On Fri, Feb 15, 2002 at 09:14:02AM -0600, SMORRIS(_at_)UP(_dot_)COM wrote:
Here is an example of what I'm trying to stop:
...
To: "Southeastern Internet University" <Bonanza(_at_)themail(_dot_)net>
From: "" <Bonanza(_at_)themail(_dot_)net>
Subject: College Degree in 2 Months!
...
Notice the To: line.... Now, I know that behind the scenes this obiviously
had a legitimate email address at my domain on it (or sendmail would have
rejected it as you pointed out), but if I can trap it based on the To: line
(since my domain is not called themail.net), that was the thought process
behind killing anything with a .net extension.
You could use something like:
:0:
* ! ^TO_myaddress(\+[a-z0-9]+)?@([a-z0-9]+\.)?anything.com
possiblespam
but that will still catch perfectly valid mail on which you were BCCd.
Another approach might be to make an "executive decision" about what
you consider an acceptable recipient format:
:0:
* ^To:.*""
possiblespam
and you can always filter by content:
:0:
* ^Subject:[ ]*([^a-z]?ADVT?:?[^a-z]|\
college degree in|\
get.+university diploma|\
accept credit card|\
major stock|\
million.*email addr|\
increase your ejaculation|\
adds?.*inche?s to .*penis|\
mortgage (loan.*eas|rates?.*(low|high))|\
your life insurance|\
[a-z]\ [a-z]\ [a-z]\ [a-z]\ [a-z]|\
[ ][ ][ ][ ][ ])
spam
etc. (As always, the whitespace range after "Subject:" consists of a
space and a tab.)
--
Paul Chvostek
<paul(_at_)it(_dot_)ca>
Operations / Development / Abuse / Whatever vox: +1 416 598-0000
it.canada http://www.it.ca/
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail