>> I seems to be getting a lot of messages with no body from suspicious
looking addresses, I'm guessing they're broken spams.
>
> There are some SARE rules that will catch most all of these. Usually
they are missing Subject, To, and the body. Makes 'em easy to catch.
Could you point me at which set of rules this will be?
>> I'm also getting
>> messages with a double linebreak in the headers section which means
they get past my .procmailrc rules (to bin mail sent to defunct
addresses) as well as getting through SA.
>
> Are these the webcam-porn spams that start out with "Hi, my name is
Tiffany"
> or the like, and have the extra break right near the end of the headers?
Whoever is sending those out has either broken ratware or a VERY poor
knowledge of correct email formatting. I haven't done a set of rules
for these since the standard SARE rules and some local ones are doing a
fine job. But it wouldn't be hard to write a few specific rules for
those puppies.
No, I've already added a 'Tiffany' rule. An example message is below, I
don't know enough about writing rules to catch these. Any help
appreciated!
--------------------------------
X-POP3-From: [EMAIL PROTECTED]
Return-path: <[EMAIL PROTECTED]>
Envelope-to: [EMAIL PROTECTED]
Delivery-date: Sat, 17 Jul 2004 07:37:59 +0100
Received: from domain by server.isp.com with local (Exim 3.36 #1)
id 1Blipb-0001MT-00
for [EMAIL PROTECTED]; Sat, 17 Jul 2004 07:37:59 +0100
Received: from cpe-66-190-155-137.hky.nc.charter.com ([66.190.155.137])
by server.isp.com with smtp (Exim 3.36 #1)
id 1BlipZ-0001Kq-00; Sat, 17 Jul 2004 07:37:57 +0100
Received: from 0.236.176.152 by 66.190.155.137; Sun, 18 Jul 2004 02:33:28
-0400
Message-Id: <[EMAIL PROTECTED]>
From: [EMAIL PROTECTED]
Bcc:
Date: Sat, 17 Jul 2004 07:37:57 +0100
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on
server.isp.com
X-Spam-Status: No, hits=2.5 required=5.0 tests=HTML_20_30,HTML_IMAGE_ONLY_06,
HTML_MESSAGE,NO_REAL_NAME autolearn=no version=2.63
X-Spam-Level: **
Newsletter Issue: 8
From: "Lea Lozano" <[EMAIL PROTECTED]>
Reply-To: "Lea Lozano" <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Subject: companionway
Date: Sun, 18 Jul 2004 04:29:28 -0200
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="--064088747150152730"
----064088747150152730
Content-Type: text/html;
Content-Transfer-Encoding: 7Bit
<html><br><a href="http://perso.wanadoo.es:80/rrkity/DirectThem.exe";><img
border="0" src="http://perso.wanadoo.es/rrkity/3.jpg?kenney";></a><br>yip
retardation calculus birmingham elephant compton brush newsletter</html>
----064088747150152730--
![http://perso.wanadoo.es/rrkity/3.jpg?kenney"](http://perso.wanadoo.es/rrkity/3.jpg?kenney"){kind=link}