On Wed, 30 Oct 1996, Alan K. Stebbens wrote:
Another solution is to place all of the regexps into a file (for
example, called "spamsters"), and use an egrep against the possible
source addresses:
:0:spamsters.lock
* ? formail -xFrom -xFrom: -xReply-To: -xSender | \
egrep -s -f spamsters
| $FLUSHFILTER $LIST > /dev/null
The "formail" pulls out the possible source addresses, and the patterns
in the "spamsters" file are matched against the addresses. If the egrep
succeeds, then FLUSHFILTER is run.
This has the advantage that a spamster address occuring on any of the
source mail fields in the mail will can trigger a match, and not just
the From or From: headers.
This has one problem. It doesn't allow for the many spammers who aren't
above forgery.
Cyberpromo was extremely bad when it came to filtering due to the MANY
domains mail could have come from.
But a recipe like this handles all of thier garbage for me, without losing
anything I ever found of importance.
:0
*(cyberpromo|interramp|moneyworld)
*!^Subject:.*(cyberpromo|interramp|moneyworld)
/dev/null
Allows me to recieve mail discussing the twits, while dropping the twits
rather effectively.