procmail
[Top] [All Lists]

Re: A spammer from China

2000-02-27 20:54:00
On Mon, 28 Feb 2000, Lars Hecking wrote:

Bert Hiddink writes:
Hello,  

Since a couple of month, I am spammed by Chinese messages (see end of 
 this message for sample): 

My hosting provider suggested me the following script, as there is  
one thing they all have in common. They are all sent from Asia. As I  
do not expect to ever receive any real mail from Asia, I tried the  
following: 

:0h 
* \[202\. 
/dev/null 

That should filter out any mail coming from an ISP or mail server in 
the 202.0.0.0 IP block. 202.0.0.0 - 203.255.255.0 are allocated for  
the APNIC for networks in the Asia/Pacific area.  

However, in practice, there are still messages slipping through. 

Another suggestion was to filter for strange caracters like ûÄêÊ in  
subject and body.  

What I would like is to combine the two above, something like: 
"if messages contains this IP-address and(!) that caracter in the  
body, then remove message" 

Is it possible to do AND-ing with procmail receipts? 

Could you help me with a sample receipt! 

Didn't see the original, since it matched as spam.  :)

:0
* ^Received:.*\.cn[     ("]
/dev/null

 Maybe next time you could consult the mailing list archives at
 http://www.rosat.mpe-garching.mpg.de/mailing-lists/procmail/
 before spamming the list with 160kB of crap. Some people pay for
 their downloads.

So, you always check archives, man pages, and printed resources before
asking a question, rigt?

-- 
As long as the answer is right, who cares if the question is wrong?

<Prev in Thread] Current Thread [Next in Thread>