Chris Hunt wrote:
> I'm getting similar emails like this one. Is there a way to filter
> the IP address in the HTML code (in the click here part)?
> Chris
> ===============================
>
> Received: from yahoo.com [192.168.1.1] by peake.com
> (SMTPD32-5.05) id ABC8A8770150; Sat, 04 Mar 2000 18:27:04 -0500
> From: <[EMAIL PROTECTED]>
> To: [EMAIL PROTECTED]
> Subject: You broke your promise
> Date: Sat, 4 Mar 2000 18:21:31
> Message-Id: <[EMAIL PROTECTED]>
> Mime-Version: 1.0
> Content-Type: text/html; charset="us-ascii"
> X-RCPT-TO: <[EMAIL PROTECTED]>
> X-UIDL: 4567
> Status: U
>
> CHECK OUT THE LATEST DISCOVERY IN
> XXX ADULT ENTERTAINMENT
> CLICK HERE
Something I do is look for:
.*Received.*Received.*Received.*
in the header. Spammers frequently bounce their messages off of a few
SMTP servers. This search string will perform the filter action when the
sender has bounced the message off of 4 SMTP servers. Most, (not all)
legitimate mail is delivered in less than 4 hops. I put this filter near
the bottom, so that other filters which direct mailing list traffic,
etc. can get to the messages first.
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
