On Wed, 31 Dec 1997, Professional Software Engineering wrote:
Rather than filter these services out as pure spam, I decided to make them
special-case filters - if the Message-ID doesn't contain the proper domain,
then the message is dumped as a spam:
:0
* ^From:(_dot_)*(_at_)juno\(_dot_)com
* ! ^Message-ID:.*juno\.com
I use just that recipe:
# Forged mail from {hotmail, usa, juno}.
:0
* ^From:.*@((hotmail|juno).com|usa.net)
* !^(Received|Message-Id):.*((hotmail|juno).com|usa.net)
{ SPAMMER="forged hotmail/usa/juno" }
Any recommendations for improvements? How about sample headers from other
mail services similar to juno and hotmail?
It works for usa.net as well. I'm not sure of any others.
This also works fairly well:
:0
* ^Received:.*((hotmail|juno|bigfoot|rocketmail).com|usa.net).*uu.net
{ SPAMMER="forged bigfoot/hotmail/juno/rocketmail/usa" }
It handles Received: headers which report as:
Received: from fake5312.hotmail.com (1cust2112.max42.seattle.uu.net)...
GReg
--
Gregory S. Sutter "How do I read this file?"
mailto:gsutter(_at_)pobox(_dot_)com "You uudecode it."
http://www.pobox.com/~gsutter/ "I I I decode it?"