procmail
[Top] [All Lists]

Re: Filter Geocities.com Spam

2006-10-12 08:05:02
Jason Self schreef:

I'm trying to create a procmail recipe to move mail that has a
geocities.com link it in to a spam mailbox.

While searching Google I found this:
http://lists.surbl.org/pipermail/discuss/2005-October/005051.html

That recipe misses a lockfile-request (a colon-flag).


It doesn't seem to identify geocities.com links that don't have a
subdomain. Ideallly, it should match whether there is a subdomain or
not (http://uk.geocities.com/zevob83413 or
http://geocities.com/zevob83413). What would the proper way to modify
that recipe be? I've been reading up on regular expressions but don't
quite get it yet.

Are you aware that such a recipe would easily catch your message and my
reply as well?
There are often better ways to match those messages, like finding
patterns in the header.

But OK:

  :0
  * B ?? http://([0-9a-z]+\.)?geocities\.com/
  .IN.suspect/


(I assumed delivery to an IMAP-folder.)


Alternative:

  :0
  * B ?? (^|[^0-9a-z]|[=%]20)\
         http://([a-z]+(ÿ|\.|[=%]2E)?)geocities(ÿ|\.|[=%]2E)com\
         /[0-9a-z][-_0-9a-z]+/\?
  .IN.suspect/


I don't understand why that ÿ is in there though, ASCII-255?

The [=%] means either "=" or "%", I am not sure that is right.
The 2E is the hexadecimal representation of the ASCII value of dot.

-- 
Groet, Ruud


____________________________________________________________
procmail mailing list   Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>