At 01:06 AM 2/16/98 -0600, Brad Knowles wrote:
[domain portion of major ISP Message-IDs matching domain of ISP]
What about mailing lists? Especially those run as entries in
/etc/aliases?
Do you know any MSN users who have /etc/aliases access *ON MSN* ? AOL? etc?
I mentioned SPECIFIC domains because _in my experience_ those specific
domains (and several others) generally have only had traffic which goes
through their mail servers, and are typically used by less sophisticated
crowds (not a jibe, just how many people who have AOL accounts are likely
to use a different account to send mail as if they were sending it from
their AOL account, even if valid?). There may be an exception here and
there, but I haven't run into one. Further, the rule does NOT apply to all
domains - just a handful I've collected, and which tend to predominate spam
forgeries. I run the same ruleset on yahoo(mail), lycosmail, excite,
hotmail, juno, etc. It catches a signifigant amount of spam, though I
check it after basic stuff like X-UIDL and mailerscum.
Besides, proper handling of a remailed message on a mailing list is to have
the list add "Resent-Message-ID:" with a list-generated Message-ID. The
original Message-ID is retained. Look at your procmail messages as an
example.
Then, at 01:03 AM 2/16/98 -0600, Brad Knowles wrote:
* ^(From|(Reply-)?To):[ ]+[0-9]+[a-z]+[0-9]+@
Be advised that rejecting all mail with a format like [0-9]+(_at_)(_dot_)+
will also refuse mail from MCImail, and last I heard they still had a
Fine, except that the filter won't match numeric only addresses - it
matches number(s) letter(s) number(s). That's what the '+' is for - ONE or
MORE. '*' is ZERO or MORE, which, if this expression used '*' for all the
stuff before the @, would match just about any alpha/numeric address, which
wouldn't be particularily handy unless you wanted to clean out your mailbox
in a hurry.
---
Please DO NOT carbon me on list replies. I'll get my copy from the list.
Sean B. Straw / Professional Software Engineering
Post Box 2395 / San Rafael, CA 94912-2395