Ruud H.G. van Tol wrote:
This should eliminate all HTML messages
:0:
* ^Content-Type: text/html
blue-spam
Check the headers of any messages that you think should have been
caught. The Content-Type:header will no doubt be different.
:0HB:
* ^Content-Type:.*text/html
blue-spam
You need to search the body as well as the header, as most (properly
formatted) HTML messages will be multipart/alternative with a text/plain
and a text/html part. The header will have multipart/alternative.
[...] I continue to receive these
Viagra emails, about two every 12 hours, the latest of which I've posted
below.
:0 :
* B ?? (pr...|c...|p...|viagra)
red-spam
That reg.exp is far to broad. A dot matches any letter. Or did you
munge it? Better mention if you did.
Content-Type: text/plain
Content-Transfer-Encoding: base64
[...]
Buy Viagra and Cialas Aka "Super Viagra"..The Viagra that last all
weekend!.. and other popular medications. Next-Day Fedex
That body fragment doesn't look like base64-encoded plain-text.
I assume you copied the header and the body in two different ways
into your message to us.
To catch base64-encoded text with non-base64-encoded reg.exps won't
work. Either uncode the body first, or use reg.exps that actually
match what you receive.
Or just send any message with these headers
Content-Type: text/plain
Content-Transfer-Encoding: base64
to some color-spam-box, because it
sure is a silly combo.
:0:
* ^Content-Type:.*text/plain
* ^Content-Transfer-Encoding:.*base64
silly-spam
--
Andrew Edelstein - http://blogs.pure-chaos.com/andrew/
AIM - strongbow1800
YM - strongbow_100
MSN - strongbow1800(_at_)hotmail(_dot_)com
ICQ - 2319600
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail