procmail
[Top] [All Lists]

Re: crud in subject line - spam trap

2002-11-03 05:34:28
(Sample subject lines)

  Subject: [1$0m]A&2H8 0#:4;g @Z0]Au 0x0m...>H3;9...
  Subject: (1$0m)<x0#(_at_)G <1EC(_at_)L @N;}@; AB?lGQ4Y!!!
  Subject: ':N:N0! GT22 :80m Aq1b4B 193; CVCJ <:@N;g(_at_)LF(_dot_)'
  Subject: [1$0m]<v(_at_)T@/>F?kG0, @O:;<v(_at_)T18A& AA@:>F0!?J 180fGO<<?d!
  Subject: Hi Professor, Ultra-Thin Si Inventory 30um & 50um thin 2"-6" in 
stock...
  Subject: VP9zWn4s5DMxBgSNO7Mf<RLl5X
  Subject: Dates For All 1681HdVP8-2-10

Can someone point me to URLs or etc that discuss using procmail for
finding a percentage of unreasonable stuff in subject line.

Well here's an example of how you can do this kind of thing:

 :0
 * ^Subject:\/.*
 {
   :0:
   * MATCH ?? 10^1 [^0-9a-z ]
   * MATCH ?? -1^1 [0-9a-z ]
   tenpercent
 }

First the subject line is captured into $MATCH.  Then in the nested
recipe:
  10 is added to the score for each character that is not a digit,
letter or space;
  1 is subtracted from the score for each character that is a digit,
letter or space.

The result is a positive score if non-space non-alphanumeric characters
take up more than about 10% of the subject line, and any such mails get
delivered to the tenpercent mailbox.  Other mails fall through  to be
processed by later recipes.

Clearly you can adjust the score values to tune it to something more
appropriate to you than 10%.  And you might well want to change the set
of 'suspicious' characters.  For instance, you might want to compare the
number of upper/lower case letters (in which case remember to use the
'D' flag for case sensitivity!).  But hopefully it gives you the idea.

Hope that helps,
Martin
-- 
Martin McCarthy                 /</    http://procmail.non-prophet.org
    `Procmail Companion'        \>\
     Addison Wesley             /</                  PGP key available

_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail