Getting through

Using the below rules I am catching alot of SPAM, however even one of the
rules matches some get through. For instance a large mailing comes in a
few individuals well forward me copies of SPAM that I have recorded in
either Procmail.head, or SPAM. Can someone explain how some are getting
through?

PATH=/usr/bin:/bin
SHELL=/bin/sh
SPAM=/export/SPAM/SPAM

# Extract To: and From: addresses
WHOFROM=`formail -xFrom: \
         | sed -e 's/  */ /g' \
         | expand | sed -e 's/^[ ]*//g' -e 's/[ ]*$//g'`

WHOTO=`formail -xTo: \
          | sed -e 's/  */ /g' \
          | expand | sed -e 's/^[ ]*//g' -e 's/[ ]*$//g'`
# Compare To: and From: addresses
:0:
* $ WHOFROM ?? ${WHOTO}
* $ WHOTO ?? ${WHOFROM}   
* ! ^To:(_dot_)*(_at_)dsrnet(_dot_)com
$SPAM


# All numbers .com, .net, or .org
:0: 
* ^(From:|Reply-To:)(_dot_)*(_at_)[0-9][0-9]*\(_dot_)(com|net|org) 
/dev/null

:0:
* ^Subject:.*xxx
{
        :0Ah:/export/home/clc/Procmail.head.lock
        | cat >> /export/home/clc/Procmail.head
}
:0:
* ^Subject:.*Work from home
{
        :0Ah:/export/home/clc/Procmail.head.lock
        | cat >> /export/home/clc/Procmail.head
}
:0:
* ^Subject:.*Ultimate honor
{
        :0Ah:/export/home/clc/Procmail.head.lock
        | cat >> /export/home/clc/Procmail.head
}
:0:
* ^Subject:.*viagra
{
        :0Ah:/export/home/clc/Procmail.head.lock
        | cat >> /export/home/clc/Procmail.head
}
:0:
* ^Subject:.*sex
{
        :0Ah:/export/home/clc/Procmail.head.lock
        | cat >> /export/home/clc/Procmail.head
}
:0:
* ^To:.*sex.com
{
        :0Ah:/export/home/clc/Procmail.head.lock
        | cat >> /export/home/clc/Procmail.head
}
:0:
* ^To:.stuff
{
        :0Ah:/export/home/clc/Procmail.head.lock
        | cat >> /export/home/clc/Procmail.head
}
:0:
* ^To:.*foryou
{
        :0Ah:/export/home/clc/Procmail.head.lock
        | cat >> /export/home/clc/Procmail.head
}
:0:
* ^To:.*your
{
        :0Ah:/export/home/clc/Procmail.head.lock
        | cat >> /export/home/clc/Procmail.head
}
# No To: line
:0
* !^To:
$SPAM
:0 D:
* ^Subject:.*MILLION
{
        :0Ah:/export/home/clc/Procmail.head.lock
        | cat >> /export/home/clc/Procmail.head
}
:0:
* ^To:.*Undisclosed.recipients@
{
        :0Ah:/export/home/clc/Procmail.head.lock
        | cat >> /export/home/clc/Procmail.head
}
:0:
* ^To:.*Undisclosed.Recipients@
{
        :0Ah:/export/home/clc/Procmail.head.lock
        | cat >> /export/home/clc/Procmail.head
}
:0:
* ^To:.*hahaha
{
        :0Ah:/export/home/clc/Procmail.head.lock
        | cat >> /export/home/clc/Procmail.head
}
# The "To:" line is empty
:0
* ^To: $
$SPAM

# The "From:" line is empty

:0
* ^From: $
$SPAM


Cris Collins

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail