procmail
[Top] [All Lists]

Re: spam from dynamic IP's

2004-06-27 16:52:43
Toen wij Dallman Ross kietelden, kwam er dit uit:

[fascistic German spam messages]
[...]
===> MSGID is ><9b6509bf71d3da(_dot_)2a082(_dot_)qmail(_at_)seic(_dot_)com><

A specific approach against these messages is on the Message-ID. 
qmail itself does not put letters in the first two parts, only 
numbers.

  $X   = "[a-z0-9]"
  $X5  = "$X$X$X$X$X"
  $X14 = "$X5$X5$X$X$X$X"
  regexp = "$X14\.$X5"

  :0:
  *$ ^Message-ID: <\/$regexp\.qmail@
  *  MATCH ?? ^^\/[^.]+\.[^.]+
  *  MATCH ?? [a-z]
  spam-german

(untested)


Variant:

  regexp = "..............\......"  # procmail-ese for .{14}\..{5}

  :0:
  *$ ^Message-ID: <\/$regexp\.qmail@
  *$ MATCH ?? ^^\/$regexp
  *  MATCH ?? [a-z]
  spam-german

(also untested)


-- 
Grtz, Ruud

____________________________________________________________
procmail mailing list   Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>