era wrote:
On Thu, 23 Sep 1999 11:01:37 -0500, David Stone
<dstone(_at_)chem(_dot_)utoronto(_dot_)ca> wrote:
I recently had a spam sneak through filters with the following
header:
From: mailer_daemon151(_at_)yahoo(_dot_)com
[snip]
What I do is check if the From_ line and the From: line resemble each
other. Usually the ones which are From_ mailer_daemon are From:
typicalspammer093450(_at_)freemail(_dot_)net and vice versa.
I'm not sure I understand what you're saying here: in my particular case
there was exactly ONE From: line (as indicated above) and NO From_ line.
In fact, I just got another spam which was identical except for being
From: mailer_daemon141(_at_)yahoo(_dot_)com
Are you trying to suggest something like the following?
:0:
* FROM_MAILER
* ! ^From: .*[a-zA-Z].*[0-9]@
adminbox
the intent of which is to direct real admin mail to the right spot,
but let fake admin mail pass through to the rest of the filter.
(Assumes that the "fake" address will have the mail(er) part at the
front as in the above example)
Thanks for any more insights, corrections or suggestions!
Dave Stone