procmail
[Top] [All Lists]

RE: Spammish?

2003-02-16 20:21:27
On Mon, 17 Feb 2003, Dallman Ross wrote:

I suspect I could construct a recipe that counted the Received:
lines based on the examples Don supplied this
morning; but do you have on that does that?

  * $  1^1  ^Received:
  { RCVD_COUNT = $= }

would work fine.

Dallman, I get some "false positives" on this.  Mostly from one domain
(servitall.com).  These folks end their message with 9 blank lines
followed by a period at the beginning of the next blank line.  This is
followed by "unsub" info between a couple of lines of "<<<>>> <<<>>>
<<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>> <<<>>>". (Another domain is
purepost.com)

Apparently procmail thinks the . at the beginning of the blank line is the
end of the message, and can't find any "Received:" headers in what follows
(of course) up to the real beginning of the next message.  So, of course,
the count here is 0. (And this part of the message is designated as from
foo(_at_)bar).

The recipe also, btw, goes beserk (bunches of 0 Received:) when it
encounters a digest in the mailbox. (I have one list I get digest mail
from).  And some idiot quoted an entire digest in another list.  Same
thing - 0 Received:

I get a count of 1 for mailer-daemon advisories and notes from cron.

I get a count of 2 for qmail stuff.  And again, procmail seems to think
there are two messages in this stuff because I get another count for the
same message right after the short count.

The recipe works swell; but I don't see how the results could be used.
The "analysis" above is from 2690 messages in a recent backup file.

                                - fleet -




_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>