The only way I can think of to currently block an e-mail address with an IP after the @ symbol would be something like:
MAILFROM 0 CONTAINS @1 MAILFROM 0 CONTAINS @2 However, this would also flag e-mail addresses like: [EMAIL PROTECTED] [EMAIL PROTECTED] I don't see how, with the current implementation of the filter file, that you could check just the extension of the e-mail address (i.e., .net, .com, .org, etc.). Maybe Scott would consider that as a future feature add. :) Maybe: MAILEXTBOGUS extinvalid x x 5 0 Where the e-mail address extension contains anything but valid/approved letter combinations. Or, maybe the MAILFROM (global.cfg) test could include the extension testing, if it is not already doing this. Bill -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Kami Razvan Sent: Sunday, January 19, 2003 12:17 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Return address <IP> Scott.. Thanks.. I guess this still leaves the other variation up for attack.. [EMAIL PROTECTED] We have seen this also.. When they are sending email with userID and IP. I guess one way to decipher this is if the last characters after the last period are not letters. Can that be a filter? Regards, Kami -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Sunday, January 19, 2003 2:50 PM To: [EMAIL PROTECTED] Subject: RE: [Declude.JunkMail] Return address <IP> >Is it a viable solution to filter the header for: > >From: <> No -- a spammer would probably send an E-mail with a return address ("MAIL FROM") of "<>", but have a header like "From: Youwill berich <[EMAIL PROTECTED]>". You could filter with something like: MAILFROM 2 CONTAINS <> -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This e-mail was scanned for viruses by Pointshare's Virus Scanning Service] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
