I've been using procmail on my mail server (Sendmail) for years with good
success in filtering spam, along with MailScanner, SpamAssassin and clamav and
some home-grown procmail recipes. However, for the last month or so, we've
seen new spam using a lot of images (with text in the images), making it
difficult to block.
One thing in common is a (bogus) "unsubscribe" image in the footer of the
message, centered. I've been filtering using one rule like:
* center.*a
href\=.*http(.|$)*img.*src\=.*http(.|$)*.(jpg|gif|png).*\/a(.|$)*\/ce(.|$)*nte(.|$)*\/body(.|$)*\/html
to catch a centered image at the bottom of the message (just before the end of
the HTML).
I had figured out that the procmail sequence (.|$)* will filter on a character
OR end of line - because they're sneaky and often break their lines in a weird
way.
I realize this is very broad, so I also filter on other characteristics, which
I won't describe here ;-)
The problem is that sometimes the spammer is sending broken HTML - no
opening/closing <html> or <body> etc. They count on the fact that many email
programs will still display the remaining HTML even though it is seriously
flawed - and they're right.
So what I wanted to do was filter on the html & image immediately followed by
end-of-file instead of the closing html tags.
I know that $ is end of line. How do I specify end-of-file? I've looked
through the FAQ and searched and haven't come up with anything.
Thanks in advance,
Fred
____________________________________________________________
procmail mailing list Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)de
http://mailman.rwth-aachen.de/mailman/listinfo/procmail