procmail
[Top] [All Lists]

Re: Interesting spam pattern

1998-03-12 08:37:22
On Thu, 12 Mar 1998 04:37:18 -0500,
Walter Dnes <waltdnes(_at_)interlog(_dot_)com> wrote:
  We're looking for
  1) "From: " (note the trailing space) and
  2) at least one alpha character
  3) a trailing space after the name

Not necessarily. For example, a lot of (IMHO broken) Post.Office and
Netscape Mail server generate From: lines like this:

    From: Mail Administrator<Postmaster(_at_)ugh(_dot_)domain(_dot_)net>

which is still perfectly valid, as far as I can tell (even though it's
ugly). 

:0:
* ! From: .*[a-z] .*@
junkmail

Skip the spaces and try something like

    :0:
    * ! ^From:(.*\<)[^@<>       ](.*\<)[^@<>    ]+(_at_)[^@<>   ]+\.
    ... whatever

This is not going to work for local mail ("From: me", implicitly
"From: me(_at_)the-same-domain-as-you") but you can probably handle that as
a special case.

/* era */

-- 
 Paparazzi of the Net: No matter what you do to protect your privacy,
  they'll hunt you down and spam you. <http://www.iki.fi/~era/spam/>

<Prev in Thread] Current Thread [Next in Thread>