
 :0
 * SBDEBUG ?? yes
 {
  LOG="  Check header to see if it is an Exim header
  "
 }

 # Exim headers
 :0
 * ^(X-)?Received: from [a-z0-9][-_a-z0-9.]+ \(\[[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\]( helo=[a-z0-9][-_a-z0-9.]+)?\)(.*$)?\
                   .*\(Exim
 {
  {
   LOG="   Check Exim header for two-part HELO domain
   "
  }

  # Check Exim header for two-part HELO domain.
  :0
  * ^(X-)?Received: from [a-z0-9][-_a-z0-9.]+ \(\[[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                    [0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\]( helo=([a-z0-9][-_a-z0-9]+\.)+\
                    (aero|biz|\
                    ([a-z][a-z][a-z][a-z]+\.br)|([a-z][a-z][a-z][a-z]+\.cc)|\
                    com|coop|de|edu|es|exp|fi|geek|gov|info|int|is|it|\
                    ([a-z][a-z][a-z][a-z]+\.lb)|llc|lnx|ltd|lv|\
                    med|mil|museum|name|net|nic|noc|nu|null|\
                    org|porn|pro|pt|se|([a-z][a-z][a-z]+\.st)|to|tv|\
                    ([a-z][a-z][a-z]+\.us)|ws|xxx)\]
  {
   :0
   * ^(X-)?Received: from [a-z0-9][-_a-z0-9.]+ \(\[[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                     [0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\]( helo=([a-z0-9][-_a-z0-9]+\.)*\/\
                     ([a-z0-9][-_a-z0-9]+\.(aero|biz|\
                     ([a-z][a-z][a-z][a-z]+\.br)|([a-z][a-z][a-z][a-z]+\.cc)|\
                     com|coop|de|edu|es|exp|fi|geek|gov|info|int|is|it|\
                     ([a-z][a-z][a-z][a-z]+\.lb)|llc|lnx|ltd|lv|\
                     med|mil|museum|name|net|nic|noc|nu|null|\
                     org|porn|pro|pt|se|([a-z][a-z][a-z]+\.st)|to|tv|\
                     ([a-z][a-z][a-z]+\.us)|ws|xxx)\]
   {
    :0
    { STRING=${MATCH} }

    :0
    { FIRSTEXHELODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
   }
  }

  :0
  * SBDEBUG ?? yes
  {
   LOG="FIRSTEXHELODOMAIN: ${FIRSTEXHELODOMAIN}
     Check Exim header for three-part HELO domain
   "
  }

  # Check Exim header for three-part HELO domain.
  :0 E
  {
   :0
   * ^(X-)?Received: from [a-z0-9][-_a-z0-9.]+ \(\[[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                     [0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\]( helo=([a-z0-9][-_a-z0-9]+\.)*\/\
                     ([a-z0-9][-_a-z0-9]+\.[a-z][a-z]\]
   {
    :0
    { STRING=${MATCH} }

    :0
    { FIRSTEXHELODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

    :0
    { LOCALTAG=yes }
   }
  }
 }

 :0
 * SBDEBUG ?? yes
 {
  LOG="FIRSTEXHELODOMAIN: ${FIRSTEXHELODOMAIN}
     Check header to see if it is a Postfix or Sendmail header
  "
 }

 # Sendmail & Postfix headers
 :0
 * ! ^(X-)?Received: from [a-z0-9][-_a-z0-9.]+ \(\[[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                     [0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\]( helo=[a-z0-9][-_a-z0-9.]+)?\)(.*$)?\
                     .*\(Exim
 * ^(X-)?Received: from [a-z0-9][-_a-z0-9.]+ \((([a-z0-9][-_a-z0-9]+\.)+[a-z][a-z]+ )?\
                   \[[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                    [0-9][0-9]?[0-9]?\]\)
 {
  :0
  * SBDEBUG ?? yes
  {
   LOG="   Check Sendmail header for two-part HELO domain
   "
  }

  # Check Sendmail header for two-part HELO domain.
  :0
  * ^(X-)?Received: from ([a-z0-9][-_a-z0-9]+\.)+(aero|biz|\
                    ([a-z][a-z][a-z][a-z]+\.br)|([a-z][a-z][a-z][a-z]+\.cc)|\
                    com|coop|de|edu|es|exp|fi|geek|gov|info|int|is|it|\
                    ([a-z][a-z][a-z][a-z]+\.lb)|llc|lnx|ltd|lv|\
                    med|mil|museum|name|net|nic|noc|nu|null|\
                    org|porn|pro|pt|se|([a-z][a-z][a-z]+\.st)|to|tv|\
                    ([a-z][a-z][a-z]+\.us)|ws|xxx) \(([a-z0-9][-_a-z0-9.]+ )?\[
  {
   :0
   * ^(X-)?Received: from ([a-z0-9][-_a-z0-9]+\.)*\/[a-z0-9][-_a-z0-9]+\.[a-z][a-z]+ \(
   {
    :0
    { STRING=${MATCH} }

    :0
    { FIRSTEXHELODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
   }
  }

  :0
  * SBDEBUG ?? yes
  {
   LOG="FIRSTEXHELODOMAIN: ${FIRSTEXHELODOMAIN}

      Check Sendmail header for a three-part HELO domain
   "
  }

  # Check Sendmail header for a three-part HELO domain.
  :0 E
  {
   :0
   * ^(X-)?Received: from (([a-z0-9][-_a-z0-9]+\.)*\/[a-z0-9][-_a-z0-9]+\.\
                [a-z0-9][-_a-z0-9]+\.[a-z][a-z] \(
   {
    :0
    { STRING=${MATCH} }

    :0
    { FIRSTEXHELODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

    :0
    { LOCALTAG=yes }
   }
  }
 }









 :0
 * ^(X-)?Received: from ([0-9a-z][-_0-9a-z\.])+ \((HELO|ELHO) \/[0-9][0-9]?[0-9]?\
              \.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?
 { FIRSTEXHELOIP=${MATCH} }

 :0 E
 * ^(X-)?Received: from \/[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]? \(
 { FIRSTEXHELOIP=`${ECHO} "${MATCH}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

 :0
 * ^(X-)?Received: from .*($)?.*by ([a-z0-9][-_a-z0-9]+\.)+(aero|biz|\
                   ([a-z][a-z][a-z][a-z]+\.br)|([a-z][a-z][a-z][a-z]+\.cc)|\
                   com|coop|de|edu|es|exp|fi|geek|gov|info|int|is|it|\
                   ([a-z][a-z][a-z][a-z]+\.lb)|llc|lnx|ltd|lv|\
                   med|mil|museum|name|net|nic|noc|nu|null|\
                   org|porn|pro|pt|se|([a-z][a-z][a-z]+\.st)|to|tv|\
                   ([a-z][a-z][a-z]+\.us)|ws|xxx)( \[|\))
 {
  :0
  * ^(X-)?Received: from .*($)?.*by ([a-z0-9][-_a-z0-9]+\.)*\/[a-z0-9][-_a-z0-9]+\.\
                    [a-z][a-z]+( \[|\))
  {
   :0
   { STRING=${MATCH} }

   :0
   { FIRSTEXTODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
  }
 }

 :0 E
 {
  :0
  * ^(X-)?Received: from .*($)?.*by ([a-z0-9][-_a-z0-9]+\.)*\
               \/[a-z0-9][-_a-z0-9]+\.[a-z0-9][-_a-z0-9]+\.[a-z][a-z]( \[|\))
  {
   :0
   { STRING=${MATCH} }

   :0
   { FIRSTEXTODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
  }
 }

 :0
 {
  :0
  * ^(X-)?Received: from .*($)?.*by \/([a-z0-9][-_a-z0-9]+\.)+[a-z][a-z]( \[|\))
  {
   :0
   { STRING=${MATCH} }

   :0
   { FIRSTEXTOHOST=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
  }
 }

 :0
 * ^(X-)?Received: from (([a-z0-9][-_a-z0-9.]+)+ )?\(([a-z0-9][-_a-z0-9]+\.)+(aero|biz|\
                   ([a-z][a-z][a-z][a-z]+\.br)|([a-z][a-z][a-z][a-z]+\.cc)|\
                   com|coop|de|edu|es|exp|fi|geek|gov|info|int|is|it|\
                   ([a-z][a-z][a-z][a-z]+\.lb)|llc|lnx|ltd|lv|\
                   med|mil|museum|name|net|nic|noc|nu|null|\
                   org|porn|pro|pt|se|([a-z][a-z][a-z]+\.st)|to|tv|\
                   ([a-z][a-z][a-z]+\.us)|ws|xxx)( \[|\))
 {
  :0
  * ^(X-)?Received: from (([a-z0-9][-_a-z0-9.]+)+ )?\(\
               ([a-z0-9][-_a-z0-9]+\.)*\/[a-z0-9][-_a-z0-9]+\.[a-z][a-z]+( \[|\))
  {
   :0
   { STRING=${MATCH} }

   :0
   { FIRSTEXDOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
  }
 }

 :0
 * FIRSTEXDOMAIN ?? example\.com
 {
  :0
  * ^(X-)?Received: from (([a-z0-9][-_a-z0-9.]+)+ )?\(([a-z0-9][-_a-z0-9]+\.)*\
               \/[a-z0-9][-_a-z0-9]+\.[a-z0-9][-_a-z0-9]+\.[a-z][a-z]( \[|\))
  {
   :0
   { STRING=${MATCH} }

   :0
   { FIRSTEXDOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
  }
 }

 :0
 {
  :0
  * ^(X-)?Received: from (([a-z0-9][-_a-z0-9.]+)+ )?\(\/([a-z0-9][-_a-z0-9]+\.)+[a-z][a-z]( \[|\))
  {
   :0
   { STRING=${MATCH} }

   :0
   { FIRSTEXHOST=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
  }
 }

 :0
 * ^(X-)?Received: from .*(\[|\()\/[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
              [0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?
 { FIRSTEXIP=${MATCH} }
}


# CHECK SECOND RECEIVED HEADER

:0
* SBDEBUG ?? yes
{
 LOG="
 CHECK SECOND RECEIVED HEADER
 "
}

CHKLOCALTO=no
CHKLOCALFROM=no
CHKNONROUTABLE=no
LOCALTAG=no

:0
* FIRSTEXIP ?? 000.000.000.000
* ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
   (X-)?Received: from.*\/(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                     [0-9][0-9]?[0-9]?(\]|\))
{
 :0
 { CHECK=${MATCH} }

 :0
 * ? ${TEST} -f ${LOCALHOSTFILE} && (${ECHO} "${CHECK}" | ${GREP} -i -f ${LOCALHOSTFILE})
 { CHKLOCALFROM=yes }
}

:0
* FIRSTEXIP ?? 000.000.000.000
* ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
   (X-)?Received: from (([0-9a-z][-_0-9a-z.]+)+ )?\/\(([0-9a-z][-_0-9a-z]+\.)+[a-z][a-z]+(\[|\))
{
 :0
 { CHECK=${MATCH} }

 :0
 * ? ${TEST} -f ${LOCALHOSTFILE} && (${ECHO} "${CHECK}" | ${GREP} -i -f ${LOCALHOSTFILE})
 { CHKLOCALFROM=yes }
}

:0
* FIRSTEXIP ?? 000.000.000.000
* $ ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                     [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
     (X-)?Received: from (([0-9a-z][-_0-9a-z.]+)+ )?\/\(${DOMAIN}(\[|\))
{ CHKLOCALFROM=yes }

:0
* FIRSTEXIP ?? 000.000.000.000
* $ ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                     [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
     (X-)?Received: from (([0-9a-z][-_0-9a-z.]+)+ )?\/\(${THISISP}(\[|\))
{ CHKLOCALFROM=yes }

:0
* FIRSTEXIP ?? 000.000.000.000
* ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
   (X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\)).*\/by.*
{
 :0
 { CHECK=${MATCH} }

 :0
 * ? ${TEST} -f ${LOCALHOSTFILE} && (${ECHO} "${CHECK}" | ${GREP} -i -f ${LOCALHOSTFILE})
 { CHKLOCALTO=yes }
}

:0
* FIRSTEXIP ?? 000.000.000.000
* $ ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                     [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
     (X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                     [0-9][0-9]?[0-9]?(\]|\)).*by.*${DOMAIN}
{ CHKLOCALTO=yes }

:0
* FIRSTEXIP ?? 000.000.000.000
* $ ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                     [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
     (X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
               [0-9][0-9]?[0-9]?(\]|\)).*by.*${THISISP}
{ CHKLOCALTO=yes }


# Check to ensure that the IP you're looking at is not an ICANN non-routable IP address.
:0
* ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
   (X-)?Received: from.*(\[|\()(0\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\
                 1\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\
                 10\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\
                 127\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\
                 169\.254\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\
                 172\.16\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\
                 192\.0\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\
                 192\.168\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\
                 204\.152\.6[4-5]\.[0-9][0-9]?[0-9]?|\
                 22[4-9]\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\
                 23[0-1]\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?|\
                 255\.255\.255\.255)(\]|\))
{ CHKNONROUTABLE=yes }

:0
* FIRSTEXIP ?? 000.000.000.000
* CHKLOCALFROM ?? no
* CHKLOCALTO ?? yes
* CHKNONROUTABLE ?? no
{ LOCALTAG=yes }

:0 E
* CHKNONROUTABLE ?? no
{ LOCALTAG=yes }

:0
* LOCALTAG ?? yes
{
 LOCALTAG=no

 :0
 * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
    (X-)?Received: from ([0-9a-z][-_0-9a-z.])+ \((HELO|ELHO) \/([0-9a-z][-_0-9a-z]+\.)+(aero|biz|\
                   ([a-z][a-z][a-z][a-z]+\.br)|([a-z][a-z][a-z][a-z]+\.cc)|\
                   com|coop|de|edu|es|exp|fi|geek|gov|info|int|is|it|\
                   ([a-z][a-z][a-z][a-z]+\.lb)|llc|lnx|ltd|lv|\
                   med|mil|museum|name|net|nic|noc|nu|null|\
                   org|porn|pro|pt|se|([a-z][a-z][a-z]+\.st)|to|tv|\
                   ([a-z][a-z][a-z]+\.us)|ws|xxx\))
 {
  :0
  * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
     (X-)?Received: from ([0-9a-z][-_0-9a-z.])+ \((HELO|ELHO) \
               ([0-9a-z][-_0-9a-z]+\.)+\/[a-z0-9][-_a-z0-9]+\.[a-z][a-z]+ \(
  {
   :0
   { STRING=${MATCH} }

   :0
   * FIRSTEXIP ?? 000.000.000.000
   { FIRSTEXHELODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

   :0 E
   { SECONDEXHELODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

   :0
   { LOCALTAG=yes }
  }
 }

 :0
 * LOCALTAG ?? no
 * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
    (X-)?Received: from ([a-z0-9][-_a-z0-9]+\.)+(aero|biz|\
                   ([a-z][a-z][a-z][a-z]+\.br)|([a-z][a-z][a-z][a-z]+\.cc)|\
                   com|coop|de|edu|es|exp|fi|geek|gov|info|int|is|it|\
                   ([a-z][a-z][a-z][a-z]+\.lb)|llc|lnx|ltd|lv|\
                   med|mil|museum|name|net|nic|noc|nu|null|\
                   org|porn|pro|pt|se|([a-z][a-z][a-z]+\.st)|to|tv|\
                   ([a-z][a-z][a-z]+\.us)|ws|xxx) \(
 {
  :0
  * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
     (X-)?Received: from ([a-z0-9][-_a-z0-9]+\.)*\/[a-z0-9][-_a-z0-9]+\.[a-z][a-z]+ \(
  {
   :0
   { STRING=${MATCH} }

   :0
   * FIRSTEXIP ?? 000.000.000.000
   { FIRSTEXHELODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

   :0 E
   { SECONDEXHELODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

   :0
   { LOCALTAG=yes }
  }
 }

 :0
 * LOCALTAG ?? no
 * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
    (X-)?Received: from ([0-9a-z][-_0-9a-z.])+ \((HELO|ELHO) \/([0-9a-z][-_0-9a-z]+\.)+[a-z][a-z]\)
 {
  :0
  * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
     (X-)?Received: ([0-9a-z][-_0-9a-z.])+ \((HELO|ELHO) ([a-z0-9][-_a-z0-9]+\.)+\
               \/[a-z0-9][-_a-z0-9]+\.[a-z0-9][-_a-z0-9]+\.[a-z][a-z] \(
  {
   :0
   { STRING=${MATCH} }

   :0
   * FIRSTEXIP ?? 000.000.000.000
   { FIRSTEXHELODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

   :0 E
   { SECONDEXHELODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

   :0
   { LOCALTAG=yes }
  }
 }

 :0
 * LOCALTAG ?? no
 {
  :0
  * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
     (X-)?Received: from ([a-z0-9][-_a-z0-9]+\.)*\/[a-z0-9][-_a-z0-9]+\.\
               [a-z0-9][-_a-z0-9]+\.[a-z][a-z] \(
  {
   :0
   { STRING=${MATCH} }

   :0
   * FIRSTEXIP ?? 000.000.000.000
   { FIRSTEXHELODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

   :0 E
   { SECONDEXHELODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
  }
 }

 :0
 * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
    (X-)?Received: from ([0-9a-z][-_0-9a-z.])+ \((HELO|ELHO) \/([0-9a-z][-_0-9a-z]+\.)+\
                   [a-z][a-z]+\)
 {
  :0
  * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
     (X-)?Received: from ([0-9a-z][-_0-9a-z.])+ \((HELO|ELHO) \/([0-9a-z][-_0-9a-z]+\.)+\
                    [a-z][a-z]+\)
  {
   :0
   { STRING=${MATCH} }

   :0
   * FIRSTEXIP ?? 000.000.000.000
   { FIRSTEXHELOHOST=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

   :0 E
   { SECONDEXHELOHOST=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
  }
 }

 :0 E
 {
  :0
  * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
     (X-)?Received: from.*\(([a-z0-9][-_a-z0-9]+\.)+[a-z][a-z]+ (\[|\()
  {
   :0
   { STRING=${MATCH} }

   :0
   * FIRSTEXIP ?? 000.000.000.000
   { FIRSTEXHELOHOST=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

   :0 E
   { SECONDEXHELOHOST=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
  }
 }

 :0
 * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
    (X-)?Received: from ([0-9a-z][-_0-9a-z\.])+ \((HELO|ELHO) \/[0-9][0-9]?[0-9]?\
              \.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?
 {
  :0
  * FIRSTEXIP ?? 000.000.000.000
  { FIRSTEXHELOIP=${MATCH} }

  :0 E
  { SECONDEXHELOIP=${MATCH} }
 }

 :0 E
 * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
    (X-)?Received: from \/[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]? \(
 {
  :0
  { STRING=${MATCH} }

  :0
  * FIRSTEXIP ?? 000.000.000.000
  { FIRSTEXHELOIP=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

  :0 E
  { SECONDEXHELOIP=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
 }

 :0
 * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
    (X-)?Received: from .*($)?.*by ([a-z0-9][-_a-z0-9]+\.)+(aero|biz|\
                   ([a-z][a-z][a-z][a-z]+\.br)|([a-z][a-z][a-z][a-z]+\.cc)|\
                   com|coop|de|edu|es|exp|fi|geek|gov|info|int|is|it|\
                   ([a-z][a-z][a-z][a-z]+\.lb)|llc|lnx|ltd|lv|\
                   med|mil|museum|name|net|nic|noc|nu|null|\
                   org|porn|pro|pt|se|([a-z][a-z][a-z]+\.st)|to|tv|\
                   ([a-z][a-z][a-z]+\.us)|ws|xxx)( \[|\))
 {
  :0
  * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
     (X-)?Received: from .*($)?.*by ([a-z0-9][-_a-z0-9]+\.)*\/[a-z0-9][-_a-z0-9]+\.\
                    [a-z][a-z]+( \[|\))
  {
   :0
   { STRING=${MATCH} }

   :0
   * FIRSTEXIP ?? 000.000.000.000
   { FIRSTEXTODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

   :0 E
   { SECONDEXTODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
  }
 }

 :0 E
 {
  :0
  * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
     (X-)?Received: from .*($)?.*by ([a-z0-9][-_a-z0-9]+\.)*\
               \/[a-z0-9][-_a-z0-9]+\.[a-z0-9][-_a-z0-9]+\.[a-z][a-z]( \[|\))
  {
   :0
   { STRING=${MATCH} }

   :0
   * FIRSTEXIP ?? 000.000.000.000
   { FIRSTEXTODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

   :0 E
   { SECONDEXTODOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
  }
 }

 :0
 {
  :0
  * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
     (X-)?Received: from .*$(?).*by \/([a-z0-9][-_a-z0-9]+\.)+[a-z][a-z]( \[|\))
  {
   :0
   { STRING=${MATCH} }

   :0
   * FIRSTEXIP ?? 000.000.000.000
   { FIRSTEXTOHOST=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

   :0 E
   { SECONDEXTOHOST=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
  }
 }

 :0
 * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
    (X-)?Received: from (([a-z0-9][-_a-z0-9.]+)+ )?\(([a-z0-9][-_a-z0-9]+\.)+(aero|biz|\
                   ([a-z][a-z][a-z][a-z]+\.br)|([a-z][a-z][a-z][a-z]+\.cc)|\
                   com|coop|de|edu|es|exp|fi|geek|gov|info|int|is|it|\
                   ([a-z][a-z][a-z][a-z]+\.lb)|llc|lnx|ltd|lv|\
                   med|mil|museum|name|net|nic|noc|nu|null|\
                   org|porn|pro|pt|se|([a-z][a-z][a-z]+\.st)|to|tv|\
                   ([a-z][a-z][a-z]+\.us)|ws|xxx)( \[|\))
 {
  :0
  * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
     (X-)?Received: from (([a-z0-9][-_a-z0-9.]+)+ )?\(\
               ([a-z0-9][-_a-z0-9]+\.)*\/[a-z0-9][-_a-z0-9]+\.[a-z][a-z]+( \[|\))
  {
   :0
   { STRING=${MATCH} }

   :0
   * FIRSTEXIP ?? 000.000.000.000
   { FIRSTEXDOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

   :0 E
   { SECONDEXDOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
  }
 }

 :0 E
 {
  :0
  * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
     (X-)?Received: from (([a-z0-9][-_a-z0-9.]+)+ )?\(([a-z0-9][-_a-z0-9]+\.)*\
               \/[a-z0-9][-_a-z0-9]+\.[a-z0-9][-_a-z0-9]+\.[a-z][a-z]( \[|\))
  {
   :0
   { STRING=${MATCH} }

   :0
   * FIRSTEXIP ?? 000.000.000.000
   { FIRSTEXDOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

   :0 E
   { SECONDEXDOMAIN=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
  }
 }

 :0
 {
  :0
  * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
     (X-)?Received: from (([a-z0-9][-_a-z0-9.]+)+ )?\(\/([a-z0-9][-_a-z0-9]+\.)+[a-z][a-z]( \[|\))
  {
   :0
   { STRING=${MATCH} }

   :0
   * FIRSTEXIP ?? 000.000.000.000
   { FIRSTEXHOST=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }

   :0 E
   { SECONDEXHOST=`${ECHO} "${STRING}" | ${SED} -e 's/[^0-9A-Za-z]*$//g'` }
  }
 }

 :0
 * ^(X-)?Received: from.*(\[|\()[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
                   [0-9][0-9]?[0-9]?(\]|\))(.*$)+\
    (X-)?Received: from .*(\[|\()\/[0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?\.\
              [0-9][0-9]?[0-9]?\.[0-9][0-9]?[0-9]?
 {
  :0
  * FIRSTEXIP ?? 000.000.000.000
  { FIRSTEXIP=${MATCH} }

  :0 E
  { SECONDEXIP=${MATCH} }
 }
}

