I got a few spams last month that had exclamation marks and dollar signs
in odd places in the headers. I decided to use scoring to look for
two or more of these. If there, then go on to do a certain body
grep that I won't get into here.
The Message-ID: header, though, often can have legit `$' chars in it.
I wanted to exclude that header. The following may or may not be
a bit sloppy (improvements solicited!); but it's what I came up with:
:0 i # two+ `!' or `$' symbols in headers . . .
* ! ^(Return-Path|Sender):.*list
* -175^0
* 100^1 [$!]
* -100^1 ^Message-ID:.*[$!]
{ do some other things if we're here }
So, I had a piece of mail come in that had two `$' chars in the
Message-ID: header. There were no other `!' or `$' signs in the
headers. The logs, though, showed a total score for this section
of -75, not -175! I don't understand how that could be.
Here is that section of the log (verbose format):
procmail: Match on ! "^(Return-Path|Sender):.*list"
procmail: Score: -175 -175 ""
procmail: Score: 200 25 "[$!]"
procmail: Score: -100 -75 "^Message-ID:.*[$!]"
--
Netcom has imploded. Please now use NOTnetcom.com for mail.
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Ex-Netcommies: Mail "forwards" for free forwarding service!
NOT affiliated with EarthLink, Inc.'s Netcom brand identity.
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail