Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!

Need to filter ALL email

Discussion in 'E-mail Discussion' started by jols, May 27, 2013.

  1. cPanelMichael

    cPanelMichael Technical Support Community Manager Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    47,335
    Likes Received:
    2,163
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    You may want to consider posting on the Exim mailing list if you are unable to receive sufficient user-feedback to the custom filter rule questions on our forums here.

    Exim-users Info Page

    Thank you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  2. chavycha

    chavycha Registered

    Joined:
    Jan 14, 2015
    Messages:
    0
    Likes Received:
    0
    Trophy Points:
    1
    cPanel Access Level:
    Root Administrator
    I have a similar problem. The following works fine:

    Code:
    if first_delivery
    and ("$h_to:" contains ".link")
    or ("$h_from:" contains ".link")
    then
    headers add "SpamRule: EXIM FILTER Blocked CONTAINS LINK (was: $h_subject:)"
    deliver "Global Spam <alerts@someaddress.com>"
    seen finish
    endif
    but this doesn't:
    Code:
    if first_delivery
    and ("$h_to:" ends ".link")
    or ("$h_from:" e ".link")
    then
    headers add "SpamRule: EXIM FILTER Blocked ENDS WITH LINK (was: $h_subject:)"
    deliver "Global Spam <alerts@domain.com>"
    seen finish
    endif
    I get false positives when sending to, say, something.linkedin.com and other similar domains.
    It's not a big problem for .link, but is a big issue for others (.in, .co, etc.).

    Any hints would be appreciated!
     
    #22 chavycha, Jan 14, 2015
    Last edited by a moderator: Jan 14, 2015
  3. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    53
    Likes Received:
    3
    Trophy Points:
    158
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    Lately I've been using:
    Code:
     
    #Block .asia
    if first_delivery
    and ("$h_from:" matches " .+@.+\.asia")
    or ("$h_to:" matches " .+@.+\.asia")
    then
     headers add "SpamRule: EXIM FILTER Block Asia (was: $h_subject:)"
    deliver "Country Spam <country@mydomain.com>"
    seen finish
    endif
    
    It should work for .link too. :)
     
    #23 StoneyCreeker, Mar 13, 2015
    Last edited: Mar 13, 2015
  4. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    53
    Likes Received:
    3
    Trophy Points:
    158
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    Now I am using this syntax and it is working great!
    It blocks 500 to 2000 every day and after 3 days of watching the newfangleddomaons@mydomain.com account carefully, I have not seen 1 false positive yet :) from this one. Warning!! It might cause them for you. Please watch the results carefully.

    Code:
    # Block Newfangled Domains
    if first_delivery
    and (
     ("$h_from:" matches " .+@.+\.space[^a-zA-Z0-9_]")
     or ("$h_from:" matches " .+@.+\.work[^a-zA-Z0-9_]")
     or ("$h_from:" matches " .+@.+\.click[^a-zA-Z0-9_]")
     or ("$h_from:" matches " .+@.+\.link[^a-zA-Z0-9_]") 
     or ("$h_from:" matches " .+@.+\.rocks[^a-zA-Z0-9_]")
     or ("$h_from:" matches " .+@.+\.science[^a-zA-Z0-9_]")
     )
     then
     headers add "SpamRule: EXIM FILTER Block Newfangled Domains (was: $h_subject:)"
     deliver "newfangleddomains@mydomain.com>"
     seen finish
    endif 
    After the rule runs it adds a new header to the email named "EXIM FILTER Block Newfangled Domains" to help me track this rule and it also adds the old subject afterwards starting with "was" to also help me identify the spam in process.

    It then delivers it to one of my email accounts so I can check the results for false positives.

    This rule set stops more spam than all 2613 lines I have written before I figured this one out.

    I have it listed first in my list of rules right after the False Positive bypass rule set:

    Code:
    # These are custom bypass the rules rules due to false positives
    if first_delivery
    and
     (
     $h_from: contains "a1aexpressautoshipping.com"
     or $h_from: contains "amazon.com"
     or $h_from: contains "alltrails.com"
     or $h_from: contains "Advance Auto Parts"
     or $h_from: contains "ebay.com" 
     or $h_from: contains "exim.org" 
     or $h_from: contains "freakmail.de" 
     or $h_subject: contains "Germkiller"
     or $h_subject: contains "instructables"
     or $h_from: contains "instructables"
     or $h_from: contains "mail@jobungo.com|marketing@cdcnews.com"
     or $h_from: contains "jpcycles"
     or $h_from: contains "mozilla.org"
     or $h_from: contains "patient-message.com"
     or $h_from: contains "pandora.com"
     or $h_subject: contains "shrinenet.org" 
     or $h_from: contains "ted.com"
     or $h_from: contains "tigerdirect.com"
     or $h_subject: contains "WEATHER ALERT for TN"
     or $h_from: contains "messages.webmd.com"
     or $h_from: contains "@WindowsSecrets.com"
     or $h_subject: contains "Your Alerts from ZDNet"
     or $h_from: contains "ZDNet"
     or $h_from: contains "mail.synchronybank.com"
     or $h_from: contains "exim"
     or $h_from: contains "mxtoolbox"
     or $h_from: contains "webmd.com"
     or $h_from: contains "@americasautoauction.com"
     or $h_from: contains "roanvalleyauctioncompany1@gmail.com"
     or $h_subject: contains "Greensboro Auto"
     or $h_from: contains "Greensboro Auto"
     or $h_from: contains "photobucket"
     or $h_from: contains "roanmountainauctioncompany1@gmail.com"
     or $h_from: contains "@swingbyswing.com"
     or $h_from: contains "toyota"
      or $h_from: contains "alstom.com" 
     or $h_from: contains "booking.com" 
     or $h_from: contains "@lge-ku.com"
     or $h_Subject: contains "LG\\&\\E"
     or $h_Subject: contains "and KU"
     or $h_from: contains "@gapac.com" 
     or $h_from: contains "PrecipitatorSeminars@APCNetwork.com"
     or $message_headers: contains "Bear Island" 
     or $h_from: contains "@service.govdelivery.com"
     or ("$h_from:" matches " .+@.+\.govdelivery.com")
     or $h_from: contains "centraldispatch"
     or $h_subject: contains "Hot Properties Alert"
     or $h_from: contains "rolledalloys"
     or $h_from: contains "naccchildlaw.org"
     or $h_from: contains "justia.com" 
     or $h_from: contains "lifefellowshipbaptist@gmail.com"
     or $h_from: contains "spartan.com" 
     or $h_from: contains "squareup.com"
     or $h_from: contains "state.tn.us"
     or $h_subject: contains "tn.gov"
     or $h_from: contains "tn.gov"
     or $h_from: contains ".gov"
     )
    then 
     finish
    endif 
    I hope this helps others writing exim spam rules.

    Stoney
     
  5. Osama Tariq

    Osama Tariq Well-Known Member

    Joined:
    Nov 27, 2014
    Messages:
    206
    Likes Received:
    2
    Trophy Points:
    18
    Location:
    Lahore, Pakistan
    cPanel Access Level:
    Root Administrator
    Twitter:
    I want to allow googlegroups for specific domain and blocked for remaining domains. I have using below acls.
    Acl with "Testing" title doesn't work but below acl "Blocking googlegroups" is working perfectly.
    Kindly let me know how to fix it.


    Code:
    ############ Testing ############
    if
    $header_from: is "googlegroups.com"
    and $header_from: is "@googlegroups.com"
    and $header_from: is "*@googlegroups.com"
    then
    save "$home/mail/" 660
    endif
    ################################
    
    #################################
    ####### Section 6 System ######
    #################################
    ###### Blocking googlegroups ##########
    logfile /var/log/filter.log 0644
    if
    ($received_protocol is "local"
    or $received_protocol is "smtp"
    and ("$h_to:, $h_cc:" contains "@googlegroups.com")
    or ("$h_from:" contains "@googlegroups.com")
    then
    logwrite "$tod_full $message_id from $sender_address contained @googlegroups.com keywords"
    seen finish
    endif
     
  6. pestemal

    pestemal Registered

    Joined:
    Mar 25, 2015
    Messages:
    4
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Türkiye
    cPanel Access Level:
    Root Administrator
    (FORUM ADMIN PLEASE DELETE MY PREVIOUS ENTRY, EDIT FUNCTION DOESN'T WORK )

    Hi,
    I can discard .click mail for this custom filter rule:

    if ("$h_from:" contains ".click")
    then
    seen finish
    endif

    But now in "WHM / Mail Delivery Reports" on Result column: Accepted and Event icon is yellow. Only Recipient column different than unfiltered mails: "discarded"
    I'd like to show on Result column a result message, for example "discarded by a custom filter". Also "Event" icon have to yellow filter icon. is it possible for this filter method? How?
     
  7. afernandez

    afernandez Member PartnerNOC

    Joined:
    Jun 3, 2009
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    51
    Hello,

    About the same case,
    I've tried to create a rule using a PCRE regex to filter these TDL:

    Code:
    if first_delivery
    and ("$h_to:, $h_cc:" matches "[a-zA-Z\\\\.@_-]*\\\\.(?:review|date|work|xyz|faith)\\$")
    or ("$h_from:" matches "[a-zA-Z\\\\.@_-]*\\\\.(?:review|date|work|xyz|faith)\\$")
    then
    seen finish
    endif
    Exim is not showing any error, but not made any filtering.

    I test the expresion on pcretest:
    Code:
    [a-zA-Z\.@_-]*\.(?:review|date|work|xyz|faith)$
    And it works normally if I set the M flag

    I re-test this expresion creating a filter in cPanel option: "Account Level Filtering", and it's works fine; but when I copy this rule from /etc/vfilters/domain.tld to /etc/cpanel_exim_system_filter, its not filter anything.

    Please, Could you give a hand with this issue?

    Thank you.
     
  8. cPanelMichael

    cPanelMichael Technical Support Community Manager Staff Member

    Joined:
    Apr 11, 2011
    Messages:
    47,335
    Likes Received:
    2,163
    Trophy Points:
    363
    cPanel Access Level:
    Root Administrator
    Twitter:
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  9. ebizindia

    ebizindia Well-Known Member

    Joined:
    Oct 13, 2005
    Messages:
    95
    Likes Received:
    3
    Trophy Points:
    158
    Location:
    Kolkata, India
    cPanel Access Level:
    Root Administrator
    I am using this line in my filter file:
    Code:
    if $h_from: matches ".+@.+\.(xyz|link|date|mobi|ninja|rocks|click|party|webcam|faith|racing|review|science|space|us|website|win|work)[^a-zA-Z0-9_]*"
    
    It is working well to block spam messages. However it is also blocking several mails that should not be blocked.

    For example, mails from these addresses were blocked.
    rag@
    bounce-bounce@
    bo-b94byygbf3tfpaaupkrfwbyt8fv6d4@

    None of these match the filter rule. Any feedback is appreciated.
     
    #29 ebizindia, Sep 12, 2015
    Last edited by a moderator: Sep 14, 2015
  10. ebizindia

    ebizindia Well-Known Member

    Joined:
    Oct 13, 2005
    Messages:
    95
    Likes Received:
    3
    Trophy Points:
    158
    Location:
    Kolkata, India
    cPanel Access Level:
    Root Administrator
    I think the system is rejecting all mails that have .in in the domain name. Any reason why?
     
  11. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    53
    Likes Received:
    3
    Trophy Points:
    158
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    I am using this in my cpanel_exim_system_filter file in ../etc and so far it is working without false positives:

    Code:
    # Block Newfangled Domain Spam
    # THESE BLOCK MORE SPAM THAN ALL THE OTHER RULES COMBINED!
    
    if first_delivery
    and (
    ("$h_from:" matches ".+@.+\\\\.click[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.ch[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.cricket[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.asia[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.ec[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.exercise[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.co.in[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.gen.in[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.it[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.net.in[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.link[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.ninja[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.review[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.rocks[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.science[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.space[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.sk[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.uno[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.website[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.work[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.xyz[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\\\.za[^a-zA-Z0-9_]")
    )
    then
    headers add "SpamRule: EXIM FILTER Block Newfangled Domains (was: $h_subject:)"
    deliver "Newfangled <newfangled@myfalsepositivecheckingdomain.com>"
    seen finish
    endif 
    You can omit the "headers add" line and the "deliver" line to just delete them if you dare.
    Hope this helps. :)
     
    ideamktg likes this.
  12. ebizindia

    ebizindia Well-Known Member

    Joined:
    Oct 13, 2005
    Messages:
    95
    Likes Received:
    3
    Trophy Points:
    158
    Location:
    Kolkata, India
    cPanel Access Level:
    Root Administrator
    AFAIK, this assumes that the address has a character after the extension (say .za) which is none of the given characters. Does the from address have a trailing space or another special character?
     
  13. ideamktg

    ideamktg Registered

    Joined:
    Oct 6, 2015
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Chicago
    cPanel Access Level:
    Root Administrator
    Hi Stoney,
    Could you show how you placed the false/positive rule in with the other filters? I use both the Newfangled domains and a spam trap of headers contain. I found your post a while back and it works great but I have one email that is getting caught and need to let it pass through. When I add the rule, it just seems to cause a jam in our mail queue. I would really appreciate the help.

    Thanks,
    Darren
     
    #33 ideamktg, Oct 6, 2015
    Last edited by a moderator: Oct 6, 2015
  14. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    53
    Likes Received:
    3
    Trophy Points:
    158
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    The false positive rule is the first one so it runs prior to all the rest.
    Maybe instead of using:
    Code:
     or $h_from: contains "ebay.com" 
    you might try:
    Code:
     or $h_from: contains "joe@ebay.com" 
    or even:
    Code:
      or ("$h_from:" matches "joe@ebay.com") 
    If the email address you are trying to whitelist has a period in it then it will need to be escaped if you use the "matches" parameter. I think it might be like this:
    Code:
      or ("$h_from:" matches "joe\\.smiley\@ebay.com") 
    I may have that wrong.
    Please see http://www.exim.org/exim-html-4.72/doc/html/filter.html#SEC00 for more help on this.
     
  15. ideamktg

    ideamktg Registered

    Joined:
    Oct 6, 2015
    Messages:
    2
    Likes Received:
    0
    Trophy Points:
    1
    Location:
    Chicago
    cPanel Access Level:
    Root Administrator
    So it would have first delivery and then the ones below would just be if? Would it be something like this? Sorry, struggling with it. This is what I tried:

    Code:
    # These are custom bypass the rules rules due to false positives
    if first_delivery
    and
     (
     or $h_from: contains "mcafee.com"
     )
    then
     finish
    endif
    
    # Block Newfangled Domains
    if
    and (
      ("$h_from:" matches ".+@.+\\\\.click[^a-zA-Z0-9_]")
     or ("$h_from:" matches ".+@.+\\\\.club[^a-zA-Z0-9_]")
     or ("$h_from:" matches ".+@.+\\\\.date[^a-zA-Z0-9_]")
     )
     then
     headers add "SpamRule: EXIM FILTER Block Newfangled Domains (was: $h_subject:)"
     deliver "Newfangled <email@domain.com>"
     seen finish
    endif
    
    # Spamtrap
    if
     $message_headers contains "esurface"
     or $header_subject: contains "Off V1agra"
     or $header_subject: contains "WhosWho"
     or $header_subject: contains "WhosWho."
     or $header_subject: contains "ED Pills"
     or $header_subject: contains "ED Pill"
     or $header_subject: contains "SC0RE"
     or $message_headers contains "aig.direct"
     or $message_headers contains "aig-direct"
     or $message_headers contains "aig_direct"
     then
     headers add "SpamRule: EXIM FILTER Block Spamtrap (was: $h_subject:)"
     deliver "Spamtrap <email@domain.com>"
     seen finish
    endif
    
    
     
  16. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    53
    Likes Received:
    3
    Trophy Points:
    158
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    I copied it from my code page. Please remove the beginning "or" from
    (
    or $h_from: contains "mcafee.com"
    )

    Sorry for the delayed response....

    Maybe this will help a little:

    Here's how I check for filter syntax errors:

    In WHM go to: Home > Email > Mail Queue Manager
    It should automatically run a 1 day report. If there are items in the list, try to deliver one. The resulting window will either say "Process Complete" or it will tell you the line number of the error and sometimes why. Sometimes the line numbers are a few off but it will get you in the general area of the error. I copied your mcafee code to my file to test it. In this case when I tried to deliver one it returned this:

    LOG: MAIN
    cwd=/usr/local/cpanel/whostmgr/docroot 4 args: /usr/sbin/exim -v -M 1Zm2cs-0005qz-Fd
    delivering 1Zm2cs-0005qz-Fd
    LOG: MAIN PANIC
    Error in system filter: unrecognized condition word "$h_from:" near line 250 of filter file


    In my filter file line 250 was the trailing ) in your filter.

    I removed the "or" and both quotes (), saved the file and then I went back to Mail Queue Manager, checked one email and clicked on "deliver selected". Then I got the message:

    LOG: MAIN
    cwd=/usr/local/cpanel/whostmgr/docroot 4 args: /usr/sbin/exim -v -M 1Zm2cs-0005qy-BW
    delivering 1Zm2cs-0005qy-BW
    LOG: MAIN
    Completed

    Which means delivery was completed.

    Now go back to Mail Queue, Now click on "Deliver All" and the queue contents will be delivered.

    That is the issue with writing filters. If you make a misteak :) , your emails will not be delivered and the Queue will start filling up.

    Hope this helps you figure this out. It is fun after you get it working, but it can be a challenge until then.

    Have a great day!
     
    #36 StoneyCreeker, Oct 13, 2015
    Last edited: Oct 13, 2015
  17. wolfsden3

    wolfsden3 Member

    Joined:
    Aug 19, 2009
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    51


    Hey StoneyCreeker I took your file and modified it to block all the tldr's I don't want which are most of them but when I apply it in WHM I get this:

    Code:
    2015-11-07 12:49:07 SMTP connection from [x.x.x.x]:40695 (TCP/IP connection count = 2)
    2015-11-07 12:49:07 1Zv7bv-0006qC-Nm H=ip x.x.x.x (email.example.com) [x.x.x.x]:40695 Warning: Message has been scanned: no virus or other harmful content was found
    2015-11-07 12:49:07 1Zv7bv-0006qC-Nm <= [EMAIL]test@example.com[/EMAIL] H=ip x-x-x-x.whatever.example.net (email.example.com) [x.x.x.x]:40695 P=esmtps X=TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=3085 id=zarafa.563e3993.2250.0b7e7a5b5cc9eb5b@email.example.com T="Test 8" for [EMAIL]info@example.com[/EMAIL]
    2015-11-07 12:49:07 SMTP connection from ip x-x-x-x.whatever.example.net (email.example.com) [x.x.x.x]:40695 closed by QUIT
    2015-11-07 12:49:07 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1Zv7bv-0006qC-Nm
    2015-11-07 12:49:07 1Zv7bv-0006qC-Nm => discarded (system filter)
    2015-11-07 12:49:07 1Zv7bv-0006qC-Nm Completed
    
    So...when the email comes through it says:

    => discarded (system filter)

    Here is my file:

    Code:
    # cat global_tld_block
    # Reference:  [URL='https://forums.cpanel.net/threads/need-to-filter-all-email.348741/page-2']Need to filter ALL email[/URL]
    # Block lame domains
    # THESE BLOCK MORE SPAM THAN ALL THE OTHER RULES COMBINED!
    
    if first_delivery
    and ("$h_from:" matches ".+@.+\\\\.aaa[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.abb[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.abbott[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.abogado[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ac[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.academy[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.accenture[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.accountant[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.accountants[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.aco[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.active[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.actor[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ad[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ads[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.adult[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ae[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.aeg[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.aero[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.af[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.afl[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ag[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.agency[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ai[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.aig[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.airforce[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.airtel[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.al[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.allfinanz[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.alsace[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.am[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.amica[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.amsterdam[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.an[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.android[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ao[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.apartments[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.app[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.aq[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.aquarelle[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ar[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.archi[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.army[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.arpa[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.as[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.asia[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.associates[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.at[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.attorney[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.au[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.auction[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.audio[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.auto[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.autos[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.aw[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ax[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.axa[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.az[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.azure[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ba[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.band[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bank[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bar[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.barcelona[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.barclaycard[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.barclays[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bargains[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bauhaus[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bayern[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bb[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bbc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bbva[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bcn[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bd[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.be[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.beer[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bentley[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.berlin[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.best[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bet[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bf[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bg[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bh[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bharti[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bi[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bible[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bid[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bike[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bing[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bingo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bio[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bj[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bl[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.black[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.blackfriday[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bloomberg[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.blue[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bm[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bmw[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bn[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bnl[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bnpparibas[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.boats[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bond[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.boo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.boots[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.boutique[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bq[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.br[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bradesco[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bridgestone[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.broker[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.brother[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.brussels[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bs[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bt[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.budapest[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.build[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.builders[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.business[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.buzz[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bv[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bw[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.by[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bz[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.bzh[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cab[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cafe[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cal[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.camera[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.camp[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cancerresearch[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.canon[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.capetown[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.capital[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.caravan[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cards[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.care[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.career[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.careers[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cars[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cartier[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.casa[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cash[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.casino[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cat[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.catering[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cba[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cbn[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cd[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ceb[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.center[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ceo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cern[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cf[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cfa[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cfd[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cg[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ch[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.chanel[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.channel[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.chat[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cheap[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.chloe[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.christmas[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.chrome[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.church[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ci[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cisco[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.citic[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.city[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ck[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cl[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.claims[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cleaning[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.click[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.clinic[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.clothing[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cloud[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.club[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cm[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cn[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.coach[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.codes[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.coffee[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.college[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cologne[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.commbank[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.community[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.company[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.computer[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.condos[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.construction[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.consulting[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.contractors[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cooking[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cool[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.coop[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.corsica[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.country[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.coupons[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.courses[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cr[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.credit[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.creditcard[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cricket[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.crown[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.crs[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cruises[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cu[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cuisinella[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cv[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cw[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cx[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cy[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cymru[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cyou[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.cz[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.dabur[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.dad[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.dance[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.date[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.dating[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.datsun[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.day[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.dclk[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.de[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.deals[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.degree[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.delivery[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.delta[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.democrat[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.dental[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.dentist[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.desi[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.design[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.dev[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.diamonds[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.diet[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.digital[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.direct[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.directory[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.discount[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.dj[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.dk[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.dm[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.dnp[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.do[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.docs[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.dog[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.doha[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.domains[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.doosan[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.download[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.drive[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.durban[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.dvag[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.dz[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.earth[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.eat[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ec[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.education[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ee[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.eg[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.eh[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.email[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.emerck[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.energy[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.engineer[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.engineering[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.enterprises[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.epson[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.equipment[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.er[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.erni[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.es[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.esq[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.estate[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.et[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.eu[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.eurovision[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.eus[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.events[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.everbank[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.exchange[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.expert[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.exposed[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.express[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fage[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fail[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.faith[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.family[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fan[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fans[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.farm[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fashion[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.feedback[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fi[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.film[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.finance[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.financial[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.firmdale[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fish[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fishing[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fit[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fitness[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fj[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fk[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.flights[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.florist[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.flowers[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.flsmidth[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fly[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fm[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.foo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.football[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.forex[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.forsale[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.forum[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.foundation[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fr[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.frl[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.frogans[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fund[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.furniture[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.futbol[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.fyi[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ga[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gal[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gallery[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.game[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.garden[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gb[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gbiz[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gd[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gdn[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ge[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gea[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gent[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.genting[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gf[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gg[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ggee[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gh[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gi[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gift[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gifts[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gives[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.giving[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gl[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.glass[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gle[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.global[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.globo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gm[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gmail[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gmo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gmx[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gn[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gold[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.goldpoint[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.golf[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.goo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.goog[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.google[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gop[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gp[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gq[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gr[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.graphics[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gratis[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.green[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gripe[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.group[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gs[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gt[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gu[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.guge[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.guide[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.guitars[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.guru[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gw[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.gy[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.hamburg[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.hangout[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.haus[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.healthcare[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.help[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.here[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.hermes[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.hiphop[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.hitachi[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.hiv[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.hk[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.hm[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.hn[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.hockey[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.holdings[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.holiday[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.homedepot[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.homes[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.honda[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.horse[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.host[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.hosting[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.hoteles[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.hotmail[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.house[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.how[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.hr[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.hsbc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ht[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.hu[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ibm[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.icbc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ice[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.icu[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.id[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ie[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ifm[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.iinet[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.il[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.im[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.immo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.immobilien[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.in[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.in.net[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.industries[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.infiniti[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ing[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ink[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.institute[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.insure[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.int[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.international[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.investments[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.io[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ipiranga[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.iq[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ir[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.irish[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ist[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.istanbul[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.it[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.itau[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.iwc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.java[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.jcb[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.je[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.jetzt[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.jewelry[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.jlc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.jll[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.jm[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.jo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.jobs[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.joburg[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.jprs[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.juegos[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.kaufen[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.kddi[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ke[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.kg[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.kh[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ki[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.kim[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.kitchen[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.kiwi[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.km[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