MAILFROM END ENDSWITH @comcast.net REVDNS 5 ENDSWITH client.comcast.net
You could probably throw a list of END statements for various domains in there as long as you know the naming convention for the REVDNS entries and can isolate them to their residential IP space (which can't be done for all domains). Also note that this will often double hit with SPAMDOMAINS, and I do see some false positives on SPAMDOMAINS when boneheads buy themselves bulk-mail software to run on their residential-class service and use accounts on places like yahoo.com as the MAILFROM. I think this might be worth a few more points though.
Matt
Paul Fuhrmeister wrote:
An email is "from" [EMAIL PROTECTED] [24.5.121.88] AND was received from cib.co.za (c-24-5-121-88.client.comcast.net [24.5.121.88]
Is there a way to add weight when - received from client.comcast.net BUT sender is not "@comcast.net"
Here are example headers:
Received: from cib.co.za (c-24-5-121-88.client.comcast.net [24.5.121.88]) by mail17.**********.com (Postfix) with SMTP id 858D630F4B; Wed, 21 Apr 2004 21:25:31 -0500 (CDT) (envelope-from [EMAIL PROTECTED]) Message-ID: <[EMAIL PROTECTED]> From: "Tim Salazar" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED], [EMAIL PROTECTED] Subject: Pain Pills V.icodin Hy.drocodone Lortab Lorcet Norco Date: Thu, 22 Apr 2004 01:00:15 +0000 MIME-Version: 1.0 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: 8bit X-RBL-Warning: DSBL: "http://dsbl.org/listing?ip=24.5.121.88"; X-RBL-Warning: BLOCKTEXT: Message failed BLOCKTEXT test (line 394, weight 7) X-Declude-Sender: [EMAIL PROTECTED] [24.5.121.88] X-Declude-Spoolname: D2d2c2f4000be40bf.SMD X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 1049636097
Paul Fuhrmeister [EMAIL PROTECTED]
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
-- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
