procmail
[Top] [All Lists]

Re: annoying spam

2003-05-09 10:47:18
On  9 May, Michele Francis wrote:
| I have the recipe of
|  ^From:(_dot_)*\(_at_)bounce\(_dot_)azoogle\(_dot_)com|\
| 
| log:
| >From 90_6-26844-48200(_at_)bounce(_dot_)azoogle(_dot_)com  Fri May  9 
07:53:43 2003
|  Subject: FREEapplication for Loan ~~~ Any Credit Auto Loans!
|   Folder: /var/mail/test-1
| 
| but the emails get thru and I don't see any thing that won't catch
| these to go to /dev/null that I have specified.  The emails are getting
| thru, anyone have any suggestions.   Thanks.

The LOGABSTRACT from your logfile is logging the envelope and you're
trying to match the From: header.  The first is the topmost line if you
look at the full headers/source of the message and has no colon.  The
second is further down, has a colon, is almost certainly forged, but at
any rate does not match your condition.  Remove the colon from the
condition so it reads simply:

  ^From(_dot_)*(_at_)bounce\(_dot_)azoogle\(_dot_)com    # no need to escape @


-- 
Email address in From: header is valid  * but only for a couple of days *
This is my reluctant response to spammers' unrelenting address harvesting



_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>