" "env.helo_domain";

    if eval "contains(helo, '.')" {
        if eval "!is_empty(env.iprev.ptr) && !eq_ignore_case(helo, env.iprev.ptr)" {
            # Helo does not match reverse IP
            let "t.HELO_IPREV_MISMATCH" "1";
        }
        if eval "!dns_exists(helo, 'ip') && !dns_exists(helo, 'mx')" {
            # Helo no resolve to A or MX
            let "t.HELO_NORES_A_OR_MX" "1";
        }
    } else {
        if eval "contains(helo, 'user')" {
            # HELO contains 'user'
            let "t.RCVD_HELO_USER" "1";
        }

        # Helo not FQDN
        let "t.HELO_NOT_FQDN" "1";
    }
} else {
    # Helo host is bare ip
    let "t.HELO_BAREIP" "1";
    
    if eval "env.helo_domain != env.remote_ip" {
        # Helo A IP != hostname IP
        let "t.HELO_IP_A" "1";
    }
}


#### Script replies_in.sieve ####


let "message_ids" "header.In-Reply-To:References";

let "i" "count(message_ids)";
while "i > 0" {
    let "i" "i - 1";

    if eval "key_exists(SPAM_DB, 'm:' + message_ids[i])" {
        let "t.TRUSTED_REPLY" "1";
        break;
    }
}


#### Script spamtrap.sieve ####


# Check if the message was sent to a spam trap address
if eval "AUTOLEARN_ENABLE && key_exists('spam-trap', envelope.to)" {
    eval "bayes_is_balanced(SPAM_DB, false, AUTOLEARN_SPAM_HAM_BALANCE) && bayes_train(SPAM_DB, body_and_subject, true)";
    let "t.SPAM_TRAP" "1";

    # Disable autolearn so the classifier is not trained twice
    let "AUTOLEARN_ENABLE" "0";
}


#### Script bayes_classify.sieve ####

if eval "!t.SPAM_TRAP && !t.TRUSTED_REPLY" {

    # Classification parameters
    # min_token_hits: 2
    # min_tokens: 11
    # min_prob_strength: 0.05
    # min_learns: 200

    let "bayes_result" "bayes_classify(SPAM_DB, body_and_subject, [2, 11, 0.05, 200])";
    if eval "!is_empty(bayes_result)" {
        if eval "bayes_result > 0.7" {
            let "t.BAYES_SPAM" "1";
        } elsif eval "bayes_result < 0.5" {
            let "t.BAYES_HAM" "1";
        }
    }
}


#### Script url.sieve ####

if eval "(count(body_urls) == 1 || count(html_body_urls) == 1) && count(tokenize(text_body, 'words')) == 0" {
    let "t.URL_ONLY" "1";
}

if eval "has_zwsp(urls)" {
    let "t.ZERO_WIDTH_SPACE_URL" "1";
} elsif eval "has_obscured(urls)" {
    let "t.R_SUSPICIOUS_URL" "1";
}

let "i" "count(urls)";
while "i > 0" {
    let "i" "i - 1";
    let "url" "urls[i]";

    # Skip non-URLs such as 'data:' and 'mailto:'
    if eval "!contains(url, '://')" {
        continue;
    }

    let "host" "uri_part(url, 'host')";

    if eval "!is_empty(host)" {
        let "is_ip" "is_ip_addr(host)";
        let "host" "puny_decode(host)";
        let "host_lc" "to_lowercase(host)";
        let "host_sld" "domain_part(host_lc, 'sld')";

        # Skip local and trusted domains
        if eval "is_local_domain(DOMAIN_DIRECTORY, host_sld) || key_exists('spam-allow', host_sld)" {
            continue;
        }

        if eval "!is_ip && 
                 (!t.REDIRECTOR_URL || !t.URL_REDIRECTOR_NESTED) && 
                 key_exists('spam-redirect', host_sld)" {
            let "t.REDIRECTOR_URL" "1";
            let "redir_count" "1";

            while "redir_count <= 5" {
                # Use a custom user-agent and a 3 second timeout
                let "url_redirect" "http_header(url, 'Location', 'Mozilla/5.0 (X11; Linux i686; rv:109.0) Gecko/20100101 Firefox/118.0', 3000)";
                if eval "!is_empty(url_redirect)" {
                    let "url" "url_redirect";
                    let "host" "uri_part(url, 'host')";
                    let "is_ip" "is_ip_addr(host)";
                    let "host" "puny_decode(host)";
                    let "host_lc" "to_lowercase(host)";
                    let "host_sld" "domain_part(host_lc, 'sld')";

                    if eval "!is_ip && key_exists('spam-redirect', host_sld)" {
                        let "redir_count" "redir_count + 1";
                    } else {
                        break;
                    }
                } else {
                    break;
                }
            }

            if eval "redir_count > 5" {
                let "t.URL_REDIRECTOR_NESTED" "1";
            }
        }

        let "url_lc" "to_lowercase(url)";
        let "query" "uri_part(url_lc, 'path_query')";
        if eval "!is_ip" {
            if eval "!is_ascii(host)" {
                let "host_cured" "cure_text(host)";
                if eval "host_lc != host_cured && dns_exists(host_cured, 'ip')" {
                    let "t.HOMOGRAPH_URL" "1";
                }

                if eval "!is_single_script(host)" {
                    let "t.MIXED_CHARSET_URL" "1";
                }
            } else {
                if eval "ends_with(host, 'googleusercontent.com') && starts_with(query, '/proxy/')" {
                    let "t.HAS_GUC_PROXY_URI" "1";
                } elsif eval "ends_with(host, 'firebasestorage.googleapis.com')" {
                    let "t.HAS_GOOGLE_FIREBASE_URL" "1";
                } elsif eval "starts_with(domain_part(host, 'sld'), 'google.') && contains(query, 'url?') " {
                    let "t.HAS_GOOGLE_REDIR" "1";
                }
            }

            if eval "(contains(host_lc, 'ipfs.') || contains(query, '/ipfs')) && contains(query, '/qm')" {
                # InterPlanetary File System (IPFS) gateway URL, likely malicious
                let "t.HAS_IPFS_GATEWAY_URL" "1";
            } elsif eval "ends_with(host_lc, '.onion')" {
                let "t.HAS_ONION_URI" "1";
            }
        } else {
            # URL is an ip address
            let "t.R_SUSPICIOUS_URL" "1";
        }

        if eval "starts_with(query, '/wp-')" {
            # Contains WordPress URIs
            let "t.HAS_WP_URI" "1";
            if eval "starts_with(query, '/wp-content') | starts_with(query, '/wp-includes')" {
                # URL that is pointing to a compromised WordPress installation
                let "t.WP_COMPROMISED" "1";
            }
        }
        if eval "contains(query, '/../') && !contains(query, '/well-known') && !contains(query, '/well_known')" {
            # Message contains URI with a hidden path
            let "t.URI_HIDDEN_PATH" "1";
        }

        # Phishing checks (refresh OpenPhish every 12 hours, PhishTank every 6 hours)
        if eval "key_exists_http('https://openphish.com/feed.txt', url, [43200, 'list'])" {
            let "t.PHISHED_OPENPHISH" "1";
        }
        if eval "key_exists_http('http://data.phishtank.com/data/online-valid.csv', url, [21600, 'csv', 1, ',', true])" {
            let "t.PHISHED_PHISHTANK" "1";
        }

    } else {
        # URL could not be parsed
        let "t.R_SUSPICIOUS_URL" "1";
    }
}



#### Script rbl.sieve ####


# Validate IP addresses
let "ip_addresses" "dedup(winnow([ env.remote_ip ] + header.received[*].rcvd.ip + header.received[*].rcvd.from.ip + header.received[*].rcvd.by.ip))";
let "ip_addresses_len" "count(ip_addresses)";
let "i" "0";

while "i < ip_addresses_len" {
    let "ip_address" "ip_addresses[i]";
    let "is_from_addr" "i == 0";
    let "i" "i + 1";

    if eval "ip_address == '127.0.0.1' || ip_address == '::1'" {
        continue;
    }

    # Do not check more than 10 IP addresses
    if eval "i >= 10" {
        break;
    }

    let "ip_reverse" "ip_reverse_name(ip_address)";
    let "is_ip_v4" "len(ip_reverse) <= 15";

    # Query SPAMHAUS
    let "result" "rsplit_once(dns_query(ip_reverse + '.zen.spamhaus.org', 'ipv4')[0], '.')";
    if eval "result[0] == '127.0.0'" {
        let "result" "result[1]";

        if eval "result == 2" {
            if eval "is_from_addr" {
                let "t.RBL_SPAMHAUS_SBL" "1";
            } else {
                let "t.RECEIVED_SPAMHAUS_SBL" "1";
            }
        } elsif eval "result == 3" {
            if eval "is_from_addr" {
                let "t.RBL_SPAMHAUS_CSS" "1";
            } else {
                let "t.RECEIVED_SPAMHAUS_CSS" "1";
            }
        } elsif eval "result >= 4 && result <= 7" {
            if eval "is_from_addr" {
                let "t.RBL_SPAMHAUS_XBL" "1";
            } else {
                let "t.RECEIVED_SPAMHAUS_XBL" "1";
            }
        } elsif eval "result == 9" {
            if eval "is_from_addr" {
                let "t.RBL_SPAMHAUS_DROP" "1";
            } else {
                let "t.RECEIVED_SPAMHAUS_PBL" "1";
            }
        } elsif eval "result == 10 || result == 11" {
            if eval "is_from_addr" {
                let "t.RBL_SPAMHAUS_PBL" "1";
            } else {
                let "t.RECEIVED_SPAMHAUS_PBL" "1";
            }
        } elsif eval "result == 254" {
            if eval "is_from_addr" {
                let "t.RBL_SPAMHAUS_BLOCKED_OPENRESOLVER" "1";
            } else {
                let "t.RECEIVED_SPAMHAUS_BLOCKED_OPENRESOLVER" "1";
            }
        } elsif eval "result == 255" {
            if eval "is_from_addr" {
                let "t.RBL_SPAMHAUS_BLOCKED" "1";
            } else {
                let "t.RECEIVED_SPAMHAUS_BLOCKED" "1";
            }
        } else {
            # Unrecognized result
            let "t.RBL_SPAMHAUS" "1";
        }
    }

    if eval "is_from_addr" {
        # Query IP reputation at Mailspike
        let "result" "rsplit_once(dns_query(ip_reverse + '.rep.mailspike.net', 'ipv4')[0], '.')";
        if eval "result[0] == '127.0.0'" {
            let "result" "result[1]";

            if eval "result == 10" {
                let "t.RBL_MAILSPIKE_WORST" "1";
            } elsif eval "result == 11" {
                let "t.RBL_MAILSPIKE_VERYBAD" "1";
            } elsif eval "result == 12" {
                let "t.RBL_MAILSPIKE_BAD" "1";
            } elsif eval "result >= 13 && result <= 16" {
                let "t.RWL_MAILSPIKE_NEUTRAL" "1";
            } elsif eval "result == 17" {
                let "t.RWL_MAILSPIKE_POSSIBLE" "1";
            } elsif eval "result == 18" {
                let "t.RWL_MAILSPIKE_GOOD" "1";
            } elsif eval "result == 19" {
                let "t.RWL_MAILSPIKE_VERYGOOD" "1";
            } elsif eval "result == 20" {
                let "t.RWL_MAILSPIKE_EXCELLENT" "1";
            }  
        }

        # Query SenderScore
        if eval "dns_exists(ip_reverse + '.bl.score.senderscore.com', 'ipv4')" {
            let "t.RBL_SENDERSCORE" "1";
        }

        # Query SpamEatingMonkey
        if eval "is_ip_v4 && dns_exists(ip_reverse + '.bl.spameatingmonkey.net', 'ipv4')" {
            let "t.RBL_SEM" "1";
        } elsif eval "!is_ip_v4 && dns_exists(ip_reverse + '.bl.ipv6.spameatingmonkey.net', 'ipv4')" {
            let "t.RBL_SEM_IPV6" "1";
        }

        # Query VirusFree
        if eval "dns_query(ip_reverse + '.bip.virusfree.cz', 'ipv4')[0] == '127.0.0.2'" {
            let "t.RBL_VIRUSFREE_BOTNET" "1";
        }

        # Query NiX
        if eval "dns_exists(ip_reverse + '.ix.dnsbl.manitu.net', 'ipv4')" {
            let "t.RBL_NIXSPAM" "1";
        }

        # Query Spamcop
        if eval "dns_exists(ip_reverse + '.bl.spamcop.net', 'ipv4')" {
            let "t.RBL_SPAMCOP" "1";
        }

        # Query Barracuda
        if eval "dns_exists(ip_reverse + '.b.barracudacentral.org', 'ipv4')" {
            let "t.RBL_BARRACUDA" "1";
        }
    }

    # Query Blocklist.de
    if eval "dns_exists(ip_reverse + '.bl.blocklist.de', 'ipv4')" {
        if eval "is_from_addr" {
            let "t.RBL_BLOCKLISTDE" "1";
        } else {
            let "t.RECEIVED_BLOCKLISTDE" "1";
        }
    }

    # Query DNSWL
    let "result" "rsplit_once(dns_query(ip_reverse + '.list.dnswl.org', 'ipv4')[0], '.')";
    if eval "starts_with(result[0], '127.')" {
        let "result" "result[1]";

        if eval "result == 0" {
            let "t.RCVD_IN_DNSWL_NONE" "1";
        } elsif eval "result == 1" {
            let "t.RCVD_IN_DNSWL_LOW" "1";
        } elsif eval "result == 2" {
            let "t.RCVD_IN_DNSWL_MED" "1";
        } elsif eval "result == 3" {
            let "t.RCVD_IN_DNSWL_HI" "1";
        } elsif eval "result == 255" {
            let "t.DNSWL_BLOCKED" "1";
        }
    }
}

# Validate domain names
let "emails" "dedup(winnow(to_lowercase([from_addr, rto_addr, envelope.from] + tokenize(text_body, 'email'))))";
let "emails_len" "count(emails)";
let "domains" "dedup(winnow(to_lowercase([ env.helo_domain, env.iprev.ptr ] + email_part(emails, 'domain') + puny_decode(uri_part(urls, 'host')))))";
let "domains_len" "count(domains)";
let "i" "0";

while "i < domains_len" {
    let "domain" "domains[i]";
    let "i" "i + 1";

    # Skip invalid and local domain names
    if eval "!contains(domain, '.') || 
             is_ip_addr(domain) || 
             is_local_domain(DOMAIN_DIRECTORY, domain_part(domain, 'sld')) ||
             key_exists('spam-allow', domain)" {
        continue;
    }

    # Do not check more than 10 domain names
    if eval "i >= 10" {
        break;
    }

    # Query SpamHaus DBL
    let "result" "rsplit_once(dns_query(domain + '.dbl.spamhaus.org', 'ipv4')[0], '.')";
    if eval "result[0] == '127.0.1'" {
        let "result" "result[1]";

        if eval "result == 2" {
            let "t.DBL_SPAM" "1";
        } elsif eval "result == 4" {
            let "t.DBL_PHISH" "1";
        } elsif eval "result == 5" {
            let "t.DBL_MALWARE" "1";
        } elsif eval "result == 6" {
            let "t.DBL_BOTNET" "1";
        } elsif eval "result == 102" {
            let "t.DBL_ABUSE" "1";
        } elsif eval "result == 103" {
            let "t.DBL_ABUSE_REDIR" "1";
        } elsif eval "result == 104" {
            let "t.DBL_ABUSE_PHISH" "1";
        } elsif eval "result == 105" {
            let "t.DBL_ABUSE_MALWARE" "1";
        } elsif eval "result == 106" {
            let "t.DBL_ABUSE_BOTNET" "1";
        } elsif eval "result == 254" {
            let "t.DBL_BLOCKED_OPENRESOLVER" "1";
        } elsif eval "result == 255" {
            let "t.DBL_BLOCKED" "1";
        }  
    }

    # Query SURBL multi
    let "result" "rsplit_once(dns_query(domain + '.multi.surbl.org', 'ipv4')[0], '.')";
    if eval "result[0] == '127.0.0'" {
        let "result" "result[1]";

        if eval "result == 128" {
            let "t.CRACKED_SURBL" "1";
        } elsif eval "result == 64" {
            let "t.ABUSE_SURBL" "1";
        } elsif eval "result == 16" {
            let "t.MW_SURBL_MULTI" "1";
        } elsif eval "result == 8" {
            let "t.PH_SURBL_MULTI" "1";
        } elsif eval "result == 1" {
            let "t.SURBL_BLOCKED" "1";
        }  
    }    

    # Query URIBL multi
    let "result" "rsplit_once(dns_query(domain + '.multi.uribl.com', 'ipv4')[0], '.')";
    if eval "result[0] == '127.0.0'" {
        let "result" "result[1]";

        if eval "result == 1" {
            let "t.URIBL_BLOCKED" "1";
        } elsif eval "result == 2" {
            let "t.URIBL_BLACK" "1";
        } elsif eval "result == 4" {
            let "t.URIBL_GREY" "1";
        } elsif eval "result == 8" {
            let "t.URIBL_RED" "1";
        }  
    }

    # Query SpamEatingMonkey URIBL
    if eval "dns_query(domain + '.uribl.spameatingmonkey.net', 'ipv4')[0] == '127.0.0.2'" {
        let "t.SEM_URIBL" "1";
    }

    # Query SpamEatingMonkey FRESH15
    if eval "dns_query(domain + '.fresh15.spameatingmonkey.net', 'ipv4')[0] == '127.0.0.2'" {
        let "t.SEM_URIBL_FRESH15" "1";
    }

}

# Check DKIM domains that passed validation
let "i" "count(env.dkim.domains)";
while "i > 0" {
    let "i" "i - 1";

    # Query DNSWL
    let "result" "rsplit_once(dns_query(env.dkim.domains[i] + '.dwl.dnswl.org', 'ipv4')[0], '.')";
    if eval "starts_with(result[0], '127.')" {
        let "result" "result[1]";

        if eval "result == 0" {
            let "t.DWL_DNSWL_NONE" "1";
        } elsif eval "result == 1" {
            let "t.DWL_DNSWL_LOW" "1";
        } elsif eval "result == 2" {
            let "t.DWL_DNSWL_MED" "1";
        } elsif eval "result == 3" {
            let "t.DWL_DNSWL_HI" "1";
        } elsif eval "result == 255" {
            let "t.DWL_DNSWL_BLOCKED" "1";
        }  
    }    
}

# Validate email addresses
let "i" "0";
while "i < emails_len" {
    let "email" "emails[i]";
    let "i" "i + 1";

    # Skip invalid and local e-mail addresses
    if eval "!contains(email, '@') || is_local_domain(DOMAIN_DIRECTORY, domain_part(email_part(email, 'domain'), 'sld'))" {
        continue;
    }

    # Do not check more than 10 email addresses
    if eval "i >= 10" {
        break;
    }

    # Query MSBL EBL
    let "result" "rsplit_once(dns_query(hash(email, 'sha1') + '.ebl.msbl.org', 'ipv4')[0], '.')";
    if eval "result[1] == 2 || result[1] == 3" {
        if eval "result[0] == '127.0.0'" {
            let "t.MSBL_EBL" "1";
        } elsif eval "result[0] == '127.0.1'" {
            let "t.MSBL_EBL_GREY" "1";
        }  
    }
}


# Validate URL hashes
let "i" "0";
let "urls_len" "count(urls)";
while "i < urls_len" {
    let "url" "urls[i]";
    let "i" "i + 1";

    # Do not check more than 10 URLs
    if eval "i >= 10" {
        break;
    }

    # Skip URLs pointing to local or trusted domains
    let "domain" "domain_part(uri_part(url, 'host'), 'sld')";
    if eval "is_local_domain(DOMAIN_DIRECTORY, domain) ||
             key_exists('spam-allow', domain)" {
        continue;
    }

    # Query SURBL HASHBL
    let "result" "rsplit_once(dns_query(hash(url, 'md5') + '.hashbl.surbl.org', 'ipv4')[0], '.')";
    if eval "starts_with(result[0], '127.0.')" {
        let "result" "result[1]";

        if eval "result == 8" {
            let "t.SURBL_HASHBL_PHISH" "1";
        } elsif eval "result == 16" {
            let "t.SURBL_HASHBL_MALWARE" "1";
        } elsif eval "result == 64" {
            let "t.SURBL_HASHBL_ABUSE" "1";
        } elsif eval "result == 128" {
            let "t.SURBL_HASHBL_CRACKED" "1";
        } elsif eval "result[0] == '127.0.1'" {
            let "t.SURBL_HASHBL_EMAIL" "1";
        }  
    }
}


#### Script pyzor.sieve ####

# Check message hash against Pyzor on public.pyzor.org:24441 using a 5 second timeout
let "pyzor_response" "pyzor_check('public.pyzor.org:24441', 5)";

if eval "!is_empty(pyzor_response) && pyzor_response[0] == 200" {
    let "count" "pyzor_response[1]";
    let "wl_count" "pyzor_response[2]";

    if eval "count > 5 && (wl_count < 10 || wl_count / count < 0.2)" {
        let "t.PYZOR" "1";
    }
}


#### Script composites.sieve ####

if eval "t.MISSING_ESSENTIAL_HEADERS && t.SINGLE_SHORT_PART" {
	let "t.SHORT_PART_BAD_HEADERS" "1";
}

if eval "t.FORGED_RECIPIENTS && t.MAILLIST" {
	let "t.FORGED_RECIPIENTS_MAILLIST" "1";
}

if eval "t.FORGED_SENDER && t.MAILLIST" {
	let "t.FORGED_SENDER_MAILLIST" "1";
}

if eval "t.DMARC_POLICY_ALLOW && (t.SPF_SOFTFAIL || t.SPF_FAIL || t.DKIM_REJECT)" {
	let "t.DMARC_POLICY_ALLOW_WITH_FAILURES" "1";
}

if eval "t.DKIM_NA && t.SPF_NA && t.DMARC_NA && t.ARC_NA" {
	let "t.AUTH_NA" "1";
}

if eval "!(t.DKIM_NA && t.SPF_NA && t.DMARC_NA && t.ARC_NA) && (t.DKIM_NA || t.DKIM_TEMPFAIL || t.DKIM_PERMFAIL) && (t.SPF_NA || t.SPF_DNSFAIL) && t.DMARC_NA && (t.ARC_NA || t.ARC_DNSFAIL)" {
	let "t.AUTH_NA_OR_FAIL" "1";
}

if eval "(t.AUTH_NA || t.AUTH_NA_OR_FAIL) && (t.BOUNCE || t.SUBJ_BOUNCE_WORDS)" {
	let "t.BOUNCE_NO_AUTH" "1";
}

if eval "(t.HAS_X_POS || t.HAS_PHPMAILER_SIG) && t.HAS_WP_URI && (t.PHISHING || t.CRACKED_SURBL || t.PH_SURBL_MULTI || t.DBL_PHISH || t.DBL_ABUSE_PHISH || t.URIBL_BLACK || t.PHISHED_OPENPHISH || t.PHISHED_PHISHTANK)" {
	let "t.HACKED_WP_PHISHING" "1";
}

if eval "(t.HAS_XOIP || t.RCVD_FROM_SMTP_AUTH) && t.DCC_BULK" {
	let "t.COMPROMISED_ACCT_BULK" "1";
}

if eval "t.DCC_BULK && (t.MISSING_TO || t.R_UNDISC_RCPT)" {
	let "t.UNDISC_RCPTS_BULK" "1";
}

if eval "t.RECEIVED_SPAMHAUS_PBL && !t.RCVD_VIA_SMTP_AUTH" {
	let "t.RCVD_UNAUTH_PBL" "1";
}

if eval "(t.DKIM_ALLOW || t.ARC_ALLOW) && t.RCVD_IN_DNSWL_MED" {
	let "t.RCVD_DKIM_ARC_DNSWL_MED" "1";
}

if eval "(t.DKIM_ALLOW || t.ARC_ALLOW) && t.RCVD_IN_DNSWL_HI" {
	let "t.RCVD_DKIM_ARC_DNSWL_HI" "1";
}

if eval "(t.HAS_X_POS || t.HAS_PHPMAILER_SIG || t.HAS_X_PHP_SCRIPT) && (t.SUBJECT_ENDS_QUESTION || t.SUBJECT_ENDS_EXCLAIM || t.MANY_INVISIBLE_PARTS)" {
	let "t.AUTOGEN_PHP_SPAMMY" "1";
}

if eval "(t.PHISHING || t.DBL_PHISH || t.PHISHED_OPENPHISH || t.PHISHED_PHISHTANK) && (t.SUBJECT_ENDS_QUESTION || t.SUBJECT_ENDS_EXCLAIM)" {
	let "t.PHISH_EMOTION" "1";
}

if eval "t.HAS_GUC_PROXY_URI || t.URIBL_RED || t.DBL_ABUSE_REDIR || t.HAS_ONION_URI" {
	let "t.HAS_ANON_DOMAIN" "1";
}

if eval "(t.SPF_FAIL || t.SPF_SOFTFAIL) && (t.RCVD_COUNT_ZERO || t.RCVD_NO_TLS_LAST)" {
	let "t.VIOLATED_DIRECT_SPF" "1";
}

if eval "(t.FREEMAIL_FROM || t.FREEMAIL_ENVFROM || t.FREEMAIL_REPLYTO) && (t.TO_DN_RECIPIENTS || t.R_UNDISC_RCPT) && (t.FROM_NAME_HAS_TITLE || t.FREEMAIL_REPLYTO_NEQ_FROM_DOM)" {
	let "t.FREEMAIL_AFF" "1";
}

if eval "t.URL_ONLY && t.REDIRECTOR_URL" {
	let "t.REDIRECTOR_URL_ONLY" "1";
}

if eval "t.FAKE_REPLY && t.RCVD_VIA_SMTP_AUTH && (!t.RECEIVED_SPAMHAUS_PBL || t.RECEIVED_SPAMHAUS_XBL || t.RECEIVED_SPAMHAUS_SBL)" {
	let "t.THREAD_HIJACKING_FROM_INJECTOR" "1";
}


#### Script scores.sieve ####

# Add scores
let "tags" "var_names()";
let "i" "count(tags)";
let "spam_result" "";
while "i > 0" {
    let "i" "i - 1";
    let "tag" "tags[i]";
    let "tag_score" "key_get('spam-scores', tag)";

    if eval "is_number(tag_score)" {
        let "score" "score + tag_score";
        if eval "ADD_HEADER_SPAM_RESULT" {
            if eval "!is_empty(spam_result)" {
                let "spam_result" "spam_result + ',\r\n\t' + tag + ' (' + tag_score + ')'";
            } else {
                let "spam_result" "spam_result + tag + ' (' + tag_score + ')'";
            }
        }
    } elsif eval "tag_score == 'reject'" {
        let "SCORE_REJECT_THRESHOLD" "1";
        let "score" "2";
        break;
    } elsif eval "tag_score == 'discard'" {
        discard;
        stop;
    }
}


#### Script reputation.sieve ####

# Obtain sender address and domain
let "rep_from" "envelope.from";
let "rep_from_domain" "envfrom_domain_sld";
if eval "is_empty(rep_from)" {
    let "rep_from" "from_addr";
    let "rep_from_domain" "from_domain_sld";
}
if eval "env.dmarc.result != 'pass'" {
    # Do not penalize forged domains
    let "rep_from" "'_' + rep_from";
    let "rep_from_domain" "'_' + rep_from_domain";
}

# Lookup ASN
let "asn" "";
if eval "len(env.remote_ip.reverse) <= 15" {
    let "asn" "env.remote_ip.reverse + '.origin.asn.cymru.com'";
} else {
    let "asn" "env.remote_ip.reverse + '.origin.asn6.cymru.com'";
}
let "asn" "split(dns_query(asn, 'txt'), '|')[0]";

# Generate reputation tokens
let "token_ids" "";
if eval "asn > 0" {
    let "token_ids" "['i:' + env.remote_ip, 'f:' + rep_from, 'd:' + rep_from_domain, 'a:' + asn ]";
} else {
    let "token_ids" "['i:' + env.remote_ip, 'f:' + rep_from, 'd:' + rep_from_domain ]";
}

# Lookup reputation
let "i" "len(token_ids)";
let "reputation" "0.0";

while "i > 0" {
    let "i" "i - 1";
    let "token_id" "token_ids[i]";

    # Lookup reputation
    let "token_rep" "key_get(SPAM_DB, token_id)";

    if eval "is_empty(token_rep)" {
        # Set reputation
        eval "!env.test && key_set(SPAM_DB, token_id, [score, 1], 2592000)";
        continue;
    }

    # Update reputation
    let "token_score" "token_rep[0]";
    let "token_count" "token_rep[1]";
    let "updated_score" "(token_count + 1) * (score + 0.98 * token_score) / (0.98 * token_count + 1)";
    eval "!env.test && key_set(SPAM_DB, token_id, [updated_score, token_count + 1], 2592000)";

