procmail
[Top] [All Lists]

Re: Spammer-slammer algorithm

1997-10-23 12:27:59

# SOFTFACTS-BLK-205-254 (Stomping grounds of Nevwest/Lostvegas)
# 205.254.164.0 - 205.254.167.0
:0Hi
* !^X-Advertisement:
* !^X-(0-9):.*(iemmc.com|remov)
* !^X-(0-9)(0-9):.*(iemmc.com|remov)
* !Received: from*\[207\.212\.65\.
* !Received: from*\[205\.199\.2\.
* !Received: from*\[205\.199\.212\.
* !Received: from*\[207\.87\.233\.(6[4-9]|[7-8][0-9]|9[0-5])\]
* !Received: from*\[205\.254\.16([4-6]\.*|7\.0)\]
$ORGMAIL

Others have commented on other parts of these recipes, particularly on
the opportunities to remove duplication in the regexps. Here are a few
more things to do and, and more importantly, to fix:

* !^X-(0-9):.*(iemmc.com|remov)
* !^X-(0-9)(0-9):.*(iemmc.com|remov)

should probably be recast as:

   !^X-[0-9]+:.*(iemmc\.com|remov)

or even

  * !^X-[0-9]+:.*\<(iemmc\.com|remov)

(all are valid syntactically, the semantics differ).


* !Received: from*\[205\.254\.16([4-6]\.*|7\.0)\]

should probably be recast as:

  * !^Received:[        ]+from.*\[205\.254\.16[4-7]\.

(and similarly, with respect to from*, for the preceding lines).


I would also deliver mail into $DEFAULT, not $ORGMAIL, absent a
specific reason not to use $DEFAULT.

-- 
Rik Kabel          Old enough to be an adult              
rik(_at_)netcom(_dot_)com

<Prev in Thread] Current Thread [Next in Thread>