procmail
[Top] [All Lists]

Re: Interesting spam pattern

1998-03-12 02:53:57
Chris Osborn wrote:

So, now I'm wondering what a rule to check to see if there's
a comment part in the From: header, in addition to the email
address, would look like. :-)

  The From: header on your message is...
From: "Chris Osborn" <fozztexx(_at_)fozztexx(_dot_)com>
  Going through my email inbox, I find a couple of points to
watch;
  1) Mailing lists tend to not have a name either.  Actually,
a spammer is effectively sending off stuff to a mailing list,
the one on his CD.  So this filter should be applied only
after your incoming mailing-list email has been delivered.
  2) The name may or may not be in quotes.  Don't depend on
quotes.  I've also seen some new users not put in their names
in their mailer programs, which may result in false positives.

So the filter rule would be something like...

:0:
* ! From: .*[a-z] .*@
junkmail

  We're looking for
  1) "From: " (note the trailing space) and
  2) at least one alpha character
  3) a trailing space after the name
  4) anything (alpha/numeric) followed by an "@" sign

  You can be stricter in the email address if you want.  This
is a first cut.

-- 
Walter Dnes (Toronto)
<waltdnes(_at_)interlog(_dot_)com>

<Prev in Thread] Current Thread [Next in Thread>