procmail
[Top] [All Lists]

Re: homemade soap receipe (AND Beyond)

1997-12-10 23:57:50
On Wed, 10 Dec 1997, Eric Hilding wrote:
On Wed, 10 Dec 1997, Peter Seebach wrote:

I recommend
:0
* ^From:.*cyberpromo
/dev/null

Wouldn't that have to be:      * ^From:.*cyberpromo\.com 
                   (or)       * ^From:.*cyberpromo.*     

Both of your suggestions would also work.  The first is just being more
precise than Peter was; the second is adding an unnecessary ".*".  If
something matches "cyberpromo.*", it will also match "cyberpromo".

Speaking of numbers, the new constant influx of unsolicited
bombardments use a series of numbers in the bogus addresses,
like: 32859385(_at_)bogusdomain(_dot_)com or 19483753(_at_)3928475(_dot_)com  
or
3948578pu(_at_)392857stinks(_dot_)com (etc., etc.).

Is there an easy way to filter on, let's say, if the part
of the address either *before* or *after* the "@" symbol
has 5 or more SUCCESSIVE digits(numbers)?  This should be 
a safe bet, I would think...and not axe out some *legit* aol 
or prodigy mail addresses which often contain several numbers.

:0
* ()\/^From:.*\<([0-9]+@|@[0-9]+\.com)
* !^From:(_dot_)*(_at_)2600\(_dot_)com
{ SPAMMER="numbers at numbers: $MATCH" }

This recipe matches 12453(_at_)domain(_dot_)com or 
user(_at_)21414124(_dot_)com, but _only_
matches if no non-numerals are in the (user|domain) name.  2600.com is
excepted, as it is legit.  There are obviously other exceptions, but
none that I have yet encountered.  This recipe catches nearly all of my
spam which is forged in this manner.  It's not very careful about odd
addressing methods or even commented addressing, because I've never
encountered a spam which had both a From: forged in this manner and a
textual component (e.g. From: Gregory Sutter <134155151(_at_)fnord(_dot_)com>)

GReg
-- 
Gregory S. Sutter                       "How do I read this file?"
mailto:gsutter(_at_)pobox(_dot_)com                "You uudecode it."
http://www.pobox.com/~gsutter/          "I I I decode it?"

<Prev in Thread] Current Thread [Next in Thread>