I've been getting a lot of spam from the domain "telysis.com". Easy
enough to fix, you say, add "telysis.com" to the list of known-bad
domains. Well, there's a problem.
I usually get the domain via:
echo $SENDER|sed 's/.*@//g'
which works pretty good, except that "telysis.com" is getting tricky
and they are using different hostnames in their domain, such as
telysis4.telysis.com
which avoids detection from my above simple scheme, and every few
months they change the hostname. "softcell.net" is another culprit of
this.
These two domains have never produced anything but spam/uce for me,
and I would like to know how to:
1) catch their domain in the 'From' or 'From: ' line even if
they use additional hostnames
2) check for "softcell.net" or "telysis.com" in any of the
headers (From, Received, etc) and be able to match them
I know I have seen this before but a check through my procmail mailbox
did not turn up anything.
Any help appreciated
TjL