procmail
[Top] [All Lists]

Spammer mistakes

2004-06-15 07:59:39
Has anyone had success with generating recipes based on "coding strings"
inadvertently included in spam messages?

Ie,

From %RNDLCCHAR514(_at_)hotmail(_dot_)com,
Message-ID: <%RNDUCCHAR2025(_at_)hotmail(_dot_)com>,
X-Message-Info: 0189RJBPED8870RND_UC_CHAR[1-3]vr47/OtLZzwlV13nXKti403aS
and X-sgxRND_LC_CHAR2: CIspjZCYQ

I'm assuming "RNDLCCHAR514" translates to "5 to 14 random lower case
characters."

L = [a-z]

:0 D
* $ ^^From $L$L$L$L$L+@
* $ ! ^^From $L$L$L$L$L$L$L$L$L$L$L$L$L$L$L@
spam

The above should match the "5 - 14 random lower case characters;" but is
there a more concise method of describing the range.

(FWIW, I consider X-Message-Info and X-(lowercase anything) indicitave of
spam so it really doesn't matter how they construct those. :) )

                                - fleet -



_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>
  • Spammer mistakes, fleet <=