.kn[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.koeln[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.komatsu[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.kp[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.kr[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.krd[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.kred[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.kw[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ky[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.kyoto[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.kz[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.la[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lacaixa[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lancaster[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.land[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lasalle[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lat[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.latrobe[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.law[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lawyer[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lb[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lds[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lease[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.leclerc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.legal[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lexus[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lgbt[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.li[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.liaison[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lidl[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.life[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lighting[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.limited[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.limo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.link[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.live[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lixil[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lk[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.loan[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.loans[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lol[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.london[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lotte[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lotto[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.love[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lr[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ls[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lt[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ltda[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lu[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lupin[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.luxe[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.luxury[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.lv[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ly[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ma[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.madrid[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.maif[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.maison[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.man[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.management[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mango[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.market[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.marketing[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.markets[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.marriott[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mba[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.md[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.me[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.media[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.meet[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.melbourne[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.meme[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.memorial[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.men[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.menu[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mf[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mg[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mh[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.miami[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.microsoft[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mini[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mk[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ml[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mm[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mma[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mn[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mobi[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.moda[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.moe[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mom[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.monash[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.money[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.montblanc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mormon[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mortgage[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.moscow[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.motorcycles[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mov[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.movie[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.movistar[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mp[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mq[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mr[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ms[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mt[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mtn[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mtpc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mu[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.museum[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mv[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mw[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mx[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.my[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.mz[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.na[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nadex[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nagoya[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.name[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.navy[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ne[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nec[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.netbank[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.network[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.neustar[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.new[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.news[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nexus[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nf[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ng[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ngo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nhk[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ni[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nico[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ninja[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nissan[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nl[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.no[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nokia[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.np[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nr[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nra[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nrw[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ntt[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nu[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nyc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.nz[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.office[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.okinawa[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.om[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.omega[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.one[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ong[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.onl[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.online[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ooo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.oracle[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.orange[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.organic[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.osaka[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.otsuka[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ovh[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pa[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.page[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.panerai[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.paris[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.partners[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.parts[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.party[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pe[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pet[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pf[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pg[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ph[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pharmacy[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.philips[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.photo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.photography[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.photos[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.physio[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.piaget[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pics[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pictet[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pictures[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pink[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pizza[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pk[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pl[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.place[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.play[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.plumbing[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.plus[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pm[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pn[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pohl[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.poker[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.porn[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.post[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pr[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.praxi[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.press[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pro[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.prod[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.productions[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.prof[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.properties[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.property[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ps[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pt[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pub[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.pw[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.py[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.qa[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.qpon[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.quebec[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.racing[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.re[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.realtor[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.realty[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.recipes[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.red[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.redstone[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.rehab[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.reise[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.reisen[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.reit[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ren[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.rent[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.rentals[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.repair[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.report[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.republican[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.rest[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.restaurant[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.review[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.reviews[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.rich[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ricoh[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.rio[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.rip[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ro[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.rocks[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.rodeo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.rs[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.rsvp[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ru[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ruhr[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.run[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.rw[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ryukyu[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sa[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.saarland[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sakura[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sale[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.samsung[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sandvik[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sandvikcoromant[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sanofi[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sap[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sarl[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.saxo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sb[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sca[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.scb[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.schmidt[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.scholarships[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.school[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.schule[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.schwarz[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.science[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.scor[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.scot[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sd[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.se[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.seat[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.seek[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sener[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.services[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sew[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sex[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sexy[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sg[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sh[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.shiksha[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.shoes[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.show[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.shriram[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.si[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.singles[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.site[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sj[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sk[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ski[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sky[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.skype[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sl[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sm[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sn[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sncf[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.so[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.soccer[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.social[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.software[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sohu[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.solar[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.solutions[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sony[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.soy[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.space[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.spiegel[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.spreadbetting[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sr[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.srl[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ss[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.st[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.starhub[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.statoil[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.stc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.stcgroup[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.studio[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.study[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.style[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.su[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sucks[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.supplies[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.supply[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.support[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.surf[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.surgery[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.suzuki[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sv[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.swatch[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.swiss[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sx[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sy[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sydney[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.systems[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.sz[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.taipei[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tatamotors[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tatar[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tattoo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tax[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.taxi[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.td[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.team[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tech[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.technology[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tel[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.telefonica[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.temasek[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tennis[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tf[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tg[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.th[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.thd[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.theater[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tickets[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tienda[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tips[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tires[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tirol[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tj[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tk[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tl[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tm[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tn[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.to[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.today[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tokyo[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tools[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.top[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.toray[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.toshiba[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tours[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.town[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.toyota[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.toys[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tp[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tr[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.trade[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.trading[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.training[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.travel[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.trust[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tt[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tui[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tv[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tw[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.tz[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ua[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ubs[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ug[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.uk[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.um[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.university[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.uno[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.uol[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.us[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.uy[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.uz[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.va[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.vacations[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.vc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ve[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.vegas[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ventures[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.versicherung[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.vet[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.vg[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.vi[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.viajes[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.video[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.villas[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.vin[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.vision[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.vista[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.vistaprint[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.viva[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.vlaanderen[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.vn[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.vodka[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.vote[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.voting[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.voto[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.voyage[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.vu[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.wales[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.walter[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.wang[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.watch[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.webcam[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.website[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.wed[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.wedding[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.weir[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.wf[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.whoswho[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.wien[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.wiki[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.williamhill[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.win[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.windows[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.wine[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.wme[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.work[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.works[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.world[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ws[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.wtc[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.wtf[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.xbox[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.xerox[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.xin[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.рус[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.xperia[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.xxx[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.xyz[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.yachts[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.yandex[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.ye[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.yodobashi[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.yoga[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.yokohama[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.youtube[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.yt[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.za[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.zip[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.zm[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.zone[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.zuerich[^a-zA-Z0-9_]")
    or ("$h_from:" matches ".+@.+\\.zw[^a-zA-Z0-9_]")
    