    # Assign weight
    let "weight" "";
    if eval "starts_with(token_id, 'f:')" {
        # Sender address has 50% weight
        let "weight" "0.5";
    } elsif eval "starts_with(token_id, 'd:')" {
        # Sender domain has 20% weight
        let "weight" "0.2";
    } elsif eval "starts_with(token_id, 'i:')" {
        # IP has 20% weight
        let "weight" "0.2";
    } elsif eval "starts_with(token_id, 'a:')" {
        # ASN has 10% weight
        let "weight" "0.1";
    } else {
        continue;
    }

    let "reputation" "reputation + (token_score / token_count * weight)";
}

# Adjust score using a 0.5 factor
if eval "reputation > 0" {
    let "score" "score + (reputation - score) * 0.5";
}


#### Script epilogue.sieve ####


# Train the bayes classifier automatically
if eval "AUTOLEARN_ENABLE && (score >= AUTOLEARN_SPAM_THRESHOLD || score <= AUTOLEARN_HAM_THRESHOLD)" {
    let "is_spam" "score >= AUTOLEARN_SPAM_THRESHOLD";
    eval "bayes_is_balanced(SPAM_DB, is_spam, AUTOLEARN_SPAM_HAM_BALANCE) && 
          bayes_train(SPAM_DB, body_and_subject, is_spam)";
}

# Process score actions
if eval "SCORE_REJECT_THRESHOLD && score >= SCORE_REJECT_THRESHOLD" {
    reject "Your message has been rejected because it has an excessive spam score. If you feel this is an error, please contact the postmaster.";
    stop;
} elsif eval "SCORE_DISCARD_THRESHOLD && score >= SCORE_DISCARD_THRESHOLD" {
    discard;
    stop;
} elsif eval "ADD_HEADER_SPAM" {
    let "spam_status" "";
    if eval "score >= SCORE_SPAM_THRESHOLD" {
        let "spam_status" "'Yes, score=' + score";
    } else {
        let "spam_status" "'No, score=' + score";
    }
    eval "add_header('X-Spam-Status', spam_status)";
    if eval "!is_empty(spam_result)" {
        eval "add_header('X-Spam-Result', spam_result)";
    }
}


'''

[sieve.trusted.scripts.track-replies]
name = "Track Replies"
contents = '''

#### Script config.sieve ####

# Whether to add an X-Spam-Status header
let "ADD_HEADER_SPAM" "key_get('spam-config', 'add-spam')";

# Whether to add an X-Spam-Result header
let "ADD_HEADER_SPAM_RESULT" "key_get('spam-config', 'add-spam-result')";

# Whether message replies from authenticated users should be learned as ham
let "AUTOLEARN_REPLIES_HAM" "key_get('spam-config', 'learn-ham-replies')";

# Whether the bayes classifier should be trained automatically
let "AUTOLEARN_ENABLE" "key_get('spam-config', 'learn-enable') && !env.test";

# When to learn ham (score >= threshold)
let "AUTOLEARN_HAM_THRESHOLD" "key_get('spam-config', 'learn-ham-threshold')";

# When to learn spam (score <= threshold)
let "AUTOLEARN_SPAM_THRESHOLD" "key_get('spam-config', 'learn-spam-threshold')";

# Keep difference for spam/ham learns for at least this value
let "AUTOLEARN_SPAM_HAM_BALANCE" "key_get('spam-config', 'learn-balance')";

# If ADD_HEADER_SPAM is enabled, mark as SPAM messages with a score above this threshold
let "SCORE_SPAM_THRESHOLD" "key_get('spam-config', 'threshold-spam')";

# Discard messages with a score above this threshold
let "SCORE_DISCARD_THRESHOLD" "key_get('spam-config', 'threshold-discard')";

# Reject messages with a score above this threshold
let "SCORE_REJECT_THRESHOLD" "key_get('spam-config', 'threshold-reject')";

# Directory name to use for local domain lookups (leave empty for default)
let "DOMAIN_DIRECTORY" "key_get('spam-config', 'directory')";

# Store to use for Bayes tokens and ids (leave empty for default)
let "SPAM_DB" "key_get('spam-config', 'lookup')";


#### Script replies_out.sieve ####


# This script should be used on authenticated SMTP sessions only
let "message_id" "header.Message-ID";

if eval "!is_empty(message_id)" {
    # Store the message ID for 30 days
    eval "key_set(SPAM_DB, 'm:' + message_id, '', 2592000)";

    if eval "AUTOLEARN_ENABLE && AUTOLEARN_REPLIES_HAM && bayes_is_balanced(SPAM_DB, false, AUTOLEARN_SPAM_HAM_BALANCE)" {
        eval "bayes_train(SPAM_DB, thread_name(header.subject) + ' ' + body.to_text, false)";
    }
}

'''

[sieve.trusted.scripts.greylist]
name = "Greylisting"
contents = '''

#### Script config.sieve ####

# Whether to add an X-Spam-Status header
let "ADD_HEADER_SPAM" "key_get('spam-config', 'add-spam')";

# Whether to add an X-Spam-Result header
let "ADD_HEADER_SPAM_RESULT" "key_get('spam-config', 'add-spam-result')";

# Whether message replies from authenticated users should be learned as ham
let "AUTOLEARN_REPLIES_HAM" "key_get('spam-config', 'learn-ham-replies')";

# Whether the bayes classifier should be trained automatically
let "AUTOLEARN_ENABLE" "key_get('spam-config', 'learn-enable') && !env.test";

# When to learn ham (score >= threshold)
let "AUTOLEARN_HAM_THRESHOLD" "key_get('spam-config', 'learn-ham-threshold')";

# When to learn spam (score <= threshold)
let "AUTOLEARN_SPAM_THRESHOLD" "key_get('spam-config', 'learn-spam-threshold')";

# Keep difference for spam/ham learns for at least this value
let "AUTOLEARN_SPAM_HAM_BALANCE" "key_get('spam-config', 'learn-balance')";

# If ADD_HEADER_SPAM is enabled, mark as SPAM messages with a score above this threshold
let "SCORE_SPAM_THRESHOLD" "key_get('spam-config', 'threshold-spam')";

# Discard messages with a score above this threshold
let "SCORE_DISCARD_THRESHOLD" "key_get('spam-config', 'threshold-discard')";

# Reject messages with a score above this threshold
let "SCORE_REJECT_THRESHOLD" "key_get('spam-config', 'threshold-reject')";

# Directory name to use for local domain lookups (leave empty for default)
let "DOMAIN_DIRECTORY" "key_get('spam-config', 'directory')";

# Store to use for Bayes tokens and ids (leave empty for default)
let "SPAM_DB" "key_get('spam-config', 'lookup')";


#### Script greylist.sieve ####


set "triplet" "g:${env.remote_ip}.${envelope.from}.${envelope.to}";

if eval "!key_exists(SPAM_DB, triplet)" {
    # Greylist sender for 30 days
    eval "key_set(SPAM_DB, triplet, '', 2592000)";
    reject "422 4.2.2 Greylisted, please try again in a few moments.";
    stop;
}

'''

[sieve.trusted.scripts.train]
name = "Train Bayes Classifier"
contents = '''

#### Script config.sieve ####

# Whether to add an X-Spam-Status header
let "ADD_HEADER_SPAM" "key_get('spam-config', 'add-spam')";

# Whether to add an X-Spam-Result header
let "ADD_HEADER_SPAM_RESULT" "key_get('spam-config', 'add-spam-result')";

# Whether message replies from authenticated users should be learned as ham
let "AUTOLEARN_REPLIES_HAM" "key_get('spam-config', 'learn-ham-replies')";

# Whether the bayes classifier should be trained automatically
let "AUTOLEARN_ENABLE" "key_get('spam-config', 'learn-enable') && !env.test";

# When to learn ham (score >= threshold)
let "AUTOLEARN_HAM_THRESHOLD" "key_get('spam-config', 'learn-ham-threshold')";

# When to learn spam (score <= threshold)
let "AUTOLEARN_SPAM_THRESHOLD" "key_get('spam-config', 'learn-spam-threshold')";

# Keep difference for spam/ham learns for at least this value
let "AUTOLEARN_SPAM_HAM_BALANCE" "key_get('spam-config', 'learn-balance')";

# If ADD_HEADER_SPAM is enabled, mark as SPAM messages with a score above this threshold
let "SCORE_SPAM_THRESHOLD" "key_get('spam-config', 'threshold-spam')";

# Discard messages with a score above this threshold
let "SCORE_DISCARD_THRESHOLD" "key_get('spam-config', 'threshold-discard')";

# Reject messages with a score above this threshold
let "SCORE_REJECT_THRESHOLD" "key_get('spam-config', 'threshold-reject')";

# Directory name to use for local domain lookups (leave empty for default)
let "DOMAIN_DIRECTORY" "key_get('spam-config', 'directory')";

# Store to use for Bayes tokens and ids (leave empty for default)
let "SPAM_DB" "key_get('spam-config', 'lookup')";


#### Script train.sieve ####



# Obtain thread name and subject
let "contents" "thread_name(header.subject) + ' ' + body.to_text";

if eval "env.train == 'spam'" {
    eval "bayes_train(SPAM_DB, contents, true)";
} elsif eval "env.train == 'ham'" {
    eval "bayes_train(SPAM_DB, contents, false)";
} else {
    reject "Missing variable 'train'";
}

'''


[lookup]
spam-config = {
"add-spam" = true,
"add-spam-result" = true,
"learn-enable" = true,
"learn-balance" = "0.9",
"learn-ham-replies" = true,
"learn-ham-threshold" = "-0.5",
"learn-spam-threshold" = "6.0",
"threshold-spam" = "5.0",
"threshold-discard" = "0.0",
"threshold-reject" = "0.0",
"directory" = "",
"lookup" = ""
}

spam-scores = {"ABUSE_SURBL" = "5.0",
"ALLOWLIST_DKIM" = "-1.0",
"ALLOWLIST_DMARC" = "-7.0",
"ALLOWLIST_SPF" = "-1.0",
"ALLOWLIST_SPF_DKIM" = "-3.0",
"ARC_ALLOW" = "-1.0",
"ARC_DNSFAIL" = "0.0",
"ARC_INVALID" = "0.5",
"ARC_NA" = "0.0",
"ARC_REJECT" = "1.0",
"ARC_SIGNED" = "0.0",
"AUTH_NA" = "1.0",
"AUTH_NA_OR_FAIL" = "1.0",
"AUTOGEN_PHP_SPAMMY" = "1.0",
"BAYES_HAM" = "-3.0",
"BAYES_SPAM" = "5.1",
"BLOCKLIST_DKIM" = "2.0",
"BLOCKLIST_DMARC" = "6.0",
"BLOCKLIST_SPF" = "1.0",
"BLOCKLIST_SPF_DKIM" = "3.0",
"BODY_URI_ONLY" = "2.0",
"BOGUS_ENCRYPTED_AND_TEXT" = "10.0",
"BOUNCE" = "-0.1",
"BOUNCE_NO_AUTH" = "1.0",
"BROKEN_CONTENT_TYPE" = "1.5",
"COMPROMISED_ACCT_BULK" = "3.0",
"CRACKED_SURBL" = "5.0",
"CTE_CASE" = "0.5",
"CTYPE_MISSING_DISPOSITION" = "4.0",
"CTYPE_MIXED_BOGUS" = "1.0",
"CT_EXTRA_SEMI" = "1.0",
"DATA_URI_OBFU" = "2.0",
"DATE_IN_FUTURE" = "4.0",
"DATE_IN_PAST" = "1.0",
"DBL_ABUSE" = "5.0",
"DBL_ABUSE_BOTNET" = "6.5",
"DBL_ABUSE_MALWARE" = "6.5",
"DBL_ABUSE_PHISH" = "6.5",
"DBL_ABUSE_REDIR" = "5.0",
"DBL_BLOCKED" = "0.0",
"DBL_BLOCKED_OPENRESOLVER" = "0.0",
"DBL_BOTNET" = "7.5",
"DBL_MALWARE" = "7.5",
"DBL_PHISH" = "7.5",
"DBL_SPAM" = "6.5",
"DCC_BULK" = "3.0",
"DIRECT_TO_MX" = "0.0",
"DISPOSABLE_CC" = "0.0",
"DISPOSABLE_ENVFROM" = "0.0",
"DISPOSABLE_FROM" = "0.0",
"DISPOSABLE_REPLYTO" = "0.0",
"DISPOSABLE_TO" = "0.0",
"DKIM_SIGNED" = "0.0",
"DMARC_BAD_POLICY" = "0.5",
"DMARC_DNSFAIL" = "0.0",
"DMARC_NA" = "0.0",
"DMARC_POLICY_ALLOW" = "-0.5",
"DMARC_POLICY_ALLOW_WITH_FAILURES" = "0.0",
"DMARC_POLICY_QUARANTINE" = "1.5",
"DMARC_POLICY_REJECT" = "2.0",
"DMARC_POLICY_SOFTFAIL" = "0.1",
"DNSWL_BLOCKED" = "0.0",
"DWL_DNSWL_BLOCKED" = "0.0",
"DWL_DNSWL_HI" = "-3.5",
"DWL_DNSWL_LOW" = "-1.0",
"DWL_DNSWL_MED" = "-2.0",
"DWL_DNSWL_NONE" = "0.0",
"EMPTY_SUBJECT" = "1.0",
"ENCRYPTED_PGP" = "-0.5",
"ENCRYPTED_SMIME" = "-0.5",
"ENVFROM_INVALID" = "2.0",
"ENVFROM_SERVICE_ACCT" = "1.0",
"EXT_CSS" = "1.0",
"FAKE_REPLY" = "1.0",
"FORGED_RCVD_TRAIL" = "1.0",
"FORGED_RECIPIENTS" = "2.0",
"FORGED_RECIPIENTS_MAILLIST" = "0.0",
"FORGED_SENDER" = "0.3",
"FORGED_SENDER_MAILLIST" = "0.0",
"FREEMAIL_AFF" = "4.0",
"FREEMAIL_CC" = "0.0",
"FREEMAIL_ENVFROM" = "0.0",
"FREEMAIL_FROM" = "0.0",
"FREEMAIL_REPLYTO" = "0.0",
"FREEMAIL_REPLYTO_NEQ_FROM_DOM" = "3.0",
"FREEMAIL_TO" = "0.0",
"FROM_DN_EQ_ADDR" = "1.0",
"FROM_EQ_ENVFROM" = "0.0",
"FROM_EXCESS_BASE64" = "1.5",
"FROM_EXCESS_QP" = "1.2",
"FROM_HAS_DN" = "0.0",
"FROM_INVALID" = "2.0",
"FROM_NAME_EXCESS_SPACE" = "1.0",
"FROM_NAME_HAS_TITLE" = "1.0",
"FROM_NEEDS_ENCODING" = "1.0",
"FROM_NEQ_DISPLAY_NAME" = "4.0",
"FROM_NEQ_ENVFROM" = "0.0",
"FROM_NO_DN" = "0.0",
"FROM_SERVICE_ACCT" = "1.0",
"HACKED_WP_PHISHING" = "4.5",
"HAS_ANON_DOMAIN" = "0.1",
"HAS_ATTACHMENT" = "0.0",
"HAS_DATA_URI" = "0.0",
"HAS_GOOGLE_FIREBASE_URL" = "2.0",
"HAS_GOOGLE_REDIR" = "1.0",
"HAS_GUC_PROXY_URI" = "1.0",
"HAS_IPFS_GATEWAY_URL" = "6.0",
"HAS_LIST_UNSUB" = "-0.01",
"HAS_ONION_URI" = "0.0",
"HAS_ORG_HEADER" = "0.0",
"HAS_PHPMAILER_SIG" = "0.0",
"HAS_REPLYTO" = "0.0",
"HAS_WP_URI" = "0.0",
"HAS_XAW" = "0.0",
"HAS_XOIP" = "0.0",
"HAS_X_ANTIABUSE" = "0.0",
"HAS_X_AS" = "0.0",
"HAS_X_GMSV" = "0.0",
"HAS_X_PHP_SCRIPT" = "0.0",
"HAS_X_POS" = "0.0",
"HAS_X_PRIO_FIVE" = "0.0",
"HAS_X_PRIO_ONE" = "0.0",
"HAS_X_PRIO_THREE" = "0.0",
"HAS_X_PRIO_TWO" = "0.0",
"HAS_X_PRIO_ZERO" = "0.0",
"HAS_X_SOURCE" = "0.0",
"HEADER_EMPTY_DELIMITER" = "1.0",
"HEADER_FORGED_MDN" = "2.0",
"HEADER_RCONFIRM_MISMATCH" = "2.0",
"FROMHOST_NORES_A_OR_MX" = "1.5",
"FROM_BOUNCE" = "0.0",
"HELO_BAREIP" = "3.0",
"HELO_IP_A" = "1.0",
"HELO_NORES_A_OR_MX" = "0.3",
"HELO_NOT_FQDN" = "2.0",
"HELO_IPREV_MISMATCH" = "1.0",
"RCPT_BOUNCEMOREONE" = "1.5",
"URL_ONLY" = "2.2",
"HIDDEN_SOURCE_OBJ" = "2.0",
"HTML_META_REFRESH_URL" = "5.0",
"HTML_SHORT_LINK_IMG_1" = "2.0",
"HTML_SHORT_LINK_IMG_2" = "1.0",
"HTML_SHORT_LINK_IMG_3" = "0.5",
"HTML_TEXT_IMG_RATIO" = "1.0",
"HTML_UNBALANCED_TAG" = "0.5",
"HTTP_TO_HTTPS" = "0.5",
"HTTP_TO_IP" = "1.0",
"INFO_TO_INFO_LU" = "2.0",
"INVALID_DATE" = "1.5",
"INVALID_FROM_8BIT" = "6.0",
"INVALID_MSGID" = "1.7",
"KLMS_SPAM" = "5.0",
"LONG_SUBJ" = "3.0",
"MAILLIST" = "-0.2",
"MANY_INVISIBLE_PARTS" = "1.0",
"MID_BARE_IP" = "2.0",
"MID_CONTAINS_FROM" = "1.0",
"MID_CONTAINS_TO" = "1.0",
"MID_MISSING_BRACKETS" = "1.0",
"MID_RHS_IP_LITERAL" = "1.0",
"MID_RHS_MATCH_FROM" = "1.0",
"MID_RHS_MATCH_FROMTLD" = "1.0",
"MID_RHS_MATCH_TO" = "1.0",
"MID_RHS_NOT_FQDN" = "0.5",
"MID_RHS_WWW" = "0.5",
"MIME_ARCHIVE_IN_ARCHIVE" = "5.0",
"MIME_BAD" = "1.0",
"MIME_BAD_ATTACHMENT" = "4.0",
"MIME_BAD_EXTENSION" = "2.0",
"MIME_BAD_UNICODE" = "8.0",
"MIME_BASE64_TEXT" = "0.1",
"MIME_BASE64_TEXT_BOGUS" = "1.0",
"MIME_DOUBLE_BAD_EXTENSION" = "2.0",
"MIME_GOOD" = "-0.1",
"MIME_HEADER_CTYPE_ONLY" = "2.0",
"MIME_HTML_ONLY" = "0.2",
"MIME_MA_MISSING_HTML" = "1.0",
"MIME_MA_MISSING_TEXT" = "2.0",
"MISSING_DATE" = "1.0",
"MISSING_FROM" = "2.0",
"MISSING_MID" = "2.5",
"MISSING_MIME_VERSION" = "2.0",
"MISSING_SUBJECT" = "2.0",
"MISSING_TO" = "2.0",
"MSBL_EBL" = "7.5",
"MSBL_EBL_GREY" = "0.5",
"MULTIPLE_FROM" = "8.0",
"MULTIPLE_UNIQUE_HEADERS" = "7.0",
"MV_CASE" = "0.5",
"MW_SURBL_MULTI" = "7.5",
"HOMOGRAPH_URL" = "5.0",
"ONCE_RECEIVED" = "0.1",
"PHISHED_OPENPHISH" = "7.0",
"PHISHED_PHISHTANK" = "7.0",
"PHISHING" = "4.0",
"PHISH_EMOTION" = "1.0",
"PHP_XPS_PATTERN" = "0.0",
"PH_SURBL_MULTI" = "7.5",
"PRECEDENCE_BULK" = "0.0",
"PREVIOUSLY_DELIVERED" = "0.0",
"PYZOR" = "3.5",
"RBL_BARRACUDA" = "4.0",
"RBL_BLOCKLISTDE" = "4.0",
"RBL_MAILSPIKE_BAD" = "1.0",
"RBL_MAILSPIKE_VERYBAD" = "1.5",
"RBL_MAILSPIKE_WORST" = "2.0",
"RBL_NIXSPAM" = "4.0",
"RBL_SEM" = "1.0",
"RBL_SEM_IPV6" = "1.0",
"RBL_SENDERSCORE" = "2.0",
"RBL_SPAMCOP" = "4.0",
"RBL_SPAMHAUS" = "0.0",
"RBL_SPAMHAUS_BLOCKED" = "0.0",
"RBL_SPAMHAUS_BLOCKED_OPENRESOLVER" = "0.0",
"RBL_SPAMHAUS_CSS" = "2.0",
"RBL_SPAMHAUS_DROP" = "7.0",
"RBL_SPAMHAUS_PBL" = "2.0",
"RBL_SPAMHAUS_SBL" = "4.0",
"RBL_SPAMHAUS_XBL" = "4.0",
"RBL_VIRUSFREE_BOTNET" = "2.0",
"RCPT_ADDR_IN_SUBJECT" = "3.0",
"RCPT_COUNT_FIVE" = "0.0",
"RCPT_COUNT_GT_50" = "1.0",
"RCPT_COUNT_ONE" = "0.0",
"RCPT_COUNT_SEVEN" = "0.0",
"RCPT_COUNT_THREE" = "0.0",
"RCPT_COUNT_TWELVE" = "0.0",
"RCPT_COUNT_TWO" = "0.0",
"RCPT_COUNT_ZERO" = "0.0",
"RCPT_LOCAL_IN_SUBJECT" = "2.0",
"RCVD_COUNT_FIVE" = "0.0",
"RCVD_COUNT_ONE" = "0.0",
"RCVD_COUNT_SEVEN" = "0.0",
"RCVD_COUNT_THREE" = "0.0",
"RCVD_COUNT_TWELVE" = "0.0",
"RCVD_COUNT_TWO" = "0.0",
"RCVD_COUNT_ZERO" = "0.0",
"RCVD_DKIM_ARC_DNSWL_HI" = "-1.0",
"RCVD_DKIM_ARC_DNSWL_MED" = "-0.5",
"RCVD_DOUBLE_IP_SPAM" = "2.0",
"RCVD_FROM_SMTP_AUTH" = "0.0",
"RCVD_HELO_USER" = "3.0",
"RCVD_ILLEGAL_CHARS" = "4.0",
"RCVD_IN_DNSWL_HI" = "-0.5",
"RCVD_IN_DNSWL_LOW" = "-0.1",
"RCVD_IN_DNSWL_MED" = "-0.2",
"RCVD_IN_DNSWL_NONE" = "0.0",
"RCVD_NO_TLS_LAST" = "0.1",
"RCVD_TLS_ALL" = "0.0",
"RCVD_TLS_LAST" = "0.0",
"RCVD_UNAUTH_PBL" = "2.0",
"RCVD_VIA_SMTP_AUTH" = "0.0",
"RDNS_DNSFAIL" = "0.0",
"RDNS_NONE" = "1.0",
"RECEIVED_BLOCKLISTDE" = "3.0",
"RECEIVED_SPAMHAUS_BLOCKED" = "0.0",
"RECEIVED_SPAMHAUS_BLOCKED_OPENRESOLVER" = "0.0",
"RECEIVED_SPAMHAUS_CSS" = "1.0",
"RECEIVED_SPAMHAUS_PBL" = "0.0",
"RECEIVED_SPAMHAUS_SBL" = "3.0",
"RECEIVED_SPAMHAUS_XBL" = "1.0",
"REDIRECTOR_URL" = "0.0",
"REDIRECTOR_URL_ONLY" = "1.0",
"REPLYTO_ADDR_EQ_FROM" = "0.0",
"REPLYTO_DN_EQ_FROM_DN" = "0.0",
"REPLYTO_DOM_EQ_FROM_DOM" = "0.0",
"REPLYTO_DOM_NEQ_FROM_DOM" = "0.0",
"REPLYTO_EMAIL_HAS_TITLE" = "2.0",
"REPLYTO_EQ_FROM" = "0.0",
"REPLYTO_EQ_TO_ADDR" = "5.0",
"REPLYTO_EXCESS_BASE64" = "1.5",
"REPLYTO_EXCESS_QP" = "1.2",
"REPLYTO_UNPARSABLE" = "1.0",
"RWL_MAILSPIKE_EXCELLENT" = "-0.4",
"RWL_MAILSPIKE_GOOD" = "-0.1",
"RWL_MAILSPIKE_NEUTRAL" = "0.0",
"RWL_MAILSPIKE_POSSIBLE" = "0.0",
"RWL_MAILSPIKE_VERYGOOD" = "-0.2",
"R_BAD_CTE_7BIT" = "3.5",
"DKIM_ALLOW" = "-0.2",
"DKIM_NA" = "0.0",
"DKIM_PERMFAIL" = "0.0",
"DKIM_REJECT" = "1.0",
"DKIM_TEMPFAIL" = "0.0",
"R_MISSING_CHARSET" = "0.5",
"R_MIXED_CHARSET" = "5.0",
"MIXED_CHARSET_URL" = "7.0",
"R_NO_SPACE_IN_FROM" = "1.0",
"R_PARTS_DIFFER" = "1.0",
"SPF_ALLOW" = "-0.2",
"SPF_DNSFAIL" = "0.0",
"SPF_FAIL" = "1.0",
"SPF_NA" = "0.0",
"SPF_NEUTRAL" = "0.0",
"SPF_PERMFAIL" = "0.0",
"SPF_SOFTFAIL" = "0.0",
"R_SUSPICIOUS_URL" = "5.0",
"R_UNDISC_RCPT" = "3.0",
"SEM_URIBL" = "3.5",
"SEM_URIBL_FRESH15" = "3.0",
"SIGNED_PGP" = "-2.0",
"SIGNED_SMIME" = "-2.0",
"SORTED_RECIPS" = "3.5",
"SPAM_FLAG" = "5.0",
"SPAM_TRAP" = "discard",
"SPOOF_DISPLAY_NAME" = "8.0",
"SPOOF_REPLYTO" = "6.0",
"SUBJECT_ENDS_EXCLAIM" = "0.0",
"SUBJECT_ENDS_QUESTION" = "1.0",
"SUBJECT_ENDS_SPACES" = "0.5",
"SUBJECT_HAS_CURRENCY" = "1.0",
"SUBJECT_HAS_EXCLAIM" = "0.0",
"SUBJECT_HAS_QUESTION" = "0.0",
"SUBJECT_NEEDS_ENCODING" = "1.0",
"SUBJ_ALL_CAPS" = "3.0",
"SUBJ_BOUNCE_WORDS" = "0.0",
"SUBJ_EXCESS_BASE64" = "1.5",
"SUBJ_EXCESS_QP" = "1.2",
"SURBL_BLOCKED" = "0.0",
"SURBL_HASHBL_ABUSE" = "5.0",
"SURBL_HASHBL_CRACKED" = "5.0",
"SURBL_HASHBL_EMAIL" = "5.0",
"SURBL_HASHBL_MALWARE" = "6.5",
"SURBL_HASHBL_PHISH" = "6.5",
"SUSPICIOUS_RECIPS" = "1.5",
"TAGGED_FROM" = "0.0",
"TAGGED_RCPT" = "0.0",
"THREAD_HIJACKING_FROM_INJECTOR" = "2.0",
"TO_DN_ALL" = "0.0",
"TO_DN_EQ_ADDR_ALL" = "0.0",
"TO_DN_EQ_ADDR_SOME" = "0.0",
"TO_DN_NONE" = "0.0",
"TO_DN_RECIPIENTS" = "2.0",
"TO_DN_SOME" = "0.0",
"TO_DOM_EQ_FROM_DOM" = "0.0",
"TO_EQ_FROM" = "0.0",
"TO_EXCESS_BASE64" = "1.5",
"TO_EXCESS_QP" = "1.2",
"TO_MATCH_ENVRCPT_ALL" = "0.0",
"TO_MATCH_ENVRCPT_SOME" = "0.0",
"TO_NEEDS_ENCODING" = "1.0",
"TO_WRAPPED_IN_SPACES" = "2.0",
"TRUSTED_REPLY" = "-7.0",
"UNDISC_RCPTS_BULK" = "3.0",
"UNITEDINTERNET_SPAM" = "5.0",
"URIBL_BLACK" = "7.5",
"URIBL_BLOCKED" = "0.0",
"URIBL_GREY" = "1.5",
"URIBL_RED" = "3.5",
"URI_COUNT_ODD" = "0.5",
"URI_HIDDEN_PATH" = "1.0",
"URL_IN_SUBJECT" = "4.0",
"URL_REDIRECTOR_NESTED" = "1.0",
"VIOLATED_DIRECT_SPF" = "3.5",
"WP_COMPROMISED" = "0.0",
"WWW_DOT_DOMAIN" = "0.5",
"XM_CASE" = "0.5",
"XM_UA_NO_VERSION" = "0.01",
"X_PHP_EVAL" = "4.0",
"ZERO_WIDTH_SPACE_URL" = "7.0",
"SHORT_PART_BAD_HEADERS" = "7.0",
"MISSING_ESSENTIAL_HEADERS" = "7.0",
"SINGLE_SHORT_PART" = "0.0",
"COMPLETELY_EMPTY" = "7.0"}

spam-dmarc = {"18f.gov",
"1password.com",
"2gis.com",
"4chan.org",
"4pda.ru",
"9-11commission.gov",
"911.gov",
"aberdeenshire.gov.uk",
"abilityone.gov",
"absolutbank.ru",
"access-board.gov",
"acquisition.gov",
"acus.gov",
"ada.gov",
"adf.gov",
"adidas.co.kr",
"adidas.com.au",
"adidas.com.br",
"adidas.com.hk",
"adidas.fi",
"adidas.fr",
"admongo.gov",
"adobe.dk",
"adobe.es",
"adobeawards.com",
"adp.com",
"advice.hmrc.gov.uk",
"aerocivil.gov.co",
"afreximbank.com",
"agingstats.gov",
"agro.ru",
"ahcpr.gov",
"aids.gov",
"airbnb.co.uk",
"airbnb.com",
"airbnb.com.tr",
"airbnb.cz",
"airbnb.de",
"airbnb.fi",
"airbnb.fr",
"airbnb.pl",
"airbnb.ru",
"airbnb.se",
"airnow.gov",
"airtel.in",
"alfabank.com",
"alfabank.ru",
"alfastrah.ru",
"alibaba.com",
"aliexpress.com",
"alipay.com",
"alkupone.ru",
"alzheimers.gov",
"amazon.co.uk",
"amazon.com",
"amazon.com.br",
"amberalert.gov",
"americanexpress.com",
"ameslab.gov",
"angus.gov.uk",
"anidub.com",
"annapolis.gov",
"anstaskforce.gov",
"apple.com.au",
"apple.com.cn",
"apps.gov",
"archives.gov",
"arctic.gov",
"arionbanki.is",
"asg.com",
"asic.gov.au",
"askona.ru",
"asos.com",
"assist.ru",
"atf.gov",
"avast.com",
"avg.com",
"avito.ru",
"avtoradio.ru",
"axisbank.com",
"badoo.com",
"baltbank.ru",
"bank.lv",
"banki.ru",
"bankofamerica.com",
"barclaycard.co.uk",
"barclays.co.uk",
"barclays.com",
"battle.net",
"beeline.kz",
"beeline.ru",
"benefits.gov",
"betfaq.ru",
"biglion.ru",
"binary.com",
"binbank.ru",
"bioethics.gov",
"biometrics.gov",
"biopreferred.gov",
"birminghampost.net",
"bishopsmove.com",
"bitbank.cc",
"bjs.gov",
"blizzard.com",
"blog.gov.uk",
"bls.gov",
"bluestarindia.com",
"boemre.gov",
"bolsover.gov.uk",
"bolton.gov.uk",
"booking.com",
"bookmate.com",
"books.ru",
"bournemouth.gov.uk",
"box.com",
"bpa.gov",
"brandshop.ru",
"bridgend.gov.uk",
"brighton-hove.gov.uk",
"britishembassy.gov.uk",
"broadbandmap.gov",
"bromley.gov.uk",
"bts.gov",
"business.gov",
"caerphilly.gov.uk",
"caixa.gov.br",
"cambridge-news.co.uk",
"campaign.gov.uk",
"cancer.gov",
"cannockchasedc.gov.uk",
"capitalone.co.uk",
"cardiff.gov.uk",
"carecredit.com",
"cbp.gov",
"cdfifund.gov",
"centralbedfordshire.gov.uk",
"ceredigion.gov.uk",
"cesg.gov.uk",
"cfda.gov",
"cfo.gov",
"challenge.gov",
"change.org",
"chase.com",
"chcoc.gov",
"childstats.gov",
"cio.gov",
"circle.com",
"citibank.ae",
"citibank.co.in",
"citibank.co.uk",
"citibank.com.my",
"citibank.hu",
"citibank.pl",
"cloud.gov",
"cloudflare.com",
"cms.gov",
"co-operativebank.co.uk",
"colgate.com.br",
"collegedrinkingprevention.gov",
"companies-house.gov.uk",
"comuneap.gov.it",
"conab.gov.br",
"concerts.com",
"consultant.ru",
"contact-sys.com",
"copeland.gov.uk",
"cosla.gov.uk",
"courtservice.gov.uk",
"coventry.gov.uk",
"cre.gov.uk",
"csosa.gov",
"cuidadodesalud.gov",
"culturarecreacionydeporte.gov.co",
"customs.gov.my",
"customs.gov.ua",
"cybercrime.gov",
"dailypost.co.uk",
"danskebank.dk",
"danskebank.fi",
"danskebank.ie",
"danskebank.no",
"dartford.gov.uk",
"dartmoor.gov.uk",
"dataprotection.gov.uk",
"daventrydc.gov.uk",
"dellin.ru",
"denbighshire.gov.uk",
"deutsche-bank.de",
"deutschebank.be",
"deutschebank.co.in",
"dh.gov.uk",
"dhl.com",
"dhs.gov",
"diablo3.com",
"digital.gov",
"digitalgov.gov",
"digitalliteracy.gov",
"disability.gov",
"disability.gov.uk",
"dnfsb.gov",
"docker.com",
"docusign.net",
"doe.gov",
"doioig.gov",
"dol.gov",
"doleta.gov",
"domofond.ru",
"drought.gov",
"drugabuse.gov",
"dsns.gov.ua",
"dtv.gov",
"dudley.gov.uk",
"dyslexiaida.org",
"e-boks.dk",
"e-verify.gov",
"eastdunbarton.gov.uk",
"eaststaffsbc.gov.uk",
"eastsuffolk.gov.uk",
"ebay.be",
"ebay.ca",
"ebay.ch",
"ebay.co.uk",
"ebay.com",
"ebay.com.au",
"ebay.com.cn",
"ebay.de",
"ebay.es",
"ebay.eu",
"ebay.fr",
"ebay.in",
"ebay.it",
"ebay.se",
"economy.gov.tr",
"econsumer.gov",
"ed.gov",
"eftps.gov",
"ehsni.gov.uk",
"eia.gov",
"ejob.gov.tw",
"elance.com",
"eldorado.ru",
"email-ee.co.uk",
"email.tektorg.ru",
"emarsys.com",
"ems.gov",
"energystar.gov",
"erewash.gov.uk",
"esetnod32.ru",
"essex-fire.gov.uk",
"eubank.kz",
"evernote.com",
"everychildmatters.gov.uk",
"evus.gov",
"exist.ru",
"expediamail.com",
"facebook.com",
"facebookmail.com",
"fbi.gov",
"fcc.gov",
"fco.gov.uk",
"fdic.gov",
"feb.gov",
"federalreserve.gov",
"fedex.com",
"fedramp.gov",
"fedshirevets.gov",
"feedthefuture.gov",
"fema.gov",
"ferc.gov",
"fhfa.gov",
"fhfaoig.gov",
"fife.gov.uk",
"financialresearch.gov",
"financialstability.gov",
"firstbankpb.bank",
"firstbankpb.com",
"firstnet.gov",
"firstresponder.gov",
"fishwatch.gov",
"fitness.gov",
"flagma.ua",
"flamp.ru",
"fletc.gov",
"fmc.gov",
"fmcs.gov",
"foia.gov",
"food.gov.uk",
"force.com",
"fordlibrarymuseum.gov",
"foreignassistance.gov",
"foreigntrade.gov.tr",
"franklinwi.gov",
"ftc.gov",
"ftccomplaintassistant.gov",
"gamereactor.dk",
"gap.com",
"garant.ru",
"geekbrains.ru",
"geektimes.ru",
"getsmartaboutdrugs.gov",
"gibraltar.gov.uk",
"gitlab.com",
"globalentry.gov",
"globalhealth.gov",
"globe.gov",
"gloucestershire.gov.uk",
"goes-r.gov",
"gosuslugi.ru",
"gov.uk",
"groupon.es",
"groupon.hk",
"groupon.it",
"gsa.gov",
"gsaadvantage.gov",
"gsaauctions.gov",
"gsaig.gov",
"gtbank.com",
"guideline.gov",
"guidelines.gov",
"gwynedd.gov.uk",
"habr.com",
"hambleton.gov.uk",
"harp.gov",
"hawaiicounty.gov",
"hdfcbank.com",
"hdrezka.ag",
"healthcare.gov",
"healthypeople.gov",
"hertfordshire.gov.uk",
"hh.kz",
"hh.ru",
"highland.gov.uk",
"highwaycode.gov.uk",
"hillingdon.gov.uk",
"hiv.gov",
"hmrc.gov.uk",
"homeoffice.gov.uk",
"homesales.gov",
"hotels.com",
"hounslow.gov.uk",
"howto.gov",
"hru.gov",
"huduser.gov",
"hurricanes.gov",
"iba.gov.au",
"ice.gov",
"idmanagement.gov",
"ikea.ch",
"ikea.co.uk",
"ikea.com",
"ikea.de",
"ikea.fr",
"ikea.gr",
"ikea.nl",
"ikea.pl",
"imgur.com",
"incometaxindiaefiling.gov.in",
"ing.com",
"inl.gov",
"inlandrevenue.gov.uk",
"insider.co.uk",
"insolvency.gov.uk",
"instagram.com",
"insurekidsnow.gov",
"invasivespeciesinfo.gov",
"investor.gov",
"irda.gov.in",
"itunes.com",
"jccbi.gov",
"jd.ru",
"jet.com",
"jimmycarterlibrary.gov",
"job.com",
"johnsonsbaby.co.uk",
"joybuy.com",
"jpmorgan.com",
"jpmorgansecurities.com",
"judiciary.gov.uk",
"justice.gov",
"justice.gov.az",
"justice.gov.uk",
"jyskebank.dk",
"kassy.ru",
"kent.gov.uk",
"keys.openpgp.org",
"kids.gov",
"kingston.gov.uk",
"kivra.com",
"klarna.com",
"klarna.se",
"kpk.gov.pl",
"lacoast.gov",
"landsbanki.is",
"lanl.gov",
"lbhf.gov.uk",
"lcd.gov.uk",
"learningcurve.gov.uk",
"leeds.gov.uk",
"leroymerlin.es",
"lichfielddc.gov.uk",
"lincoln.gov.uk",
"lincolnshire.gov.uk",
"linkedin.com",
"livejournal.com",
"llnl.gov",
"lloydsbank.com",
"locatorplus.gov",
"lostfilm.tv",
"louisvilleco.gov",
"love.ru",
"lufthansa-group.com",
"lufthansa.com",
"mackeeper.com",
"mailgun.net",
"mak.com",
"mandtbank.com",
"mcc.gov",
"mcga.gov.uk",
"mchenrycountyil.gov",
"mecknc.gov",
"mediamarkt.se",
"medicaid.gov",
"medicare.gov",
"medium.com",
"megafon.ru",
"megaplan.ru",
"mercadolibre.com.ar",
"mercadolivre.com.br",
"merseyfire.gov.uk",
"merthyr.gov.uk",
"meshok.ru",
"messenger.com",
"microsoft.net",
"middlesbrough.gov.uk",
"midlothian.gov.uk",
"mil.ru",
"mincit.gov.co",
"minhacienda.gov.co",
"minsvyaz.ru",
"mintic.gov.co",
"mirrorfootball.co.uk",
"mkb.ru",
"mlg.ru",
"mlg.tv",
"mns.gov.ua",
"mod.gov.az",
"molisa.gov.vn",
"mos.ru",
"mosoblbank.ru",
"mosreg.ru",
"motinfo.gov.uk",
"movavi.com",
"msha.gov",
"mspb.gov",
"msport.gov.pl",
"murfreesborotn.gov",
"mvideo.ru",
"mxtoolbox.com",
"mymoney.gov",
"myplate.gov",
"myra.gov",
"myshared.ru",
"n-kesteven.gov.uk",
"n-somerset.gov.uk",
"nads.gov.ua",
"nalog.ru",
"namus.gov",
"nasa.gov",
"nationalarchives.gov.uk",
"nationalservice.gov",
"nationsreportcard.gov",
"nbr.gov.bd",
"nbtbank.com",
"ncifcrf.gov",
"ncpw.gov",
"nctb.gov.bd",
"ne-derbyshire.gov.uk",
"nea.gov",
"nelincs.gov.uk",
"neobux.com",
"neolane.net",
"netflix.com",
"newegg.com",
"newmoney.gov",
"nga.gov",
"ngu.gov.ua",
"nhtsa.gov",
"nic.ru",
"nidw.gov.bd",
"nij.gov",
"nio.gov.uk",
"niscc.gov.uk",
"nist.gov",
"nixonlibrary.gov",
"nkh.gov.hu",
"noaa.gov",
"nordea.dk",
"nordea.com",
"nordea.fi",
"nordea.no",
"nordea.se",
"north-ayrshire.gov.uk",
"north-norfolk.gov.uk",
"northlincs.gov.uk",
"norwich.gov.uk",
"notifications.service.gov.uk",
"nottinghamcity.gov.uk",
"nrc-gateway.gov",
"nrc.gov",
"nrel.gov",
"nsf.gov",
"nsopr.gov",
"nsopw.gov",
"nwtrb.gov",
"oculus.com",
"ofcm.gov",
"office.com",
"officemag.ru",
"ok.ru",
"omb.gov",
"ombudsman.gov.tr",
"onedrive.com",
"onguardonline.gov",
"opengl.org",
"openinternet.gov",
"ordsvy.gov.uk",
"ornl.gov",
"oshrc.gov",
"osti.gov",
"oxfordshire.gov.uk",
"ozon.ru",
"paauditor.gov",
"paccar.com",
"paddle8.com",
"pandemicflu.gov",
"passport.gov.uk",
"payeer.com",
"paymentaccuracy.gov",
"paypal-community.com",
"paypal.be",
"paypal.cn",
"paypal.co.il",
"paypal.co.uk",
"paypal.com",
"paypal.com.au",
"paypal.com.br",
"paypal.com.mx",
"paypal.de",
"paypal.dk",
"paypal.es",
"paypal.fr",
"paypal.nl",
"paypal.se",
"pbgc.gov",
"pc.gov.au",
"pch.com",
"penanghill.gov.my",
"pepfar.gov",
"performance.gov",
"pinterest.co.kr",
"pinterest.com",
"pinterest.de",
"pinterest.jp",
"pinterest.se",
"pkc.gov.uk",
"planeta.ru",
"platron.ru",
"plymouth.gov.uk",
"pm.gov.uk",
"pmf.gov",
"pmi.gov",
"pncbank.com",
"pokerstars.com",
"pokerstars.fr",
"pokerstars.it",
"pokerstars.net",
"priorbank.by",
"privatbank.ua",
"prospertx.gov",
"prostocash.com",
"provident.bank",
"psbank.ru",
"psc.gov",
"punjab.gov.in",
"puzzle-english.com",
"qiwi.com",
"qiwi.ru",
"rabota.ru",
"rbkc.gov.uk",
"ready.gov",
"reaganlibrary.gov",
"redbridge.gov.uk",
"reddit.com",
"reebok.es",
"reebok.nl",
"reginfo.gov",
"regulations.gov",
"reisebank.de",
"renfrewshire.gov.uk",
"rentonwa.gov",
"reportband.gov",
"rgs.ru",
"richmond.gov.uk",
"rivers.gov",
"rkn.gov.ru",
"ros.gov.uk",
"roseltorg.ru",
"rostelecom.ru",
"roundrocktexas.gov",
"royalmail.com",
"rozetka.com.ua",
"rt.com",
"rt.ru",
"rushcliffe.gov.uk",
"rutubeinfo.ru",
"sacn.gov.uk",
"safercar.gov",
"samhsa.gov",
"sanmarcostx.gov",
"sberbank.ru",
"sberbank-ast.ru",
"sbir.gov",
"sbis.ru",
"scality.com",
"scdhhs.gov",
"science360.gov",
"sciencebase.gov",
"scijinks.gov",
"sec.gov",
"secretservice.gov",
"section508.gov",
"semnan.ac.ir",
"senate.gov",
"sendgrid.net",
"seniorcorps.gov",
"serpro.gov.br",
"service.gov.uk",
"sftool.gov",
"shetland.gov.uk",
"shropshire-cc.gov.uk",
"shutterstock.com",
"sigtarp.gov",
"sk.ru",
"skat.dk",
"skatteverket.se",
"skbbank.ru",
"skittles.com",
"skydio.com",
"skype.com",
"slideshare.com",
"smart.gov",
"smida.gov.ua",
"smokefree.gov",
"snickers.com",
"solardecathlon.gov",
"sourceforge.net",
"south-ayrshire.gov.uk",
"sovest.ru",
"spbrealty.ru",
"sportmaster.ru",
"squarespace.com",
"sravni.ru",
"srs.gov",
"staffordbc.gov.uk",
"stat.gov.az",
"stedmundsbury.gov.uk",
"sthelens.gov.uk",
"stihl.ru",
"stopalcoholabuse.gov",
"stopfraud.gov",
"studentloans.gov",
"subscribe.ru",
"suffolkcc.gov.uk",
"suncorpbank.com.au",
"sundaymirror.co.uk",
"sunlight.net",
"superjob.ru",
"surestart.gov.uk",
"sutton.gov.uk",
"swansea.gov.uk",
"swift.com",
"symantec.com",
"synologynotification.com",
"taobao.com",
"tatar.ru",
"tauntondeane.gov.uk",
"tda.gov.uk",
"tdk.gov.tr",
"tdscpc.gov.in",
"telework.gov",
"tenders.gov.au",
"textmagic.com",
"tfhrc.gov",
"thebell.io",
"thecoolspot.gov",
"thinkroadsafety.gov.uk",
"tiaabank.com",
"ticketland.ru",
"tinder.com",
"tinkoff.ru",
"tomsk.gov.ru",
"torbay.gov.uk",
"tradingstandards.gov.uk",
"treas.gov",
"trial-sport.ru",
"tsa.gov",
"tst.gov.br",
"tuba.gov.tr",
"turystyka.gov.pl",
"tutu.ru",
"twitch.tv",
"twitter.com",
"twix.com",
"uber.com",
"ucarecdn.com",
"ucrdatatool.gov",
"udall.gov",
"ukvisas.gov.uk",
"ulmart.ru",
"unicor.gov",
"uniras.gov.uk",
"ups.com",
"uralairlines.ru",
"us-cert.gov",
"usa.gov",
"usadf.gov",
"usaid.gov",
"usap.gov",
"uscg.gov",
"usconsulate.gov",
"usmission.gov",
"usphs.gov",
"uspis.gov",
"usps.com",
"usps.gov",
"ustreas.gov",
"utair.ru",
"utkonos.ru",
"vaccines.gov",
"valeofglamorgan.gov.uk",
"verizonwireless.com",
"vigoda.ru",
"visa.co.uk",
"visa.com",
"visa.com.ar",
"visa.com.br",
"visa.com.cn",
"visa.com.tw",
"visa.pl",
"vistacampus.gov",
"vk.com",
"vkrugudruzei.ru",
"vkusnyblog.ru",
"vmc.gov.in",
"voa.gov.uk",
"volunteer.gov",
"vote.gov",
"walsall.gov.uk",
"wandsworth.gov.uk",
"wartimecontracting.gov",
"warwickdc.gov.uk",
"wealden.gov.uk",
"wellingtonfl.gov",
"west-lindsey.gov.uk",
"westernunion.com",
"westernunion.ru",
"westlothian.gov.uk",
"whatsapp.com",
"whistleblowers.gov",
"wirral.gov.uk",
"wlga.gov.uk",
"womenshealth.gov",
"wrexham.gov.uk",
"wrigley.com",
"wrp.gov",
"yandex-team.ru",
"york.gov.uk",
"youla.ru",
"youth.gov",
"youthrules.gov",
"youtube.com",
"zcts.ru",
"zendesk.com",
"zionsbank.com",
"zomato.com"}


spam-allow = {"126.com",
"163.com",
"1gost.info",
"1stnationalbank.com",
"2o7.net",
"365online.com",
"4at1.com",
"53.com",
"5iantlavalamp.com",
"abl.com.pk",
"about.com",
"accessbankplc.com",
"adelphia.net",
"adib.ae",
"adobe.com",
"agora-inc.com",
"agoramedia.com",
"aibgb.co.uk",
"aib.ie",
"airdriesavingsbank.com",
"akamai.net",
"akamaitech.net",
"aldermore.co.uk",
"alexa.com",
"alliancebank.com.my",
"alliancefg.com",
"alliantcreditunion.com",
"alliantcreditunion.org",
"allianz.de",
"allybank.com",
"alterna.ca",
"amazon.com",
"americanexpress.ch",
"americanexpress.com",
"anadolubank.nl",
"ancestry.com",
"anz.com",
"anz.co.nz",
"aol.com",
"apache.org",
"apple.com",
"arbuthnotlatham.co.uk",
"arcamax.com",
"asb.co.nz",
"ask.com",
"astrology.com",
"atdmt.com",
"att.net",
"authorize.net",
"autorambler.ru",
"axisbank.co.in",
"axisbank.com",
"b2bbank.com",
"baaderbank.de",
"baidu.com",
"baloise.ch",
"baml.com",
"banamex.com",
"bancanetbsc.do",
"bancanetsantacruz.com.do",
"bancapulia.it",
"bancarios.com",
"bancastato.ch",
"bancatransilvania.ro",
"bancobase.com",
"bancobic.ao",
"bancobic.pt",
"bancobpi.pt",
"banco.bradesco",
"bancobrasil.com.br",
"bancochile.cl",
"bancochile.com",
"bancoestado.cl",
"bancofalabella.cl",
"bancofalabella.com.co",
"bancofalabella.pe",
"bancomer.com",
"bancopopolare.it",
"bancopostaclick.it",
"bancoposta.it",
"bancosantander.es",
"bancovotorantimcartoes.com.br",
"bank24.ru",
"bankalhabib.com",
"bankaustria.at",
"bank.barclays.co.uk",
"bankbgzbnpparibas.pl",
"bankcardservices.co.uk",
"bankcomm.com",
"bankcoop.ch",
"bankiabancapersonal.es",
"bankia.com",
"bankia.es",
"bankinter.com",
"bankinter.es",
"bankmutual.com",
"bankofamerica.com",
"bankofcanada.ca",
"bankofchina.com",
"bankofcyprus.com",
"bankofindia.co.nz",
"bankofireland.com",
"bank-of-ireland.co.uk",
"bankofirelanduk.com",
"bankofoklahoma.com",
"bankofscotland.co.uk",
"banksinarmas.com",
"bankvonroll.ch",
"bankwest.com.au",
"banque-casino.fr",
"banquepopulaire.fr",
"banquescotia.com",
"barclaycard.co.uk",
"barclaycard.de",
"barclaycard.es",
"barclays.com",
"barclays.co.uk",
"barclayspartnerfinance.com",
"barclays.sc",
"barodanzltd.co.nz",
"basler.ch",
"bbandt.com",
"bbc.co.uk",
"bcentral.com",
"bci.cl",
"bcp.com.pe",
"bcv.ch",
"bcvs.ch",
"bekb.ch",
"bellevue.ch",
"bellsouth.net",
"bendigobank.com.au",
"berliner-bank.de",
"berliner-sparkasse.de",
"bfanet.ao",
"bfi0.com",
"bgfi.com",
"bgfionline.com",
"bgzbnpparibas.pl",
"billmelater.com",
"bing.com",
"bkb.ch",
"bk.rw",
"bks.at",
"blkb.ch",
"bmocm.com",
"bmo.com",
"bmogam.com",
"bmoharris.com",
"bmoharrisprivatebankingonline.com",
"bmoinvestorline.com",
"bmonesbittburns.com",
"bnl.it",
"bnpparibas.com",
"bnpparibas.fr",
"boc.cnnz",
"bonuscard.ch",
"bpe-gruposantander.com",
"bpi.pt",
"bpostbank.be",
"bradescardonline.com.br",
"bradesco.com.br",
"bradescoseguranca.com.br",
"bridgetrack.com",
"bridgewaterbank.ca",
"bsibank.com",
"btrl.ro",
"bt-trade.ro",
"businessonline-boi.com",
"bzbank.ch",
"ca-cib.com",
"ca-egypt.com",
"cafbank.org",
"cafe24.com",
"cafonline.org",
"caisse-epargne.com",
"caisse-epargne.fr",
"caixabank.com",
"caixa.gov.br",
"cajasur.es",
"camsonline.com",
"canadiandirect.com",
"capitalone360.com",
"capitalone.com",
"capitaloneonline.co.uk",
"capitecbank.co.za",
"cariparma.it",
"carrefour-banque.fr",
"cartabcc.it",
"cartabccpos.it",
"cartasi.it",
"ca-suisse.com",
"catalunyacaixa.com",
"cbg.gm",
"cbonline.co.uk",
"cembra.ch",
"cenbank.org",
"centralbank.ae",
"charitybank.org",
"charter.net",
"chase.com",
"chebanca.it",
"chinatrust.com.tw",
"cial.ch",
"cibc.com",
"cic.ch",
"cimbclicks.com.my",
"citibank.ae",
"citibank.co.in",
"citibank.com",
"citibank.co.uk",
"citibankonline.com",
"citibusiness.com",
"citicards.com",
"citi.com",
"citi.co.nz",
"citi.eu",
"citigroup.com",
"citizensbank.ca",
"citizensbank.com",
"civibank.com",
"civibank.it",
"cjb.net",
"classmates.com",
"clickbank.net",
"closebrothers.com",
"closebrothers.co.uk",
"clubsc.ch",
"cnet.com",
"cnn.com",
"co.kg",
"colpatria.com",
"colpatria.com.co",
"comcast.net",
"com.com",
"commbank.com.au",
"commerzbank.com",
"commerzbank.de",
"com.ne.kr",
"coopbank.dk",
"co-operativebank.co.uk",
"cornerbanca.ch",
"cornercard.ch",
"cornercard.com",
"corner.ch",
"corporate-ir.net",
"cosycard.ch",
"coutts.com",
"cox.net",
"craigslist.org",
"credit-agricole.com",
"credit-agricole.fr",
"creditagricole.rs",
"credit-suisse.com",
"cs.com",
"css.ch",
"ctbcbank.com",
"ctfs.com",
"custhelp.com",
"cwbank.com",
"cwbankgroup.com",
"cwt.ca",
"cybg.com",
"danskebankas.lt",
"danskebank.com",
"danskebank.co.uk",
"danskebank.de",
"danskebank.dk",
"danskebank.ee",
"danskebank.fi",
"danskebank.ie",
"danskebank.no",
"datatrans.biz",
"datatrans.ch",
"daum.net",
"db.com",
"dbs.com",
"dd.se",
"debian.org",
"dell.com",
"demirbank.kg",
"denizbank.com",
"desjardins.ca",
"desjardins.com",
"deutschebank.be",
"deutschebank.co.nz",
"deutsche-bank.de",
"diamondbank.com",
"dibpak.com",
"directnic.com",
"directtrack.com",
"discovercard.com",
"discover.com",
"discovery.co.za",
"dnbnord.lt",
"domain.com",
"doubleclick.com",
"dresdner-bank.de",
"dsbbank.sr",
"dsbl.org",
"duncanlawrie.com",
"earthlink.net",
"easybank.at",
"easylnk.com",
"ebay.com",
"ebay.co.uk",
"ebay.de",
"ebayimg.com",
"ebaystatic.com",
"ecobank.com",
"edgesuite.net",
"ediets.com",
"edwardjones.com",
"egroups.com",
"e-gulfbank.com",
"emode.com",
"esunbank.com.tw",
"example.com",
"example.net",
"example.org",
"excite.com",
"facebook.com",
"fedex.com",
"fednetbank.com",
"fidelity.com",
"fidor.de",
"finance.com",
"finansbank.com.tr",
"finasta.lt",
"fineco.it",
"firstbankcard.com",
"firstmerit.com",
"firstnational.com",
"firstnationalmerchantsolutions.com",
"firsttrustbank.co.uk",
"flickr.com",
"fnbc.ca",
"fnb.co.za",
"fnb-online.com",
"freebsd.org",
"free.fr",
"friuladria.it",
"f-secure.com",
"garantibank.eu",
"garantibank.nl",
"garanti.com.tr",
"gazprombank.ch",
"gazprombank.ru",
"generali.es",
"genevoise.ch",
"gentoo.org",
"geocities.com",
"gkb.ch",
"gmail.com",
"gmx.net",
"go.com",
"godaddy.com",
"googleadservices.com",
"google.co.in",
"google.com",
"google.it",
"google.ru",
"granitbank.hu",
"grisoft.com",
"gtbank.com",
"halifax.co.uk",
"hallmark.com",
"handelsbanken.se",
"harrodsbank.co.uk",
"hbl.com",
"hblibank.com",
"hblibank.com.pk",
"hdfcbank.com",
"heartland.co.nz",
"hellenicbank.com",
"hinet.net",
"hkbea.com",
"hlb.com.kh",
"hlb.com.my",
"hoaresbank.co.uk",
"home.barclays",
"hongleongconnect.com.kh",
"hongleongconnect.com.vn",
"hongleongconnect.my",
"hotbar.com",
"hotmail.com",
"hotpop.com",
"hp.com",
"hsbc.com",
"hsbc.com.ar",
"hsbc.com.hk",
"hsbc.co.nz",
"hsbc.co.uk",
"hypovereinsbank.co.uk",
"hypovereinsbank.de",
"ibm.com",
"icbcnz.com",
"icicibank.co.in",
"icicibank.com",
"icicibankprivatebanking.com",
"icorner.ch",
"icscards.de",
"icscards.nl",
"incredimail.com",
"ing.be",
"ing.com",
"ing-diba.de",
"ingdirect.ca",
"ing.lu",
"ing.nl",
"ingvysyabank.com",
"interac.ca",
"investorplace.com",
"iobnet.co.in",
"isbank.com.tr",
"isbank.de",
"isbank.ge",
"isbank.iq",
"isbankkosova.com",
"itau.com.br",
"ivillage.com",
"joingevalia.com",
"jpmchase.com",
"jpmorgan.com",
"jsafrasarasin.com",
"julianhodgebank.com",
"juliusbaer.com",
"juno.com",
"jyskebank.dk",
"kantonalbank.ch",
"kernel.org",
"key.com",
"kiwibank.co.nz",
"kotak.com",
"kredytbank.pl",
"kreissparkasse-schwalm-eder.de",
"ksklb.de",
"kutxabank.es",
"laboralkutxa.com",
"lacaixa.cat",
"lacaixa.es",
"laurentianbank.ca",
"lbb.de",
"lcl.com",
"lcl.fr",
"li.ru",
"list.ru",
"liveinternet.ru",
"livejournal.com",
"lloydsbank.com",
"lloydsbankcommercial.com",
"lloydsbankinggroup.com",
"lloydstsb.ch",
"lloydstsb.co.uk",
"lombardodier.com",
"loydsbank.com",
"lycos.com",
"m7z.net",
"mac.com",
"macromedia.com",
"maerki-baumann.ch",
"mail.com",
"mail.ru",
"mailscanner.info",
"mandtbank.com",
"manulifebank.ca",
"manulifebankselect.ca",
"manulife.com",
"manulifeone.ca",
"marketwatch.com",
"mashreqbank.com",
"mastercard.com",
"maybank2u.com",
"maybank2u.com.my",
"mcafee.com",
"mchsi.com",
"mdmbank.com",
"mechanicsbank.com",
"medbank.lt",
"messagelabs.com",
"metrobankdirect.com",
"metrobankonline.co.uk",
"microsoft.com",
"migbank.com",
"migrosbank.ch",
"military.com",
"mindspring.com",
"mit.edu",
"mizuhobank.co.jp",
"mmwarburg.lu",
"monster.com",
"montepio.pt",
"morganstanley.com",
"mozilla.com",
"mps.it",
"ms.com",
"msn.com",
"mufg.jp",
"myonlineresourcecenter.com",
"myonlineservices.ch",
"myspace.com",
"nate.com",
"nationalesuisse.ch",
"nationwide-communications.co.uk",
"nationwide.co.uk",
"nationwide-service.co.uk",
"natwest.com",
"navyfederal.org",
"nbc.ca",
"netflix.com",
"netscape.com",
"netscape.net",
"netzero.net",
"newyorkfed.org",
"nibl.com.np",
"nod32.com",
"nordea.fi",
"nordea.lt",
"nordfynsbank.dk",
"norisbank.de",
"norman.com",
"notenstein.ch",
"nuvisionfederal.com",
"nytimes.com",
"oceanbank.com",
"onlinesbi.com",
"openoffice.org",
"openxmlformats.org",
"optonline.net",
"orchardbank.com",
"osdn.com",
"ostsaechsische-sparkasse-dresden.de",
"overstock.com",
"pacbell.net",
"pandasoftware.com",
"passport.com",
"paylife.at",
"paypal.be",
"paypal-brasil.com.br",
"paypal.ca",
"paypal.ch",
"paypal.co.il",
"paypal.com",
"paypal.com.au",
"paypal.com.br",
"paypal-communication.com",
"paypal-community.com",
"paypal.com.mx",
"paypal.com.pt",
"paypal.co.uk",
"paypal-customerfeedback.com",
"paypal.de",
"paypal-deutschland.de",
"paypal.dk",
"paypal.es",
"paypal-exchanges.com",
"paypal.fr",
"paypal.it",
"paypal-marketing.co.uk",
"paypal-marketing.pl",
"paypal.net",
"paypal.nl",
"paypal.no",
"paypal-notify.com",
"paypal-now.com",
"paypalobjects.com",
"paypal-opwaarderen.nl",
"paypal-pages.com",
"paypal.pt",
"paypal.ru",
"paypal.se",
"paypal-search.com",
"paypal-shopping.co.uk",
"paypal-techsupport.com",
"pbebank.com",
"pcfinancial.ca",
"peoplepc.com",
"permanenttsb.ie",
"plaxo.com",
"pnc.com",
"popolarevicenza.it",
"postbank.de",
"postepay.it",
"postfinancearena.ch",
"postfinance.ch",
"postfinance.info",
"price.ru",
"prodigy.net",
"publicislamicbank.com.my",
"rabobank.com",
"rabobank.co.nz",
"rabobank.nl",
"radaruol.com.br",
"rahnbodmer.ch",
"raiffeisenbank.rs",
"raiffeisen.ch",
"raiffeisen.hu",
"raiffeisen.li",
"raiffeisen.ru",
"rambler-co.ru",
"rambler.ru",
"raphaelsbank.com",
"rbc.com",
"rbcroyalbank.com",
"rbs.co.uk",
"rbssecure.co.uk",
"rbsworldpay.com",
"rcb.at",
"real.com",
"recordbank.be",
"redhat.com",
"rediff.com",
"regiobank.nl",
"regions.com",
"regionsnet.com",
"renasantbank.com",
"rhbgroup.com",
"rogersbank.com",
"rogers.com",
"rothschildbank.com",
"rothschild.com",
"royalbank.com",
"rr.com",
"sagepay.com",
"sagepay.co.uk",
"sainsburysbank.co.uk",
"samba.com",
"santander.cl",
"santander.com",
"santander.com.br",
"santander.com.mx",
"santandercorretora.com.br",
"santander.co.uk",
"santanderesfera.com.br",
"santandersantiago.cl",
"sarasin.ch",
"sbcglobal.net",
"sberbank.ch",
"sbs.net.nz",
"sc.com",
"schoellerbank.at",
"scotiabank.ca",
"scotiabank.com",
"scotiamocatta.com",
"scotiaonline.com",
"s.de",
"sec.gov",
"securetrustbank.com",
"service-sparkasse.de",
"serviciobancomer.com",
"sf.net",
"shawbrook.co.uk",
"shaw.ca",
"shkb.ch",
"shockwave.com",
"six-group.com",
"six-payment-services.com",
"skrill.com",
"sls-direkt.de",
"smithbarney.com",
"snb.ch",
"snsbank.nl",
"societegenerale.fr",
"sourceforge.net",
"spamcop.net",
"sparda-a.de",
"sparda-bank-hamburg.de",
"sparda-b.de",
"sparda-bw.de",
"sparda-h.de",
"sparda-hessen.de",
"sparda-m.de",
"sparda-ms.de",
"sparda-n.de",
"sparda-ostbayern.de",
"sparda-sw.de",
"sparda-verband.de",
"sparda-west.de",
"sparkasse.at",
"sparkasse-bank-malta.com",
"sparkasse-bielefeld.de",
"sparkasseblog.de",
"sparkasse-bochum.de",
"sparkasse.ch",
"sparkasse.de",
"sparkasse-gera-greiz.de",
"sparkasse-hamm.de",
"sparkasse-heidelberg.de",
"sparkasse-ingolstadt.de",
"sparkasse-mittelthueringen.de",
"speedera.net",
"sportsline.com",
"standardbank.com",
"standardbank.co.za",
"standardchartered.com.gh",
"standardchartered.com.my",
"subscribe.ru",
"sun.com",
"suncorpbank.com.au",
"suntrust.com",
"swedbank.com",
"swedbank.ee",
"swedbank.lt",
"swedbank.lu",
"swedbank.se",
"swisscanto.ch",
"swisscaution.ch",
"swissquote.ch",
"sydbank.dk",
"sympatico.ca",
"tails.nl",
"tangerine.ca",
"tcb-bank.com.tw",
"tdbank.com",
"tdcommercialbanking.com",
"telus.net",
"terra.com.br",
"tescobank.com",
"ticketmaster.com",
"tinyurl.com",
"tiscali.co.uk",
"tns-counter.ru",
"tom.com",
"tone.co.nz",
"t-online.de",
"top4top.ru",
"tsbbank.co.nz",
"tsb.co.nz",
"tsb.co.uk",
"tux.org",
"twitter.com",
"ubibanca.com",
"ubs.com",
"ulsterbankanytimebanking.co.uk",
"ulsterbank.co.uk",
"unibancoconnect.pt",
"unibanco.pt",
"unicreditbank.lt",
"unicredit.eu",
"unicreditgroup.eu",
"unicredit.it",
"unionbankcameroon.com",
"unionbank.com",
"unity.co.uk",
"uob.com.sg",
"uobgroup.com",
"uol.com.br",
"ups.com",
"usbank.com",
"valianttrust.com",
"vaudoise.ch",
"venetobanca.it",
"venetobanka.al",
"verizon.net",
"versabank.com",
"videobank.it",
"virginmoney.com",
"visa.com.ar",
"visa.com.br",
"visaeurope.ch",
"visaeurope.com",
"viseca.ch",
"volksbank.de",
"volkswagenbank.de",
"vpbank.com",
"vr.de",
"vwbank.de",
"w3.org",
"wachovia.com",
"walmart.com",
"wamu.com",
"wanadoo.fr",
"washingtonpost.com",
"weatherbug.com",
"weatherbys.co.uk",
"web.de",
"webshots.com",
"webtv.net",
"wegelin.ch",
"wellsfargo.com",
"wellsfargoemail.com",
"westernunion.ca",
"westernunion.com",
"westernunion.fr",
"westernunion.se",
"westpac.com.au",
"westpac.co.nz",
"wir.ch",
"wordpress.com",
"worldbank.org",
"worldpay.com",
"wsj.com",
"wvb.de",
"xmlsoap.org",
"yacht.nl",
"yahoo.ca",
"yahoo.co.jp",
"yahoo.co.kr",
"yahoo.com",
"yahoo.com.br",
"yahoo.co.uk",
"yahoogroups.com",
"yandex.net",
"yandex.ru",
"ybonline.co.uk",
"yimg.com",
"yopi.de",
"yorkshirebank.co.uk",
"yourbankcard.com",
"yoursite.com",
"youtube.com",
"zagbank.ca",
"zdnet.com",
"zenithbank.com",
"zkb.ch",
"zugerkb.ch",
"vistaprint.dk",
"vistaprint.com",
"anpdm.com",
"dovecot.org",
"exacttarget.com",
"github.com",
"isc.org",
"lists.isc.org",
"lists.roundcube.net",
"svn.apache.org",
"taggedmail.com",
"tumblr.com"}

spam-spdk = {"1cfresh.com",
"4chan.org",
"6pm.com",
"about.com",
"addthis.com",
"adf.ly",
"adobe.com",
"adp.com",
"adschemist.com",
"airbnb.com",
"airtel.in",
"alibaba.com",
"aliexpress.com",
"alipay.com",
"allrecipes.com",
"amazon.ca",
"amazon.cn",
"amazon.co.jp",
"amazon.com",
"amazon.co.uk",
"amazon.de",
"amazon.es",
"amazon.fr",
"amazon.in",
"amazon.it",
"amazon.ru",
"americanexpress.com",
"ancestry.com",
"android.com",
"apple.com",
"asana.com",
"att.com",
"autohome.com.cn",
"avg.com",
"aweber.com",
"badoo.com",
"bankofamerica.com",
"basecamp.com",
"battle.net",
"bet365.com",
"biglobe.ne.jp",
"bitly.com",
"bleacherreport.com",
"blogger.com",
"bloomberg.com",
"booking.com",
"box.com",
"bt.com",
"capitalone.com",
"cdiscount.com",
"change.org",
"chase.com",
"cisco.com",
"citi.com",
"costco.com",
"craigslist.org",
"custhelp.com",
"dell.com",
"delta.com",
"diply.com",
"discovercard.com",
"disqus.com",
"dropbox.com",
"drweb.com",
"e-boks.dk",
"ebay.ca",
"ebay.com",
"ebay.com.au",
"ebay.co.uk",
"ebay.de",
"ebay.fr",
"ebay.in",
"ebay.it",
"ebay.ru",
"etsy.com",
"evernote.com",
"expedia.com",
"facebook.com",
"fedex.com",
"fidelity.com",
"fishki.net",
"flickr.com",
"flirchi.com",
"force.com",
"freepik.com",
"gap.com",
"gawker.com",
"github.com",
"gizmodo.com",
"godaddy.com",
"googleadservices.com",
"googleusercontent.com",
"groupon.com",
"hdfcbank.com",
"hgtv.com",
"hh.ru",
"hm.com",
"houzz.com",
"hubspot.com",
"icicibank.com",
"icloud.com",
"ign.com",
"imgur.com",
"immobilienscout24.de",
"indeed.com",
"indiatimes.com",
"infusionsoft.com",
"instagram.com",
"intel.com",
"irctc.co.in",
"kayak.com",
"kickstarter.com",
"kijiji.ca",
"kotaku.com",
"letsencrypt.org",
"libero.it",
"lifehacker.com",
"likes.com",
"linkedin.com",
"linux.com",
"list-manage.com",
"mackeeper.com",
"mailchimp.com",
"mashable.com",
"match.com",
"mercadolibre.com.ar",
"mercadolivre.com.br",
"messenger.com",
"microsoft.com",
"microsoftonline.com",
"minmyndighetspost.se",
"moikrug.ru",
"mts.ru",
"neobux.com",
"netflix.com",
"newegg.com",
"nhk.or.jp",
"nifty.com",
"nikkeibp.co.jp",
"nyaa.se",
"nytimes.com",
"odnoklassniki.ru",
"ofd.yandex.ru",
"ok.ru",
"olx.ua",
"overstock.com",
"ozon.ru",
"ozon.travel",
"pandora.com",
"paypal.ca",
"paypal.cn",
"paypal.com",
"paypal.co.uk",
"paypal.de",
"paypal.es",
"paypal.fr",
"paypal.it",
"paypal.ru",
"paytm.com",
"pch.com",
"pinterest.com",
"porn.com",
"priceline.com",
"quora.com",
"rakuten.co.jp",
"reddit.com",
"researchgate.net",
"salesforce.com",
"sciencedirect.com",
"shopify.com",
"skanetrafiken.se",
"skat.dk",
"skatteverket.se",
"slack.com",
"slideshare.net",
"so-net.ne.jp",
"southwest.com",
"spotify.com",
"springer.com",
"squarespace.com",
"stalker.com",
"steampowered.com",
"stumbleupon.com",
"surveymonkey.com",
"swagbucks.com",
"taboola.com",
"taleo.net",
"taobao.com",
"target.com",
"taringa.net",
"taxi.yandex.ru",
"tele2.ru",
"thekitchn.com",
"tochka.com",
"tokopedia.com",
"trello.com",
"tribunnews.com",
"trulia.com",
"tumblr.com",
"twitter.com",
"ultimate-guitar.com",
"ups.com",
"usaa.com",
"usbank.com",
"usps.com",
"verizon.com",
"verizonwireless.com",
"vimeo.com",
"vine.co",
"vk.com",
"vmware.com",
"vtb24.ru",
"wahoofitness.com",
"walmart.com",
"wav.tv",
"wellsfargo.com",
"whatsapp.com",
"wikia.com",
"wikimedia.org",
"wikipedia.org",
"wildberries.ru",
"wix.com",
"wordpress.com",
"wordpress.org",
"wp.com",
"xuite.net",
"xvideos.com",
"yelp.com",
"youtube.com",
"yts.to",
"zappos.com",
"zendesk.com",
"zippyshare.com",
"zomato.com",
"zoom.us",
"zulily.com",
"zwift.com"}

spam-disposable = {"0815.ru",
"0clickemail.com",
"0wnd.net",
"0wnd.org",
"1054733.mail-temp.com",
"10m.email",
"10minutemail.com",
"10minutesmail.com",
"1secmail.com",
"1secmail.net",
"1secmail.org",
"20minutemail.com",
"2emailock.com",
"2prong.com",
"33mail.com",
"3d-magical-magnet.ru",
"4warding.com",
"90bit.ru",
"9ox.net",
"a-bc.net",
"afrobacon.com",
"alaki.ga",
"alivance.com",
"amilegit.com",
"amiri.net",
"anonymbox.com",
"antichef.com",
"antichef.net",
"antispam.de",
"audio.now.im",
"awex.icu",
"barenshop.ru",
"barryogorman.com",
"baxomale.ht.cx",
"beefmilk.com",
"binkmail.com",
"bio-muesli.net",
"bobmail.info",
"bofthew.com",
"brefmail.com",
"bsnow.net",
"bspamfree.org",
"bugmenot.com",
"casualdx.com",
"centermail.com",
"cetpass.com",
"chammy.info",
"choicemail1.com",
"choocho-telegram.ru",
"cool.fr.nf",
"courriel.fr.nf",
"courrieltemporaire.com",
"cuvox.de",
"dandikmail.com",
"dayrep.com",
"dcemail.com",
"deadspam.com",
"desoz.com",
"devnullmail.com",
"dfg6.kozow.com",
"dfgh.net",
"digitalsanctuary.com",
"dingbone.com",
"discardmail.com",
"discardmail.de",
"dispomail.win",
"dispomail.xyz",
"disposableaddress.com",
"disposeamail.com",
"dispostable.com",
"divismail.ru",
"dlesha.ru",
"dmaster39.ru",
"dodgit.com",
"domremonta-nv.ru",
"donemail.ru",
"dontreg.com",
"dontsendmespam.de",
"dumpandjunk.com",
"e-mail.com",
"e-mail.org",
"e4ward.com",
"edu.aiot.ze.cx",
"ekholotdeeper.ru",
"email-24x7.com",
"email60.com",
"emailate.com",
"emailay.com",
"emailias.com",
"emailmiser.com",
"emailsensei.com",
"emailtemporanea.net",
"emailtemporario.com.br",
"emailtex.com",
"emailwarden.com",
"emailx.at.hm",
"emailxfer.com",
"emz.net",
"exbts.com",
"explodemail.com",
"extremail.ru",
"eyeemail.com",
"fakeinbox.com",
"fakeinformation.com",
"fantasymail.de",
"filzmail.com",
"fls4.gleeze.com",
"fotosta.ru",
"frapmail.com",
"fudgerub.com",
"funny-mom.ru",
"furycraft.ru",
"garliclife.com",
"get2mail.fr",
"getonemail.com",
"gishpuppy.com",
"gnomi.ru",
"goplaygame.ru",
"greensloth.com",
"grr.la",
"gsrv.co.uk",
"guerillamail.com",
"guerrillamail.biz",
"guerrillamail.com",
"guerrillamail.de",
"guerrillamail.info",
"guerrillamail.net",
"guerrillamail.org",
"guerrillamailblock.com",
"h2ocoffe.ru",
"haltospam.com",
"hatespam.org",
"hidemail.de",
"hmamail.com",
"hochsitze.com",
"hulapla.de",
"hydraulics360.ru",
"i.xcode.ro",
"imails.info",
"inboxclean.com",
"inboxclean.org",
"irish2me.com",
"isdaq.com",
"iwi.net",
"jetable.com",
"jetable.fr.nf",
"jetable.net",
"jetable.org",
"justyland.ru",
"kasmail.com",
"kaspop.com",
"kemampuan.me",
"kikoxltd.com",
"killmail.com",
"killmail.net",
"kismail.ru",
"kkm35.ru",
"klassmaster.com",
"klzlk.com",
"koszmail.pl",
"kurzepost.de",
"kusrc.com",
"lackmail.ru",
"laoho.com",
"ldaho.biz",
"leeching.net",
"letthemeatspam.com",
"lhsdv.com",
"lifebyfood.com",
"lifeguru.online",
"light-marketing.ru",
"lol.ovpn.to",
"lookugly.com",
"lortemail.dk",
"lr78.com",
"madecassol78.ru",
"mail-temporaire.fr",
"mail.mezimages.net",
"mail333.com",
"mailbidon.com",
"mailblocks.com",
"mailbucket.org",
"mailcatch.com",
"maildrop.cc",
"maildx.com",
"mailed.ro",
"mailfreeonline.com",
"mailfs.com",
"mailin8r.com",
"mailinater.com",
"mailinator.com",
"mailinator.net",
"mailinator2.com",
"mailincubator.com",
"mailme.ir",
"mailme.lv",
"mailmetal.com",
"mailmetrash.com",
"mailmoat.com",
"mailnesia.com",
"mailnull.com",
"mailscrap.com",
"mailshell.com",
"mailsiphon.com",
"mailsoul.com",
"mailtrash.net",
"mailzilla.com",
"makemetheking.com",
"mbx.cc",
"mega.zik.dj",
"meinspamschutz.de",
"meltmail.com",
"messagebeamer.de",
"mineblue.ru",
"mintemail.com",
"misha-rosestoy.ru",
"moboinfo.xyz",
"moncourrier.fr.nf",
"monemail.fr.nf",
"monmail.fr.nf",
"mor19.uu.gl",
"mt2009.com",
"mvrht.com",
"mycleaninbox.net",
"mymail-in.net",
"mypartyclip.de",
"myphantomemail.com",
"mytempemail.com",
"mytrashmail.com",
"neomailbox.com",
"nepwk.com",
"nervmich.net",
"nervtmich.net",
"netmails.com",
"netmails.net",
"neverbox.com",
"newfilm24.ru",
"niepodam.pl",
"no-spam.ws",
"nomail.xl.cx",
"nomorespamemails.com",
"nospam.ze.tc",
"nospam4.us",
"nospammail.net",
"notmailinator.com",
"notsharingmy.info",
"nowmymail.com",
"nurfuerspam.de",
"objectmail.com",
"obobbo.com",
"officialrolex.ru",
"oneoffemail.com",
"onewaymail.com",
"onlinenet.info",
"oopi.org",
"ordinaryamerican.net",
"otherinbox.com",
"ovpn.to",
"owlpic.com",
"p33.org",
"pancakemail.com",
"partner1bizmoney.ru",
"pchelovodstvo-tut.ru",
"piratesdelivery.ru",
"pmlep.de",
"politikerclub.de",
"pookmail.com",
"powerbank-russia.ru",
"privacy.net",
"proxymail.eu",
"prtnx.com",
"putthisinyourspamdatabase.com",
"quickinbox.com",
"razinrocks.me",
"rcpt.at",
"reallymymail.com",
"recode.me",
"reconmail.com",
"recursor.net",
"reloadpoint.ru",
"rtrtr.com",
"s-sakamas.ru",
"s0ny.net",
"safe-mail.net",
"safersignup.de",
"safetymail.info",
"safetypost.de",
"samogonda.ru",
"sendspamhere.com",
"senseless-entertainment.com",
"sgbteamreborn.imouto.pro",
"shar-kov.ru",
"sharklasers.com",
"shiftmail.com",
"shitmail.me",
"shortmail.net",
"sibmail.com",
"slaskpost.se",
"smellfear.com",
"sneakemail.com",
"sofimail.com",
"sogetthis.com",
"soodonims.com",
"spam4.me",
"spambob.net",
"spambog.com",
"spambog.de",
"spambog.ru",
"spambooger.com",
"spambox.us",
"spambox.win",
"spambox.xyz",
"spamcannon.com",
"spamcannon.net",
"spamcon.org",
"spamcorptastic.com",
"spamcowboy.com",
"spamcowboy.net",
"spamcowboy.org",
"spamday.com",
"spamex.com",
"spamfree.eu",
"spamfree24.com",
"spamfree24.de",
"spamfree24.org",
"spamgourmet.com",
"spamgourmet.net",
"spamgourmet.org",
"spamhereplease.com",
"spamhole.com",
"spamify.com",
"spaml.de",
"spammotel.com",
"spamobox.com",
"spamslicer.com",
"spamthis.co.uk",
"speed.1s.fr",
"squizzy.net",
"sskstroy.ru",
"streetwisemail.com",
"super-auswahl.de",
"supermailer.jp",
"suremail.info",
"tecninja.xyz",
"teewars.org",
"teleosaurs.xyz",
"teleworm.com",
"temp-mail.org",
"tempe-mail.com",
"tempemail.com",
"tempemail.net",
"tempinbox.co.uk",
"tempinbox.com",
"tempmail.it",
"tempmail.top",
"tempmail.win",
"tempomail.fr",
"thankyou2010.com",
"thisisnotmyrealemail.com",
"thrott.com",
"throwawayemailaddress.com",
"tilien.com",
"titaspaharpur1.gq",
"tmailinator.com",
"tradermail.info",
"trash-mail.at",
"trash-mail.com",
"trash-mail.de",
"trash2009.com",
"trashdevil.com",
"trashemail.de",
"trashinbox.net",
"trashmail.at",
"trashmail.com",
"trashmail.de",
"trashmail.me",
"trashmail.net",
"trashmail.org",
"trashmail.ws",
"trashmailer.com",
"trashymail.com",
"trbvm.com",
"trbvn.com",
"trillianpro.com",
"tvchd.com",
"twinmail.de",
"tyldd.com",
"uggsrock.com",
"upliftnow.com",
"urhen.com",
"ussv.club",
"vapecentral.ru",
"venompen.com",
"veryrealemail.com",
"vkusup.ru",
"voemail.com",
"vssms.com",
"weammo.xyz",
"webcool.club",
"wegwerfadresse.de",
"wegwerfemail.com",
"wegwerfemail.de",
"wegwerfmail.de",
"wegwerfmail.net",
"wegwerfmail.org",
"wh4f.org",
"whyspam.me",
"willhackforfood.biz",
"willselfdestruct.com",
"wronghead.com",
"wwwnew.eu",
"xemaps.com",
"xitroo.com",
"xmaily.com",
"xoxy.net",
"xww.ro",
"yep.it",
"yevme.com",
"yopmail.com",
"yopmail.fr",
"yopmail.net",
"yuurok.com",
"zagorodnyi-domik.ru",
"zdorovpagh.ru",
"zehnminutenmail.de",
"zippymail.info",
"zoemail.net"}

spam-free = {"0-mail.com",
"027168.com",
"0815.su",
"0sg.net",
"10mail.org",
"10minutemail.co.za",
"123.com",
"123india.com",
"123mail.cl",
"123mail.org",
"126.com",
"139.com",
"150mail.com",
"150ml.com",
"15meg4free.com",
"163.com",
"16mail.com",
"188.com",
"189.cn",
"1ce.us",
"1chuan.com",
"1funplace.com",
"1internetdrive.com",
"1mail.net",
"1me.net",
"1mum.com",
"1musicrow.com",
"1pad.de",
"1zhuan.com",
"2-mail.com",
"20email.eu",
"20mail.in",
"20mail.it",
"212.com",
"21cn.com",
"24horas.com",
"2980.com",
"2bmail.co.uk",
"2die4.com",
"2trom.com",
"3126.com",
"321media.com",
"37.com",
"3ammagazine.com",
"3dmail.com",
"3g.ua",
"3mail.ga",
"444.net",
"4email.net",
"4mg.com",
"4warding.net",
"4x4man.com",
"50mail.com",
"5iron.com",
"60minutemail.com",
"6ip.us",
"74.ru",
"7mail.ml",
"88.am",
"8mail.ml",
"97rock.com",
"99experts.com",
"9online.fr",
"a1.net",
"a45.in",
"aaamail.zzn.com",
"aapt.net.au",
"aaronkwok.net",
"abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijk.com",
"abcflash.net",
"abdulnour.com",
"aberystwyth.com",
"about.com",
"abv.bg",
"abwesend.de",
"abyssmail.com",
"acceso.or.cr",
"access4less.net",
"accountant.com",
"acdcfan.com",
"acmemail.net",
"acninc.net",
"activist.com",
"adam.com.au",
"add3000.pp.ua",
"addcom.de",
"address.com",
"adelphia.net",
"adexec.com",
"adfarrow.com",
"adoption.com",
"ados.fr",
"adrenalinefreak.com",
"advalvas.be",
"advantimo.com",
"aeiou.pt",
"africamail.com",
"africamel.net",
"agoodmail.com",
"ahaa.dk",
"ahk.jp",
"aichi.com",
"aim.com",
"aircraftmail.com",
"airforce.net",
"airforceemail.com",
"airpost.net",
"ajacied.com",
"ak47.hu",
"aknet.kg",
"albawaba.com",
"algeria.com",
"alhilal.net",
"alibaba.com",
"alice.it",
"aliyun.com",
"allergist.com",
"allmail.net",
"allracing.com",
"allsaintsfan.com",
"alpenjodel.de",
"alphafrau.de",
"alskens.dk",
"alternativagratis.com",
"alumni.com",
"alumnidirector.com",
"alvilag.hu",
"amail.com",
"amele.com",
"america.hm",
"ameritech.net",
"amnetsal.com",
"amorki.pl",
"amrer.net",
"amuro.net",
"amuromail.com",
"ananzi.co.za",
"ancestry.com",
"andylau.net",
"angelfire.com",
"angelic.com",
"animail.net",
"animalhouse.com",
"anjungcafe.com",
"annsmail.com",
"ano-mail.net",
"anonymous.to",
"anote.com",
"another.com",
"anotherdomaincyka.tk",
"anotherwin95.com",
"anti-social.com",
"antisocial.com",
"antispam24.de",
"anymoment.com",
"anytimenow.com",
"aol.co.uk",
"aol.com",
"aol.fr",
"aon.at",
"apexmail.com",
"apmail.com",
"apollo.lv",
"aport.ru",
"aport2000.ru",
"appraiser.net",
"arabia.com",
"arabtop.net",
"archaeologist.com",
"arcor.de",
"arcticmail.com",
"argentina.com",
"army.net",
"armyspy.com",
"arnet.com.ar",
"artlover.com",
"artlover.com.au",
"asdasd.nl",
"asean-mail.com",
"asheville.com",
"asia-links.com",
"asia-mail.com",
"asia.com",
"asiafind.com",
"asianavenue.com",
"asiancityweb.com",
"asiansonly.net",
"asianwired.net",
"asiapoint.net",
"ass.pp.ua",
"assala.com",
"assamesemail.com",
"astrolover.com",
"astrosfan.net",
"asurfer.com",
"atheist.com",
"athenachu.net",
"atina.cl",
"atozasia.com",
"atrus.ru",
"att.net",
"attglobal.net",
"attymail.com",
"au.ru",
"auctioneer.net",
"ausi.com",
"aussiemail.com.au",
"austin.rr.com",
"australia.edu",
"australiamail.com",
"autoescuelanerja.com",
"autograf.pl",
"autorambler.ru",
"aver.com",
"avh.hu",
"awsom.net",
"axoskate.com",
"azazazatashkent.tk",
"azmeil.tk",
"bachelorboy.com",
"bachelorgal.com",
"backpackers.com",
"backstreet-boys.com",
"bagherpour.com",
"baldmama.de",
"baldpapa.de",
"ballyfinance.com",
"bangkok.com",
"bangkok2000.com",
"bannertown.net",
"baptistmail.com",
"baptized.com",
"barcelona.com",
"bareed.ws",
"bartender.net",
"baseballmail.com",
"basketballmail.com",
"batuta.net",
"bboy.zzn.com",
"bcvibes.com",
"beddly.com",
"beeebank.com",
"beenhad.com",
"beep.ru",
"beer.com",
"beethoven.com",
"belice.com",
"bell.net",
"bellair.net",
"bellsouth.net",
"berlin.com",
"berlin.de",
"bestmail.us",
"betriebsdirektor.de",
"bettergolf.net",
"bharatmail.com",
"bigassweb.com",
"bigblue.net.au",
"bigfoot.com",
"bigfoot.de",
"bigger.com",
"biggerbadder.com",
"bigmailbox.com",
"bigmir.net",
"bigpond.com",
"bigpond.com.au",
"bigpond.net.au",
"bigstring.com",
"bikemechanics.com",
"bikeracer.com",
"bikerider.com",
"billsfan.com",
"billsfan.net",
"bin-wieder-da.de",
"birdlover.com",
"bisons.com",
"bitmail.com",
"bitpage.net",
"bizhosting.com",
"bk.ru",
"blackplanet.com",
"blader.com",
"bladesmail.net",
"blazemail.com",
"bleib-bei-mir.de",
"blockfilter.com",
"blogmyway.org",
"bluebottle.com",
"bluemail.ch",
"bluemail.dk",
"blushmail.com",
"boardermail.com",
"bodhi.lawlita.com",
"bol.com.br",
"bolando.com",
"bolt.com",
"boltonfans.com",
"bombdiggity.com",
"bootybay.de",
"boun.cr",
"bounce.net",
"bouncr.com",
"box.az",
"box.ua",
"boxemail.com",
"boxformail.in",
"boxfrog.com",
"boximail.com",
"bradfordfans.com",
"brasilia.net",
"brazilmail.com",
"breathe.com",
"brennendesreich.de",
"bresnan.net",
"brew-master.com",
"brew-meister.com",
"briefemail.com",
"bright.net",
"britneyclub.com",
"broadcast.net",
"brokenvalve.com",
"brusseler.com",
"bsdmail.com",
"btcmail.pw",
"btinternet.com",
"buerotiger.de",
"bullsfan.com",
"bumpymail.com",
"bund.us",
"burnthespam.info",
"burstmail.info",
"businessman.net",
"buyersusa.com",
"bvimailbox.com",
"byom.de",
"c2.hu",
"c3.hu",
"c4.com",
"cabacabana.com",
"cableone.net",
"caere.it",
"calidifontain.be",
"californiamail.com",
"callnetuk.com",
"callsign.net",
"caltanet.it",
"camidge.com",
"canada-11.com",
"canadianmail.com",
"canoemail.com",
"caramail.com",
"caramail.fr",
"care2.com",
"careerbuildermail.com",
"carioca.net",
"cartestraina.ro",
"casablancaresort.com",
"casema.nl",
"cash4u.com",
"casino.com",
"catchamail.com",
"catholic.org",
"catlover.com",
"cd2.com",
"cegetel.net",
"celineclub.com",
"celtic.com",
"center-mail.de",
"centermail.at",
"centermail.de",
"centermail.info",
"centoper.it",
"centralpets.com",
"centrum.cz",
"centrum.sk",
"centurytel.net",
"certifiedmail.com",
"cfl.rr.com",
"cgac.es",
"chacuo.net",
"chaiyomail.com",
"chammy.info",
"chandrasekar.net",
"charmedmail.com",
"charter.com",
"charter.net",
"chat.ru",
"chattown.com",
"cheatmail.de",
"chechnya.conf.work",
"check.com",
"check1check.com",
"cheerful.com",
"chef.net",
"chek.com",
"chello.nl",
"chemist.com",
"cheyenneweb.com",
"chez.com",
"china.com",
"chinamail.com",
"chirk.com",
"chocaholic.com.au",
"chong-mail.net",
"churchusa.com",
"cia-agent.com",
"cia.hu",
"cicciociccio.com",
"cincinow.net",
"citiz.net",
"citlink.net",
"city-of-birmingham.com",
"city-of-cambridge.com",
"city-of-edinburgh.com",
"city-of-lincoln.com",
"city-of-liverpool.com",
"city-of-manchester.com",
"city-of-oxford.com",
"city-of-swansea.com",
"city-of-westminster.com",
"city-of-westminster.net",
"city-of-york.net",
"cityoflondon.org",
"ckaazaza.tk",
"claramail.com",
"classicalfan.com",
"classicmail.co.za",
"clerk.com",
"cliffhanger.com",
"clixser.com",
"close2you.net",
"clrmail.com",
"club4x4.net",
"clubalfa.com",
"clubbers.net",
"clubducati.com",
"clubhonda.net",
"club-internet.fr",
"clubinternet.fr",
"clubmember.org",
"clubnetnoir.com",
"clubvdo.net",
"cluemail.com",
"cmail.net",
"cmpmail.com",
"cnnsimail.com",
"cntv.cn",
"codec.ro",
"coder.hu",
"coid.biz",
"coldmail.com",
"collectiblesuperstore.com",
"collector.org",
"collegeclub.com",
"collegemail.com",
"colleges.com",
"columbus.rr.com",
"columbusrr.com",
"columnist.com",
"comcast.net",
"comic.com",
"communityconnect.com",
"comprendemail.com",
"compuserve.com",
"computer4u.com",
"computermail.net",
"conexcol.com",
"conk.com",
"connect4free.net",
"consultant.com",
"consumerriot.com",
"contractor.net",
"coole-files.de",
"coolgoose.ca",
"coolgoose.com",
"coolkiwi.com",
"coolmail.com",
"coolmail.net",
"coolsite.net",
"cooperation.net",
"cooperationtogo.net",
"copacabana.com",
"cornells.com",
"corporatedirtbag.com",
"cotas.net",
"counsellor.com",
"cox.com",
"cox.net",
"coxinet.net",
"cracker.hu",
"crapmail.org",
"crazedanddazed.com",
"crazymailing.com",
"cristianemail.com",
"critterpost.com",
"croeso.com",
"crosshairs.com",
"crosswinds.net",
"crwmail.com",
"cs.com",
"csinibaba.hu",
"cuemail.com",
"curio-city.com",
"curryworld.de",
"cute-girl.com",
"cutey.com",
"cyber-africa.net",
"cyber-innovation.club",
"cyber-matrix.com",
"cyber-wizard.com",
"cyber4all.com",
"cyberbabies.com",
"cybercafemaui.com",
"cyberdude.com",
"cybergal.com",
"cybergrrl.com",
"cybermail.net",
"cybernet.it",
"cyberservices.com",
"cyberspace-asia.com",
"cybertrains.org",
"cyclefanz.com",
"cynetcity.com",
"dabsol.net",
"dadacasa.com",
"dailypioneer.com",
"dallasmail.com",
"dangerous-minds.com",
"dasdasdascyka.tk",
"dawnsonmail.com",
"dawsonmail.com",
"dbzmail.com",
"deadlymob.org",
"deagot.com",
"deal-maker.com",
"dearriba.com",
"death-star.com",
"deliveryman.com",
"deneg.net",
"depechemode.com",
"deseretmail.com",
"desilota.com",
"deskpilot.com",
"destin.com",
"detik.com",
"deutschland-net.com",
"devotedcouples.com",
"dezigner.ru",
"dfwatson.com",
"di-ve.com",
"die-besten-bilder.de",
"die-genossen.de",
"die-optimisten.net",
"diemailbox.de",
"digibel.be",
"digital-filestore.de",
"diplomats.com",
"directbox.com",
"dirtracer.com",
"discard.email",
"discard.ga",
"discard.gq",
"disciples.com",
"discofan.com",
"discovery.com",
"discoverymail.com",
"disign-revelation.com",
"dispomail.eu",
"disposable.com",
"dispose.it",
"dm.w3internet.co.uk",
"dnsmadeeasy.com",
"docmail.cz",
"doctor.com",
"dodo.com.au",
"dodsi.com",
"dog.com",
"dogit.com",
"doglover.com",
"dogsnob.net",
"doityourself.com",
"domforfb1.tk",
"domforfb2.tk",
"domforfb3.tk",
"domforfb4.tk",
"domforfb5.tk",
"domforfb6.tk",
"domforfb8.tk",
"domozmail.com",
"doneasy.com",
"dontgotmail.com",
"dontmesswithtexas.com",
"doramail.com",
"dostmail.com",
"dotcom.fr",
"dotmsg.com",
"dott.it",
"download-privat.de",
"dplanet.ch",
"dr.com",
"dropmail.me",
"dropzone.com",
"drotposta.hu",
"dublin.com",
"dublin.ie",
"dumpmail.com",
"dumpmail.de",
"dumpyemail.com",
"dunlopdriver.com",
"dunloprider.com",
"duno.com",
"duskmail.com",
"dutchmail.com",
"dwp.net",
"dygo.com",
"dyndns.org",
"e-apollo.lv",
"e-mail.com.tr",
"e-mail.dk",
"e-mail.ru",
"e-mail.ua",
"e-mailanywhere.com",
"e-tapaal.com",
"earthalliance.com",
"earthcam.net",
"earthdome.com",
"earthling.net",
"earthlink.net",
"earthonline.net",
"eastcoast.co.za",
"eastmail.com",
"easy.to",
"easypost.com",
"easytrashmail.com",
"ecardmail.com",
"echina.com",
"ecompare.com",
"edmail.com",
"edtnmail.com",
"educacao.te.pt",
"eelmail.com",
"ehmail.com",
"einrot.com",
"eintagsmail.de",
"eircom.net",
"elitemail.org",
"elvis.com",
"elvisfan.com",
"email-fake.gq",
"email-london.co.uk",
"email.biz",
"email.com",
"email.cz",
"email.ee",
"email.it",
"email.nu",
"email.org",
"email.ro",
"email.ru",
"email.su",
"email.ua",
"email2me.net",
"emailacc.com",
"emailaccount.com",
"emailasso.net",
"emailchoice.com",
"emailcorner.net",
"emailem.com",
"emailengine.net",
"emailengine.org",
"emailgo.de",
"emailgroups.net",
"emailinfive.com",
"emailit.com",
"emailplanet.com",
"emailplus.org",
"emailto.de",
"emailuser.net",
"emailx.net",
"embarqmail.com",
"emeil.in",
"emeil.ir",
"emil.com",
"eml.cc",
"eml.pp.ua",
"enel.net",
"engineer.com",
"england.com",
"england.edu",
"englandmail.com",
"epage.ru",
"ephemail.net",
"epix.net",
"eposta.hu",
"eramail.co.za",
"eresmas.com",
"eriga.lv",
"estranet.it",
"ethos.st",
"eudoramail.com",
"europamel.net",
"europe.com",
"europemail.com",
"euroseek.com",
"eurosport.com",
"every1.net",
"everyday.com.kh",
"everymail.net",
"everyone.net",
"everytg.ml",
"examnotes.net",
"excite.co.jp",
"excite.com",
"excite.it",
"execs.com",
"exemail.com.au",
"expressasia.com",
"extenda.net",
"eyepaste.com",
"ezcybersearch.com",
"ezrs.com",
"f-m.fm",
"f1fans.net",
"facebook.com",
"fahr-zur-hoelle.org",
"fake-email.pp.ua",
"fake-mail.cf",
"falseaddress.com",
"fan.com",
"fansonlymail.com",
"fantasticmail.com",
"farang.net",
"faroweb.com",
"fast-email.com",
"fast-mail.fr",
"fast-mail.org",
"fastchevy.com",
"fastem.com",
"fastemail.us",
"fastemailer.com",
"fastermail.com",
"fastest.cc",
"fastimap.com",
"fastmail.ca",
"fastmail.cn",
"fastmail.co.uk",
"fastmail.com",
"fastmail.com.au",
"fastmail.es",
"fastmail.fm",
"fastmail.im",
"fastmail.in",
"fastmail.jp",
"fastmail.mx",
"fastmail.net",
"fastmail.nl",
"fastmail.se",
"fastmail.to",
"fastmail.tw",
"fastmail.us",
"fastmailbox.net",
"fastmazda.com",
"fastmessaging.com",
"fastservice.com",
"fastsubaru.com",
"fatflap.com",
"fathersrightsne.org",
"fax.ru",
"fbi.hu",
"fea.st",
"federalcontractors.com",
"feinripptraeger.de",
"felicitymail.com",
"femenino.com",
"fetchmail.co.uk",
"fettabernett.de",
"feyenoorder.com",
"ffanet.com",
"fiberia.com",
"ficken.de",
"fightallspam.com",
"filipinolinks.com",
"financemail.net",
"financier.com",
"findmail.com",
"fire-brigade.com",
"fireman.net",
"fishburne.org",
"fishfuse.com",
"fixmail.tk",
"fizmail.com",
"flashbox.5july.org",
"flashmail.com",
"flashmail.net",
"fleckens.hu",
"flipcode.com",
"fmail.co.uk",
"fmailbox.com",
"fmgirl.com",
"fmguy.com",
"fnbmail.co.za",
"fnmail.com",
"folkfan.com",
"foodmail.com",
"footard.com",
"football.ua",
"footballmail.com",
"for-president.com",
"force9.co.uk",
"forgetmail.com",
"forpresident.com",
"fortuncity.com",
"fortunecity.com",
"forum.dk",
"foxmail.com",
"fr33mail.info",
"francemel.fr",
"free-online.net",
"free-org.com",
"free.com.pe",
"free.fr",
"freeaccess.nl",
"freeaccount.com",
"freeandsingle.com",
"freedom.usa.com",
"freedomlover.com",
"freegates.be",
"freelance-france.eu",
"freeler.nl",
"freemail.c3.hu",
"freemail.com.pk",
"freemail.de",
"freemail.et",
"freemail.gr",
"freemail.hu",
"freemail.it",
"freemail.lt",
"freemail.org.mk",
"freemails.ga",
"freemeil.gq",
"freenet.de",
"freenet.kg",
"freeola.com",
"freeola.net",
"freestart.hu",
"freesurf.fr",
"freesurf.nl",
"freeuk.com",
"freeuk.net",
"freeukisp.co.uk",
"freeweb.org",
"freewebemail.com",
"freeyellow.com",
"freezone.co.uk",
"fresnomail.com",
"freudenkinder.de",
"freundin.ru",
"friendlymail.co.uk",
"friendsfan.com",
"from-africa.com",
"from-australia.com",
"from-europe.com",
"from-holland.com",
"from-japan.net",
"from-mexico.com",
"from-outerspace.com",
"from-russia.com",
"fromalaska.com",
"fromarizona.com",
"fromarkansas.com",
"fromcalifornia.com",
"fromconnecticut.com",
"fromgeorgia.com",
"fromhawaii.net",
"fromidaho.com",
"fromindiana.com",
"fromiowa.com",
"fromkansas.com",
"fromlouisiana.com",
"frommaryland.com",
"frommassachusetts.com",
"frommiami.com",
"frommichigan.com",
"fromminnesota.com",
"frommississippi.com",
"frommissouri.com",
"fromnevada.com",
"fromnewhampshire.com",
"fromnewjersey.com",
"fromnewmexico.com",
"fromnorthcarolina.com",
"fromnorthdakota.com",
"fromohio.com",
"fromoklahoma.com",
"frompennsylvania.com",
"fromrhodeisland.com",
"fromru.com",
"fromsouthcarolina.com",
"fromtennessee.com",
"fromtexas.com",
"fromutah.com",
"fromvermont.com",
"fromvirginia.com",
"fromwashington.com",
"fromwashingtondc.com",
"fromwestvirginia.com",
"fromwisconsin.com",
"fromwyoming.com",
"front.ru",
"frontier.com",
"frontiernet.net",
"fsmail.net",
"ftml.net",
"fullmail.com",
"fuorissimo.com",
"furnitureprovider.com",
"fuse.net",
"fut.es",
"galaxyhit.com",
"gamebox.net",
"gamegeek.com",
"gamespotmail.com",
"garbage.com",
"gardener.com",
"gaybrighton.co.uk",
"gaza.net",
"gazeta.pl",
"gazibooks.com",
"gci.net",
"geek.com",
"geeklife.com",
"gelitik.in",
"gencmail.com",
"gentlemansclub.de",
"geocities.com",
"geography.net",
"geologist.com",
"geopia.com",
"germanymail.com",
"get.pp.ua",
"get1mail.com",
"getairmail.com",
"getairmail.gq",
"getonemail.net",
"ghanamail.com",
"ghostmail.com",
"ghosttexter.de",
"gigileung.org",
"girl4god.com",
"glay.org",
"glendale.net",
"globalfree.it",
"globalpagan.com",
"gmail.com",
"gmail.com.br",
"gmx.at",
"gmx.biz",
"gmx.ch",
"gmx.co.uk",
"gmx.com",
"gmx.de",
"gmx.eu",
"gmx.fr",
"gmx.info",
"gmx.li",
"gmx.net",
"gmx.org",
"gmx.us",
"go.com",
"go.ro",
"go.ru",
"gocollege.com",
"gocubs.com",
"goldmail.ru",
"goldtoolbox.com",
"golfemail.com",
"golfilla.info",
"golfmail.be",
"gonavy.net",
"goodnewsmail.com",
"goodstick.com",
"googlemail.com",
"goplay.com",
"gorillaswithdirtyarmpits.com",
"gospelfan.com",
"gotmail.com",
"gotmail.org",
"gotomy.com",
"gotti.otherinbox.com",
"gportal.hu",
"graduate.org",
"graffiti.net",
"gramszu.net",
"grandmamail.com",
"graphic-designer.com",
"grapplers.com",
"greenmail.net",
"groupmail.com",
"grr.la",
"gtmc.net",
"gua.net",
"guessmail.com",
"guju.net",
"gustr.com",
"guy.com",
"guy2.com",
"guyanafriends.com",
"h-mail.us",
"hab-verschlafen.de",
"habmalnefrage.de",
"hacccc.com",
"hackermail.com",
"hackermail.net",
"hailmail.net",
"hairdresser.net",
"hamptonroads.com",
"handbag.com",
"handleit.com",
"hanmail.net",
"happemail.com",
"happycounsel.com",
"happypuppy.com",
"harakirimail.com",
"hardcorefreak.com",
"hartbot.de",
"hawaii.rr.com",
"hawaiiantel.net",
"heerschap.com",
"heesun.net",
"hello.hu",
"hello.net.au",
"hello.to",
"helter-skelter.com",
"herediano.com",
"herp.in",
"herr-der-mails.de",
"hetnet.nl",
"hey.to",
"hidzz.com",
"highquality.com",
"highveldmail.co.za",
"hilarious.com",
"hiphopfan.com",
"hispavista.com",
"hitmail.com",
"hitthe.net",
"hkg.net",
"hockeymail.com",
"hollywoodkids.com",
"home-email.com",
"home.de",
"home.nl",
"home.ro",
"home.se",
"homemail.com",
"homestead.com",
"honduras.com",
"hongkong.com",
"hoopsmail.com",
"hopemail.biz",
"hot-shot.com",
"hot.ee",
"hotbrev.com",
"hotletter.com",
"hotmail.ca",
"hotmail.ch",
"hotmail.co.il",
"hotmail.co.uk",
"hotmail.com",
"hotmail.de",
"hotmail.es",
"hotmail.fr",
"hotmail.it",
"hotmail.kz",
"hotmail.nl",
"hotmail.ru",
"hotpop3.com",
"hotvoice.com",
"housemail.com",
"hsuchi.net",
"hu2.ru",
"hughes.net",
"humanoid.net",
"hunsa.com",
"hurting.com",
"hush.com",
"hushmail.com",
"hypernautica.com",
"i-connect.com",
"i-mail.com.au",
"i-p.com",
"i.am",
"i.ua",
"i2pmail.org",
"iamawoman.com",
"icestorm.com",
"ich-bin-verrueckt-nach-dir.de",
"ich-will-net.de",
"icloud.com",
"icmsconsultants.com",
"icq.com",
"icqmail.com",
"icrazy.com",
"idirect.com",
"ieh-mail.de",
"iespana.es",
"ig.com.br",
"ihateclowns.com",
"iinet.net.au",
"ijustdontcare.com",
"ikbenspamvrij.nl",
"ilkposta.com",
"ilovechocolate.com",
"ilovejesus.com",
"ilse.nl",
"imaginemail.com",
"imail.org",
"imail.ru",
"imap-mail.com",
"imap.cc",
"imapmail.org",
"imel.org",
"imgof.com",
"imgv.de",
"immo-gerance.info",
"imposter.co.uk",
"imstations.com",
"imstressed.com",
"in-box.net",
"iname.com",
"inbax.tk",
"inbox.com",
"inbox.net",
"inbox.ru",
"inbox.si",
"inboxalias.com",
"incamail.com",
"incredimail.com",
"index.ua",
"indexa.fr",
"india.com",
"indiatimes.com",
"indo-mail.com",
"indomail.com",
"indyracers.com",
"inerted.com",
"info-media.de",
"info-radio.ml",
"info66.com",
"infohq.com",
"infomail.es",
"infomart.or.jp",
"infospacemail.com",
"infovia.com.ar",
"inicia.es",
"inmail.sk",
"inmail24.com",
"inmano.com",
"inmynetwork.tk",
"innocent.com",
"inorbit.com",
"inoutbox.com",
"insidebaltimore.net",
"insight.rr.com",
"instantemailaddress.com",
"instantmail.fr",
"instruction.com",
"instructor.net",
"insurer.com",
"interburp.com",
"interfree.it",
"interia.pl",
"interlap.com.ar",
"intermail.co.il",
"internet-e-mail.com",
"internet-mail.org",
"internet-police.com",
"internetegypt.com",
"internetemails.net",
"internetmailing.net",
"internode.on.net",
"inwind.it",
"iobox.com",
"iobox.fi",
"iol.it",
"iowaemail.com",
"ip4.pp.ua",
"ip6.pp.ua",
"ipoo.org",
"iprimus.com.au",
"iqemail.com",
"irangate.net",
"ireland.com",
"irelandmail.com",
"irj.hu",
"iroid.com",
"isellcars.com",
"iservejesus.com",
"islamonline.net",
"isleuthmail.com",
"ismart.net",
"isp9.net",
"israelmail.com",
"ist-allein.info",
"ist-einmalig.de",
"ist-ganz-allein.de",
"ist-willig.de",
"italymail.com",
"itmom.com",
"ivebeenframed.com",
"iwmail.com",
"iwon.com",
"izadpanah.com",
"jahoopa.com",
"jakuza.hu",
"jazzandjava.com",
"jazzfan.com",
"je-recycle.info",
"jerusalemmail.com",
"jetable.de",
"jetable.pp.ua",
"jetemail.net",
"jippii.fi",
"jmail.co.za",
"job4u.com",
"jokes.com",
"journalist.com",
"jourrapide.com",
"jovem.te.pt",
"jpopmail.com",
"jsrsolutions.com",
"jubiimail.dk",
"juniormail.com",
"junkmail.com",
"juno.com",
"justemail.net",
"justicemail.com",
"kaazoo.com",
"kaffeeschluerfer.com",
"kaffeeschluerfer.de",
"kaixo.com",
"kalpoint.com",
"kansascity.com",
"karbasi.com",
"katamail.com",
"kayafmmail.co.za",
"kbjrmail.com",
"kcks.com",
"keg-party.com",
"keinpardon.de",
"keko.com.ar",
"kellychen.com",
"keromail.com",
"keyemail.com",
"kgb.hu",
"kickassmail.com",
"killermail.com",
"kimo.com",
"kinglibrary.net",
"kinki-kids.com",
"kissfans.com",
"kittymail.com",
"kitznet.at",
"kiwitown.com",
"km.ru",
"knol-power.nl",
"kommespaeter.de",
"konx.com",
"korea.com",
"koreamail.com",
"kpnmail.nl",
"krongthip.com",
"krunis.com",
"ksanmail.com",
"ksee24mail.com",
"kukamail.com",
"kulturbetrieb.info",
"kumarweb.com",
"la.com",
"ladymail.cz",
"lagerlouts.com",
"lags.us",
"lakmail.com",
"lamer.hu",
"land.ru",
"lankamail.com",
"laoeq.com",
"laposte.net",
"lass-es-geschehen.de",
"lastmail.co",
"latemodels.com",
"lavache.com",
"law.com",
"lawyer.com",
"lazyinbox.com",
"leehom.net",
"legalrc.loan",
"legislator.com",
"lenta.ru",
"leonlai.net",
"letsgomets.net",
"letterboxes.org",
"letthemeatspam.com",
"levele.hu",
"lex.bg",
"lexis-nexis-mail.com",
"libero.it",
"liberomail.com",
"lick101.com",
"liebt-dich.info",
"linktrader.com",
"linuxfreemail.com",
"linuxmail.org",
"liontrucks.com",
"liquidinformation.net",
"list.ru",
"listomail.com",
"littleapple.com",
"littleblueroom.com",
"live.at",
"live.ca",
"live.cl",
"live.cn",
"live.co.uk",
"live.co.za",
"live.com",
"live.com.ar",
"live.com.au",
"live.com.mx",
"live.com.pt",
"live.com.sg",
"live.de",
"live.dk",
"live.fr",
"live.ie",
"live.in",
"live.it",
"live.jp",
"live.nl",
"live.ru",
"live.se",
"liveradio.tk",
"liverpoolfans.com",
"llandudno.com",
"llangollen.com",
"lobbyist.com",
"localbar.com",
"locos.com",
"loh.pp.ua",
"lolfreak.net",
"london.com",
"looksmart.co.uk",
"looksmart.com",
"lopezclub.com",
"louiskoo.com",
"loveable.com",
"lovecat.com",
"lovefall.ml",
"lovefootball.com",
"lovemail.com",
"lover-boy.com",
"lovesea.gq",
"lovethebroncos.com",
"loveyouforever.de",
"lovingjesus.com",
"lowandslow.com",
"lroid.com",
"luukku.com",
"lycos.co.uk",
"lycos.com",
"lycos.es",
"lycos.ne.jp",
"m-hmail.com",
"m4.org",
"mac.com",
"macbox.com",
"macfreak.com",
"macmail.com",
"madonnafan.com",
"maennerversteherin.com",
"maennerversteherin.de",
"maffia.hu",
"magicmail.co.za",
"mail-awu.de",
"mail-box.cz",
"mail-center.com",
"mail-central.com",
"mail-easy.fr",
"mail-filter.com",
"mail-me.com",
"mail-page.com",
"mail-tester.com",
"mail.az",
"mail.be",
"mail.bulgaria.com",
"mail.by",
"mail.co.za",
"mail.com",
"mail.com.tr",
"mail.ee",
"mail.gr",
"mail.hitthebeach.com",
"mail.htl22.at",
"mail.md",
"mail.misterpinball.de",
"mail.nu",
"mail.org.uk",
"mail.pf",
"mail.pt",
"mail.ru",
"mail.sisna.com",
"mail.svenz.eu",
"mail.usa.com",
"mail.wtf",
"mail114.net",
"mail15.com",
"mail2007.com",
"mail2aaron.com",
"mail2abby.com",
"mail2abc.com",
"mail2actor.com",
"mail2admiral.com",
"mail2adorable.com",
"mail2adoration.com",
"mail2adore.com",
"mail2adventure.com",
"mail2aeolus.com",
"mail2aether.com",
"mail2affection.com",
"mail2afghanistan.com",
"mail2africa.com",
"mail2agent.com",
"mail2aha.com",
"mail2ahoy.com",
"mail2aim.com",
"mail2air.com",
"mail2airbag.com",
"mail2airforce.com",
"mail2airport.com",
"mail2alabama.com",
"mail2alan.com",
"mail2alaska.com",
"mail2albania.com",
"mail2alcoholic.com",
"mail2alec.com",
"mail2alexa.com",
"mail2algeria.com",
"mail2alicia.com",
"mail2alien.com",
"mail2allan.com",
"mail2allen.com",
"mail2allison.com",
"mail2alpha.com",
"mail2alyssa.com",
"mail2amanda.com",
"mail2amazing.com",
"mail2amber.com",
"mail2america.com",
"mail2american.com",
"mail2andorra.com",
"mail2andrea.com",
"mail2andy.com",
"mail2anesthesiologist.com",
"mail2angela.com",
"mail2angola.com",
"mail2ann.com",
"mail2anna.com",
"mail2anne.com",
"mail2anthony.com",
"mail2aphrodite.com",
"mail2apollo.com",
"mail2april.com",
"mail2aquarius.com",
"mail2arabia.com",
"mail2arabic.com",
"mail2architect.com",
"mail2ares.com",
"mail2argentina.com",
"mail2aries.com",
"mail2arizona.com",
"mail2arkansas.com",
"mail2armenia.com",
"mail2army.com",
"mail2arnold.com",
"mail2art.com",
"mail2arthur.com",
"mail2artist.com",
"mail2ashley.com",
"mail2ask.com",
"mail2astronomer.com",
"mail2athena.com",
"mail2athlete.com",
"mail2atlas.com",
"mail2atom.com",
"mail2attitude.com",
"mail2auction.com",
"mail2aunt.com",
"mail2australia.com",
"mail2austria.com",
"mail2azerbaijan.com",
"mail2baby.com",
"mail2bahamas.com",
"mail2bahrain.com",
"mail2ballerina.com",
"mail2ballplayer.com",
"mail2band.com",
"mail2bangladesh.com",
"mail2bank.com",
"mail2banker.com",
"mail2bankrupt.com",
"mail2baptist.com",
"mail2bar.com",
"mail2barbados.com",
"mail2barbara.com",
"mail2barter.com",
"mail2basketball.com",
"mail2batter.com",
"mail2beach.com",
"mail2beast.com",
"mail2beatles.com",
"mail2beauty.com",
"mail2becky.com",
"mail2beijing.com",
"mail2belgium.com",
"mail2belize.com",
"mail2ben.com",
"mail2bernard.com",
"mail2beth.com",
"mail2betty.com",
"mail2beverly.com",
"mail2beyond.com",
"mail2biker.com",
"mail2bill.com",
"mail2billionaire.com",
"mail2billy.com",
"mail2bio.com",
"mail2biologist.com",
"mail2black.com",
"mail2blackbelt.com",
"mail2blake.com",
"mail2blind.com",
"mail2blonde.com",
"mail2blues.com",
"mail2bob.com",
"mail2bobby.com",
"mail2bolivia.com",
"mail2bombay.com",
"mail2bonn.com",
"mail2bookmark.com",
"mail2boreas.com",
"mail2bosnia.com",
"mail2boston.com",
"mail2botswana.com",
"mail2bradley.com",
"mail2brazil.com",
"mail2breakfast.com",
"mail2brian.com",
"mail2bride.com",
"mail2brittany.com",
"mail2broker.com",
"mail2brook.com",
"mail2bruce.com",
"mail2brunei.com",
"mail2brunette.com",
"mail2brussels.com",
"mail2bryan.com",
"mail2bug.com",
"mail2bulgaria.com",
"mail2business.com",
"mail2buy.com",
"mail2ca.com",
"mail2california.com",
"mail2calvin.com",
"mail2cambodia.com",
"mail2cameroon.com",
"mail2canada.com",
"mail2cancer.com",
"mail2capeverde.com",
"mail2capricorn.com",
"mail2cardinal.com",
"mail2cardiologist.com",
"mail2care.com",
"mail2caroline.com",
"mail2carolyn.com",
"mail2casey.com",
"mail2cat.com",
"mail2caterer.com",
"mail2cathy.com",
"mail2catlover.com",
"mail2catwalk.com",
"mail2cell.com",
"mail2chad.com",
"mail2champaign.com",
"mail2charles.com",
"mail2chef.com",
"mail2chemist.com",
"mail2cherry.com",
"mail2chicago.com",
"mail2chile.com",
"mail2china.com",
"mail2chinese.com",
"mail2chocolate.com",
"mail2christian.com",
"mail2christie.com",
"mail2christmas.com",
"mail2christy.com",
"mail2chuck.com",
"mail2cindy.com",
"mail2clark.com",
"mail2classifieds.com",
"mail2claude.com",
"mail2cliff.com",
"mail2clinic.com",
"mail2clint.com",
"mail2close.com",
"mail2club.com",
"mail2coach.com",
"mail2coastguard.com",
"mail2colin.com",
"mail2college.com",
"mail2color.com",
"mail2colorado.com",
"mail2columbia.com",
"mail2comedian.com",
"mail2composer.com",
"mail2computer.com",
"mail2computers.com",
"mail2concert.com",
"mail2congo.com",
"mail2connect.com",
"mail2connecticut.com",
"mail2consultant.com",
"mail2convict.com",
"mail2cook.com",
"mail2cool.com",
"mail2cory.com",
"mail2costarica.com",
"mail2country.com",
"mail2courtney.com",
"mail2cowboy.com",
"mail2cowgirl.com",
"mail2craig.com",
"mail2crave.com",
"mail2crazy.com",
"mail2create.com",
"mail2croatia.com",
"mail2cry.com",
"mail2crystal.com",
"mail2cuba.com",
"mail2culture.com",
"mail2curt.com",
"mail2customs.com",
"mail2cute.com",
"mail2cutey.com",
"mail2cynthia.com",
"mail2cyprus.com",
"mail2czechrepublic.com",
"mail2dad.com",
"mail2dale.com",
"mail2dallas.com",
"mail2dan.com",
"mail2dana.com",
"mail2dance.com",
"mail2dancer.com",
"mail2danielle.com",
"mail2danny.com",
"mail2darlene.com",
"mail2darling.com",
"mail2darren.com",
"mail2daughter.com",
"mail2dave.com",
"mail2dawn.com",
"mail2dc.com",
"mail2dealer.com",
"mail2deanna.com",
"mail2dearest.com",
"mail2debbie.com",
"mail2debby.com",
"mail2deer.com",
"mail2delaware.com",
"mail2delicious.com",
"mail2demeter.com",
"mail2democrat.com",
"mail2denise.com",
"mail2denmark.com",
"mail2dennis.com",
"mail2dentist.com",
"mail2derek.com",
"mail2desert.com",
"mail2devoted.com",
"mail2devotion.com",
"mail2diamond.com",
"mail2diana.com",
"mail2diane.com",
"mail2diehard.com",
"mail2dilemma.com",
"mail2dillon.com",
"mail2dinner.com",
"mail2dinosaur.com",
"mail2dionysos.com",
"mail2diplomat.com",
"mail2director.com",
"mail2dirk.com",
"mail2disco.com",
"mail2dive.com",
"mail2diver.com",
"mail2divorced.com",
"mail2djibouti.com",
"mail2doctor.com",
"mail2doglover.com",
"mail2dominic.com",
"mail2dominica.com",
"mail2dominicanrepublic.com",
"mail2don.com",
"mail2donald.com",
"mail2donna.com",
"mail2doris.com",
"mail2dorothy.com",
"mail2doug.com",
"mail2dough.com",
"mail2douglas.com",
"mail2dow.com",
"mail2downtown.com",
"mail2dream.com",
"mail2dreamer.com",
"mail2dude.com",
"mail2dustin.com",
"mail2dyke.com",
"mail2dylan.com",
"mail2earl.com",
"mail2earth.com",
"mail2eastend.com",
"mail2eat.com",
"mail2economist.com",
"mail2ecuador.com",
"mail2eddie.com",
"mail2edgar.com",
"mail2edwin.com",
"mail2egypt.com",
"mail2electron.com",
"mail2eli.com",
"mail2elizabeth.com",
"mail2ellen.com",
"mail2elliot.com",
"mail2elsalvador.com",
"mail2elvis.com",
"mail2emergency.com",
"mail2emily.com",
"mail2engineer.com",
"mail2english.com",
"mail2environmentalist.com",
"mail2eos.com",
"mail2eric.com",
"mail2erica.com",
"mail2erin.com",
"mail2erinyes.com",
"mail2eris.com",
"mail2eritrea.com",
"mail2ernie.com",
"mail2eros.com",
"mail2estonia.com",
"mail2ethan.com",
"mail2ethiopia.com",
"mail2eu.com",
"mail2europe.com",
"mail2eurus.com",
"mail2eva.com",
"mail2evan.com",
"mail2evelyn.com",
"mail2everything.com",
"mail2exciting.com",
"mail2expert.com",
"mail2fairy.com",
"mail2faith.com",
"mail2fanatic.com",
"mail2fancy.com",
"mail2fantasy.com",
"mail2farm.com",
"mail2farmer.com",
"mail2fashion.com",
"mail2fat.com",
"mail2feeling.com",
"mail2female.com",
"mail2fever.com",
"mail2fighter.com",
"mail2fiji.com",
"mail2filmfestival.com",
"mail2films.com",
"mail2finance.com",
"mail2finland.com",
"mail2fireman.com",
"mail2firm.com",
"mail2fisherman.com",
"mail2flexible.com",
"mail2florence.com",
"mail2florida.com",
"mail2floyd.com",
"mail2fly.com",
"mail2fond.com",
"mail2fondness.com",
"mail2football.com",
"mail2footballfan.com",
"mail2found.com",
"mail2france.com",
"mail2frank.com",
"mail2frankfurt.com",
"mail2franklin.com",
"mail2fred.com",
"mail2freddie.com",
"mail2free.com",
"mail2freedom.com",
"mail2french.com",
"mail2freudian.com",
"mail2friendship.com",
"mail2from.com",
"mail2fun.com",
"mail2gabon.com",
"mail2gabriel.com",
"mail2gail.com",
"mail2galaxy.com",
"mail2gambia.com",
"mail2games.com",
"mail2gary.com",
"mail2gavin.com",
"mail2gemini.com",
"mail2gene.com",
"mail2genes.com",
"mail2geneva.com",
"mail2george.com",
"mail2georgia.com",
"mail2gerald.com",
"mail2german.com",
"mail2germany.com",
"mail2ghana.com",
"mail2gilbert.com",
"mail2gina.com",
"mail2girl.com",
"mail2glen.com",
"mail2gloria.com",
"mail2goddess.com",
"mail2gold.com",
"mail2golfclub.com",
"mail2golfer.com",
"mail2gordon.com",
"mail2government.com",
"mail2grab.com",
"mail2grace.com",
"mail2graham.com",
"mail2grandma.com",
"mail2grandpa.com",
"mail2grant.com",
"mail2greece.com",
"mail2green.com",
"mail2greg.com",
"mail2grenada.com",
"mail2gsm.com",
"mail2guard.com",
"mail2guatemala.com",
"mail2guy.com",
"mail2hades.com",
"mail2haiti.com",
"mail2hal.com",
"mail2handhelds.com",
"mail2hank.com",
"mail2hannah.com",
"mail2harold.com",
"mail2harry.com",
"mail2hawaii.com",
"mail2headhunter.com",
"mail2heal.com",
"mail2heather.com",
"mail2heaven.com",
"mail2hebe.com",
"mail2hecate.com",
"mail2heidi.com",
"mail2helen.com",
"mail2hell.com",
"mail2help.com",
"mail2helpdesk.com",
"mail2henry.com",
"mail2hephaestus.com",
"mail2hera.com",
"mail2hercules.com",
"mail2herman.com",
"mail2hermes.com",
"mail2hespera.com",
"mail2hestia.com",
"mail2highschool.com",
"mail2hindu.com",
"mail2hip.com",
"mail2hiphop.com",
"mail2holland.com",
"mail2holly.com",
"mail2hollywood.com",
"mail2homer.com",
"mail2honduras.com",
"mail2honey.com",
"mail2hongkong.com",
"mail2hope.com",
"mail2horse.com",
"mail2hot.com",
"mail2hotel.com",
"mail2houston.com",
"mail2howard.com",
"mail2hugh.com",
"mail2human.com",
"mail2hungary.com",
"mail2hungry.com",
"mail2hygeia.com",
"mail2hyperspace.com",
"mail2hypnos.com",
"mail2ian.com",
"mail2ice-cream.com",
"mail2iceland.com",
"mail2idaho.com",
"mail2idontknow.com",
"mail2illinois.com",
"mail2imam.com",
"mail2in.com",
"mail2india.com",
"mail2indian.com",
"mail2indiana.com",
"mail2indonesia.com",
"mail2infinity.com",
"mail2intense.com",
"mail2iowa.com",
"mail2iran.com",
"mail2iraq.com",
"mail2ireland.com",
"mail2irene.com",
"mail2iris.com",
"mail2irresistible.com",
"mail2irving.com",
"mail2irwin.com",
"mail2isaac.com",
"mail2israel.com",
"mail2italian.com",
"mail2italy.com",
"mail2jackie.com",
"mail2jacob.com",
"mail2jail.com",
"mail2jaime.com",
"mail2jake.com",
"mail2jamaica.com",
"mail2james.com",
"mail2jamie.com",
"mail2jan.com",
"mail2jane.com",
"mail2janet.com",
"mail2janice.com",
"mail2japan.com",
"mail2japanese.com",
"mail2jasmine.com",
"mail2jason.com",
"mail2java.com",
"mail2jay.com",
"mail2jazz.com",
"mail2jed.com",
"mail2jeffrey.com",
"mail2jennifer.com",
"mail2jenny.com",
"mail2jeremy.com",
"mail2jerry.com",
"mail2jessica.com",
"mail2jessie.com",
"mail2jesus.com",
"mail2jew.com",
"mail2jeweler.com",
"mail2jim.com",
"mail2jimmy.com",
"mail2joan.com",
"mail2joann.com",
"mail2joanna.com",
"mail2jody.com",
"mail2joe.com",
"mail2joel.com",
"mail2joey.com",
"mail2john.com",
"mail2join.com",
"mail2jon.com",
"mail2jonathan.com",
"mail2jones.com",
"mail2jordan.com",
"mail2joseph.com",
"mail2josh.com",
"mail2joy.com",
"mail2juan.com",
"mail2judge.com",
"mail2judy.com",
"mail2juggler.com",
"mail2julian.com",
"mail2julie.com",
"mail2jumbo.com",
"mail2junk.com",
"mail2justin.com",
"mail2justme.com",
"mail2k.ru",
"mail2kansas.com",
"mail2karate.com",
"mail2karen.com",
"mail2karl.com",
"mail2karma.com",
"mail2kathleen.com",
"mail2kathy.com",
"mail2katie.com",
"mail2kay.com",
"mail2kazakhstan.com",
"mail2keen.com",
"mail2keith.com",
"mail2kelly.com",
"mail2kelsey.com",
"mail2ken.com",
"mail2kendall.com",
"mail2kennedy.com",
"mail2kenneth.com",
"mail2kenny.com",
"mail2kentucky.com",
"mail2kenya.com",
"mail2kerry.com",
"mail2kevin.com",
"mail2kim.com",
"mail2kimberly.com",
"mail2king.com",
"mail2kirk.com",
"mail2kiss.com",
"mail2kosher.com",
"mail2kristin.com",
"mail2kurt.com",
"mail2kuwait.com",
"mail2kyle.com",
"mail2kyrgyzstan.com",
"mail2la.com",
"mail2lacrosse.com",
"mail2lance.com",
"mail2lao.com",
"mail2larry.com",
"mail2latvia.com",
"mail2laugh.com",
"mail2laura.com",
"mail2lauren.com",
"mail2laurie.com",
"mail2lawrence.com",
"mail2lawyer.com",
"mail2lebanon.com",
"mail2lee.com",
"mail2leo.com",
"mail2leon.com",
"mail2leonard.com",
"mail2leone.com",
"mail2leslie.com",
"mail2letter.com",
"mail2liberia.com",
"mail2libertarian.com",
"mail2libra.com",
"mail2libya.com",
"mail2liechtenstein.com",
"mail2life.com",
"mail2linda.com",
"mail2linux.com",
"mail2lionel.com",
"mail2lipstick.com",
"mail2liquid.com",
"mail2lisa.com",
"mail2lithuania.com",
"mail2litigator.com",
"mail2liz.com",
"mail2lloyd.com",
"mail2lois.com",
"mail2lola.com",
"mail2london.com",
"mail2looking.com",
"mail2lori.com",
"mail2lost.com",
"mail2lou.com",
"mail2louis.com",
"mail2louisiana.com",
"mail2lovable.com",
"mail2love.com",
"mail2lucky.com",
"mail2lucy.com",
"mail2lunch.com",
"mail2lust.com",
"mail2luxembourg.com",
"mail2luxury.com",
"mail2lyle.com",
"mail2lynn.com",
"mail2madagascar.com",
"mail2madison.com",
"mail2madrid.com",
"mail2maggie.com",
"mail2mail4.com",
"mail2maine.com",
"mail2malawi.com",
"mail2malaysia.com",
"mail2maldives.com",
"mail2mali.com",
"mail2malta.com",
"mail2mambo.com",
"mail2man.com",
"mail2mandy.com",
"mail2manhunter.com",
"mail2mankind.com",
"mail2many.com",
"mail2marc.com",
"mail2marcia.com",
"mail2margaret.com",
"mail2margie.com",
"mail2marhaba.com",
"mail2maria.com",
"mail2marilyn.com",
"mail2marines.com",
"mail2mark.com",
"mail2marriage.com",
"mail2married.com",
"mail2marries.com",
"mail2mars.com",
"mail2marsha.com",
"mail2marshallislands.com",
"mail2martha.com",
"mail2martin.com",
"mail2marty.com",
"mail2marvin.com",
"mail2mary.com",
"mail2maryland.com",
"mail2mason.com",
"mail2massachusetts.com",
"mail2matt.com",
"mail2matthew.com",
"mail2maurice.com",
"mail2mauritania.com",
"mail2mauritius.com",
"mail2max.com",
"mail2maxwell.com",
"mail2maybe.com",
"mail2mba.com",
"mail2me4u.com",
"mail2mechanic.com",
"mail2medieval.com",
"mail2megan.com",
"mail2mel.com",
"mail2melanie.com",
"mail2melissa.com",
"mail2melody.com",
"mail2member.com",
"mail2memphis.com",
"mail2methodist.com",
"mail2mexican.com",
"mail2mexico.com",
"mail2mgz.com",
"mail2miami.com",
"mail2michael.com",
"mail2michelle.com",
"mail2michigan.com",
"mail2mike.com",
"mail2milan.com",
"mail2milano.com",
"mail2mildred.com",
"mail2milkyway.com",
"mail2millennium.com",
"mail2millionaire.com",
"mail2milton.com",
"mail2mime.com",
"mail2mindreader.com",
"mail2mini.com",
"mail2minister.com",
"mail2minneapolis.com",
"mail2minnesota.com",
"mail2miracle.com",
"mail2missionary.com",
"mail2mississippi.com",
"mail2missouri.com",
"mail2mitch.com",
"mail2model.com",
"mail2mom.com",
"mail2monaco.com",
"mail2money.com",
"mail2mongolia.com",
"mail2monica.com",
"mail2montana.com",
"mail2monty.com",
"mail2moon.com",
"mail2morocco.com",
"mail2morpheus.com",
"mail2mors.com",
"mail2moscow.com",
"mail2moslem.com",
"mail2mouseketeer.com",
"mail2movies.com",
"mail2mozambique.com",
"mail2mp3.com",
"mail2mrright.com",
"mail2msright.com",
"mail2museum.com",
"mail2music.com",
"mail2musician.com",
"mail2muslim.com",
"mail2my.com",
"mail2myboat.com",
"mail2mycar.com",
"mail2mycell.com",
"mail2mygsm.com",
"mail2mylaptop.com",
"mail2mymac.com",
"mail2mypager.com",
"mail2mypalm.com",
"mail2mypc.com",
"mail2myphone.com",
"mail2myplane.com",
"mail2namibia.com",
"mail2nancy.com",
"mail2nasdaq.com",
"mail2nathan.com",
"mail2nauru.com",
"mail2navy.com",
"mail2neal.com",
"mail2nebraska.com",
"mail2ned.com",
"mail2neil.com",
"mail2nelson.com",
"mail2nemesis.com",
"mail2nepal.com",
"mail2netherlands.com",
"mail2network.com",
"mail2nevada.com",
"mail2newhampshire.com",
"mail2newjersey.com",
"mail2newmexico.com",
"mail2newyork.com",
"mail2newzealand.com",
"mail2nicaragua.com",
"mail2nick.com",
"mail2nicole.com",
"mail2niger.com",
"mail2nigeria.com",
"mail2nike.com",
"mail2no.com",
"mail2noah.com",
"mail2noel.com",
"mail2noelle.com",
"mail2normal.com",
"mail2norman.com",
"mail2northamerica.com",
"mail2northcarolina.com",
"mail2northdakota.com",
"mail2northpole.com",
"mail2norway.com",
"mail2notus.com",
"mail2noway.com",
"mail2nowhere.com",
"mail2nuclear.com",
"mail2nun.com",
"mail2ny.com",
"mail2oasis.com",
"mail2oceanographer.com",
"mail2ohio.com",
"mail2ok.com",
"mail2oklahoma.com",
"mail2oliver.com",
"mail2oman.com",
"mail2one.com",
"mail2onfire.com",
"mail2online.com",
"mail2oops.com",
"mail2open.com",
"mail2ophthalmologist.com",
"mail2optometrist.com",
"mail2oregon.com",
"mail2oscars.com",
"mail2oslo.com",
"mail2painter.com",
"mail2pakistan.com",
"mail2pan.com",
"mail2panama.com",
"mail2paraguay.com",
"mail2paralegal.com",
"mail2paris.com",
"mail2park.com",
"mail2parker.com",
"mail2party.com",
"mail2passion.com",
"mail2pat.com",
"mail2patricia.com",
"mail2patrick.com",
"mail2patty.com",
"mail2paul.com",
"mail2paula.com",
"mail2pay.com",
"mail2peace.com",
"mail2pediatrician.com",
"mail2peggy.com",
"mail2pennsylvania.com",
"mail2perry.com",
"mail2persephone.com",
"mail2persian.com",
"mail2peru.com",
"mail2pete.com",
"mail2peter.com",
"mail2pharmacist.com",
"mail2phil.com",
"mail2philippines.com",
"mail2phoenix.com",
"mail2phonecall.com",
"mail2phyllis.com",
"mail2pickup.com",
"mail2pilot.com",
"mail2pisces.com",
"mail2planet.com",
"mail2platinum.com",
"mail2plato.com",
"mail2pluto.com",
"mail2pm.com",
"mail2podiatrist.com",
"mail2poet.com",
"mail2poland.com",
"mail2policeman.com",
"mail2policewoman.com",
"mail2politician.com",
"mail2pop.com",
"mail2pope.com",
"mail2popular.com",
"mail2portugal.com",
"mail2poseidon.com",
"mail2potatohead.com",
"mail2power.com",
"mail2presbyterian.com",
"mail2president.com",
"mail2priest.com",
"mail2prince.com",
"mail2princess.com",
"mail2producer.com",
"mail2professor.com",
"mail2protect.com",
"mail2psychiatrist.com",
"mail2psycho.com",
"mail2psychologist.com",
"mail2qatar.com",
"mail2queen.com",
"mail2rabbi.com",
"mail2race.com",
"mail2racer.com",
"mail2rachel.com",
"mail2rage.com",
"mail2rainmaker.com",
"mail2ralph.com",
"mail2randy.com",
"mail2rap.com",
"mail2rare.com",
"mail2rave.com",
"mail2ray.com",
"mail2raymond.com",
"mail2realtor.com",
"mail2rebecca.com",
"mail2recruiter.com",
"mail2recycle.com",
"mail2redhead.com",
"mail2reed.com",
"mail2reggie.com",
"mail2register.com",
"mail2rent.com",
"mail2republican.com",
"mail2resort.com",
"mail2rex.com",
"mail2rhodeisland.com",
"mail2rich.com",
"mail2richard.com",
"mail2ricky.com",
"mail2ride.com",
"mail2riley.com",
"mail2rita.com",
"mail2rob.com",
"mail2robert.com",
"mail2roberta.com",
"mail2robin.com",
"mail2rock.com",
"mail2rocker.com",
"mail2rod.com",
"mail2rodney.com",
"mail2romania.com",
"mail2rome.com",
"mail2ron.com",
"mail2ronald.com",
"mail2ronnie.com",
"mail2rose.com",
"mail2rosie.com",
"mail2roy.com",
"mail2rss.org",
"mail2rudy.com",
"mail2rugby.com",
"mail2runner.com",
"mail2russell.com",
"mail2russia.com",
"mail2russian.com",
"mail2rusty.com",
"mail2ruth.com",
"mail2rwanda.com",
"mail2ryan.com",
"mail2sa.com",
"mail2sabrina.com",
"mail2safe.com",
"mail2sagittarius.com",
"mail2sail.com",
"mail2sailor.com",
"mail2sal.com",
"mail2salaam.com",
"mail2sam.com",
"mail2samantha.com",
"mail2samoa.com",
"mail2samurai.com",
"mail2sandra.com",
"mail2sandy.com",
"mail2sanfrancisco.com",
"mail2sanmarino.com",
"mail2santa.com",
"mail2sara.com",
"mail2sarah.com",
"mail2sat.com",
"mail2saturn.com",
"mail2saudi.com",
"mail2saudiarabia.com",
"mail2save.com",
"mail2savings.com",
"mail2school.com",
"mail2scientist.com",
"mail2scorpio.com",
"mail2scott.com",
"mail2sean.com",
"mail2search.com",
"mail2seattle.com",
"mail2secretagent.com",
"mail2senate.com",
"mail2senegal.com",
"mail2sensual.com",
"mail2seth.com",
"mail2sevenseas.com",
"mail2sexy.com",
"mail2seychelles.com",
"mail2shane.com",
"mail2sharon.com",
"mail2shawn.com",
"mail2ship.com",
"mail2shirley.com",
"mail2shoot.com",
"mail2shuttle.com",
"mail2sierraleone.com",
"mail2simon.com",
"mail2singapore.com",
"mail2single.com",
"mail2site.com",
"mail2skater.com",
"mail2skier.com",
"mail2sky.com",
"mail2sleek.com",
"mail2slim.com",
"mail2slovakia.com",
"mail2slovenia.com",
"mail2smile.com",
"mail2smith.com",
"mail2smooth.com",
"mail2soccer.com",
"mail2soccerfan.com",
"mail2socialist.com",
"mail2soldier.com",
"mail2somalia.com",
"mail2son.com",
"mail2song.com",
"mail2sos.com",
"mail2sound.com",
"mail2southafrica.com",
"mail2southamerica.com",
"mail2southcarolina.com",
"mail2southdakota.com",
"mail2southkorea.com",
"mail2southpole.com",
"mail2spain.com",
"mail2spanish.com",
"mail2spectrum.com",
"mail2splash.com",
"mail2sponsor.com",
"mail2sports.com",
"mail2srilanka.com",
"mail2stacy.com",
"mail2stan.com",
"mail2stanley.com",
"mail2star.com",
"mail2state.com",
"mail2stephanie.com",
"mail2steve.com",
"mail2steven.com",
"mail2stewart.com",
"mail2stlouis.com",
"mail2stock.com",
"mail2stockholm.com",
"mail2stockmarket.com",
"mail2storage.com",
"mail2store.com",
"mail2strong.com",
"mail2student.com",
"mail2studio.com",
"mail2studio54.com",
"mail2stuntman.com",
"mail2subscribe.com",
"mail2sudan.com",
"mail2superstar.com",
"mail2surfer.com",
"mail2suriname.com",
"mail2susan.com",
"mail2suzie.com",
"mail2swaziland.com",
"mail2sweden.com",
"mail2sweetheart.com",
"mail2swim.com",
"mail2swimmer.com",
"mail2swiss.com",
"mail2switzerland.com",
"mail2sydney.com",
"mail2sylvia.com",
"mail2syria.com",
"mail2taboo.com",
"mail2taiwan.com",
"mail2tajikistan.com",
"mail2tammy.com",
"mail2tango.com",
"mail2tanya.com",
"mail2tanzania.com",
"mail2tara.com",
"mail2taurus.com",
"mail2taxi.com",
"mail2taxidermist.com",
"mail2taylor.com",
"mail2taz.com",
"mail2teacher.com",
"mail2technician.com",
"mail2ted.com",
"mail2telephone.com",
"mail2tenderness.com",
"mail2tennessee.com",
"mail2tennis.com",
"mail2tennisfan.com",
"mail2terri.com",
"mail2terry.com",
"mail2test.com",
"mail2texas.com",
"mail2thailand.com",
"mail2therapy.com",
"mail2think.com",
"mail2tickets.com",
"mail2tiffany.com",
"mail2tim.com",
"mail2time.com",
"mail2timothy.com",
"mail2tina.com",
"mail2titanic.com",
"mail2toby.com",
"mail2todd.com",
"mail2togo.com",
"mail2tom.com",
"mail2tommy.com",
"mail2tonga.com",
"mail2tony.com",
"mail2touch.com",
"mail2tourist.com",
"mail2tracey.com",
"mail2tracy.com",
"mail2tramp.com",
"mail2travel.com",
"mail2traveler.com",
"mail2travis.com",
"mail2trekkie.com",
"mail2trex.com",
"mail2triallawyer.com",
"mail2trick.com",
"mail2trillionaire.com",
"mail2troy.com",
"mail2truck.com",
"mail2trump.com",
"mail2try.com",
"mail2tunisia.com",
"mail2turbo.com",
"mail2turkey.com",
"mail2turkmenistan.com",
"mail2tv.com",
"mail2tycoon.com",
"mail2tyler.com",
"mail2u4me.com",
"mail2uae.com",
"mail2uganda.com",
"mail2uk.com",
"mail2ukraine.com",
"mail2uncle.com",
"mail2unsubscribe.com",
"mail2uptown.com",
"mail2uruguay.com",
"mail2usa.com",
"mail2utah.com",
"mail2uzbekistan.com",
"mail2v.com",
"mail2vacation.com",
"mail2valentines.com",
"mail2valerie.com",
"mail2valley.com",
"mail2vamoose.com",
"mail2vanessa.com",
"mail2vanuatu.com",
"mail2venezuela.com",
"mail2venous.com",
"mail2venus.com",
"mail2vermont.com",
"mail2vickie.com",
"mail2victor.com",
"mail2victoria.com",
"mail2vienna.com",
"mail2vietnam.com",
"mail2vince.com",
"mail2virginia.com",
"mail2virgo.com",
"mail2visionary.com",
"mail2vodka.com",
"mail2volleyball.com",
"mail2waiter.com",
"mail2wallstreet.com",
"mail2wally.com",
"mail2walter.com",
"mail2warren.com",
"mail2washington.com",
"mail2wave.com",
"mail2way.com",
"mail2waycool.com",
"mail2wayne.com",
"mail2webmaster.com",
"mail2webtop.com",
"mail2webtv.com",
"mail2weird.com",
"mail2wendell.com",
"mail2wendy.com",
"mail2westend.com",
"mail2westvirginia.com",
"mail2whether.com",
"mail2whip.com",
"mail2white.com",
"mail2whitehouse.com",
"mail2whitney.com",
"mail2why.com",
"mail2wilbur.com",
"mail2wild.com",
"mail2willard.com",
"mail2willie.com",
"mail2wine.com",
"mail2winner.com",
"mail2wired.com",
"mail2wisconsin.com",
"mail2woman.com",
"mail2wonder.com",
"mail2world.com",
"mail2worship.com",
"mail2wow.com",
"mail2www.com",
"mail2wyoming.com",
"mail2xfiles.com",
"mail2xox.com",
"mail2yachtclub.com",
"mail2yahalla.com",
"mail2yemen.com",
"mail2yes.com",
"mail2yugoslavia.com",
"mail2zack.com",
"mail2zambia.com",
"mail2zenith.com",
"mail2zephir.com",
"mail2zeus.com",
"mail2zipper.com",
"mail2zoo.com",
"mail2zoologist.com",
"mail2zurich.com",
"mail3000.com",
"mail4trash.com",
"mail4u.info",
"mailandftp.com",
"mailas.com",
"mailasia.com",
"mailbolt.com",
"mailboom.com",
"mailbox.as",
"mailbox.co.za",
"mailbox.gr",
"mailbox.hu",
"mailc.net",
"mailcan.com",
"mailcat.biz",
"mailcc.com",
"mailcity.com",
"mailclub.fr",
"maildx.com",
"mailed.ro",
"mailexcite.com",
"mailfa.tk",
"mailforce.net",
"mailforspam.com",
"mailfs.com",
"mailftp.com",
"mailgenie.net",
"mailguard.me",
"mailhaven.com",
"mailhood.com",
"mailimate.com",
"mailinatar.com",
"mailinator.org",
"mailinblack.com",
"mailingaddress.org",
"mailingweb.com",
"mailisent.com",
"mailismagic.com",
"mailite.com",
"mailmate.com",
"mailme.dk",
"mailme.gq",
"mailme24.com",
"mailmight.com",
"mailnator.com",
"mailnew.com",
"mailoye.com",
"mailpanda.com",
"mailpick.biz",
"mailpost.zzn.com",
"mailpride.com",
"mailproxsy.com",
"mailpuppy.com",
"mailquack.com",
"mailrock.biz",
"mailroom.com",
"mailru.com",
"mailsac.com",
"mailsent.net",
"mailservice.ms",
"mailshuttle.com",
"mailslapping.com",
"mailstart.com",
"mailstartplus.com",
"mailsurf.com",
"mailtag.com",
"mailtemp.info",
"mailtothis.com",
"mailueberfall.de",
"mailup.net",
"mailwire.com",
"mailworks.org",
"mailzi.ru",
"mailzilla.org",
"malayalamtelevision.net",
"maltesemail.com",
"mamber.net",
"manager.de",
"mancity.net",
"mantramail.com",
"manybrain.com",
"marchmail.com",
"mariahc.com",
"marijuana.com",
"marijuana.nl",
"married-not.com",
"martindalemail.com",
"masrawy.com",
"matmail.com",
"mauimail.com",
"mauritius.com",
"maxmail.co.uk",
"mbox.com.au",
"me.com",
"meta.ua",
"medical.net.au",
"medscape.com",
"meetingmall.com",
"megapoint.com",
"mehrani.com",
"mehtaweb.com",
"meine-dateien.info",
"meine-diashow.de",
"meine-fotos.info",
"meine-urlaubsfotos.de",
"mekhong.com",
"merda.flu.cc",
"merda.igg.biz",
"merda.nut.cc",
"merda.usa.cc",
"message.hu",
"messages.to",
"metacrawler.com",
"metalfan.com",
"metta.lk",
"mexicomail.com",
"mezimages.net",
"mfsa.ru",
"mierdamail.com",
"miesto.sk",
"mighty.co.za",
"migmail.net",
"migmail.pl",
"miho-nakayama.com",
"mikrotamanet.com",
"millionaireintraining.com",
"millionairemail.com",
"milmail.com",
"mindless.com",
"mindspring.com",
"minister.com",
"misery.net",
"mittalweb.com",
"mixmail.com",
"mjfrogmail.com",
"ml1.net",
"mm.st",
"mns.ru",
"moakt.com",
"mobileninja.co.uk",
"mochamail.com",
"mohammed.com",
"mohmal.com",
"moldova.cc",
"moldova.com",
"moldovacc.com",
"momslife.com",
"monemail.com",
"money.net",
"montevideo.com.uy",
"monumentmail.com",
"moose-mail.com",
"mor19.uu.gl",
"mortaza.com",
"moscowmail.com",
"mostlysunny.com",
"motormania.com",
"movemail.com",
"movieluver.com",
"mox.pp.ua",
"mp4.it",
"mr-potatohead.com",
"msgbox.com",
"msn.cn",
"msn.com",
"msn.nl",
"mt2015.com",
"mt2016.com",
"mttestdriver.com",
"muehlacker.tk",
"munich.com",
"music.com",
"musician.org",
"musicscene.org",
"muskelshirt.de",
"muslim.com",
"muslimsonline.com",
"mutantweb.com",
"mvrht.com",
"my.com",
"my10minutemail.com",
"mybox.it",
"mycity.com",
"mydomain.com",
"mydotcomaddress.com",
"myfamily.com",
"myfastmail.com",
"mygo.com",
"myiris.com",
"mymacmail.com",
"mynamedot.com",
"mynet.com",
"mynetstore.de",
"myownemail.com",
"mypacks.net",
"mypad.com",
"myplace.com",
"myrambler.ru",
"myrealbox.com",
"myremarq.com",
"myself.com",
"myspamless.com",
"mystupidjob.com",
"mytemp.email",
"mythirdage.com",
"myway.com",
"myworldmail.com",
"n2.com",
"n2baseball.com",
"n2mail.com",
"n2soccer.com",
"n2software.com",
"nabc.biz",
"nafe.com",
"nakedgreens.com",
"name.com",
"naplesnews.net",
"naseej.com",
"nativeweb.net",
"naui.net",
"naver.com",
"navigator.lv",
"navy.org",
"naz.com",
"nchoicemail.com",
"neeva.net",
"nenter.com",
"neo.rr.com",
"nervhq.org",
"net-c.be",
"net-c.ca",
"net-c.cat",
"net-c.com",
"net-c.es",
"net-c.fr",
"net-c.it",
"net-c.lu",
"net-c.nl",
"net-c.pl",
"net-pager.net",
"net-shopping.com",
"net4b.pt",
"net4you.at",
"netbounce.com",
"netbroadcaster.com",
"netby.dk",
"netc.eu",
"netc.fr",
"netc.it",
"netc.lu",
"netc.pl",
"netcenter-vn.net",
"netcmail.com",
"netcourrier.com",
"netexecutive.com",
"netexpressway.com",
"netgenie.com",
"netian.com",
"netizen.com.ar",
"netmongol.com",
"netnoir.net",
"netpiper.com",
"netralink.com",
"netscape.net",
"netspace.net.au",
"netster.com",
"nettaxi.com",
"nettemail.com",
"netterchef.de",
"netzero.com",
"netzero.net",
"neue-dateien.de",
"neuf.fr",
"neuro.md",
"newmail.com",
"newmail.net",
"newmail.ru",
"newsboysmail.com",
"newyork.com",
"nextmail.ru",
"nexxmail.com",
"nfmail.com",
"nicebush.com",
"nicegal.com",
"nicholastse.net",
"nicolastse.com",
"nikopage.com",
"nimail.com",
"ninfan.com",
"nirvanafan.com",
"nmail.cf",
"noavar.com",
"nonpartisan.com",
"nonspam.eu",
"nonspammer.de",
"norika-fujiwara.com",
"norikomail.com",
"northgates.net",
"nowhere.org",
"ntlhelp.net",
"ntscan.com",
"null.net",
"nullbox.info",
"nur-fuer-spam.de",
"nus.edu.sg",
"nwldx.com",
"nxt.ru",
"ny.com",
"nybella.com",
"nyc.com",
"nycmail.com",
"nzoomail.com",
"o-tay.com",
"o2.co.uk",
"oaklandas-fan.com",
"oath.com",
"oceanfree.net",
"oddpost.com",
"odmail.com",
"office-dateien.de",
"office-email.com",
"offroadwarrior.com",
"oicexchange.com",
"oikrach.com",
"okbank.com",
"okhuman.com",
"okmagic.com",
"oldies104mail.com",
"olemail.com",
"olympist.net",
"olypmall.ru",
"omaninfo.com",
"omen.ru",
"onebox.com",
"onenet.com.ar",
"oneoffmail.com",
"onet.com.pl",
"onet.eu",
"onet.pl",
"oninet.pt",
"online.ie",
"online.ms",
"online.nl",
"onlinewiz.com",
"onmilwaukee.com",
"onobox.com",
"op.pl",
"opayq.com",
"openmailbox.org",
"operafan.com",
"operamail.com",
"opoczta.pl",
"optician.com",
"optonline.net",
"optusnet.com.au",
"orange.fr",
"orbitel.bg",
"orgmail.net",
"orthodontist.net",
"osite.com.br",
"oso.com",
"otakumail.com",
"our-computer.com",
"our-office.com",
"our.st",
"ourbrisbane.com",
"ournet.md",
"outgun.com",
"outlook.at",
"outlook.be",
"outlook.cl",
"outlook.co.id",
"outlook.co.il",
"outlook.co.nz",
"outlook.co.th",
"outlook.com",
"outlook.com.au",
"outlook.com.br",
"outlook.com.gr",
"outlook.com.pe",
"outlook.com.tr",
"outlook.com.vn",
"outlook.cz",
"outlook.de",
"outlook.dk",
"outlook.es",
"outlook.fr",
"outlook.hu",
"outlook.ie",
"outlook.in",
"outlook.it",
"outlook.jp",
"outlook.kr",
"outlook.lv",
"outlook.my",
"outlook.ph",
"outlook.pt",
"outlook.sa",
"outlook.sg",
"outlook.sk",
"over-the-rainbow.com",
"ownmail.net",
"ozbytes.net.au",
"ozemail.com.au",
"pacbell.net",
"pacific-ocean.com",
"pacific-re.com",
"pacificwest.com",
"pagina.de",
"pagons.org",
"pakistanmail.com",
"pakistanoye.com",
"parkjiyoon.com",
"parrot.com",
"parsmail.com",
"partlycloudy.com",
"partybombe.de",
"partyheld.de",
"partynight.at",
"passwordmail.com",
"pathfindermail.com",
"pcusers.otherinbox.com",
"pediatrician.com",
"penpen.com",
"peoplepc.com",
"peopleweb.com",
"pepbot.com",
"perfectmail.com",
"perso.be",
"personal.ro",
"personales.com",
"petlover.com",
"petml.com",
"pettypool.com",
"pezeshkpour.com",
"pfui.ru",
"phayze.com",
"phone.net",
"photographer.net",
"phpbb.uu.gl",
"phreaker.net",
"physicist.net",
"pianomail.com",
"pickupman.com",
"picusnet.com",
"pigpig.net",
"pinoymail.com",
"piracha.net",
"pisem.net",
"pjjkp.com",
"planet.nl",
"planetaccess.com",
"planetarymotion.net",
"planetearthinter.net",
"planetmail.com",
"planetmail.net",
"planetout.com",
"playersodds.com",
"playful.com",
"plus.com",
"plusmail.com.br",
"pmail.net",
"pobox.sk",
"pochta.ru",
"poczta.fm",
"poczta.onet.pl",
"poetic.com",
"pokemail.net",
"pokemonpost.com",
"pokepost.com",
"polandmail.com",
"polbox.com",
"politician.com",
"polizisten-duzer.de",
"poond.com",
"popaccount.com",
"popmail.com",
"popsmail.com",
"popstar.com",
"portugalmail.com",
"portugalmail.pt",
"post.com",
"post.cz",
"post.sk",
"posta.ro",
"postaccesslite.com",
"postafree.com",
"postfach.cc",
"postinbox.com",
"postino.ch",
"postmark.net",
"postmaster.co.uk",
"postpro.net",
"powerfan.com",
"praize.com",
"premiumservice.com",
"presidency.com",
"priest.com",
"primposta.com",
"primposta.hu",
"privy-mail.com",
"privymail.de",
"pro.hu",
"probemail.com",
"prodigy.net",
"progetplus.it",
"programist.ru",
"programmer.net",
"proinbox.com",
"promessage.com",
"prontomail.com",
"protestant.com",
"protonmail.com",
"prydirect.info",
"psv-supporter.com",
"ptd.net",
"public-files.de",
"public.usa.com",
"publicist.com",
"pulp-fiction.com",
"purpleturtle.com",
"put2.net",
"pwrby.com",
"q.com",
"qmail.com",
"qprfans.com",
"qq.com",
"quackquack.com",
"quakemail.com",
"qualityservice.com",
"quantentunnel.de",
"quickhosts.com",
"quickmail.nl",
"quicknet.nl",
"quickwebmail.com",
"quiklinks.com",
"quikmail.com",
"qv7.info",
"qwest.net",
"qwestoffice.net",
"racedriver.com",
"racefanz.com",
"racingmail.com",
"radicalz.com",
"radiku.ye.vc",
"radiologist.net",
"ragingbull.com",
"ralib.com",
"rambler.ru",
"rambler.ua",
"ranmamail.com",
"rastogi.net",
"ratt-n-roll.com",
"rattle-snake.com",
"raubtierbaendiger.de",
"ravearena.com",
"ravemail.com",
"realemail.net",
"reality-concept.club",
"reallyfast.biz",
"reallyfast.info",
"reallymymail.com",
"realtyagent.com",
"reborn.com",
"reconmail.com",
"recycler.com",
"recyclermail.com",
"rediff.com",
"rediffmail.com",
"rediffmailpro.com",
"rednecks.com",
"redseven.de",
"reggaefan.com",
"registerednurses.com",
"regspaces.tk",
"reincarnate.com",
"religious.com",
"remail.ga",
"renren.com",
"repairman.com",
"reply.hu",
"representative.com",
"rescueteam.com",
"resgedvgfed.tk",
"resumemail.com",
"rezai.com",
"rhyta.com",
"richmondhill.com",
"rickymail.com",
"rin.ru",
"riopreto.com.br",
"rn.com",
"ro.ru",
"roadrunner.com",
"roanokemail.com",
"rock.com",
"rocketmail.com",
"rocketship.com",
"rockfan.com",
"rodrun.com",
"rogers.com",
"roosh.com",
"rootprompt.org",
"royal.net",
"rr.com",
"rrohio.com",
"rsub.com",
"runbox.com",
"rushpost.com",
"ruttolibero.com",
"rvshop.com",
"s-mail.com",
"sacbeemail.com",
"saeuferleber.de",
"safrica.com",
"sagra.lu",
"sags-per-mail.de",
"sailormoon.com",
"saintly.com",
"salehi.net",
"salesperson.net",
"samerica.com",
"samilan.net",
"sammimail.com",
"sandelf.de",
"sanfranmail.com",
"sanook.com",
"sapo.pt",
"saudia.com",
"sayhi.net",
"sbcglobal.net",
"scandalmail.com",
"scarlet.nl",
"schafmail.de",
"schizo.com",
"schmusemail.de",
"schoolmail.com",
"schoolsucks.com",
"schreib-doch-mal-wieder.de",
"sci.fi",
"scientist.com",
"scotland.com",
"scotlandmail.com",
"scottishmail.co.uk",
"scubadiving.com",
"seanet.com",
"search.ua",
"searchwales.com",
"sebil.com",
"secret-police.com",
"secretary.net",
"secretservices.net",
"secure-mail.biz",
"secure-mail.cc",
"seductive.com",
"seekstoyboy.com",
"seguros.com.br",
"selfdestructingmail.com",
"send.hu",
"sendme.cz",
"sendspamhere.com",
"sent.as",
"sent.at",
"sent.com",
"sentrismail.com",
"serga.com.ar",
"servemymail.com",
"servermaps.net",
"sesmail.com",
"sexmagnet.com",
"seznam.cz",
"sfr.fr",
"shaniastuff.com",
"shared-files.de",
"sharedmailbox.org",
"sharmaweb.com",
"she.com",
"shieldedmail.com",
"shinedyoureyes.com",
"shitaway.cf",
"shitaway.ga",
"shitaway.gq",
"shitaway.ml",
"shitaway.tk",
"shitaway.usa.cc",
"shitmail.de",
"shitmail.org",
"shitware.nl",
"shortmail.com",
"shotgun.hu",
"showslow.de",
"sialkotcity.com",
"sialkotian.com",
"sialkotoye.com",
"sify.com",
"silkroad.net",
"sina.cn",
"sina.com",
"singles4jesus.com",
"singmail.com",
"singnet.com.sg",
"singpost.com",
"sinnlos-mail.de",
"siteposter.net",
"skafan.com",
"skeefmail.com",
"skim.com",
"skizo.hu",
"skrx.tk",
"sky.com",
"slamdunkfan.com",
"slave-auctions.net",
"slingshot.com",
"slippery.email",
"slipry.net",
"slotter.com",
"smap.4nmv.ru",
"smapxsmap.net",
"smashmail.de",
"smoothmail.com",
"sms.at",
"snail-mail.net",
"snakebite.com",
"snet.net",
"sniper.hu",
"snkmail.com",
"snoopymail.com",
"snowboarding.com",
"snowdonia.net",
"socceramerica.net",
"soccermail.com",
"soccermomz.com",
"social-mailer.tk",
"socialworker.net",
"sociologist.com",
"sofort-mail.de",
"sofortmail.de",
"softhome.net",
"sogou.com",
"sohu.com",
"sol.dk",
"solcon.nl",
"soldier.hu",
"solution4u.com",
"solvemail.info",
"songwriter.net",
"sonnenkinder.org",
"soodomail.com",
"soon.com",
"soulfoodcookbook.com",
"sp.nl",
"space-bank.com",
"space-man.com",
"space-ship.com",
"space-travel.com",
"space.com",
"spacemart.com",
"spacewar.com",
"spainmail.com",
"spam.2012-2016.ru",
"spamavert.com",
"spambob.com",
"spambooger.com",
"spamdecoy.net",
"spameater.com",
"spamfree24.info",
"spaminator.de",
"spaml.com",
"spamoff.de",
"spartapiet.com",
"speedemail.net",
"speedpost.net",
"speedrules.com",
"speedrulz.com",
"speedymail.org",
"sperke.net",
"spils.com",
"spinfinder.com",
"spl.at",
"spoko.pl",
"spoofmail.de",
"sportsmail.com",
"sporttruckdriver.com",
"spray.se",
"spybox.de",
"spymac.com",
"srilankan.net",
"ssl-mail.com",
"st-davids.net",
"stade.fr",
"stargateradio.com",
"starmail.com",
"starmedia.com",
"starspath.com",
"start.com.au",
"startkeys.com",
"stinkefinger.net",
"stipte.nl",
"stoned.com",
"stones.com",
"stop-my-spam.pp.ua",
"streber24.de",
"streetwisemail.com",
"strompost.com",
"strongguy.com",
"student.su",
"studentcenter.org",
"stuffmail.de",
"subram.com",
"sudolife.me",
"sudolife.net",
"sudomail.biz",
"sudomail.com",
"sudomail.net",
"sudoverse.com",
"sudoverse.net",
"sudoweb.net",
"sudoworld.com",
"sudoworld.net",
"suhabi.com",
"sukhumvit.net",
"sunpoint.net",
"sunrise-sunset.com",
"sunsgame.com",
"sunumail.sn",
"superdada.com",
"supereva.it",
"supermail.ru",
"superrito.com",
"surf3.net",
"surfree.com",
"surfy.net",
"surgical.net",
"surimail.com",
"survivormail.com",
"svk.jp",
"swbell.net",
"sweb.cz",
"swedenmail.com",
"sweetxxx.de",
"swift-mail.com",
"swiftdesk.com",
"swingeasyhithard.com",
"swingfan.com",
"swipermail.zzn.com",
"swirve.com",
"swissmail.com",
"swissmail.net",
"switchboardmail.com",
"sx172.com",
"syom.com",
"t-online.de",
"t.psh.me",
"t2mail.com",
"tafmail.com",
"takuyakimura.com",
"talk21.com",
"talkinator.com",
"tamil.com",
"tampabay.rr.com",
"tankpolice.com",
"tatanova.com",
"tbwt.com",
"tds.net",
"teachermail.net",
"teachers.org",
"teamdiscovery.com",
"teamtulsa.net",
"tech-center.com",
"tech4peace.org",
"techemail.com",
"techie.com",
"technisamail.co.za",
"technologist.com",
"techscout.com",
"techspot.com",
"tele2.at",
"tele2.nl",
"teleline.es",
"telerymd.com",
"teleworm.us",
"telfort.nl",
"telfortglasvezel.nl",
"telinco.net",
"telpage.net",
"telstra.com",
"telstra.com.au",
"temp-mail.com",
"temp-mail.de",
"temp.headstrong.de",
"tempail.com",
"tempemail.biz",
"tempmail.us",
"tempmaildemo.com",
"tempmailer.com",
"temporarioemail.com.br",
"temporaryemail.us",
"tempthe.net",
"tempymail.com",
"temtulsa.net",
"tenchiclub.com",
"tenderkiss.com",
"tennismail.com",
"terminverpennt.de",
"terra.cl",
"terra.com",
"terra.com.ar",
"terra.com.br",
"test.com",
"test.de",
"tfanus.com.er",
"tfz.net",
"thai.com",
"thaimail.com",
"thaimail.net",
"thanksnospam.info",
"the-african.com",
"the-aliens.com",
"the-american.com",
"the-animal.com",
"the-astronaut.com",
"the-beauty.com",
"the-big-apple.com",
"the-boss.com",
"the-captain.com",
"the-cowboy.com",
"the-eagles.com",
"the-fastest.net",
"the-galaxy.net",
"the-genius.com",
"the-gentleman.com",
"the-german.com",
"the-italian.com",
"the-lair.com",
"the-madman.com",
"the-marine.com",
"the-master.com",
"the-mexican.com",
"the-monkey.com",
"the-pentagon.com",
"the-professional.com",
"the-quickest.com",
"the-russian.com",
"the-spaceman.com",
"thecriminals.com",
"thedoghousemail.com",
"thedorm.com",
"theend.hu",
"theglobe.com",
"thegolfcourse.com",
"theheadoffice.com",
"theinternetemail.com",
"thelanddownunder.com",
"themail.com",
"themillionare.net",
"theplate.com",
"thepokerface.com",
"thepostmaster.net",
"theraces.com",
"therapist.net",
"thestreetfighter.com",
"thewatercooler.com",
"thewebpros.co.uk",
"thirdage.com",
"thisgirl.com",
"thraml.com",
"throwam.com",
"tidni.com",
"tiscali.co.uk",
"tiscali.it",
"tkcity.com",
"tmail.ws",
"toast.com",
"toke.com",
"tom.com",
"toolsource.com",
"toomail.biz",
"toothfairy.com",
"topletter.com",
"topmail-files.de",
"torontomail.com",
"tortenboxer.de",
"totalmail.de",
"totalmusic.net",
"tpg.com.au",
"trash-mail.ml",
"trashdevil.de",
"trashymail.net",
"trayna.com",
"trialbytrivia.com",
"trickmail.net",
"trimix.cn",
"tritium.net",
"trmailbox.com",
"tropicalstorm.com",
"truckracer.com",
"truckracers.com",
"truthmail.com",
"tsamail.co.za",
"ttml.co.in",
"turboprinz.de",
"turboprinzessin.de",
"turkey.com",
"tut.by",
"tvstar.com",
"twc.com",
"twinstarsmail.com",
"typemail.com",
"u2club.com",
"ua.fm",
"ubbi.com",
"uboot.com",
"uk2.net",
"uk2k.com",
"uk2net.com",
"uk7.net",
"uk8.net",
"ukbuilder.com",
"ukcool.com",
"ukdreamcast.com",
"ukmail.org",
"ukmax.com",
"ukr.net",
"uku.co.uk",
"ultapulta.com",
"ultrapostman.com",
"ummah.org",
"umpire.com",
"unbounded.com",
"unforgettable.com",
"uni.de",
"unican.es",
"unihome.com",
"universal.pt",
"uno.ee",
"uno.it",
"unofree.it",
"unterderbruecke.de",
"uol.com.br",
"uol.com.co",
"uol.com.ve",
"uomail.com",
"upc.nl",
"upcmail.nl",
"upf.org",
"uplipht.com",
"ureach.com",
"uroid.com",
"usa.com",
"usa.net",
"usaaccess.net",
"usermail.com",
"username.e4ward.com",
"usma.net",
"usmc.net",
"uswestmail.net",
"utanet.at",
"uymail.com",
"uyuyuy.com",
"vaasfc4.tk",
"vahoo.com",
"valemail.net",
"vampirehunter.com",
"varbizmail.com",
"vcmail.com",
"velnet.co.uk",
"velocall.com",
"verizon.net",
"verlass-mich-nicht.de",
"versatel.nl",
"veryfast.biz",
"veryrealemail.com",
"veryspeedy.net",
"vfemail.net",
"vickaentb.tk",
"videotron.ca",
"viditag.com",
"vinbazar.com",
"violinmakers.co.uk",
"vip.126.com",
"vip.163.com",
"vip.21cn.com",
"vip.citiz.net",
"vip.gr",
"vip.onet.pl",
"vip.qq.com",
"vip.sina.com",
"vipmail.ru",
"virgilio.it",
"virgin.net",
"virginbroadband.com.au",
"visitweb.com",
"visto.com",
"vivavelocity.com",
"vivianhsu.net",
"vkcode.ru",
"vnet.citiz.net",
"vnn.vn",
"vodafone.nl",
"vodafonethuis.nl",
"volcanomail.com",
"vollbio.de",
"volloeko.de",
"vomoto.com",
"vorsicht-bissig.de",
"vorsicht-scharf.de",
"vote-democrats.com",
"vote-republicans.com",
"vote4gop.org",
"votenet.com",
"vp.pl",
"vr9.com",
"vubby.com",
"w3.to",
"wahoye.com",
"walala.org",
"wales2000.net",
"walkmail.net",
"walkmail.ru",
"wam.co.za",
"wanadoo.es",
"wanadoo.fr",
"war-im-urlaub.de",
"warmmail.com",
"warpmail.net",
"warrior.hu",
"wazabi.club",
"wbdet.com",
"web-contact.info",
"web-emailbox.eu",
"web-mail.com.ar",
"web-mail.pp.ua",
"web-police.com",
"web.de",
"webave.com",
"webcity.ca",
"webcontact-france.eu",
"webdream.com",
"webindia123.com",
"webmail.co.za",
"webmail.hu",
"webmails.com",
"webname.com",
"webstation.com",
"websurfer.co.za",
"webtopmail.com",
"wee.my",
"weekonline.com",
"wefjo.grn.cc",
"weg-werf-email.de",
"wegas.ru",
"wegwerf-emails.de",
"wegwerfmail.info",
"wegwerpmailadres.nl",
"wehshee.com",
"weibsvolk.de",
"weibsvolk.org",
"weinenvorglueck.de",
"welsh-lady.com",
"westnet.com.au",
"wfgdfhj.tk",
"whale-mail.com",
"whartontx.com",
"whatiaas.com",
"whatpaas.com",
"wheelweb.com",
"whipmail.com",
"whoever.com",
"whtjddn.33mail.com",
"wickmail.net",
"wideopenwest.com",
"wildmail.com",
"wilemail.com",
"will-hier-weg.de",
"windowslive.com",
"windstream.net",
"wingnutz.com",
"winning.com",
"wir-haben-nachwuchs.de",
"wir-sind-cool.org",
"witty.com",
"wiz.cc",
"wkbwmail.com",
"wmail.cf",
"wo.com.cn",
"woh.rr.com",
"wolke7.net",
"wombles.com",
"women-at-work.org",
"wongfaye.com",
"wooow.it",
"worker.com",
"workmail.com",
"worldemail.com",
"worldnet.att.net",
"wormseo.cn",
"wosaddict.com",
"wowgirl.com",
"wowmail.com",
"wowway.com",
"wp.pl",
"wptamail.com",
"wrexham.net",
"writeme.com",
"writemeback.com",
"wrongmail.com",
"www.com",
"www.e4ward.com",
"wxs.net",
"x-mail.net",
"x-networks.net",
"x5g.com",
"xaker.ru",
"xing886.uu.gl",
"xmastime.com",
"xms.nl",
"xoom.com",
"xpressmail.zzn.com",
"xs4all.nl",
"xsecurity.org",
"xsmail.com",
"xtra.co.nz",
"xuno.com",
"xww.ro",
"xy9ce.tk",
"y7mail.com",
"ya.ru",
"yada-yada.com",
"yahoo.at",
"yahoo.be",
"yahoo.ca",
"yahoo.cn",
"yahoo.co.id",
"yahoo.co.il",
"yahoo.co.in",
"yahoo.co.jp",
"yahoo.co.kr",
"yahoo.co.nz",
"yahoo.co.th",
"yahoo.co.uk",
"yahoo.co.za",
"yahoo.com",
"yahoo.com.ar",
"yahoo.com.au",
"yahoo.com.br",
"yahoo.com.cn",
"yahoo.com.co",
"yahoo.com.hk",
"yahoo.com.mx",
"yahoo.com.my",
"yahoo.com.ph",
"yahoo.com.sg",
"yahoo.com.tr",
"yahoo.com.tw",
"yahoo.com.vn",
"yahoo.cz",
"yahoo.de",
"yahoo.dk",
"yahoo.es",
"yahoo.fi",
"yahoo.fr",
"yahoo.gr",
"yahoo.hu",
"yahoo.ie",
"yahoo.in",
"yahoo.it",
"yahoo.jp",
"yahoo.nl",
"yahoo.no",
"yahoo.pl",
"yahoo.pt",
"yahoo.ro",
"yahoo.se",
"yalla.com",
"yalla.com.lb",
"yalook.com",
"yam.com",
"yandex.com",
"yandex.ru",
"yandex.ua",
"yapped.net",
"yawmail.com",
"yeah.net",
"yebox.com",
"yehey.com",
"yepmail.net",
"yert.ye.vc",
"yesey.net",
"ymail.com",
"yogotemail.com",
"yomail.info",
"yopmail.pp.ua",
"yopolis.com",
"yopweb.com",
"youareadork.com",
"youmailr.com",
"your-house.com",
"your-mail.com",
"yourname.freeservers.com",
"yours.com",
"yoursubdomain.zzn.com",
"yourteacher.net",
"yuuhuu.net",
"yyhmail.com",
"z1p.biz",
"za.com",
"zahadum.com",
"zaktouni.fr",
"zeepost.nl",
"zetmail.com",
"zhaowei.net",
"zhouemail.510520.org",
"ziggo.nl",
"zionweb.org",
"zip.net",
"zipido.com",
"ziplip.com",
"zipmail.com",
"zipmail.com.br",
"zipmax.com",
"zmail.ru",
"zoho.com",
"zomg.info",
"zonnet.nl",
"zoominternet.net",
"zubee.com",
"zuzzurello.com",
"zwallet.com",
"zweb.in",
"zxcvbnm.com",
"zybermail.com",
"zydecofan.com",
"zzn.com",
"zzz.com"}

spam-mime = {
"bat" = "BAD",
"chm" = "BAD",
"com" = "BAD",
"exe" = "BAD",
"hta" = "BAD|NZ",
"iso" = "BAD",
"jar" = "BAD|NZ",
"lnk" = "BAD",
"scr" = "BAD",
"htm" = "text/html|BAD",
"html" = "text/html|BAD",
"shtm" = "text/html|BAD",
"shtml" = "text/html|BAD",
"ace" = "BAD|AR",
"arj" = "BAD|AR",
"asx" = "BAD",
"cab" = "BAD|AR",
"sfx" = "BAD",
"vst" = "BAD",
"vss" = "BAD",
"ade" = "BAD",
"adp" = "BAD",
"cmd" = "BAD",
"cpl" = "BAD",
"ins" = "BAD",
"isp" = "BAD",
"js" = "BAD|NZ",
"jse" = "BAD",
"lib" = "BAD",
"mde" = "BAD",
"msc" = "BAD",
"msi" = "BAD",
"msp" = "BAD",
"mst" = "BAD",
"nsh" = "BAD",
"pif" = "BAD",
"sct" = "BAD",
"shb" = "BAD",
"sys" = "BAD",
"vb" = "BAD",
"vbe" = "BAD",
"vbs" = "BAD|NZ",
"vxd" = "BAD",
"wsc" = "BAD",
"wsh" = "BAD",
"app" = "BAD",
"asp" = "BAD",
"bas" = "BAD",
"cnt" = "BAD",
"csh" = "BAD",
"diagcab" = "BAD",
"fxp" = "BAD",
"gadget" = "BAD",
"grp" = "BAD",
"hlp" = "BAD",
"hpj" = "BAD",
"inf" = "BAD",
"its" = "BAD",
"jnlp" = "BAD",
"ksh" = "BAD",
"mad" = "BAD",
"maf" = "BAD",
"mag" = "BAD",
"mam" = "BAD",
"maq" = "BAD",
"mar" = "BAD",
"mas" = "BAD",
"mat" = "BAD",
"mau" = "BAD",
"mav" = "BAD",
"maw" = "BAD",
"mcf" = "BAD",
"mda" = "BAD",
"mdb" = "BAD",
"mdt" = "BAD",
"mdw" = "BAD",
"mdz" = "BAD",
"msh" = "BAD",
"msh1" = "BAD",
"msh2" = "BAD",
"mshxml" = "BAD",
"msh1xml" = "BAD",
"msh2xml" = "BAD",
"msu" = "BAD",
"ops" = "BAD",
"osd" = "BAD",
"pcd" = "BAD",
"pl" = "BAD",
"plg" = "BAD",
"prf" = "BAD",
"prg" = "BAD",
"printerexport" = "BAD",
"ps1" = "BAD",
"ps1xml" = "BAD",
"ps2" = "BAD",
"ps2xml" = "BAD",
"psc1" = "BAD",
"psc2" = "BAD",
"psd1" = "BAD",
"psdm1" = "BAD",
"pst" = "BAD",
"reg" = "BAD",
"scf" = "BAD",
"shs" = "BAD",
"theme" = "BAD",
"url" = "BAD",
"vbp" = "BAD",
"vsmacros" = "BAD",
"vsw" = "BAD",
"webpnp" = "BAD",
"website" = "BAD",
"ws" = "BAD",
"xbap" = "BAD",
"xll" = "BAD",
"xnk" = "BAD",
"docx" = "NZ",
"docm" = "BAD",
"pptm" = "BAD",
"xlsm" = "BAD",
"pdf" = "application/pdf|application/x-pdf|NZ",
"pptx" = "NZ",
"wsf" = "NZ",
"xlsx" = "NZ",
"7x" = "AR",
"alz" = "AR",
"bz2" = "AR",
"egg" = "AR",
"lz" = "AR",
"rar" = "AR",
"xz" = "AR",
"zip" = "AR",
"txt" = "text/plain|message/disposition-notification|text/rfc822-headers"}

