Need to filter ALL email

cPanelMichael

Administrator

Staff member

Jan 9, 2015

#21

You may want to consider posting on the Exim mailing list if you are unable to receive sufficient user-feedback to the custom filter rule questions on our forums here.

Exim-users Info Page

Thank you.

C

chavycha

Registered

Jan 14, 2015

#22

I have a similar problem. The following works fine:

Code:

if first_delivery
and ("$h_to:" contains ".link")
or ("$h_from:" contains ".link")
then
headers add "SpamRule: EXIM FILTER Blocked CONTAINS LINK (was: $h_subject:)"
deliver "Global Spam <[email protected]>"
seen finish
endif

but this doesn't:

Code:

if first_delivery
and ("$h_to:" ends ".link")
or ("$h_from:" e ".link")
then
headers add "SpamRule: EXIM FILTER Blocked ENDS WITH LINK (was: $h_subject:)"
deliver "Global Spam <[email protected]>"
seen finish
endif

I get false positives when sending to, say, something.linkedin.com and other similar domains.
It's not a big problem for .link, but is a big issue for others (.in, .co, etc.).

Any hints would be appreciated!

Last edited by a moderator: Jan 14, 2015

S

StoneyCreeker

Well-Known Member

Mar 13, 2015

#23

chavycha said:
I have a similar problem. The following works fine:

Code:

if first_delivery and ("$h_to:" contains ".link") or ("$h_from:" contains ".link") then headers add "SpamRule: EXIM FILTER Blocked CONTAINS LINK (was: $h_subject:)" deliver "Global Spam <[email protected]>" seen finish endif

but this doesn't:

Code:

if first_delivery and ("$h_to:" ends ".link") or ("$h_from:" e ".link") then headers add "SpamRule: EXIM FILTER Blocked ENDS WITH LINK (was: $h_subject:)" deliver "Global Spam <[email protected]>" seen finish endif

I get false positives when sending to, say, something.linkedin.com and other similar domains.
It's not a big problem for .link, but is a big issue for others (.in, .co, etc.).

Any hints would be appreciated!

Lately I've been using:

Code:

#Block .asia
if first_delivery
and ("$h_from:" matches " [email protected]+\.asia")
or ("$h_to:" matches " [email protected]+\.asia")
then
 headers add "SpamRule: EXIM FILTER Block Asia (was: $h_subject:)"
deliver "Country Spam <[email protected]>"
seen finish
endif

It should work for .link too.

Last edited: Mar 13, 2015

S

StoneyCreeker

Well-Known Member

Mar 19, 2015

#24

Now I am using this syntax and it is working great!
It blocks 500 to 2000 every day and after 3 days of watching the [email protected] account carefully, I have not seen 1 false positive yet

from this one. Warning!! It might cause them for you. Please watch the results carefully.

Code:

# Block Newfangled Domains
if first_delivery
and (
 ("$h_from:" matches " [email protected]+\.space[^a-zA-Z0-9_]")
 or ("$h_from:" matches " [email protected]+\.work[^a-zA-Z0-9_]")
 or ("$h_from:" matches " [email protected]+\.click[^a-zA-Z0-9_]")
 or ("$h_from:" matches " [email protected]+\.link[^a-zA-Z0-9_]") 
 or ("$h_from:" matches " [email protected]+\.rocks[^a-zA-Z0-9_]")
 or ("$h_from:" matches " [email protected]+\.science[^a-zA-Z0-9_]")
 )
 then
 headers add "SpamRule: EXIM FILTER Block Newfangled Domains (was: $h_subject:)"
 deliver "[email protected]>"
 seen finish
endif

After the rule runs it adds a new header to the email named "EXIM FILTER Block Newfangled Domains" to help me track this rule and it also adds the old subject afterwards starting with "was" to also help me identify the spam in process.

It then delivers it to one of my email accounts so I can check the results for false positives.

This rule set stops more spam than all 2613 lines I have written before I figured this one out.

I have it listed first in my list of rules right after the False Positive bypass rule set:

Code:

# These are custom bypass the rules rules due to false positives
if first_delivery
and
 (
 $h_from: contains "a1aexpressautoshipping.com"
 or $h_from: contains "amazon.com"
 or $h_from: contains "alltrails.com"
 or $h_from: contains "Advance Auto Parts"
 or $h_from: contains "ebay.com" 
 or $h_from: contains "exim.org" 
 or $h_from: contains "freakmail.de" 
 or $h_subject: contains "Germkiller"
 or $h_subject: contains "instructables"
 or $h_from: contains "instructables"
 or $h_from: contains "[email protected]|[email protected]"
 or $h_from: contains "jpcycles"
 or $h_from: contains "mozilla.org"
 or $h_from: contains "patient-message.com"
 or $h_from: contains "pandora.com"
 or $h_subject: contains "shrinenet.org" 
 or $h_from: contains "ted.com"
 or $h_from: contains "tigerdirect.com"
 or $h_subject: contains "WEATHER ALERT for TN"
 or $h_from: contains "messages.webmd.com"
 or $h_from: contains "@WindowsSecrets.com"
 or $h_subject: contains "Your Alerts from ZDNet"
 or $h_from: contains "ZDNet"
 or $h_from: contains "mail.synchronybank.com"
 or $h_from: contains "exim"
 or $h_from: contains "mxtoolbox"
 or $h_from: contains "webmd.com"
 or $h_from: contains "@americasautoauction.com"
 or $h_from: contains "[email protected]"
 or $h_subject: contains "Greensboro Auto"
 or $h_from: contains "Greensboro Auto"
 or $h_from: contains "photobucket"
 or $h_from: contains "[email protected]"
 or $h_from: contains "@swingbyswing.com"
 or $h_from: contains "toyota"
  or $h_from: contains "alstom.com" 
 or $h_from: contains "booking.com" 
 or $h_from: contains "@lge-ku.com"
 or $h_Subject: contains "LG\\&\\E"
 or $h_Subject: contains "and KU"
 or $h_from: contains "@gapac.com" 
 or $h_from: contains "[email protected]"
 or $message_headers: contains "Bear Island" 
 or $h_from: contains "@service.govdelivery.com"
 or ("$h_from:" matches " [email protected]+\.govdelivery.com")
 or $h_from: contains "centraldispatch"
 or $h_subject: contains "Hot Properties Alert"
 or $h_from: contains "rolledalloys"
 or $h_from: contains "naccchildlaw.org"
 or $h_from: contains "justia.com" 
 or $h_from: contains "[email protected]"
 or $h_from: contains "spartan.com" 
 or $h_from: contains "squareup.com"
 or $h_from: contains "state.tn.us"
 or $h_subject: contains "tn.gov"
 or $h_from: contains "tn.gov"
 or $h_from: contains ".gov"
 )
then 
 finish
endif

I hope this helps others writing exim spam rules.

Stoney

Osama Tariq

Well-Known Member

Aug 17, 2015

#25

I want to allow googlegroups for specific domain and blocked for remaining domains. I have using below acls.
Acl with "Testing" title doesn't work but below acl "Blocking googlegroups" is working perfectly.
Kindly let me know how to fix it.

Code:

############ Testing ############
if
$header_from: is "googlegroups.com"
and $header_from: is "@googlegroups.com"
and $header_from: is "*@googlegroups.com"
then
save "$home/mail/" 660
endif
################################

#################################
####### Section 6 System ######
#################################
###### Blocking googlegroups ##########
logfile /var/log/filter.log 0644
if
($received_protocol is "local"
or $received_protocol is "smtp"
and ("$h_to:, $h_cc:" contains "@googlegroups.com")
or ("$h_from:" contains "@googlegroups.com")
then
logwrite "$tod_full $message_id from $sender_address contained @googlegroups.com keywords"
seen finish
endif

P

pestemal

Registered

Aug 31, 2015

#26

(FORUM ADMIN PLEASE DELETE MY PREVIOUS ENTRY, EDIT FUNCTION DOESN'T WORK )

Hi,
I can discard .click mail for this custom filter rule:

if ("$h_from:" contains ".click")
then
seen finish
endif

But now in "WHM / Mail Delivery Reports" on Result column: Accepted and Event icon is yellow. Only Recipient column different than unfiltered mails: "discarded"
I'd like to show on Result column a result message, for example "discarded by a custom filter". Also "Event" icon have to yellow filter icon. is it possible for this filter method? How?

A

afernandez

Member

PartnerNOC

Aug 31, 2015

#27

Hello,

About the same case,
I've tried to create a rule using a PCRE regex to filter these TDL:

Code:

if first_delivery
and ("$h_to:, $h_cc:" matches "[a-zA-Z\\\\[email protected]_-]*\\\\.(?:review|date|work|xyz|faith)\\$")
or ("$h_from:" matches "[a-zA-Z\\\\[email protected]_-]*\\\\.(?:review|date|work|xyz|faith)\\$")
then
seen finish
endif

Exim is not showing any error, but not made any filtering.

I test the expresion on pcretest:

Code:

[a-zA-Z\[email protected]_-]*\.(?:review|date|work|xyz|faith)$

And it works normally if I set the M flag

I re-test this expresion creating a filter in cPanel option: "Account Level Filtering", and it's works fine; but when I copy this rule from /etc/vfilters/domain.tld to /etc/cpanel_exim_system_filter, its not filter anything.

Please, Could you give a hand with this issue?

Thank you.

cPanelMichael

Administrator

Staff member

Sep 8, 2015

#28

I've merged some additional posts into this thread. Please check if the most recent user-submitted solution is helpful:

https://forums.cpanel.net/threads/need-to-filter-all-email.348741/page-2#post-1853701

Thank you.

E

ebizindia

Well-Known Member

Sep 12, 2015

#29

I am using this line in my filter file:

Code:

if $h_from: matches "[email protected]+\.(xyz|link|date|mobi|ninja|rocks|click|party|webcam|faith|racing|review|science|space|us|website|win|work)[^a-zA-Z0-9_]*"

It is working well to block spam messages. However it is also blocking several mails that should not be blocked.

For example, mails from these addresses were blocked.
[email protected]
[email protected]
[email protected]

None of these match the filter rule. Any feedback is appreciated.

Last edited by a moderator: Sep 14, 2015

E

ebizindia

Well-Known Member

Sep 12, 2015

#30

I think the system is rejecting all mails that have .in in the domain name. Any reason why?

S

StoneyCreeker

Well-Known Member

Sep 18, 2015

#31

I am using this in my cpanel_exim_system_filter file in ../etc and so far it is working without false positives:

Code:

# Block Newfangled Domain Spam
# THESE BLOCK MORE SPAM THAN ALL THE OTHER RULES COMBINED!

if first_delivery
and (
("$h_from:" matches "[email protected]+\\\\.click[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.ch[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.cricket[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.asia[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.ec[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.exercise[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.co.in[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.gen.in[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.it[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.net.in[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.link[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.ninja[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.review[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.rocks[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.science[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.space[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.sk[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.uno[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.website[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.work[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.xyz[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.za[^a-zA-Z0-9_]")
)
then
headers add "SpamRule: EXIM FILTER Block Newfangled Domains (was: $h_subject:)"
deliver "Newfangled <[email protected]>"
seen finish
endif

You can omit the "headers add" line and the "deliver" line to just delete them if you dare.
Hope this helps.

Reactions: ideamktg

E

ebizindia

Well-Known Member

Sep 19, 2015

#32

AFAIK, this assumes that the address has a character after the extension (say .za) which is none of the given characters. Does the from address have a trailing space or another special character?

I

ideamktg

Registered

Oct 6, 2015

#33

StoneyCreeker said:

I have it listed first in my list of rules right after the False Positive bypass rule set:

Code:

# These are custom bypass the rules rules due to false positives
if first_delivery
and
(
$h_from: contains "a1aexpressautoshipping.com"
or $h_from: contains "amazon.com"
or $h_from: contains "alltrails.com"
or $h_from: contains "Advance Auto Parts"
or $h_from: contains "ebay.com"
or $h_from: contains "exim.org"
or $h_from: contains "freakmail.de"
or $h_subject: contains "Germkiller"
or $h_subject: contains "instructables"
or $h_from: contains "instructables"
or $h_from: contains "[email protected]|[email protected]"
or $h_from: contains "jpcycles"
or $h_from: contains "mozilla.org"
or $h_from: contains "patient-message.com"
or $h_from: contains "pandora.com"
or $h_subject: contains "shrinenet.org"
or $h_from: contains "ted.com"
or $h_from: contains "tigerdirect.com"
or $h_subject: contains "WEATHER ALERT for TN"
or $h_from: contains "messages.webmd.com"
or $h_from: contains "@WindowsSecrets.com"
or $h_subject: contains "Your Alerts from ZDNet"
or $h_from: contains "ZDNet"
or $h_from: contains "mail.synchronybank.com"
or $h_from: contains "exim"
or $h_from: contains "mxtoolbox"
or $h_from: contains "webmd.com"
or $h_from: contains "@americasautoauction.com"
or $h_from: contains "[email protected]"
or $h_subject: contains "Greensboro Auto"
or $h_from: contains "Greensboro Auto"
or $h_from: contains "photobucket"
or $h_from: contains "[email protected]"
or $h_from: contains "@swingbyswing.com"
or $h_from: contains "toyota"
  or $h_from: contains "alstom.com"
or $h_from: contains "booking.com"
or $h_from: contains "@lge-ku.com"
or $h_Subject: contains "LG\\&\\E"
or $h_Subject: contains "and KU"
or $h_from: contains "@gapac.com"
or $h_from: contains "[email protected]"
or $message_headers: contains "Bear Island"
or $h_from: contains "@service.govdelivery.com"
or ("$h_from:" matches " [email protected]+\.govdelivery.com")
or $h_from: contains "centraldispatch"
or $h_subject: contains "Hot Properties Alert"
or $h_from: contains "rolledalloys"
or $h_from: contains "naccchildlaw.org"
or $h_from: contains "justia.com"
or $h_from: contains "[email protected]"
or $h_from: contains "spartan.com"
or $h_from: contains "squareup.com"
or $h_from: contains "state.tn.us"
or $h_subject: contains "tn.gov"
or $h_from: contains "tn.gov"
or $h_from: contains ".gov"
)
then
finish
endif

I hope this helps others writing exim spam rules.

Stoney

Hi Stoney,
Could you show how you placed the false/positive rule in with the other filters? I use both the Newfangled domains and a spam trap of headers contain. I found your post a while back and it works great but I have one email that is getting caught and need to let it pass through. When I add the rule, it just seems to cause a jam in our mail queue. I would really appreciate the help.

Thanks,
Darren

Last edited by a moderator: Oct 6, 2015

S

StoneyCreeker

Well-Known Member

Oct 7, 2015

#34

The false positive rule is the first one so it runs prior to all the rest.
Maybe instead of using:

Code:

 or $h_from: contains "ebay.com"

you might try:

Code:

 or $h_from: contains "[email protected]"

or even:

Code:

  or ("$h_from:" matches "[email protected]")

If the email address you are trying to whitelist has a period in it then it will need to be escaped if you use the "matches" parameter. I think it might be like this:

Code:

  or ("$h_from:" matches "joe\\.smiley\@ebay.com")

I may have that wrong.
Please see http://www.exim.org/exim-html-4.72/doc/html/filter.html#SEC00 for more help on this.

I

ideamktg

Registered

Oct 7, 2015

#35

StoneyCreeker said:
The false positive rule is the first one so it runs prior to all the rest.
Maybe instead of using:

Code:

or $h_from: contains "ebay.com"

you might try:

Code:

or $h_from: contains "[email protected]"

or even:

Code:

or ("$h_from:" matches "[email protected]")

If the email address you are trying to whitelist has a period in it then it will need to be escaped if you use the "matches" parameter. I think it might be like this:

Code:

or ("$h_from:" matches "joe\\.smiley\@ebay.com")

I may have that wrong.
Please see http://www.exim.org/exim-html-4.72/doc/html/filter.html#SEC00 for more help on this.

So it would have first delivery and then the ones below would just be if? Would it be something like this? Sorry, struggling with it. This is what I tried:

Code:

# These are custom bypass the rules rules due to false positives
if first_delivery
and
 (
 or $h_from: contains "mcafee.com"
 )
then
 finish
endif

# Block Newfangled Domains
if
and (
  ("$h_from:" matches "[email protected]+\\\\.click[^a-zA-Z0-9_]")
 or ("$h_from:" matches "[email protected]+\\\\.club[^a-zA-Z0-9_]")
 or ("$h_from:" matches "[email protected]+\\\\.date[^a-zA-Z0-9_]")
 )
 then
 headers add "SpamRule: EXIM FILTER Block Newfangled Domains (was: $h_subject:)"
 deliver "Newfangled <[email protected]>"
 seen finish
endif

# Spamtrap
if
 $message_headers contains "esurface"
 or $header_subject: contains "Off V1agra"
 or $header_subject: contains "WhosWho"
 or $header_subject: contains "WhosWho."
 or $header_subject: contains "ED Pills"
 or $header_subject: contains "ED Pill"
 or $header_subject: contains "SC0RE"
 or $message_headers contains "aig.direct"
 or $message_headers contains "aig-direct"
 or $message_headers contains "aig_direct"
 then
 headers add "SpamRule: EXIM FILTER Block Spamtrap (was: $h_subject:)"
 deliver "Spamtrap <[email protected]>"
 seen finish
endif

S

StoneyCreeker

Well-Known Member

Oct 13, 2015

#36

I copied it from my code page. Please remove the beginning "or" from
(
or $h_from: contains "mcafee.com"
)

Sorry for the delayed response....

Maybe this will help a little:

Here's how I check for filter syntax errors:

In WHM go to: Home > Email > Mail Queue Manager
It should automatically run a 1 day report. If there are items in the list, try to deliver one. The resulting window will either say "Process Complete" or it will tell you the line number of the error and sometimes why. Sometimes the line numbers are a few off but it will get you in the general area of the error. I copied your mcafee code to my file to test it. In this case when I tried to deliver one it returned this:

LOG: MAIN
cwd=/usr/local/cpanel/whostmgr/docroot 4 args: /usr/sbin/exim -v -M 1Zm2cs-0005qz-Fd
delivering 1Zm2cs-0005qz-Fd
LOG: MAIN PANIC
Error in system filter: unrecognized condition word "$h_from:" near line 250 of filter file

In my filter file line 250 was the trailing ) in your filter.

I removed the "or" and both quotes (), saved the file and then I went back to Mail Queue Manager, checked one email and clicked on "deliver selected". Then I got the message:

LOG: MAIN
cwd=/usr/local/cpanel/whostmgr/docroot 4 args: /usr/sbin/exim -v -M 1Zm2cs-0005qy-BW
delivering 1Zm2cs-0005qy-BW
LOG: MAIN
Completed

Which means delivery was completed.

Now go back to Mail Queue, Now click on "Deliver All" and the queue contents will be delivered.

That is the issue with writing filters. If you make a misteak , your emails will not be delivered and the Queue will start filling up.

Hope this helps you figure this out. It is fun after you get it working, but it can be a challenge until then.

Have a great day!

Last edited: Oct 13, 2015

W

wolfsden3

Member

Nov 7, 2015

#37

StoneyCreeker said:

I am using this in my cpanel_exim_system_filter file in ../etc and so far it is working without false positives:

Code:

# Block Newfangled Domain Spam
# THESE BLOCK MORE SPAM THAN ALL THE OTHER RULES COMBINED!

if first_delivery
and (
("$h_from:" matches "[email protected]+\\\\.click[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.ch[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.cricket[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.asia[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.ec[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.exercise[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.co.in[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.gen.in[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.it[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.net.in[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.link[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.ninja[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.review[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.rocks[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.science[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.space[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.sk[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.uno[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.website[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.work[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.xyz[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\\\.za[^a-zA-Z0-9_]")
)
then
headers add "SpamRule: EXIM FILTER Block Newfangled Domains (was: $h_subject:)"
deliver "Newfangled <[email protected]>"
seen finish
endif

You can omit the "headers add" line and the "deliver" line to just delete them if you dare.
Hope this helps.

Hey StoneyCreeker I took your file and modified it to block all the tldr's I don't want which are most of them but when I apply it in WHM I get this:

Code:

2015-11-07 12:49:07 SMTP connection from [x.x.x.x]:40695 (TCP/IP connection count = 2)
2015-11-07 12:49:07 1Zv7bv-0006qC-Nm H=ip x.x.x.x (email.example.com) [x.x.x.x]:40695 Warning: Message has been scanned: no virus or other harmful content was found
2015-11-07 12:49:07 1Zv7bv-0006qC-Nm <= [EMAIL][email protected][/EMAIL] H=ip x-x-x-x.whatever.example.net (email.example.com) [x.x.x.x]:40695 P=esmtps X=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=3085 [email protected] T="Test 8" for [EMAIL][email protected][/EMAIL]
2015-11-07 12:49:07 SMTP connection from ip x-x-x-x.whatever.example.net (email.example.com) [x.x.x.x]:40695 closed by QUIT
2015-11-07 12:49:07 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1Zv7bv-0006qC-Nm
2015-11-07 12:49:07 1Zv7bv-0006qC-Nm => discarded (system filter)
2015-11-07 12:49:07 1Zv7bv-0006qC-Nm Completed

So...when the email comes through it says:

=> discarded (system filter)

Here is my file:

Code:

# cat global_tld_block
# Reference:  [URL='https://forums.cpanel.net/threads/need-to-filter-all-email.348741/page-2']Need to filter ALL email[/URL]
# Block lame domains
# THESE BLOCK MORE SPAM THAN ALL THE OTHER RULES COMBINED!

if first_delivery
and ("$h_from:" matches "[email protected]+\\\\.aaa[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.abb[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.abbott[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.abogado[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ac[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.academy[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.accenture[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.accountant[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.accountants[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.aco[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.active[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.actor[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ad[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ads[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.adult[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ae[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.aeg[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.aero[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.af[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.afl[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ag[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.agency[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ai[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.aig[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.airforce[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.airtel[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.al[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.allfinanz[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.alsace[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.am[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.amica[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.amsterdam[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.an[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.android[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ao[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.apartments[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.app[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.aq[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.aquarelle[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ar[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.archi[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.army[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.arpa[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.as[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.asia[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.associates[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.at[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.attorney[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.au[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.auction[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.audio[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.auto[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.autos[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.aw[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ax[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.axa[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.az[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.azure[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ba[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.band[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bank[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bar[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.barcelona[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.barclaycard[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.barclays[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bargains[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bauhaus[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bayern[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bb[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bbc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bbva[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bcn[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bd[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.be[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.beer[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bentley[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.berlin[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.best[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bet[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bf[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bg[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bh[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bharti[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bi[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bible[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bid[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bike[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bing[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bingo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bio[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bj[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bl[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.black[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.blackfriday[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bloomberg[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.blue[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bm[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bmw[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bn[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bnl[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bnpparibas[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.boats[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bond[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.boo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.boots[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.boutique[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bq[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.br[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bradesco[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bridgestone[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.broker[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.brother[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.brussels[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bs[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bt[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.budapest[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.build[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.builders[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.business[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.buzz[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bv[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bw[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.by[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bz[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.bzh[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cab[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cafe[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cal[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.camera[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.camp[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cancerresearch[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.canon[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.capetown[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.capital[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.caravan[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cards[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.care[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.career[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.careers[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cars[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cartier[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.casa[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cash[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.casino[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cat[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.catering[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cba[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cbn[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cd[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ceb[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.center[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ceo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cern[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cf[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cfa[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cfd[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cg[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ch[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.chanel[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.channel[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.chat[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cheap[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.chloe[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.christmas[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.chrome[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.church[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ci[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cisco[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.citic[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.city[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ck[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cl[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.claims[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cleaning[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.click[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.clinic[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.clothing[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cloud[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.club[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cm[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cn[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.coach[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.codes[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.coffee[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.college[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cologne[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.commbank[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.community[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.company[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.computer[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.condos[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.construction[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.consulting[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.contractors[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cooking[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cool[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.coop[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.corsica[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.country[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.coupons[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.courses[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cr[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.credit[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.creditcard[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cricket[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.crown[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.crs[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cruises[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cu[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cuisinella[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cv[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cw[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cx[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cy[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cymru[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cyou[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.cz[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.dabur[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.dad[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.dance[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.date[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.dating[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.datsun[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.day[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.dclk[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.de[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.deals[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.degree[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.delivery[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.delta[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.democrat[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.dental[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.dentist[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.desi[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.design[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.dev[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.diamonds[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.diet[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.digital[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.direct[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.directory[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.discount[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.dj[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.dk[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.dm[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.dnp[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.do[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.docs[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.dog[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.doha[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.domains[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.doosan[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.download[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.drive[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.durban[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.dvag[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.dz[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.earth[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.eat[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ec[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.education[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ee[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.eg[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.eh[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.email[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.emerck[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.energy[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.engineer[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.engineering[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.enterprises[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.epson[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.equipment[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.er[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.erni[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.es[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.esq[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.estate[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.et[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.eu[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.eurovision[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.eus[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.events[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.everbank[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.exchange[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.expert[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.exposed[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.express[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fage[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fail[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.faith[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.family[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fan[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fans[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.farm[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fashion[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.feedback[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fi[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.film[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.finance[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.financial[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.firmdale[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fish[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fishing[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fit[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fitness[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fj[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fk[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.flights[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.florist[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.flowers[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.flsmidth[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fly[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fm[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.foo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.football[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.forex[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.forsale[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.forum[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.foundation[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fr[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.frl[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.frogans[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fund[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.furniture[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.futbol[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.fyi[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ga[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gal[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gallery[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.game[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.garden[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gb[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gbiz[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gd[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gdn[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ge[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gea[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gent[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.genting[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gf[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gg[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ggee[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gh[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gi[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gift[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gifts[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gives[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.giving[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gl[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.glass[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gle[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.global[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.globo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gm[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gmail[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gmo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gmx[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gn[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gold[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.goldpoint[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.golf[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.goo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.goog[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.google[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gop[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gp[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gq[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gr[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.graphics[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gratis[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.green[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gripe[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.group[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gs[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gt[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gu[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.guge[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.guide[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.guitars[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.guru[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gw[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.gy[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.hamburg[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.hangout[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.haus[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.healthcare[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.help[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.here[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.hermes[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.hiphop[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.hitachi[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.hiv[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.hk[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.hm[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.hn[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.hockey[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.holdings[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.holiday[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.homedepot[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.homes[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.honda[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.horse[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.host[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.hosting[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.hoteles[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.hotmail[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.house[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.how[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.hr[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.hsbc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ht[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.hu[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ibm[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.icbc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ice[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.icu[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.id[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ie[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ifm[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.iinet[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.il[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.im[^a-zA-Z0-9_]")
or ("$h_from:" matches ".[email protected]+\\.immo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.immobilien[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.in[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.in.net[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.industries[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.infiniti[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ing[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ink[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.institute[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.insure[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.int[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.international[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.investments[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.io[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ipiranga[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.iq[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ir[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.irish[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ist[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.istanbul[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.it[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.itau[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.iwc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.java[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.jcb[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.je[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.jetzt[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.jewelry[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.jlc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.jll[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.jm[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.jo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.jobs[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.joburg[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.jprs[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.juegos[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.kaufen[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.kddi[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ke[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.kg[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.kh[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ki[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.kim[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.kitchen[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.kiwi[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.km[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.kn[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.koeln[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.komatsu[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.kp[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.kr[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.krd[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.kred[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.kw[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ky[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.kyoto[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.kz[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.la[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lacaixa[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lancaster[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.land[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lasalle[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lat[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.latrobe[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.law[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lawyer[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lb[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lds[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lease[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.leclerc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.legal[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lexus[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lgbt[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.li[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.liaison[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lidl[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.life[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lighting[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.limited[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.limo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.link[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.live[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lixil[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lk[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.loan[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.loans[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lol[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.london[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lotte[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lotto[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.love[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lr[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ls[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lt[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ltda[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lu[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lupin[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.luxe[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.luxury[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.lv[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ly[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ma[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.madrid[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.maif[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.maison[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.man[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.management[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mango[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.market[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.marketing[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.markets[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.marriott[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mba[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.md[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.me[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.media[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.meet[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.melbourne[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.meme[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.memorial[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.men[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.menu[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mf[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mg[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mh[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.miami[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.microsoft[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mini[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mk[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ml[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mm[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mma[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mn[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mobi[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.moda[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.moe[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mom[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.monash[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.money[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.montblanc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mormon[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mortgage[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.moscow[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.motorcycles[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mov[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.movie[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.movistar[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mp[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mq[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mr[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ms[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mt[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mtn[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mtpc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mu[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.museum[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mv[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mw[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mx[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.my[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.mz[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.na[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nadex[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nagoya[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.name[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.navy[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ne[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nec[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.netbank[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.network[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.neustar[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.new[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.news[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nexus[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nf[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ng[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ngo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nhk[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ni[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nico[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ninja[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nissan[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nl[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.no[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nokia[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.np[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nr[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nra[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nrw[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ntt[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nu[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nyc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.nz[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.office[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.okinawa[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.om[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.omega[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.one[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ong[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.onl[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.online[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ooo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.oracle[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.orange[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.organic[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.osaka[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.otsuka[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ovh[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pa[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.page[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.panerai[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.paris[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.partners[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.parts[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.party[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pe[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pet[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pf[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pg[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ph[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pharmacy[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.philips[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.photo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.photography[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.photos[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.physio[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.piaget[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pics[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pictet[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pictures[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pink[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pizza[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pk[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pl[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.place[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.play[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.plumbing[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.plus[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pm[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pn[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pohl[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.poker[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.porn[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.post[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pr[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.praxi[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.press[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pro[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.prod[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.productions[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.prof[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.properties[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.property[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ps[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pt[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pub[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.pw[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.py[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.qa[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.qpon[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.quebec[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.racing[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.re[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.realtor[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.realty[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.recipes[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.red[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.redstone[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.rehab[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.reise[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.reisen[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.reit[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ren[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.rent[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.rentals[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.repair[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.report[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.republican[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.rest[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.restaurant[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.review[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.reviews[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.rich[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ricoh[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.rio[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.rip[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ro[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.rocks[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.rodeo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.rs[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.rsvp[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ru[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ruhr[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.run[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.rw[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ryukyu[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sa[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.saarland[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sakura[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sale[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.samsung[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sandvik[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sandvikcoromant[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sanofi[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sap[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sarl[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.saxo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sb[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sca[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.scb[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.schmidt[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.scholarships[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.school[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.schule[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.schwarz[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.science[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.scor[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.scot[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sd[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.se[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.seat[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.seek[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sener[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.services[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sew[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sex[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sexy[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sg[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sh[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.shiksha[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.shoes[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.show[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.shriram[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.si[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.singles[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.site[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sj[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sk[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ski[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sky[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.skype[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sl[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sm[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sn[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sncf[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.so[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.soccer[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.social[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.software[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sohu[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.solar[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.solutions[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sony[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.soy[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.space[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.spiegel[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.spreadbetting[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sr[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.srl[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ss[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.st[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.starhub[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.statoil[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.stc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.stcgroup[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.studio[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.study[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.style[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.su[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sucks[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.supplies[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.supply[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.support[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.surf[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.surgery[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.suzuki[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sv[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.swatch[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.swiss[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sx[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sy[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sydney[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.systems[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.sz[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.taipei[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tatamotors[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tatar[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tattoo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tax[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.taxi[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.td[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.team[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tech[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.technology[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tel[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.telefonica[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.temasek[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tennis[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tf[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tg[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.th[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.thd[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.theater[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tickets[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tienda[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tips[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tires[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tirol[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tj[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tk[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tl[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tm[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tn[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.to[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.today[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tokyo[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tools[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.top[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.toray[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.toshiba[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tours[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.town[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.toyota[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.toys[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tp[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tr[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.trade[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.trading[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.training[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.travel[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.trust[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tt[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tui[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tv[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tw[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.tz[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ua[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ubs[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ug[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.uk[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.um[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.university[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.uno[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.uol[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.us[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.uy[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.uz[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.va[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.vacations[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.vc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ve[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.vegas[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ventures[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.versicherung[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.vet[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.vg[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.vi[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.viajes[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.video[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.villas[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.vin[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.vision[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.vista[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.vistaprint[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.viva[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.vlaanderen[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.vn[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.vodka[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.vote[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.voting[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.voto[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.voyage[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.vu[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.wales[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.walter[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.wang[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.watch[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.webcam[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.website[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.wed[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.wedding[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.weir[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.wf[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.whoswho[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.wien[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.wiki[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.williamhill[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.win[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.windows[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.wine[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.wme[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.work[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.works[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.world[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ws[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.wtc[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.wtf[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.xbox[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.xerox[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.xin[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.рус[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.xperia[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.xxx[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.xyz[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.yachts[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.yandex[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.ye[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.yodobashi[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.yoga[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.yokohama[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.youtube[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.yt[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.za[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.zip[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.zm[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.zone[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.zuerich[^a-zA-Z0-9_]")
or ("$h_from:" matches "[email protected]+\\.zw[^a-zA-Z0-9_]")

then
# Uncommend to forward spam to an inbox
# headers add "SpamRule: EXIM FILTER Block Newfangled Domains (was: $h_subject:$
# deliver "Newfangled <[email protected]>"
seen finish
endif

I noticed that in your post you had:

Code:

if first_delivery
and (
("$h_from:" matches "[email protected]+\\\\.aaa[^a-zA-Z0-9_]")

But I have:

Code:

if first_delivery
and ("$h_from:" matches "[email protected]+\\\\.aaa[^a-zA-Z0-9_]")

* I got rid of one of the "("'s

I'm not a real coder so I'm not certain what this is or isn't causing. I tried it with both and got an error when I have your extra one in the file I made called global_tld_block.

When I run it the way you have it posted I get this error:

Error in system filter: unexpected ")" in line 1194 of filter file

So my file "works" without your extra ellipse BUT what's not working is how my test email is getting blocked when it's from a ".com" domain! I shouldn't get blocked but seems to get blocked.

I don't think I fully understand your syntax.

Any help on this would be appreciated or any insight form anyone else.

Thanks!

Last edited by a moderator: Nov 7, 2015

S

StoneyCreeker

Well-Known Member

Nov 10, 2015

#38

I tried your code and it too re-directed all email including .com.
I noticed you only had 2 backslashes in your code. When I used the "replace" function in wordpad to find \\. and replace it with \\\\. it seems to be working. At least it is not stopping legit emails with the .com extension.

PS I am also still including the whole list in brackets.

That is a huge list!

Hope this helps...

EDIT: I am using your list and will monitor the "newfangled" spam folder for a few hours this afternoon and let you know about false positives. It already caught one from the .xyz domain.

Last edited: Nov 10, 2015

W

wolfsden3

Member

Nov 11, 2015

#39

Stoney - you dah man. I can't believe I missed that syntax error. Once I put in the \\\\'s, works like a charm!

I got that list from the grand daddy list of tld's online. Whomever sanctions them. My fear though is, now; anyone can buy a tld so there will more coming down the road and who uses things other than the real big one's like .com, .net, .edu, .gov, .uk...and a few others like .ca, etc?

Unless you do business with other countries (which you can edit that out of the file) or do business with oddball companies using domains like ".link" then this list is a winner! ;0)

S

StoneyCreeker

Well-Known Member

Nov 11, 2015

#40

The syntax still is not "exactly" correct. It blocked "[email protected]" last night. It should only have blocked "[email protected]". I have a lawyer client that uses that service and I am glad I send them to an email account so I can check for false positives. I hashed # that one out for now. Also it blocked an email from [email protected], the "triple A" auto towing service that was legit.

Maybe some expert coder will run across this issue and offer a better solution.

When I get time I will look into improving the syntax, but I am covered up with another project for the next few weeks.

Thread starter	Similar threads	Forum	Replies	Date
M	I need help writing a global email rule to filter spam.	Email	1	Mar 22, 2020
A	Help needed with Global Filters (body regex)	Email	2	May 16, 2016
S	Need to filter ALL email from [email protected] at account level using CPANEL not WHM	Email	3	Jun 15, 2013
W	Need guide to create email filter (email spoofing)	Email	0	May 17, 2008
E	Email filtering wisdom needed!	Email	5	Jun 1, 2007