Re: trapping fake hotmail

I suggested to Paul,

|  :0
|  * ^From:(_dot_)+(_at_)hotmail\(_dot_)com\>
|  {
|   :0
|   * ^From: ".+" <[a-z0-9_(_dot_)-]+(_at_)hotmail\(_dot_)com>
|   * ^X-Keywords:
|   * ^X-OriginalArrivalTime:
|   * ^X-UID: [0-9]+$
|   * ^Content-Length: [0-9]+$
|   * ^Lines: [0-9]+$
|   * ^From:(_dot_)+(_at_)(_dot_)
|   * ^X-Originating-IP: \[[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+]
|   * ^Received: from hotmail.com (\/...
|   * $ ^Message-ID: <${MATCH}(_dot_)+(_at_)hotmail\(_dot_)com>
|   { }
|
|   :0 Efhw
|   | formail -A "X-spamtrap: fake hotmail"
|  }

or

|  :0fhw
|  * ^From:(_dot_)+(_at_)hotmail\(_dot_)com\>
|  * 10^0
|  * -1^0 ^From: ".+" <[a-z0-9_(_dot_)-]+(_at_)hotmail\(_dot_)com>
|  * -1^0 ^X-Keywords:
|  * -1^0 ^X-OriginalArrivalTime:
|  * -1^0 ^X-UID: [0-9]+$
|  * -1^0 ^Content-Length: [0-9]+$
|  * -1^0 ^Lines: [0-9]+$
|  * -1^0 ^From:(_dot_)+(_at_)(_dot_)
|  * -1^0 ^X-Originating-IP: \[[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+]
|  * -1^0 ^Received: from hotmail.com (\/...
|  * -1^0 $ ^Message-ID: <${MATCH}(_dot_)+(_at_)hotmail\(_dot_)com>
|  | formail -A "X-spamtrap: fake hotmail"

I just noticed that one of his original conditions is redundant.  Anything
matching
  ^From: ".+" <[a-z0-9_(_dot_)-]+(_at_)hotmail\(_dot_)com>
or for that matter matching
  ^From:(_dot_)+(_at_)hotmail\(_dot_)com\>
will perforce match
   ^From:(_dot_)+(_at_)(_dot_)

So let's make the above two into these:

  :0
  * ^From:(_dot_)+(_at_)hotmail\(_dot_)com\>
  {
   :0
   * ^From: ".+" <[a-z0-9_(_dot_)-]+(_at_)hotmail\(_dot_)com>
   * ^X-Keywords:
   * ^X-OriginalArrivalTime:
   * ^X-UID: [0-9]+$
   * ^Content-Length: [0-9]+$
   * ^Lines: [0-9]+$
   * ^X-Originating-IP: \[[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+]
   * ^Received: from hotmail.com (\/...
   * $ ^Message-ID: <${MATCH}(_dot_)+(_at_)hotmail\(_dot_)com>
   { }

   :0 Efhw
   | formail -A "X-spamtrap: fake hotmail"
  }

and

  :0fhw
  * ^From:(_dot_)+(_at_)hotmail\(_dot_)com\>
  * 9^0
  * -1^0 ^From: ".+" <[a-z0-9_(_dot_)-]+(_at_)hotmail\(_dot_)com>
  * -1^0 ^X-Keywords:
  * -1^0 ^X-OriginalArrivalTime:
  * -1^0 ^X-UID: [0-9]+$
  * -1^0 ^Content-Length: [0-9]+$
  * -1^0 ^Lines: [0-9]+$
  * -1^0 ^X-Originating-IP: \[[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+]
  * -1^0 ^Received: from hotmail.com (\/...
  * -1^0 $ ^Message-ID: <${MATCH}(_dot_)+(_at_)hotmail\(_dot_)com>
  | formail -A "X-spamtrap: fake hotmail"

respectively.  It should be noted that mail sent through Pop3Hot will be
branded as fake, but there probably isn't enough of that to worry about.




_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail