cory wrote:
I'm currently filtering mail using home-grown rules.  Any messages that
aren't TO_ me and contain certain keywords in the subject or body get sent
to a spam file, which is deleted periodically.  Works good.
Unfortunately, some spam gets through.  Most often it's of the form:
From: getrichquick(_at_)somefakedomain(_dot_)com
To: cory(_at_)olga(_dot_)net, cory(_at_)someotherdomain(_dot_)com, 
cory(_at_)yetanotherdomain(_dot_)com
Cc: cory(_at_)andanother(_dot_)com, etc...
I'm having trouble forming the recipe to filter out spam with these 
headers.  
Here's a starting point...
    ################ sample code begins
    :0
    * ! ^TO_cory(_at_)olga\(_dot_)net
    spam
    # If we get here, there was at least "cory(_at_)olga(_dot_)net" in the
    # header.  Were there any more?  
    # NOTE: this recipe isn't perfect.  It won't identify
    #       "cory(_at_)olga(_dot_)net(_dot_)otherdomain(_dot_)com" as a bogus 
address, but
    #       probably the mail will have "cory(_at_)someotherdomain(_dot_)com" or
    #       something like that in it, so it's likely "good enough"
    :0
    * ! ^TO_cory(_at_)[^o]
    * ! ^TO_cory(_at_)o[^l]
    * ! ^TO_cory(_at_)ol[^g]
    * ! ^TO_cory(_at_)olg[^a]
    * ! ^TO_cory(_at_)olga[^(_dot_)]
    * ! ^TO_cory(_at_)olga\(_dot_)[^n]
    * ! ^TO_cory(_at_)olga\(_dot_)n[^e]
    * ! ^TO_cory(_at_)olga\(_dot_)ne[^t]
    { 
        # There were NOT!  So skip the next recipe.
    }
    :0 E
    # in other words, there WAS cory(_at_)somewhereElse; spam-file it.
    spam
    ################ end of sample code
Untested of course.
-- 
Neither I nor my employer will accept any liability for any problems
or consequential loss caused by relying on this information.  Sorry.
Collin Park                         Not a statement of my employer.
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail