procmail
[Top] [All Lists]

Re: identical From and To headers

1997-10-13 10:22:38
At 08:55 AM 10/13/97 -0700, { brad brace } wrote:

Much of the spam I receive has identical From and To headers->

From: jrmaxx97(_at_)qlink2info(_dot_)com
To: jrmaxx97(_at_)qlink2info(_dot_)com
Subject: Free To Start

What recipe would recognize this?

Your question has been answered in another post, so I won't go into that.
However, I'd caustion you to consider writing the recipe, then passing your
message archives into it to see what messages get caught by it.

Some outbound-only mailing lists utilize FROM=TO (esp. ones run by
individuals without access to a listserve).  It isn't that uncommon to send
the message TO yourself, and BCC all the regular recipients (which keeps
them in the dark about each other).  At least, don't /dev/null it.

Now, if you're matching the FULL text (comments included) of the two lines,
you'll probably reduce your false hit rate, but then, some of the spam will
probably get through too.

---
 Please DO NOT carbon me on list replies.  I'll get my copy from the list.

 Sean B. Straw / Professional Software Engineering
 Post Box 2395 / San Rafael, CA  94912-2395