spam-redirect = {"000d.ru",
"0845.com",
"0c.ru",
"0lv.ru",
"0pen.me",
"0rz.tw",
"10r.us",
"123url.org",
"140.uz",
"17q.com",
"1c-bitrix.ru",
"1cl.in",
"1ink.in",
"1ink.ru",
"1iny.com",
"1lik.net",
"1link.in",
"1url.com",
"1url.in",
"1-url.net",
"1-url.ru",
"2big.at",
"2dwww.com",
"2.gp",
"2it.info",
"2.ly",
"2mb.eu",
"2qu.ru",
"2sms.ru",
"2tu.me",
"2tu.us",
"2url.org",
"307.to",
"3fw.ru",
"3le.ru",
"3.ly",
"3.vu",
"3x.si",
"4.gg",
"4job.ru",
"4.ly",
"4ms.me",
"4p5.com",
"4ry.ru",
"4sq.com",
"4u.gd",
"4url.cc",
"4url.tk",
"5.gp",
"5link.tk",
"5pl.us",
"5url.net",
"5z8.info",
"6fr.ru",
"6.ly",
"6pn.com",
"6url.com",
"6yo.org",
"70.ru",
"74job.ru",
"7.ly",
"7ly.ru",
"7pisem.ru",
"7ruh.com",
"7ry.us",
"7xu.org",
"8.ly",
"8q.ro",
"9mp.com",
"9-n.org",
"9xi.ru",
"a1.tc",
"a2k.in",
"aa.cx",
"aafter.us",
"abe5.com",
"access.im",
"action-emails.ru",
"ad4.us",
"adf.ly",
"adjix.com",
"adsbeta.net",
"ad.vu",
"afx.cc",
"a.gg",
"ah.ae",
"aipro.ru",
"airs.ru",
"aka-url.com",
"alic.at",
"all.fuseurl.com",
"allshort.ru",
"all-top.ru",
"alturl.com",
"a.md",
"amzn.to",
"a.nf",
"apeurl.com",
"api.m3653.net",
"apsense.cc",
"apu.sh",
"ar.gy",
"arm.in",
"arst.ch",
"atiny.me",
"atto.co.za",
"atu.ca",
"autodesk.com",
"avast.com",
"avoo.net",
"azc.cc",
"b23.ru",
"b2l.me",
"backupurl.com",
"bacn.me",
"bai.lu",
"bcool.bz",
"bezurl.com",
"bi.gl",
"binged.it",
"bin.nu",
"bitby.net",
"bit.do",
"bit.gy",
"bit.ly",
"bitleyco.cc",
"bitly.com",
"bitrix24.ru",
"biturl.net",
"bit.uz",
"bizj.us",
"bloat.me",
"bmu.li",
"boi.re",
"bq.ro",
"bravo.ly",
"briefurl.pl",
"bsa.ly",
"bsndsy.ru",
"budurl.com",
"bun.ru",
"bu.tt",
"byst.ro",
"byyb.net",
"bz9.com",
"campaign-services.directcrm.ru",
"canurl.com",
"capello.linkatty.com",
"capourl.com",
"care2share.tk",
"cbs.so",
"cbuz.com",
"cctv.ws",
"cd.vg",
"cektkp.com",
"cha.la",
"chilp.it",
"chzb.gr",
"cjb.net",
"cjt99.tk",
"clck.ru",
"cliccami.info",
"click2.info",
"clicks.biletix.ru",
"clicks.citilink.ru",
"click.email4customers.com",
"click.emailinfo.mail.hpe.com",
"click.icptrack.com",
"click.mlsend.com",
"click-me.us",
"clickthru.ca",
"clickv.tk",
"cli.gs",
"clkit.co",
"cl.lk",
"cl.ly",
"clme.ru",
"cloakreferer.com",
"clockurl.com",
"clop.in",
"cms.im",
"cmylink.com",
"cnect.us",
"comyonet.com",
"conta.cc",
"coolestone.com",
"cort.as",
"cortas.elpais.com",
"cot.ag",
"cowurl.com",
"cp.bitrix.ru",
"cr.am",
"createurl.com",
"crks.me",
"crlf.ru",
"crop.im",
"crum.pl",
"ctvr.us",
"cug.kr",
"cut4.me",
"cut.by",
"cuthut.com",
"cutt.us",
"d2u.us",
"d8z.ru",
"dai.ly",
"da.lc",
"ddp.net",
"decenturl.com",
"delivr.com",
"dev0.ru",
"dft.ba",
"digbig.com",
"di.gd",
"digg.com",
"digidns.net",
"din.gy",
"directtrafficlink.com",
"disq.us",
"dld.bz",
"dlvr.it",
"dmanalytics1.com",
"doiop.com",
"do.my",
"dopen.us",
"dot.tk",
"dr2.biz",
"driz.ru",
"dr.tl",
"durlz.info",
"easyuri.com",
"easyurl.jp",
"easyurl.net",
"eepurl.com",
"ej.uz",
"elurl.com",
"email.account.2gis.com",
"email.mail.ostrovok.ru",
"email.mxtoolbox.com",
"email.news.ostrovok.ru",
"e.mail.ru",
"em.digium.com",
"emap.ws",
"emlstart.com",
"etdurl.com",
"eweri.com",
"exa.im",
"f1ru.net",
"fa.by",
"fanta.linkatty.com",
"fav.me",
"fbi.pp.ua",
"fb.me",
"fbshare.me",
"fff.to",
"ff.im",
"ffs.cc",
"fi.gd",
"fire.to",
"firsturl.de",
"firsturl.net",
"fishurl.ru",
"flane.info",
"flavr.be",
"flic.kr",
"flq.us",
"flx.im",
"fly2.ws",
"folo.me",
"fo.my",
"fon.gs",
"forex-trade.be",
"fqav.com",
"freak.to",
"freepl.us",
"free-redirect.tk",
"freeurl.me",
"free-url-redirection.com.ru",
"fur.ly",
"fuseurl.com",
"fuzzy.to",
"fwd4.me",
"fwds.me",
"fwib.net",
"fyad.org",
"fyn.im",
"g00.me",
"gadaf.fi",
"game-url.com",
"gentleurl.net",
"geteml.com",
"getlink.info",
"get.sh",
"get.tf",
"gho.co",
"gig140.com",
"gizmo.do",
"gl.am",
"glink.co",
"gltw.ru",
"gmetzner.de",
"gmy.su",
"gnu.su",
"go2-url.com",
"go.9nl.com",
"go9.us",
"goandgrab.info",
"gog.tc",
"go.it",
"go-links.net",
"golook.at",
"go.ly",
"good.ly",
"goo.gl",
"goo.pm",
"go.qb.by",
"goshrink.com",
"gosite.in",
"goto.pattayacitythailand.com",
"gourl.ca",
"gourl.gr",
"gourl.it",
"go-url.ru",
"go.usa.gov",
"gri.bz",
"groteck.com",
"g.ro.lt",
"gtgg.us",
"g.ua",
"gu.ma",
"gurl.es",
"haqm.com",
"hex.io",
"hhvx.com",
"hiderefer.com",
"hijw.com",
"hi.kg",
"hit.kg",
"hj.to",
"hlurl.com",
"hmm.ph",
"ho.io",
"hop.clickbank.net",
"hopclicks.com",
"ho.pe",
"hop.kz",
"href.in",
"hsblinks.com",
"htxt.it",
"hubb.me",
"huff.to",
"hulu.com",
"hurl.me",
"hurl.ws",
"huuk.net",
"hvmnd.org",
"i2h.de",
"i5.be",
"icanhaz.com",
"idek.net",
"idelink.com",
"ifree.kz",
"ih3.ru",
"ikeafamilynews.ru",
"ilix.in",
"ilnk.me",
"informer.ru",
"innogam.es",
"ino.me",
"int.kz",
"ipsha.ru",
"ir.pe",
"is.gd",
"is.gs",
"issuu.com",
"itshrunk.com",
"its.my",
"iurlz.com",
"ix.lt",
"ixr.be",
"j3w.it",
"ja.cx",
"jdem.cz",
"jewi.sh",
"jijr.com",
"jmb.tw",
"j.mp",
"jom.la",
"joo.ru",
"just.as",
"juu.cc",
"keep2.me",
"kickurl.com",
"kipq.com",
"kisaurl.com",
"ki.tl",
"kl.am",
"klck.me",
"klik.sihitam.com",
"klx.co",
"knb.im",
"kon.tl",
"kore.us",
"korta.nu",
"kqon.com",
"kr1n.ru",
"krunchd.com",
"krz.ch",
"ktzr.us",
"l24.cm",
"l3ss.me",
"l9k.net",
"lat.ms",
"lavvs.com",
"lcut.us",
"leeturl.net",
"leto.tk",
"liip.to",
"liltext.com",
"lin.io",
"link2me.ru",
"link.ac",
"linkbee.com",
"linkbun.ch",
"linkcash.biz",
"linkde.info",
"linkee.com",
"link.from.homecredit.ru",
"link.hhut.ru",
"linkl.ru",
"link.mail.1fd-system.ru",
"link.mail.e-gazeta-unp.ru",
"link.mail.e.glavbukh-mail.ru",
"link.mail.fd-online.ru",
"link.mail.glavbukh-mail.ru",
"link.mail.unp-client.ru",
"link.rengo.ru",
"link.sendsay.ru",
"linkslash.ca",
"linkunion.de",
"linkx.me",
"linkyy.com",
"linkzip.net",
"lip.tc",
"li.ru",
"list-manage1.com",
"list-manage2.com",
"list-manage.com",
"little.im",
"littleurl.net",
"liurl.cn",
"livehoster.org",
"llinks.net",
"ln0.ru",
"ln4.me",
"lnk.by",
"lnk.cm",
"lnk.co",
"lnk.gd",
"lnk.in",
"lnk.ly",
"lnk.ms",
"lnk.sk",
"lnkd.in",
"lnks.gd",
"lnks.it",
"lnkstts.com",
"lnkurl.com",
"ln-s.net",
"ln-s.ru",
"loh.ru",
"loo.gl",
"lovebyt.es",
"low.cc",
"l.pr",
"lr.tc",
"lru.jp",
"lrwk.com",
"ltos.ru",
"lt.tl",
"lul.es",
"lurl.no",
"lx2.net",
"ly9.net",
"m4u.in",
"m7a.org",
"macte.ch",
"mail.rambler.ru",
"mandrillapp.com",
"mash.to",
"mee.la",
"merky.de",
"metamark.net",
"micurl.com",
"migre.me",
"miliuner.com",
"miniurl.com",
"miniurl.net.ru",
"miniurl.pl",
"mimecast.com",
"minu.me",
"minurl.fr",
"minyurl.net",
"minyurl.org",
"mislead.in",
"miud.in",
"mixe.me",
"mj.is",
"mjt.lu",
"mke.me",
"mlcampaignru.com",
"mljt.tech",
"mlsendru.com",
"mmt.su",
"mobotix-news.com",
"mo.by",
"moby.to",
"mockurl.com",
"moourl.com",
"mp77.com",
"mrte.ch",
"mtp.pl",
"mty.in",
"mug.gs",
"murl.kz",
"mvp.im",
"mylink4u.info",
"mylink.to",
"myloc.me",
"myooo.info",
"mypaqe.com",
"mypl.us",
"mytinyurl.net",
"myurl.in",
"myurl.si",
"myxx.me",
"mzan.si",
"n3n.in",
"n3r.ru",
"nbc.co",
"nblo.gs",
"nbold.com",
"ne1.net",
"netgod.tk",
"neuf.tk",
"newhotlink.com",
"nexturl.ru",
"nicesharing.com",
"nik.im",
"niurl.com",
"nl.cr",
"nn.nf",
"no1.in",
"no.io",
"nonameno.com",
"normalurl.com",
"notlong.com",
"not.my",
"now.am",
"n.pr",
"nsfw.in",
"nutshellurl.com",
"nxy.in",
"nyti.ms",
"oc1.us",
"oeeq.com",
"oiurl.com",
"o.ly",
"omf.gd",
"om.ly",
"omoikane.net",
"on.cnn.com",
"on.mktw.net",
"oogyah.com",
"oork.com",
"opurl.us",
"orbita.co.il",
"orz.se",
"ourgplus.at",
"out.houseofgaga.ru",
"ovr.me",
"ow.ly",
"o-x.fr",
"p1.fr",
"pathto.net",
"paypal-communication.com",
"pb8.ru",
"pburl.com",
"pcw.ro",
"pduda.mobi",
"pechkincensor.ru",
"pechkinspy.ru",
"peeep.us",
"peekurl.com",
"pendek.in",
"penting.web.id",
"pfat.de",
"pho.se",
"phpm.ru",
"php-ru.info",
"pi90.com",
"picourl.ru",
"piks.nl",
"ping.fm",
"pli.gs",
"plink.es",
"plo.cc",
"ploshadka.ru",
"plugin.name",
"plusphp.com",
"p.ly",
"pnt.me",
"pobierz-film.tk",
"politi.co",
"ponyurl.com",
"poo.pr",
"post.ly",
"pot.vg",
"pp.gg",
"ppt.cc",
"pra.im",
"privacy-surf.com",
"proext.com",
"professionali.ru",
"profile.to",
"proofpoint.com",
"prourl.de",
"ptiturl.com",
"p.tl",
"pub.vitrue.com",
"punyurl.com",
"purl.org",
"pvh.me",
"pw.ly",
"pxlz.org",
"py6.ru",
"pygmyurl.com",
"pysper.com",
"q32.ru",
"qick.ws",
"qid.in",
"qkr.cc",
"qlnk.net",
"qlql.ru",
"qnh.pl",
"qr.cx",
"qr.ee",
"qrf.in",
"qr.net",
"qru.ru",
"qte.me",
"qtwk.com",
"quik.in",
"qurl.com",
"qu.tc",
"qz.bz",
"rb6.me",
"r.delphicomponent.ru",
"rdrct.us",
"rdr.to",
"read.bi",
"readthis.ca",
"reallytinyurl.com",
"redir.ec",
"redirectingat.com",
"redirects.ca",
"redirect.subscribe.ru",
"redire.ru",
"redirx.com",
"reduc.in",
"referer.us",
"retweet.cc",
"retwt.me",
"reurl.org",
"rhwm.eu",
"rickroll.it",
"r.im",
"ri.ms",
"riz.gd",
"rlu.ru",
"rmse.ru",
"rnd.ru",
"romb.su",
"r-ss.de",
"rt.nu",
"rubyurl.com",
"ru.ly",
"rurl.org",
"rurl.ru",
"rurls.ru",
"rustech.org",
"rww.tw",
"s0bu.ru",
"s0e.ru",
"s4c.in",
"s7y.us",
"s8.hk",
"safe.mn",
"saf.li",
"safelinks.protection.outlook.com",
"sami.24.gg",
"sayabit.com",
"sbrf.link.info.sberbank.ru",
"s.coop",
"scurtare-url.hi2.ro",
"sdut.us",
"securityexpert.ru",
"securl.ru",
"sendgrid.net",
"sendit.in",
"sendsay.ru",
"sendurl.info",
"sg4d.com",
"sg-url.tk",
"shadyurl.com",
"share.flocktory.com",
"shar.es",
"shink.de",
"shiturl.com",
"shli.de",
"shorl.com",
"shortb.net",
"shorten.im",
"shorten.ws",
"short.ie",
"short.im",
"shortlinks.co.uk",
"short-me.com",
"shortner.com",
"shortn.me",
"short.nr",
"short.su",
"short.to",
"shorturl.asia",
"shorturl.com",
"short-url.co.uk",
"shorturls.co.uk",
"shortz.me",
"shout.to",
"show.my",
"shrinkee.com",
"shrinkify.com",
"shrinkr.com",
"shrten.com",
"shrt.fr",
"shrtl.com",
"shrt.st",
"shrunkin.com",
"shx.in",
"simplesite.com",
"simurl.com",
"sitefwd.com",
"sk9.pl",
"slate.me",
"sli.su",
"slki.ru",
"sl.to",
"smallr.com",
"smallurl.in",
"smallurl.ru",
"smalur.com",
"s-m.co",
"smsh.me",
"smurl.ca",
"smurl.name",
"sn9.ru",
"sn.im",
"snipr.com",
"snipurl.com",
"snurl.com",
"softlinemail.ru",
"sokrati.ru",
"somexyz.com",
"song.ly",
"sorturl.net",
"so.vg",
"sp2.ro",
"spedr.com",
"speed-tester.info",
"sq6.ru",
"srclick.ru",
"srcom.net",
"srnk.net",
"srs.li",
"srtn.me",
"starts.com",
"starturl.com",
"stat-pulse.com",
"stnx.at",
"stump.ws",
"su.ly",
"su.pr",
"surl.co.uk",
"surl.hu",
"surl.me",
"surs.nl",
"susurl.com",
"swturl.com",
"t1ny.net",
"ta.gd",
"ta.gg",
"tagiturl.com",
"taourl.com",
"tbd.ly",
"t.cn",
"t.co",
"tcrn.ch",
"techto.us",
"tez.co",
"tgl.net",
"tgr.me",
"tgr.ph",
"th8.us",
"thexyz.org",
"thinfi.com",
"th.ly",
"thnlnk.com",
"thurl.in",
"tie.ly",
"tighturl.com",
"tin.cc",
"tiniuri.com",
"tiny9.com",
"tinyarro.ws",
"tiny.by",
"tiny.cc",
"tinyit.cc",
"tinylink.ca",
"tinylink.in",
"tiny.ly",
"tiny.pl",
"tiny.ps",
"tinyuri.ca",
"tinyurl.com",
"tinyurl.ru",
"tki.me",
"tldr.in",
"tl.gd",
"t.lh.com",
"tlim.ru",
"tllg.net",
"tmi.me",
"tnij.org",
"tny.com",
"tny.tc",
"to8.cc",
"togoto.us",
"to.je",
"to.ly",
"toma.ai",
"tos.co",
"totc.us",
"tourl.fr",
"toysr.us",
"tozm.com",
"tpm.ly",
"tra.kz",
"track-mail.skbkontur.ru",
"trg.li",
"trii.us",
"tr.im",
"trimurl.me",
"trk.emlbest.com",
"trk.klclick.com",
"trk.klclick1.com",
"trk.klclick2.com",
"trk.klclick3.com",
"trunc.it",
"trusteml.com",
"tty.su",
"tuckinfo.com",
"tux-pla.net",
"tvsl.eu",
"tweet.ms",
"tweez.me",
"twhub.com",
"twirl.at",
"twitclicks.com",
"twitter.com",
"twitterurl.net",
"twiturl.de",
"twiu.ru",
"twurl.cc",
"twurl.nl",
"tyny.me",
"u2s.in",
"u76.org",
"ub0.cc",
"u.info-mg.ru",
"ukril.ru",
"ulk.me",
"ulmart.ru",
"ulo.me",
"ulu.lu",
"u.mavrev.com",
"umenytt.se",
"unfake.it",
"u.nu",
"updating.me",
"ur1.ca",
"ur3.us",
"ural-tender.ru",
"url2.ru",
"url360.me",
"url3.ru",
"url4.eu",
"url4.ru",
"url4t.com",
"url5.ru",
"url66.com",
"urla.ru",
"url.az",
"url.b24.am",
"urlbit.us",
"urlborg.com",
"urlbrief.com",
"urlcantik.com",
"urlclick.ru",
"url.cn",
"urlcorta.es",
"url.co.uk",
"urlcover.com",
"urlcut.com",
"urldefender.com",
"urldefense.com",
"urldepo.ru",
"url.dflix.net",
"urlel.com",
"urlenco.de",
"urle.us",
"url.g4team.com",
"urlgator.com",
"urlgeo.me",
"urlg.in",
"url-go.com",
"urlgo.ru",
"url.ie",
"urlin.it",
"urlink.eu",
"urli.nl",
"urlite.de",
"url.lotpatrol.com",
"urlmint.com",
"url.mk.ua",
"urlms.com",
"urloid.com",
"urloo.com",
"urlot.com",
"urlredo.com",
"urlscott.com",
"urls.co.za",
"url.shinri.biz",
"urlshorteningservicefortwitter.com",
"urlshort.me",
"urls.im",
"urlsim.com",
"urlsnip.com",
"urlsp.in",
"urlsqueeze.com",
"urls.vg",
"urltwit.com",
"urlu.ms",
"urlus.ru",
"url.vsofte.ru",
"urlx.ie",
"urlxs.fr",
"ur.ly",
"url.yanclex.com",
"urlz.at",
"urlzen.com",
"url-zip.com",
"urlz.ro",
"usat.ly",
"use.my",
"u.to",
"uud.in",
"uuu.su",
"uww.me",
"uyurl.com",
"vani.sh",
"vash-repetitor.ru",
"vb.ly",
"vc8.net",
"vgn.am",
"view.my",
"vk.cc",
"vl.am",
"vll.me",
"vog.me",
"vovka.com",
"vst.tv",
"w3t.org",
"w55.de",
"wa.la",
"wapo.st",
"wapurl.co.uk",
"warble.co",
"webformyself.com",
"weblist.kharkov.ua",
"weburl.me",
"weeclix.com",
"wez.su",
"whspr.it",
"widg.me",
"wik.ro",
"wipi.es",
"wlatcy-moch.tk",
"wlink.me.uk",
"wmturls.com",
"wom.im",
"wowurl.com",
"wp.me",
"wp.nu",
"wurl.in",
"wurl.us",
"wuw.su",
"ww.tl",
"clickmeeting.com",
"grandstreamnetworks.ru",
"reg.ru",
"wz.ae",
"x2t.com",
"xaa.su",
"xav.cc",
"xcqv.com",
"xcs.me",
"xd5.net",
"xdvn.net",
"xew.co",
"xops.fr",
"xp.cm",
"xr.com",
"xrl.in",
"xrls.tk",
"xrl.us",
"x-url.com",
"xurl.es",
"xurl.jp",
"x.vu",
"xvx.su",
"xw6.com",
"xxsurl.de",
"xxw.me",
"y.ahoo.it",
"yatuc.com",
"ydn.ru",
"ye.pe",
"yep.it",
"yfrog.com",
"yhoo.it",
"yi.pe",
"yiyd.com",
"ysu.me",
"yuarel.com",
"yurl.in",
"y-url.ru",
"yurl.ru",
"z0p.de",
"z2z.ca",
"zapt.in",
"zazi.me",
"zcom.us",
"zebratelecom.ru",
"zeep.in",
"zi.ma",
"zi.mu",
"zio.in",
"zipmyurl.com",
"zolp.net",
"zrps.info",
"zti.me",
"zud.me",
"zurl.ws",
"zxc9.com",
"zzang.kr",
"zz.gd"}