    then
    # Uncommend to forward spam to an inbox
    # headers add "SpamRule: EXIM FILTER Block Newfangled Domains (was: $h_subject:$
    # deliver "Newfangled <newfangled@myfalsepositivecheckingdomain.com>"
    seen finish
    endif
    
    
    I noticed that in your post you had:

    Code:
    if first_delivery
    and (
    ("$h_from:" matches ".+@.+\\\\.aaa[^a-zA-Z0-9_]")
    
    But I have:

    Code:
    if first_delivery
    and ("$h_from:" matches ".+@.+\\\\.aaa[^a-zA-Z0-9_]")
    
    * I got rid of one of the "("'s

    I'm not a real coder so I'm not certain what this is or isn't causing. I tried it with both and got an error when I have your extra one in the file I made called global_tld_block.

    When I run it the way you have it posted I get this error:

    Error in system filter: unexpected ")" in line 1194 of filter file

    So my file "works" without your extra ellipse BUT what's not working is how my test email is getting blocked when it's from a ".com" domain! I shouldn't get blocked but seems to get blocked.

    I don't think I fully understand your syntax.

    Any help on this would be appreciated or any insight form anyone else.

    Thanks!
     
    #37 wolfsden3, Nov 7, 2015
    Last edited by a moderator: Nov 7, 2015
  18. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    53
    Likes Received:
    3
    Trophy Points:
    158
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    I tried your code and it too re-directed all email including .com.
    I noticed you only had 2 backslashes in your code. When I used the "replace" function in wordpad to find \\. and replace it with \\\\. it seems to be working. At least it is not stopping legit emails with the .com extension.

    PS I am also still including the whole list in brackets.

    That is a huge list!

    Hope this helps... :)

    EDIT: I am using your list and will monitor the "newfangled" spam folder for a few hours this afternoon and let you know about false positives. It already caught one from the .xyz domain.
     
    #38 StoneyCreeker, Nov 10, 2015
    Last edited: Nov 10, 2015
  19. wolfsden3

    wolfsden3 Member

    Joined:
    Aug 19, 2009
    Messages:
    6
    Likes Received:
    0
    Trophy Points:
    51
    Stoney - you dah man. I can't believe I missed that syntax error. Once I put in the \\\\'s, works like a charm!

    I got that list from the grand daddy list of tld's online. Whomever sanctions them. My fear though is, now; anyone can buy a tld so there will more coming down the road and who uses things other than the real big one's like .com, .net, .edu, .gov, .uk...and a few others like .ca, etc?

    Unless you do business with other countries (which you can edit that out of the file) or do business with oddball companies using domains like ".link" then this list is a winner! ;0)
     
  20. StoneyCreeker

    StoneyCreeker Well-Known Member

    Joined:
    Oct 17, 2006
    Messages:
    53
    Likes Received:
    3
    Trophy Points:
    158
    Location:
    Upper-East TN
    cPanel Access Level:
    Root Administrator
    The syntax still is not "exactly" correct. It blocked "xxx@corp.lawyer.com" last night. It should only have blocked "xxx@corp.lawyer". I have a lawyer client that uses that service and I am glad I send them to an email account so I can check for false positives. I hashed # that one out for now. Also it blocked an email from xxx@aaa.com, the "triple A" auto towing service that was legit.

    Maybe some expert coder will run across this issue and offer a better solution.

    When I get time I will look into improving the syntax, but I am covered up with another project for the next few weeks.
     
Loading...

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Dismiss Notice