spam-filter.toml

[version]
spam-filter = "2.0.5"
server = "0.11.0"

[asn]
type = "resource"
expires = "1d"
timeout = "5m"
max-size = 104857600

[asn.urls]
asn = [ "https://cdn.jsdelivr.net/npm/@ip-location-db/asn/asn-ipv4.csv", 
        "https://cdn.jsdelivr.net/npm/@ip-location-db/asn/asn-ipv6.csv" ]
geo = [ "https://cdn.jsdelivr.net/npm/@ip-location-db/geolite2-geo-whois-asn-country/geolite2-geo-whois-asn-country-ipv4.csv", 
        "https://cdn.jsdelivr.net/npm/@ip-location-db/geolite2-geo-whois-asn-country/geolite2-geo-whois-asn-country-ipv6.csv" ]


[spam-filter.rule.STWT_SHORT_BAD_HEADERS]
enable = true
scope = "any"
priority = 1000
condition = [ { if = "$MISSING_ESSENTIAL_HEADERS && $SINGLE_SHORT_PART", then = "'SHORT_PART_BAD_HEADERS'" },
 			  { else = false } ]

[spam-filter.rule.STWT_FORGED_RCPT_LIST]
enable = true
scope = "any"
priority = 1001
condition = [ { if = "$FORGED_RECIPIENTS && $MAILLIST", then = "'FORGED_RECIPIENTS_MAILLIST'" },
 			  { else = false } ]

[spam-filter.rule.STWT_FORGED_SENDER_LIST]
enable = true
scope = "any"
priority = 1002
condition = [ { if = "$FORGED_SENDER && $MAILLIST", then = "'FORGED_SENDER_MAILLIST'" },
 			  { else = false } ]

[spam-filter.rule.STWT_DMARC_ALLOW_WITH_FAIL]
enable = true
scope = "any"
priority = 1003
condition = [ { if = "$DMARC_POLICY_ALLOW && ($SPF_SOFTFAIL || $SPF_FAIL || $DKIM_REJECT)", then = "'DMARC_POLICY_ALLOW_WITH_FAILURES'" },
 			  { else = false } ]

[spam-filter.rule.STWT_AUTH_NA]
enable = true
scope = "any"
priority = 1004
condition = [ { if = "$DKIM_NA && $SPF_NA && $DMARC_NA && $ARC_NA", then = "'AUTH_NA'" },
 			  { else = false } ]

[spam-filter.rule.STWT_AUTH_NA_FAIL]
enable = true
scope = "any"
priority = 1005
condition = [ { if = "!($DKIM_NA && $SPF_NA && $DMARC_NA && $ARC_NA) && ($DKIM_NA || $DKIM_TEMPFAIL || $DKIM_PERMFAIL) && ($SPF_NA || $SPF_DNSFAIL) && $DMARC_NA && ($ARC_NA || $ARC_DNSFAIL)", then = "'AUTH_NA_OR_FAIL'" },
 			  { else = false } ]

[spam-filter.rule.STWT_BOUNCE_NO_AUTH]
enable = true
scope = "any"
priority = 1006
condition = [ { if = "($AUTH_NA || $AUTH_NA_OR_FAIL) && ($BOUNCE || $SUBJ_BOUNCE_WORDS)", then = "'BOUNCE_NO_AUTH'" },
 			  { else = false } ]

[spam-filter.rule.STWT_HACKED_WP_PHISHING]
enable = true
scope = "any"
priority = 1007
condition = [ { if = "($X_HDR_X_PHP_ORIGINATING_SCRIPT || $HAS_PHPMAILER_SIG) && $HAS_WP_URI && ($PHISHING || $CRACKED_SURBL || $PH_SURBL_MULTI || $DBL_PHISH || $DBL_ABUSE_PHISH || $URIBL_BLACK || $PHISHED_OPENPHISH || $PHISHED_PHISHTANK)", then = "'HACKED_WP_PHISHING'" },
 			  { else = false } ]

[spam-filter.rule.STWT_COMPROMISED_ACCT_BULK]
enable = true
scope = "any"
priority = 1008
condition = [ { if = "($X_HDR_X_ORIGINATING_IP || $RCVD_VIA_SMTP_AUTH) && $DCC_BULK", then = "'COMPROMISED_ACCT_BULK'" },
 			  { else = false } ]

[spam-filter.rule.STWT_UNDISC_RCPTS_BULK]
enable = true
scope = "any"
priority = 1009
condition = [ { if = "$DCC_BULK && ($MISSING_TO || $UNDISC_RCPT)", then = "'UNDISC_RCPTS_BULK'" },
 			  { else = false } ]

[spam-filter.rule.STWT_RCVD_UNAUTH_PBL]
enable = true
scope = "any"
priority = 1010
condition = [ { if = "$RECEIVED_SPAMHAUS_PBL && !$RCVD_VIA_SMTP_AUTH", then = "'RCVD_UNAUTH_PBL'" },
 			  { else = false } ]

[spam-filter.rule.STWT_RCVD_DKIM_ARC_DNSWL_MED]
enable = true
scope = "any"
priority = 1011
condition = [ { if = "($DKIM_ALLOW || $ARC_ALLOW) && $RCVD_IN_DNSWL_MED", then = "'RCVD_DKIM_ARC_DNSWL_MED'" },
 			  { else = false } ]

[spam-filter.rule.STWT_RCVD_DKIM_ARC_DNSWL_HI]
enable = true
scope = "any"
priority = 1012
condition = [ { if = "($DKIM_ALLOW || $ARC_ALLOW) && $RCVD_IN_DNSWL_HI", then = "'RCVD_DKIM_ARC_DNSWL_HI'" },
 			  { else = false } ]

[spam-filter.rule.STWT_AUTOGEN_PHP_SPAMMY]
enable = true
scope = "any"
priority = 1013
condition = [ { if = "($X_HDR_X_PHP_ORIGINATING_SCRIPT || $HAS_PHPMAILER_SIG || $X_HDR_X_PHP_SCRIPT) && ($SUBJECT_ENDS_QUESTION || $SUBJECT_ENDS_EXCLAIM || $MANY_INVISIBLE_PARTS)", then = "'AUTOGEN_PHP_SPAMMY'" },
 			  { else = false } ]

[spam-filter.rule.STWT_PHISH_EMOTION]
enable = true
scope = "any"
priority = 1014
condition = [ { if = "($PHISHING || $DBL_PHISH || $PHISHED_OPENPHISH || $PHISHED_PHISHTANK) && ($SUBJECT_ENDS_QUESTION || $SUBJECT_ENDS_EXCLAIM)", then = "'PHISH_EMOTION'" },
 			  { else = false } ]

[spam-filter.rule.STWT_HAS_ANON_DOMAIN]
enable = true
scope = "any"
priority = 1015
condition = [ { if = "$HAS_GUC_PROXY_URI || $URIBL_RED || $DBL_ABUSE_REDIR || $HAS_ONION_URI", then = "'HAS_ANON_DOMAIN'" },
 			  { else = false } ]

[spam-filter.rule.STWT_VIOLATED_DIRECT_SPF]
enable = true
scope = "any"
priority = 1016
condition = [ { if = "($SPF_FAIL || $SPF_SOFTFAIL) && ($RCVD_COUNT_ZERO || $RCVD_NO_TLS_LAST)", then = "'VIOLATED_DIRECT_SPF'" },
 			  { else = false } ]

[spam-filter.rule.STWT_FREEMAIL_AFF]
enable = true
scope = "any"
priority = 1017
condition = [ { if = "($FREEMAIL_FROM || $FREEMAIL_ENV_FROM || $FREEMAIL_REPLY_TO) && ($TO_DN_RECIPIENTS || $UNDISC_RCPT) && ($FROM_NAME_HAS_TITLE || $FREEMAIL_REPLY_TO_NEQ_FROM_DOM)", then = "'FREEMAIL_AFF'" },
 			  { else = false } ]

[spam-filter.rule.STWT_REDIRECTOR_URL_ONLY]
enable = true
scope = "any"
priority = 1018
condition = [ { if = "$URL_ONLY && $REDIRECTOR_URL", then = "'REDIRECTOR_URL_ONLY'" },
			  { else = false } ]

[spam-filter.rule.STWT_THREAD_HIJACKING]
enable = true
scope = "any"
priority = 1019
condition = [ { if = "$FAKE_REPLY && $RCVD_VIA_SMTP_AUTH && (!$RECEIVED_SPAMHAUS_PBL || $RECEIVED_SPAMHAUS_XBL || $RECEIVED_SPAMHAUS_SBL)", then = "'THREAD_HIJACKING_FROM_INJECTOR'" },
			  { else = false } ]

[spam-filter.rule.STWT_DKIM_SIGNED]
enable = true
scope = "any"
priority = 1020
condition = [ { if = "$X_HDR_DKIM_SIGNATURE", then = "'DKIM_SIGNED'" },
			  { else = false } ]

[spam-filter.rule.STWT_ARC_SIGNED]
enable = true
scope = "any"
priority = 1021
condition = [ { if = "$X_HDR_ARC_SEAL", then = "'ARC_SIGNED'" },
			  { else = false } ]

[spam-filter.rule.STWT_FREEMAIL_RTO_NEQ_DOM]
enable = true
scope = "any"
priority = 1022
condition = [ { if = "$FREEMAIL_REPLY_TO && from.domain != reply_to.domain", then = "'FREEMAIL_REPLY_TO_NEQ_FROM_DOM'" },
			  { else = false } ]

[spam-filter.rule.STWT_SUSPICIOUS_MDN]
enable = true
scope = "any"
priority = 1023
condition = [ { if = "($FREEMAIL_DNT || $DISPOSABLE_DNT) && !($FREEMAIL_FROM || $FREEMAIL_ENV_FROM)", then = "'SUSPICIOUS_MDN'" },
			  { else = false } ]

[spam-filter.rule.STWT_SUSPICIOUS_AUTH_ORIGIN]
enable = true
scope = "any"
priority = 1024
condition = [ { if = "($X_HDR_X_ORIGINATING_IP || $RCVD_VIA_SMTP_AUTH) && ($RECEIVED_SPAMHAUS_PBL || $RECEIVED_SPAMHAUS_XBL || $RECEIVED_SPAMHAUS_SBL || $RECEIVED_BLOCKLISTDE)", then = "'SUSPICIOUS_AUTH_ORIGIN'" },
			  { else = false } ]

[spam-filter.rule.STWT_SABUSE_FROM_INJECTOR]
enable = true
scope = "any"
priority = 1025
condition = [ { if = "$SUSPICIOUS_AUTH_ORIGIN && ($RCVD_HELO_USER || $FAKE_REPLY || $HAS_IPFS_GATEWAY_URL || $HTML_SHORT_LINK_IMG_1)", then = "'ABUSE_FROM_INJECTOR'" },
			  { else = false } ]

[spam-filter.rule.STWT_MIME_BAD_EXT_WITH_BAD_UNICODE]
enable = true
scope = "any"
priority = 1026
condition = [ { if = "$MIME_BAD_EXTENSION && $MIME_BAD_UNICODE", then = "'MIME_BAD_EXT_WITH_BAD_UNICODE'" },
			  { else = false } ]

[spam-filter.rule.STWT_HAS_SEO_WORD]
enable = true
scope = "any"
priority = 1027
condition = [ { if = "contains(subject.words, 'SEO') || contains(body.words, 'SEO')", then = "'HAS_SEO_WORD'" },
			  { else = false } ]

[spam-filter.rule.STWT_SEO_SPAM]
enable = true
scope = "any"
priority = 1028
condition = [ { if = "$HAS_SEO_WORD && ($RCPT_DOMAIN_IN_BODY || $RCPT_IN_BODY || $FREEMAIL_FROM)", then = "'SEO_SPAM'" },
			  { else = false } ]

[spam-filter.rule.STWT_DIRECT_TO_MX]
enable = true
scope = "any"
priority = 1029
condition = [ { if = "$RCVD_COUNT_ZERO && !$RCVD_VIA_SMTP_AUTH && ($X_HDR_USER_AGENT || $X_HDR_X_MAILER)", then = "'DIRECT_TO_MX'" },
			  { else = false } ]

[spam-filter.rule.STWT_SHORT_LINK_IMG]
enable = true
scope = "any"
priority = 1030
condition = [ { if = "!$HAS_LINK_TO_LARGE_IMG", then = "false" },
			  { if = "$HTML_SHORT_1", then = "'HTML_SHORT_LINK_IMG_1'" },
			  { if = "$HTML_SHORT_2", then = "'HTML_SHORT_LINK_IMG_2'" },
			  { if = "$HTML_SHORT_3", then = "'HTML_SHORT_LINK_IMG_3'" },
			  { else = false } ]


[spam-filter.dnsbl.server.STWT_RBL_SPAMHAUS_IP]
enable = true
zone = "ip_reverse + '.zen.spamhaus.org'"
tag = [ { if = "octets[0] != 127", then = "false" },
        { if = "octets[3] == 2", then = "if_then(location == 'tcp', 'RBL_SPAMHAUS_SBL', 'RECEIVED_SPAMHAUS_SBL')" },
        { if = "octets[3] == 3", then = "if_then(location == 'tcp', 'RBL_SPAMHAUS_CSS', 'RECEIVED_SPAMHAUS_CSS')" },
        { if = "octets[3] >= 4 && octets[3] <= 7", then = "if_then(location == 'tcp', 'RBL_SPAMHAUS_XBL', 'RECEIVED_SPAMHAUS_XBL')" },
        { if = "octets[3] == 9", then = "if_then(location == 'tcp', 'RBL_SPAMHAUS_DROP', 'RECEIVED_SPAMHAUS_DROP')" },
        { if = "(octets[3] == 10 || octets[3] == 11)", then = "if_then(location == 'tcp', 'RBL_SPAMHAUS_PBL', 'RECEIVED_SPAMHAUS_PBL')" },
        { if = "octets[3] == 254", then = "if_then(location == 'tcp', 'RBL_SPAMHAUS_BLOCKED_OPENRESOLVER', 'RECEIVED_SPAMHAUS_BLOCKED_OPENRESOLVER')" },
        { if = "octets[3] == 255", then = "if_then(location == 'tcp', 'RBL_SPAMHAUS_BLOCKED', 'RECEIVED_SPAMHAUS_BLOCKED')" },
		{ else = false } ]
scope = "ip"

[spam-filter.dnsbl.server.STWT_RBL_MAILSPIKE_IP]
enable = true
zone = [ { if = "location == 'tcp'", then = "ip_reverse + '.rep.mailspike.net'" },
		{ else = false } ]
tag = [ { if = "octets[0] != 127", then = "false" },
        { if = "octets[3] == 10", then = "'RBL_MAILSPIKE_WORST'" },
        { if = "octets[3] == 11", then = "'RBL_MAILSPIKE_VERYBAD'" },
        { if = "octets[3] == 12", then = "'RBL_MAILSPIKE_BAD'" },
        { if = "octets[3] >= 13 && octets[3] <= 16", then = "'RWL_MAILSPIKE_NEUTRAL'" },
        { if = "octets[3] == 17", then = "'RWL_MAILSPIKE_POSSIBLE'" },
        { if = "octets[3] == 18", then = "'RWL_MAILSPIKE_GOOD'" },
        { if = "octets[3] == 19", then = "'RWL_MAILSPIKE_VERYGOOD'" },
        { if = "octets[3] == 20", then = "'RWL_MAILSPIKE_EXCELLENT'" },
		{ else = false } ]
scope = "ip"

[spam-filter.dnsbl.server.STWT_RBL_SENDERSCORE_IP]
enable = false
zone = [ { if = "location == 'tcp'", then = "ip_reverse + '.bl.score.senderscore.com'" },
		{ else = false } ]
tag = [ { if = "octets[0] != 127", then = "false" },
        { if = "octets[3] == 1", then = "'RBL_SENDERSCORE_BOT'" },
        { if = "octets[3] == 2", then = "'RBL_SENDERSCORE_NA'" },
        { if = "octets[3] == 3", then = "'RBL_SENDERSCORE_NA_BOT'" },
        { if = "octets[3] == 4", then = "'RBL_SENDERSCORE_PRST'" },
        { if = "octets[3] == 5", then = "'RBL_SENDERSCORE_PRST_BOT'" },
        { if = "octets[3] == 6", then = "'RBL_SENDERSCORE_PRST_NA'" },
        { if = "octets[3] == 7", then = "'RBL_SENDERSCORE_PRST_NA_BOT'" },
        { if = "octets[3] == 8", then = "'RBL_SENDERSCORE_SUS_ATT'" },
        { if = "octets[3] == 10", then = "'RBL_SENDERSCORE_SUS_ATT_NA'" },
        { if = "octets[3] == 11", then = "'RBL_SENDERSCORE_SUS_ATT_NA_BOT'" },
        { if = "octets[3] == 14", then = "'RBL_SENDERSCORE_SUS_ATT_PRST_NA'" },
        { if = "octets[3] == 15", then = "'RBL_SENDERSCORE_SUS_ATT_PRST_NA_BOT'" },
        { if = "octets[3] == 16", then = "'RBL_SENDERSCORE_SCORE'" },
        { if = "octets[3] == 18", then = "'RBL_SENDERSCORE_SCORE_NA'" },
        { if = "octets[3] == 20", then = "'RBL_SENDERSCORE_SCORE_PRST'" },
        { if = "octets[3] == 22", then = "'RBL_SENDERSCORE_SCORE_PRST_NA'" },
        { if = "octets[3] == 26", then = "'RBL_SENDERSCORE_SCORE_SUS_ATT_NA'" },
        { if = "octets[3] == 255", then = "'RBL_SENDERSCORE_BLOCKED'" },
		{ else = false } ]
scope = "ip"

[spam-filter.dnsbl.server.STWT_RBL_SENDERSCORE_REPUT_IP]
enable = true
zone = [ { if = "location == 'tcp'", then = "ip_reverse + '.score.senderscore.com'" },
		{ else = false } ]
tag = [ { if = "octets[0] != 127", then = "false" },
        { if = "octets[3] < 10", then = "'RBL_SENDERSCORE_REPUT_0'" },
        { if = "octets[3] >= 10 && octets[3] <= 19", then = "'RBL_SENDERSCORE_REPUT_1'" },
        { if = "octets[3] >= 20 && octets[3] <= 29", then = "'RBL_SENDERSCORE_REPUT_2'" },
        { if = "octets[3] >= 30 && octets[3] <= 39", then = "'RBL_SENDERSCORE_REPUT_3'" },
        { if = "octets[3] >= 40 && octets[3] <= 49", then = "'RBL_SENDERSCORE_REPUT_4'" },
        { if = "octets[3] >= 50 && octets[3] <= 59", then = "'RBL_SENDERSCORE_REPUT_5'" },
        { if = "octets[3] >= 60 && octets[3] <= 69", then = "'RBL_SENDERSCORE_REPUT_6'" },
        { if = "octets[3] >= 70 && octets[3] <= 79", then = "'RBL_SENDERSCORE_REPUT_7'" },
        { if = "octets[3] >= 80 && octets[3] <= 89", then = "'RBL_SENDERSCORE_REPUT_8'" },
        { if = "octets[3] >= 90 && octets[3] <= 100", then = "'RBL_SENDERSCORE_REPUT_9'" },
        { if = "octets[3] == 255", then = "'RBL_SENDERSCORE_REPUT_BLOCKED'" },
		{ else = false } ]
scope = "ip"

[spam-filter.dnsbl.server.STWT_RBL_SEM_IP]
enable = true
zone = [ { if = "location == 'tcp' && is_v4", then = "ip_reverse + '.bl.spameatingmonkey.net'" },
        { if = "location == 'tcp' && is_v6", then = "ip_reverse + '.bl.ipv6.spameatingmonkey.net'" },
		{ else = false } ]
tag = [ { if = "!is_empty(ip)", then = "'RBL_SEM'" },
		{ else = false } ]
scope = "ip"

[spam-filter.dnsbl.server.STWT_RBL_VIRUSFREE_IP]
enable = true
zone = [ { if = "location == 'tcp'", then = "ip_reverse + '.bip.virusfree.cz'" },
		{ else = false } ]
tag = [ { if = "ip == '127.0.0.2'", then = "'RBL_VIRUSFREE_BOTNET'" },
		{ else = false } ]
scope = "ip"

[spam-filter.dnsbl.server.STWT_RBL_SPAMCOP_IP]
enable = true
zone = [ { if = "location == 'tcp'", then = "ip_reverse + '.bl.spamcop.net'" },
		{ else = false } ]
tag = [ { if = "!is_empty(ip)", then = "'RBL_SPAMCOP'" },
		{ else = false } ]
scope = "ip"

[spam-filter.dnsbl.server.STWT_RBL_BARRACUDA_IP]
enable = true
zone = [ { if = "location == 'tcp'", then = "ip_reverse + '.b.barracudacentral.org'" },
		{ else = false } ]
tag = [ { if = "!is_empty(ip)", then = "'RBL_BARRACUDA'" },
		{ else = false } ]
scope = "ip"

[spam-filter.dnsbl.server.STWT_RBL_BLOCKLISTDE_IP]
enable = true
zone = "ip_reverse + '.bl.blocklist.de'"
tag = [ { if = "!is_empty(ip) && location == 'tcp'", then = "'RBL_BLOCKLISTDE'" },
        { if = "!is_empty(ip)", then = "'RECEIVED_BLOCKLISTDE'" },
		{ else = false } ]
scope = "ip"

[spam-filter.dnsbl.server.STWT_DNSWL_IP]
enable = true
zone = "ip_reverse + '.list.dnswl.org'"
tag = [ { if = "octets[0] != 127", then = "false" },
        { if = "octets[3] == 0", then = "'RCVD_IN_DNSWL_NONE'" },
        { if = "octets[3] == 1", then = "'RCVD_IN_DNSWL_LOW'" },
        { if = "octets[3] == 2", then = "'RCVD_IN_DNSWL_MED'" },
        { if = "octets[3] == 3", then = "'RCVD_IN_DNSWL_HI'" },
        { if = "octets[3] == 255", then = "'DNSWL_BLOCKED'" },
		{ else = false } ]
scope = "ip"

[spam-filter.dnsbl.server.STWT_DBL_SPAMHAUS_DOMAIN]
enable = true
zone = "value + '.dbl.spamhaus.org'"
tag = [ { if = "octets[0] != 127", then = "false" },
        { if = "octets[3] == 2", then = "'DBL_SPAM'" },
        { if = "octets[3] == 4", then = "'DBL_PHISH'" },
        { if = "octets[3] == 5", then = "'DBL_MALWARE'" },
        { if = "octets[3] == 6", then = "'DBL_BOTNET'" },
        { if = "octets[3] == 102", then = "'DBL_ABUSE'" },
        { if = "octets[3] == 103", then = "'DBL_ABUSE_REDIR'" },
        { if = "octets[3] == 104", then = "'DBL_ABUSE_PHISH'" },
        { if = "octets[3] == 105", then = "'DBL_ABUSE_MALWARE'" },
        { if = "octets[3] == 106", then = "'DBL_ABUSE_BOTNET'" },
        { if = "octets[3] == 254", then = "'DBL_BLOCKED_OPENRESOLVER'" },
        { if = "octets[3] == 255", then = "'DBL_BLOCKED'" },
		{ else = false } ]
scope = "domain"

[spam-filter.dnsbl.server.STWT_SURBL_DOMAIN]
enable = true
zone = "value + '.multi.surbl.org'"
tag = [ { if = "octets[3] == 128", then = "'CRACKED_SURBL'" },
        { if = "octets[3] == 64", then = "'ABUSE_SURBL'" },
        { if = "octets[3] == 32", then = "'CT_SURBL'" },
        { if = "octets[3] == 16", then = "'MW_SURBL_MULTI'" },
        { if = "octets[3] == 8", then = "'PH_SURBL_MULTI'" },
        { if = "octets[3] == 4", then = "'DM_SURBL'" },
        { if = "octets[3] == 1", then = "'SURBL_BLOCKED'" },
		{ else = false } ]
scope = "domain"

[spam-filter.dnsbl.server.STWT_URIBL_DOMAIN]
enable = true
zone = "value + '.multi.uribl.com'"
tag = [ { if = "octets[3] == 1", then = "'URIBL_BLOCKED'" },
        { if = "octets[3] == 2", then = "'URIBL_BLACK'" },
        { if = "octets[3] == 4", then = "'URIBL_GREY'" },
        { if = "octets[3] == 8", then = "'URIBL_RED'" },
		{ else = false } ]
scope = "domain"

[spam-filter.dnsbl.server.STWT_SEM_URIBL]
enable = true
zone = "value + '.uribl.spameatingmonkey.net'"
tag = [ { if = "ip == '127.0.0.2'", then = "'SEM_URIBL'" },
		{ else = false } ]
scope = "domain"

[spam-filter.dnsbl.server.STWT_SEM_URIBL_FRESH15]
enable = true
zone = "value + '.fresh15.spameatingmonkey.net'"
tag = [ { if = "ip == '127.0.0.2'", then = "'SEM_URIBL_FRESH15'" },
		{ else = false } ]
scope = "domain"

[spam-filter.dnsbl.server.STWT_DWL_DNSWL_DOMAIN]
enable = true
zone = [ { if = "location == 'dkim_pass'", then = "value + '.dwl.dnswl.org'" },
		{ else = false } ]
tag = [ { if = "octets[0] != 127", then = "false" },
        { if = "octets[3] == 0", then = "'DWL_DNSWL_NONE'" },
        { if = "octets[3] == 1", then = "'DWL_DNSWL_LOW'" },
        { if = "octets[3] == 2", then = "'DWL_DNSWL_MED'" },
        { if = "octets[3] == 3", then = "'DWL_DNSWL_HI'" },
        { if = "octets[3] == 255", then = "'DWL_DNSWL_BLOCKED'" },
		{ else = false } ]
scope = "domain"

[spam-filter.dnsbl.server.STWT_MSBL_EBL_EMAIL]
enable = true
zone = "hash(email, 'sha1') + '.ebl.msbl.org'"
tag = [ { if = "octets[0] != 127", then = "false" },
        { if = "octets[2] == 0 && (octets[3] == 2 || octets[3] == 3)", then = "'MSBL_EBL'" },
        { if = "octets[2] == 1 && (octets[3] == 2 || octets[3] == 3)", then = "'MSBL_EBL_GREY'" },
		{ else = false } ]
scope = "email"

[spam-filter.dnsbl.server.STWT_SURBL_HASHBL_DOMAIN]
enable = true
zone = [ { if = "key_exists('surbl-hashbl', host)", then = "hash(host + path, 'md5') + '.hashbl.surbl.org'" },
		{ else = false } ]
tag = [ { if = "octets[0] != 127", then = "false" },
        { if = "octets[3] == 8", then = "'SURBL_HASHBL_PHISH'" },
        { if = "octets[3] == 16", then = "'SURBL_HASHBL_MALWARE'" },
        { if = "octets[3] == 64", then = "'SURBL_HASHBL_ABUSE'" },
        { if = "octets[3] == 128", then = "'SURBL_HASHBL_CRACKED'" },
        { if = "octets[2] == 1", then = "'SURBL_HASHBL_EMAIL'" },
		{ else = false } ]
scope = "url"


[spam-filter.rule.STWT_SVC_OR_TAGGED]
enable = true
scope = "any"
priority = 10
condition = [ { if = "is_intersect(['www-data', 'anonymous', 'ftp', 'apache', 'nobody', 'guest', 'nginx', 'web', 'www'], [from.local, env_from.local, reply_to.local])", then = "'FROM_SERVICE_ACCT'" },
              { if = "contains(from.local, '+')", then = "'TAGGED_FROM'" },
			  { else = false } ]

[spam-filter.rule.STWT_WWW_DOMAIN]
enable = true
scope = "any"
priority = 11
condition = [ { if = "starts_with(from.domain, 'www.') || starts_with(reply_to.domain, 'www.')", then = "'WWW_DOT_DOMAIN'" },
			  { else = false } ]

[spam-filter.rule.STWT_HAS_TITLE]
enable = true
scope = "any"
priority = 12
condition = [ { if = "is_intersect(['mr.', 'mrs.', 'ms.', 'dr.', 'prof.', 'rev.', 'hon.'], split(to_lowercase(from.name), ' '))", then = "'FROM_NAME_HAS_TITLE'" },
              { if = "is_intersect(['mr.', 'mrs.', 'ms.', 'dr.', 'prof.', 'rev.', 'hon.'], split(to_lowercase(reply_to.name), ' '))", then = "'REPLYTO_EMAIL_HAS_TITLE'" },
			  { else = false } ]

[spam-filter.rule.STWT_FROM_NAME_SPACE]
enable = true
scope = "any"
priority = 13
condition = [ { if = "contains(from.name, '  ')", then = "'FROM_NAME_EXCESS_SPACE'" },
			  { else = false } ]

[spam-filter.rule.STWT_BOUNCE]
enable = true
scope = "any"
priority = 14
condition = [ { if = "is_empty(env_from) && ($IS_DSN || $HAS_MESSAGE_PARTS || ($X_HDR_X_MDDSN_MESSAGE && contains_ignore_case(from.name, 'mdaemon')))", then = "'BOUNCE'" },
			  { else = false } ]

[spam-filter.rule.STWT_RCPT_DOMAIN_IN_MESSAGE]
enable = true
scope = "any"
priority = 15
condition = [ { if = "$RCPT_DOMAIN_IN_SUBJECT && ($RCPT_DOMAIN_IN_BODY || $RCPT_IN_BODY)", then = "'RCPT_DOMAIN_IN_MESSAGE'" },
			  { else = false } ]

[spam-filter.rule.STWT_TRUSTED_DOMAIN]
enable = true
scope = "any"
priority = 16
condition = [ { if = "$DMARC_POLICY_ALLOW && key_exists('trusted-domains', from.domain)", then = "'TRUSTED_DOMAIN'" },
			  { else = false } ]

[spam-filter.rule.STWT_BLOCKED_DOMAIN]
enable = true
scope = "any"
priority = 17
condition = [ { if = "key_exists('blocked-domains', from.domain)", then = "'BLOCKED_DOMAIN'" },
			  { else = false } ]


[spam-filter.rule.STWT_R_UNDISC_RCPT]
enable = true
scope = "header"
priority = 60
condition = [ { if = "contains(['to', 'cc', 'bcc'], name_lower) && contains(raw_lower, 'undisclosed')", then = "'UNDISC_RCPT'" },
			  { else = false } ]

[spam-filter.rule.STWT_HAS_X_AS]
enable = true
scope = "header"
priority = 61
condition = [ { if = "name_lower == 'x-authenticated-sender' && contains(value, ': ')", then = "'HAS_X_AS'" },
			  { else = false } ]

[spam-filter.rule.STWT_HAS_X_GMSV]
enable = true
scope = "header"
priority = 62
condition = [ { if = "name_lower == 'x-get-message-sender-via' && contains(value_lower, 'authenticated_id:')", then = "'HAS_X_GMSV'" },
			  { else = false } ]

[spam-filter.rule.STWT_HIDDEN_SOURCE_OBJ]
enable = true
scope = "header"
priority = 63
condition = [ { if = "contains(['x-source', 'x-source-args', 'x-source-dir'], name_lower) && contains(value, '../')", then = "'HIDDEN_SOURCE_OBJ'" },
			  { else = false } ]

[spam-filter.rule.STWT_X_PHP_EVAL]
enable = true
scope = "header"
priority = 64
condition = [ { if = "contains(value_lower, 'eval()') && contains(['x-php-originating-script', 'x-php-script'], name_lower)", then = "'X_PHP_EVAL'" },
			  { else = false } ]

[spam-filter.rule.STWT_HIDDEN_SOURCE_PHP]
enable = true
scope = "header"
priority = 65
condition = [ { if = "contains(value, '../') && contains(['x-php-originating-script', 'x-php-script'], name_lower)", then = "'HIDDEN_SOURCE_OBJ'" },
			  { else = false } ]

[spam-filter.rule.STWT_UNITEDINTERNET_SPAM]
enable = true
scope = "header"
priority = 66
condition = [ { if = "contains(['x-ui-filterresults', 'x-ui-out-filterresults', 'x-source-dir'], name_lower) && contains(value_lower, 'junk')", then = "'UNITEDINTERNET_SPAM'" },
			  { else = false } ]

[spam-filter.rule.STWT_SPAM_FLAG]
enable = true
scope = "header"
priority = 67
condition = [ { if = "contains(['x-spam', 'x-spam-flag', 'x-spam-status'], name_lower) && (contains(value_lower, 'yes') || contains(value_lower, 'true') || contains(value_lower, 'spam'))", then = "'SPAM_FLAG'" },
			  { else = false } ]

[spam-filter.rule.STWT_KLMS_SPAM]
enable = true
scope = "header"
priority = 68
condition = [ { if = "name_lower == 'x-klms-antispam-status' && contains(value_lower, 'spam')", then = "'KLMS_SPAM'" },
			  { else = false } ]

[spam-filter.rule.STWT_XM_CASE]
enable = true
scope = "header"
priority = 69
condition = [ { if = "name_lower == 'x-mailer' && name != 'X-Mailer'", then = "'XM_CASE'" },
			  { else = false } ]

[spam-filter.rule.STWT_XM_UA_NO_VERSION]
enable = true
scope = "header"
priority = 70
condition = [ { if = "(name_lower == 'user_agent' || name_lower == 'x-mailer') && !is_empty(value) && !has_digits(value)", then = "'XM_UA_NO_VERSION'" },
			  { else = false } ]

[spam-filter.rule.STWT_HAS_PHPMAILER_SIG]
enable = true
scope = "header"
priority = 71
condition = [ { if = "name_lower == 'x-mailer' && contains(value_lower, 'phpmailer')", then = "'HAS_PHPMAILER_SIG'" },
			  { else = false } ]



[spam-filter.llm]
enable = false
model = ""
temperature = "0.5"
prompt = "You are an AI assistant specialized in analyzing email content to detect unsolicited, commercial, or harmful messages. Your task is to examine the provided email, including its subject line, and determine if it falls into any of these categories. Please follow these steps:

- Carefully read the entire email content, including the subject line.
- Look for indicators of unsolicited messages, such as:
   * Lack of prior relationship or consent
   * Mass-mailing characteristics
   * Vague or misleading sender information
- Identify commercial content by checking for:
   * Promotional language
   * Product or service offerings
   * Call-to-action for purchases
- Detect potentially harmful content by searching for:
   * Phishing attempts (requests for personal information, suspicious links)
   * Malware indicators (suspicious attachments, urgent calls to action)
   * Scams or fraudulent schemes
- Analyze the overall tone, intent, and legitimacy of the email.
- Determine the most appropriate single category for the email: Unsolicited, Commercial, Harmful, or Legitimate.
- Assess your confidence level in this determination: High, Medium, or Low.
- Provide a brief explanation for your determination.
- Format your response as follows, separated by commas: Category,Confidence,Explanation
  * Example: Unsolicited,High,The email contains mass-mailing characteristics without any prior relationship context.

Here's the email to analyze, please provide your analysis based on the above instructions, ensuring your response is in the specified comma-separated format:"
separator = ","
categories = ["Unsolicited", "Commercial", "Harmful", "Legitimate"]
confidence = ["High", "Medium", "Low"]

[spam-filter.llm.index]
category = 0
confidence = 1
explanation = 2


[spam-filter.rule.STWT_TO_DN_RECIPIENTS]
enable = true
scope = "email"
priority = 60
condition = [ { if = "contains(['to', 'cc', 'bcc'], location) && contains_ignore_case(name, 'recipient')", then = "'TO_DN_RECIPIENTS'" },
			  { else = false } ]

[spam-filter.rule.STWT_INFO_INFO_LU]
enable = true
scope = "email"
priority = 61
condition = [ { if = "contains(['to', 'cc', 'bcc'], location) && local == 'info' && from.local == 'info' && $X_HDR_LIST_UNSUBSCRIBE", then = "'INFO_TO_INFO_LU'" },
			  { else = false } ]

[spam-filter.rule.STWT_TAGGED_RCPT]
enable = true
scope = "email"
priority = 62
condition = [ { if = "contains(['to', 'cc', 'bcc'], location) && contains(local, '+')", then = "'TAGGED_RCPT'" },
			  { else = false } ]

[spam-filter.rule.STWT_FREE_OR_DISP]
enable = true
scope = "email"
priority = 63
condition = [ { if = "!contains(['env_from', 'from', 'reply_to', 'to', 'cc', 'bcc', 'dnt'], location) || is_empty(sld)", then = "false" },
			  { if = "key_exists('stwt_free_domains', domain)", then = "'FREEMAIL_' + to_uppercase(location)" },
			  { if = "key_exists('stwt_disposable_domains', domain)", then = "'DISPOSABLE_' + to_uppercase(location)" },
			  { else = false } ]


[spam-filter.rule.STWT_SUBJ_BOUNCE_WORDS]
enable = true
scope = "any"
priority = 20
condition = [ { if = "(contains(subject, 'delivery') && 
            (contains(subject, 'failed') || 
             contains(subject, 'report') || 
             contains(subject, 'status') || 
             contains(subject, 'warning'))) ||
         (contains(subject, 'failure') && 
            (contains(subject, 'delivery') || 
             contains(subject, 'notice') || 
             contains(subject, 'mail') )) ||
         (contains(subject, 'delivered') &&
            (contains(subject, 'couldn\\'t be') || 
             contains(subject, 'could not be') || 
             contains(subject, 'hasn\\'t been') || 
             contains(subject, 'has not been'))) ||
         contains(subject, 'returned mail') ||
         contains(subject, 'undeliverable') || 
         contains(subject, 'undelivered')", then = "'SUBJ_BOUNCE_WORDS'" },
			   { else = false } ]

[spam-filter.rule.STWT_BOUNCE_SUBJECT]
enable = true
scope = "any"
priority = 21
condition = [ { if = "!$BOUNCE && is_empty(env_from) && $SUBJ_BOUNCE_WORDS && (contains(from.local, 'postmaster') || contains(from.local, 'mailer-daemon'))", then = "'BOUNCE'" },
			   { else = false } ]

[spam-filter.rule.STWT_SUBJECT_HAS_SYMBOLS]
enable = true
scope = "any"
priority = 22
condition = [ { if = "ends_with(trim(subject), '!')", then = "'SUBJECT_ENDS_EXCLAIM'" },
              { if = "ends_with(trim(subject), '?')", then = "'SUBJECT_ENDS_QUESTION'" },
              { if = "contains(subject, '!')", then = "'SUBJECT_HAS_EXCLAIM'" },
              { if = "contains(subject, '?')", then = "'SUBJECT_HAS_QUESTION'" },
			  { else = false } ]

[spam-filter.rule.STWT_LONG_SUBJ]
enable = true
scope = "any"
priority = 23
condition = [ { if = "len(subject) > 200", then = "'LONG_SUBJ'" },
			  { else = false } ]

[spam-filter.rule.STWT_FAKE_REPLY]
enable = true
scope = "any"
priority = 24
condition = [ { if = "contains_ignore_case(['re', 'aw', 'antw', 'sv'], split_once(subject, ':')[0]) && !$X_HDR_IN_REPLY_TO && !$X_HDR_REFERENCES", then = "'FAKE_REPLY'" },
			  { else = false } ]



[spam-filter.rule.STWT_PHISHED_OPEN]
enable = true
scope = "url"
priority = 50
condition = [ { if = "key_exists('stwt_openphish', url)", then = "'PHISHED_OPENPHISH'" },
			  { else = false } ]

[spam-filter.rule.STWT_PHISHED_TANK]
enable = true
scope = "url"
priority = 51
condition = [ { if = "key_exists('stwt_phishtank', url)", then = "'PHISHED_PHISHTANK'" },
			  { else = false } ]

[spam-filter.rule.STWT_HAS_GOOGLE_URL]
enable = true
scope = "url"
priority = 52
condition = [ { if = "ends_with(host, 'googleusercontent.com') && starts_with(path_query, '/proxy/')", then = "'HAS_GUC_PROXY_URI'" },
              { if = "ends_with(host, 'firebasestorage.googleapis.com')", then = "'HAS_GOOGLE_FIREBASE_URL'" },
              { if = "starts_with(sld, 'google.') && contains(path_query, 'url?')", then = "'HAS_GOOGLE_REDIR'" },
    		  { else = false } ]

[spam-filter.rule.STWT_IPFS_OR_ONION]
enable = true
scope = "url"
priority = 53
condition = [ { if = "(contains(host, 'ipfs.') || contains(path_query, '/ipfs')) && contains(path_query, '/qm')", then = "'HAS_IPFS_GATEWAY_URL'" },
              { if = "ends_with(host, '.onion')", then = "'HAS_ONION_URI'" }, 
			  { else = false } ]

[spam-filter.rule.STWT_WP_COMPROMISED]
enable = true
scope = "url"
priority = 54
condition = [ { if = "starts_with(path, '/wp-content') || starts_with(path, '/wp-includes')", then = "'WP_COMPROMISED'" },
              { if = "starts_with(path, '/wp-')", then = "'HAS_WP_URI'" }, 
			  { else = false } ]

[spam-filter.rule.STWT_URI_HIDDEN_PATH]
enable = true
scope = "url"
priority = 55
condition = [ { if = "contains(path_query, '/../') && !contains(path_query, '/well-known') && !contains(path_query, '/well_known')", then = "'URI_HIDDEN_PATH'" },
			  { else = false } ]


# Lists
[spam-filter.list]
file-extensions = {
"bat" = "BAD",
"chm" = "BAD",
"com" = "BAD",
"exe" = "BAD",
"hta" = "BAD|NZ",
"iso" = "BAD",
"jar" = "BAD|NZ",
"lnk" = "BAD",
"scr" = "BAD",
"htm" = "text/html|BAD",
"html" = "text/html|BAD",
"shtm" = "text/html|BAD",
"shtml" = "text/html|BAD",
"ace" = "BAD|AR",
"arj" = "BAD|AR",
"asx" = "BAD",
"cab" = "BAD|AR",
"sfx" = "BAD",
"vst" = "BAD",
"vss" = "BAD",
"ade" = "BAD",
"adp" = "BAD",
"cmd" = "BAD",
"cpl" = "BAD",
"ins" = "BAD",
"isp" = "BAD",
"js" = "BAD|NZ",
"jse" = "BAD",
"lib" = "BAD",
"mde" = "BAD",
"msc" = "BAD",
"msi" = "BAD",
"msp" = "BAD",
"mst" = "BAD",
"nsh" = "BAD",
"pif" = "BAD",
"sct" = "BAD",
"shb" = "BAD",
"sys" = "BAD",
"vb" = "BAD",
"vbe" = "BAD",
"vbs" = "BAD|NZ",
"vxd" = "BAD",
"wsc" = "BAD",
"wsh" = "BAD",
"app" = "BAD",
"asp" = "BAD",
"bas" = "BAD",
"cnt" = "BAD",
"csh" = "BAD",
"diagcab" = "BAD",
"fxp" = "BAD",
"gadget" = "BAD",
"grp" = "BAD",
"hlp" = "BAD",
"hpj" = "BAD",
"inf" = "BAD",
"its" = "BAD",
"jnlp" = "BAD",
"ksh" = "BAD",
"mad" = "BAD",
"maf" = "BAD",
"mag" = "BAD",
"mam" = "BAD",
"maq" = "BAD",
"mar" = "BAD",
"mas" = "BAD",
"mat" = "BAD",
"mau" = "BAD",
"mav" = "BAD",
"maw" = "BAD",
"mcf" = "BAD",
"mda" = "BAD",
"mdb" = "BAD",
"mdt" = "BAD",
"mdw" = "BAD",
"mdz" = "BAD",
"msh" = "BAD",
"msh1" = "BAD",
"msh2" = "BAD",
"mshxml" = "BAD",
"msh1xml" = "BAD",
"msh2xml" = "BAD",
"msu" = "BAD",
"ops" = "BAD",
"osd" = "BAD",
"pcd" = "BAD",
"pl" = "BAD",
"plg" = "BAD",
"prf" = "BAD",
"prg" = "BAD",
"printerexport" = "BAD",
"ps1" = "BAD",
"ps1xml" = "BAD",
"ps2" = "BAD",
"ps2xml" = "BAD",
"psc1" = "BAD",
"psc2" = "BAD",
"psd1" = "BAD",
"psdm1" = "BAD",
"pst" = "BAD",
"reg" = "BAD",
"scf" = "BAD",
"shs" = "BAD",
"theme" = "BAD",
"url" = "BAD",
"vbp" = "BAD",
"vsmacros" = "BAD",
"vsw" = "BAD",
"webpnp" = "BAD",
"website" = "BAD",
"ws" = "BAD",
"xbap" = "BAD",
"xll" = "BAD",
"xnk" = "BAD",
"docx" = "NZ",
"docm" = "BAD",
"pptm" = "BAD",
"xlsm" = "BAD",
"pdf" = "application/pdf|application/x-pdf|NZ",
"pptx" = "NZ",
"wsf" = "NZ",
"xlsx" = "NZ",
"7x" = "AR",
"alz" = "AR",
"bz2" = "AR",
"egg" = "AR",
"lz" = "AR",
"rar" = "AR",
"xz" = "AR",
"zip" = "AR",
"txt" = "text/plain|message/disposition-notification|text/rfc822-headers"}


[http-lookup.STWT_OPENPHISH]
enable = true
url = "https://openphish.com/feed.txt"
format = "list"
retry = "1h"
refresh = "12h"
timeout = "30s"
limits.size = 104857600
limits.entries = 900000
limits.entry-size = 512

[http-lookup.STWT_PHISHTANK]
enable = true
url = "https://data.phishtank.com/data/online-valid.csv.gz"
format = "csv"
separator = ","
index.key = 1
skip-first = true
gzipped = true
retry = "1h"
refresh = "6h"
timeout = "30s"
limits.size = 104857600
limits.entries = 900000
limits.entry-size = 512

[http-lookup.STWT_DISPOSABLE_DOMAINS]
enable = true
url = "https://disposable.github.io/disposable-email-domains/domains_mx.txt"
format = "list"
retry = "1h"
refresh = "24h"
timeout = "30s"
limits.size = 104857600
limits.entries = 900000
limits.entry-size = 512

[http-lookup.STWT_FREE_DOMAINS]
enable = true
url = "https://gist.githubusercontent.com/okutbay/5b4974b70673dfdcc21c517632c1f984/raw/993a35930a8d24a1faab1b988d19d38d92afbba4/free_email_provider_domains.txt"
format = "list"
retry = "1h"
refresh = "720h"
timeout = "30s"
limits.size = 104857600
limits.entries = 900000
limits.entry-size = 512


[spam-filter.list]
scores = {"ABUSE_SURBL" = "5.0",
"ARC_ALLOW" = "0.0",
"ARC_DNSFAIL" = "0.0",
"ARC_INVALID" = "0.5",
"ARC_NA" = "0.0",
"ARC_REJECT" = "1.0",
"ARC_SIGNED" = "0.0",
"AUTH_NA" = "1.0",
"AUTH_NA_OR_FAIL" = "1.0",
"AUTOGEN_PHP_SPAMMY" = "1.0",
"PROB_HAM_HIGH" = "-8.0",
"PROB_HAM_MEDIUM" = "-6.0",
"PROB_HAM_LOW" = "-2.0",
"PROB_SPAM_UNCERTAIN" = "0.0",
"PROB_SPAM_LOW" = "2.0",
"PROB_SPAM_MEDIUM" = "6.0",
"PROB_SPAM_HIGH" = "8.0",
"BODY_URI_ONLY" = "2.0",
"GTUBE_TEST" = "1000.0",
"BOGUS_ENCRYPTED_AND_TEXT" = "10.0",
"BOUNCE" = "-0.1",
"BOUNCE_NO_AUTH" = "1.0",
"BROKEN_CONTENT_TYPE" = "1.5",
"COMPROMISED_ACCT_BULK" = "3.0",
"CRACKED_SURBL" = "5.0",
"CTE_CASE" = "0.5",
"CTYPE_MISSING_DISPOSITION" = "4.0",
"CTYPE_MIXED_BOGUS" = "1.0",
"CT_EXTRA_SEMI" = "1.0",
"DATA_URI_OBFU" = "2.0",
"DATE_IN_FUTURE" = "4.0",
"DATE_IN_PAST" = "1.0",
"DBL_ABUSE" = "5.0",
"DBL_ABUSE_BOTNET" = "6.5",
"DBL_ABUSE_MALWARE" = "6.5",
"DBL_ABUSE_PHISH" = "6.5",
"DBL_ABUSE_REDIR" = "5.0",
"DBL_BLOCKED" = "0.0",
"DBL_BLOCKED_OPENRESOLVER" = "0.0",
"DBL_BOTNET" = "7.5",
"DBL_MALWARE" = "7.5",
"DBL_PHISH" = "7.5",
"DBL_SPAM" = "6.5",
"DCC_BULK" = "3.0",
"DIRECT_TO_MX" = "2.0",
"DISPOSABLE_CC" = "0.0",
"DISPOSABLE_ENV_FROM" = "0.0",
"DISPOSABLE_FROM" = "0.0",
"DISPOSABLE_REPLYTO" = "0.0",
"DISPOSABLE_TO" = "0.0",
"DISPOSABLE_DNT" = "0.5",
"DKIM_SIGNED" = "0.0",
"DMARC_BAD_POLICY" = "0.5",
"DMARC_DNSFAIL" = "0.0",
"DMARC_NA" = "1.0",
"DMARC_POLICY_ALLOW" = "-0.5",
"DMARC_POLICY_ALLOW_WITH_FAILURES" = "0.0",
"DMARC_POLICY_QUARANTINE" = "1.5",
"DMARC_POLICY_REJECT" = "4.0",
"DMARC_POLICY_SOFTFAIL" = "0.1",
"DNSWL_BLOCKED" = "0.0",
"DWL_DNSWL_BLOCKED" = "0.0",
"DWL_DNSWL_HI" = "-3.5",
"DWL_DNSWL_LOW" = "-1.0",
"DWL_DNSWL_MED" = "-2.0",
"DWL_DNSWL_NONE" = "0.0",
"EMPTY_SUBJECT" = "1.0",
"ENCRYPTED_PGP" = "-0.5",
"ENCRYPTED_SMIME" = "-0.5",
"ENV_FROM_INVALID" = "2.0",
"EXT_CSS" = "1.0",
"FAKE_REPLY" = "1.0",
"FORGED_RCVD_TRAIL" = "1.0",
"FORGED_RECIPIENTS" = "2.0",
"FORGED_RECIPIENTS_MAILLIST" = "0.0",
"FORGED_SENDER" = "0.3",
"FORGED_SENDER_MAILLIST" = "0.0",
"FREEMAIL_AFF" = "4.0",
"FREEMAIL_CC" = "0.0",
"FREEMAIL_ENV_FROM" = "0.0",
"FREEMAIL_FROM" = "0.0",
"FREEMAIL_REPLY_TO" = "0.0",
"FREEMAIL_REPLY_TO_NEQ_FROM_DOM" = "3.0",
"FREEMAIL_TO" = "0.0",
"FREEMAIL_DNT" = "0.0",
"FROM_DN_EQ_ADDR" = "1.0",
"FROM_EQ_ENV_FROM" = "0.0",
"FROM_EXCESS_BASE64" = "1.5",
"FROM_EXCESS_QP" = "1.2",
"FROM_HAS_DN" = "0.0",
"FROM_INVALID" = "2.0",
"FROM_NAME_EXCESS_SPACE" = "1.0",
"FROM_NAME_HAS_TITLE" = "1.0",
"FROM_NEEDS_ENCODING" = "1.0",
"FROM_NEQ_DISPLAY_NAME" = "4.0",
"FROM_NEQ_ENV_FROM" = "0.0",
"FROM_NO_DN" = "0.0",
"FROM_SERVICE_ACCT" = "1.0",
"HACKED_WP_PHISHING" = "4.5",
"HAS_ANON_DOMAIN" = "0.1",
"HAS_ATTACHMENT" = "0.0",
"HAS_DATA_URI" = "0.0",
"HAS_GOOGLE_FIREBASE_URL" = "2.0",
"HAS_GOOGLE_REDIR" = "1.0",
"HAS_GUC_PROXY_URI" = "1.0",
"HAS_IPFS_GATEWAY_URL" = "6.0",
"HAS_LIST_UNSUB" = "-0.01",
"HAS_ONION_URI" = "0.0",
"HAS_PHPMAILER_SIG" = "0.0",
"HAS_REPLYTO" = "0.0",
"HAS_WP_URI" = "0.0",
"HAS_X_AS" = "0.0",
"HAS_X_GMSV" = "0.0",
"HAS_X_PRIO_FIVE" = "0.0",
"HAS_X_PRIO_ONE" = "0.0",
"HAS_X_PRIO_THREE" = "0.0",
"HAS_X_PRIO_TWO" = "0.0",
"HAS_X_PRIO_ZERO" = "0.0",
"HEADER_EMPTY_DELIMITER" = "1.0",
"HEADER_FORGED_MDN" = "2.0",
"HEADER_RCONFIRM_MISMATCH" = "2.0",
"FROMHOST_NORES_A_OR_MX" = "1.5",
"FROM_BOUNCE" = "0.0",
"HELO_BAREIP" = "3.0",
"HELO_IP_A" = "1.0",
"HELO_NORES_A_OR_MX" = "0.3",
"HELO_NOT_FQDN" = "2.0",
"HELO_IPREV_MISMATCH" = "1.0",
"RCPT_BOUNCEMOREONE" = "1.5",
"URL_ONLY" = "2.2",
"HIDDEN_SOURCE_OBJ" = "2.0",
"HTML_META_REFRESH_URL" = "5.0",
"HTML_SHORT_LINK_IMG_1" = "2.0",
"HTML_SHORT_LINK_IMG_2" = "1.0",
"HTML_SHORT_LINK_IMG_3" = "0.5",
"HTML_TEXT_IMG_RATIO" = "1.0",
"HTML_UNBALANCED_TAG" = "0.5",
"HTTP_TO_HTTPS" = "0.5",
"HTTP_TO_IP" = "1.0",
"INFO_TO_INFO_LU" = "2.0",
"INVALID_DATE" = "1.5",
"INVALID_FROM_8BIT" = "6.0",
"INVALID_MSGID" = "1.7",
"KLMS_SPAM" = "5.0",
"LONG_SUBJ" = "3.0",
"MAILLIST" = "-0.2",
"MANY_INVISIBLE_PARTS" = "1.0",
"MID_BARE_IP" = "2.0",
"MID_CONTAINS_FROM" = "1.0",
"MID_CONTAINS_TO" = "1.0",
"MID_MISSING_BRACKETS" = "1.0",
"MID_RHS_IP_LITERAL" = "1.0",
"MID_RHS_MATCH_FROM" = "1.0",
"MID_RHS_MATCH_FROMTLD" = "0.0",
"MID_RHS_MATCH_TO" = "1.0",
"MID_RHS_NOT_FQDN" = "0.5",
"MID_RHS_WWW" = "0.5",
"MIME_ARCHIVE_IN_ARCHIVE" = "5.0",
"MIME_BAD" = "1.0",
"MIME_BAD_ATTACHMENT" = "4.0",
"MIME_BAD_EXTENSION" = "2.0",
"MIME_BAD_UNICODE" = "8.0",
"MIME_BASE64_TEXT" = "0.1",
"MIME_BASE64_TEXT_BOGUS" = "1.0",
"MIME_DOUBLE_BAD_EXTENSION" = "2.0",
"MIME_GOOD" = "-0.1",
"MIME_HEADER_CTYPE_ONLY" = "2.0",
"MIME_HTML_ONLY" = "0.2",
"MIME_MA_MISSING_HTML" = "1.0",
"MIME_MA_MISSING_TEXT" = "2.0",
"MISSING_DATE" = "1.0",
"MISSING_FROM" = "2.0",
"MISSING_MID" = "2.5",
"MISSING_MIME_VERSION" = "2.0",
"MISSING_SUBJECT" = "2.0",
"MISSING_TO" = "2.0",
"MSBL_EBL" = "7.5",
"MSBL_EBL_GREY" = "0.5",
"MULTIPLE_FROM" = "8.0",
"MULTIPLE_UNIQUE_HEADERS" = "7.0",
"MV_CASE" = "0.5",
"MW_SURBL_MULTI" = "7.5",
"HOMOGRAPH_URL" = "5.0",
"PHISHED_OPENPHISH" = "7.0",
"PHISHED_PHISHTANK" = "7.0",
"PHISHING" = "4.0",
"PHISH_EMOTION" = "1.0",
"PH_SURBL_MULTI" = "7.5",
"PRECEDENCE_BULK" = "0.0",
"PREVIOUSLY_DELIVERED" = "0.0",
"PYZOR" = "3.5",
"RBL_BARRACUDA" = "4.0",
"RBL_BLOCKLISTDE" = "4.0",
"RBL_MAILSPIKE_BAD" = "1.0",
"RBL_MAILSPIKE_VERYBAD" = "1.5",
"RBL_MAILSPIKE_WORST" = "2.0",
"RBL_SEM" = "1.0",
"RBL_SEM_IPV6" = "1.0",
"RBL_SENDERSCORE_BOT" = "2.0",
"RBL_SENDERSCORE_NA" = "0.0",
"RBL_SENDERSCORE_NA_BOT" = "1.0",
"RBL_SENDERSCORE_PRST" = "2.0",
"RBL_SENDERSCORE_PRST_BOT" = "3.0",
"RBL_SENDERSCORE_PRST_NA" = "2.0",
"RBL_SENDERSCORE_PRST_NA_BOT" = "3.0",
"RBL_SENDERSCORE_SUS_ATT" = "1.0",
"RBL_SENDERSCORE_SUS_ATT_NA" = "1.0",
"RBL_SENDERSCORE_SUS_ATT_NA_BOT" = "1.5",
"RBL_SENDERSCORE_SUS_ATT_PRST_NA" = "3.0",
"RBL_SENDERSCORE_SUS_ATT_PRST_NA_BOT" = "3.5",
"RBL_SENDERSCORE_SCORE" = "2.0",
"RBL_SENDERSCORE_SCORE_NA" = "2.0",
"RBL_SENDERSCORE_SCORE_PRST" = "4.0",
"RBL_SENDERSCORE_SCORE_PRST_NA" = "4.0",
"RBL_SENDERSCORE_SCORE_SUS_ATT_NA" = "3.0",
"RBL_SENDERSCORE_BLOCKED" = "0.0",
"RBL_SENDERSCORE_REPUT_UNKNOWN" = "0.0",
"RBL_SENDERSCORE_REPUT_0" = "4.0",
"RBL_SENDERSCORE_REPUT_1" = "3.5",
"RBL_SENDERSCORE_REPUT_2" = "3.0",
"RBL_SENDERSCORE_REPUT_3" = "2.5",
"RBL_SENDERSCORE_REPUT_4" = "2.0",
"RBL_SENDERSCORE_REPUT_5" = "1.5",
"RBL_SENDERSCORE_REPUT_6" = "1.0",
"RBL_SENDERSCORE_REPUT_7" = "0.5",
"RBL_SENDERSCORE_REPUT_8" = "0.0",
"RBL_SENDERSCORE_REPUT_9" = "-1.0",
"RBL_SENDERSCORE_REPUT_BLOCKED" = "0.0",
"RBL_SPAMCOP" = "4.0",
"RBL_SPAMHAUS_BLOCKED" = "0.0",
"RBL_SPAMHAUS_BLOCKED_OPENRESOLVER" = "0.0",
"RBL_SPAMHAUS_CSS" = "2.0",
"RBL_SPAMHAUS_DROP" = "7.0",
"RBL_SPAMHAUS_PBL" = "2.0",
"RBL_SPAMHAUS_SBL" = "4.0",
"RBL_SPAMHAUS_XBL" = "4.0",
"RBL_VIRUSFREE_BOTNET" = "2.0",
"RCPT_IN_SUBJECT" = "3.0",
"RCPT_DOMAIN_IN_SUBJECT" = "2.0",
"RCPT_DOMAIN_IN_MESSAGE" = "2.0",
"RCPT_COUNT_FIVE" = "0.0",
"RCPT_COUNT_GT_50" = "1.0",
"RCPT_COUNT_ONE" = "0.0",
"RCPT_COUNT_SEVEN" = "0.0",
"RCPT_COUNT_THREE" = "0.0",
"RCPT_COUNT_TWELVE" = "0.0",
"RCPT_COUNT_TWO" = "0.0",
"RCPT_COUNT_ZERO" = "0.0",
"RCPT_LOCAL_IN_SUBJECT" = "2.0",
"RCVD_COUNT_FIVE" = "0.0",
"RCVD_COUNT_ONE" = "0.0",
"RCVD_COUNT_SEVEN" = "0.0",
"RCVD_COUNT_THREE" = "0.0",
"RCVD_COUNT_TWELVE" = "0.0",
"RCVD_COUNT_TWO" = "0.0",
"RCVD_COUNT_ZERO" = "0.1",
"RCVD_DKIM_ARC_DNSWL_HI" = "-1.0",
"RCVD_DKIM_ARC_DNSWL_MED" = "-0.5",
"RCVD_DOUBLE_IP_SPAM" = "2.0",
"RCVD_HELO_USER" = "3.0",
"RCVD_ILLEGAL_CHARS" = "4.0",
"RCVD_IN_DNSWL_HI" = "-0.5",
"RCVD_IN_DNSWL_LOW" = "-0.1",
"RCVD_IN_DNSWL_MED" = "-0.2",
"RCVD_IN_DNSWL_NONE" = "0.0",
"RCVD_NO_TLS_LAST" = "0.1",
"RCVD_TLS_ALL" = "0.0",
"RCVD_TLS_LAST" = "0.0",
"RCVD_UNAUTH_PBL" = "2.0",
"RCVD_VIA_SMTP_AUTH" = "0.0",
"RDNS_DNSFAIL" = "0.0",
"RDNS_NONE" = "2.0",
"RECEIVED_BLOCKLISTDE" = "3.0",
"RECEIVED_SPAMHAUS_BLOCKED" = "0.0",
"RECEIVED_SPAMHAUS_BLOCKED_OPENRESOLVER" = "0.0",
"RECEIVED_SPAMHAUS_CSS" = "1.0",
"RECEIVED_SPAMHAUS_PBL" = "0.0",
"RECEIVED_SPAMHAUS_SBL" = "3.0",
"RECEIVED_SPAMHAUS_XBL" = "1.0",
"REDIRECTOR_URL" = "0.0",
"REDIRECTOR_URL_ONLY" = "1.0",
"REPLYTO_ADDR_EQ_FROM" = "0.0",
"REPLYTO_DN_EQ_FROM_DN" = "0.0",
"REPLYTO_DOM_EQ_FROM_DOM" = "0.0",
"REPLYTO_DOM_NEQ_FROM_DOM" = "0.0",
"REPLYTO_EMAIL_HAS_TITLE" = "2.0",
"REPLYTO_EQ_FROM" = "0.0",
"REPLYTO_EQ_TO_ADDR" = "5.0",
"REPLYTO_EXCESS_BASE64" = "1.5",
"REPLYTO_EXCESS_QP" = "1.2",
"REPLYTO_UNPARSABLE" = "1.0",
"RWL_MAILSPIKE_EXCELLENT" = "-0.4",
"RWL_MAILSPIKE_GOOD" = "-0.1",
"RWL_MAILSPIKE_NEUTRAL" = "0.0",
"RWL_MAILSPIKE_POSSIBLE" = "0.0",
"RWL_MAILSPIKE_VERYGOOD" = "-0.2",
"BAD_CTE_7BIT" = "3.5",
"DKIM_ALLOW" = "-0.2",
"DKIM_NA" = "0.0",
"DKIM_PERMFAIL" = "0.0",
"DKIM_REJECT" = "1.0",
"DKIM_TEMPFAIL" = "0.0",
"MISSING_CHARSET" = "0.5",
"MIXED_CHARSET" = "2.0",
"MIXED_CHARSET_URL" = "7.0",
"NO_SPACE_IN_FROM" = "1.0",
"PARTS_DIFFER" = "1.0",
"SPF_ALLOW" = "-0.2",
"SPF_DNSFAIL" = "0.0",
"SPF_FAIL" = "1.0",
"SPF_NA" = "0.0",
"SPF_NEUTRAL" = "0.0",
"SPF_PERMFAIL" = "0.0",
"SPF_SOFTFAIL" = "0.0",
"SUSPICIOUS_URL" = "5.0",
"UNPARSABLE_URL" = "0.5",
"UNDISC_RCPT" = "3.0",
"SEM_URIBL" = "3.5",
"SEM_URIBL_FRESH15" = "3.0",
"SIGNED_PGP" = "-2.0",
"SIGNED_SMIME" = "-2.0",
"SORTED_RECIPS" = "3.5",
"SPAM_FLAG" = "5.0",
"SPAM_TRAP" = "15.0",
"SPOOF_DISPLAY_NAME" = "8.0",
"SPOOF_REPLYTO" = "6.0",
"SUBJECT_ENDS_EXCLAIM" = "0.0",
"SUBJECT_ENDS_QUESTION" = "1.0",
"SUBJECT_ENDS_SPACES" = "0.5",
"SUBJECT_HAS_CURRENCY" = "1.0",
"SUBJECT_HAS_EXCLAIM" = "0.0",
"SUBJECT_HAS_QUESTION" = "0.0",
"SUBJECT_NEEDS_ENCODING" = "1.0",
"SUBJ_ALL_CAPS" = "3.0",
"SUBJ_BOUNCE_WORDS" = "0.0",
"SUBJ_EXCESS_BASE64" = "1.5",
"SUBJ_EXCESS_QP" = "1.2",
"SURBL_BLOCKED" = "0.0",
"SURBL_HASHBL_ABUSE" = "5.0",
"SURBL_HASHBL_CRACKED" = "5.0",
"SURBL_HASHBL_EMAIL" = "5.0",
"SURBL_HASHBL_MALWARE" = "6.5",
"SURBL_HASHBL_PHISH" = "6.5",
"SUSPICIOUS_RECIPS" = "1.5",
"TAGGED_FROM" = "0.0",
"TAGGED_RCPT" = "0.0",
"THREAD_HIJACKING_FROM_INJECTOR" = "2.0",
"TO_DN_ALL" = "0.0",
"TO_DN_EQ_ADDR_ALL" = "0.0",
"TO_DN_EQ_ADDR_SOME" = "0.0",
"TO_DN_NONE" = "0.0",
"TO_DN_RECIPIENTS" = "2.0",
"TO_DN_SOME" = "0.0",
"TO_DOM_EQ_FROM_DOM" = "0.0",
"TO_EQ_FROM" = "0.0",
"TO_EXCESS_BASE64" = "1.5",
"TO_EXCESS_QP" = "1.2",
"TO_MATCH_ENVRCPT_ALL" = "0.0",
"TO_MATCH_ENVRCPT_SOME" = "0.0",
"TO_NEEDS_ENCODING" = "1.0",
"TO_WRAPPED_IN_SPACES" = "2.0",
"TRUSTED_REPLY" = "-7.0",
"UNDISC_RCPTS_BULK" = "3.0",
"UNITEDINTERNET_SPAM" = "5.0",
"URIBL_BLACK" = "7.5",
"URIBL_BLOCKED" = "0.0",
"URIBL_GREY" = "2.5",
"URIBL_RED" = "0.5",
"URI_COUNT_ODD" = "0.5",
"URI_HIDDEN_PATH" = "1.0",
"URL_IN_SUBJECT" = "4.0",
"URL_REDIRECTOR_NESTED" = "1.0",
"VIOLATED_DIRECT_SPF" = "3.5",
"WP_COMPROMISED" = "0.0",
"WWW_DOT_DOMAIN" = "0.5",
"XM_CASE" = "0.5",
"XM_UA_NO_VERSION" = "0.01",
"X_PHP_EVAL" = "4.0",
"ZERO_WIDTH_SPACE_URL" = "7.0",
"SHORT_PART_BAD_HEADERS" = "7.0",
"MISSING_ESSENTIAL_HEADERS" = "7.0",
"SINGLE_SHORT_PART" = "0.0",
"COMPLETELY_EMPTY" = "7.0",
"LLM_UNSOLICITED_HIGH" = "3.0",
"LLM_UNSOLICITED_MEDIUM" = "2.0",
"LLM_UNSOLICITED_LOW" = "0.5",
"LLM_COMMERCIAL_HIGH" = "3.0",
"LLM_COMMERCIAL_MEDIUM" = "2.0",
"LLM_COMMERCIAL_LOW" = "0.5",
"LLM_HARMFUL_HIGH" = "3.0",
"LLM_HARMFUL_MEDIUM" = "2.0",
"LLM_HARMFUL_LOW" = "0.5",
"LLM_LEGITIMATE_HIGH" = "-3.0",
"LLM_LEGITIMATE_MEDIUM" = "-2.0",
"LLM_LEGITIMATE_LOW" = "-0.5",
"SUSPICIOUS_MDN" = "2.0",
"SUSPICIOUS_AUTH_ORIGIN" = "0.0",
"ABUSE_FROM_INJECTOR" = "2.0",
"MIME_BAD_EXT_WITH_BAD_UNICODE" = "8.0",
"HAS_SEO_WORD" = "0.0",
"SEO_SPAM" = "5.0",
"TRUSTED_DOMAIN" = "-7.0",
"BLOCKED_DOMAIN" = "reject"}


[lookup]
surbl-hashbl = { "0ven.io",
"1drv.ms",
"1kb.link",
"1th.me",
"2ww.me",
"4.fo",
"abre.ai",
"alturl.com",
"api.whatsapp.com",
"arweave.net",
"bit.do",
"bit.ly",
"bitly.ws",
"bom.so",
"buff.ly",
"c4rex.co",
"cdn.discordapp.com",
"cdn.via.com",
"cf-ipfs.com",
"citly.me",
"clcr.me",
"cld.pt",
"cleanuri.com",
"clicktracker.net",
"cloudflare-ipfs.com",
"commondatastorage.googleapis.com",
"crustwebsites.net",
"cutlly.com",
"cutt.ly",
"cutt.us",
"d8hxy.app.goo.gl",
"dik.si",
"drive.google.com",
"dweb.link",
"eblink4.com",
"eblink5.com",
"eu2.contabostorage.com",
"firebasestorage.googleapis.com",
"fleek.cool",
"fleek.ipfs.io",
"flowto.it",
"forms.gle",
"g.bmb.jp",
"gateway.ipfs.io",
"gateway.lighthouse.storage",
"geno.link",
"gg.gg",
"ggle.io",
"goo.gl",
"goo.su",
"gtly.to",
"han.gl",
"hardbin.com",
"hashbltest.surbl.org",
"hashbltest2.surbl.org",
"heyflow.id",
"ht.ly",
"htl.li",
"httpslink.com",
"ibit.ly",
"inx.lv",
"ipfs.eth.aragon.network",
"ipfs.fleek.co",
"ipfs.io",
"iqy.im",
"is.gd",
"itsssl.com",
"ja.cat",
"ja2r7.app.goo.gl",
"jpeg.ly",
"kortlink.dk",
"kutt.it",
"kuza.me",
"l8.nu",
"li-ne.me",
"lihi.cc",
"lin.ee",
"line.me",
"link-shortener.net",
"link.nn.ru",
"linkmn.gr",
"linktr.ee",
"ln.run",
"lnk.sk",
"lnkd.in",
"lnkiy.in",
"m17.ca",
"m1s.it",
"m6z.cn",
"me-qr.com",
"mpago.la",
"mq.mbd.baidu.com",
"mq4.ru",
"mub.me",
"my.forms.app",
"n9.cl",
"nftstorage.link",
"objects-us-east-1.dream.io",
"ow.ly",
"p.st",
"pastebin.com",
"peg3z.app.goo.gl",
"peyg.ir",
"piplynow.com",
"ppt.cc",
"ptpn4.id",
"pxlme.me",
"qrco.de",
"qrs.ly",
"r10.to",
"rb.gy",
"rcw3r.app.goo.gl",
"rebrand.ly",
"reurl.cc",
"rotf.lol",
"rplg.co",
"s.free.fr",
"s.id",
"s.lu",
"s3.amazonaws.com",
"s3.us-west-1.amazonaws.com",
"sfo3.digitaloceanspaces.com",
"sgp1.digitaloceanspaces.com",
"shln.me",
"short-me.me",
"short.gy",
"shorter.gg",
"shortly.at",
"shorturl.ac",
"shorturl.asia",
"shorturl.at",
"shrinke.me",
"shrtco.de",
"siasky.net",
"sites.google.com",
"snip.ly",
"ssur.cc",
"storage.cloud.google.com",
"storage.googleapis.com",
"storageapi.fleek.co",
"substack.com",
"surl.li",
"swll.to",
"syd1.digitaloceanspaces.com",
"t.co",
"t.ly",
"t.me",
"telegra.ph",
"tiny.cc",
"tiny.one",
"tinylink.in",
"tinyurl.com",
"tls.tc",
"tny.im",
"to.sv",
"trimmer.to",
"twtr.to",
"tyl.ke",
"u.to",
"uclck.ru",
"url-s.xyz",
"url.com",
"url.zip",
"urlcc.cc",
"urly.it",
"urlz.fr",
"urlzs.com",
"usc1.contabostorage.com",
"vk.cc",
"vk.sv",
"vo.la",
"wa.link",
"wa.me",
"www.bit.do",
"www.goo.su",
"x.gd",
"xek99.app.goo.gl",
"xurl.es",
"yhv6e.app.goo.gl",
"zpr.io"}


[lookup]
trusted-domains = {"126.com",
"163.com",
"1gost.info",
"1stnationalbank.com",
"2o7.net",
"365online.com",
"4at1.com",
"53.com",
"5iantlavalamp.com",
"abl.com.pk",
"about.com",
"accessbankplc.com",
"adelphia.net",
"adib.ae",
"adobe.com",
"agora-inc.com",
"agoramedia.com",
"aibgb.co.uk",
"aib.ie",
"airdriesavingsbank.com",
"akamai.net",
"akamaitech.net",
"aldermore.co.uk",
"alexa.com",
"alliancebank.com.my",
"alliancefg.com",
"alliantcreditunion.com",
"alliantcreditunion.org",
"allianz.de",
"allybank.com",
"alterna.ca",
"amazon.com",
"americanexpress.ch",
"americanexpress.com",
"anadolubank.nl",
"ancestry.com",
"anz.com",
"anz.co.nz",
"aol.com",
"apache.org",
"apple.com",
"arbuthnotlatham.co.uk",
"arcamax.com",
"asb.co.nz",
"ask.com",
"astrology.com",
"atdmt.com",
"att.net",
"authorize.net",
"autorambler.ru",
"axisbank.co.in",
"axisbank.com",
"b2bbank.com",
"baaderbank.de",
"baidu.com",
"baloise.ch",
"baml.com",
"banamex.com",
"bancanetbsc.do",
"bancanetsantacruz.com.do",
"bancapulia.it",
"bancarios.com",
"bancastato.ch",
"bancatransilvania.ro",
"bancobase.com",
"bancobic.ao",
"bancobic.pt",
"bancobpi.pt",
"banco.bradesco",
"bancobrasil.com.br",
"bancochile.cl",
"bancochile.com",
"bancoestado.cl",
"bancofalabella.cl",
"bancofalabella.com.co",
"bancofalabella.pe",
"bancomer.com",
"bancopopolare.it",
"bancopostaclick.it",
"bancoposta.it",
"bancosantander.es",
"bancovotorantimcartoes.com.br",
"bank24.ru",
"bankalhabib.com",
"bankaustria.at",
"bank.barclays.co.uk",
"bankbgzbnpparibas.pl",
"bankcardservices.co.uk",
"bankcomm.com",
"bankcoop.ch",
"bankiabancapersonal.es",
"bankia.com",
"bankia.es",
"bankinter.com",
"bankinter.es",
"bankmutual.com",
"bankofamerica.com",
"bankofcanada.ca",
"bankofchina.com",
"bankofcyprus.com",
"bankofindia.co.nz",
"bankofireland.com",
"bank-of-ireland.co.uk",
"bankofirelanduk.com",
"bankofoklahoma.com",
"bankofscotland.co.uk",
"banksinarmas.com",
"bankvonroll.ch",
"bankwest.com.au",
"banque-casino.fr",
"banquepopulaire.fr",
"banquescotia.com",
"barclaycard.co.uk",
"barclaycard.de",
"barclaycard.es",
"barclays.com",
"barclays.co.uk",
"barclayspartnerfinance.com",
"barclays.sc",
"barodanzltd.co.nz",
"basler.ch",
"bbandt.com",
"bbc.co.uk",
"bcentral.com",
"bci.cl",
"bcp.com.pe",
"bcv.ch",
"bcvs.ch",
"bekb.ch",
"bellevue.ch",
"bellsouth.net",
"bendigobank.com.au",
"berliner-bank.de",
"berliner-sparkasse.de",
"bfanet.ao",
"bfi0.com",
"bgfi.com",
"bgfionline.com",
"bgzbnpparibas.pl",
"billmelater.com",
"bing.com",
"bkb.ch",
"bk.rw",
"bks.at",
"blkb.ch",
"bmocm.com",
"bmo.com",
"bmogam.com",
"bmoharris.com",
"bmoharrisprivatebankingonline.com",
"bmoinvestorline.com",
"bmonesbittburns.com",
"bnl.it",
"bnpparibas.com",
"bnpparibas.fr",
"boc.cnnz",
"bonuscard.ch",
"bpe-gruposantander.com",
"bpi.pt",
"bpostbank.be",
"bradescardonline.com.br",
"bradesco.com.br",
"bradescoseguranca.com.br",
"bridgetrack.com",
"bridgewaterbank.ca",
"bsibank.com",
"btrl.ro",
"bt-trade.ro",
"businessonline-boi.com",
"bzbank.ch",
"ca-cib.com",
"ca-egypt.com",
"cafbank.org",
"cafe24.com",
"cafonline.org",
"caisse-epargne.com",
"caisse-epargne.fr",
"caixabank.com",
"caixa.gov.br",
"cajasur.es",
"camsonline.com",
"canadiandirect.com",
"capitalone360.com",
"capitalone.com",
"capitaloneonline.co.uk",
"capitecbank.co.za",
"cariparma.it",
"carrefour-banque.fr",
"cartabcc.it",
"cartabccpos.it",
"cartasi.it",
"ca-suisse.com",
"catalunyacaixa.com",
"cbg.gm",
"cbonline.co.uk",
"cembra.ch",
"cenbank.org",
"centralbank.ae",
"charitybank.org",
"charter.net",
"chase.com",
"chebanca.it",
"chinatrust.com.tw",
"cial.ch",
"cibc.com",
"cic.ch",
"cimbclicks.com.my",
"citibank.ae",
"citibank.co.in",
"citibank.com",
"citibank.co.uk",
"citibankonline.com",
"citibusiness.com",
"citicards.com",
"citi.com",
"citi.co.nz",
"citi.eu",
"citigroup.com",
"citizensbank.ca",
"citizensbank.com",
"civibank.com",
"civibank.it",
"cjb.net",
"classmates.com",
"clickbank.net",
"closebrothers.com",
"closebrothers.co.uk",
"clubsc.ch",
"cnet.com",
"cnn.com",
"co.kg",
"colpatria.com",
"colpatria.com.co",
"comcast.net",
"com.com",
"commbank.com.au",
"commerzbank.com",
"commerzbank.de",
"com.ne.kr",
"coopbank.dk",
"co-operativebank.co.uk",
"cornerbanca.ch",
"cornercard.ch",
"cornercard.com",
"corner.ch",
"corporate-ir.net",
"cosycard.ch",
"coutts.com",
"cox.net",
"craigslist.org",
"credit-agricole.com",
"credit-agricole.fr",
"creditagricole.rs",
"credit-suisse.com",
"cs.com",
"css.ch",
"ctbcbank.com",
"ctfs.com",
"custhelp.com",
"cwbank.com",
"cwbankgroup.com",
"cwt.ca",
"cybg.com",
"danskebankas.lt",
"danskebank.com",
"danskebank.co.uk",
"danskebank.de",
"danskebank.dk",
"danskebank.ee",
"danskebank.fi",
"danskebank.ie",
"danskebank.no",
"datatrans.biz",
"datatrans.ch",
"daum.net",
"db.com",
"dbs.com",
"dd.se",
"debian.org",
"dell.com",
"demirbank.kg",
"denizbank.com",
"desjardins.ca",
"desjardins.com",
"deutschebank.be",
"deutschebank.co.nz",
"deutsche-bank.de",
"diamondbank.com",
"dibpak.com",
"directnic.com",
"directtrack.com",
"discovercard.com",
"discover.com",
"discovery.co.za",
"dnbnord.lt",
"domain.com",
"doubleclick.com",
"dresdner-bank.de",
"dsbbank.sr",
"dsbl.org",
"duncanlawrie.com",
"earthlink.net",
"easybank.at",
"easylnk.com",
"ebay.com",
"ebay.co.uk",
"ebay.de",
"ebayimg.com",
"ebaystatic.com",
"ecobank.com",
"edgesuite.net",
"ediets.com",
"edwardjones.com",
"egroups.com",
"e-gulfbank.com",
"emode.com",
"esunbank.com.tw",
"example.com",
"example.net",
"example.org",
"excite.com",
"facebook.com",
"fedex.com",
"fednetbank.com",
"fidelity.com",
"fidor.de",
"finance.com",
"finansbank.com.tr",
"finasta.lt",
"fineco.it",
"firstbankcard.com",
"firstmerit.com",
"firstnational.com",
"firstnationalmerchantsolutions.com",
"firsttrustbank.co.uk",
"flickr.com",
"fnbc.ca",
"fnb.co.za",
"fnb-online.com",
"freebsd.org",
"free.fr",
"friuladria.it",
"f-secure.com",
"garantibank.eu",
"garantibank.nl",
"garanti.com.tr",
"gazprombank.ch",
"gazprombank.ru",
"generali.es",
"genevoise.ch",
"gentoo.org",
"geocities.com",
"gkb.ch",
"gmx.net",
"go.com",
"godaddy.com",
"googleadservices.com",
"google.co.in",
"google.com",
"google.it",
"google.ru",
"granitbank.hu",
"grisoft.com",
"gtbank.com",
"halifax.co.uk",
"hallmark.com",
"handelsbanken.se",
"harrodsbank.co.uk",
"hbl.com",
"hblibank.com",
"hblibank.com.pk",
"hdfcbank.com",
"heartland.co.nz",
"hellenicbank.com",
"hinet.net",
"hkbea.com",
"hlb.com.kh",
"hlb.com.my",
"hoaresbank.co.uk",
"home.barclays",
"hongleongconnect.com.kh",
"hongleongconnect.com.vn",
"hongleongconnect.my",
"hotbar.com",
"hotpop.com",
"hp.com",
"hsbc.com",
"hsbc.com.ar",
"hsbc.com.hk",
"hsbc.co.nz",
"hsbc.co.uk",
"hypovereinsbank.co.uk",
"hypovereinsbank.de",
"ibm.com",
"icbcnz.com",
"icicibank.co.in",
"icicibank.com",
"icicibankprivatebanking.com",
"icorner.ch",
"icscards.de",
"icscards.nl",
"incredimail.com",
"ing.be",
"ing.com",
"ing-diba.de",
"ingdirect.ca",
"ing.lu",
"ing.nl",
"ingvysyabank.com",
"interac.ca",
"investorplace.com",
"iobnet.co.in",
"isbank.com.tr",
"isbank.de",
"isbank.ge",
"isbank.iq",
"isbankkosova.com",
"itau.com.br",
"ivillage.com",
"joingevalia.com",
"jpmchase.com",
"jpmorgan.com",
"jsafrasarasin.com",
"julianhodgebank.com",
"juliusbaer.com",
"juno.com",
"jyskebank.dk",
"kantonalbank.ch",
"kernel.org",
"key.com",
"kiwibank.co.nz",
"kotak.com",
"kredytbank.pl",
"kreissparkasse-schwalm-eder.de",
"ksklb.de",
"kutxabank.es",
"laboralkutxa.com",
"lacaixa.cat",
"lacaixa.es",
"laurentianbank.ca",
"lbb.de",
"lcl.com",
"lcl.fr",
"li.ru",
"list.ru",
"liveinternet.ru",
"livejournal.com",
"lloydsbank.com",
"lloydsbankcommercial.com",
"lloydsbankinggroup.com",
"lloydstsb.ch",
"lloydstsb.co.uk",
"lombardodier.com",
"loydsbank.com",
"lycos.com",
"m7z.net",
"mac.com",
"macromedia.com",
"maerki-baumann.ch",
"mail.com",
"mail.ru",
"mailscanner.info",
"mandtbank.com",
"manulifebank.ca",
"manulifebankselect.ca",
"manulife.com",
"manulifeone.ca",
"marketwatch.com",
"mashreqbank.com",
"mastercard.com",
"maybank2u.com",
"maybank2u.com.my",
"mcafee.com",
"mchsi.com",
"mdmbank.com",
"mechanicsbank.com",
"medbank.lt",
"messagelabs.com",
"metrobankdirect.com",
"metrobankonline.co.uk",
"microsoft.com",
"migbank.com",
"migrosbank.ch",
"military.com",
"mindspring.com",
"mit.edu",
"mizuhobank.co.jp",
"mmwarburg.lu",
"monster.com",
"montepio.pt",
"morganstanley.com",
"mozilla.com",
"mps.it",
"ms.com",
"mufg.jp",
"myonlineresourcecenter.com",
"myonlineservices.ch",
"myspace.com",
"nate.com",
"nationalesuisse.ch",
"nationwide-communications.co.uk",
"nationwide.co.uk",
"nationwide-service.co.uk",
"natwest.com",
"navyfederal.org",
"nbc.ca",
"netflix.com",
"netscape.com",
"netscape.net",
"netzero.net",
"newyorkfed.org",
"nibl.com.np",
"nod32.com",
"nordea.fi",
"nordea.lt",
"nordfynsbank.dk",
"norisbank.de",
"norman.com",
"notenstein.ch",
"nuvisionfederal.com",
"nytimes.com",
"oceanbank.com",
"onlinesbi.com",
"openoffice.org",
"openxmlformats.org",
"optonline.net",
"orchardbank.com",
"osdn.com",
"ostsaechsische-sparkasse-dresden.de",
"overstock.com",
"pacbell.net",
"pandasoftware.com",
"passport.com",
"paylife.at",
"paypal.be",
"paypal-brasil.com.br",
"paypal.ca",
"paypal.ch",
"paypal.co.il",
"paypal.com",
"paypal.com.au",
"paypal.com.br",
"paypal-communication.com",
"paypal-community.com",
"paypal.com.mx",
"paypal.com.pt",
"paypal.co.uk",
"paypal-customerfeedback.com",
"paypal.de",
"paypal-deutschland.de",
"paypal.dk",
"paypal.es",
"paypal-exchanges.com",
"paypal.fr",
"paypal.it",
"paypal-marketing.co.uk",
"paypal-marketing.pl",
"paypal.net",
"paypal.nl",
"paypal.no",
"paypal-notify.com",
"paypal-now.com",
"paypalobjects.com",
"paypal-opwaarderen.nl",
"paypal-pages.com",
"paypal.pt",
"paypal.ru",
"paypal.se",
"paypal-search.com",
"paypal-shopping.co.uk",
"paypal-techsupport.com",
"pbebank.com",
"pcfinancial.ca",
"peoplepc.com",
"permanenttsb.ie",
"plaxo.com",
"pnc.com",
"popolarevicenza.it",
"postbank.de",
"postepay.it",
"postfinancearena.ch",
"postfinance.ch",
"postfinance.info",
"price.ru",
"prodigy.net",
"publicislamicbank.com.my",
"rabobank.com",
"rabobank.co.nz",
"rabobank.nl",
"radaruol.com.br",
"rahnbodmer.ch",
"raiffeisenbank.rs",
"raiffeisen.ch",
"raiffeisen.hu",
"raiffeisen.li",
"raiffeisen.ru",
"rambler-co.ru",
"rambler.ru",
"raphaelsbank.com",
"rbc.com",
"rbcroyalbank.com",
"rbs.co.uk",
"rbssecure.co.uk",
"rbsworldpay.com",
"rcb.at",
"real.com",
"recordbank.be",
"redhat.com",
"rediff.com",
"regiobank.nl",
"regions.com",
"regionsnet.com",
"renasantbank.com",
"rhbgroup.com",
"rogersbank.com",
"rogers.com",
"rothschildbank.com",
"rothschild.com",
"royalbank.com",
"rr.com",
"sagepay.com",
"sagepay.co.uk",
"sainsburysbank.co.uk",
"samba.com",
"santander.cl",
"santander.com",
"santander.com.br",
"santander.com.mx",
"santandercorretora.com.br",
"santander.co.uk",
"santanderesfera.com.br",
"santandersantiago.cl",
"sarasin.ch",
"sbcglobal.net",
"sberbank.ch",
"sbs.net.nz",
"sc.com",
"schoellerbank.at",
"scotiabank.ca",
"scotiabank.com",
"scotiamocatta.com",
"scotiaonline.com",
"s.de",
"sec.gov",
"securetrustbank.com",
"service-sparkasse.de",
"serviciobancomer.com",
"sf.net",
"shawbrook.co.uk",
"shaw.ca",
"shkb.ch",
"shockwave.com",
"six-group.com",
"six-payment-services.com",
"skrill.com",
"sls-direkt.de",
"smithbarney.com",
"snb.ch",
"snsbank.nl",
"societegenerale.fr",
"sourceforge.net",
"spamcop.net",
"sparda-a.de",
"sparda-bank-hamburg.de",
"sparda-b.de",
"sparda-bw.de",
"sparda-h.de",
"sparda-hessen.de",
"sparda-m.de",
"sparda-ms.de",
"sparda-n.de",
"sparda-ostbayern.de",
"sparda-sw.de",
"sparda-verband.de",
"sparda-west.de",
"sparkasse.at",
"sparkasse-bank-malta.com",
"sparkasse-bielefeld.de",
"sparkasseblog.de",
"sparkasse-bochum.de",
"sparkasse.ch",
"sparkasse.de",
"sparkasse-gera-greiz.de",
"sparkasse-hamm.de",
"sparkasse-heidelberg.de",
"sparkasse-ingolstadt.de",
"sparkasse-mittelthueringen.de",
"speedera.net",
"sportsline.com",
"standardbank.com",
"standardbank.co.za",
"standardchartered.com.gh",
"standardchartered.com.my",
"subscribe.ru",
"sun.com",
"suncorpbank.com.au",
"suntrust.com",
"swedbank.com",
"swedbank.ee",
"swedbank.lt",
"swedbank.lu",
"swedbank.se",
"swisscanto.ch",
"swisscaution.ch",
"swissquote.ch",
"sydbank.dk",
"sympatico.ca",
"tails.nl",
"tangerine.ca",
"tcb-bank.com.tw",
"tdbank.com",
"tdcommercialbanking.com",
"telus.net",
"terra.com.br",
"tescobank.com",
"ticketmaster.com",
"tinyurl.com",
"tiscali.co.uk",
"tns-counter.ru",
"tom.com",
"tone.co.nz",
"t-online.de",
"top4top.ru",
"tsbbank.co.nz",
"tsb.co.nz",
"tsb.co.uk",
"tux.org",
"twitter.com",
"ubibanca.com",
"ubs.com",
"ulsterbankanytimebanking.co.uk",
"ulsterbank.co.uk",
"unibancoconnect.pt",
"unibanco.pt",
"unicreditbank.lt",
"unicredit.eu",
"unicreditgroup.eu",
"unicredit.it",
"unionbankcameroon.com",
"unionbank.com",
"unity.co.uk",
"uob.com.sg",
"uobgroup.com",
"uol.com.br",
"ups.com",
"usbank.com",
"valianttrust.com",
"vaudoise.ch",
"venetobanca.it",
"venetobanka.al",
"verizon.net",
"versabank.com",
"videobank.it",
"virginmoney.com",
"visa.com.ar",
"visa.com.br",
"visaeurope.ch",
"visaeurope.com",
"viseca.ch",
"volksbank.de",
"volkswagenbank.de",
"vpbank.com",
"vr.de",
"vwbank.de",
"w3.org",
"wachovia.com",
"walmart.com",
"wamu.com",
"wanadoo.fr",
"washingtonpost.com",
"weatherbug.com",
"weatherbys.co.uk",
"web.de",
"webshots.com",
"webtv.net",
"wegelin.ch",
"wellsfargo.com",
"wellsfargoemail.com",
"westernunion.ca",
"westernunion.com",
"westernunion.fr",
"westernunion.se",
"westpac.com.au",
"westpac.co.nz",
"wir.ch",
"wordpress.com",
"worldbank.org",
"worldpay.com",
"wsj.com",
"wvb.de",
"xmlsoap.org",
"yacht.nl",
"yahoo.ca",
"yahoo.co.jp",
"yahoo.co.kr",
"yahoo.com",
"yahoo.com.br",
"yahoo.co.uk",
"yahoogroups.com",
"yandex.net",
"yandex.ru",
"ybonline.co.uk",
"yimg.com",
"yopi.de",
"yorkshirebank.co.uk",
"yourbankcard.com",
"yoursite.com",
"youtube.com",
"zagbank.ca",
"zdnet.com",
"zenithbank.com",
"zkb.ch",
"zugerkb.ch",
"vistaprint.dk",
"vistaprint.com",
"anpdm.com",
"dovecot.org",
"exacttarget.com",
"github.com",
"isc.org",
"lists.isc.org",
"lists.roundcube.net",
"svn.apache.org",
"taggedmail.com",
"tumblr.com"}


[lookup]
url-redirectors = {"000d.ru",
"0845.com",
"0c.ru",
"0lv.ru",
"0pen.me",
"0rz.tw",
"10r.us",
"123url.org",
"140.uz",
"17q.com",
"1c-bitrix.ru",
"1cl.in",
"1ink.in",
"1ink.ru",
"1iny.com",
"1lik.net",
"1link.in",
"1url.com",
"1url.in",
"1-url.net",
"1-url.ru",
"2big.at",
"2dwww.com",
"2.gp",
"2it.info",
"2.ly",
"2mb.eu",
"2qu.ru",
"2sms.ru",
"2tu.me",
"2tu.us",
"2url.org",
"307.to",
"3fw.ru",
"3le.ru",
"3.ly",
"3.vu",
"3x.si",
"4.gg",
"4job.ru",
"4.ly",
"4ms.me",
"4p5.com",
"4ry.ru",
"4sq.com",
"4u.gd",
"4url.cc",
"4url.tk",
"5.gp",
"5link.tk",
"5pl.us",
"5url.net",
"5z8.info",
"6fr.ru",
"6.ly",
"6pn.com",
"6url.com",
"6yo.org",
"70.ru",
"74job.ru",
"7.ly",
"7ly.ru",
"7pisem.ru",
"7ruh.com",
"7ry.us",
"7xu.org",
"8.ly",
"8q.ro",
"9mp.com",
"9-n.org",
"9xi.ru",
"a1.tc",
"a2k.in",
"aa.cx",
"aafter.us",
"abe5.com",
"access.im",
"action-emails.ru",
"ad4.us",
"adf.ly",
"adjix.com",
"adsbeta.net",
"ad.vu",
"afx.cc",
"a.gg",
"ah.ae",
"aipro.ru",
"airs.ru",
"aka-url.com",
"alic.at",
"all.fuseurl.com",
"allshort.ru",
"all-top.ru",
"alturl.com",
"a.md",
"amzn.to",
"a.nf",
"apeurl.com",
"api.m3653.net",
"apsense.cc",
"apu.sh",
"ar.gy",
"arm.in",
"arst.ch",
"atiny.me",
"atto.co.za",
"atu.ca",
"autodesk.com",
"avast.com",
"avoo.net",
"azc.cc",
"b23.ru",
"b2l.me",
"backupurl.com",
"bacn.me",
"bai.lu",
"bcool.bz",
"bezurl.com",
"bi.gl",
"binged.it",
"bin.nu",
"bitby.net",
"bit.do",
"bit.gy",
"bit.ly",
"bitleyco.cc",
"bitly.com",
"bitrix24.ru",
"biturl.net",
"bit.uz",
"bizj.us",
"bloat.me",
"bmu.li",
"boi.re",
"bq.ro",
"bravo.ly",
"briefurl.pl",
"bsa.ly",
"bsndsy.ru",
"budurl.com",
"bun.ru",
"bu.tt",
"byst.ro",
"byyb.net",
"bz9.com",
"campaign-services.directcrm.ru",
"canurl.com",
"capello.linkatty.com",
"capourl.com",
"care2share.tk",
"cbs.so",
"cbuz.com",
"cctv.ws",
"cd.vg",
"cektkp.com",
"cha.la",
"chilp.it",
"chzb.gr",
"cjb.net",
"cjt99.tk",
"clck.ru",
"cliccami.info",
"click2.info",
"clicks.biletix.ru",
"clicks.citilink.ru",
"click.email4customers.com",
"click.emailinfo.mail.hpe.com",
"click.icptrack.com",
"click.mlsend.com",
"click-me.us",
"clickthru.ca",
"clickv.tk",
"cli.gs",
"clkit.co",
"cl.lk",
"cl.ly",
"clme.ru",
"cloakreferer.com",
"clockurl.com",
"clop.in",
"cms.im",
"cmylink.com",
"cnect.us",
"comyonet.com",
"conta.cc",
"coolestone.com",
"cort.as",
"cortas.elpais.com",
"cot.ag",
"cowurl.com",
"cp.bitrix.ru",
"cr.am",
"createurl.com",
"crks.me",
"crlf.ru",
"crop.im",
"crum.pl",
"ctvr.us",
"cug.kr",
"cut4.me",
"cut.by",
"cuthut.com",
"cutt.us",
"d2u.us",
"d8z.ru",
"dai.ly",
"da.lc",
"ddp.net",
"decenturl.com",
"delivr.com",
"dev0.ru",
"dft.ba",
"digbig.com",
"di.gd",
"digg.com",
"digidns.net",
"din.gy",
"directtrafficlink.com",
"disq.us",
"dld.bz",
"dlvr.it",
"dmanalytics1.com",
"doiop.com",
"do.my",
"dopen.us",
"dot.tk",
"dr2.biz",
"driz.ru",
"dr.tl",
"durlz.info",
"easyuri.com",
"easyurl.jp",
"easyurl.net",
"eepurl.com",
"ej.uz",
"elurl.com",
"email.account.2gis.com",
"email.mail.ostrovok.ru",
"email.mxtoolbox.com",
"email.news.ostrovok.ru",
"e.mail.ru",
"em.digium.com",
"emap.ws",
"emlstart.com",
"etdurl.com",
"eweri.com",
"exa.im",
"f1ru.net",
"fa.by",
"fanta.linkatty.com",
"fav.me",
"fbi.pp.ua",
"fb.me",
"fbshare.me",
"fff.to",
"ff.im",
"ffs.cc",
"fi.gd",
"fire.to",
"firsturl.de",
"firsturl.net",
"fishurl.ru",
"flane.info",
"flavr.be",
"flic.kr",
"flq.us",
"flx.im",
"fly2.ws",
"folo.me",
"fo.my",
"fon.gs",
"forex-trade.be",
"fqav.com",
"freak.to",
"freepl.us",
"free-redirect.tk",
"freeurl.me",
"free-url-redirection.com.ru",
"fur.ly",
"fuseurl.com",
"fuzzy.to",
"fwd4.me",
"fwds.me",
"fwib.net",
"fyad.org",
"fyn.im",
"g00.me",
"gadaf.fi",
"game-url.com",
"gentleurl.net",
"geteml.com",
"getlink.info",
"get.sh",
"get.tf",
"gho.co",
"gig140.com",
"gizmo.do",
"gl.am",
"glink.co",
"gltw.ru",
"gmetzner.de",
"gmy.su",
"gnu.su",
"go2-url.com",
"go.9nl.com",
"go9.us",
"goandgrab.info",
"gog.tc",
"go.it",
"go-links.net",
"golook.at",
"go.ly",
"good.ly",
"goo.gl",
"goo.pm",
"go.qb.by",
"goshrink.com",
"gosite.in",
"goto.pattayacitythailand.com",
"gourl.ca",
"gourl.gr",
"gourl.it",
"go-url.ru",
"go.usa.gov",
"gri.bz",
"groteck.com",
"g.ro.lt",
"gtgg.us",
"g.ua",
"gu.ma",
"gurl.es",
"haqm.com",
"hex.io",
"hhvx.com",
"hiderefer.com",
"hijw.com",
"hi.kg",
"hit.kg",
"hj.to",
"hlurl.com",
"hmm.ph",
"ho.io",
"hop.clickbank.net",
"hopclicks.com",
"ho.pe",
"hop.kz",
"href.in",
"hsblinks.com",
"htxt.it",
"hubb.me",
"huff.to",
"hulu.com",
"hurl.me",
"hurl.ws",
"huuk.net",
"hvmnd.org",
"i2h.de",
"i5.be",
"icanhaz.com",
"idek.net",
"idelink.com",
"ifree.kz",
"ih3.ru",
"ikeafamilynews.ru",
"ilix.in",
"ilnk.me",
"informer.ru",
"innogam.es",
"ino.me",
"int.kz",
"ipsha.ru",
"ir.pe",
"is.gd",
"is.gs",
"issuu.com",
"itshrunk.com",
"its.my",
"iurlz.com",
"ix.lt",
"ixr.be",
"j3w.it",
"ja.cx",
"jdem.cz",
"jewi.sh",
"jijr.com",
"jmb.tw",
"j.mp",
"jom.la",
"joo.ru",
"just.as",
"juu.cc",
"keep2.me",
"kickurl.com",
"kipq.com",
"kisaurl.com",
"ki.tl",
"kl.am",
"klck.me",
"klik.sihitam.com",
"klx.co",
"knb.im",
"kon.tl",
"kore.us",
"korta.nu",
"kqon.com",
"kr1n.ru",
"krunchd.com",
"krz.ch",
"ktzr.us",
"l24.cm",
"l3ss.me",
"l9k.net",
"lat.ms",
"lavvs.com",
"lcut.us",
"leeturl.net",
"leto.tk",
"liip.to",
"liltext.com",
"lin.io",
"link2me.ru",
"link.ac",
"linkbee.com",
"linkbun.ch",
"linkcash.biz",
"linkde.info",
"linkee.com",
"link.from.homecredit.ru",
"link.hhut.ru",
"linkl.ru",
"link.mail.1fd-system.ru",
"link.mail.e-gazeta-unp.ru",
"link.mail.e.glavbukh-mail.ru",
"link.mail.fd-online.ru",
"link.mail.glavbukh-mail.ru",
"link.mail.unp-client.ru",
"link.rengo.ru",
"link.sendsay.ru",
"linkslash.ca",
"linkunion.de",
"linkx.me",
"linkyy.com",
"linkzip.net",
"lip.tc",
"li.ru",
"list-manage1.com",
"list-manage2.com",
"list-manage.com",
"little.im",
"littleurl.net",
"liurl.cn",
"livehoster.org",
"llinks.net",
"ln0.ru",
"ln4.me",
"lnk.by",
"lnk.cm",
"lnk.co",
"lnk.gd",
"lnk.in",
"lnk.ly",
"lnk.ms",
"lnk.sk",
"lnkd.in",
"lnks.gd",
"lnks.it",
"lnkstts.com",
"lnkurl.com",
"ln-s.net",
"ln-s.ru",
"loh.ru",
"loo.gl",
"lovebyt.es",
"low.cc",
"l.pr",
"lr.tc",
"lru.jp",
"lrwk.com",
"ltos.ru",
"lt.tl",
"lul.es",
"lurl.no",
"lx2.net",
"ly9.net",
"m4u.in",
"m7a.org",
"macte.ch",
"mail.rambler.ru",
"mandrillapp.com",
"mash.to",
"mee.la",
"merky.de",
"metamark.net",
"micurl.com",
"migre.me",
"miliuner.com",
"miniurl.com",
"miniurl.net.ru",
"miniurl.pl",
"mimecast.com",
"minu.me",
"minurl.fr",
"minyurl.net",
"minyurl.org",
"mislead.in",
"miud.in",
"mixe.me",
"mj.is",
"mjt.lu",
"mke.me",
"mlcampaignru.com",
"mljt.tech",
"mlsendru.com",
"mmt.su",
"mobotix-news.com",
"mo.by",
"moby.to",
"mockurl.com",
"moourl.com",
"mp77.com",
"mrte.ch",
"mtp.pl",
"mty.in",
"mug.gs",
"murl.kz",
"mvp.im",
"mylink4u.info",
"mylink.to",
"myloc.me",
"myooo.info",
"mypaqe.com",
"mypl.us",
"mytinyurl.net",
"myurl.in",
"myurl.si",
"myxx.me",
"mzan.si",
"n3n.in",
"n3r.ru",
"nbc.co",
"nblo.gs",
"nbold.com",
"ne1.net",
"netgod.tk",
"neuf.tk",
"newhotlink.com",
"nexturl.ru",
"nicesharing.com",
"nik.im",
"niurl.com",
"nl.cr",
"nn.nf",
"no1.in",
"no.io",
"nonameno.com",
"normalurl.com",
"notlong.com",
"not.my",
"now.am",
"n.pr",
"nsfw.in",
"nutshellurl.com",
"nxy.in",
"nyti.ms",
"oc1.us",
"oeeq.com",
"oiurl.com",
"o.ly",
"omf.gd",
"om.ly",
"omoikane.net",
"on.cnn.com",
"on.mktw.net",
"oogyah.com",
"oork.com",
"opurl.us",
"orbita.co.il",
"orz.se",
"ourgplus.at",
"out.houseofgaga.ru",
"ovr.me",
"ow.ly",
"o-x.fr",
"p1.fr",
"pathto.net",
"paypal-communication.com",
"pb8.ru",
"pburl.com",
"pcw.ro",
"pduda.mobi",
"pechkincensor.ru",
"pechkinspy.ru",
"peeep.us",
"peekurl.com",
"pendek.in",
"penting.web.id",
"pfat.de",
"pho.se",
"phpm.ru",
"php-ru.info",
"pi90.com",
"picourl.ru",
"piks.nl",
"ping.fm",
"pli.gs",
"plink.es",
"plo.cc",
"ploshadka.ru",
"plugin.name",
"plusphp.com",
"p.ly",
"pnt.me",
"pobierz-film.tk",
"politi.co",
"ponyurl.com",
"poo.pr",
"post.ly",
"pot.vg",
"pp.gg",
"ppt.cc",
"pra.im",
"privacy-surf.com",
"proext.com",
"professionali.ru",
"profile.to",
"proofpoint.com",
"prourl.de",
"ptiturl.com",
"p.tl",
"pub.vitrue.com",
"punyurl.com",
"purl.org",
"pvh.me",
"pw.ly",
"pxlz.org",
"py6.ru",
"pygmyurl.com",
"pysper.com",
"q32.ru",
"qick.ws",
"qid.in",
"qkr.cc",
"qlnk.net",
"qlql.ru",
"qnh.pl",
"qr.cx",
"qr.ee",
"qrf.in",
"qr.net",
"qru.ru",
"qte.me",
"qtwk.com",
"quik.in",
"qurl.com",
"qu.tc",
"qz.bz",
"rb6.me",
"r.delphicomponent.ru",
"rdrct.us",
"rdr.to",
"read.bi",
"readthis.ca",
"reallytinyurl.com",
"redir.ec",
"redirectingat.com",
"redirects.ca",
"redirect.subscribe.ru",
"redire.ru",
"redirx.com",
"reduc.in",
"referer.us",
"retweet.cc",
"retwt.me",
"reurl.org",
"rhwm.eu",
"rickroll.it",
"r.im",
"ri.ms",
"riz.gd",
"rlu.ru",
"rmse.ru",
"rnd.ru",
"romb.su",
"r-ss.de",
"rt.nu",
"rubyurl.com",
"ru.ly",
"rurl.org",
"rurl.ru",
"rurls.ru",
"rustech.org",
"rww.tw",
"s0bu.ru",
"s0e.ru",
"s4c.in",
"s7y.us",
"s8.hk",
"safe.mn",
"saf.li",
"safelinks.protection.outlook.com",
"sami.24.gg",
"sayabit.com",
"sbrf.link.info.sberbank.ru",
"s.coop",
"scurtare-url.hi2.ro",
"sdut.us",
"securityexpert.ru",
"securl.ru",
"sendgrid.net",
"sendit.in",
"sendsay.ru",
"sendurl.info",
"sg4d.com",
"sg-url.tk",
"shadyurl.com",
"share.flocktory.com",
"shar.es",
"shink.de",
"shiturl.com",
"shli.de",
"shorl.com",
"shortb.net",
"shorten.im",
"shorten.ws",
"short.ie",
"short.im",
"shortlinks.co.uk",
"short-me.com",
"shortner.com",
"shortn.me",
"short.nr",
"short.su",
"short.to",
"shorturl.asia",
"shorturl.com",
"short-url.co.uk",
"shorturls.co.uk",
"shortz.me",
"shout.to",
"show.my",
"shrinkee.com",
"shrinkify.com",
"shrinkr.com",
"shrten.com",
"shrt.fr",
"shrtl.com",
"shrt.st",
"shrunkin.com",
"shx.in",
"simplesite.com",
"simurl.com",
"sitefwd.com",
"sk9.pl",
"slate.me",
"sli.su",
"slki.ru",
"sl.to",
"smallr.com",
"smallurl.in",
"smallurl.ru",
"smalur.com",
"s-m.co",
"smsh.me",
"smurl.ca",
"smurl.name",
"sn9.ru",
"sn.im",
"snipr.com",
"snipurl.com",
"snurl.com",
"softlinemail.ru",
"sokrati.ru",
"somexyz.com",
"song.ly",
"sorturl.net",
"so.vg",
"sp2.ro",
"spedr.com",
"speed-tester.info",
"sq6.ru",
"srclick.ru",
"srcom.net",
"srnk.net",
"srs.li",
"srtn.me",
"starts.com",
"starturl.com",
"stat-pulse.com",
"stnx.at",
"stump.ws",
"su.ly",
"su.pr",
"surl.co.uk",
"surl.hu",
"surl.me",
"surs.nl",
"susurl.com",
"swturl.com",
"t1ny.net",
"ta.gd",
"ta.gg",
"tagiturl.com",
"taourl.com",
"tbd.ly",
"t.cn",
"t.co",
"tcrn.ch",
"techto.us",
"tez.co",
"tgl.net",
"tgr.me",
"tgr.ph",
"th8.us",
"thexyz.org",
"thinfi.com",
"th.ly",
"thnlnk.com",
"thurl.in",
"tie.ly",
"tighturl.com",
"tin.cc",
"tiniuri.com",
"tiny9.com",
"tinyarro.ws",
"tiny.by",
"tiny.cc",
"tinyit.cc",
"tinylink.ca",
"tinylink.in",
"tiny.ly",
"tiny.pl",
"tiny.ps",
"tinyuri.ca",
"tinyurl.com",
"tinyurl.ru",
"tki.me",
"tldr.in",
"tl.gd",
"t.lh.com",
"tlim.ru",
"tllg.net",
"tmi.me",
"tnij.org",
"tny.com",
"tny.tc",
"to8.cc",
"togoto.us",
"to.je",
"to.ly",
"toma.ai",
"tos.co",
"totc.us",
"tourl.fr",
"toysr.us",
"tozm.com",
"tpm.ly",
"tra.kz",
"track-mail.skbkontur.ru",
"trg.li",
"trii.us",
"tr.im",
"trimurl.me",
"trk.emlbest.com",
"trk.klclick.com",
"trk.klclick1.com",
"trk.klclick2.com",
"trk.klclick3.com",
"trunc.it",
"trusteml.com",
"tty.su",
"tuckinfo.com",
"tux-pla.net",
"tvsl.eu",
"tweet.ms",
"tweez.me",
"twhub.com",
"twirl.at",
"twitclicks.com",
"twitter.com",
"twitterurl.net",
"twiturl.de",
"twiu.ru",
"twurl.cc",
"twurl.nl",
"tyny.me",
"u2s.in",
"u76.org",
"ub0.cc",
"u.info-mg.ru",
"ukril.ru",
"ulk.me",
"ulmart.ru",
"ulo.me",
"ulu.lu",
"u.mavrev.com",
"umenytt.se",
"unfake.it",
"u.nu",
"updating.me",
"ur1.ca",
"ur3.us",
"ural-tender.ru",
"url2.ru",
"url360.me",
"url3.ru",
"url4.eu",
"url4.ru",
"url4t.com",
"url5.ru",
"url66.com",
"urla.ru",
"url.az",
"url.b24.am",
"urlbit.us",
"urlborg.com",
"urlbrief.com",
"urlcantik.com",
"urlclick.ru",
"url.cn",
"urlcorta.es",
"url.co.uk",
"urlcover.com",
"urlcut.com",
"urldefender.com",
"urldefense.com",
"urldepo.ru",
"url.dflix.net",
"urlel.com",
"urlenco.de",
"urle.us",
"url.g4team.com",
"urlgator.com",
"urlgeo.me",
"urlg.in",
"url-go.com",
"urlgo.ru",
"url.ie",
"urlin.it",
"urlink.eu",
"urli.nl",
"urlite.de",
"url.lotpatrol.com",
"urlmint.com",
"url.mk.ua",
"urlms.com",
"urloid.com",
"urloo.com",
"urlot.com",
"urlredo.com",
"urlscott.com",
"urls.co.za",
"url.shinri.biz",
"urlshorteningservicefortwitter.com",
"urlshort.me",
"urls.im",
"urlsim.com",
"urlsnip.com",
"urlsp.in",
"urlsqueeze.com",
"urls.vg",
"urltwit.com",
"urlu.ms",
"urlus.ru",
"url.vsofte.ru",
"urlx.ie",
"urlxs.fr",
"ur.ly",
"url.yanclex.com",
"urlz.at",
"urlzen.com",
"url-zip.com",
"urlz.ro",
"usat.ly",
"use.my",
"u.to",
"uud.in",
"uuu.su",
"uww.me",
"uyurl.com",
"vani.sh",
"vash-repetitor.ru",
"vb.ly",
"vc8.net",
"vgn.am",
"view.my",
"vk.cc",
"vl.am",
"vll.me",
"vog.me",
"vovka.com",
"vst.tv",
"w3t.org",
"w55.de",
"wa.la",
"wapo.st",
"wapurl.co.uk",
"warble.co",
"webformyself.com",
"weblist.kharkov.ua",
"weburl.me",
"weeclix.com",
"wez.su",
"whspr.it",
"widg.me",
"wik.ro",
"wipi.es",
"wlatcy-moch.tk",
"wlink.me.uk",
"wmturls.com",
"wom.im",
"wowurl.com",
"wp.me",
"wp.nu",
"wurl.in",
"wurl.us",
"wuw.su",
"ww.tl",
"clickmeeting.com",
"grandstreamnetworks.ru",
"reg.ru",
"wz.ae",
"x2t.com",
"xaa.su",
"xav.cc",
"xcqv.com",
"xcs.me",
"xd5.net",
"xdvn.net",
"xew.co",
"xops.fr",
"xp.cm",
"xr.com",
"xrl.in",
"xrls.tk",
"xrl.us",
"x-url.com",
"xurl.es",
"xurl.jp",
"x.vu",
"xvx.su",
"xw6.com",
"xxsurl.de",
"xxw.me",
"y.ahoo.it",
"yatuc.com",
"ydn.ru",
"ye.pe",
"yep.it",
"yfrog.com",
"yhoo.it",
"yi.pe",
"yiyd.com",
"ysu.me",
"yuarel.com",
"yurl.in",
"y-url.ru",
"yurl.ru",
"z0p.de",
"z2z.ca",
"zapt.in",
"zazi.me",
"zcom.us",
"zebratelecom.ru",
"zeep.in",
"zi.ma",
"zi.mu",
"zio.in",
"zipmyurl.com",
"zolp.net",
"zrps.info",
"zti.me",
"zud.me",
"zurl.ws",
"zxc9.com",
"zzang.kr",
"zz.gd"}